Merge remote-tracking branch 'remotes/origin/develop' into media-preview-proxy
[akkoma] / lib / pleroma / web / twitter_api / controllers / remote_follow_controller.ex
1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
4
5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowController do
6 use Pleroma.Web, :controller
7
8 require Logger
9
10 alias Pleroma.Activity
11 alias Pleroma.MFA
12 alias Pleroma.Object.Fetcher
13 alias Pleroma.Plugs.OAuthScopesPlug
14 alias Pleroma.User
15 alias Pleroma.Web.Auth.Authenticator
16 alias Pleroma.Web.Auth.TOTPAuthenticator
17 alias Pleroma.Web.CommonAPI
18
19 @status_types ["Article", "Event", "Note", "Video", "Page", "Question"]
20
21 plug(Pleroma.Web.FederatingPlug)
22
23 # Note: follower can submit the form (with password auth) not being signed in (having no token)
24 plug(
25 OAuthScopesPlug,
26 %{fallback: :proceed_unauthenticated, scopes: ["follow", "write:follows"]}
27 when action in [:do_follow]
28 )
29
30 # GET /ostatus_subscribe
31 #
32 def follow(%{assigns: %{user: user}} = conn, %{"acct" => acct}) do
33 case is_status?(acct) do
34 true -> follow_status(conn, user, acct)
35 _ -> follow_account(conn, user, acct)
36 end
37 end
38
39 defp follow_status(conn, _user, acct) do
40 with {:ok, object} <- Fetcher.fetch_object_from_id(acct),
41 %Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(object.data["id"]) do
42 redirect(conn, to: o_status_path(conn, :notice, activity_id))
43 else
44 error ->
45 handle_follow_error(conn, error)
46 end
47 end
48
49 defp follow_account(conn, user, acct) do
50 with {:ok, followee} <- User.get_or_fetch(acct) do
51 render(conn, follow_template(user), %{error: false, followee: followee, acct: acct})
52 else
53 {:error, _reason} ->
54 render(conn, follow_template(user), %{error: :error})
55 end
56 end
57
58 defp follow_template(%User{} = _user), do: "follow.html"
59 defp follow_template(_), do: "follow_login.html"
60
61 defp is_status?(acct) do
62 case Fetcher.fetch_and_contain_remote_object_from_id(acct) do
63 {:ok, %{"type" => type}} when type in @status_types ->
64 true
65
66 _ ->
67 false
68 end
69 end
70
71 # POST /ostatus_subscribe
72 #
73 # adds a remote account in followers if user already is signed in.
74 #
75 def do_follow(%{assigns: %{user: %User{} = user}} = conn, %{"user" => %{"id" => id}}) do
76 with {:fetch_user, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
77 {:ok, _, _, _} <- CommonAPI.follow(user, followee) do
78 redirect(conn, to: "/users/#{followee.id}")
79 else
80 error ->
81 handle_follow_error(conn, error)
82 end
83 end
84
85 # POST /ostatus_subscribe
86 #
87 # step 1.
88 # checks login\password and displays step 2 form of MFA if need.
89 #
90 def do_follow(conn, %{"authorization" => %{"name" => _, "password" => _, "id" => id}}) do
91 with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
92 {_, {:ok, user}, _} <- {:auth, Authenticator.get_user(conn), followee},
93 {_, _, _, false} <- {:mfa_required, followee, user, MFA.require?(user)},
94 {:ok, _, _, _} <- CommonAPI.follow(user, followee) do
95 redirect(conn, to: "/users/#{followee.id}")
96 else
97 error ->
98 handle_follow_error(conn, error)
99 end
100 end
101
102 # POST /ostatus_subscribe
103 #
104 # step 2
105 # checks TOTP code. otherwise displays form with errors
106 #
107 def do_follow(conn, %{"mfa" => %{"code" => code, "token" => token, "id" => id}}) do
108 with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
109 {_, _, {:ok, %{user: user}}} <- {:mfa_token, followee, MFA.Token.validate(token)},
110 {_, _, _, {:ok, _}} <-
111 {:verify_mfa_code, followee, token, TOTPAuthenticator.verify(code, user)},
112 {:ok, _, _, _} <- CommonAPI.follow(user, followee) do
113 redirect(conn, to: "/users/#{followee.id}")
114 else
115 error ->
116 handle_follow_error(conn, error)
117 end
118 end
119
120 def do_follow(%{assigns: %{user: nil}} = conn, _) do
121 Logger.debug("Insufficient permissions: follow | write:follows.")
122 render(conn, "followed.html", %{error: "Insufficient permissions: follow | write:follows."})
123 end
124
125 defp handle_follow_error(conn, {:mfa_token, followee, _} = _) do
126 render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
127 end
128
129 defp handle_follow_error(conn, {:verify_mfa_code, followee, token, _} = _) do
130 render(conn, "follow_mfa.html", %{
131 error: "Wrong authentication code",
132 followee: followee,
133 mfa_token: token
134 })
135 end
136
137 defp handle_follow_error(conn, {:mfa_required, followee, user, _} = _) do
138 {:ok, %{token: token}} = MFA.Token.create(user)
139 render(conn, "follow_mfa.html", %{followee: followee, mfa_token: token, error: false})
140 end
141
142 defp handle_follow_error(conn, {:auth, _, followee} = _) do
143 render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
144 end
145
146 defp handle_follow_error(conn, {:fetch_user, error} = _) do
147 Logger.debug("Remote follow failed with error #{inspect(error)}")
148 render(conn, "followed.html", %{error: "Could not find user"})
149 end
150
151 defp handle_follow_error(conn, {:error, "Could not follow user:" <> _} = _) do
152 render(conn, "followed.html", %{error: "Error following account"})
153 end
154
155 defp handle_follow_error(conn, error) do
156 Logger.debug("Remote follow failed with error #{inspect(error)}")
157 render(conn, "followed.html", %{error: "Something went wrong."})
158 end
159 end