1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.OAuth.OAuthControllerTest do
6 use Pleroma.Web.ConnCase
10 alias Pleroma.Registration
12 alias Pleroma.Web.OAuth.Authorization
13 alias Pleroma.Web.OAuth.Token
18 signing_salt: "cooldude"
21 describe "in OAuth consumer mode, " do
23 oauth_consumer_enabled_path = [:auth, :oauth_consumer_enabled]
24 oauth_consumer_strategies_path = [:auth, :oauth_consumer_strategies]
25 oauth_consumer_enabled = Pleroma.Config.get(oauth_consumer_enabled_path)
26 oauth_consumer_strategies = Pleroma.Config.get(oauth_consumer_strategies_path)
28 Pleroma.Config.put(oauth_consumer_enabled_path, true)
29 Pleroma.Config.put(oauth_consumer_strategies_path, ~w(twitter facebook))
32 Pleroma.Config.put(oauth_consumer_enabled_path, oauth_consumer_enabled)
33 Pleroma.Config.put(oauth_consumer_strategies_path, oauth_consumer_strategies)
37 app: insert(:oauth_app),
40 |> Plug.Session.call(Plug.Session.init(@session_opts))
45 test "GET /oauth/authorize also renders OAuth consumer form", %{
54 "response_type" => "code",
55 "client_id" => app.client_id,
56 "redirect_uri" => app.redirect_uris,
61 assert response = html_response(conn, 200)
62 assert response =~ "Sign in with Twitter"
63 assert response =~ o_auth_path(conn, :prepare_request)
66 test "GET /oauth/prepare_request encodes parameters as `state` and redirects", %{
73 "/oauth/prepare_request",
75 "provider" => "twitter",
76 "scope" => "read follow",
77 "client_id" => app.client_id,
78 "redirect_uri" => app.redirect_uris,
83 assert response = html_response(conn, 302)
85 redirect_query = URI.parse(redirected_to(conn)).query
86 assert %{"state" => state_param} = URI.decode_query(redirect_query)
87 assert {:ok, state_components} = Poison.decode(state_param)
89 expected_client_id = app.client_id
90 expected_redirect_uri = app.redirect_uris
93 "scope" => "read follow",
94 "client_id" => ^expected_client_id,
95 "redirect_uri" => ^expected_redirect_uri,
100 test "on authentication error, redirects to `redirect_uri`", %{app: app, conn: conn} do
102 "scope" => Enum.join(app.scopes, " "),
103 "client_id" => app.client_id,
104 "redirect_uri" => app.redirect_uris,
110 |> assign(:ueberauth_failure, %{errors: [%{message: "unknown error"}]})
112 "/oauth/twitter/callback",
114 "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
115 "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
116 "provider" => "twitter",
117 "state" => Poison.encode!(state_params)
121 assert response = html_response(conn, 302)
122 assert redirected_to(conn) == app.redirect_uris
125 test "with user-bound registration, GET /oauth/<provider>/callback redirects to `redirect_uri` with `code`",
126 %{app: app, conn: conn} do
127 registration = insert(:registration)
130 "scope" => Enum.join(app.scopes, " "),
131 "client_id" => app.client_id,
132 "redirect_uri" => app.redirect_uris,
136 with_mock Pleroma.Web.Auth.Authenticator,
137 get_registration: fn _, _ -> {:ok, registration} end do
141 "/oauth/twitter/callback",
143 "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
144 "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
145 "provider" => "twitter",
146 "state" => Poison.encode!(state_params)
150 assert response = html_response(conn, 302)
151 assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
155 test "with user-unbound registration, GET /oauth/<provider>/callback redirects to registration_details page",
156 %{app: app, conn: conn} do
157 registration = insert(:registration, user: nil)
160 "scope" => "read write",
161 "client_id" => app.client_id,
162 "redirect_uri" => app.redirect_uris,
166 with_mock Pleroma.Web.Auth.Authenticator,
167 get_registration: fn _, _ -> {:ok, registration} end do
171 "/oauth/twitter/callback",
173 "oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
174 "oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
175 "provider" => "twitter",
176 "state" => Poison.encode!(state_params)
180 expected_redirect_params =
182 |> Map.delete("scope")
184 "scope" => "read write",
185 "email" => Registration.email(registration),
186 "nickname" => Registration.nickname(registration)
189 assert response = html_response(conn, 302)
191 assert redirected_to(conn) ==
192 o_auth_path(conn, :registration_details, expected_redirect_params)
196 test "GET /oauth/registration_details renders registration details form", %{
203 "/oauth/registration_details",
205 "scopes" => app.scopes,
206 "client_id" => app.client_id,
207 "redirect_uri" => app.redirect_uris,
208 "state" => "a_state",
210 "email" => "john@doe.com"
214 assert response = html_response(conn, 200)
215 assert response =~ ~r/name="op" type="submit" value="register"/
216 assert response =~ ~r/name="op" type="submit" value="connect"/
219 test "with valid params, POST /oauth/register?op=register redirects to `redirect_uri` with `code`",
224 registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
228 |> put_session(:registration_id, registration.id)
233 "scopes" => app.scopes,
234 "client_id" => app.client_id,
235 "redirect_uri" => app.redirect_uris,
236 "state" => "a_state",
237 "nickname" => "availablenick",
238 "email" => "available@email.com"
242 assert response = html_response(conn, 302)
243 assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
246 test "with invalid params, POST /oauth/register?op=register redirects to registration_details page",
251 another_user = insert(:user)
252 registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
256 "scopes" => app.scopes,
257 "client_id" => app.client_id,
258 "redirect_uri" => app.redirect_uris,
259 "state" => "a_state",
260 "nickname" => another_user.nickname,
261 "email" => another_user.email
266 |> put_session(:registration_id, registration.id)
267 |> post("/oauth/register", params)
269 assert response = html_response(conn, 302)
271 assert redirected_to(conn) ==
272 o_auth_path(conn, :registration_details, params)
275 test "with valid params, POST /oauth/register?op=connect redirects to `redirect_uri` with `code`",
280 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt("testpassword"))
281 registration = insert(:registration, user: nil)
285 |> put_session(:registration_id, registration.id)
290 "scopes" => app.scopes,
291 "client_id" => app.client_id,
292 "redirect_uri" => app.redirect_uris,
293 "state" => "a_state",
294 "auth_name" => user.nickname,
295 "password" => "testpassword"
299 assert response = html_response(conn, 302)
300 assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
303 test "with invalid params, POST /oauth/register?op=connect redirects to registration_details page",
309 registration = insert(:registration, user: nil)
313 "scopes" => app.scopes,
314 "client_id" => app.client_id,
315 "redirect_uri" => app.redirect_uris,
316 "state" => "a_state",
317 "auth_name" => user.nickname,
318 "password" => "wrong password"
323 |> put_session(:registration_id, registration.id)
324 |> post("/oauth/register", params)
326 assert response = html_response(conn, 302)
328 assert redirected_to(conn) ==
329 o_auth_path(conn, :registration_details, Map.delete(params, "password"))
333 describe "GET /oauth/authorize" do
336 app: insert(:oauth_app, redirect_uris: "https://redirect.url"),
339 |> Plug.Session.call(Plug.Session.init(@session_opts))
344 test "renders authentication page", %{app: app, conn: conn} do
350 "response_type" => "code",
351 "client_id" => app.client_id,
352 "redirect_uri" => app.redirect_uris,
357 assert html_response(conn, 200) =~ ~s(type="submit")
360 test "renders authentication page if user is already authenticated but `force_login` is tru-ish",
361 %{app: app, conn: conn} do
362 token = insert(:oauth_token, app_id: app.id)
366 |> put_session(:oauth_token, token.token)
370 "response_type" => "code",
371 "client_id" => app.client_id,
372 "redirect_uri" => app.redirect_uris,
374 "force_login" => "true"
378 assert html_response(conn, 200) =~ ~s(type="submit")
381 test "redirects to app if user is already authenticated", %{app: app, conn: conn} do
382 token = insert(:oauth_token, app_id: app.id)
386 |> put_session(:oauth_token, token.token)
390 "response_type" => "code",
391 "client_id" => app.client_id,
392 "redirect_uri" => app.redirect_uris,
397 assert redirected_to(conn) == "https://redirect.url"
401 describe "POST /oauth/authorize" do
402 test "redirects with oauth authorization" do
404 app = insert(:oauth_app, scopes: ["read", "write", "follow"])
408 |> post("/oauth/authorize", %{
409 "authorization" => %{
410 "name" => user.nickname,
411 "password" => "test",
412 "client_id" => app.client_id,
413 "redirect_uri" => app.redirect_uris,
414 "scope" => "read write",
415 "state" => "statepassed"
419 target = redirected_to(conn)
420 assert target =~ app.redirect_uris
422 query = URI.parse(target).query |> URI.query_decoder() |> Map.new()
424 assert %{"state" => "statepassed", "code" => code} = query
425 auth = Repo.get_by(Authorization, token: code)
427 assert auth.scopes == ["read", "write"]
430 test "returns 401 for wrong credentials", %{conn: conn} do
432 app = insert(:oauth_app)
436 |> post("/oauth/authorize", %{
437 "authorization" => %{
438 "name" => user.nickname,
439 "password" => "wrong",
440 "client_id" => app.client_id,
441 "redirect_uri" => app.redirect_uris,
442 "state" => "statepassed",
443 "scope" => Enum.join(app.scopes, " ")
446 |> html_response(:unauthorized)
449 assert result =~ app.client_id
450 assert result =~ app.redirect_uris
453 assert result =~ "Invalid Username/Password"
456 test "returns 401 for missing scopes", %{conn: conn} do
458 app = insert(:oauth_app)
462 |> post("/oauth/authorize", %{
463 "authorization" => %{
464 "name" => user.nickname,
465 "password" => "test",
466 "client_id" => app.client_id,
467 "redirect_uri" => app.redirect_uris,
468 "state" => "statepassed",
472 |> html_response(:unauthorized)
475 assert result =~ app.client_id
476 assert result =~ app.redirect_uris
479 assert result =~ "This action is outside the authorized scopes"
482 test "returns 401 for scopes beyond app scopes", %{conn: conn} do
484 app = insert(:oauth_app, scopes: ["read", "write"])
488 |> post("/oauth/authorize", %{
489 "authorization" => %{
490 "name" => user.nickname,
491 "password" => "test",
492 "client_id" => app.client_id,
493 "redirect_uri" => app.redirect_uris,
494 "state" => "statepassed",
495 "scope" => "read write follow"
498 |> html_response(:unauthorized)
501 assert result =~ app.client_id
502 assert result =~ app.redirect_uris
505 assert result =~ "This action is outside the authorized scopes"
509 describe "POST /oauth/token" do
510 test "issues a token for an all-body request" do
512 app = insert(:oauth_app, scopes: ["read", "write"])
514 {:ok, auth} = Authorization.create_authorization(app, user, ["write"])
518 |> post("/oauth/token", %{
519 "grant_type" => "authorization_code",
520 "code" => auth.token,
521 "redirect_uri" => app.redirect_uris,
522 "client_id" => app.client_id,
523 "client_secret" => app.client_secret
526 assert %{"access_token" => token, "me" => ap_id} = json_response(conn, 200)
528 token = Repo.get_by(Token, token: token)
530 assert token.scopes == auth.scopes
531 assert user.ap_id == ap_id
534 test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do
535 password = "testpassword"
536 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
538 app = insert(:oauth_app, scopes: ["read", "write"])
540 # Note: "scope" param is intentionally omitted
543 |> post("/oauth/token", %{
544 "grant_type" => "password",
545 "username" => user.nickname,
546 "password" => password,
547 "client_id" => app.client_id,
548 "client_secret" => app.client_secret
551 assert %{"access_token" => token} = json_response(conn, 200)
553 token = Repo.get_by(Token, token: token)
555 assert token.scopes == app.scopes
558 test "issues a token for request with HTTP basic auth client credentials" do
560 app = insert(:oauth_app, scopes: ["scope1", "scope2", "scope3"])
562 {:ok, auth} = Authorization.create_authorization(app, user, ["scope1", "scope2"])
563 assert auth.scopes == ["scope1", "scope2"]
566 (URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
571 |> put_req_header("authorization", "Basic " <> app_encoded)
572 |> post("/oauth/token", %{
573 "grant_type" => "authorization_code",
574 "code" => auth.token,
575 "redirect_uri" => app.redirect_uris
578 assert %{"access_token" => token, "scope" => scope} = json_response(conn, 200)
580 assert scope == "scope1 scope2"
582 token = Repo.get_by(Token, token: token)
584 assert token.scopes == ["scope1", "scope2"]
587 test "rejects token exchange with invalid client credentials" do
589 app = insert(:oauth_app)
591 {:ok, auth} = Authorization.create_authorization(app, user)
595 |> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
596 |> post("/oauth/token", %{
597 "grant_type" => "authorization_code",
598 "code" => auth.token,
599 "redirect_uri" => app.redirect_uris
602 assert resp = json_response(conn, 400)
603 assert %{"error" => _} = resp
604 refute Map.has_key?(resp, "access_token")
607 test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
608 setting = Pleroma.Config.get([:instance, :account_activation_required])
611 Pleroma.Config.put([:instance, :account_activation_required], true)
612 on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
615 password = "testpassword"
616 user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
617 info_change = Pleroma.User.Info.confirmation_changeset(user.info, :unconfirmed)
621 |> Ecto.Changeset.change()
622 |> Ecto.Changeset.put_embed(:info, info_change)
625 refute Pleroma.User.auth_active?(user)
627 app = insert(:oauth_app)
631 |> post("/oauth/token", %{
632 "grant_type" => "password",
633 "username" => user.nickname,
634 "password" => password,
635 "client_id" => app.client_id,
636 "client_secret" => app.client_secret
639 assert resp = json_response(conn, 403)
640 assert %{"error" => _} = resp
641 refute Map.has_key?(resp, "access_token")
644 test "rejects an invalid authorization code" do
645 app = insert(:oauth_app)
649 |> post("/oauth/token", %{
650 "grant_type" => "authorization_code",
651 "code" => "Imobviouslyinvalid",
652 "redirect_uri" => app.redirect_uris,
653 "client_id" => app.client_id,
654 "client_secret" => app.client_secret
657 assert resp = json_response(conn, 400)
658 assert %{"error" => _} = json_response(conn, 400)
659 refute Map.has_key?(resp, "access_token")