defmodule Pleroma.Helpers.AuthHelper do
alias Pleroma.Web.Plugs.OAuthScopesPlug
- alias Plug.Conn
import Plug.Conn
- @oauth_token_session_key :oauth_token
-
@doc """
Skips OAuth permissions (scopes) checks, assigns nil `:token`.
Intended to be used with explicit authentication and only when OAuth token cannot be determined.
|> assign(:token, nil)
|> put_private(:authentication_ignored, true)
end
-
- @doc "Gets OAuth token string from session"
- def get_session_token(%Conn{} = conn) do
- get_session(conn, @oauth_token_session_key)
- end
-
- @doc "Updates OAuth token string in session"
- def put_session_token(%Conn{} = conn, token) when is_binary(token) do
- put_session(conn, @oauth_token_session_key, token)
- end
-
- @doc "Deletes OAuth token string from session"
- def delete_session_token(%Conn{} = conn) do
- delete_session(conn, @oauth_token_session_key)
- end
end
import Pleroma.Web.ControllerHelper, only: [json_response: 3]
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.Helpers.UriHelper
alias Pleroma.User
alias Pleroma.Web.OAuth.App
|> UriHelper.modify_uri_params(%{"access_token" => oauth_token.token})
conn
- |> AuthHelper.put_session_token(oauth_token.token)
|> redirect(to: redirect_to)
else
_ -> redirect_to_oauth_form(conn, params)
end
def login(conn, params) do
- with %{assigns: %{user: %User{}, token: %Token{app_id: app_id}}} <- conn,
+ with %{assigns: %{user: %User{}, token: %Token{app_id: app_id, token: token}}} <- conn,
{:ok, %{id: ^app_id}} <- local_mastofe_app() do
- redirect(conn, to: local_mastodon_post_login_path(conn))
+ redirect(conn, to: local_mastodon_post_login_path(conn) <> "?access_token=#{token}")
else
_ -> redirect_to_oauth_form(conn, params)
end
def logout(conn, _) do
conn =
with %{assigns: %{token: %Token{} = oauth_token}} <- conn,
- session_token = AuthHelper.get_session_token(conn),
- {:ok, %Token{token: ^session_token}} <- RevokeToken.revoke(oauth_token) do
- AuthHelper.delete_session_token(conn)
+ {:ok, %Token{token: _session_token}} <- RevokeToken.revoke(oauth_token) do
+ conn
else
_ -> conn
end
defmodule Pleroma.Web.OAuth.OAuthController do
use Pleroma.Web, :controller
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.Helpers.UriHelper
alias Pleroma.Maps
alias Pleroma.MFA
def authorize(%Plug.Conn{} = conn, params), do: do_authorize(conn, params)
+ defp maybe_remove_token(%Plug.Conn{assigns: %{token: %{app: id}}} = conn, %App{id: id}) do
+ conn
+ end
+
+ defp maybe_remove_token(conn, _app) do
+ conn
+ |> assign(:token, nil)
+ end
+
defp do_authorize(%Plug.Conn{} = conn, params) do
app = Repo.get_by(App, client_id: params["client_id"])
+ conn = maybe_remove_token(conn, app)
available_scopes = (app && app.scopes) || []
scopes = Scopes.fetch_scopes(params, available_scopes)
- user =
- with %{assigns: %{user: %User{} = user}} <- conn do
- user
- else
- _ -> nil
- end
+ # if we already have a token for this specific setup, we can use that
+ with false <- Params.truthy_param?(params["force_login"]),
+ %App{} <- app,
+ %{assigns: %{user: %Pleroma.User{} = user}} <- conn,
+ {:ok, %Token{} = token} <- Token.get_preexisting_by_app_and_user(app, user),
+ true <- scopes == token.scopes do
+ token = Repo.preload(token, :app)
- scopes =
- if scopes == [] do
- available_scopes
- else
- scopes
- end
-
- # Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template
- render(conn, Authenticator.auth_template(), %{
- user: user,
- app: app && Map.delete(app, :client_secret),
- response_type: params["response_type"],
- client_id: params["client_id"],
- available_scopes: available_scopes,
- scopes: scopes,
- redirect_uri: params["redirect_uri"],
- state: params["state"],
- params: params,
- view_module: OAuthView
- })
+ conn
+ |> assign(:token, token)
+ |> handle_existing_authorization(params)
+ else
+ _ ->
+ user =
+ with %{assigns: %{user: %User{} = user}} <- conn do
+ user
+ else
+ _ -> nil
+ end
+
+ scopes =
+ if scopes == [] do
+ available_scopes
+ else
+ scopes
+ end
+
+ # Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template
+ render(conn, Authenticator.auth_template(), %{
+ user: user,
+ app: app && Map.delete(app, :client_secret),
+ response_type: params["response_type"],
+ client_id: params["client_id"],
+ available_scopes: available_scopes,
+ scopes: scopes,
+ redirect_uri: params["redirect_uri"],
+ state: params["state"],
+ params: params,
+ view_module: OAuthView
+ })
+ end
end
defp handle_existing_authorization(
# Bad request
def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params)
- def after_token_exchange(%Plug.Conn{} = conn, %{token: token} = view_params) do
+ def after_token_exchange(%Plug.Conn{} = conn, %{token: _token} = view_params) do
conn
- |> AuthHelper.put_session_token(token.token)
|> json(OAuthView.render("token.json", view_params))
end
def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do
with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token),
- {:ok, oauth_token} <- RevokeToken.revoke(oauth_token) do
- conn =
- with session_token = AuthHelper.get_session_token(conn),
- %Token{token: ^session_token} <- oauth_token do
- AuthHelper.delete_session_token(conn)
- else
- _ -> conn
- end
-
+ {:ok, _oauth_token} <- RevokeToken.revoke(oauth_token) do
json(conn, %{})
else
_error ->
|> Repo.find_resource()
end
+ def get_preexisting_by_app_and_user(%App{} = app, %User{} = user) do
+ app.id
+ |> Query.get_unexpired_by_app_and_user(user)
+ |> Repo.find_resource()
+ end
+
@doc "Gets token for app by access token"
@spec get_by_token(App.t(), String.t()) :: {:ok, t()} | {:error, :not_found}
def get_by_token(%App{id: app_id} = _app, token) do
from(q in query, where: q.token == ^token)
end
+ @spec get_unexpired_by_app_and_user(query, String.t()) :: query
+ def get_unexpired_by_app_and_user(query \\ Token, app_id, %Pleroma.User{id: user_id}) do
+ time = NaiveDateTime.utc_now()
+
+ from(q in query,
+ where: q.app_id == ^app_id and q.valid_until > ^time and q.user_id == ^user_id,
+ limit: 1
+ )
+ end
+
@spec get_by_app(query, String.t()) :: query
def get_by_app(query \\ Token, app_id) do
- from(q in query, where: q.app_id == ^app_id)
+ from(q in query, where: q.app_id == ^app_id, limit: 1)
end
@spec get_by_id(query, String.t()) :: query
import Plug.Conn
import Ecto.Query
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.Repo
alias Pleroma.User
alias Pleroma.Web.OAuth.App
def init(options), do: options
- def call(%{assigns: %{user: %User{}}} = conn, _), do: conn
-
def call(conn, _) do
with {:ok, token_str} <- fetch_token_str(conn) do
with {:ok, user, user_token} <- fetch_user_and_token(token_str),
with {:ok, token} <- fetch_token_str(headers) do
{:ok, token}
else
- _ -> fetch_token_from_session(conn)
+ _ -> :no_token_found
end
end
end
defp fetch_token_str([]), do: :no_token_found
-
- @spec fetch_token_from_session(Plug.Conn.t()) :: :no_token_found | {:ok, String.t()}
- defp fetch_token_from_session(conn) do
- case AuthHelper.get_session_token(conn) do
- nil -> :no_token_found
- token -> {:ok, token}
- end
- end
end
+++ /dev/null
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Pleroma.Web.Plugs.SetUserSessionIdPlug do
- alias Pleroma.Helpers.AuthHelper
- alias Pleroma.Web.OAuth.Token
-
- def init(opts) do
- opts
- end
-
- def call(%{assigns: %{token: %Token{} = oauth_token}} = conn, _) do
- AuthHelper.put_session_token(conn, oauth_token.token)
- end
-
- def call(conn, _), do: conn
-end
pipeline :after_auth do
plug(Pleroma.Web.Plugs.UserEnabledPlug)
- plug(Pleroma.Web.Plugs.SetUserSessionIdPlug)
plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug)
plug(Pleroma.Web.Plugs.UserTrackingPlug)
end
get("/web/login", MastodonAPI.AuthController, :login)
delete("/auth/sign_out", MastodonAPI.AuthController, :logout)
-
- post("/auth/password", MastodonAPI.AuthController, :password_reset)
-
get("/web/*path", MastoFEController, :index)
+ post("/auth/password", MastodonAPI.AuthController, :password_reset)
get("/embed/:id", EmbedController, :show)
end
{:trailing_format_plug, "~> 0.0.7"},
{:fast_sanitize, "~> 0.2.3"},
{:html_entities, "~> 0.5", override: true},
- {:phoenix_html, "~> 3.1", override: true},
+ {:phoenix_html, "~> 3.0", override: true},
{:calendar, "~> 1.0"},
{:cachex, "~> 3.4"},
{:poison, "~> 3.0", override: true},
ref: "f75cd55325e33cbea198fb41fe41871392f8fb76"},
{:cors_plug, "~> 2.0"},
{:web_push_encryption, "~> 0.3.1"},
- {:swoosh, "~> 1.0"},
+ {:swoosh, "~> 1.3"},
{:phoenix_swoosh, "~> 0.3"},
{:gen_smtp, "~> 0.13"},
{:ex_syslogger, "~> 1.4"},
import Pleroma.Factory
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.MFA
alias Pleroma.MFA.TOTP
alias Pleroma.Repo
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
assert html_response(conn, 200) =~ ~s(type="submit")
end
- test "renders authentication page if user is already authenticated but user request with another client",
+ test "reuses authentication if the user is authenticated with another client",
%{
- app: app,
conn: conn
} do
- token = insert(:oauth_token, app: app)
+ user = insert(:user)
+
+ app = insert(:oauth_app, redirect_uris: "https://redirect.url")
+ other_app = insert(:oauth_app, redirect_uris: "https://redirect.url")
+
+ token = insert(:oauth_token, user: user, app: app)
+ reusable_token = insert(:oauth_token, app: other_app, user: user)
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
"response_type" => "code",
- "client_id" => "another_client_id",
- "redirect_uri" => OAuthController.default_redirect_uri(app),
+ "client_id" => other_app.client_id,
+ "redirect_uri" => OAuthController.default_redirect_uri(other_app),
+ "scope" => "read"
+ }
+ )
+
+ assert URI.decode(redirected_to(conn)) ==
+ "https://redirect.url?access_token=#{reusable_token.token}"
+ end
+
+ test "does not reuse other people's tokens",
+ %{
+ conn: conn
+ } do
+ user = insert(:user)
+ other_user = insert(:user)
+
+ app = insert(:oauth_app, redirect_uris: "https://redirect.url")
+ other_app = insert(:oauth_app, redirect_uris: "https://redirect.url")
+
+ token = insert(:oauth_token, user: user, app: app)
+ _not_reusable_token = insert(:oauth_token, app: other_app, user: other_user)
+
+ conn =
+ conn
+ |> put_req_header("authorization", "Bearer #{token.token}")
+ |> get(
+ "/oauth/authorize",
+ %{
+ "response_type" => "code",
+ "client_id" => other_app.client_id,
+ "redirect_uri" => OAuthController.default_redirect_uri(other_app),
+ "scope" => "read"
+ }
+ )
+
+ assert html_response(conn, 200) =~ ~s(type="submit")
+ end
+
+ test "does not reuse expired tokens",
+ %{
+ conn: conn
+ } do
+ user = insert(:user)
+
+ app = insert(:oauth_app, redirect_uris: "https://redirect.url")
+
+ other_app = insert(:oauth_app, redirect_uris: "https://redirect.url")
+
+ token = insert(:oauth_token, user: user, app: app)
+
+ _not_reusable_token =
+ insert(:oauth_token,
+ app: other_app,
+ user: user,
+ valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), -60 * 100)
+ )
+
+ conn =
+ conn
+ |> put_req_header("authorization", "Bearer #{token.token}")
+ |> get(
+ "/oauth/authorize",
+ %{
+ "response_type" => "code",
+ "client_id" => other_app.client_id,
+ "redirect_uri" => OAuthController.default_redirect_uri(other_app),
"scope" => "read"
}
)
assert html_response(conn, 200) =~ ~s(type="submit")
end
+ test "does not reuse tokens with the wrong scopes",
+ %{
+ conn: conn
+ } do
+ user = insert(:user)
+
+ app = insert(:oauth_app, redirect_uris: "https://redirect.url")
+
+ other_app = insert(:oauth_app, redirect_uris: "https://redirect.url")
+
+ token = insert(:oauth_token, user: user, app: app, scopes: ["read"])
+
+ _not_reusable_token =
+ insert(:oauth_token,
+ app: other_app,
+ user: user
+ )
+
+ conn =
+ conn
+ |> put_req_header("authorization", "Bearer #{token.token}")
+ |> get(
+ "/oauth/authorize",
+ %{
+ "response_type" => "code",
+ "client_id" => other_app.client_id,
+ "redirect_uri" => OAuthController.default_redirect_uri(other_app),
+ "scope" => "read write"
+ }
+ )
+
+ assert html_response(conn, 200) =~ ~s(type="submit")
+ end
+
test "with existing authentication and non-OOB `redirect_uri`, redirects to app with `token` and `state` params",
%{
app: app,
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
conn =
conn
- |> AuthHelper.put_session_token(token.token)
+ |> put_req_header("authorization", "Bearer #{token.token}")
|> get(
"/oauth/authorize",
%{
end
end
- test "authorize from cookie" do
- user = insert(:user)
- app = insert(:oauth_app)
- oauth_token = insert(:oauth_token, user: user, app: app)
- redirect_uri = OAuthController.default_redirect_uri(app)
-
- conn =
- build_conn()
- |> Plug.Session.call(Plug.Session.init(@session_opts))
- |> fetch_session()
- |> AuthHelper.put_session_token(oauth_token.token)
- |> post(
- "/oauth/authorize",
- %{
- "authorization" => %{
- "name" => user.nickname,
- "client_id" => app.client_id,
- "redirect_uri" => redirect_uri,
- "scope" => app.scopes,
- "state" => "statepassed"
- }
- }
- )
-
- target = redirected_to(conn)
- assert target =~ redirect_uri
-
- query = URI.parse(target).query |> URI.query_decoder() |> Map.new()
-
- assert %{"state" => "statepassed", "code" => code} = query
- auth = Repo.get_by(Authorization, token: code)
- assert auth
- assert auth.scopes == app.scopes
- end
-
test "redirect to on two-factor auth page" do
otp_secret = TOTP.generate_secret()
response =
build_conn()
+ |> put_req_header("authorization", "Bearer #{access_token.token}")
|> post("/oauth/token", %{
"grant_type" => "refresh_token",
"refresh_token" => access_token.refresh_token,
build_conn()
|> Plug.Session.call(Plug.Session.init(@session_opts))
|> fetch_session()
- |> AuthHelper.put_session_token(oauth_token.token)
+ |> put_req_header("authorization", "Bearer #{oauth_token.token}")
|> post("/oauth/revoke", %{"token" => oauth_token.token})
assert json_response(conn, 200)
- refute AuthHelper.get_session_token(conn)
assert Token.get_by_token(oauth_token.token) == {:error, :not_found}
end
build_conn()
|> Plug.Session.call(Plug.Session.init(@session_opts))
|> fetch_session()
- |> AuthHelper.put_session_token(oauth_token.token)
+ |> put_req_header("authorization", "Bearer #{oauth_token.token}")
|> post("/oauth/revoke", %{"token" => other_app_oauth_token.token})
assert json_response(conn, 200)
- assert AuthHelper.get_session_token(conn) == oauth_token.token
assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found}
end
defmodule Pleroma.Web.Plugs.OAuthPlugTest do
use Pleroma.Web.ConnCase, async: true
- alias Pleroma.Helpers.AuthHelper
alias Pleroma.Web.OAuth.Token
- alias Pleroma.Web.OAuth.Token.Strategy.Revoke
alias Pleroma.Web.Plugs.OAuthPlug
- alias Plug.Session
import Pleroma.Factory
refute conn.assigns[:user]
end
-
- describe "with :oauth_token in session, " do
- setup %{token: oauth_token, conn: conn} do
- session_opts = [
- store: :cookie,
- key: "_test",
- signing_salt: "cooldude"
- ]
-
- conn =
- conn
- |> Session.call(Session.init(session_opts))
- |> fetch_session()
- |> AuthHelper.put_session_token(oauth_token.token)
-
- %{conn: conn}
- end
-
- test "if session-stored token matches a valid OAuth token, assigns :user and :token", %{
- conn: conn,
- user: user,
- token: oauth_token
- } do
- conn = OAuthPlug.call(conn, %{})
-
- assert conn.assigns.user && conn.assigns.user.id == user.id
- assert conn.assigns.token && conn.assigns.token.id == oauth_token.id
- end
-
- test "if session-stored token matches an expired OAuth token, does nothing", %{
- conn: conn,
- token: oauth_token
- } do
- expired_valid_until = NaiveDateTime.add(NaiveDateTime.utc_now(), -3600 * 24, :second)
-
- oauth_token
- |> Ecto.Changeset.change(valid_until: expired_valid_until)
- |> Pleroma.Repo.update()
-
- ret_conn = OAuthPlug.call(conn, %{})
- assert ret_conn == conn
- end
-
- test "if session-stored token matches a revoked OAuth token, does nothing", %{
- conn: conn,
- token: oauth_token
- } do
- Revoke.revoke(oauth_token)
-
- ret_conn = OAuthPlug.call(conn, %{})
- assert ret_conn == conn
- end
- end
end
+++ /dev/null
-# Pleroma: A lightweight social networking server
-# Copyright © 2017-2021 Pleroma Authors <https://pleroma.social/>
-# SPDX-License-Identifier: AGPL-3.0-only
-
-defmodule Pleroma.Web.Plugs.SetUserSessionIdPlugTest do
- use Pleroma.Web.ConnCase, async: true
-
- alias Pleroma.Helpers.AuthHelper
- alias Pleroma.Web.Plugs.SetUserSessionIdPlug
-
- setup %{conn: conn} do
- session_opts = [
- store: :cookie,
- key: "_test",
- signing_salt: "cooldude"
- ]
-
- conn =
- conn
- |> Plug.Session.call(Plug.Session.init(session_opts))
- |> fetch_session()
-
- %{conn: conn}
- end
-
- test "doesn't do anything if the user isn't set", %{conn: conn} do
- ret_conn = SetUserSessionIdPlug.call(conn, %{})
-
- assert ret_conn == conn
- end
-
- test "sets session token basing on :token assign", %{conn: conn} do
- %{user: user, token: oauth_token} = oauth_access(["read"])
-
- ret_conn =
- conn
- |> assign(:user, user)
- |> assign(:token, oauth_token)
- |> SetUserSessionIdPlug.call(%{})
-
- assert AuthHelper.get_session_token(ret_conn) == oauth_token.token
- end
-end
projects / akkoma / commitdiff