totally ignore session when handling oauth2

lib/pleroma/helpers/auth_helper.ex

@@ -4,12 +4,9 @@
 
 defmodule Pleroma.Helpers.AuthHelper do
   alias Pleroma.Web.Plugs.OAuthScopesPlug
-  alias Plug.Conn
 
   import Plug.Conn
 
-  @oauth_token_session_key :oauth_token
-
   @doc """
   Skips OAuth permissions (scopes) checks, assigns nil `:token`.
   Intended to be used with explicit authentication and only when OAuth token cannot be determined.
@@ -28,19 +25,4 @@ defmodule Pleroma.Helpers.AuthHelper do
     |> assign(:token, nil)
     |> put_private(:authentication_ignored, true)
   end
-
-  @doc "Gets OAuth token string from session"
-  def get_session_token(%Conn{} = conn) do
-    get_session(conn, @oauth_token_session_key)
-  end
-
-  @doc "Updates OAuth token string in session"
-  def put_session_token(%Conn{} = conn, token) when is_binary(token) do
-    put_session(conn, @oauth_token_session_key, token)
-  end
-
-  @doc "Deletes OAuth token string from session"
-  def delete_session_token(%Conn{} = conn) do
-    delete_session(conn, @oauth_token_session_key)
-  end
 end

lib/pleroma/web/mastodon_api/controllers/auth_controller.ex

@@ -7,7 +7,6 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do
 
   import Pleroma.Web.ControllerHelper, only: [json_response: 3]
 
-  alias Pleroma.Helpers.AuthHelper
   alias Pleroma.Helpers.UriHelper
   alias Pleroma.User
   alias Pleroma.Web.OAuth.App
@@ -67,9 +66,8 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do
   def logout(conn, _) do
     conn =
       with %{assigns: %{token: %Token{} = oauth_token}} <- conn,
-           session_token = AuthHelper.get_session_token(conn),
-           {:ok, %Token{token: ^session_token}} <- RevokeToken.revoke(oauth_token) do
-        AuthHelper.delete_session_token(conn)
+           {:ok, %Token{token: _session_token}} <- RevokeToken.revoke(oauth_token) do
+        conn
       else
         _ -> conn
       end

lib/pleroma/web/o_auth/o_auth_controller.ex

@@ -5,7 +5,6 @@
 defmodule Pleroma.Web.OAuth.OAuthController do
   use Pleroma.Web, :controller
 
-  alias Pleroma.Helpers.AuthHelper
   alias Pleroma.Helpers.UriHelper
   alias Pleroma.Maps
   alias Pleroma.MFA
@@ -78,7 +77,8 @@ defmodule Pleroma.Web.OAuth.OAuthController do
     scopes = Scopes.fetch_scopes(params, available_scopes)
 
     # if we already have a token for this specific setup, we can use that
-    with %App{} <- app,
+    with false <- Params.truthy_param?(params["force_login"]),
+         %App{} <- app,
          {:ok, _} <- Scopes.validate(scopes, app.scopes),
          {:ok, %Token{} = token} <- Token.get_by_app(app) do
       token = Repo.preload(token, :app)
@@ -330,9 +330,8 @@ defmodule Pleroma.Web.OAuth.OAuthController do
   # Bad request
   def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params)
 
-  def after_token_exchange(%Plug.Conn{} = conn, %{token: token} = view_params) do
+  def after_token_exchange(%Plug.Conn{} = conn, %{token: _token} = view_params) do
     conn
-    |> AuthHelper.put_session_token(token.token)
     |> json(OAuthView.render("token.json", view_params))
   end
 
@@ -391,15 +390,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
 
   def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do
     with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token),
-         {:ok, oauth_token} <- RevokeToken.revoke(oauth_token) do
-      conn =
-        with session_token = AuthHelper.get_session_token(conn),
-             %Token{token: ^session_token} <- oauth_token do
-          AuthHelper.delete_session_token(conn)
-        else
-          _ -> conn
-        end
-
+         {:ok, _oauth_token} <- RevokeToken.revoke(oauth_token) do
       json(conn, %{})
     else
       _error ->

lib/pleroma/web/o_auth/token.ex

@@ -41,7 +41,7 @@ defmodule Pleroma.Web.OAuth.Token do
 
   def get_by_app(%App{} = app) do
     app.id
-    |> Query.get_by_app()
+    |> Query.get_unexpired_by_app()
     |> Repo.find_resource()
   end
 

lib/pleroma/web/o_auth/token/query.ex

@@ -23,12 +23,17 @@ defmodule Pleroma.Web.OAuth.Token.Query do
     from(q in query, where: q.token == ^token)
   end
 
-  @spec get_by_app(query, String.t()) :: query
-  def get_by_app(query \\ Token, app_id) do
+  @spec get_unexpired_by_app(query, String.t()) :: query
+  def get_unexpired_by_app(query \\ Token, app_id) do
     time = NaiveDateTime.utc_now()
     from(q in query, where: q.app_id == ^app_id and q.valid_until > ^time, limit: 1)
   end
 
+  @spec get_by_app(query, String.t()) :: query
+  def get_by_app(query \\ Token, app_id) do
+    from(q in query, where: q.app_id == ^app_id, limit: 1)
+  end
+
   @spec get_by_id(query, String.t()) :: query
   def get_by_id(query \\ Token, id) do
     from(q in query, where: q.id == ^id)

lib/pleroma/web/plugs/set_user_session_id_plug.ex

@@ -1,18 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Pleroma.Web.Plugs.SetUserSessionIdPlug do
-  alias Pleroma.Helpers.AuthHelper
-  alias Pleroma.Web.OAuth.Token
-
-  def init(opts) do
-    opts
-  end
-
-  def call(%{assigns: %{token: %Token{} = oauth_token}} = conn, _) do
-    AuthHelper.put_session_token(conn, oauth_token.token)
-  end
-
-  def call(conn, _), do: conn
-end

lib/pleroma/web/router.ex

@@ -57,7 +57,6 @@ defmodule Pleroma.Web.Router do
 
   pipeline :after_auth do
     plug(Pleroma.Web.Plugs.UserEnabledPlug)
-    plug(Pleroma.Web.Plugs.SetUserSessionIdPlug)
     plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
     plug(Pleroma.Web.Plugs.UserTrackingPlug)
   end

test/pleroma/web/o_auth/o_auth_controller_test.exs

@@ -7,7 +7,6 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
 
   import Pleroma.Factory
 
-  alias Pleroma.Helpers.AuthHelper
   alias Pleroma.MFA
   alias Pleroma.MFA.TOTP
   alias Pleroma.Repo
@@ -456,7 +455,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
 
       conn =
         conn
-        |> AuthHelper.put_session_token(token.token)
+        |> put_req_header("authorization", "Bearer #{token.token}")
         |> get(
           "/oauth/authorize",
           %{
@@ -480,7 +479,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
 
       conn =
         conn
-        |> AuthHelper.put_session_token(token.token)
+        |> put_req_header("authorization", "Bearer #{token.token}")
         |> get(
           "/oauth/authorize",
           %{
@@ -503,7 +502,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
 
       conn =
         conn
-        |> AuthHelper.put_session_token(token.token)
+        |> put_req_header("authorization", "Bearer #{token.token}")
         |> get(
           "/oauth/authorize",
           %{
@@ -529,7 +528,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
 
       conn =
         conn
-        |> AuthHelper.put_session_token(token.token)
+        |> put_req_header("authorization", "Bearer #{token.token}")
         |> get(
           "/oauth/authorize",
           %{
@@ -553,7 +552,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
 
       conn =
         conn
-        |> AuthHelper.put_session_token(token.token)
+        |> put_req_header("authorization", "Bearer #{token.token}")
         |> get(
           "/oauth/authorize",
           %{
@@ -611,34 +610,6 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
       end
     end
 
-    test "should not authorize from cookie" do
-      user = insert(:user)
-      app = insert(:oauth_app)
-      oauth_token = insert(:oauth_token, user: user, app: app)
-      redirect_uri = OAuthController.default_redirect_uri(app)
-
-      conn =
-        build_conn()
-        |> Plug.Session.call(Plug.Session.init(@session_opts))
-        |> fetch_session()
-        |> AuthHelper.put_session_token(oauth_token.token)
-        |> post(
-          "/oauth/authorize",
-          %{
-            "authorization" => %{
-              "name" => user.nickname,
-              "client_id" => app.client_id,
-              "redirect_uri" => redirect_uri,
-              "scope" => app.scopes,
-              "state" => "statepassed"
-            }
-          }
-        )
-
-      target = redirected_to(conn)
-      refute target =~ redirect_uri
-    end
-
     test "redirect to on two-factor auth page" do
       otp_secret = TOTP.generate_secret()
 
@@ -1211,6 +1182,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
 
       response =
         build_conn()
+        |> put_req_header("authorization", "Bearer #{access_token.token}")
         |> post("/oauth/token", %{
           "grant_type" => "refresh_token",
           "refresh_token" => access_token.refresh_token,
@@ -1260,12 +1232,11 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
         build_conn()
         |> Plug.Session.call(Plug.Session.init(@session_opts))
         |> fetch_session()
-        |> AuthHelper.put_session_token(oauth_token.token)
+        |> put_req_header("authorization", "Bearer #{oauth_token.token}")
         |> post("/oauth/revoke", %{"token" => oauth_token.token})
 
       assert json_response(conn, 200)
 
-      refute AuthHelper.get_session_token(conn)
       assert Token.get_by_token(oauth_token.token) == {:error, :not_found}
     end
 
@@ -1279,12 +1250,11 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
         build_conn()
         |> Plug.Session.call(Plug.Session.init(@session_opts))
         |> fetch_session()
-        |> AuthHelper.put_session_token(oauth_token.token)
+        |> put_req_header("authorization", "Bearer #{oauth_token.token}")
         |> post("/oauth/revoke", %{"token" => other_app_oauth_token.token})
 
       assert json_response(conn, 200)
 
-      assert AuthHelper.get_session_token(conn) == oauth_token.token
       assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found}
     end
 

test/pleroma/web/plugs/o_auth_plug_test.exs

@@ -5,11 +5,8 @@
 defmodule Pleroma.Web.Plugs.OAuthPlugTest do
   use Pleroma.Web.ConnCase, async: true
 
-  alias Pleroma.Helpers.AuthHelper
   alias Pleroma.Web.OAuth.Token
-  alias Pleroma.Web.OAuth.Token.Strategy.Revoke
   alias Pleroma.Web.Plugs.OAuthPlug
-  alias Plug.Session
 
   import Pleroma.Factory
 
@@ -72,57 +69,4 @@ defmodule Pleroma.Web.Plugs.OAuthPlugTest do
 
     refute conn.assigns[:user]
   end
-
-  describe "with :oauth_token in session, " do
-    setup %{token: oauth_token, conn: conn} do
-      session_opts = [
-        store: :cookie,
-        key: "_test",
-        signing_salt: "cooldude"
-      ]
-
-      conn =
-        conn
-        |> Session.call(Session.init(session_opts))
-        |> fetch_session()
-        |> AuthHelper.put_session_token(oauth_token.token)
-
-      %{conn: conn}
-    end
-
-    test "if session-stored token matches a valid OAuth token, should not assign :user and :token", %{
-      conn: conn,
-      user: user,
-      token: oauth_token
-    } do
-      conn = OAuthPlug.call(conn, %{})
-
-      refute conn.assigns[:user]
-      refute conn.assigns[:token]
-    end
-
-    test "if session-stored token matches an expired OAuth token, does nothing", %{
-      conn: conn,
-      token: oauth_token
-    } do
-      expired_valid_until = NaiveDateTime.add(NaiveDateTime.utc_now(), -3600 * 24, :second)
-
-      oauth_token
-      |> Ecto.Changeset.change(valid_until: expired_valid_until)
-      |> Pleroma.Repo.update()
-
-      ret_conn = OAuthPlug.call(conn, %{})
-      assert ret_conn == conn
-    end
-
-    test "if session-stored token matches a revoked OAuth token, does nothing", %{
-      conn: conn,
-      token: oauth_token
-    } do
-      Revoke.revoke(oauth_token)
-
-      ret_conn = OAuthPlug.call(conn, %{})
-      assert ret_conn == conn
-    end
-  end
 end

test/pleroma/web/plugs/set_user_session_id_plug_test.exs

@@ -1,43 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Pleroma.Web.Plugs.SetUserSessionIdPlugTest do
-  use Pleroma.Web.ConnCase, async: true
-
-  alias Pleroma.Helpers.AuthHelper
-  alias Pleroma.Web.Plugs.SetUserSessionIdPlug
-
-  setup %{conn: conn} do
-    session_opts = [
-      store: :cookie,
-      key: "_test",
-      signing_salt: "cooldude"
-    ]
-
-    conn =
-      conn
-      |> Plug.Session.call(Plug.Session.init(session_opts))
-      |> fetch_session()
-
-    %{conn: conn}
-  end
-
-  test "doesn't do anything if the user isn't set", %{conn: conn} do
-    ret_conn = SetUserSessionIdPlug.call(conn, %{})
-
-    assert ret_conn == conn
-  end
-
-  test "sets session token basing on :token assign", %{conn: conn} do
-    %{user: user, token: oauth_token} = oauth_access(["read"])
-
-    ret_conn =
-      conn
-      |> assign(:user, user)
-      |> assign(:token, oauth_token)
-      |> SetUserSessionIdPlug.call(%{})
-
-    assert AuthHelper.get_session_token(ret_conn) == oauth_token.token
-  end
-end