Make token exchange return errors with 400 as status code
[akkoma] / lib / pleroma / web / oauth / oauth_controller.ex
1 defmodule Pleroma.Web.OAuth.OAuthController do
2 use Pleroma.Web, :controller
3
4 alias Pleroma.Web.OAuth.{Authorization, Token, App}
5 alias Pleroma.{Repo, User}
6 alias Comeonin.Pbkdf2
7
8 plug(:fetch_session)
9 plug(:fetch_flash)
10
11 action_fallback(Pleroma.Web.OAuth.FallbackController)
12
13 def authorize(conn, params) do
14 render(conn, "show.html", %{
15 response_type: params["response_type"],
16 client_id: params["client_id"],
17 scope: params["scope"],
18 redirect_uri: params["redirect_uri"],
19 state: params["state"]
20 })
21 end
22
23 def create_authorization(conn, %{
24 "authorization" =>
25 %{
26 "name" => name,
27 "password" => password,
28 "client_id" => client_id,
29 "redirect_uri" => redirect_uri
30 } = params
31 }) do
32 with %User{} = user <- User.get_by_nickname_or_email(name),
33 true <- Pbkdf2.checkpw(password, user.password_hash),
34 %App{} = app <- Repo.get_by(App, client_id: client_id),
35 {:ok, auth} <- Authorization.create_authorization(app, user) do
36 if redirect_uri == "urn:ietf:wg:oauth:2.0:oob" do
37 render(conn, "results.html", %{
38 auth: auth
39 })
40 else
41 connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?"
42 url = "#{redirect_uri}#{connector}code=#{auth.token}"
43
44 url =
45 if params["state"] do
46 url <> "&state=#{params["state"]}"
47 else
48 url
49 end
50
51 redirect(conn, external: url)
52 end
53 end
54 end
55
56 # TODO
57 # - proper scope handling
58 def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do
59 with %App{} = app <- get_app_from_request(conn, params),
60 fixed_token = fix_padding(params["code"]),
61 %Authorization{} = auth <-
62 Repo.get_by(Authorization, token: fixed_token, app_id: app.id),
63 {:ok, token} <- Token.exchange_token(app, auth) do
64 response = %{
65 token_type: "Bearer",
66 access_token: token.token,
67 refresh_token: token.refresh_token,
68 expires_in: 60 * 10,
69 scope: "read write follow"
70 }
71
72 json(conn, response)
73 else
74 _error ->
75 put_status(conn, 400)
76 |> json(%{error: "Invalid credentials"})
77 end
78 end
79
80 # TODO
81 # - investigate a way to verify the user wants to grant read/write/follow once scope handling is done
82 def token_exchange(
83 conn,
84 %{"grant_type" => "password", "name" => name, "password" => password} = params
85 ) do
86 with %App{} = app <- get_app_from_request(conn, params),
87 %User{} = user <- User.get_cached_by_nickname(name),
88 true <- Pbkdf2.checkpw(password, user.password_hash),
89 {:ok, auth} <- Authorization.create_authorization(app, user),
90 {:ok, token} <- Token.exchange_token(app, auth) do
91 response = %{
92 token_type: "Bearer",
93 access_token: token.token,
94 refresh_token: token.refresh_token,
95 expires_in: 60 * 10,
96 scope: "read write follow"
97 }
98
99 json(conn, response)
100 else
101 _error ->
102 put_status(conn, 400)
103 |> json(%{error: "Invalid credentials"})
104 end
105 end
106
107 defp fix_padding(token) do
108 token
109 |> Base.url_decode64!(padding: false)
110 |> Base.url_encode64()
111 end
112
113 defp get_app_from_request(conn, params) do
114 # Per RFC 6749, HTTP Basic is preferred to body params
115 {client_id, client_secret} =
116 with ["Basic " <> encoded] <- get_req_header(conn, "authorization"),
117 {:ok, decoded} <- Base.decode64(encoded),
118 [id, secret] <-
119 String.split(decoded, ":")
120 |> Enum.map(fn s -> URI.decode_www_form(s) end) do
121 {id, secret}
122 else
123 _ -> {params["client_id"], params["client_secret"]}
124 end
125
126 if client_id && client_secret do
127 Repo.get_by(
128 App,
129 client_id: client_id,
130 client_secret: client_secret
131 )
132 else
133 nil
134 end
135 end
136 end