+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
defmodule Pleroma.Web.OAuth.OAuthController do
use Pleroma.Web, :controller
- alias Pleroma.Web.OAuth.{Authorization, Token, App}
- alias Pleroma.{Repo, User}
+ alias Pleroma.Web.Auth.Authenticator
+ alias Pleroma.Web.OAuth.Authorization
+ alias Pleroma.Web.OAuth.Token
+ alias Pleroma.Web.OAuth.App
+ alias Pleroma.Repo
+ alias Pleroma.User
alias Comeonin.Pbkdf2
+ import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2]
+
plug(:fetch_session)
plug(:fetch_flash)
action_fallback(Pleroma.Web.OAuth.FallbackController)
def authorize(conn, params) do
- render(conn, "show.html", %{
+ app = Repo.get_by(App, client_id: params["client_id"])
+ available_scopes = (app && app.scopes) || []
+ scopes = oauth_scopes(params, nil) || available_scopes
+
+ render(conn, Authenticator.auth_template(), %{
response_type: params["response_type"],
client_id: params["client_id"],
- scope: params["scope"],
+ available_scopes: available_scopes,
+ scopes: scopes,
redirect_uri: params["redirect_uri"],
- state: params["state"]
+ state: params["state"],
+ params: params
})
end
def create_authorization(conn, %{
"authorization" =>
%{
- "name" => name,
- "password" => password,
"client_id" => client_id,
"redirect_uri" => redirect_uri
- } = params
+ } = auth_params
}) do
- with %User{} = user <- User.get_by_nickname_or_email(name),
- true <- Pbkdf2.checkpw(password, user.password_hash),
+ with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn)},
%App{} = app <- Repo.get_by(App, client_id: client_id),
- {:ok, auth} <- Authorization.create_authorization(app, user) do
- if redirect_uri == "urn:ietf:wg:oauth:2.0:oob" do
- render(conn, "results.html", %{
- auth: auth
- })
- else
- connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?"
- url = "#{redirect_uri}#{connector}"
- url_params = %{:code => auth.token}
-
- url_params =
- if params["state"] do
- Map.put(url_params, :state, params["state"])
- else
- url_params
- end
-
- url = "#{url}#{Plug.Conn.Query.encode(url_params)}"
-
- redirect(conn, external: url)
+ true <- redirect_uri in String.split(app.redirect_uris),
+ scopes <- oauth_scopes(auth_params, []),
+ {:unsupported_scopes, []} <- {:unsupported_scopes, scopes -- app.scopes},
+ # Note: `scope` param is intentionally not optional in this context
+ {:missing_scopes, false} <- {:missing_scopes, scopes == []},
+ {:auth_active, true} <- {:auth_active, User.auth_active?(user)},
+ {:ok, auth} <- Authorization.create_authorization(app, user, scopes) do
+ redirect_uri =
+ if redirect_uri == "." do
+ # Special case: Local MastodonFE
+ mastodon_api_url(conn, :login)
+ else
+ redirect_uri
+ end
+
+ cond do
+ redirect_uri == "urn:ietf:wg:oauth:2.0:oob" ->
+ render(conn, "results.html", %{
+ auth: auth
+ })
+
+ true ->
+ connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?"
+ url = "#{redirect_uri}#{connector}"
+ url_params = %{:code => auth.token}
+
+ url_params =
+ if auth_params["state"] do
+ Map.put(url_params, :state, auth_params["state"])
+ else
+ url_params
+ end
+
+ url = "#{url}#{Plug.Conn.Query.encode(url_params)}"
+
+ redirect(conn, external: url)
end
+ else
+ {scopes_issue, _} when scopes_issue in [:unsupported_scopes, :missing_scopes] ->
+ conn
+ |> put_flash(:error, "Permissions not specified.")
+ |> put_status(:unauthorized)
+ |> authorize(auth_params)
+
+ {:auth_active, false} ->
+ conn
+ |> put_flash(:error, "Account confirmation pending.")
+ |> put_status(:forbidden)
+ |> authorize(auth_params)
+
+ error ->
+ Authenticator.handle_error(conn, error)
end
end
- # TODO
- # - proper scope handling
def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do
with %App{} = app <- get_app_from_request(conn, params),
fixed_token = fix_padding(params["code"]),
refresh_token: token.refresh_token,
created_at: DateTime.to_unix(inserted_at),
expires_in: 60 * 10,
- scope: "read write follow"
+ scope: Enum.join(token.scopes, " ")
}
json(conn, response)
end
end
- # TODO
- # - investigate a way to verify the user wants to grant read/write/follow once scope handling is done
def token_exchange(
conn,
%{"grant_type" => "password", "username" => name, "password" => password} = params
with %App{} = app <- get_app_from_request(conn, params),
%User{} = user <- User.get_by_nickname_or_email(name),
true <- Pbkdf2.checkpw(password, user.password_hash),
- {:ok, auth} <- Authorization.create_authorization(app, user),
+ {:auth_active, true} <- {:auth_active, User.auth_active?(user)},
+ scopes <- oauth_scopes(params, app.scopes),
+ [] <- scopes -- app.scopes,
+ true <- Enum.any?(scopes),
+ {:ok, auth} <- Authorization.create_authorization(app, user, scopes),
{:ok, token} <- Token.exchange_token(app, auth) do
response = %{
token_type: "Bearer",
access_token: token.token,
refresh_token: token.refresh_token,
expires_in: 60 * 10,
- scope: "read write follow"
+ scope: Enum.join(token.scopes, " ")
}
json(conn, response)
else
+ {:auth_active, false} ->
+ conn
+ |> put_status(:forbidden)
+ |> json(%{error: "Account confirmation pending"})
+
_error ->
put_status(conn, 400)
|> json(%{error: "Invalid credentials"})
def token_exchange(
conn,
- %{"grant_type" => "password", "name" => name, "password" => password} = params
+ %{"grant_type" => "password", "name" => name, "password" => _password} = params
) do
params =
params
end
end
+ # XXX - for whatever reason our token arrives urlencoded, but Plug.Conn should be
+ # decoding it. Investigate sometime.
defp fix_padding(token) do
token
+ |> URI.decode()
|> Base.url_decode64!(padding: false)
- |> Base.url_encode64()
+ |> Base.url_encode64(padding: false)
end
defp get_app_from_request(conn, params) do