git.squeep.com Git - akkoma/blob - lib/pleroma/tests/auth_test_controller.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 # A test controller reachable only in :test env.
   6 defmodule Pleroma.Tests.AuthTestController do
   7   @moduledoc false
   8
   9   use Pleroma.Web, :controller
  10
  11   alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
  12   alias Pleroma.Plugs.OAuthScopesPlug
  13   alias Pleroma.User
  14
  15   # Serves only with proper OAuth token (:api and :authenticated_api)
  16   # Skipping EnsurePublicOrAuthenticatedPlug has no effect in this case
  17   #
  18   # Suggested use case: all :authenticated_api endpoints (makes no sense for :api endpoints)
  19   plug(OAuthScopesPlug, %{scopes: ["read"]} when action == :do_oauth_check)
  20
  21   # Via :api, keeps :user if token has requested scopes (if :user is dropped, serves if public)
  22   # Via :authenticated_api, serves if token is present and has requested scopes
  23   #
  24   # Suggested use case: vast majority of :api endpoints (no sense for :authenticated_api ones)
  25   plug(
  26     OAuthScopesPlug,
  27     %{scopes: ["read"], fallback: :proceed_unauthenticated}
  28     when action == :fallback_oauth_check
  29   )
  30
  31   # Keeps :user if present, executes regardless of token / token scopes
  32   # Fails with no :user for :authenticated_api / no user for :api on private instance
  33   # Note: EnsurePublicOrAuthenticatedPlug is not skipped (private instance fails on no :user)
  34   # Note: Basic Auth processing results in :skip_plug call for OAuthScopesPlug
  35   #
  36   # Suggested use: suppressing OAuth checks for other auth mechanisms (like Basic Auth)
  37   # For controller-level use, see :skip_oauth_skip_publicity_check instead
  38   plug(
  39     :skip_plug,
  40     OAuthScopesPlug when action == :skip_oauth_check
  41   )
  42
  43   # (Shouldn't be executed since the plug is skipped)
  44   plug(OAuthScopesPlug, %{scopes: ["admin"]} when action == :skip_oauth_check)
  45
  46   # Via :api, keeps :user if token has requested scopes, and continues with nil :user otherwise
  47   # Via :authenticated_api, serves if token is present and has requested scopes
  48   #
  49   # Suggested use: as :fallback_oauth_check but open with nil :user for :api on private instances
  50   plug(
  51     :skip_plug,
  52     EnsurePublicOrAuthenticatedPlug when action == :fallback_oauth_skip_publicity_check
  53   )
  54
  55   plug(
  56     OAuthScopesPlug,
  57     %{scopes: ["read"], fallback: :proceed_unauthenticated}
  58     when action == :fallback_oauth_skip_publicity_check
  59   )
  60
  61   # Via :api, keeps :user if present, serves regardless of token presence / scopes / :user presence
  62   # Via :authenticated_api, serves if :user is set (regardless of token presence and its scopes)
  63   #
  64   # Suggested use: making an :api endpoint always accessible (e.g. email confirmation endpoint)
  65   plug(
  66     :skip_plug,
  67     [OAuthScopesPlug, EnsurePublicOrAuthenticatedPlug]
  68     when action == :skip_oauth_skip_publicity_check
  69   )
  70
  71   # Via :authenticated_api, always fails with 403 (endpoint is insecure)
  72   # Via :api, drops :user if present and serves if public (private instance rejects on no user)
  73   #
  74   # Suggested use: none; please define OAuth rules for all :api / :authenticated_api endpoints
  75   plug(:skip_plug, [] when action == :missing_oauth_check_definition)
  76
  77   def do_oauth_check(conn, _params), do: conn_state(conn)
  78
  79   def fallback_oauth_check(conn, _params), do: conn_state(conn)
  80
  81   def skip_oauth_check(conn, _params), do: conn_state(conn)
  82
  83   def fallback_oauth_skip_publicity_check(conn, _params), do: conn_state(conn)
  84
  85   def skip_oauth_skip_publicity_check(conn, _params), do: conn_state(conn)
  86
  87   def missing_oauth_check_definition(conn, _params), do: conn_state(conn)
  88
  89   defp conn_state(%{assigns: %{user: %User{} = user}} = conn),
  90     do: json(conn, %{user_id: user.id})
  91
  92   defp conn_state(conn), do: json(conn, %{user_id: nil})
  93 end