Masks::Rails
The consumer half: a Rails engine that mounts the code flow into an application, so signing in against a masks issuer is configuration rather than a controller you write.
It loads only when Rails::Engine is already defined. Requiring
the gem from a plain Ruby process gets Masks::Client and nothing else.
Three pieces do the work:
-
Configuration — the issuer, credentials and routes, set once in an initializer
-
Authentication —
masks_login_url, the callback, and the session -
ProtectedResource — the other direction — checking a bearer this app was
handed, for an API rather than a browser
This engine is the client. The provider is the masks-server gem, whether it runs elsewhere or is mounted on a subdomain of this app.
Generated from client/lib by bundle exec rake reference. Its shape is the code’s; the
prose is the RDoc in the source.
Masks::Rails::Authentication
Section titled “Masks::Rails::Authentication”| Constant | Value |
|---|---|
REQUESTS |
"masks_requests".freeze |
HANDSHAKES |
"masks_handshakes".freeze |
FAREWELLS |
"masks_farewells".freeze |
STEPPED_UP |
"masks_stepped_up".freeze |
STEP_UP_WITHIN |
300 |
IDENTITY |
[ "sub", "sid", "name", "preferred_username", "email", "email_verified", "tenant", "picture", Masks::Client::Claims::AVATARS, Masks::Client::Claims::ORGANIZATION, Masks::Client::Claims::ORGANIZATIONS ].freeze |
#authenticate_masks!
Section titled “#authenticate_masks!”#authenticate_masks!()#masked
Section titled “#masked”#masked()#masks_account_url
Section titled “#masks_account_url”#masks_account_url()#masks_cache
Section titled “#masks_cache”#masks_cache()#masks_configured?
Section titled “#masks_configured?”#masks_configured?()#masks_disconnect!
Section titled “#masks_disconnect!”#masks_disconnect!()#masks_farewells
Section titled “#masks_farewells”#masks_farewells()#masks_forget
Section titled “#masks_forget”#masks_forget()#masks_handshake_path
Section titled “#masks_handshake_path”#masks_handshake_path()#masks_handshakes
Section titled “#masks_handshakes”#masks_handshakes()#masks_held
Section titled “#masks_held”#masks_held()#masks_identity_from
Section titled “#masks_identity_from”#masks_identity_from(tokens)#masks_login_url
Section titled “#masks_login_url”#masks_login_url(return_to: nil, organization: nil, privilege: nil, max_age: nil)Where to send someone to sign in. max_age asks masks for a sign-in no older
than that many seconds; an older one is refused at the callback.
#masks_reconnect!
Section titled “#masks_reconnect!”#masks_reconnect!()#masks_refresh!
Section titled “#masks_refresh!”#masks_refresh!()#masks_refreshed_identity
Section titled “#masks_refreshed_identity”#masks_refreshed_identity(tokens)#masks_registered?
Section titled “#masks_registered?”#masks_registered?()#masks_registration
Section titled “#masks_registration”#masks_registration()#masks_requests
Section titled “#masks_requests”#masks_requests()#masks_session
Section titled “#masks_session”#masks_session()#masks_session_cookies
Section titled “#masks_session_cookies”#masks_session_cookies()#masks_signed_in?
Section titled “#masks_signed_in?”#masks_signed_in?()#masks_store
Section titled “#masks_store”#masks_store(tokens, identity: nil)#masks_tokens
Section titled “#masks_tokens”#masks_tokens()#masks_tracker
Section titled “#masks_tracker”#masks_tracker(key)Masks::Rails::Cache
Section titled “Masks::Rails::Cache”| Constant | Value |
|---|---|
CLAIM |
30 |
RESULT |
60 |
WAIT |
0.05 |
PATIENCE |
30 |
LOGOUT |
600 |
LOGOUT_LEEWAY |
120 |
DEPARTURE |
30 * 24 * 3600 |
CIPHER |
"aes-256-gcm".freeze |
NONCE |
12 |
TAG |
16 |
| Attribute | Access |
|---|---|
store |
R |
::key(*parts)::new(store)::now()#depart!
Section titled “#depart!”#depart!(issuer, logout)#departed?
Section titled “#departed?”#departed?(issuer, identity, since:)#first?
Section titled “#first?”#first?(key, expires_in:)#first_logout?
Section titled “#first_logout?”#first_logout?(issuer, logout)#renew
Section titled “#renew”#renew(issuer, refresh_token)Masks::Rails::Cache::Unavailable
Section titled “Masks::Rails::Cache::Unavailable”Inherits Masks::Client::Error.
Masks::Rails::Configurable
Section titled “Masks::Rails::Configurable”#masks_config
Section titled “#masks_config”#masks_config()Masks::Rails::Configuration
Section titled “Masks::Rails::Configuration”| Constant | Value |
|---|---|
Privilege |
Struct.new(:name, :scopes, :roles, :organization, keyword_init: true) |
PRIVILEGE_KEYS |
%w[scope role organization].freeze |
| Attribute | Access |
|---|---|
after_sign_in |
RW |
after_sign_out |
RW |
authenticate_everything |
RW |
cache |
W |
credentials |
W |
credentials_path |
RW |
delegates |
RW |
delegation_redirect_uri |
W |
forget |
W |
issuer |
W |
logged_out |
W |
manages |
W |
name |
W |
namespace |
RW |
organization |
W |
parent_controller |
RW |
privileges |
R |
redirect_uri |
W |
resource |
RW |
resource_scopes |
RW |
scope |
RW |
session_key |
RW |
sign_out_of_issuer |
RW |
store |
W |
::new()#approved_scope
Section titled “#approved_scope”#approved_scope()#backchannel_logout_uri_for
Section titled “#backchannel_logout_uri_for”#backchannel_logout_uri_for(request)#cache
Section titled “#cache”#cache()#can_forget?
Section titled “#can_forget?”#can_forget?()#client_id_for
Section titled “#client_id_for”#client_id_for(request)#client_secret_for
Section titled “#client_secret_for”#client_secret_for(request)#configured?
Section titled “#configured?”#configured?(request)#credentials_for
Section titled “#credentials_for”#credentials_for(request)#default_credentials
Section titled “#default_credentials”#default_credentials()#delegation_redirect_uri_for
Section titled “#delegation_redirect_uri_for”#delegation_redirect_uri_for(request)#forget!
Section titled “#forget!”#forget!(request)#handshake_for
Section titled “#handshake_for”#handshake_for(request)#issuer_for
Section titled “#issuer_for”#issuer_for(request)#logged_out!
Section titled “#logged_out!”#logged_out!(request, logout)#manages?
Section titled “#manages?”#manages?(request, masked = nil)#name_for
Section titled “#name_for”#name_for(request)#organization_for
Section titled “#organization_for”#organization_for(request)#post_logout_redirect_uri_for
Section titled “#post_logout_redirect_uri_for”#post_logout_redirect_uri_for(request)#privilege
Section titled “#privilege”#privilege(name)#privileges=
Section titled “#privileges=”#privileges=(value)#redirect_uri_for
Section titled “#redirect_uri_for”#redirect_uri_for(request)#resource_for
Section titled “#resource_for”#resource_for(request)#resource_server_for
Section titled “#resource_server_for”#resource_server_for(request)#return_to_for
Section titled “#return_to_for”#return_to_for(request)#scope_for
Section titled “#scope_for”#scope_for(requested)#session_for
Section titled “#session_for”#session_for(request)#store!
Section titled “#store!”#store!(request, registration)Masks::Rails::Configuration::Unconfigured
Section titled “Masks::Rails::Configuration::Unconfigured”Inherits Masks::Client::Error.
Masks::Rails::Credentials
Section titled “Masks::Rails::Credentials”| Constant | Value |
|---|---|
KEYS |
%w[client_id client_secret registration_access_token registration_client_uri].freeze |
| Attribute | Access |
|---|---|
path |
R |
::new(path)#clear!
Section titled “#clear!”#clear!()#connected?
Section titled “#connected?”#connected?()#read()#write
Section titled “#write”#write(registration)Masks::Rails::Engine
Section titled “Masks::Rails::Engine”Inherits Rails::Engine.
Masks::Rails::Masked
Section titled “Masks::Rails::Masked”| Attribute | Access |
|---|---|
access_token |
R |
account_url |
R |
claims |
R |
expires_at |
R |
scopes |
R |
::new(claims:, scopes:, config:, signed_in:, access_token: nil, expires_at: nil, account_url: nil)::nobody
Section titled “::nobody”::nobody(config)#[]
#[](claim)#avatars
Section titled “#avatars”#avatars()#email()#email_verified?
Section titled “#email_verified?”#email_verified?()#holds?
Section titled “#holds?”#holds?(privilege)#member!
Section titled “#member!”#member!(privilege)#name()#nickname
Section titled “#nickname”#nickname()#organization
Section titled “#organization”#organization()#organizations
Section titled “#organizations”#organizations()#permits?
Section titled “#permits?”#permits?(scope)#picture
Section titled “#picture”#picture()#privilege?
Section titled “#privilege?”#privilege?(*names)#privileges
Section titled “#privileges”#privileges()#role?
Section titled “#role?”#role?(*roles)#signed_in?
Section titled “#signed_in?”#signed_in?()#subject
Section titled “#subject”#subject()#tenant
Section titled “#tenant”#tenant()#to_h()Masks::Rails::Privileged
Section titled “Masks::Rails::Privileged”::masked!
Section titled “::masked!”::masked!(*privileges, **options)#authorize_masks!
Section titled “#authorize_masks!”#authorize_masks!(*names)Masks::Rails::ProtectedResource
Section titled “Masks::Rails::ProtectedResource”#masked
Section titled “#masked”#masked()#masks_authenticate
Section titled “#masks_authenticate”#masks_authenticate(scope: nil, role: nil, organization: nil)#masks_challenge
Section titled “#masks_challenge”#masks_challenge(error)#masks_proof
Section titled “#masks_proof”#masks_proof()#masks_resource
Section titled “#masks_resource”#masks_resource()#masks_resource_metadata
Section titled “#masks_resource_metadata”#masks_resource_metadata()#masks_unavailable
Section titled “#masks_unavailable”#masks_unavailable()Masks::Rails::Renewal
Section titled “Masks::Rails::Renewal”| Constant | Value |
|---|---|
OUTCOMES |
%i[renewed refused unregistered unreachable].freeze |
| Attribute | Access |
|---|---|
identity |
R |
outcome |
R |
tokens |
R |
::from_h
Section titled “::from_h”::from_h(body)::new(outcome, tokens: nil, identity: nil)::refused
Section titled “::refused”::refused()::renewed
Section titled “::renewed”::renewed(tokens, identity)::unreachable
Section titled “::unreachable”::unreachable()::unregistered
Section titled “::unregistered”::unregistered()#to_h()Masks::Rails::SessionCookies
Section titled “Masks::Rails::SessionCookies”| Constant | Value |
|---|---|
VERSION |
"v1".freeze |
PIECE |
3800 |
PIECES |
8 |
CIPHER |
"aes-256-gcm".freeze |
NONCE |
12 |
TAG |
16 |
PURPOSE |
"masks session cookie".freeze |
UNPACKED |
PIECE * PIECES * 8 |
::key()::new(request, key)::open
Section titled “::open”::open(value, bound)::seal
Section titled “::seal”::seal(held, bound)#clear
Section titled “#clear”#clear()#name(index)#read()#write
Section titled “#write”#write(held)Masks::Rails::SessionCookies::Overflow
Section titled “Masks::Rails::SessionCookies::Overflow”Inherits Masks::Client::Error.