forked from AkkomaGang/akkoma
parent
aa681d7e15
commit
8d7b63a766
12 changed files with 248 additions and 193 deletions
|
@ -4,9 +4,12 @@
|
||||||
|
|
||||||
defmodule Pleroma.Helpers.AuthHelper do
|
defmodule Pleroma.Helpers.AuthHelper do
|
||||||
alias Pleroma.Web.Plugs.OAuthScopesPlug
|
alias Pleroma.Web.Plugs.OAuthScopesPlug
|
||||||
|
alias Plug.Conn
|
||||||
|
|
||||||
import Plug.Conn
|
import Plug.Conn
|
||||||
|
|
||||||
|
@oauth_token_session_key :oauth_token
|
||||||
|
|
||||||
@doc """
|
@doc """
|
||||||
Skips OAuth permissions (scopes) checks, assigns nil `:token`.
|
Skips OAuth permissions (scopes) checks, assigns nil `:token`.
|
||||||
Intended to be used with explicit authentication and only when OAuth token cannot be determined.
|
Intended to be used with explicit authentication and only when OAuth token cannot be determined.
|
||||||
|
@ -25,4 +28,19 @@ def drop_auth_info(conn) do
|
||||||
|> assign(:token, nil)
|
|> assign(:token, nil)
|
||||||
|> put_private(:authentication_ignored, true)
|
|> put_private(:authentication_ignored, true)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@doc "Gets OAuth token string from session"
|
||||||
|
def get_session_token(%Conn{} = conn) do
|
||||||
|
get_session(conn, @oauth_token_session_key)
|
||||||
|
end
|
||||||
|
|
||||||
|
@doc "Updates OAuth token string in session"
|
||||||
|
def put_session_token(%Conn{} = conn, token) when is_binary(token) do
|
||||||
|
put_session(conn, @oauth_token_session_key, token)
|
||||||
|
end
|
||||||
|
|
||||||
|
@doc "Deletes OAuth token string from session"
|
||||||
|
def delete_session_token(%Conn{} = conn) do
|
||||||
|
delete_session(conn, @oauth_token_session_key)
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -7,6 +7,7 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do
|
||||||
|
|
||||||
import Pleroma.Web.ControllerHelper, only: [json_response: 3]
|
import Pleroma.Web.ControllerHelper, only: [json_response: 3]
|
||||||
|
|
||||||
|
alias Pleroma.Helpers.AuthHelper
|
||||||
alias Pleroma.Helpers.UriHelper
|
alias Pleroma.Helpers.UriHelper
|
||||||
alias Pleroma.User
|
alias Pleroma.User
|
||||||
alias Pleroma.Web.OAuth.App
|
alias Pleroma.Web.OAuth.App
|
||||||
|
@ -33,6 +34,7 @@ def login(conn, %{"code" => auth_token} = params) do
|
||||||
|> UriHelper.modify_uri_params(%{"access_token" => oauth_token.token})
|
|> UriHelper.modify_uri_params(%{"access_token" => oauth_token.token})
|
||||||
|
|
||||||
conn
|
conn
|
||||||
|
|> AuthHelper.put_session_token(oauth_token.token)
|
||||||
|> redirect(to: redirect_to)
|
|> redirect(to: redirect_to)
|
||||||
else
|
else
|
||||||
_ -> redirect_to_oauth_form(conn, params)
|
_ -> redirect_to_oauth_form(conn, params)
|
||||||
|
@ -40,9 +42,9 @@ def login(conn, %{"code" => auth_token} = params) do
|
||||||
end
|
end
|
||||||
|
|
||||||
def login(conn, params) do
|
def login(conn, params) do
|
||||||
with %{assigns: %{user: %User{}, token: %Token{app_id: app_id, token: token}}} <- conn,
|
with %{assigns: %{user: %User{}, token: %Token{app_id: app_id}}} <- conn,
|
||||||
{:ok, %{id: ^app_id}} <- local_mastofe_app() do
|
{:ok, %{id: ^app_id}} <- local_mastofe_app() do
|
||||||
redirect(conn, to: local_mastodon_post_login_path(conn) <> "?access_token=#{token}")
|
redirect(conn, to: local_mastodon_post_login_path(conn))
|
||||||
else
|
else
|
||||||
_ -> redirect_to_oauth_form(conn, params)
|
_ -> redirect_to_oauth_form(conn, params)
|
||||||
end
|
end
|
||||||
|
@ -66,8 +68,9 @@ defp redirect_to_oauth_form(conn, _params) do
|
||||||
def logout(conn, _) do
|
def logout(conn, _) do
|
||||||
conn =
|
conn =
|
||||||
with %{assigns: %{token: %Token{} = oauth_token}} <- conn,
|
with %{assigns: %{token: %Token{} = oauth_token}} <- conn,
|
||||||
{:ok, %Token{token: _session_token}} <- RevokeToken.revoke(oauth_token) do
|
session_token = AuthHelper.get_session_token(conn),
|
||||||
conn
|
{:ok, %Token{token: ^session_token}} <- RevokeToken.revoke(oauth_token) do
|
||||||
|
AuthHelper.delete_session_token(conn)
|
||||||
else
|
else
|
||||||
_ -> conn
|
_ -> conn
|
||||||
end
|
end
|
||||||
|
|
|
@ -5,6 +5,7 @@
|
||||||
defmodule Pleroma.Web.OAuth.OAuthController do
|
defmodule Pleroma.Web.OAuth.OAuthController do
|
||||||
use Pleroma.Web, :controller
|
use Pleroma.Web, :controller
|
||||||
|
|
||||||
|
alias Pleroma.Helpers.AuthHelper
|
||||||
alias Pleroma.Helpers.UriHelper
|
alias Pleroma.Helpers.UriHelper
|
||||||
alias Pleroma.Maps
|
alias Pleroma.Maps
|
||||||
alias Pleroma.MFA
|
alias Pleroma.MFA
|
||||||
|
@ -71,62 +72,38 @@ def authorize(
|
||||||
|
|
||||||
def authorize(%Plug.Conn{} = conn, params), do: do_authorize(conn, params)
|
def authorize(%Plug.Conn{} = conn, params), do: do_authorize(conn, params)
|
||||||
|
|
||||||
defp maybe_remove_token(%Plug.Conn{assigns: %{token: %{app: id}}} = conn, %App{id: id}) do
|
|
||||||
conn
|
|
||||||
end
|
|
||||||
|
|
||||||
defp maybe_remove_token(conn, _app) do
|
|
||||||
conn
|
|
||||||
|> assign(:token, nil)
|
|
||||||
end
|
|
||||||
|
|
||||||
defp do_authorize(%Plug.Conn{} = conn, params) do
|
defp do_authorize(%Plug.Conn{} = conn, params) do
|
||||||
app = Repo.get_by(App, client_id: params["client_id"])
|
app = Repo.get_by(App, client_id: params["client_id"])
|
||||||
conn = maybe_remove_token(conn, app)
|
|
||||||
available_scopes = (app && app.scopes) || []
|
available_scopes = (app && app.scopes) || []
|
||||||
scopes = Scopes.fetch_scopes(params, available_scopes)
|
scopes = Scopes.fetch_scopes(params, available_scopes)
|
||||||
|
|
||||||
# if we already have a token for this specific setup, we can use that
|
user =
|
||||||
with false <- Params.truthy_param?(params["force_login"]),
|
with %{assigns: %{user: %User{} = user}} <- conn do
|
||||||
%App{} <- app,
|
user
|
||||||
%{assigns: %{user: %Pleroma.User{} = user}} <- conn,
|
else
|
||||||
{:ok, %Token{} = token} <- Token.get_preexisting_by_app_and_user(app, user),
|
_ -> nil
|
||||||
true <- scopes == token.scopes do
|
end
|
||||||
token = Repo.preload(token, :app)
|
|
||||||
|
|
||||||
conn
|
scopes =
|
||||||
|> assign(:token, token)
|
if scopes == [] do
|
||||||
|> handle_existing_authorization(params)
|
available_scopes
|
||||||
else
|
else
|
||||||
_ ->
|
scopes
|
||||||
user =
|
end
|
||||||
with %{assigns: %{user: %User{} = user}} <- conn do
|
|
||||||
user
|
|
||||||
else
|
|
||||||
_ -> nil
|
|
||||||
end
|
|
||||||
|
|
||||||
scopes =
|
# Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template
|
||||||
if scopes == [] do
|
render(conn, Authenticator.auth_template(), %{
|
||||||
available_scopes
|
user: user,
|
||||||
else
|
app: app && Map.delete(app, :client_secret),
|
||||||
scopes
|
response_type: params["response_type"],
|
||||||
end
|
client_id: params["client_id"],
|
||||||
|
available_scopes: available_scopes,
|
||||||
# Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template
|
scopes: scopes,
|
||||||
render(conn, Authenticator.auth_template(), %{
|
redirect_uri: params["redirect_uri"],
|
||||||
user: user,
|
state: params["state"],
|
||||||
app: app && Map.delete(app, :client_secret),
|
params: params,
|
||||||
response_type: params["response_type"],
|
view_module: OAuthView
|
||||||
client_id: params["client_id"],
|
})
|
||||||
available_scopes: available_scopes,
|
|
||||||
scopes: scopes,
|
|
||||||
redirect_uri: params["redirect_uri"],
|
|
||||||
state: params["state"],
|
|
||||||
params: params,
|
|
||||||
view_module: OAuthView
|
|
||||||
})
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
|
|
||||||
defp handle_existing_authorization(
|
defp handle_existing_authorization(
|
||||||
|
@ -341,8 +318,9 @@ def token_exchange(%Plug.Conn{} = conn, %{"grant_type" => "client_credentials"}
|
||||||
# Bad request
|
# Bad request
|
||||||
def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params)
|
def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params)
|
||||||
|
|
||||||
def after_token_exchange(%Plug.Conn{} = conn, %{token: _token} = view_params) do
|
def after_token_exchange(%Plug.Conn{} = conn, %{token: token} = view_params) do
|
||||||
conn
|
conn
|
||||||
|
|> AuthHelper.put_session_token(token.token)
|
||||||
|> json(OAuthView.render("token.json", view_params))
|
|> json(OAuthView.render("token.json", view_params))
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -401,7 +379,15 @@ defp handle_token_exchange_error(%Plug.Conn{} = conn, _error) do
|
||||||
|
|
||||||
def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do
|
def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do
|
||||||
with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token),
|
with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token),
|
||||||
{:ok, _oauth_token} <- RevokeToken.revoke(oauth_token) do
|
{:ok, oauth_token} <- RevokeToken.revoke(oauth_token) do
|
||||||
|
conn =
|
||||||
|
with session_token = AuthHelper.get_session_token(conn),
|
||||||
|
%Token{token: ^session_token} <- oauth_token do
|
||||||
|
AuthHelper.delete_session_token(conn)
|
||||||
|
else
|
||||||
|
_ -> conn
|
||||||
|
end
|
||||||
|
|
||||||
json(conn, %{})
|
json(conn, %{})
|
||||||
else
|
else
|
||||||
_error ->
|
_error ->
|
||||||
|
|
|
@ -39,12 +39,6 @@ def get_by_token(token) do
|
||||||
|> Repo.find_resource()
|
|> Repo.find_resource()
|
||||||
end
|
end
|
||||||
|
|
||||||
def get_preexisting_by_app_and_user(%App{} = app, %User{} = user) do
|
|
||||||
app.id
|
|
||||||
|> Query.get_unexpired_by_app_and_user(user)
|
|
||||||
|> Repo.find_resource()
|
|
||||||
end
|
|
||||||
|
|
||||||
@doc "Gets token for app by access token"
|
@doc "Gets token for app by access token"
|
||||||
@spec get_by_token(App.t(), String.t()) :: {:ok, t()} | {:error, :not_found}
|
@spec get_by_token(App.t(), String.t()) :: {:ok, t()} | {:error, :not_found}
|
||||||
def get_by_token(%App{id: app_id} = _app, token) do
|
def get_by_token(%App{id: app_id} = _app, token) do
|
||||||
|
|
|
@ -23,19 +23,9 @@ def get_by_token(query \\ Token, token) do
|
||||||
from(q in query, where: q.token == ^token)
|
from(q in query, where: q.token == ^token)
|
||||||
end
|
end
|
||||||
|
|
||||||
@spec get_unexpired_by_app_and_user(query, String.t()) :: query
|
|
||||||
def get_unexpired_by_app_and_user(query \\ Token, app_id, %Pleroma.User{id: user_id}) do
|
|
||||||
time = NaiveDateTime.utc_now()
|
|
||||||
|
|
||||||
from(q in query,
|
|
||||||
where: q.app_id == ^app_id and q.valid_until > ^time and q.user_id == ^user_id,
|
|
||||||
limit: 1
|
|
||||||
)
|
|
||||||
end
|
|
||||||
|
|
||||||
@spec get_by_app(query, String.t()) :: query
|
@spec get_by_app(query, String.t()) :: query
|
||||||
def get_by_app(query \\ Token, app_id) do
|
def get_by_app(query \\ Token, app_id) do
|
||||||
from(q in query, where: q.app_id == ^app_id, limit: 1)
|
from(q in query, where: q.app_id == ^app_id)
|
||||||
end
|
end
|
||||||
|
|
||||||
@spec get_by_id(query, String.t()) :: query
|
@spec get_by_id(query, String.t()) :: query
|
||||||
|
|
|
@ -8,6 +8,7 @@ defmodule Pleroma.Web.Plugs.OAuthPlug do
|
||||||
import Plug.Conn
|
import Plug.Conn
|
||||||
import Ecto.Query
|
import Ecto.Query
|
||||||
|
|
||||||
|
alias Pleroma.Helpers.AuthHelper
|
||||||
alias Pleroma.Repo
|
alias Pleroma.Repo
|
||||||
alias Pleroma.User
|
alias Pleroma.User
|
||||||
alias Pleroma.Web.OAuth.App
|
alias Pleroma.Web.OAuth.App
|
||||||
|
@ -17,6 +18,8 @@ defmodule Pleroma.Web.Plugs.OAuthPlug do
|
||||||
|
|
||||||
def init(options), do: options
|
def init(options), do: options
|
||||||
|
|
||||||
|
def call(%{assigns: %{user: %User{}}} = conn, _), do: conn
|
||||||
|
|
||||||
def call(conn, _) do
|
def call(conn, _) do
|
||||||
with {:ok, token_str} <- fetch_token_str(conn) do
|
with {:ok, token_str} <- fetch_token_str(conn) do
|
||||||
with {:ok, user, user_token} <- fetch_user_and_token(token_str),
|
with {:ok, user, user_token} <- fetch_user_and_token(token_str),
|
||||||
|
@ -79,7 +82,7 @@ defp fetch_token_str(%Plug.Conn{} = conn) do
|
||||||
with {:ok, token} <- fetch_token_str(headers) do
|
with {:ok, token} <- fetch_token_str(headers) do
|
||||||
{:ok, token}
|
{:ok, token}
|
||||||
else
|
else
|
||||||
_ -> :no_token_found
|
_ -> fetch_token_from_session(conn)
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -93,4 +96,12 @@ defp fetch_token_str([token | tail]) do
|
||||||
end
|
end
|
||||||
|
|
||||||
defp fetch_token_str([]), do: :no_token_found
|
defp fetch_token_str([]), do: :no_token_found
|
||||||
|
|
||||||
|
@spec fetch_token_from_session(Plug.Conn.t()) :: :no_token_found | {:ok, String.t()}
|
||||||
|
defp fetch_token_from_session(conn) do
|
||||||
|
case AuthHelper.get_session_token(conn) do
|
||||||
|
nil -> :no_token_found
|
||||||
|
token -> {:ok, token}
|
||||||
|
end
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
18
lib/pleroma/web/plugs/set_user_session_id_plug.ex
Normal file
18
lib/pleroma/web/plugs/set_user_session_id_plug.ex
Normal file
|
@ -0,0 +1,18 @@
|
||||||
|
# Pleroma: A lightweight social networking server
|
||||||
|
# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
|
||||||
|
# SPDX-License-Identifier: AGPL-3.0-only
|
||||||
|
|
||||||
|
defmodule Pleroma.Web.Plugs.SetUserSessionIdPlug do
|
||||||
|
alias Pleroma.Helpers.AuthHelper
|
||||||
|
alias Pleroma.Web.OAuth.Token
|
||||||
|
|
||||||
|
def init(opts) do
|
||||||
|
opts
|
||||||
|
end
|
||||||
|
|
||||||
|
def call(%{assigns: %{token: %Token{} = oauth_token}} = conn, _) do
|
||||||
|
AuthHelper.put_session_token(conn, oauth_token.token)
|
||||||
|
end
|
||||||
|
|
||||||
|
def call(conn, _), do: conn
|
||||||
|
end
|
|
@ -57,6 +57,7 @@ defmodule Pleroma.Web.Router do
|
||||||
|
|
||||||
pipeline :after_auth do
|
pipeline :after_auth do
|
||||||
plug(Pleroma.Web.Plugs.UserEnabledPlug)
|
plug(Pleroma.Web.Plugs.UserEnabledPlug)
|
||||||
|
plug(Pleroma.Web.Plugs.SetUserSessionIdPlug)
|
||||||
plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
|
plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
|
||||||
plug(Pleroma.Web.Plugs.UserTrackingPlug)
|
plug(Pleroma.Web.Plugs.UserTrackingPlug)
|
||||||
end
|
end
|
||||||
|
@ -792,9 +793,11 @@ defmodule Pleroma.Web.Router do
|
||||||
|
|
||||||
get("/web/login", MastodonAPI.AuthController, :login)
|
get("/web/login", MastodonAPI.AuthController, :login)
|
||||||
delete("/auth/sign_out", MastodonAPI.AuthController, :logout)
|
delete("/auth/sign_out", MastodonAPI.AuthController, :logout)
|
||||||
get("/web/*path", MastoFEController, :index)
|
|
||||||
post("/auth/password", MastodonAPI.AuthController, :password_reset)
|
post("/auth/password", MastodonAPI.AuthController, :password_reset)
|
||||||
|
|
||||||
|
get("/web/*path", MastoFEController, :index)
|
||||||
|
|
||||||
get("/embed/:id", EmbedController, :show)
|
get("/embed/:id", EmbedController, :show)
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
4
mix.exs
4
mix.exs
|
@ -131,7 +131,7 @@ defp deps do
|
||||||
{:trailing_format_plug, "~> 0.0.7"},
|
{:trailing_format_plug, "~> 0.0.7"},
|
||||||
{:fast_sanitize, "~> 0.2.3"},
|
{:fast_sanitize, "~> 0.2.3"},
|
||||||
{:html_entities, "~> 0.5", override: true},
|
{:html_entities, "~> 0.5", override: true},
|
||||||
{:phoenix_html, "~> 3.0", override: true},
|
{:phoenix_html, "~> 3.1", override: true},
|
||||||
{:calendar, "~> 1.0"},
|
{:calendar, "~> 1.0"},
|
||||||
{:cachex, "~> 3.4"},
|
{:cachex, "~> 3.4"},
|
||||||
{:poison, "~> 3.0", override: true},
|
{:poison, "~> 3.0", override: true},
|
||||||
|
@ -152,7 +152,7 @@ defp deps do
|
||||||
ref: "f75cd55325e33cbea198fb41fe41871392f8fb76"},
|
ref: "f75cd55325e33cbea198fb41fe41871392f8fb76"},
|
||||||
{:cors_plug, "~> 2.0"},
|
{:cors_plug, "~> 2.0"},
|
||||||
{:web_push_encryption, "~> 0.3.1"},
|
{:web_push_encryption, "~> 0.3.1"},
|
||||||
{:swoosh, "~> 1.3"},
|
{:swoosh, "~> 1.0"},
|
||||||
{:phoenix_swoosh, "~> 0.3"},
|
{:phoenix_swoosh, "~> 0.3"},
|
||||||
{:gen_smtp, "~> 0.13"},
|
{:gen_smtp, "~> 0.13"},
|
||||||
{:ex_syslogger, "~> 1.4"},
|
{:ex_syslogger, "~> 1.4"},
|
||||||
|
|
|
@ -7,6 +7,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
|
||||||
|
|
||||||
import Pleroma.Factory
|
import Pleroma.Factory
|
||||||
|
|
||||||
|
alias Pleroma.Helpers.AuthHelper
|
||||||
alias Pleroma.MFA
|
alias Pleroma.MFA
|
||||||
alias Pleroma.MFA.TOTP
|
alias Pleroma.MFA.TOTP
|
||||||
alias Pleroma.Repo
|
alias Pleroma.Repo
|
||||||
|
@ -455,7 +456,7 @@ test "renders authentication page if user is already authenticated but `force_lo
|
||||||
|
|
||||||
conn =
|
conn =
|
||||||
conn
|
conn
|
||||||
|> put_req_header("authorization", "Bearer #{token.token}")
|
|> AuthHelper.put_session_token(token.token)
|
||||||
|> get(
|
|> get(
|
||||||
"/oauth/authorize",
|
"/oauth/authorize",
|
||||||
%{
|
%{
|
||||||
|
@ -470,130 +471,26 @@ test "renders authentication page if user is already authenticated but `force_lo
|
||||||
assert html_response(conn, 200) =~ ~s(type="submit")
|
assert html_response(conn, 200) =~ ~s(type="submit")
|
||||||
end
|
end
|
||||||
|
|
||||||
test "reuses authentication if the user is authenticated with another client",
|
test "renders authentication page if user is already authenticated but user request with another client",
|
||||||
%{
|
%{
|
||||||
|
app: app,
|
||||||
conn: conn
|
conn: conn
|
||||||
} do
|
} do
|
||||||
user = insert(:user)
|
token = insert(:oauth_token, app: app)
|
||||||
|
|
||||||
app = insert(:oauth_app, redirect_uris: "https://redirect.url")
|
|
||||||
other_app = insert(:oauth_app, redirect_uris: "https://redirect.url")
|
|
||||||
|
|
||||||
token = insert(:oauth_token, user: user, app: app)
|
|
||||||
reusable_token = insert(:oauth_token, app: other_app, user: user)
|
|
||||||
|
|
||||||
conn =
|
conn =
|
||||||
conn
|
conn
|
||||||
|> put_req_header("authorization", "Bearer #{token.token}")
|
|> AuthHelper.put_session_token(token.token)
|
||||||
|> get(
|
|> get(
|
||||||
"/oauth/authorize",
|
"/oauth/authorize",
|
||||||
%{
|
%{
|
||||||
"response_type" => "code",
|
"response_type" => "code",
|
||||||
"client_id" => other_app.client_id,
|
"client_id" => "another_client_id",
|
||||||
"redirect_uri" => OAuthController.default_redirect_uri(other_app),
|
"redirect_uri" => OAuthController.default_redirect_uri(app),
|
||||||
"scope" => "read"
|
"scope" => "read"
|
||||||
}
|
}
|
||||||
)
|
)
|
||||||
|
|
||||||
assert URI.decode(redirected_to(conn)) ==
|
|
||||||
"https://redirect.url?access_token=#{reusable_token.token}"
|
|
||||||
end
|
|
||||||
|
|
||||||
test "does not reuse other people's tokens",
|
|
||||||
%{
|
|
||||||
conn: conn
|
|
||||||
} do
|
|
||||||
user = insert(:user)
|
|
||||||
other_user = insert(:user)
|
|
||||||
|
|
||||||
app = insert(:oauth_app, redirect_uris: "https://redirect.url")
|
|
||||||
other_app = insert(:oauth_app, redirect_uris: "https://redirect.url")
|
|
||||||
|
|
||||||
token = insert(:oauth_token, user: user, app: app)
|
|
||||||
_not_reusable_token = insert(:oauth_token, app: other_app, user: other_user)
|
|
||||||
|
|
||||||
conn =
|
|
||||||
conn
|
|
||||||
|> put_req_header("authorization", "Bearer #{token.token}")
|
|
||||||
|> get(
|
|
||||||
"/oauth/authorize",
|
|
||||||
%{
|
|
||||||
"response_type" => "code",
|
|
||||||
"client_id" => other_app.client_id,
|
|
||||||
"redirect_uri" => OAuthController.default_redirect_uri(other_app),
|
|
||||||
"scope" => "read"
|
|
||||||
}
|
|
||||||
)
|
|
||||||
|
|
||||||
assert html_response(conn, 200) =~ ~s(type="submit")
|
|
||||||
end
|
|
||||||
|
|
||||||
test "does not reuse expired tokens",
|
|
||||||
%{
|
|
||||||
conn: conn
|
|
||||||
} do
|
|
||||||
user = insert(:user)
|
|
||||||
|
|
||||||
app = insert(:oauth_app, redirect_uris: "https://redirect.url")
|
|
||||||
|
|
||||||
other_app = insert(:oauth_app, redirect_uris: "https://redirect.url")
|
|
||||||
|
|
||||||
token = insert(:oauth_token, user: user, app: app)
|
|
||||||
|
|
||||||
_not_reusable_token =
|
|
||||||
insert(:oauth_token,
|
|
||||||
app: other_app,
|
|
||||||
user: user,
|
|
||||||
valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), -60 * 100)
|
|
||||||
)
|
|
||||||
|
|
||||||
conn =
|
|
||||||
conn
|
|
||||||
|> put_req_header("authorization", "Bearer #{token.token}")
|
|
||||||
|> get(
|
|
||||||
"/oauth/authorize",
|
|
||||||
%{
|
|
||||||
"response_type" => "code",
|
|
||||||
"client_id" => other_app.client_id,
|
|
||||||
"redirect_uri" => OAuthController.default_redirect_uri(other_app),
|
|
||||||
"scope" => "read"
|
|
||||||
}
|
|
||||||
)
|
|
||||||
|
|
||||||
assert html_response(conn, 200) =~ ~s(type="submit")
|
|
||||||
end
|
|
||||||
|
|
||||||
test "does not reuse tokens with the wrong scopes",
|
|
||||||
%{
|
|
||||||
conn: conn
|
|
||||||
} do
|
|
||||||
user = insert(:user)
|
|
||||||
|
|
||||||
app = insert(:oauth_app, redirect_uris: "https://redirect.url")
|
|
||||||
|
|
||||||
other_app = insert(:oauth_app, redirect_uris: "https://redirect.url")
|
|
||||||
|
|
||||||
token = insert(:oauth_token, user: user, app: app, scopes: ["read"])
|
|
||||||
|
|
||||||
_not_reusable_token =
|
|
||||||
insert(:oauth_token,
|
|
||||||
app: other_app,
|
|
||||||
user: user
|
|
||||||
)
|
|
||||||
|
|
||||||
conn =
|
|
||||||
conn
|
|
||||||
|> put_req_header("authorization", "Bearer #{token.token}")
|
|
||||||
|> get(
|
|
||||||
"/oauth/authorize",
|
|
||||||
%{
|
|
||||||
"response_type" => "code",
|
|
||||||
"client_id" => other_app.client_id,
|
|
||||||
"redirect_uri" => OAuthController.default_redirect_uri(other_app),
|
|
||||||
"scope" => "read write"
|
|
||||||
}
|
|
||||||
)
|
|
||||||
|
|
||||||
assert html_response(conn, 200) =~ ~s(type="submit")
|
assert html_response(conn, 200) =~ ~s(type="submit")
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -606,7 +503,7 @@ test "with existing authentication and non-OOB `redirect_uri`, redirects to app
|
||||||
|
|
||||||
conn =
|
conn =
|
||||||
conn
|
conn
|
||||||
|> put_req_header("authorization", "Bearer #{token.token}")
|
|> AuthHelper.put_session_token(token.token)
|
||||||
|> get(
|
|> get(
|
||||||
"/oauth/authorize",
|
"/oauth/authorize",
|
||||||
%{
|
%{
|
||||||
|
@ -632,7 +529,7 @@ test "with existing authentication and unlisted non-OOB `redirect_uri`, redirect
|
||||||
|
|
||||||
conn =
|
conn =
|
||||||
conn
|
conn
|
||||||
|> put_req_header("authorization", "Bearer #{token.token}")
|
|> AuthHelper.put_session_token(token.token)
|
||||||
|> get(
|
|> get(
|
||||||
"/oauth/authorize",
|
"/oauth/authorize",
|
||||||
%{
|
%{
|
||||||
|
@ -656,7 +553,7 @@ test "with existing authentication and OOB `redirect_uri`, redirects to app with
|
||||||
|
|
||||||
conn =
|
conn =
|
||||||
conn
|
conn
|
||||||
|> put_req_header("authorization", "Bearer #{token.token}")
|
|> AuthHelper.put_session_token(token.token)
|
||||||
|> get(
|
|> get(
|
||||||
"/oauth/authorize",
|
"/oauth/authorize",
|
||||||
%{
|
%{
|
||||||
|
@ -714,6 +611,41 @@ test "redirects with oauth authorization, " <>
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
test "authorize from cookie" do
|
||||||
|
user = insert(:user)
|
||||||
|
app = insert(:oauth_app)
|
||||||
|
oauth_token = insert(:oauth_token, user: user, app: app)
|
||||||
|
redirect_uri = OAuthController.default_redirect_uri(app)
|
||||||
|
|
||||||
|
conn =
|
||||||
|
build_conn()
|
||||||
|
|> Plug.Session.call(Plug.Session.init(@session_opts))
|
||||||
|
|> fetch_session()
|
||||||
|
|> AuthHelper.put_session_token(oauth_token.token)
|
||||||
|
|> post(
|
||||||
|
"/oauth/authorize",
|
||||||
|
%{
|
||||||
|
"authorization" => %{
|
||||||
|
"name" => user.nickname,
|
||||||
|
"client_id" => app.client_id,
|
||||||
|
"redirect_uri" => redirect_uri,
|
||||||
|
"scope" => app.scopes,
|
||||||
|
"state" => "statepassed"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
target = redirected_to(conn)
|
||||||
|
assert target =~ redirect_uri
|
||||||
|
|
||||||
|
query = URI.parse(target).query |> URI.query_decoder() |> Map.new()
|
||||||
|
|
||||||
|
assert %{"state" => "statepassed", "code" => code} = query
|
||||||
|
auth = Repo.get_by(Authorization, token: code)
|
||||||
|
assert auth
|
||||||
|
assert auth.scopes == app.scopes
|
||||||
|
end
|
||||||
|
|
||||||
test "redirect to on two-factor auth page" do
|
test "redirect to on two-factor auth page" do
|
||||||
otp_secret = TOTP.generate_secret()
|
otp_secret = TOTP.generate_secret()
|
||||||
|
|
||||||
|
@ -1286,7 +1218,6 @@ test "issues a new token if token expired" do
|
||||||
|
|
||||||
response =
|
response =
|
||||||
build_conn()
|
build_conn()
|
||||||
|> put_req_header("authorization", "Bearer #{access_token.token}")
|
|
||||||
|> post("/oauth/token", %{
|
|> post("/oauth/token", %{
|
||||||
"grant_type" => "refresh_token",
|
"grant_type" => "refresh_token",
|
||||||
"refresh_token" => access_token.refresh_token,
|
"refresh_token" => access_token.refresh_token,
|
||||||
|
@ -1336,11 +1267,12 @@ test "when authenticated with request token, revokes it and clears it from sessi
|
||||||
build_conn()
|
build_conn()
|
||||||
|> Plug.Session.call(Plug.Session.init(@session_opts))
|
|> Plug.Session.call(Plug.Session.init(@session_opts))
|
||||||
|> fetch_session()
|
|> fetch_session()
|
||||||
|> put_req_header("authorization", "Bearer #{oauth_token.token}")
|
|> AuthHelper.put_session_token(oauth_token.token)
|
||||||
|> post("/oauth/revoke", %{"token" => oauth_token.token})
|
|> post("/oauth/revoke", %{"token" => oauth_token.token})
|
||||||
|
|
||||||
assert json_response(conn, 200)
|
assert json_response(conn, 200)
|
||||||
|
|
||||||
|
refute AuthHelper.get_session_token(conn)
|
||||||
assert Token.get_by_token(oauth_token.token) == {:error, :not_found}
|
assert Token.get_by_token(oauth_token.token) == {:error, :not_found}
|
||||||
end
|
end
|
||||||
|
|
||||||
|
@ -1354,11 +1286,12 @@ test "if request is authenticated with a different token, " <>
|
||||||
build_conn()
|
build_conn()
|
||||||
|> Plug.Session.call(Plug.Session.init(@session_opts))
|
|> Plug.Session.call(Plug.Session.init(@session_opts))
|
||||||
|> fetch_session()
|
|> fetch_session()
|
||||||
|> put_req_header("authorization", "Bearer #{oauth_token.token}")
|
|> AuthHelper.put_session_token(oauth_token.token)
|
||||||
|> post("/oauth/revoke", %{"token" => other_app_oauth_token.token})
|
|> post("/oauth/revoke", %{"token" => other_app_oauth_token.token})
|
||||||
|
|
||||||
assert json_response(conn, 200)
|
assert json_response(conn, 200)
|
||||||
|
|
||||||
|
assert AuthHelper.get_session_token(conn) == oauth_token.token
|
||||||
assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found}
|
assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found}
|
||||||
end
|
end
|
||||||
|
|
||||||
|
|
|
@ -5,8 +5,11 @@
|
||||||
defmodule Pleroma.Web.Plugs.OAuthPlugTest do
|
defmodule Pleroma.Web.Plugs.OAuthPlugTest do
|
||||||
use Pleroma.Web.ConnCase, async: true
|
use Pleroma.Web.ConnCase, async: true
|
||||||
|
|
||||||
|
alias Pleroma.Helpers.AuthHelper
|
||||||
alias Pleroma.Web.OAuth.Token
|
alias Pleroma.Web.OAuth.Token
|
||||||
|
alias Pleroma.Web.OAuth.Token.Strategy.Revoke
|
||||||
alias Pleroma.Web.Plugs.OAuthPlug
|
alias Pleroma.Web.Plugs.OAuthPlug
|
||||||
|
alias Plug.Session
|
||||||
|
|
||||||
import Pleroma.Factory
|
import Pleroma.Factory
|
||||||
|
|
||||||
|
@ -69,4 +72,57 @@ test "with invalid token, it does not assign the user", %{conn: conn} do
|
||||||
|
|
||||||
refute conn.assigns[:user]
|
refute conn.assigns[:user]
|
||||||
end
|
end
|
||||||
|
|
||||||
|
describe "with :oauth_token in session, " do
|
||||||
|
setup %{token: oauth_token, conn: conn} do
|
||||||
|
session_opts = [
|
||||||
|
store: :cookie,
|
||||||
|
key: "_test",
|
||||||
|
signing_salt: "cooldude"
|
||||||
|
]
|
||||||
|
|
||||||
|
conn =
|
||||||
|
conn
|
||||||
|
|> Session.call(Session.init(session_opts))
|
||||||
|
|> fetch_session()
|
||||||
|
|> AuthHelper.put_session_token(oauth_token.token)
|
||||||
|
|
||||||
|
%{conn: conn}
|
||||||
|
end
|
||||||
|
|
||||||
|
test "if session-stored token matches a valid OAuth token, assigns :user and :token", %{
|
||||||
|
conn: conn,
|
||||||
|
user: user,
|
||||||
|
token: oauth_token
|
||||||
|
} do
|
||||||
|
conn = OAuthPlug.call(conn, %{})
|
||||||
|
|
||||||
|
assert conn.assigns.user && conn.assigns.user.id == user.id
|
||||||
|
assert conn.assigns.token && conn.assigns.token.id == oauth_token.id
|
||||||
|
end
|
||||||
|
|
||||||
|
test "if session-stored token matches an expired OAuth token, does nothing", %{
|
||||||
|
conn: conn,
|
||||||
|
token: oauth_token
|
||||||
|
} do
|
||||||
|
expired_valid_until = NaiveDateTime.add(NaiveDateTime.utc_now(), -3600 * 24, :second)
|
||||||
|
|
||||||
|
oauth_token
|
||||||
|
|> Ecto.Changeset.change(valid_until: expired_valid_until)
|
||||||
|
|> Pleroma.Repo.update()
|
||||||
|
|
||||||
|
ret_conn = OAuthPlug.call(conn, %{})
|
||||||
|
assert ret_conn == conn
|
||||||
|
end
|
||||||
|
|
||||||
|
test "if session-stored token matches a revoked OAuth token, does nothing", %{
|
||||||
|
conn: conn,
|
||||||
|
token: oauth_token
|
||||||
|
} do
|
||||||
|
Revoke.revoke(oauth_token)
|
||||||
|
|
||||||
|
ret_conn = OAuthPlug.call(conn, %{})
|
||||||
|
assert ret_conn == conn
|
||||||
|
end
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
43
test/pleroma/web/plugs/set_user_session_id_plug_test.exs
Normal file
43
test/pleroma/web/plugs/set_user_session_id_plug_test.exs
Normal file
|
@ -0,0 +1,43 @@
|
||||||
|
# Pleroma: A lightweight social networking server
|
||||||
|
# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
|
||||||
|
# SPDX-License-Identifier: AGPL-3.0-only
|
||||||
|
|
||||||
|
defmodule Pleroma.Web.Plugs.SetUserSessionIdPlugTest do
|
||||||
|
use Pleroma.Web.ConnCase, async: true
|
||||||
|
|
||||||
|
alias Pleroma.Helpers.AuthHelper
|
||||||
|
alias Pleroma.Web.Plugs.SetUserSessionIdPlug
|
||||||
|
|
||||||
|
setup %{conn: conn} do
|
||||||
|
session_opts = [
|
||||||
|
store: :cookie,
|
||||||
|
key: "_test",
|
||||||
|
signing_salt: "cooldude"
|
||||||
|
]
|
||||||
|
|
||||||
|
conn =
|
||||||
|
conn
|
||||||
|
|> Plug.Session.call(Plug.Session.init(session_opts))
|
||||||
|
|> fetch_session()
|
||||||
|
|
||||||
|
%{conn: conn}
|
||||||
|
end
|
||||||
|
|
||||||
|
test "doesn't do anything if the user isn't set", %{conn: conn} do
|
||||||
|
ret_conn = SetUserSessionIdPlug.call(conn, %{})
|
||||||
|
|
||||||
|
assert ret_conn == conn
|
||||||
|
end
|
||||||
|
|
||||||
|
test "sets session token basing on :token assign", %{conn: conn} do
|
||||||
|
%{user: user, token: oauth_token} = oauth_access(["read"])
|
||||||
|
|
||||||
|
ret_conn =
|
||||||
|
conn
|
||||||
|
|> assign(:user, user)
|
||||||
|
|> assign(:token, oauth_token)
|
||||||
|
|> SetUserSessionIdPlug.call(%{})
|
||||||
|
|
||||||
|
assert AuthHelper.get_session_token(ret_conn) == oauth_token.token
|
||||||
|
end
|
||||||
|
end
|
Loading…
Reference in a new issue