strongroom-rails 0.1.0

data/lib/strongroom/errors.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Strongroom
+  class Error < StandardError; end
+  class ConfigurationError < Error; end
+  class InvalidRequest < Error; end
+  class Unauthorized < Error; end
+  class ProtocolError < Error; end
+  class Unavailable < Error; end
+
+  class RateLimited < Error
+    attr_reader :retry_after
+
+    def initialize(retry_after: nil)
+      @retry_after = retry_after
+      super("authentication rate limited")
+    end
+  end
+
+  class Busy < RateLimited; end
+end

data/lib/strongroom/net_http_transport.rb

@@ -0,0 +1,207 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "openssl"
+require "uri"
+require "ipaddr"
+
+module Strongroom
+  TransportResponse = Data.define(:status, :headers, :body) do
+    def initialize(status:, headers:, body:)
+      code = if status.is_a?(Integer)
+        status
+      elsif status.is_a?(String) && status.match?(/\A[1-5][0-9]{2}\z/)
+        Integer(status, 10)
+      end
+      raise ProtocolError, "invalid authentication response status" unless code && (100..599).cover?(code)
+      normalized = headers.to_h do |key, values|
+        [key.downcase.freeze, Array(values).map { |value| value.dup.freeze }.freeze]
+      end
+      super(status: code, headers: normalized.freeze, body: body.dup.freeze)
+    end
+
+    def inspect = "#<Strongroom::TransportResponse status=#{status} [FILTERED]>"
+    alias to_s inspect
+    def pretty_print(printer) = printer.text(inspect)
+    def as_json(*) = {status: status}
+
+    def to_h
+      redacted = headers.to_h do |key, values|
+        [key, %w[set-cookie cookie authorization].include?(key) ? ["[FILTERED]"] : values]
+      end
+      {status: status, headers: redacted, body: "[FILTERED]"}
+    end
+
+    def encode_with(coder)
+      coder.map = to_h.transform_keys(&:to_s)
+    end
+
+    def init_with(_coder)
+      raise TypeError, "transport responses must not be deserialized"
+    end
+
+    def marshal_dump
+      raise TypeError, "transport responses must not be serialized"
+    end
+  end
+
+  class NetHTTPTransport
+    class Connection < Net::HTTP
+      module DeadlineReads
+        attr_accessor :connection
+
+        private
+
+        def rbuf_fill
+          self.read_timeout = connection.budget(connection.read_timeout)
+          super
+        end
+      end
+
+      attr_accessor :expires
+
+      def budget(limit)
+        remaining = expires - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        raise Net::ReadTimeout unless remaining.positive?
+        [remaining, limit].min
+      end
+
+      private
+
+      def on_connect
+        @socket.extend(DeadlineReads)
+        @socket.connection = self
+      end
+    end
+
+    MAX_RESPONSE_BYTES = 65_536
+    REQUESTS = {get: Net::HTTP::Get, post: Net::HTTP::Post, delete: Net::HTTP::Delete}.freeze
+    FAILURES = [IOError, SystemCallError, Timeout::Error, SocketError, OpenSSL::SSL::SSLError,
+                Net::HTTPBadResponse, Net::HTTPHeaderSyntaxError, Net::ProtocolError].freeze
+    attr_reader :endpoint
+
+    def self.endpoint(value)
+      unless value.is_a?(String) && value.bytesize <= 2048 && !value.match?(/[[:space:]\\@]/)
+        raise ConfigurationError, "invalid authentication endpoint"
+      end
+      uri = URI.parse(value)
+      unless %w[https http].include?(uri.scheme) && uri.hostname && !uri.hostname.include?("*") &&
+          (1..65_535).cover?(uri.port) && !uri.userinfo &&
+          uri.query.nil? && uri.fragment.nil? && ["", "/"].include?(uri.path) &&
+          (uri.scheme == "https" || loopback?(uri.hostname))
+        raise ConfigurationError, "HTTPS required (HTTP is loopback-only)"
+      end
+      uri.normalize.to_s.delete_suffix("/").freeze
+    rescue URI::InvalidURIError, ArgumentError, TypeError
+      raise ConfigurationError, "invalid authentication endpoint", cause: nil
+    end
+
+    def self.loopback?(hostname)
+      hostname == "localhost" || IPAddr.new(hostname).loopback?
+    rescue IPAddr::Error
+      false
+    end
+
+    def initialize(endpoint:, open_timeout: 2, read_timeout: 5, write_timeout: 5, deadline: 15,
+      keep_alive: false, keep_alive_timeout: 2, max_idle: 4)
+      @endpoint = self.class.endpoint(endpoint)
+      @uri = URI(@endpoint)
+      @open_timeout, @read_timeout, @write_timeout = [open_timeout, read_timeout, write_timeout].map { |value| seconds(value, 30) }
+      @deadline = seconds(deadline, 60)
+      raise ConfigurationError, "keep_alive must be true or false" unless [true, false].include?(keep_alive)
+      raise ConfigurationError, "max_idle must be an integer from 1 to 64" unless max_idle.is_a?(Integer) && (1..64).cover?(max_idle)
+      @keep_alive, @keep_alive_timeout, @max_idle = keep_alive, seconds(keep_alive_timeout, 30), max_idle
+      @lock, @idle, @pid = Mutex.new, [], Process.pid
+    end
+
+    def keep_alive? = @keep_alive
+
+    def call(method, path, headers:, body: nil)
+      request = REQUESTS.fetch(method).new(path, headers)
+      request.body = body if body
+      connection = checkout(clock + @deadline)
+      response = exchange(connection, request)
+      checkin(connection)
+      connection = nil
+      response
+    rescue *FAILURES
+      raise Unavailable, "authentication service unavailable", cause: nil
+    ensure
+      discard(connection)
+    end
+
+    def close
+      idle = @lock.synchronize { @pid == Process.pid ? @idle.slice!(0..) : [] }
+      idle.each { |connection| discard(connection) }
+      nil
+    end
+
+    private
+
+    def checkout(expires)
+      connection = reusable || build
+      connection.expires = expires
+      connection.open_timeout = connection.budget(@open_timeout)
+      connection.started? ? connection : connection.start
+    end
+
+    def reusable
+      return unless @keep_alive
+      @lock.synchronize do
+        @idle, @pid = [], Process.pid unless @pid == Process.pid
+        @idle.pop
+      end
+    end
+
+    def checkin(connection)
+      kept = @keep_alive && @lock.synchronize do
+        @pid == Process.pid && @idle.size < @max_idle && @idle.push(connection)
+      end
+      discard(connection) unless kept
+    end
+
+    def build
+      http = Connection.new(@uri.hostname, @uri.port, nil)
+      http.read_timeout, http.write_timeout = @read_timeout, @write_timeout
+      http.keep_alive_timeout = @keep_alive_timeout
+      http.max_retries = 0
+      http.use_ssl = @uri.scheme == "https"
+      if http.use_ssl?
+        http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        http.verify_hostname = true
+        http.min_version = OpenSSL::SSL::TLS1_2_VERSION
+      end
+      http
+    end
+
+    def exchange(connection, request)
+      connection.write_timeout = connection.budget(@write_timeout)
+      result = nil
+      connection.request(request) do |response|
+        bytes = +""
+        response.read_body do |chunk|
+          raise ProtocolError, "authentication response too large" if bytes.bytesize + chunk.bytesize > MAX_RESPONSE_BYTES
+          bytes << chunk
+        end
+        result = TransportResponse.new(status: response.code, headers: response.to_hash, body: bytes)
+      end
+      result
+    end
+
+    def discard(connection)
+      connection.finish if connection&.started?
+    rescue *FAILURES
+      nil
+    end
+
+    def seconds(value, limit)
+      number = Float(value)
+      raise ArgumentError unless number.finite? && number.positive? && number <= limit
+      number
+    rescue ArgumentError, TypeError
+      raise ConfigurationError, "timeouts must be positive and at most #{limit} seconds", cause: nil
+    end
+
+    def clock = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+  end
+end

data/lib/strongroom/rails/account.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Strongroom
+  module Rails
+    class Account
+      attr_reader :client, :table, :model, :register, :cookie_name
+
+      def initialize(client:, table:, model:, resolve:, eligible:, register: false)
+        raise ConfigurationError, "client must be a Strongroom::Client" unless client.is_a?(Client)
+        unless table.is_a?(String) && table.match?(/\A[a-z_][a-z0-9_]{0,62}\z/)
+          raise ConfigurationError, "table must be a lowercase SQL identifier of at most 63 characters"
+        end
+        raise ConfigurationError, "table #{table} is a PostgreSQL system name (pg_*)" if table.start_with?("pg_")
+        unless model.is_a?(Class) && model.respond_to?(:table_name)
+          raise ConfigurationError, "model must be a class responding to table_name, not #{model.inspect}"
+        end
+        unless model.table_name == table
+          raise ConfigurationError, "#{model}.table_name is #{model.table_name.inspect}, not #{table.inspect}"
+        end
+        raise ConfigurationError, "resolve must be callable (subject -> record or nil)" unless resolve.respond_to?(:call)
+        raise ConfigurationError, "eligible must be callable (record -> true)" unless eligible.respond_to?(:call)
+        raise ConfigurationError, "register must be true or false" unless [true, false].include?(register)
+        @client, @model, @table = client, model, table.dup.freeze
+        @resolver, @eligible, @register = resolve, eligible, register
+        @cookie_name = "strongroom_#{client.namespace}".freeze
+        freeze
+      end
+
+      def resolve(session)
+        subject = client.subject(session)
+        record = @resolver.call(subject)
+        unless record.is_a?(model) && record.class.table_name == table && @eligible.call(record).equal?(true)
+          raise Unauthorized, "authentication failed"
+        end
+        record
+      rescue Error
+        raise
+      rescue StandardError
+        raise Unavailable, "local principal lookup unavailable", cause: nil
+      end
+    end
+  end
+end

data/lib/strongroom/rails/authentication.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+require "action_controller/metal/request_forgery_protection"
+
+module Strongroom
+  module Rails
+    module Authentication
+      extend ActiveSupport::Concern
+
+      INTENT_HEADER = "HTTP_X_STRONGROOM_REQUEST"
+
+      def self.origin(value)
+        NetHTTPTransport.endpoint(value)
+      rescue ConfigurationError
+        raise ConfigurationError, "trusted origins must be canonical HTTPS origins (HTTP only on loopback)", cause: nil
+      end
+
+      included do
+        prepend_before_action :strongroom_no_store!
+        helper_method :strongroom_current_account if respond_to?(:helper_method)
+        class_attribute :strongroom_trusted_origins, instance_accessor: false, default: [].freeze
+      end
+
+      class_methods do
+        def strongroom_trust_origins(*origins)
+          self.strongroom_trusted_origins = origins.flatten.map { |origin| Authentication.origin(origin) }.uniq.freeze
+        end
+      end
+
+      def strongroom_login(namespace:, identity:, password:, identity_kind: "email")
+        strongroom_verify_mutation!(:post)
+        account = strongroom_registry.fetch(namespace)
+        issued = account.client.login(identity: identity, password: password, identity_kind: identity_kind)
+        strongroom_publish(account, issued)
+      ensure
+        strongroom_resolver.forget(namespace)
+      end
+
+      def strongroom_current_account(namespace:)
+        strongroom_resolver.account(namespace)
+      end
+
+      def strongroom_rotate(namespace:)
+        strongroom_verify_mutation!(:post)
+        account = strongroom_registry.fetch(namespace)
+        token = strongroom_resolver.credential(namespace) or raise Unauthorized, "authentication failed"
+        strongroom_publish(account, account.client.rotate(token: token))
+      ensure
+        strongroom_resolver.forget(namespace)
+      end
+
+      def strongroom_logout(namespace:)
+        strongroom_verify_mutation!(:delete)
+        account = strongroom_registry.fetch(namespace)
+        resolver = strongroom_resolver
+        presented, cookie = resolver.credential(namespace), resolver.cookie_credential(namespace)
+        if presented.nil? && cookie.nil? && !request.get_header("HTTP_AUTHORIZATION").nil?
+          raise Unauthorized, "no revocable session credential"
+        end
+        [presented, cookie].compact.uniq(&:reveal).each { |token| account.client.logout(token: token) }
+        request.cookie_jar.delete(account.cookie_name, path: "/", secure: true, httponly: true, same_site: :lax)
+        nil
+      ensure
+        strongroom_resolver.forget(namespace)
+      end
+
+      private
+
+      def strongroom_no_store!
+        response.set_header("Cache-Control", "no-store")
+        response.set_header("Vary", [response.get_header("Vary"), "Cookie", "Authorization"].compact.join(", "))
+      end
+
+      def strongroom_registry = Registry.current
+      def strongroom_resolver = Resolver.new(request)
+
+      def strongroom_verify_mutation!(verb)
+        unless request.request_method == verb.to_s.upcase && strongroom_mutation_intended?
+          raise ::ActionController::InvalidAuthenticityToken, "verified mutation intent required"
+        end
+      end
+
+      def strongroom_mutation_intended?
+        if respond_to?(:verified_request?, true)
+          protect_against_forgery? && verified_request?
+        else
+          strongroom_declared_intent?
+        end
+      end
+
+      def strongroom_declared_intent?
+        return false unless request.get_header(INTENT_HEADER) == "1"
+        origin = request.get_header("HTTP_ORIGIN")
+        return request.get_header("HTTP_SEC_FETCH_SITE").nil? if origin.nil?
+        origin == request.base_url || self.class.strongroom_trusted_origins.include?(origin)
+      end
+
+      def strongroom_publish(account, issued)
+        begin
+          record = account.resolve(issued.session)
+        rescue Error => error
+          account.client.discard(token: issued.token)
+          raise error, cause: nil
+        end
+        request.cookie_jar.encrypted[account.cookie_name] = {
+          value: issued.token.reveal, expires: issued.session.expires_at,
+          secure: true, httponly: true, same_site: :lax, path: "/"
+        }
+        record
+      end
+    end
+  end
+end

data/lib/strongroom/rails/railtie.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Strongroom
+  module Rails
+    class Railtie < ::Rails::Railtie
+      config.strongroom = ActiveSupport::OrderedOptions.new
+      config.strongroom.verify_on_boot = true
+
+      config.action_dispatch.rescue_responses.merge!(
+        "Strongroom::InvalidRequest" => :bad_request,
+        "Strongroom::Unauthorized" => :unauthorized,
+        "Strongroom::RateLimited" => :too_many_requests,
+        "Strongroom::Busy" => :service_unavailable,
+        "Strongroom::ProtocolError" => :service_unavailable,
+        "Strongroom::Unavailable" => :service_unavailable
+      )
+
+      initializer "strongroom.filter_credentials" do |app|
+        app.config.filter_parameters |= %i[password password_confirmation identity authorization cookie strongroom_token]
+      end
+
+      config.after_initialize do |app|
+        require_relative "warden_strategy" if defined?(::Warden::Strategies)
+        if app.config.strongroom.verify_on_boot
+          Railtie.verify!(app)
+          app.reloader.to_prepare { Railtie.verify!(app) }
+        end
+      end
+
+      def self.verify!(app)
+        Registry.current(app)
+        unless app.config.middleware.include?(ActionDispatch::Cookies)
+          raise ConfigurationError, "ActionDispatch::Cookies middleware is required for Strongroom session cookies"
+        end
+        nil
+      end
+    end
+  end
+end

data/lib/strongroom/rails/registry.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Strongroom
+  module Rails
+    class Registry
+      def self.current(app = ::Rails.application)
+        raise ConfigurationError, "no Rails application is defined" unless app
+        registry = app.config.x.strongroom_accounts
+        return registry if registry.is_a?(self)
+        if registry.nil? || (registry.is_a?(ActiveSupport::OrderedOptions) && registry.empty?)
+          raise ConfigurationError, "config.x.strongroom_accounts is not set: assign a Strongroom::Rails::Registry in a to_prepare block"
+        end
+        raise ConfigurationError, "config.x.strongroom_accounts must be a Strongroom::Rails::Registry, not #{registry.class}"
+      end
+
+      def initialize(*accounts, warden_scopes: {})
+        raise ConfigurationError, "configure one to sixteen accounts, got #{accounts.size}" unless (1..16).cover?(accounts.size)
+        unless accounts.all?(Account)
+          stray = accounts.find { |account| !account.is_a?(Account) }
+          raise ConfigurationError, "registry entries must be Strongroom::Rails::Account, not #{stray.class}"
+        end
+        @accounts = {}
+        accounts.each do |account|
+          client = account.client
+          raise ConfigurationError, "namespace #{client.namespace} is configured twice" if @accounts.key?(client.namespace)
+          @accounts.each_value do |other|
+            if other.table == account.table
+              raise ConfigurationError, "namespaces #{other.client.namespace} and #{client.namespace} share table #{account.table}"
+            end
+            if (other.client.issuer == client.issuer || other.client.endpoint == client.endpoint) &&
+                (other.client.org_id == client.org_id || other.client.app_id == client.app_id)
+              raise ConfigurationError,
+                "namespaces #{other.client.namespace} and #{client.namespace} share an org or app on the same issuer or endpoint"
+            end
+          end
+          @accounts[client.namespace] = account
+        end
+        @accounts.freeze
+        @scopes = scopes(warden_scopes)
+        freeze
+      end
+
+      def fetch(namespace)
+        @accounts.fetch(namespace.to_s) { raise ConfigurationError, "unknown account namespace" }
+      end
+
+      def namespaces = @accounts.keys
+
+      def for_scope(scope)
+        @scopes.fetch(scope.to_s) { fetch(scope) }
+      end
+
+      private
+
+      def scopes(mapping)
+        raise ConfigurationError, "warden_scopes must map Warden scopes to namespaces" unless mapping.is_a?(Hash)
+        mapping.to_h do |scope, namespace|
+          unless (scope.is_a?(Symbol) || scope.is_a?(String)) && @accounts.key?(namespace.to_s)
+            raise ConfigurationError, "Warden scope #{scope.inspect} must map to a configured namespace"
+          end
+          [scope.to_s.freeze, @accounts.fetch(namespace.to_s)]
+        end.freeze
+      end
+    end
+  end
+end

data/lib/strongroom/rails/resolver.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "action_dispatch"
+require "action_dispatch/middleware/cookies"
+
+module Strongroom
+  module Rails
+    class Resolver
+      MEMO = "strongroom.rails.resolved"
+      attr_reader :request
+
+      def initialize(request, registry: nil)
+        @request = case request
+        when ActionDispatch::Request then request
+        when Hash then ActionDispatch::Request.new(request)
+        else ActionDispatch::Request.new(request.env)
+        end
+        @registry = registry
+      end
+
+      def account(namespace)
+        remember(:account, namespace) do
+          current = session(namespace)
+          current && registry.fetch(namespace).resolve(current)
+        rescue Unauthorized
+          nil
+        end
+      end
+
+      def subject(namespace)
+        current = session(namespace) or return nil
+        registry.fetch(namespace).client.subject(current)
+      rescue Unauthorized
+        nil
+      end
+
+      def session(namespace)
+        remember(:session, namespace) do
+          token = credential(namespace)
+          token && registry.fetch(namespace).client.session(token: token)
+        rescue Unauthorized
+          nil
+        end
+      end
+
+      def forget(namespace)
+        name = namespace.to_s
+        memo.delete_if { |(_, key), _| key == name }
+        nil
+      end
+
+      def credential(namespace)
+        authorization = request.get_header("HTTP_AUTHORIZATION")
+        return Token.from_authorization(authorization) unless authorization.nil?
+        cookie_credential(namespace)
+      end
+
+      def cookie_credential(namespace)
+        value = request.cookie_jar.encrypted[registry.fetch(namespace).cookie_name]
+        Token.new(value) unless value.nil?
+      rescue Unauthorized
+        nil
+      end
+
+      private
+
+      def registry = @registry ||= Registry.current
+      def memo = request.get_header(MEMO) || request.set_header(MEMO, {})
+
+      def remember(kind, namespace)
+        key = [kind, registry.fetch(namespace).client.namespace]
+        cache = memo
+        return cache[key] if cache.key?(key)
+        cache[key] = yield
+      end
+    end
+  end
+end

data/lib/strongroom/rails/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Strongroom
+  module Rails
+    VERSION = "0.1.0" # x-release-please-version
+  end
+end

data/lib/strongroom/rails/warden_strategy.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "warden"
+
+module Strongroom
+  module Rails
+    class WardenStrategy < ::Warden::Strategies::Base
+      def valid?
+        !resolver.credential(namespace).nil?
+      end
+
+      def authenticate!
+        record = resolver.account(namespace)
+        record ? success!(record) : fail!("authentication failed")
+      end
+
+      def store? = false
+
+      private
+
+      def namespace = @namespace ||= Registry.current.for_scope(scope).client.namespace
+      def resolver = @resolver ||= Resolver.new(env)
+    end
+  end
+end
+
+::Warden::Strategies.add(:strongroom, Strongroom::Rails::WardenStrategy) unless ::Warden::Strategies[:strongroom]

data/lib/strongroom/rails.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require "strongroom"
+require "rails"
+require "action_controller"
+require_relative "rails/account"
+require_relative "rails/registry"
+require_relative "rails/resolver"
+require_relative "rails/authentication"
+require_relative "rails/railtie"

data/lib/strongroom/session.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require "time"
+
+module Strongroom
+  Session = Data.define(:session_id, :user_id, :org_id, :app_id, :expires_at)
+  Subject = Data.define(:issuer, :namespace, :org_id, :app_id, :user_id)
+
+  class IssuedSession
+    attr_reader :session, :token
+
+    def initialize(session:, token:)
+      @session, @token = session, token
+      freeze
+    end
+
+    def inspect = "#<Strongroom::IssuedSession session_id=#{session.session_id} token=[FILTERED]>"
+    def pretty_print(printer) = printer.text(inspect)
+
+    def as_json(*)
+      raise TypeError, "issued credentials must not be serialized"
+    end
+  end
+end