git.squeep.com Git - akkoma/blob - test/web/oauth/oauth_controller_test.exs

   1 defmodule Pleroma.Web.OAuth.OAuthControllerTest do
   2   use Pleroma.Web.ConnCase
   3   import Pleroma.Factory
   4
   5   alias Pleroma.Repo
   6   alias Pleroma.Web.OAuth.{Authorization, Token}
   7
   8   test "redirects with oauth authorization" do
   9     user = insert(:user)
  10     app = insert(:oauth_app)
  11
  12     conn =
  13       build_conn()
  14       |> post("/oauth/authorize", %{
  15         "authorization" => %{
  16           "name" => user.nickname,
  17           "password" => "test",
  18           "client_id" => app.client_id,
  19           "redirect_uri" => app.redirect_uris,
  20           "state" => "statepassed"
  21         }
  22       })
  23
  24     target = redirected_to(conn)
  25     assert target =~ app.redirect_uris
  26
  27     query = URI.parse(target).query |> URI.query_decoder() |> Map.new()
  28
  29     assert %{"state" => "statepassed", "code" => code} = query
  30     assert Repo.get_by(Authorization, token: code)
  31   end
  32
  33   test "issues a token for an all-body request" do
  34     user = insert(:user)
  35     app = insert(:oauth_app)
  36
  37     {:ok, auth} = Authorization.create_authorization(app, user)
  38
  39     conn =
  40       build_conn()
  41       |> post("/oauth/token", %{
  42         "grant_type" => "authorization_code",
  43         "code" => auth.token,
  44         "redirect_uri" => app.redirect_uris,
  45         "client_id" => app.client_id,
  46         "client_secret" => app.client_secret
  47       })
  48
  49     assert %{"access_token" => token} = json_response(conn, 200)
  50     assert Repo.get_by(Token, token: token)
  51   end
  52
  53   test "issues a token for `password` grant_type with valid credentials" do
  54     password = "testpassword"
  55     user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
  56
  57     app = insert(:oauth_app)
  58
  59     conn =
  60       build_conn()
  61       |> post("/oauth/token", %{
  62         "grant_type" => "password",
  63         "username" => user.nickname,
  64         "password" => password,
  65         "client_id" => app.client_id,
  66         "client_secret" => app.client_secret
  67       })
  68
  69     assert %{"access_token" => token} = json_response(conn, 200)
  70     assert Repo.get_by(Token, token: token)
  71   end
  72
  73   test "issues a token for request with HTTP basic auth client credentials" do
  74     user = insert(:user)
  75     app = insert(:oauth_app)
  76
  77     {:ok, auth} = Authorization.create_authorization(app, user)
  78
  79     app_encoded =
  80       (URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
  81       |> Base.encode64()
  82
  83     conn =
  84       build_conn()
  85       |> put_req_header("authorization", "Basic " <> app_encoded)
  86       |> post("/oauth/token", %{
  87         "grant_type" => "authorization_code",
  88         "code" => auth.token,
  89         "redirect_uri" => app.redirect_uris
  90       })
  91
  92     assert %{"access_token" => token} = json_response(conn, 200)
  93     assert Repo.get_by(Token, token: token)
  94   end
  95
  96   test "rejects token exchange with invalid client credentials" do
  97     user = insert(:user)
  98     app = insert(:oauth_app)
  99
 100     {:ok, auth} = Authorization.create_authorization(app, user)
 101
 102     conn =
 103       build_conn()
 104       |> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
 105       |> post("/oauth/token", %{
 106         "grant_type" => "authorization_code",
 107         "code" => auth.token,
 108         "redirect_uri" => app.redirect_uris
 109       })
 110
 111     assert resp = json_response(conn, 400)
 112     assert %{"error" => _} = resp
 113     refute Map.has_key?(resp, "access_token")
 114   end
 115
 116   test "rejects token exchange for valid credentials belonging to unconfirmed user" do
 117     password = "testpassword"
 118     user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
 119     info_change = Pleroma.User.Info.confirmation_change(user.info, :unconfirmed)
 120
 121     {:ok, user} =
 122       user
 123       |> Ecto.Changeset.change()
 124       |> Ecto.Changeset.put_embed(:info, info_change)
 125       |> Repo.update()
 126
 127     refute Pleroma.User.auth_active?(user)
 128
 129     app = insert(:oauth_app)
 130
 131     conn =
 132       build_conn()
 133       |> post("/oauth/token", %{
 134         "grant_type" => "password",
 135         "username" => user.nickname,
 136         "password" => password,
 137         "client_id" => app.client_id,
 138         "client_secret" => app.client_secret
 139       })
 140
 141     assert resp = json_response(conn, 403)
 142     assert %{"error" => _} = resp
 143     refute Map.has_key?(resp, "access_token")
 144   end
 145
 146   test "rejects an invalid authorization code" do
 147     app = insert(:oauth_app)
 148
 149     conn =
 150       build_conn()
 151       |> post("/oauth/token", %{
 152         "grant_type" => "authorization_code",
 153         "code" => "Imobviouslyinvalid",
 154         "redirect_uri" => app.redirect_uris,
 155         "client_id" => app.client_id,
 156         "client_secret" => app.client_secret
 157       })
 158
 159     assert resp = json_response(conn, 400)
 160     assert %{"error" => _} = json_response(conn, 400)
 161     refute Map.has_key?(resp, "access_token")
 162   end
 163 end