"password" => "test",
"client_id" => app.client_id,
"redirect_uri" => redirect_uri,
- "scope" => "read write",
+ "scope" => "read:subscope write",
"state" => "statepassed"
}
})
assert %{"state" => "statepassed", "code" => code} = query
auth = Repo.get_by(Authorization, token: code)
assert auth
- assert auth.scopes == ["read", "write"]
+ assert auth.scopes == ["read:subscope", "write"]
end
test "returns 401 for wrong credentials", %{conn: conn} do
assert result =~ "This action is outside the authorized scopes"
end
- test "returns 401 for scopes beyond app scopes", %{conn: conn} do
+ test "returns 401 for scopes beyond app scopes hierarchy", %{conn: conn} do
user = insert(:user)
app = insert(:oauth_app, scopes: ["read", "write"])
redirect_uri = OAuthController.default_redirect_uri(app)
{:ok, user} =
insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
- |> User.change_info(&User.Info.confirmation_changeset(&1, need_confirmation: true))
- |> Repo.update()
+ |> User.confirmation_changeset(need_confirmation: true)
+ |> User.update_and_set_cache()
refute Pleroma.User.auth_active?(user)
user =
insert(:user,
password_hash: Comeonin.Pbkdf2.hashpwsalt(password),
- info: %{deactivated: true}
+ deactivated: true
)
app = insert(:oauth_app)
user =
insert(:user,
password_hash: Comeonin.Pbkdf2.hashpwsalt(password),
- info: %{password_reset_pending: true}
+ password_reset_pending: true
)
app = insert(:oauth_app, scopes: ["read", "write"])
assert resp = json_response(conn, 403)
assert resp["error"] == "Password reset is required"
+ assert resp["identifier"] == "password_reset_required"
refute Map.has_key?(resp, "access_token")
end