1 # Pleroma: A lightweight social networking server
2 # Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
3 # SPDX-License-Identifier: AGPL-3.0-only
5 defmodule Pleroma.Plugs.OAuthScopesPlugTest do
6 use Pleroma.Web.ConnCase, async: true
8 alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
9 alias Pleroma.Plugs.OAuthScopesPlug
10 alias Pleroma.Plugs.PlugHelper
14 import Pleroma.Factory
16 setup_with_mocks([{EnsurePublicOrAuthenticatedPlug, [], [call: fn conn, _ -> conn end]}]) do
20 test "is not performed if marked as skipped", %{conn: conn} do
21 with_mock OAuthScopesPlug, [:passthrough], perform: &passthrough([&1, &2]) do
24 |> PlugHelper.append_to_skipped_plugs(OAuthScopesPlug)
25 |> OAuthScopesPlug.call(%{scopes: ["random_scope"]})
27 refute called(OAuthScopesPlug.perform(:_, :_))
32 test "if `token.scopes` fulfills specified 'any of' conditions, " <>
33 "proceeds with no op",
35 token = insert(:oauth_token, scopes: ["read", "write"]) |> Repo.preload(:user)
39 |> assign(:user, token.user)
40 |> assign(:token, token)
41 |> OAuthScopesPlug.call(%{scopes: ["read"]})
44 assert conn.assigns[:user]
47 test "if `token.scopes` fulfills specified 'all of' conditions, " <>
48 "proceeds with no op",
50 token = insert(:oauth_token, scopes: ["scope1", "scope2", "scope3"]) |> Repo.preload(:user)
54 |> assign(:user, token.user)
55 |> assign(:token, token)
56 |> OAuthScopesPlug.call(%{scopes: ["scope2", "scope3"], op: :&})
59 assert conn.assigns[:user]
62 describe "with `fallback: :proceed_unauthenticated` option, " do
63 test "if `token.scopes` doesn't fulfill specified conditions, " <>
64 "clears :user and :token assigns and calls EnsurePublicOrAuthenticatedPlug",
67 token1 = insert(:oauth_token, scopes: ["read", "write"], user: user)
69 for token <- [token1, nil], op <- [:|, :&] do
72 |> assign(:user, user)
73 |> assign(:token, token)
74 |> OAuthScopesPlug.call(%{
77 fallback: :proceed_unauthenticated
80 refute ret_conn.halted
81 refute ret_conn.assigns[:user]
82 refute ret_conn.assigns[:token]
84 assert called(EnsurePublicOrAuthenticatedPlug.call(ret_conn, :_))
88 test "with :skip_instance_privacy_check option, " <>
89 "if `token.scopes` doesn't fulfill specified conditions, " <>
90 "clears :user and :token assigns and does NOT call EnsurePublicOrAuthenticatedPlug",
93 token1 = insert(:oauth_token, scopes: ["read:statuses", "write"], user: user)
95 for token <- [token1, nil], op <- [:|, :&] do
98 |> assign(:user, user)
99 |> assign(:token, token)
100 |> OAuthScopesPlug.call(%{
103 fallback: :proceed_unauthenticated,
104 skip_instance_privacy_check: true
107 refute ret_conn.halted
108 refute ret_conn.assigns[:user]
109 refute ret_conn.assigns[:token]
111 refute called(EnsurePublicOrAuthenticatedPlug.call(ret_conn, :_))
116 describe "without :fallback option, " do
117 test "if `token.scopes` does not fulfill specified 'any of' conditions, " <>
118 "returns 403 and halts",
120 for token <- [insert(:oauth_token, scopes: ["read", "write"]), nil] do
121 any_of_scopes = ["follow", "push"]
125 |> assign(:token, token)
126 |> OAuthScopesPlug.call(%{scopes: any_of_scopes})
128 assert ret_conn.halted
129 assert 403 == ret_conn.status
131 expected_error = "Insufficient permissions: #{Enum.join(any_of_scopes, " | ")}."
132 assert Jason.encode!(%{error: expected_error}) == ret_conn.resp_body
136 test "if `token.scopes` does not fulfill specified 'all of' conditions, " <>
137 "returns 403 and halts",
139 for token <- [insert(:oauth_token, scopes: ["read", "write"]), nil] do
140 token_scopes = (token && token.scopes) || []
141 all_of_scopes = ["write", "follow"]
145 |> assign(:token, token)
146 |> OAuthScopesPlug.call(%{scopes: all_of_scopes, op: :&})
149 assert 403 == conn.status
152 "Insufficient permissions: #{Enum.join(all_of_scopes -- token_scopes, " & ")}."
154 assert Jason.encode!(%{error: expected_error}) == conn.resp_body
159 describe "with hierarchical scopes, " do
160 test "if `token.scopes` fulfills specified 'any of' conditions, " <>
161 "proceeds with no op",
163 token = insert(:oauth_token, scopes: ["read", "write"]) |> Repo.preload(:user)
167 |> assign(:user, token.user)
168 |> assign(:token, token)
169 |> OAuthScopesPlug.call(%{scopes: ["read:something"]})
172 assert conn.assigns[:user]
175 test "if `token.scopes` fulfills specified 'all of' conditions, " <>
176 "proceeds with no op",
178 token = insert(:oauth_token, scopes: ["scope1", "scope2", "scope3"]) |> Repo.preload(:user)
182 |> assign(:user, token.user)
183 |> assign(:token, token)
184 |> OAuthScopesPlug.call(%{scopes: ["scope1:subscope", "scope2:subscope"], op: :&})
187 assert conn.assigns[:user]
191 describe "filter_descendants/2" do
192 test "filters scopes which directly match or are ancestors of supported scopes" do
193 f = fn scopes, supported_scopes ->
194 OAuthScopesPlug.filter_descendants(scopes, supported_scopes)
197 assert f.(["read", "follow"], ["write", "read"]) == ["read"]
199 assert f.(["read", "write:something", "follow"], ["write", "read"]) ==
200 ["read", "write:something"]
202 assert f.(["admin:read"], ["write", "read"]) == []
204 assert f.(["admin:read"], ["write", "admin"]) == ["admin:read"]
208 describe "transform_scopes/2" do
209 clear_config([:auth, :enforce_oauth_admin_scope_usage])
212 {:ok, %{f: &OAuthScopesPlug.transform_scopes/2}}
215 test "with :admin option, prefixes all requested scopes with `admin:` " <>
216 "and [optionally] keeps only prefixed scopes, " <>
217 "depending on `[:auth, :enforce_oauth_admin_scope_usage]` setting",
219 Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
221 assert f.(["read"], %{admin: true}) == ["admin:read", "read"]
223 assert f.(["read", "write"], %{admin: true}) == [
230 Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
232 assert f.(["read:accounts"], %{admin: true}) == ["admin:read:accounts"]
234 assert f.(["read", "write:reports"], %{admin: true}) == [
236 "admin:write:reports"
240 test "with no supported options, returns unmodified scopes", %{f: f} do
241 assert f.(["read"], %{}) == ["read"]
242 assert f.(["read", "write"], %{}) == ["read", "write"]