diff --git a/lib/pleroma/helpers/auth_helper.ex b/lib/pleroma/helpers/auth_helper.ex
index 13e4c8158..d56f6f461 100644
--- a/lib/pleroma/helpers/auth_helper.ex
+++ b/lib/pleroma/helpers/auth_helper.ex
@@ -4,12 +4,9 @@
defmodule Pleroma.Helpers.AuthHelper do
alias Pleroma.Web.Plugs.OAuthScopesPlug
- alias Plug.Conn
import Plug.Conn
- @oauth_token_session_key :oauth_token
-
@doc """
Skips OAuth permissions (scopes) checks, assigns nil `:token`.
Intended to be used with explicit authentication and only when OAuth token cannot be determined.
@@ -28,19 +25,4 @@ defmodule Pleroma.Helpers.AuthHelper do
|> assign(:token, nil)
|> put_private(:authentication_ignored, true)
end
-
- @doc "Gets OAuth token string from session"
- def get_session_token(%Conn{} = conn) do
- get_session(conn, @oauth_token_session_key)
- end
-
- @doc "Updates OAuth token string in session"
- def put_session_token(%Conn{} = conn, token) when is_binary(token) do
- put_session(conn, @oauth_token_session_key, token)
- end
-
- @doc "Deletes OAuth token string from session"
- def delete_session_token(%Conn{} = conn) do
- delete_session(conn, @oauth_token_session_key)
- end
end
diff --git a/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex b/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex
index dccc39699..f415e5931 100644
--- a/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex
+++ b/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex
@@ -7,7 +7,6 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do
import Pleroma.Web.ControllerHelper, only: [json_response: 3]
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.Helpers.UriHelper
alias Pleroma.User
alias Pleroma.Web.OAuth.App
@@ -67,9 +66,8 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do
def logout(conn, _) do
conn =
with %{assigns: %{token: %Token{} = oauth_token}} <- conn,
- session_token = AuthHelper.get_session_token(conn),
- {:ok, %Token{token: ^session_token}} <- RevokeToken.revoke(oauth_token) do
- AuthHelper.delete_session_token(conn)
+ {:ok, %Token{token: _session_token}} <- RevokeToken.revoke(oauth_token) do
+ conn
else
_ -> conn
end
diff --git a/lib/pleroma/web/o_auth/o_auth_controller.ex b/lib/pleroma/web/o_auth/o_auth_controller.ex
index 63f82420c..43536f95d 100644
--- a/lib/pleroma/web/o_auth/o_auth_controller.ex
+++ b/lib/pleroma/web/o_auth/o_auth_controller.ex
@@ -5,7 +5,6 @@
defmodule Pleroma.Web.OAuth.OAuthController do
use Pleroma.Web, :controller
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.Helpers.UriHelper
alias Pleroma.Maps
alias Pleroma.MFA
@@ -78,7 +77,8 @@ defmodule Pleroma.Web.OAuth.OAuthController do
scopes = Scopes.fetch_scopes(params, available_scopes)
# if we already have a token for this specific setup, we can use that
- with %App{} <- app,
+ with false <- Params.truthy_param?(params["force_login"]),
+ %App{} <- app,
{:ok, _} <- Scopes.validate(scopes, app.scopes),
{:ok, %Token{} = token} <- Token.get_by_app(app) do
token = Repo.preload(token, :app)
@@ -330,9 +330,8 @@ defmodule Pleroma.Web.OAuth.OAuthController do
# Bad request
def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params)
- def after_token_exchange(%Plug.Conn{} = conn, %{token: token} = view_params) do
+ def after_token_exchange(%Plug.Conn{} = conn, %{token: _token} = view_params) do
conn
- |> AuthHelper.put_session_token(token.token)
|> json(OAuthView.render("token.json", view_params))
end
@@ -391,15 +390,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do
with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token),
- {:ok, oauth_token} <- RevokeToken.revoke(oauth_token) do
- conn =
- with session_token = AuthHelper.get_session_token(conn),
- %Token{token: ^session_token} <- oauth_token do
- AuthHelper.delete_session_token(conn)
- else
- _ -> conn
- end
-
+ {:ok, _oauth_token} <- RevokeToken.revoke(oauth_token) do
json(conn, %{})
else
_error ->
diff --git a/lib/pleroma/web/o_auth/token.ex b/lib/pleroma/web/o_auth/token.ex
index 612707e1f..08c8cd298 100644
--- a/lib/pleroma/web/o_auth/token.ex
+++ b/lib/pleroma/web/o_auth/token.ex
@@ -41,7 +41,7 @@ defmodule Pleroma.Web.OAuth.Token do
def get_by_app(%App{} = app) do
app.id
- |> Query.get_by_app()
+ |> Query.get_unexpired_by_app()
|> Repo.find_resource()
end
diff --git a/lib/pleroma/web/o_auth/token/query.ex b/lib/pleroma/web/o_auth/token/query.ex
index fb0f74086..8edfcf5d7 100644
--- a/lib/pleroma/web/o_auth/token/query.ex
+++ b/lib/pleroma/web/o_auth/token/query.ex
@@ -23,12 +23,17 @@ defmodule Pleroma.Web.OAuth.Token.Query do
from(q in query, where: q.token == ^token)
end
- @spec get_by_app(query, String.t()) :: query
- def get_by_app(query \\ Token, app_id) do
+ @spec get_unexpired_by_app(query, String.t()) :: query
+ def get_unexpired_by_app(query \\ Token, app_id) do
time = NaiveDateTime.utc_now()
from(q in query, where: q.app_id == ^app_id and q.valid_until > ^time, limit: 1)
end
+ @spec get_by_app(query, String.t()) :: query
+ def get_by_app(query \\ Token, app_id) do
+ from(q in query, where: q.app_id == ^app_id, limit: 1)
+ end
+
@spec get_by_id(query, String.t()) :: query
def get_by_id(query \\ Token, id) do
from(q in query, where: q.id == ^id)
diff --git a/lib/pleroma/web/plugs/set_user_session_id_plug.ex b/lib/pleroma/web/plugs/set_user_session_id_plug.ex
deleted file mode 100644
index a1cfa0915..000000000
--- a/lib/pleroma/web/plugs/set_user_session_id_plug.ex
+++ /dev/null
@@ -1,18 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2021 Pleroma Authors
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Pleroma.Web.Plugs.SetUserSessionIdPlug do
- alias Pleroma.Helpers.AuthHelper
- alias Pleroma.Web.OAuth.Token
-
- def init(opts) do
- opts
- end
-
- def call(%{assigns: %{token: %Token{} = oauth_token}} = conn, _) do
- AuthHelper.put_session_token(conn, oauth_token.token)
- end
-
- def call(conn, _), do: conn
-end
diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex
index 1232bc8cb..f2d6b0aff 100644
--- a/lib/pleroma/web/router.ex
+++ b/lib/pleroma/web/router.ex
@@ -57,7 +57,6 @@ defmodule Pleroma.Web.Router do
pipeline :after_auth do
plug(Pleroma.Web.Plugs.UserEnabledPlug)
- plug(Pleroma.Web.Plugs.SetUserSessionIdPlug)
plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
plug(Pleroma.Web.Plugs.UserTrackingPlug)
end
diff --git a/test/pleroma/web/o_auth/o_auth_controller_test.exs b/test/pleroma/web/o_auth/o_auth_controller_test.exs
index 00ce0c95f..4e197a485 100644
--- a/test/pleroma/web/o_auth/o_auth_controller_test.exs
+++ b/test/pleroma/web/o_auth/o_auth_controller_test.exs
@@ -7,7 +7,6 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
import Pleroma.Factory
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.MFA
alias Pleroma.MFA.TOTP
alias Pleroma.Repo
@@ -456,7 +455,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
@@ -480,7 +479,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
@@ -503,7 +502,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
@@ -529,7 +528,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
@@ -553,7 +552,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
@@ -611,34 +610,6 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
end
end
- test "should not authorize from cookie" do
- user = insert(:user)
- app = insert(:oauth_app)
- oauth_token = insert(:oauth_token, user: user, app: app)
- redirect_uri = OAuthController.default_redirect_uri(app)
-
- conn =
- build_conn()
- |> Plug.Session.call(Plug.Session.init(@session_opts))
- |> fetch_session()
- |> AuthHelper.put_session_token(oauth_token.token)
- |> post(
- "/oauth/authorize",
- %{
- "authorization" => %{
- "name" => user.nickname,
- "client_id" => app.client_id,
- "redirect_uri" => redirect_uri,
- "scope" => app.scopes,
- "state" => "statepassed"
- }
- }
- )
-
- target = redirected_to(conn)
- refute target =~ redirect_uri
- end
-
test "redirect to on two-factor auth page" do
otp_secret = TOTP.generate_secret()
@@ -1211,6 +1182,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
response =
build_conn()
+ |> put_req_header("authorization", "Bearer #{access_token.token}")
|> post("/oauth/token", %{
"grant_type" => "refresh_token",
"refresh_token" => access_token.refresh_token,
@@ -1260,12 +1232,11 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
build_conn()
|> Plug.Session.call(Plug.Session.init(@session_opts))
|> fetch_session()
- |> AuthHelper.put_session_token(oauth_token.token)
+ |> put_req_header("authorization", "Bearer #{oauth_token.token}")
|> post("/oauth/revoke", %{"token" => oauth_token.token})
assert json_response(conn, 200)
- refute AuthHelper.get_session_token(conn)
assert Token.get_by_token(oauth_token.token) == {:error, :not_found}
end
@@ -1279,12 +1250,11 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
build_conn()
|> Plug.Session.call(Plug.Session.init(@session_opts))
|> fetch_session()
- |> AuthHelper.put_session_token(oauth_token.token)
+ |> put_req_header("authorization", "Bearer #{oauth_token.token}")
|> post("/oauth/revoke", %{"token" => other_app_oauth_token.token})
assert json_response(conn, 200)
- assert AuthHelper.get_session_token(conn) == oauth_token.token
assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found}
end
diff --git a/test/pleroma/web/plugs/o_auth_plug_test.exs b/test/pleroma/web/plugs/o_auth_plug_test.exs
index 8fb7d1dfd..caabfc1cb 100644
--- a/test/pleroma/web/plugs/o_auth_plug_test.exs
+++ b/test/pleroma/web/plugs/o_auth_plug_test.exs
@@ -5,11 +5,8 @@
defmodule Pleroma.Web.Plugs.OAuthPlugTest do
use Pleroma.Web.ConnCase, async: true
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.Web.OAuth.Token
- alias Pleroma.Web.OAuth.Token.Strategy.Revoke
alias Pleroma.Web.Plugs.OAuthPlug
- alias Plug.Session
import Pleroma.Factory
@@ -72,57 +69,4 @@ defmodule Pleroma.Web.Plugs.OAuthPlugTest do
refute conn.assigns[:user]
end
-
- describe "with :oauth_token in session, " do
- setup %{token: oauth_token, conn: conn} do
- session_opts = [
- store: :cookie,
- key: "_test",
- signing_salt: "cooldude"
- ]
-
- conn =
- conn
- |> Session.call(Session.init(session_opts))
- |> fetch_session()
- |> AuthHelper.put_session_token(oauth_token.token)
-
- %{conn: conn}
- end
-
- test "if session-stored token matches a valid OAuth token, should not assign :user and :token", %{
- conn: conn,
- user: user,
- token: oauth_token
- } do
- conn = OAuthPlug.call(conn, %{})
-
- refute conn.assigns[:user]
- refute conn.assigns[:token]
- end
-
- test "if session-stored token matches an expired OAuth token, does nothing", %{
- conn: conn,
- token: oauth_token
- } do
- expired_valid_until = NaiveDateTime.add(NaiveDateTime.utc_now(), -3600 * 24, :second)
-
- oauth_token
- |> Ecto.Changeset.change(valid_until: expired_valid_until)
- |> Pleroma.Repo.update()
-
- ret_conn = OAuthPlug.call(conn, %{})
- assert ret_conn == conn
- end
-
- test "if session-stored token matches a revoked OAuth token, does nothing", %{
- conn: conn,
- token: oauth_token
- } do
- Revoke.revoke(oauth_token)
-
- ret_conn = OAuthPlug.call(conn, %{})
- assert ret_conn == conn
- end
- end
end
diff --git a/test/pleroma/web/plugs/set_user_session_id_plug_test.exs b/test/pleroma/web/plugs/set_user_session_id_plug_test.exs
deleted file mode 100644
index 9814c80d8..000000000
--- a/test/pleroma/web/plugs/set_user_session_id_plug_test.exs
+++ /dev/null
@@ -1,43 +0,0 @@
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2021 Pleroma Authors
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Pleroma.Web.Plugs.SetUserSessionIdPlugTest do
- use Pleroma.Web.ConnCase, async: true
-
- alias Pleroma.Helpers.AuthHelper
- alias Pleroma.Web.Plugs.SetUserSessionIdPlug
-
- setup %{conn: conn} do
- session_opts = [
- store: :cookie,
- key: "_test",
- signing_salt: "cooldude"
- ]
-
- conn =
- conn
- |> Plug.Session.call(Plug.Session.init(session_opts))
- |> fetch_session()
-
- %{conn: conn}
- end
-
- test "doesn't do anything if the user isn't set", %{conn: conn} do
- ret_conn = SetUserSessionIdPlug.call(conn, %{})
-
- assert ret_conn == conn
- end
-
- test "sets session token basing on :token assign", %{conn: conn} do
- %{user: user, token: oauth_token} = oauth_access(["read"])
-
- ret_conn =
- conn
- |> assign(:user, user)
- |> assign(:token, oauth_token)
- |> SetUserSessionIdPlug.call(%{})
-
- assert AuthHelper.get_session_token(ret_conn) == oauth_token.token
- end
-end