1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.OAuth.OAuthControllerTest do
6 use Pleroma.Web.ConnCase
10 alias Pleroma.Registration
12 alias Pleroma.Web.OAuth.Authorization
13 alias Pleroma.Web.OAuth.Token
18 signing_salt: "cooldude"
21 describe "in OAuth consumer mode, " do
23 oauth_consumer_strategies_path = [:auth, :oauth_consumer_strategies]
24 oauth_consumer_strategies = Pleroma.Config.get(oauth_consumer_strategies_path)
25 Pleroma.Config.put(oauth_consumer_strategies_path, ~w(twitter facebook))
28 Pleroma.Config.put(oauth_consumer_strategies_path, oauth_consumer_strategies)
32 app: insert(:oauth_app),
35 |> Plug.Session.call(Plug.Session.init(@session_opts))
40 test "GET /oauth/authorize renders auth forms, including OAuth consumer form", %{
49 "response_type" => "code",
50 "client_id" => app.client_id,
51 "redirect_uri" => app.redirect_uris,
56 assert response = html_response(conn, 200)
57 assert response =~ "Sign in with Twitter"
58 assert response =~ o_auth_path(conn, :prepare_request)
61 test "GET /oauth/prepare_request encodes parameters as `state` and redirects", %{
68 "/oauth/prepare_request",
70 "provider" => "twitter",
72 "scope" => "read follow",
73 "client_id" => app.client_id,
74 "redirect_uri" => app.redirect_uris,
80 assert response = html_response(conn, 302)
82 redirect_query = URI.parse(redirected_to(conn)).query
83 assert %{"state" => state_param} = URI.decode_query(redirect_query)
84 assert {:ok, state_components} = Poison.decode(state_param)
86 expected_client_id = app.client_id
87 expected_redirect_uri = app.redirect_uris
90 "scope" => "read follow",
91 "client_id" => ^expected_client_id,
92 "redirect_uri" => ^expected_redirect_uri,
97 test "with user-bound registration, GET /oauth/<provider>/callback redirects to `redirect_uri` with `code`",
98 %{app: app, conn: conn} do
99 registration = insert(:registration)
102 "scope" => Enum.join(app.scopes, " "),
103 "client_id" => app.client_id,
104 "redirect_uri" => app.redirect_uris,
108 with_mock Pleroma.Web.Auth.Authenticator,
109 get_registration: fn _ -> {:ok, registration} end do
113 "/oauth/twitter/callback",
115 "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
116 "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
117 "provider" => "twitter",
118 "state" => Poison.encode!(state_params)
122 assert response = html_response(conn, 302)
123 assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
127 test "with user-unbound registration, GET /oauth/<provider>/callback renders registration_details page",
128 %{app: app, conn: conn} do
129 registration = insert(:registration, user: nil)
132 "scope" => "read write",
133 "client_id" => app.client_id,
134 "redirect_uri" => app.redirect_uris,
138 with_mock Pleroma.Web.Auth.Authenticator,
139 get_registration: fn _ -> {:ok, registration} end do
143 "/oauth/twitter/callback",
145 "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
146 "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
147 "provider" => "twitter",
148 "state" => Poison.encode!(state_params)
152 assert response = html_response(conn, 200)
153 assert response =~ ~r/name="op" type="submit" value="register"/
154 assert response =~ ~r/name="op" type="submit" value="connect"/
155 assert response =~ Registration.email(registration)
156 assert response =~ Registration.nickname(registration)
160 test "on authentication error, GET /oauth/<provider>/callback redirects to `redirect_uri`", %{
165 "scope" => Enum.join(app.scopes, " "),
166 "client_id" => app.client_id,
167 "redirect_uri" => app.redirect_uris,
173 |> assign(:ueberauth_failure, %{errors: [%{message: "(error description)"}]})
175 "/oauth/twitter/callback",
177 "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
178 "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
179 "provider" => "twitter",
180 "state" => Poison.encode!(state_params)
184 assert response = html_response(conn, 302)
185 assert redirected_to(conn) == app.redirect_uris
186 assert get_flash(conn, :error) == "Failed to authenticate: (error description)."
189 test "GET /oauth/registration_details renders registration details form", %{
196 "/oauth/registration_details",
198 "authorization" => %{
199 "scopes" => app.scopes,
200 "client_id" => app.client_id,
201 "redirect_uri" => app.redirect_uris,
202 "state" => "a_state",
204 "email" => "john@doe.com"
209 assert response = html_response(conn, 200)
210 assert response =~ ~r/name="op" type="submit" value="register"/
211 assert response =~ ~r/name="op" type="submit" value="connect"/
214 test "with valid params, POST /oauth/register?op=register redirects to `redirect_uri` with `code`",
219 registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
223 |> put_session(:registration_id, registration.id)
228 "authorization" => %{
229 "scopes" => app.scopes,
230 "client_id" => app.client_id,
231 "redirect_uri" => app.redirect_uris,
232 "state" => "a_state",
233 "nickname" => "availablenick",
234 "email" => "available@email.com"
239 assert response = html_response(conn, 302)
240 assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
243 test "with invalid params, POST /oauth/register?op=register renders registration_details page",
248 another_user = insert(:user)
249 registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
253 "authorization" => %{
254 "scopes" => app.scopes,
255 "client_id" => app.client_id,
256 "redirect_uri" => app.redirect_uris,
257 "state" => "a_state",
258 "nickname" => "availablenickname",
259 "email" => "available@email.com"
263 for {bad_param, bad_param_value} <-
264 [{"nickname", another_user.nickname}, {"email", another_user.email}] do
265 bad_registration_attrs = %{
266 "authorization" => Map.put(params["authorization"], bad_param, bad_param_value)
269 bad_params = Map.merge(params, bad_registration_attrs)
273 |> put_session(:registration_id, registration.id)
274 |> post("/oauth/register", bad_params)
276 assert html_response(conn, 403) =~ ~r/name="op" type="submit" value="register"/
277 assert get_flash(conn, :error) == "Error: #{bad_param} has already been taken."
281 test "with valid params, POST /oauth/register?op=connect redirects to `redirect_uri` with `code`",
286 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt("testpassword"))
287 registration = insert(:registration, user: nil)
291 |> put_session(:registration_id, registration.id)
296 "authorization" => %{
297 "scopes" => app.scopes,
298 "client_id" => app.client_id,
299 "redirect_uri" => app.redirect_uris,
300 "state" => "a_state",
301 "name" => user.nickname,
302 "password" => "testpassword"
307 assert response = html_response(conn, 302)
308 assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
311 test "with invalid params, POST /oauth/register?op=connect renders registration_details page",
317 registration = insert(:registration, user: nil)
321 "authorization" => %{
322 "scopes" => app.scopes,
323 "client_id" => app.client_id,
324 "redirect_uri" => app.redirect_uris,
325 "state" => "a_state",
326 "name" => user.nickname,
327 "password" => "wrong password"
333 |> put_session(:registration_id, registration.id)
334 |> post("/oauth/register", params)
336 assert html_response(conn, 401) =~ ~r/name="op" type="submit" value="connect"/
337 assert get_flash(conn, :error) == "Invalid Username/Password"
341 describe "GET /oauth/authorize" do
344 app: insert(:oauth_app, redirect_uris: "https://redirect.url"),
347 |> Plug.Session.call(Plug.Session.init(@session_opts))
352 test "renders authentication page", %{app: app, conn: conn} do
358 "response_type" => "code",
359 "client_id" => app.client_id,
360 "redirect_uri" => app.redirect_uris,
365 assert html_response(conn, 200) =~ ~s(type="submit")
368 test "properly handles internal calls with `authorization`-wrapped params", %{
377 "authorization" => %{
378 "response_type" => "code",
379 "client_id" => app.client_id,
380 "redirect_uri" => app.redirect_uris,
386 assert html_response(conn, 200) =~ ~s(type="submit")
389 test "renders authentication page if user is already authenticated but `force_login` is tru-ish",
390 %{app: app, conn: conn} do
391 token = insert(:oauth_token, app_id: app.id)
395 |> put_session(:oauth_token, token.token)
399 "response_type" => "code",
400 "client_id" => app.client_id,
401 "redirect_uri" => app.redirect_uris,
403 "force_login" => "true"
407 assert html_response(conn, 200) =~ ~s(type="submit")
410 test "redirects to app if user is already authenticated", %{app: app, conn: conn} do
411 token = insert(:oauth_token, app_id: app.id)
415 |> put_session(:oauth_token, token.token)
419 "response_type" => "code",
420 "client_id" => app.client_id,
421 "redirect_uri" => app.redirect_uris,
426 assert redirected_to(conn) == "https://redirect.url"
430 describe "POST /oauth/authorize" do
431 test "redirects with oauth authorization" do
433 app = insert(:oauth_app, scopes: ["read", "write", "follow"])
437 |> post("/oauth/authorize", %{
438 "authorization" => %{
439 "name" => user.nickname,
440 "password" => "test",
441 "client_id" => app.client_id,
442 "redirect_uri" => app.redirect_uris,
443 "scope" => "read write",
444 "state" => "statepassed"
448 target = redirected_to(conn)
449 assert target =~ app.redirect_uris
451 query = URI.parse(target).query |> URI.query_decoder() |> Map.new()
453 assert %{"state" => "statepassed", "code" => code} = query
454 auth = Repo.get_by(Authorization, token: code)
456 assert auth.scopes == ["read", "write"]
459 test "returns 401 for wrong credentials", %{conn: conn} do
461 app = insert(:oauth_app)
465 |> post("/oauth/authorize", %{
466 "authorization" => %{
467 "name" => user.nickname,
468 "password" => "wrong",
469 "client_id" => app.client_id,
470 "redirect_uri" => app.redirect_uris,
471 "state" => "statepassed",
472 "scope" => Enum.join(app.scopes, " ")
475 |> html_response(:unauthorized)
478 assert result =~ app.client_id
479 assert result =~ app.redirect_uris
482 assert result =~ "Invalid Username/Password"
485 test "returns 401 for missing scopes", %{conn: conn} do
487 app = insert(:oauth_app)
491 |> post("/oauth/authorize", %{
492 "authorization" => %{
493 "name" => user.nickname,
494 "password" => "test",
495 "client_id" => app.client_id,
496 "redirect_uri" => app.redirect_uris,
497 "state" => "statepassed",
501 |> html_response(:unauthorized)
504 assert result =~ app.client_id
505 assert result =~ app.redirect_uris
508 assert result =~ "This action is outside the authorized scopes"
511 test "returns 401 for scopes beyond app scopes", %{conn: conn} do
513 app = insert(:oauth_app, scopes: ["read", "write"])
517 |> post("/oauth/authorize", %{
518 "authorization" => %{
519 "name" => user.nickname,
520 "password" => "test",
521 "client_id" => app.client_id,
522 "redirect_uri" => app.redirect_uris,
523 "state" => "statepassed",
524 "scope" => "read write follow"
527 |> html_response(:unauthorized)
530 assert result =~ app.client_id
531 assert result =~ app.redirect_uris
534 assert result =~ "This action is outside the authorized scopes"
538 describe "POST /oauth/token" do
539 test "issues a token for an all-body request" do
541 app = insert(:oauth_app, scopes: ["read", "write"])
543 {:ok, auth} = Authorization.create_authorization(app, user, ["write"])
547 |> post("/oauth/token", %{
548 "grant_type" => "authorization_code",
549 "code" => auth.token,
550 "redirect_uri" => app.redirect_uris,
551 "client_id" => app.client_id,
552 "client_secret" => app.client_secret
555 assert %{"access_token" => token, "me" => ap_id} = json_response(conn, 200)
557 token = Repo.get_by(Token, token: token)
559 assert token.scopes == auth.scopes
560 assert user.ap_id == ap_id
563 test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do
564 password = "testpassword"
565 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
567 app = insert(:oauth_app, scopes: ["read", "write"])
569 # Note: "scope" param is intentionally omitted
572 |> post("/oauth/token", %{
573 "grant_type" => "password",
574 "username" => user.nickname,
575 "password" => password,
576 "client_id" => app.client_id,
577 "client_secret" => app.client_secret
580 assert %{"access_token" => token} = json_response(conn, 200)
582 token = Repo.get_by(Token, token: token)
584 assert token.scopes == app.scopes
587 test "issues a token for request with HTTP basic auth client credentials" do
589 app = insert(:oauth_app, scopes: ["scope1", "scope2", "scope3"])
591 {:ok, auth} = Authorization.create_authorization(app, user, ["scope1", "scope2"])
592 assert auth.scopes == ["scope1", "scope2"]
595 (URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
600 |> put_req_header("authorization", "Basic " <> app_encoded)
601 |> post("/oauth/token", %{
602 "grant_type" => "authorization_code",
603 "code" => auth.token,
604 "redirect_uri" => app.redirect_uris
607 assert %{"access_token" => token, "scope" => scope} = json_response(conn, 200)
609 assert scope == "scope1 scope2"
611 token = Repo.get_by(Token, token: token)
613 assert token.scopes == ["scope1", "scope2"]
616 test "rejects token exchange with invalid client credentials" do
618 app = insert(:oauth_app)
620 {:ok, auth} = Authorization.create_authorization(app, user)
624 |> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
625 |> post("/oauth/token", %{
626 "grant_type" => "authorization_code",
627 "code" => auth.token,
628 "redirect_uri" => app.redirect_uris
631 assert resp = json_response(conn, 400)
632 assert %{"error" => _} = resp
633 refute Map.has_key?(resp, "access_token")
636 test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
637 setting = Pleroma.Config.get([:instance, :account_activation_required])
640 Pleroma.Config.put([:instance, :account_activation_required], true)
641 on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
644 password = "testpassword"
645 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
646 info_change = Pleroma.User.Info.confirmation_changeset(user.info, :unconfirmed)
650 |> Ecto.Changeset.change()
651 |> Ecto.Changeset.put_embed(:info, info_change)
654 refute Pleroma.User.auth_active?(user)
656 app = insert(:oauth_app)
660 |> post("/oauth/token", %{
661 "grant_type" => "password",
662 "username" => user.nickname,
663 "password" => password,
664 "client_id" => app.client_id,
665 "client_secret" => app.client_secret
668 assert resp = json_response(conn, 403)
669 assert %{"error" => _} = resp
670 refute Map.has_key?(resp, "access_token")
673 test "rejects token exchange for valid credentials belonging to deactivated user" do
674 password = "testpassword"
678 password_hash: Comeonin.Pbkdf2.hashpwsalt(password),
679 info: %{deactivated: true}
682 app = insert(:oauth_app)
686 |> post("/oauth/token", %{
687 "grant_type" => "password",
688 "username" => user.nickname,
689 "password" => password,
690 "client_id" => app.client_id,
691 "client_secret" => app.client_secret
694 assert resp = json_response(conn, 403)
695 assert %{"error" => _} = resp
696 refute Map.has_key?(resp, "access_token")
699 test "rejects an invalid authorization code" do
700 app = insert(:oauth_app)
704 |> post("/oauth/token", %{
705 "grant_type" => "authorization_code",
706 "code" => "Imobviouslyinvalid",
707 "redirect_uri" => app.redirect_uris,
708 "client_id" => app.client_id,
709 "client_secret" => app.client_secret
712 assert resp = json_response(conn, 400)
713 assert %{"error" => _} = json_response(conn, 400)
714 refute Map.has_key?(resp, "access_token")