git.squeep.com Git - akkoma/blob - test/web/oauth/oauth_controller_test.exs

   1 # Pleroma: A lightweight social networking server
   2 # Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
   3 # SPDX-License-Identifier: AGPL-3.0-only
   4
   5 defmodule Pleroma.Web.OAuth.OAuthControllerTest do
   6   use Pleroma.Web.ConnCase
   7   import Pleroma.Factory
   8
   9   alias Pleroma.Repo
  10   alias Pleroma.Web.OAuth.Authorization
  11   alias Pleroma.Web.OAuth.Token
  12
  13   test "redirects with oauth authorization" do
  14     user = insert(:user)
  15     app = insert(:oauth_app, scopes: ["read", "write", "follow"])
  16
  17     conn =
  18       build_conn()
  19       |> post("/oauth/authorize", %{
  20         "authorization" => %{
  21           "name" => user.nickname,
  22           "password" => "test",
  23           "client_id" => app.client_id,
  24           "redirect_uri" => app.redirect_uris,
  25           "scope" => "read write",
  26           "state" => "statepassed"
  27         }
  28       })
  29
  30     target = redirected_to(conn)
  31     assert target =~ app.redirect_uris
  32
  33     query = URI.parse(target).query |> URI.query_decoder() |> Map.new()
  34
  35     assert %{"state" => "statepassed", "code" => code} = query
  36     auth = Repo.get_by(Authorization, token: code)
  37     assert auth
  38     assert auth.scopes == ["read", "write"]
  39   end
  40
  41   test "returns 401 for wrong credentials", %{conn: conn} do
  42     user = insert(:user)
  43     app = insert(:oauth_app)
  44
  45     result =
  46       conn
  47       |> post("/oauth/authorize", %{
  48         "authorization" => %{
  49           "name" => user.nickname,
  50           "password" => "wrong",
  51           "client_id" => app.client_id,
  52           "redirect_uri" => app.redirect_uris,
  53           "state" => "statepassed",
  54           "scope" => Enum.join(app.scopes, " ")
  55         }
  56       })
  57       |> html_response(:unauthorized)
  58
  59     # Keep the details
  60     assert result =~ app.client_id
  61     assert result =~ app.redirect_uris
  62
  63     # Error message
  64     assert result =~ "Invalid Username/Password"
  65   end
  66
  67   test "returns 401 for missing scopes", %{conn: conn} do
  68     user = insert(:user)
  69     app = insert(:oauth_app)
  70
  71     result =
  72       conn
  73       |> post("/oauth/authorize", %{
  74         "authorization" => %{
  75           "name" => user.nickname,
  76           "password" => "test",
  77           "client_id" => app.client_id,
  78           "redirect_uri" => app.redirect_uris,
  79           "state" => "statepassed",
  80           "scope" => ""
  81         }
  82       })
  83       |> html_response(:unauthorized)
  84
  85     # Keep the details
  86     assert result =~ app.client_id
  87     assert result =~ app.redirect_uris
  88
  89     # Error message
  90     assert result =~ "Permissions not specified"
  91   end
  92
  93   test "returns 401 for scopes beyond app scopes", %{conn: conn} do
  94     user = insert(:user)
  95     app = insert(:oauth_app, scopes: ["read", "write"])
  96
  97     result =
  98       conn
  99       |> post("/oauth/authorize", %{
 100         "authorization" => %{
 101           "name" => user.nickname,
 102           "password" => "test",
 103           "client_id" => app.client_id,
 104           "redirect_uri" => app.redirect_uris,
 105           "state" => "statepassed",
 106           "scope" => "read write follow"
 107         }
 108       })
 109       |> html_response(:unauthorized)
 110
 111     # Keep the details
 112     assert result =~ app.client_id
 113     assert result =~ app.redirect_uris
 114
 115     # Error message
 116     assert result =~ "Permissions not specified"
 117   end
 118
 119   test "issues a token for an all-body request" do
 120     user = insert(:user)
 121     app = insert(:oauth_app, scopes: ["read", "write"])
 122
 123     {:ok, auth} = Authorization.create_authorization(app, user, ["write"])
 124
 125     conn =
 126       build_conn()
 127       |> post("/oauth/token", %{
 128         "grant_type" => "authorization_code",
 129         "code" => auth.token,
 130         "redirect_uri" => app.redirect_uris,
 131         "client_id" => app.client_id,
 132         "client_secret" => app.client_secret
 133       })
 134
 135     assert %{"access_token" => token} = json_response(conn, 200)
 136
 137     token = Repo.get_by(Token, token: token)
 138     assert token
 139     assert token.scopes == auth.scopes
 140   end
 141
 142   test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do
 143     password = "testpassword"
 144     user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
 145
 146     app = insert(:oauth_app, scopes: ["read", "write"])
 147
 148     # Note: "scope" param is intentionally omitted
 149     conn =
 150       build_conn()
 151       |> post("/oauth/token", %{
 152         "grant_type" => "password",
 153         "username" => user.nickname,
 154         "password" => password,
 155         "client_id" => app.client_id,
 156         "client_secret" => app.client_secret
 157       })
 158
 159     assert %{"access_token" => token} = json_response(conn, 200)
 160
 161     token = Repo.get_by(Token, token: token)
 162     assert token
 163     assert token.scopes == app.scopes
 164   end
 165
 166   test "issues a token for request with HTTP basic auth client credentials" do
 167     user = insert(:user)
 168     app = insert(:oauth_app, scopes: ["scope1", "scope2"])
 169
 170     {:ok, auth} = Authorization.create_authorization(app, user, ["scope2"])
 171     assert auth.scopes == ["scope2"]
 172
 173     app_encoded =
 174       (URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
 175       |> Base.encode64()
 176
 177     conn =
 178       build_conn()
 179       |> put_req_header("authorization", "Basic " <> app_encoded)
 180       |> post("/oauth/token", %{
 181         "grant_type" => "authorization_code",
 182         "code" => auth.token,
 183         "redirect_uri" => app.redirect_uris
 184       })
 185
 186     assert %{"access_token" => token} = json_response(conn, 200)
 187
 188     token = Repo.get_by(Token, token: token)
 189     assert token
 190     assert token.scopes == ["scope2"]
 191   end
 192
 193   test "rejects token exchange with invalid client credentials" do
 194     user = insert(:user)
 195     app = insert(:oauth_app)
 196
 197     {:ok, auth} = Authorization.create_authorization(app, user)
 198
 199     conn =
 200       build_conn()
 201       |> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
 202       |> post("/oauth/token", %{
 203         "grant_type" => "authorization_code",
 204         "code" => auth.token,
 205         "redirect_uri" => app.redirect_uris
 206       })
 207
 208     assert resp = json_response(conn, 400)
 209     assert %{"error" => _} = resp
 210     refute Map.has_key?(resp, "access_token")
 211   end
 212
 213   test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
 214     setting = Pleroma.Config.get([:instance, :account_activation_required])
 215
 216     unless setting do
 217       Pleroma.Config.put([:instance, :account_activation_required], true)
 218       on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
 219     end
 220
 221     password = "testpassword"
 222     user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
 223     info_change = Pleroma.User.Info.confirmation_changeset(user.info, :unconfirmed)
 224
 225     {:ok, user} =
 226       user
 227       |> Ecto.Changeset.change()
 228       |> Ecto.Changeset.put_embed(:info, info_change)
 229       |> Repo.update()
 230
 231     refute Pleroma.User.auth_active?(user)
 232
 233     app = insert(:oauth_app)
 234
 235     conn =
 236       build_conn()
 237       |> post("/oauth/token", %{
 238         "grant_type" => "password",
 239         "username" => user.nickname,
 240         "password" => password,
 241         "client_id" => app.client_id,
 242         "client_secret" => app.client_secret
 243       })
 244
 245     assert resp = json_response(conn, 403)
 246     assert %{"error" => _} = resp
 247     refute Map.has_key?(resp, "access_token")
 248   end
 249
 250   test "rejects an invalid authorization code" do
 251     app = insert(:oauth_app)
 252
 253     conn =
 254       build_conn()
 255       |> post("/oauth/token", %{
 256         "grant_type" => "authorization_code",
 257         "code" => "Imobviouslyinvalid",
 258         "redirect_uri" => app.redirect_uris,
 259         "client_id" => app.client_id,
 260         "client_secret" => app.client_secret
 261       })
 262
 263     assert resp = json_response(conn, 400)
 264     assert %{"error" => _} = json_response(conn, 400)
 265     refute Map.has_key?(resp, "access_token")
 266   end
 267 end