sqrl-rails 0.1.0

data/lib/sqrl/rails/password_policy.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    # Enforces the two account-policy signals a SQRL client can send with +ident+:
+    #
+    # * +sqrlonly+ – "disable all non-SQRL authentication": password logins for the user
+    #   must be refused ({Sessions}).
+    # * +hardlock+ – "disable all non-SQRL account recovery": password resets for the
+    #   user must be refused ({Passwords}).
+    #
+    # The concerns target the controllers that `bin/rails generate authentication`
+    # produces (the generator adds the +include+ lines), but work in any controller that
+    # takes an email address or a password-reset token:
+    #
+    #   class SessionsController < ApplicationController
+    #     include SQRL::Rails::PasswordPolicy::Sessions      # before_action on :create
+    #   end
+    #
+    #   class PasswordsController < ApplicationController
+    #     include SQRL::Rails::PasswordPolicy::Passwords     # before_action on :create, :edit, :update
+    #   end
+    #
+    # Override +sqrl_policy_user+ to change how the user is looked up, and
+    # +sqrl_policy_refused(reason)+ to change the response (the default redirects to the
+    # sign-in page with a flash alert from the +sqrl.password_policy+ translations).
+    module PasswordPolicy
+      # Shared lookup and response helpers.
+      module Base
+        extend ActiveSupport::Concern
+
+        private
+
+        # The user the current request is about: by +email_address+/+email+ parameter,
+        # or by password-reset token when the request carries one.
+        #
+        # @return [Object, nil]
+        def sqrl_policy_user
+          return @user if instance_variable_defined?(:@user) && @user
+
+          model = SQRL::Rails.config.user_model
+          token = params[:token].presence
+          if token
+            found =
+              if model.respond_to?(:find_by_password_reset_token)
+                model.find_by_password_reset_token(token)
+              elsif model.respond_to?(:find_by_token_for)
+                model.find_by_token_for(:password_reset, token)
+              end
+            return found if found
+          end
+          email = params[:email_address].presence || params[:email].presence
+          return nil if email.nil? || !model.respond_to?(:column_names)
+
+          column = %w[email_address email].find { |c| model.column_names.include?(c) }
+          column && model.find_by(column => email.to_s.strip.downcase)
+        rescue StandardError
+          nil
+        end
+
+        # Respond to a refused request. +reason+ is +:sqrl_only+ or +:hard_lock+.
+        def sqrl_policy_refused(reason)
+          message = I18n.t("sqrl.password_policy.#{reason}",
+                           default: if reason == :sqrl_only
+                                      "This account signs in with SQRL only."
+                                    else
+                                      "Password recovery is disabled for this account; use SQRL."
+                                    end)
+          flash[:alert] = message if respond_to?(:flash)
+          target = sqrl_policy_redirect_path
+          redirect_to target, allow_other_host: false
+        end
+
+        def sqrl_policy_redirect_path
+          if respond_to?(:new_session_path, true)
+            send(:new_session_path)
+          elsif respond_to?(:root_path, true)
+            send(:root_path)
+          else
+            "/"
+          end
+        end
+      end
+
+      # Refuses password logins for +sqrlonly+ users.
+      module Sessions
+        extend ActiveSupport::Concern
+        include Base
+
+        included do
+          before_action :refuse_password_login_for_sqrl_only_users, only: :create
+        end
+
+        private
+
+        def refuse_password_login_for_sqrl_only_users
+          user = sqrl_policy_user
+          sqrl_policy_refused(:sqrl_only) if user && SQRL::Rails.sqrl_only?(user)
+        end
+      end
+
+      # Refuses password resets for +hardlock+ users.
+      module Passwords
+        extend ActiveSupport::Concern
+        include Base
+
+        included do
+          before_action :refuse_password_reset_for_hard_locked_users, only: %i[create edit update]
+        end
+
+        private
+
+        def refuse_password_reset_for_hard_locked_users
+          user = sqrl_policy_user
+          sqrl_policy_refused(:hard_lock) if user && SQRL::Rails.hard_locked?(user)
+        end
+      end
+    end
+  end
+end

data/lib/sqrl/rails/rate_limited.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    # A small, version-independent rate limiter for the engine's public actions,
+    # configured through +config.sqrl.rate_limit = { to: 60, within: 1.minute }+.
+    # Requests are counted per client IP (or per +by:+ callable) in +Rails.cache+ (or the
+    # +cache:+ option); over the limit the action answers 429. +nil+ (the default)
+    # disables it. Works on Rails 7.1 as well as on versions that have their own
+    # +rate_limit+ macro.
+    module RateLimited
+      extend ActiveSupport::Concern
+
+      included do
+        before_action :sqrl_enforce_rate_limit
+      end
+
+      # The configured limit for an action name, or nil.
+      #
+      # @param action [Symbol] +:cli+, +:login+, +:status+, +:callback+, +:identities+
+      # @return [Hash, nil]
+      def self.limit_for(action)
+        limit = SQRL::Rails.config.rate_limit
+        return nil unless limit.is_a?(Hash) && limit[:to] && limit[:within]
+
+        only = limit[:only]
+        return nil if only && !Array(only).map(&:to_sym).include?(action.to_sym)
+
+        limit
+      end
+
+      private
+
+      # Name used to scope the limit; controllers override it.
+      def sqrl_rate_limit_scope
+        :cli
+      end
+
+      def sqrl_enforce_rate_limit
+        limit = RateLimited.limit_for(sqrl_rate_limit_scope)
+        return unless limit
+
+        by = limit[:by] ? limit[:by].call(request) : request.remote_ip
+        cache = limit[:cache] || ::Rails.cache
+        window = limit[:within].to_i
+        bucket = (Time.now.to_i / window).to_s
+        key = "sqrl:rate_limit:#{sqrl_rate_limit_scope}:#{by}:#{bucket}"
+        count = cache.increment(key, 1, expires_in: window)
+        if count.nil?
+          # Stores without increment support (or a missing key on some stores): fall back
+          # to a read/write cycle. Not atomic, but still bounded.
+          count = cache.read(key).to_i + 1
+          cache.write(key, count, expires_in: window)
+        end
+        return if count <= limit[:to].to_i
+
+        response.set_header("retry-after", (window - (Time.now.to_i % window)).to_s)
+        head :too_many_requests
+      end
+    end
+  end
+end

data/lib/sqrl/rails/sign_in.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    # The default sign-in adapter and redirect resolution.
+    module SignIn
+      # Session key used by the plain-session fallback.
+      SESSION_USER_KEY = :user_id
+      # Session key holding the user's class name in the plain-session fallback.
+      SESSION_USER_TYPE_KEY = :sqrl_user_type
+
+      module_function
+
+      # Sign +user+ in on +controller+.
+      #
+      # 1. Rails' generated +Authentication+ concern: +start_new_session_for(user)+.
+      # 2. Warden (if the app uses it directly): +warden.set_user(user)+.
+      # 3. Fallback: +session[:user_id]+ (and the user's class name).
+      def default(controller, _identity, user)
+        if controller.respond_to?(:start_new_session_for, true)
+          controller.send(:start_new_session_for, user)
+        elsif controller.request.env["warden"].respond_to?(:set_user)
+          controller.request.env["warden"].set_user(user)
+        else
+          controller.session[SESSION_USER_KEY] = user.id
+          controller.session[SESSION_USER_TYPE_KEY] = user.class.name
+        end
+      end
+
+      # The user signed in through {default}'s fallback, for applications without their
+      # own +current_user+.
+      def session_user(session)
+        id = session[SESSION_USER_KEY]
+        return nil if id.nil?
+
+        klass = session[SESSION_USER_TYPE_KEY].presence&.safe_constantize || SQRL::Rails.config.user_model
+        klass.find_by(klass.primary_key => id)
+      end
+
+      # Where to go after a successful login.
+      def after(controller, completion)
+        return_to = completion.return_to
+        return return_to if same_site_path?(return_to)
+
+        custom = SQRL::Rails.config.after_sign_in
+        return custom.call(controller, completion) if custom
+
+        if controller.respond_to?(:after_authentication_url, true)
+          controller.send(:after_authentication_url)
+        elsif controller.respond_to?(:main_app) && controller.main_app.respond_to?(:root_path)
+          controller.main_app.root_path
+        else
+          "/"
+        end
+      end
+
+      # The signed-in user for linking purposes.
+      def current_user(controller)
+        custom = SQRL::Rails.config.current_user
+        return custom.call(controller) if custom
+
+        if Object.const_defined?(:Current) && ::Current.respond_to?(:user)
+          controller.send(:resume_session) if controller.respond_to?(:resume_session, true)
+          user = ::Current.user
+          return user if user
+        end
+        session_user(controller.session)
+      rescue StandardError
+        nil
+      end
+
+      # A same-site, root-relative path. Rejects protocol-relative URLs (//host), the
+      # backslash form browsers normalise to a slash (/\host), and control characters or
+      # whitespace that URL parsers strip before interpreting the rest.
+      def same_site_path?(path)
+        path.is_a?(String) && path.match?(%r{\A/(?![/\\])}) && !path.match?(/[\x00-\x20\x7f\\]/)
+      end
+    end
+  end
+end

data/lib/sqrl/rails/stores/active_record.rb

@@ -0,0 +1,279 @@
+# frozen_string_literal: true
+
+module SQRL
+  module Rails
+    module Stores
+      # ActiveRecord-backed implementations of the three {SQRL::Server} store interfaces,
+      # over the tables created by `bin/rails generate sqrl:install`:
+      #
+      # * +sqrl_identities+ – one row per SQRL association; +idk+, +suk+ and +vuk+ are
+      #   stored base64url-encoded; a re-key updates the row in place and leaves a
+      #   tombstone row for the old +idk+ with +superseded_by+ set.
+      # * +sqrl_nuts+ – issued nuts; +consume+ is a single conditional +UPDATE+, so a nut
+      #   can only ever be used once even under concurrent requests.
+      # * +sqrl_pending_logins+ – one row per login page view; +claim_cps_token+ is a
+      #   compare-and-set on the token.
+      #
+      # Key material crosses the boundary as raw bytes (what the protocol core uses) and
+      # is encoded/decoded here.
+      module ActiveRecord
+        # @return [SQRL::Server::Stores]
+        def self.stores
+          SQRL::Server::Stores.new(nuts: NutStore.new, identities: IdentityStore.new,
+                                   pending_logins: PendingLoginStore.new)
+        end
+
+        # Runs a store operation with an explicitly checked-out connection, returned to
+        # the pool as soon as it finishes (Rails 7.1 would otherwise keep a thread's
+        # implicit connection until the thread dies, starving concurrent callers).
+        module WithConnection
+          private
+
+          def with_connection(&)
+            ::ActiveRecord::Base.connection_pool.with_connection(&)
+          end
+        end
+
+        # Encoding helpers shared by the stores.
+        module Codec
+          module_function
+
+          # @return [String, nil] binary bytes as base64url for a string column
+          def encode(bytes)
+            bytes.nil? ? nil : SQRL::Util.b64u_encode(bytes.b)
+          end
+
+          # @return [String, nil] binary bytes from a base64url column
+          def decode(text)
+            text.nil? || text.empty? ? nil : SQRL::Util.b64u_decode(text)
+          end
+        end
+
+        # @see SQRL::Server::NutStore
+        class NutStore < SQRL::Server::NutStore
+          include WithConnection
+
+          # Issue on ActiveRecord; same contract as +SQRL::Server::NutStore#issue+.
+          def issue(nut:, pending_login_id:, expected_server:, ip:, bound_idk:, expires_at:)
+            with_connection do
+              row = Nut.create!(nut: nut, pending_login_id: pending_login_id, expected_server: expected_server, ip: ip,
+                                bound_idk: Codec.encode(bound_idk), expires_at: expires_at)
+              to_record(row)
+            end
+          end
+
+          # Consume on ActiveRecord; same contract as +SQRL::Server::NutStore#consume+.
+          def consume(nut, now: Time.now)
+            return nil if nut.nil? || nut.empty?
+
+            with_connection do
+              scope = Nut.where(nut: nut, used_at: nil).where("expires_at IS NULL OR expires_at > ?", now)
+              next nil unless scope.update_all(used_at: now) == 1
+
+              to_record(Nut.find_by!(nut: nut))
+            end
+          end
+
+          # Delete expired rows.
+          # @return [Integer] number deleted
+          def prune!(now = Time.now)
+            with_connection { Nut.where("used_at IS NOT NULL OR expires_at <= ?", now).delete_all }
+            nil
+          end
+
+          private
+
+          def to_record(row)
+            SQRL::Server::NutRecord.new(nut: row.nut, pending_login_id: row.pending_login_id,
+                                        expected_server: row.expected_server, ip: row.ip,
+                                        bound_idk: Codec.decode(row.bound_idk), expires_at: row.expires_at,
+                                        used_at: row.used_at)
+          end
+        end
+
+        # @see SQRL::Server::IdentityStore
+        class IdentityStore < SQRL::Server::IdentityStore
+          # Identity columns that +update+ may change.
+          ATTRIBUTE_COLUMNS = %i[suk vuk disabled sqrlonly hardlock ins logins].freeze
+
+          # Find on ActiveRecord; same contract as +SQRL::Server::IdentityStore#find+.
+          def find(idk)
+            row = Identity.active.find_by(idk: Codec.encode(idk))
+            row && to_record(row)
+          end
+
+          # Create on ActiveRecord; same contract as +SQRL::Server::IdentityStore#create+.
+          def create(**attrs)
+            identity = SQRL::Server::Identity.new(**attrs)
+            row = Identity.new(idk: Codec.encode(identity.idk), suk: Codec.encode(identity.suk),
+                               vuk: Codec.encode(identity.vuk), disabled: identity.disabled?,
+                               sqrlonly: identity.sqrlonly?, hardlock: identity.hardlock?, ins: identity.ins,
+                               logins: identity.logins.to_i, last_login_at: Time.current)
+            assign_user(row, identity.user_ref)
+            begin
+              row.save!
+            rescue ::ActiveRecord::RecordInvalid, ::ActiveRecord::RecordNotUnique
+              raise ArgumentError, "identity already exists" if Identity.exists?(idk: row.idk)
+
+              raise
+            end
+            to_record(row)
+          end
+
+          # Update on ActiveRecord; same contract as +SQRL::Server::IdentityStore#update+.
+          def update(idk, **attrs)
+            row = Identity.active.find_by(idk: Codec.encode(idk))
+            return nil unless row
+
+            changes = {}
+            attrs.each do |key, value|
+              case key
+              when :suk, :vuk then changes[key] = Codec.encode(value)
+              when :idk then changes[key] = Codec.encode(value)
+              when :user_ref then assign_user(row, value)
+              when *ATTRIBUTE_COLUMNS then changes[key] = value
+              else raise ArgumentError, "unknown identity attribute #{key}"
+              end
+            end
+            changes[:last_login_at] = Time.current if attrs.key?(:logins)
+            row.assign_attributes(changes)
+            row.save!
+            to_record(row)
+          end
+
+          # Rekey on ActiveRecord; same contract as +SQRL::Server::IdentityStore#rekey+.
+          def rekey(old_idk, new_idk, suk:, vuk:, ins:)
+            old_b64 = Codec.encode(old_idk)
+            new_b64 = Codec.encode(new_idk)
+            Identity.transaction do
+              row = Identity.active.lock.find_by(idk: old_b64)
+              return nil unless row
+
+              row.update!(idk: new_b64, suk: Codec.encode(suk), vuk: Codec.encode(vuk), ins: ins)
+              Identity.create!(idk: old_b64, superseded_by: new_b64, disabled: true)
+              to_record(row)
+            end
+          end
+
+          def superseded?(idk)
+            Identity.where(idk: Codec.encode(idk)).where.not(superseded_by: nil).exists?
+          end
+
+          # Remove on ActiveRecord; same contract as +SQRL::Server::IdentityStore#remove+.
+          def remove(idk)
+            row = Identity.active.find_by(idk: Codec.encode(idk))
+            return nil unless row
+
+            record = to_record(row)
+            row.destroy!
+            record
+          end
+
+          # The ActiveRecord row for an identity record (for applications).
+          def row_for(identity)
+            Identity.active.find_by(idk: identity.respond_to?(:idk_b64) ? identity.idk_b64 : identity.to_s)
+          end
+
+          private
+
+          def assign_user(row, user_ref)
+            if user_ref.nil?
+              row.user_type = nil
+              row.user_id = nil
+            else
+              type, id = user_ref.to_s.split(":", 2)
+              row.user_type = type
+              row.user_id = id
+            end
+          end
+
+          def to_record(row)
+            SQRL::Server::Identity.new(idk: Codec.decode(row.idk), suk: Codec.decode(row.suk),
+                                       vuk: Codec.decode(row.vuk), disabled: row.disabled, sqrlonly: row.sqrlonly,
+                                       hardlock: row.hardlock, ins: row.ins, logins: row.logins.to_i,
+                                       user_ref: row.user_type && row.user_id ? "#{row.user_type}:#{row.user_id}" : nil)
+          end
+        end
+
+        # @see SQRL::Server::PendingLoginStore
+        class PendingLoginStore < SQRL::Server::PendingLoginStore
+          include WithConnection
+
+          # Pending-login columns that +update+ may change.
+          COLUMNS = %i[authenticated_at btn asked ip return_to link_user_ref expires_at cps_token
+                       cps_token_expires_at ip_matched].freeze
+
+          # Create on ActiveRecord; same contract as +SQRL::Server::PendingLoginStore#create+.
+          def create(id, ip:, return_to:, expires_at:, link_user_ref: nil, created_at: Time.now)
+            row = PendingLogin.create!(login_id: id, ip: ip, return_to: return_to, expires_at: expires_at,
+                                       link_user_ref: link_user_ref, created_at: created_at)
+            to_record(row)
+          end
+
+          # Find on ActiveRecord; same contract as +SQRL::Server::IdentityStore#find+.
+          def find(id)
+            row = id && PendingLogin.find_by(login_id: id)
+            row && to_record(row)
+          end
+
+          # Update on ActiveRecord; same contract as +SQRL::Server::IdentityStore#update+.
+          def update(id, **attrs)
+            row = PendingLogin.find_by(login_id: id)
+            return nil unless row
+
+            changes = {}
+            attrs.each do |key, value|
+              case key
+              when :authenticated_idk then changes[key] = Codec.encode(value)
+              when :last_command then changes[key] = value&.to_s
+              when *COLUMNS then changes[key] = value
+              else raise ArgumentError, "unknown pending login attribute #{key}"
+              end
+            end
+            row.update!(changes)
+            to_record(row)
+          end
+
+          # Claim cps token on ActiveRecord; same contract as +SQRL::Server::PendingLoginStore#claim_cps_token+.
+          def claim_cps_token(token, now: Time.now)
+            return nil if token.nil? || token.empty?
+
+            with_connection do
+              row = PendingLogin.find_by(cps_token: token)
+              next nil unless row
+
+              claimed = PendingLogin.where(id: row.id, cps_token: token)
+                                    .update_all(cps_token: nil, cps_token_expires_at: nil) == 1
+              next nil unless claimed
+              next nil if row.cps_token_expires_at && row.cps_token_expires_at <= now
+
+              row.cps_token = nil
+              row.cps_token_expires_at = nil
+              to_record(row)
+            end
+          end
+
+          # Delete expired rows.
+          # @return [Integer] number deleted
+          def prune!(now = Time.now)
+            PendingLogin.where("expires_at <= ?", now).delete_all
+            nil
+          end
+
+          private
+
+          def to_record(row)
+            SQRL::Server::PendingLogin.new(
+              id: row.login_id, ip: row.ip, return_to: row.return_to, link_user_ref: row.link_user_ref,
+              created_at: row.created_at, expires_at: row.expires_at,
+              authenticated_idk: Codec.decode(row.authenticated_idk), authenticated_at: row.authenticated_at,
+              btn: row.btn, asked: row.asked, last_command: row.last_command&.to_sym,
+              cps_token: row.cps_token, cps_token_expires_at: row.cps_token_expires_at,
+              ip_matched: row.respond_to?(:ip_matched) ? row.ip_matched == true : false
+            )
+          end
+        end
+      end
+    end
+  end
+end