1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Web.MastodonAPI.AuthController do
6 use Pleroma.Web, :controller
8 import Pleroma.Web.ControllerHelper, only: [json_response: 3]
10 alias Pleroma.Helpers.AuthHelper
12 alias Pleroma.Web.OAuth.App
13 alias Pleroma.Web.OAuth.Authorization
14 alias Pleroma.Web.OAuth.Token
15 alias Pleroma.Web.TwitterAPI.TwitterAPI
17 action_fallback(Pleroma.Web.MastodonAPI.FallbackController)
19 plug(Pleroma.Web.Plugs.RateLimiter, [name: :password_reset] when action == :password_reset)
21 @local_mastodon_name "Mastodon-Local"
24 def login(%{assigns: %{user: %User{}}} = conn, _params) do
25 redirect(conn, to: local_mastodon_root_path(conn))
28 # Local Mastodon FE login init action
29 def login(conn, %{"code" => auth_token}) do
30 with {:ok, app} <- get_or_make_app(),
31 {:ok, auth} <- Authorization.get_by_token(app, auth_token),
32 {:ok, token} <- Token.exchange_token(app, auth) do
34 |> AuthHelper.put_session_token(token.token)
35 |> redirect(to: local_mastodon_root_path(conn))
39 # Local Mastodon FE callback action
41 with {:ok, app} <- get_or_make_app() do
43 o_auth_path(conn, :authorize,
44 response_type: "code",
45 client_id: app.client_id,
47 scope: Enum.join(app.scopes, " ")
50 redirect(conn, to: path)
54 @doc "DELETE /auth/sign_out"
55 def logout(conn, _) do
61 @doc "POST /auth/password"
62 def password_reset(conn, params) do
63 nickname_or_email = params["email"] || params["nickname"]
65 TwitterAPI.password_reset(nickname_or_email)
67 json_response(conn, :no_content, "")
70 defp local_mastodon_root_path(conn) do
71 case get_session(conn, :return_to) do
73 masto_fe_path(conn, :index, ["getting-started"])
76 delete_session(conn, :return_to)
81 @spec get_or_make_app() :: {:ok, App.t()} | {:error, Ecto.Changeset.t()}
82 defp get_or_make_app do
83 %{client_name: @local_mastodon_name, redirect_uris: "."}
84 |> App.get_or_make(["read", "write", "follow", "push", "admin"])