From: floatingghost Date: Sun, 21 Aug 2022 16:24:37 +0000 (+0000) Subject: Fix oauth2 (for real) (#179) X-Git-Url: https://git.squeep.com/?a=commitdiff_plain;h=aa681d7e15f6170e7e92d86146d5ba96be6433bc;p=akkoma Fix oauth2 (for real) (#179) Reviewed-on: https://akkoma.dev/AkkomaGang/akkoma/pulls/179 --- diff --git a/lib/pleroma/helpers/auth_helper.ex b/lib/pleroma/helpers/auth_helper.ex index 13e4c8158..d56f6f461 100644 --- a/lib/pleroma/helpers/auth_helper.ex +++ b/lib/pleroma/helpers/auth_helper.ex @@ -4,12 +4,9 @@ defmodule Pleroma.Helpers.AuthHelper do alias Pleroma.Web.Plugs.OAuthScopesPlug - alias Plug.Conn import Plug.Conn - @oauth_token_session_key :oauth_token - @doc """ Skips OAuth permissions (scopes) checks, assigns nil `:token`. Intended to be used with explicit authentication and only when OAuth token cannot be determined. @@ -28,19 +25,4 @@ defmodule Pleroma.Helpers.AuthHelper do |> assign(:token, nil) |> put_private(:authentication_ignored, true) end - - @doc "Gets OAuth token string from session" - def get_session_token(%Conn{} = conn) do - get_session(conn, @oauth_token_session_key) - end - - @doc "Updates OAuth token string in session" - def put_session_token(%Conn{} = conn, token) when is_binary(token) do - put_session(conn, @oauth_token_session_key, token) - end - - @doc "Deletes OAuth token string from session" - def delete_session_token(%Conn{} = conn) do - delete_session(conn, @oauth_token_session_key) - end end diff --git a/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex b/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex index 4920d65da..f415e5931 100644 --- a/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex +++ b/lib/pleroma/web/mastodon_api/controllers/auth_controller.ex @@ -7,7 +7,6 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do import Pleroma.Web.ControllerHelper, only: [json_response: 3] - alias Pleroma.Helpers.AuthHelper alias Pleroma.Helpers.UriHelper alias Pleroma.User alias Pleroma.Web.OAuth.App @@ -34,7 +33,6 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do |> UriHelper.modify_uri_params(%{"access_token" => oauth_token.token}) conn - |> AuthHelper.put_session_token(oauth_token.token) |> redirect(to: redirect_to) else _ -> redirect_to_oauth_form(conn, params) @@ -42,9 +40,9 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do end def login(conn, params) do - with %{assigns: %{user: %User{}, token: %Token{app_id: app_id}}} <- conn, + with %{assigns: %{user: %User{}, token: %Token{app_id: app_id, token: token}}} <- conn, {:ok, %{id: ^app_id}} <- local_mastofe_app() do - redirect(conn, to: local_mastodon_post_login_path(conn)) + redirect(conn, to: local_mastodon_post_login_path(conn) <> "?access_token=#{token}") else _ -> redirect_to_oauth_form(conn, params) end @@ -68,9 +66,8 @@ defmodule Pleroma.Web.MastodonAPI.AuthController do def logout(conn, _) do conn = with %{assigns: %{token: %Token{} = oauth_token}} <- conn, - session_token = AuthHelper.get_session_token(conn), - {:ok, %Token{token: ^session_token}} <- RevokeToken.revoke(oauth_token) do - AuthHelper.delete_session_token(conn) + {:ok, %Token{token: _session_token}} <- RevokeToken.revoke(oauth_token) do + conn else _ -> conn end diff --git a/lib/pleroma/web/o_auth/o_auth_controller.ex b/lib/pleroma/web/o_auth/o_auth_controller.ex index 358120fe6..6a8006d31 100644 --- a/lib/pleroma/web/o_auth/o_auth_controller.ex +++ b/lib/pleroma/web/o_auth/o_auth_controller.ex @@ -5,7 +5,6 @@ defmodule Pleroma.Web.OAuth.OAuthController do use Pleroma.Web, :controller - alias Pleroma.Helpers.AuthHelper alias Pleroma.Helpers.UriHelper alias Pleroma.Maps alias Pleroma.MFA @@ -72,38 +71,62 @@ defmodule Pleroma.Web.OAuth.OAuthController do def authorize(%Plug.Conn{} = conn, params), do: do_authorize(conn, params) + defp maybe_remove_token(%Plug.Conn{assigns: %{token: %{app: id}}} = conn, %App{id: id}) do + conn + end + + defp maybe_remove_token(conn, _app) do + conn + |> assign(:token, nil) + end + defp do_authorize(%Plug.Conn{} = conn, params) do app = Repo.get_by(App, client_id: params["client_id"]) + conn = maybe_remove_token(conn, app) available_scopes = (app && app.scopes) || [] scopes = Scopes.fetch_scopes(params, available_scopes) - user = - with %{assigns: %{user: %User{} = user}} <- conn do - user - else - _ -> nil - end + # if we already have a token for this specific setup, we can use that + with false <- Params.truthy_param?(params["force_login"]), + %App{} <- app, + %{assigns: %{user: %Pleroma.User{} = user}} <- conn, + {:ok, %Token{} = token} <- Token.get_preexisting_by_app_and_user(app, user), + true <- scopes == token.scopes do + token = Repo.preload(token, :app) - scopes = - if scopes == [] do - available_scopes - else - scopes - end - - # Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template - render(conn, Authenticator.auth_template(), %{ - user: user, - app: app && Map.delete(app, :client_secret), - response_type: params["response_type"], - client_id: params["client_id"], - available_scopes: available_scopes, - scopes: scopes, - redirect_uri: params["redirect_uri"], - state: params["state"], - params: params, - view_module: OAuthView - }) + conn + |> assign(:token, token) + |> handle_existing_authorization(params) + else + _ -> + user = + with %{assigns: %{user: %User{} = user}} <- conn do + user + else + _ -> nil + end + + scopes = + if scopes == [] do + available_scopes + else + scopes + end + + # Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template + render(conn, Authenticator.auth_template(), %{ + user: user, + app: app && Map.delete(app, :client_secret), + response_type: params["response_type"], + client_id: params["client_id"], + available_scopes: available_scopes, + scopes: scopes, + redirect_uri: params["redirect_uri"], + state: params["state"], + params: params, + view_module: OAuthView + }) + end end defp handle_existing_authorization( @@ -318,9 +341,8 @@ defmodule Pleroma.Web.OAuth.OAuthController do # Bad request def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params) - def after_token_exchange(%Plug.Conn{} = conn, %{token: token} = view_params) do + def after_token_exchange(%Plug.Conn{} = conn, %{token: _token} = view_params) do conn - |> AuthHelper.put_session_token(token.token) |> json(OAuthView.render("token.json", view_params)) end @@ -379,15 +401,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token), - {:ok, oauth_token} <- RevokeToken.revoke(oauth_token) do - conn = - with session_token = AuthHelper.get_session_token(conn), - %Token{token: ^session_token} <- oauth_token do - AuthHelper.delete_session_token(conn) - else - _ -> conn - end - + {:ok, _oauth_token} <- RevokeToken.revoke(oauth_token) do json(conn, %{}) else _error -> diff --git a/lib/pleroma/web/o_auth/token.ex b/lib/pleroma/web/o_auth/token.ex index 9d69e9db4..6e91b6216 100644 --- a/lib/pleroma/web/o_auth/token.ex +++ b/lib/pleroma/web/o_auth/token.ex @@ -39,6 +39,12 @@ defmodule Pleroma.Web.OAuth.Token do |> Repo.find_resource() end + def get_preexisting_by_app_and_user(%App{} = app, %User{} = user) do + app.id + |> Query.get_unexpired_by_app_and_user(user) + |> Repo.find_resource() + end + @doc "Gets token for app by access token" @spec get_by_token(App.t(), String.t()) :: {:ok, t()} | {:error, :not_found} def get_by_token(%App{id: app_id} = _app, token) do diff --git a/lib/pleroma/web/o_auth/token/query.ex b/lib/pleroma/web/o_auth/token/query.ex index d16a759d8..acddf0533 100644 --- a/lib/pleroma/web/o_auth/token/query.ex +++ b/lib/pleroma/web/o_auth/token/query.ex @@ -23,9 +23,19 @@ defmodule Pleroma.Web.OAuth.Token.Query do from(q in query, where: q.token == ^token) end + @spec get_unexpired_by_app_and_user(query, String.t()) :: query + def get_unexpired_by_app_and_user(query \\ Token, app_id, %Pleroma.User{id: user_id}) do + time = NaiveDateTime.utc_now() + + from(q in query, + where: q.app_id == ^app_id and q.valid_until > ^time and q.user_id == ^user_id, + limit: 1 + ) + end + @spec get_by_app(query, String.t()) :: query def get_by_app(query \\ Token, app_id) do - from(q in query, where: q.app_id == ^app_id) + from(q in query, where: q.app_id == ^app_id, limit: 1) end @spec get_by_id(query, String.t()) :: query diff --git a/lib/pleroma/web/plugs/o_auth_plug.ex b/lib/pleroma/web/plugs/o_auth_plug.ex index 5e06ac3f6..29b3316b3 100644 --- a/lib/pleroma/web/plugs/o_auth_plug.ex +++ b/lib/pleroma/web/plugs/o_auth_plug.ex @@ -8,7 +8,6 @@ defmodule Pleroma.Web.Plugs.OAuthPlug do import Plug.Conn import Ecto.Query - alias Pleroma.Helpers.AuthHelper alias Pleroma.Repo alias Pleroma.User alias Pleroma.Web.OAuth.App @@ -18,8 +17,6 @@ defmodule Pleroma.Web.Plugs.OAuthPlug do def init(options), do: options - def call(%{assigns: %{user: %User{}}} = conn, _), do: conn - def call(conn, _) do with {:ok, token_str} <- fetch_token_str(conn) do with {:ok, user, user_token} <- fetch_user_and_token(token_str), @@ -82,7 +79,7 @@ defmodule Pleroma.Web.Plugs.OAuthPlug do with {:ok, token} <- fetch_token_str(headers) do {:ok, token} else - _ -> fetch_token_from_session(conn) + _ -> :no_token_found end end @@ -96,12 +93,4 @@ defmodule Pleroma.Web.Plugs.OAuthPlug do end defp fetch_token_str([]), do: :no_token_found - - @spec fetch_token_from_session(Plug.Conn.t()) :: :no_token_found | {:ok, String.t()} - defp fetch_token_from_session(conn) do - case AuthHelper.get_session_token(conn) do - nil -> :no_token_found - token -> {:ok, token} - end - end end diff --git a/lib/pleroma/web/plugs/set_user_session_id_plug.ex b/lib/pleroma/web/plugs/set_user_session_id_plug.ex deleted file mode 100644 index a1cfa0915..000000000 --- a/lib/pleroma/web/plugs/set_user_session_id_plug.ex +++ /dev/null @@ -1,18 +0,0 @@ -# Pleroma: A lightweight social networking server -# Copyright © 2017-2021 Pleroma Authors -# SPDX-License-Identifier: AGPL-3.0-only - -defmodule Pleroma.Web.Plugs.SetUserSessionIdPlug do - alias Pleroma.Helpers.AuthHelper - alias Pleroma.Web.OAuth.Token - - def init(opts) do - opts - end - - def call(%{assigns: %{token: %Token{} = oauth_token}} = conn, _) do - AuthHelper.put_session_token(conn, oauth_token.token) - end - - def call(conn, _), do: conn -end diff --git a/lib/pleroma/web/router.ex b/lib/pleroma/web/router.ex index 647d99278..f2d6b0aff 100644 --- a/lib/pleroma/web/router.ex +++ b/lib/pleroma/web/router.ex @@ -57,7 +57,6 @@ defmodule Pleroma.Web.Router do pipeline :after_auth do plug(Pleroma.Web.Plugs.UserEnabledPlug) - plug(Pleroma.Web.Plugs.SetUserSessionIdPlug) plug(Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug) plug(Pleroma.Web.Plugs.UserTrackingPlug) end @@ -793,10 +792,8 @@ defmodule Pleroma.Web.Router do get("/web/login", MastodonAPI.AuthController, :login) delete("/auth/sign_out", MastodonAPI.AuthController, :logout) - - post("/auth/password", MastodonAPI.AuthController, :password_reset) - get("/web/*path", MastoFEController, :index) + post("/auth/password", MastodonAPI.AuthController, :password_reset) get("/embed/:id", EmbedController, :show) end diff --git a/mix.exs b/mix.exs index e7f491997..170276b0a 100644 --- a/mix.exs +++ b/mix.exs @@ -131,7 +131,7 @@ defmodule Pleroma.Mixfile do {:trailing_format_plug, "~> 0.0.7"}, {:fast_sanitize, "~> 0.2.3"}, {:html_entities, "~> 0.5", override: true}, - {:phoenix_html, "~> 3.1", override: true}, + {:phoenix_html, "~> 3.0", override: true}, {:calendar, "~> 1.0"}, {:cachex, "~> 3.4"}, {:poison, "~> 3.0", override: true}, @@ -152,7 +152,7 @@ defmodule Pleroma.Mixfile do ref: "f75cd55325e33cbea198fb41fe41871392f8fb76"}, {:cors_plug, "~> 2.0"}, {:web_push_encryption, "~> 0.3.1"}, - {:swoosh, "~> 1.0"}, + {:swoosh, "~> 1.3"}, {:phoenix_swoosh, "~> 0.3"}, {:gen_smtp, "~> 0.13"}, {:ex_syslogger, "~> 1.4"}, diff --git a/test/pleroma/web/o_auth/o_auth_controller_test.exs b/test/pleroma/web/o_auth/o_auth_controller_test.exs index 0fdd5b8e9..9f984b26f 100644 --- a/test/pleroma/web/o_auth/o_auth_controller_test.exs +++ b/test/pleroma/web/o_auth/o_auth_controller_test.exs @@ -7,7 +7,6 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do import Pleroma.Factory - alias Pleroma.Helpers.AuthHelper alias Pleroma.MFA alias Pleroma.MFA.TOTP alias Pleroma.Repo @@ -456,7 +455,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do conn = conn - |> AuthHelper.put_session_token(token.token) + |> put_req_header("authorization", "Bearer #{token.token}") |> get( "/oauth/authorize", %{ @@ -471,22 +470,92 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do assert html_response(conn, 200) =~ ~s(type="submit") end - test "renders authentication page if user is already authenticated but user request with another client", + test "reuses authentication if the user is authenticated with another client", %{ - app: app, conn: conn } do - token = insert(:oauth_token, app: app) + user = insert(:user) + + app = insert(:oauth_app, redirect_uris: "https://redirect.url") + other_app = insert(:oauth_app, redirect_uris: "https://redirect.url") + + token = insert(:oauth_token, user: user, app: app) + reusable_token = insert(:oauth_token, app: other_app, user: user) conn = conn - |> AuthHelper.put_session_token(token.token) + |> put_req_header("authorization", "Bearer #{token.token}") |> get( "/oauth/authorize", %{ "response_type" => "code", - "client_id" => "another_client_id", - "redirect_uri" => OAuthController.default_redirect_uri(app), + "client_id" => other_app.client_id, + "redirect_uri" => OAuthController.default_redirect_uri(other_app), + "scope" => "read" + } + ) + + assert URI.decode(redirected_to(conn)) == + "https://redirect.url?access_token=#{reusable_token.token}" + end + + test "does not reuse other people's tokens", + %{ + conn: conn + } do + user = insert(:user) + other_user = insert(:user) + + app = insert(:oauth_app, redirect_uris: "https://redirect.url") + other_app = insert(:oauth_app, redirect_uris: "https://redirect.url") + + token = insert(:oauth_token, user: user, app: app) + _not_reusable_token = insert(:oauth_token, app: other_app, user: other_user) + + conn = + conn + |> put_req_header("authorization", "Bearer #{token.token}") + |> get( + "/oauth/authorize", + %{ + "response_type" => "code", + "client_id" => other_app.client_id, + "redirect_uri" => OAuthController.default_redirect_uri(other_app), + "scope" => "read" + } + ) + + assert html_response(conn, 200) =~ ~s(type="submit") + end + + test "does not reuse expired tokens", + %{ + conn: conn + } do + user = insert(:user) + + app = insert(:oauth_app, redirect_uris: "https://redirect.url") + + other_app = insert(:oauth_app, redirect_uris: "https://redirect.url") + + token = insert(:oauth_token, user: user, app: app) + + _not_reusable_token = + insert(:oauth_token, + app: other_app, + user: user, + valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), -60 * 100) + ) + + conn = + conn + |> put_req_header("authorization", "Bearer #{token.token}") + |> get( + "/oauth/authorize", + %{ + "response_type" => "code", + "client_id" => other_app.client_id, + "redirect_uri" => OAuthController.default_redirect_uri(other_app), "scope" => "read" } ) @@ -494,6 +563,40 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do assert html_response(conn, 200) =~ ~s(type="submit") end + test "does not reuse tokens with the wrong scopes", + %{ + conn: conn + } do + user = insert(:user) + + app = insert(:oauth_app, redirect_uris: "https://redirect.url") + + other_app = insert(:oauth_app, redirect_uris: "https://redirect.url") + + token = insert(:oauth_token, user: user, app: app, scopes: ["read"]) + + _not_reusable_token = + insert(:oauth_token, + app: other_app, + user: user + ) + + conn = + conn + |> put_req_header("authorization", "Bearer #{token.token}") + |> get( + "/oauth/authorize", + %{ + "response_type" => "code", + "client_id" => other_app.client_id, + "redirect_uri" => OAuthController.default_redirect_uri(other_app), + "scope" => "read write" + } + ) + + assert html_response(conn, 200) =~ ~s(type="submit") + end + test "with existing authentication and non-OOB `redirect_uri`, redirects to app with `token` and `state` params", %{ app: app, @@ -503,7 +606,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do conn = conn - |> AuthHelper.put_session_token(token.token) + |> put_req_header("authorization", "Bearer #{token.token}") |> get( "/oauth/authorize", %{ @@ -529,7 +632,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do conn = conn - |> AuthHelper.put_session_token(token.token) + |> put_req_header("authorization", "Bearer #{token.token}") |> get( "/oauth/authorize", %{ @@ -553,7 +656,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do conn = conn - |> AuthHelper.put_session_token(token.token) + |> put_req_header("authorization", "Bearer #{token.token}") |> get( "/oauth/authorize", %{ @@ -611,41 +714,6 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do end end - test "authorize from cookie" do - user = insert(:user) - app = insert(:oauth_app) - oauth_token = insert(:oauth_token, user: user, app: app) - redirect_uri = OAuthController.default_redirect_uri(app) - - conn = - build_conn() - |> Plug.Session.call(Plug.Session.init(@session_opts)) - |> fetch_session() - |> AuthHelper.put_session_token(oauth_token.token) - |> post( - "/oauth/authorize", - %{ - "authorization" => %{ - "name" => user.nickname, - "client_id" => app.client_id, - "redirect_uri" => redirect_uri, - "scope" => app.scopes, - "state" => "statepassed" - } - } - ) - - target = redirected_to(conn) - assert target =~ redirect_uri - - query = URI.parse(target).query |> URI.query_decoder() |> Map.new() - - assert %{"state" => "statepassed", "code" => code} = query - auth = Repo.get_by(Authorization, token: code) - assert auth - assert auth.scopes == app.scopes - end - test "redirect to on two-factor auth page" do otp_secret = TOTP.generate_secret() @@ -1218,6 +1286,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do response = build_conn() + |> put_req_header("authorization", "Bearer #{access_token.token}") |> post("/oauth/token", %{ "grant_type" => "refresh_token", "refresh_token" => access_token.refresh_token, @@ -1267,12 +1336,11 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do build_conn() |> Plug.Session.call(Plug.Session.init(@session_opts)) |> fetch_session() - |> AuthHelper.put_session_token(oauth_token.token) + |> put_req_header("authorization", "Bearer #{oauth_token.token}") |> post("/oauth/revoke", %{"token" => oauth_token.token}) assert json_response(conn, 200) - refute AuthHelper.get_session_token(conn) assert Token.get_by_token(oauth_token.token) == {:error, :not_found} end @@ -1286,12 +1354,11 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do build_conn() |> Plug.Session.call(Plug.Session.init(@session_opts)) |> fetch_session() - |> AuthHelper.put_session_token(oauth_token.token) + |> put_req_header("authorization", "Bearer #{oauth_token.token}") |> post("/oauth/revoke", %{"token" => other_app_oauth_token.token}) assert json_response(conn, 200) - assert AuthHelper.get_session_token(conn) == oauth_token.token assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found} end diff --git a/test/pleroma/web/plugs/o_auth_plug_test.exs b/test/pleroma/web/plugs/o_auth_plug_test.exs index 9e4be5559..caabfc1cb 100644 --- a/test/pleroma/web/plugs/o_auth_plug_test.exs +++ b/test/pleroma/web/plugs/o_auth_plug_test.exs @@ -5,11 +5,8 @@ defmodule Pleroma.Web.Plugs.OAuthPlugTest do use Pleroma.Web.ConnCase, async: true - alias Pleroma.Helpers.AuthHelper alias Pleroma.Web.OAuth.Token - alias Pleroma.Web.OAuth.Token.Strategy.Revoke alias Pleroma.Web.Plugs.OAuthPlug - alias Plug.Session import Pleroma.Factory @@ -72,57 +69,4 @@ defmodule Pleroma.Web.Plugs.OAuthPlugTest do refute conn.assigns[:user] end - - describe "with :oauth_token in session, " do - setup %{token: oauth_token, conn: conn} do - session_opts = [ - store: :cookie, - key: "_test", - signing_salt: "cooldude" - ] - - conn = - conn - |> Session.call(Session.init(session_opts)) - |> fetch_session() - |> AuthHelper.put_session_token(oauth_token.token) - - %{conn: conn} - end - - test "if session-stored token matches a valid OAuth token, assigns :user and :token", %{ - conn: conn, - user: user, - token: oauth_token - } do - conn = OAuthPlug.call(conn, %{}) - - assert conn.assigns.user && conn.assigns.user.id == user.id - assert conn.assigns.token && conn.assigns.token.id == oauth_token.id - end - - test "if session-stored token matches an expired OAuth token, does nothing", %{ - conn: conn, - token: oauth_token - } do - expired_valid_until = NaiveDateTime.add(NaiveDateTime.utc_now(), -3600 * 24, :second) - - oauth_token - |> Ecto.Changeset.change(valid_until: expired_valid_until) - |> Pleroma.Repo.update() - - ret_conn = OAuthPlug.call(conn, %{}) - assert ret_conn == conn - end - - test "if session-stored token matches a revoked OAuth token, does nothing", %{ - conn: conn, - token: oauth_token - } do - Revoke.revoke(oauth_token) - - ret_conn = OAuthPlug.call(conn, %{}) - assert ret_conn == conn - end - end end diff --git a/test/pleroma/web/plugs/set_user_session_id_plug_test.exs b/test/pleroma/web/plugs/set_user_session_id_plug_test.exs deleted file mode 100644 index 9814c80d8..000000000 --- a/test/pleroma/web/plugs/set_user_session_id_plug_test.exs +++ /dev/null @@ -1,43 +0,0 @@ -# Pleroma: A lightweight social networking server -# Copyright © 2017-2021 Pleroma Authors -# SPDX-License-Identifier: AGPL-3.0-only - -defmodule Pleroma.Web.Plugs.SetUserSessionIdPlugTest do - use Pleroma.Web.ConnCase, async: true - - alias Pleroma.Helpers.AuthHelper - alias Pleroma.Web.Plugs.SetUserSessionIdPlug - - setup %{conn: conn} do - session_opts = [ - store: :cookie, - key: "_test", - signing_salt: "cooldude" - ] - - conn = - conn - |> Plug.Session.call(Plug.Session.init(session_opts)) - |> fetch_session() - - %{conn: conn} - end - - test "doesn't do anything if the user isn't set", %{conn: conn} do - ret_conn = SetUserSessionIdPlug.call(conn, %{}) - - assert ret_conn == conn - end - - test "sets session token basing on :token assign", %{conn: conn} do - %{user: user, token: oauth_token} = oauth_access(["read"]) - - ret_conn = - conn - |> assign(:user, user) - |> assign(:token, oauth_token) - |> SetUserSessionIdPlug.call(%{}) - - assert AuthHelper.get_session_token(ret_conn) == oauth_token.token - end -end