git.squeep.com Git - akkoma/blob - test/web/oauth/oauth_controller_test.exs

   1 defmodule Pleroma.Web.OAuth.OAuthControllerTest do
   2   use Pleroma.Web.ConnCase
   3   import Pleroma.Factory
   4
   5   alias Pleroma.Repo
   6   alias Pleroma.Web.OAuth.{Authorization, Token}
   7
   8   test "redirects with oauth authorization" do
   9     user = insert(:user)
  10     app = insert(:oauth_app)
  11
  12     conn =
  13       build_conn()
  14       |> post("/oauth/authorize", %{
  15         "authorization" => %{
  16           "name" => user.nickname,
  17           "password" => "test",
  18           "client_id" => app.client_id,
  19           "redirect_uri" => app.redirect_uris,
  20           "state" => "statepassed"
  21         }
  22       })
  23
  24     target = redirected_to(conn)
  25     assert target =~ app.redirect_uris
  26
  27     query = URI.parse(target).query |> URI.query_decoder() |> Map.new()
  28
  29     assert %{"state" => "statepassed", "code" => code} = query
  30     assert Repo.get_by(Authorization, token: code)
  31   end
  32
  33   test "issues a token for an all-body request" do
  34     user = insert(:user)
  35     app = insert(:oauth_app)
  36
  37     {:ok, auth} = Authorization.create_authorization(app, user)
  38
  39     conn =
  40       build_conn()
  41       |> post("/oauth/token", %{
  42         "grant_type" => "authorization_code",
  43         "code" => auth.token,
  44         "redirect_uri" => app.redirect_uris,
  45         "client_id" => app.client_id,
  46         "client_secret" => app.client_secret
  47       })
  48
  49     assert %{"access_token" => token} = json_response(conn, 200)
  50     assert Repo.get_by(Token, token: token)
  51   end
  52
  53   test "issues a token for `password` grant_type with valid credentials" do
  54     password = "testpassword"
  55     user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
  56
  57     app = insert(:oauth_app)
  58
  59     conn =
  60       build_conn()
  61       |> post("/oauth/token", %{
  62         "grant_type" => "password",
  63         "username" => user.nickname,
  64         "password" => password,
  65         "client_id" => app.client_id,
  66         "client_secret" => app.client_secret
  67       })
  68
  69     assert %{"access_token" => token} = json_response(conn, 200)
  70     assert Repo.get_by(Token, token: token)
  71   end
  72
  73   test "issues a token for request with HTTP basic auth client credentials" do
  74     user = insert(:user)
  75     app = insert(:oauth_app)
  76
  77     {:ok, auth} = Authorization.create_authorization(app, user)
  78
  79     app_encoded =
  80       (URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
  81       |> Base.encode64()
  82
  83     conn =
  84       build_conn()
  85       |> put_req_header("authorization", "Basic " <> app_encoded)
  86       |> post("/oauth/token", %{
  87         "grant_type" => "authorization_code",
  88         "code" => auth.token,
  89         "redirect_uri" => app.redirect_uris
  90       })
  91
  92     assert %{"access_token" => token} = json_response(conn, 200)
  93     assert Repo.get_by(Token, token: token)
  94   end
  95
  96   test "rejects token exchange with invalid client credentials" do
  97     user = insert(:user)
  98     app = insert(:oauth_app)
  99
 100     {:ok, auth} = Authorization.create_authorization(app, user)
 101
 102     conn =
 103       build_conn()
 104       |> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
 105       |> post("/oauth/token", %{
 106         "grant_type" => "authorization_code",
 107         "code" => auth.token,
 108         "redirect_uri" => app.redirect_uris
 109       })
 110
 111     assert resp = json_response(conn, 400)
 112     assert %{"error" => _} = resp
 113     refute Map.has_key?(resp, "access_token")
 114   end
 115
 116   test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
 117     setting = Pleroma.Config.get([:instance, :account_activation_required])
 118
 119     unless setting do
 120       Pleroma.Config.put([:instance, :account_activation_required], true)
 121       on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
 122     end
 123
 124     password = "testpassword"
 125     user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
 126     info_change = Pleroma.User.Info.confirmation_changeset(user.info, :unconfirmed)
 127
 128     {:ok, user} =
 129       user
 130       |> Ecto.Changeset.change()
 131       |> Ecto.Changeset.put_embed(:info, info_change)
 132       |> Repo.update()
 133
 134     refute Pleroma.User.auth_active?(user)
 135
 136     app = insert(:oauth_app)
 137
 138     conn =
 139       build_conn()
 140       |> post("/oauth/token", %{
 141         "grant_type" => "password",
 142         "username" => user.nickname,
 143         "password" => password,
 144         "client_id" => app.client_id,
 145         "client_secret" => app.client_secret
 146       })
 147
 148     assert resp = json_response(conn, 403)
 149     assert %{"error" => _} = resp
 150     refute Map.has_key?(resp, "access_token")
 151   end
 152
 153   test "rejects an invalid authorization code" do
 154     app = insert(:oauth_app)
 155
 156     conn =
 157       build_conn()
 158       |> post("/oauth/token", %{
 159         "grant_type" => "authorization_code",
 160         "code" => "Imobviouslyinvalid",
 161         "redirect_uri" => app.redirect_uris,
 162         "client_id" => app.client_id,
 163         "client_secret" => app.client_secret
 164       })
 165
 166     assert resp = json_response(conn, 400)
 167     assert %{"error" => _} = json_response(conn, 400)
 168     refute Map.has_key?(resp, "access_token")
 169   end
 170 end