X-Git-Url: http://git.squeep.com/?a=blobdiff_plain;f=lib%2Fpleroma%2Fweb%2Foauth%2Foauth_controller.ex;h=7c1a3adbd363046ff3606922c113d4518039c41d;hb=bc4f77b10bb4360ac00d1999b1d08fa55e1fa547;hp=8fe0dde6e602d804d86427637aadb822edbb4f60;hpb=b79c126ee0977e44e21f275418862fede0e1f346;p=akkoma diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex index 8fe0dde6e..7c1a3adbd 100644 --- a/lib/pleroma/web/oauth/oauth_controller.ex +++ b/lib/pleroma/web/oauth/oauth_controller.ex @@ -1,20 +1,34 @@ +# Pleroma: A lightweight social networking server +# Copyright © 2017-2019 Pleroma Authors +# SPDX-License-Identifier: AGPL-3.0-only + defmodule Pleroma.Web.OAuth.OAuthController do use Pleroma.Web, :controller - alias Pleroma.Web.OAuth.{Authorization, Token, App} - alias Pleroma.{Repo, User} + alias Pleroma.Web.OAuth.Authorization + alias Pleroma.Web.OAuth.Token + alias Pleroma.Web.OAuth.App + alias Pleroma.Repo + alias Pleroma.User alias Comeonin.Pbkdf2 + import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2] + plug(:fetch_session) plug(:fetch_flash) action_fallback(Pleroma.Web.OAuth.FallbackController) def authorize(conn, params) do + app = Repo.get_by(App, client_id: params["client_id"]) + available_scopes = (app && app.scopes) || [] + scopes = oauth_scopes(params, nil) || available_scopes + render(conn, "show.html", %{ response_type: params["response_type"], client_id: params["client_id"], - scope: params["scope"], + available_scopes: available_scopes, + scopes: scopes, redirect_uri: params["redirect_uri"], state: params["state"] }) @@ -27,37 +41,66 @@ defmodule Pleroma.Web.OAuth.OAuthController do "password" => password, "client_id" => client_id, "redirect_uri" => redirect_uri - } = params + } = auth_params }) do with %User{} = user <- User.get_by_nickname_or_email(name), true <- Pbkdf2.checkpw(password, user.password_hash), %App{} = app <- Repo.get_by(App, client_id: client_id), - {:ok, auth} <- Authorization.create_authorization(app, user) do - if redirect_uri == "urn:ietf:wg:oauth:2.0:oob" do - render(conn, "results.html", %{ - auth: auth - }) - else - connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?" - url = "#{redirect_uri}#{connector}" - url_params = %{:code => auth.token} - - url_params = - if params["state"] do - Map.put(url_params, :state, params["state"]) - else - url_params - end - - url = "#{url}#{Plug.Conn.Query.encode url_params}" - - redirect(conn, external: url) + true <- redirect_uri in String.split(app.redirect_uris), + scopes <- oauth_scopes(auth_params, []), + {:unsupported_scopes, []} <- {:unsupported_scopes, scopes -- app.scopes}, + # Note: `scope` param is intentionally not optional in this context + {:missing_scopes, false} <- {:missing_scopes, scopes == []}, + {:auth_active, true} <- {:auth_active, User.auth_active?(user)}, + {:ok, auth} <- Authorization.create_authorization(app, user, scopes) do + # Special case: Local MastodonFE. + redirect_uri = + if redirect_uri == "." do + mastodon_api_url(conn, :login) + else + redirect_uri + end + + cond do + redirect_uri == "urn:ietf:wg:oauth:2.0:oob" -> + render(conn, "results.html", %{ + auth: auth + }) + + true -> + connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?" + url = "#{redirect_uri}#{connector}" + url_params = %{:code => auth.token} + + url_params = + if auth_params["state"] do + Map.put(url_params, :state, auth_params["state"]) + else + url_params + end + + url = "#{url}#{Plug.Conn.Query.encode(url_params)}" + + redirect(conn, external: url) end + else + {scopes_issue, _} when scopes_issue in [:unsupported_scopes, :missing_scopes] -> + conn + |> put_flash(:error, "Permissions not specified.") + |> put_status(:unauthorized) + |> authorize(auth_params) + + {:auth_active, false} -> + conn + |> put_flash(:error, "Account confirmation pending.") + |> put_status(:forbidden) + |> authorize(auth_params) + + error -> + error end end - # TODO - # - proper scope handling def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do with %App{} = app <- get_app_from_request(conn, params), fixed_token = fix_padding(params["code"]), @@ -71,7 +114,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do refresh_token: token.refresh_token, created_at: DateTime.to_unix(inserted_at), expires_in: 60 * 10, - scope: "read write follow" + scope: Enum.join(token.scopes) } json(conn, response) @@ -82,8 +125,6 @@ defmodule Pleroma.Web.OAuth.OAuthController do end end - # TODO - # - investigate a way to verify the user wants to grant read/write/follow once scope handling is done def token_exchange( conn, %{"grant_type" => "password", "username" => name, "password" => password} = params @@ -91,18 +132,27 @@ defmodule Pleroma.Web.OAuth.OAuthController do with %App{} = app <- get_app_from_request(conn, params), %User{} = user <- User.get_by_nickname_or_email(name), true <- Pbkdf2.checkpw(password, user.password_hash), - {:ok, auth} <- Authorization.create_authorization(app, user), + {:auth_active, true} <- {:auth_active, User.auth_active?(user)}, + scopes <- oauth_scopes(params, app.scopes), + [] <- scopes -- app.scopes, + true <- Enum.any?(scopes), + {:ok, auth} <- Authorization.create_authorization(app, user, scopes), {:ok, token} <- Token.exchange_token(app, auth) do response = %{ token_type: "Bearer", access_token: token.token, refresh_token: token.refresh_token, expires_in: 60 * 10, - scope: "read write follow" + scope: Enum.join(token.scopes, " ") } json(conn, response) else + {:auth_active, false} -> + conn + |> put_status(:forbidden) + |> json(%{error: "Account confirmation pending"}) + _error -> put_status(conn, 400) |> json(%{error: "Invalid credentials"}) @@ -111,7 +161,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do def token_exchange( conn, - %{"grant_type" => "password", "name" => name, "password" => password} = params + %{"grant_type" => "password", "name" => name, "password" => _password} = params ) do params = params @@ -133,10 +183,13 @@ defmodule Pleroma.Web.OAuth.OAuthController do end end + # XXX - for whatever reason our token arrives urlencoded, but Plug.Conn should be + # decoding it. Investigate sometime. defp fix_padding(token) do token + |> URI.decode() |> Base.url_decode64!(padding: false) - |> Base.url_encode64() + |> Base.url_encode64(padding: false) end defp get_app_from_request(conn, params) do