projects
/
akkoma
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
[#1427] Fixes / improvements of admin scopes support. Added tests.
[akkoma]
/
lib
/
pleroma
/
plugs
/
oauth_scopes_plug.ex
diff --git
a/lib/pleroma/plugs/oauth_scopes_plug.ex
b/lib/pleroma/plugs/oauth_scopes_plug.ex
index 41403047efec8369fc8fbd011b1ac4b2b53c2922..3201fb399820cf2f43158f020b9b8f3d52794dad 100644
(file)
--- a/
lib/pleroma/plugs/oauth_scopes_plug.ex
+++ b/
lib/pleroma/plugs/oauth_scopes_plug.ex
@@
-6,6
+6,9
@@
defmodule Pleroma.Plugs.OAuthScopesPlug do
import Plug.Conn
import Pleroma.Web.Gettext
import Plug.Conn
import Pleroma.Web.Gettext
+ alias Pleroma.Config
+ alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
+
@behaviour Plug
def init(%{scopes: _} = options), do: options
@behaviour Plug
def init(%{scopes: _} = options), do: options
@@
-13,11
+16,19
@@
defmodule Pleroma.Plugs.OAuthScopesPlug do
def call(%Plug.Conn{assigns: assigns} = conn, %{scopes: scopes} = options) do
op = options[:op] || :|
token = assigns[:token]
def call(%Plug.Conn{assigns: assigns} = conn, %{scopes: scopes} = options) do
op = options[:op] || :|
token = assigns[:token]
+
+ scopes =
+ if options[:admin] do
+ Config.oauth_admin_scopes(scopes)
+ else
+ scopes
+ end
+
matched_scopes = token && filter_descendants(scopes, token.scopes)
cond do
is_nil(token) ->
matched_scopes = token && filter_descendants(scopes, token.scopes)
cond do
is_nil(token) ->
- conn
+ maybe_perform_instance_privacy_check(conn, options)
op == :| && Enum.any?(matched_scopes) ->
conn
op == :| && Enum.any?(matched_scopes) ->
conn
@@
-29,6
+40,7
@@
defmodule Pleroma.Plugs.OAuthScopesPlug do
conn
|> assign(:user, nil)
|> assign(:token, nil)
conn
|> assign(:user, nil)
|> assign(:token, nil)
+ |> maybe_perform_instance_privacy_check(options)
true ->
missing_scopes = scopes -- matched_scopes
true ->
missing_scopes = scopes -- matched_scopes
@@
-56,4
+68,12
@@
defmodule Pleroma.Plugs.OAuthScopesPlug do
end
)
end
end
)
end
+
+ defp maybe_perform_instance_privacy_check(%Plug.Conn{} = conn, options) do
+ if options[:skip_instance_privacy_check] do
+ conn
+ else
+ EnsurePublicOrAuthenticatedPlug.call(conn, [])
+ end
+ end
end
end