git.squeep.com Git - akkoma/blob - lib/pleroma/web/twitter_api/controllers/remote_follow_controller.ex

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.TwitterAPI.RemoteFollowController do
   6   use Pleroma.Web, :controller
   7
   8   require Logger
   9
  10   alias Pleroma.Activity
  11   alias Pleroma.MFA
  12   alias Pleroma.Object.Fetcher
  13   alias Pleroma.Plugs.OAuthScopesPlug
  14   alias Pleroma.User
  15   alias Pleroma.Web.Auth.Authenticator
  16   alias Pleroma.Web.Auth.TOTPAuthenticator
  17   alias Pleroma.Web.CommonAPI
  18
  19   @status_types ["Article", "Event", "Note", "Video", "Page", "Question"]
  20
  21   plug(Pleroma.Web.FederatingPlug)
  22
  23   # Note: follower can submit the form (with password auth) not being signed in (having no token)
  24   plug(
  25     OAuthScopesPlug,
  26     %{fallback: :proceed_unauthenticated, scopes: ["follow", "write:follows"]}
  27     when action in [:do_follow]
  28   )
  29
  30   # GET /ostatus_subscribe
  31   #
  32   def follow(%{assigns: %{user: user}} = conn, %{"acct" => acct}) do
  33     case is_status?(acct) do
  34       true -> follow_status(conn, user, acct)
  35       _ -> follow_account(conn, user, acct)
  36     end
  37   end
  38
  39   defp follow_status(conn, _user, acct) do
  40     with {:ok, object} <- Fetcher.fetch_object_from_id(acct),
  41          %Activity{id: activity_id} <- Activity.get_create_by_object_ap_id(object.data["id"]) do
  42       redirect(conn, to: o_status_path(conn, :notice, activity_id))
  43     else
  44       error ->
  45         handle_follow_error(conn, error)
  46     end
  47   end
  48
  49   defp follow_account(conn, user, acct) do
  50     with {:ok, followee} <- User.get_or_fetch(acct) do
  51       render(conn, follow_template(user), %{error: false, followee: followee, acct: acct})
  52     else
  53       {:error, _reason} ->
  54         render(conn, follow_template(user), %{error: :error})
  55     end
  56   end
  57
  58   defp follow_template(%User{} = _user), do: "follow.html"
  59   defp follow_template(_), do: "follow_login.html"
  60
  61   defp is_status?(acct) do
  62     case Fetcher.fetch_and_contain_remote_object_from_id(acct) do
  63       {:ok, %{"type" => type}} when type in @status_types ->
  64         true
  65
  66       _ ->
  67         false
  68     end
  69   end
  70
  71   # POST  /ostatus_subscribe
  72   #
  73   # adds a remote account in followers if user already is signed in.
  74   #
  75   def do_follow(%{assigns: %{user: %User{} = user}} = conn, %{"user" => %{"id" => id}}) do
  76     with {:fetch_user, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
  77          {:ok, _, _, _} <- CommonAPI.follow(user, followee) do
  78       redirect(conn, to: "/users/#{followee.id}")
  79     else
  80       error ->
  81         handle_follow_error(conn, error)
  82     end
  83   end
  84
  85   # POST  /ostatus_subscribe
  86   #
  87   # step 1.
  88   # checks login\password and displays step 2 form of MFA if need.
  89   #
  90   def do_follow(conn, %{"authorization" => %{"name" => _, "password" => _, "id" => id}}) do
  91     with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
  92          {_, {:ok, user}, _} <- {:auth, Authenticator.get_user(conn), followee},
  93          {_, _, _, false} <- {:mfa_required, followee, user, MFA.require?(user)},
  94          {:ok, _, _, _} <- CommonAPI.follow(user, followee) do
  95       redirect(conn, to: "/users/#{followee.id}")
  96     else
  97       error ->
  98         handle_follow_error(conn, error)
  99     end
 100   end
 101
 102   # POST  /ostatus_subscribe
 103   #
 104   # step 2
 105   # checks TOTP code. otherwise displays form with errors
 106   #
 107   def do_follow(conn, %{"mfa" => %{"code" => code, "token" => token, "id" => id}}) do
 108     with {_, %User{} = followee} <- {:fetch_user, User.get_cached_by_id(id)},
 109          {_, _, {:ok, %{user: user}}} <- {:mfa_token, followee, MFA.Token.validate(token)},
 110          {_, _, _, {:ok, _}} <-
 111            {:verify_mfa_code, followee, token, TOTPAuthenticator.verify(code, user)},
 112          {:ok, _, _, _} <- CommonAPI.follow(user, followee) do
 113       redirect(conn, to: "/users/#{followee.id}")
 114     else
 115       error ->
 116         handle_follow_error(conn, error)
 117     end
 118   end
 119
 120   def do_follow(%{assigns: %{user: nil}} = conn, _) do
 121     Logger.debug("Insufficient permissions: follow | write:follows.")
 122     render(conn, "followed.html", %{error: "Insufficient permissions: follow | write:follows."})
 123   end
 124
 125   defp handle_follow_error(conn, {:mfa_token, followee, _} = _) do
 126     render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
 127   end
 128
 129   defp handle_follow_error(conn, {:verify_mfa_code, followee, token, _} = _) do
 130     render(conn, "follow_mfa.html", %{
 131       error: "Wrong authentication code",
 132       followee: followee,
 133       mfa_token: token
 134     })
 135   end
 136
 137   defp handle_follow_error(conn, {:mfa_required, followee, user, _} = _) do
 138     {:ok, %{token: token}} = MFA.Token.create(user)
 139     render(conn, "follow_mfa.html", %{followee: followee, mfa_token: token, error: false})
 140   end
 141
 142   defp handle_follow_error(conn, {:auth, _, followee} = _) do
 143     render(conn, "follow_login.html", %{error: "Wrong username or password", followee: followee})
 144   end
 145
 146   defp handle_follow_error(conn, {:fetch_user, error} = _) do
 147     Logger.debug("Remote follow failed with error #{inspect(error)}")
 148     render(conn, "followed.html", %{error: "Could not find user"})
 149   end
 150
 151   defp handle_follow_error(conn, {:error, "Could not follow user:" <> _} = _) do
 152     render(conn, "followed.html", %{error: "Error following account"})
 153   end
 154
 155   defp handle_follow_error(conn, error) do
 156     Logger.debug("Remote follow failed with error #{inspect(error)}")
 157     render(conn, "followed.html", %{error: "Something went wrong."})
 158   end
 159 end