No OneTemporary
Actions

Authored By

Unknown

Size

100 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/oauth-app-spam.fix b/changelog.d/oauth-app-spam.fix
	new file mode 100644
	index 000000000..cdc2e816d
	--- /dev/null
	+++ b/changelog.d/oauth-app-spam.fix
	@@ -0,0 +1 @@
	+Add a rate limiter to the OAuth App creation endpoint and ensure registered apps are assigned to users.
	diff --git a/config/config.exs b/config/config.exs
	index ad6b1cb94..80a3b8d57 100644
	--- a/config/config.exs
	+++ b/config/config.exs
	@@ -1,945 +1,947 @@
	# .i;;;;i.
	# iYcviii;vXY:
	# .YXi .i1c.
	# .YC. . in7.
	# .vc. ...... ;1c.
	# i7, .. .;1;
	# i7, .. ... .Y1i
	# ,7v .6MMM@; .YX,
	# .7;. ..IMMMMMM1 :t7.
	# .;Y. ;$MMMMMM9. :tc.
	# vY. .. .nMMM@MMU. ;1v.
	# i7i ... .#MM@M@C. .....:71i
	# it: .... $MMM@9;.,i;;;i,;tti
	# :t7. ..... 0MMMWv.,iii:::,,;St.
	# .nC. ..... IMMMQ..,::::::,.,czX.
	# .ct: ....... .ZMMMI..,:::::::,,:76Y.
	# c2: ......,i..Y$M@t..:::::::,,..inZY
	# vov ......:ii..c$MBc..,,,,,,,,,,..iI9i
	# i9Y ......iii:..7@MA,..,,,,,,,,,....;AA:
	# iIS. ......:ii::..;@MI....,............;Ez.
	# .I9. ......:i::::...8M1..................C0z.
	# .z9; ......:i::::,.. .i:...................zWX.
	# vbv ......,i::::,,. ................. :AQY
	# c6Y. .,...,::::,,..:t0@@QY. ................ :8bi
	# :6S. ..,,...,:::,,,..EMMMMMMI. ............... .;bZ,
	# :6o, .,,,,..:::,,,..i#MMMMMM#v................. YW2.
	# .n8i ..,,,,,,,::,,,,.. tMMMMM@C:.................. .1Wn
	# 7Uc. .:::,,,,,::,,,,.. i1t;,..................... .UEi
	# 7C...::::::::::::,,,,.. .................... vSi.
	# ;1;...,,::::::,......... .................. Yz:
	# v97,......... .voC.
	# izAotX7777777777777777777777777777777777777777Y7n92:
	# .;CoIIIIIUAA666666699999ZZZZZZZZZZZZZZZZZZZZ6ov.
	#
	# !!! ATTENTION !!!
	# DO NOT EDIT THIS FILE! THIS FILE CONTAINS THE DEFAULT VALUES FOR THE CON-
	# FIGURATION! EDIT YOUR SECRET FILE (either prod.secret.exs, dev.secret.exs).
	#
	# This file is responsible for configuring your application
	# and its dependencies with the aid of the Config module.
	#
	# This configuration file is loaded before any dependency and
	# is restricted to this project.
	import Config

	# General application configuration
	config :pleroma, ecto_repos: [Pleroma.Repo]

	config :pleroma, Pleroma.Repo,
	telemetry_event: [Pleroma.Repo.Instrumenter],
	migration_lock: nil

	config :pleroma, Pleroma.Captcha,
	enabled: true,
	seconds_valid: 300,
	method: Pleroma.Captcha.Native

	config :pleroma, Pleroma.Captcha.Kocaptcha, endpoint: "https://captcha.kotobank.ch"

	# Upload configuration
	config :pleroma, Pleroma.Upload,
	uploader: Pleroma.Uploaders.Local,
	filters: [Pleroma.Upload.Filter.Dedupe],
	link_name: false,
	proxy_remote: false,
	filename_display_max_length: 30,
	default_description: nil,
	base_url: nil

	config :pleroma, Pleroma.Uploaders.Local, uploads: "uploads"

	config :pleroma, Pleroma.Uploaders.S3,
	bucket: nil,
	bucket_namespace: nil,
	truncated_namespace: nil,
	streaming_enabled: true

	config :ex_aws, :s3,
	# host: "s3.wasabisys.com", # required if not Amazon AWS
	access_key_id: nil,
	secret_access_key: nil,
	# region: "us-east-1", # may be required for Amazon AWS
	scheme: "https://"

	config :pleroma, Pleroma.Uploaders.IPFS,
	post_gateway_url: "http://localhost:5001",
	get_gateway_url: "http://localhost:8080"

	config :pleroma, :emoji,
	shortcode_globs: ["/emoji/custom/*/.png"],
	pack_extensions: [".png", ".gif"],
	groups: [
	Custom: ["/emoji/.png", "/emoji//.png"]
	],
	default_manifest: "https://git.pleroma.social/pleroma/emoji-index/raw/master/index.json",
	shared_pack_cache_seconds_per_file: 60

	config :pleroma, :uri_schemes,
	valid_schemes: [
	"https",
	"http",
	"dat",
	"dweb",
	"gopher",
	"hyper",
	"ipfs",
	"ipns",
	"irc",
	"ircs",
	"magnet",
	"mailto",
	"mumble",
	"ssb",
	"xmpp"
	]

	# Configures the endpoint
	config :pleroma, Pleroma.Web.Endpoint,
	url: [host: "localhost"],
	http: [
	ip: {127, 0, 0, 1}
	],
	protocol: "https",
	secret_key_base: "aK4Abxf29xU9TTDKre9coZPUgevcVCFQJe/5xP/7Lt4BEif6idBIbjupVbOrbKxl",
	live_view: [signing_salt: "U5ELgdEwTD3n1+D5s0rY0AMg8/y1STxZ3Zvsl3bWh+oBcGrYdil0rXqPMRd3Glcq"],
	signing_salt: "CqaoopA2",
	render_errors: [view: Pleroma.Web.ErrorView, accepts: ~w(json)],
	pubsub_server: Pleroma.PubSub,
	secure_cookie_flag: true,
	extra_cookie_attrs: [
	"SameSite=Lax"
	]

	# Configures Elixir's Logger
	config :logger, backends: [:console]

	config :logger, :console,
	level: :debug,
	format: "\n$time $metadata[$level] $message\n",
	metadata: [:actor, :path, :type, :user]

	config :logger, :ex_syslogger,
	level: :debug,
	ident: "pleroma",
	format: "$metadata[$level] $message",
	metadata: [:actor, :path, :type, :user]

	config :mime, :types, %{
	"application/xml" => ["xml"],
	"application/xrd+xml" => ["xrd+xml"],
	"application/jrd+json" => ["jrd+json"],
	"application/activity+json" => ["activity+json"],
	"application/ld+json" => ["activity+json"]
	}

	config :tesla, adapter: Tesla.Adapter.Hackney

	# Configures http settings, upstream proxy etc.
	config :pleroma, :http,
	proxy_url: nil,
	send_user_agent: true,
	user_agent: :default,
	adapter: []

	config :pleroma, :instance,
	name: "Pleroma",
	email: "example@example.com",
	notify_email: "noreply@example.com",
	description: "Pleroma: An efficient and flexible fediverse server",
	short_description: "",
	background_image: "/images/city.jpg",
	instance_thumbnail: "/instance/thumbnail.jpeg",
	favicon: "/favicon.png",
	limit: 5_000,
	description_limit: 5_000,
	remote_limit: 100_000,
	upload_limit: 16_000_000,
	avatar_upload_limit: 2_000_000,
	background_upload_limit: 4_000_000,
	banner_upload_limit: 4_000_000,
	poll_limits: %{
	max_options: 20,
	max_option_chars: 200,
	min_expiration: 0,
	max_expiration: 365 * 24 * 60 * 60
	},
	registrations_open: true,
	invites_enabled: false,
	account_activation_required: false,
	account_approval_required: false,
	federating: true,
	federation_incoming_replies_max_depth: 100,
	federation_reachability_timeout_days: 7,
	allow_relay: true,
	public: true,
	quarantined_instances: [],
	rejected_instances: [],
	static_dir: "instance/static/",
	allowed_post_formats: [
	"text/plain",
	"text/html",
	"text/markdown",
	"text/bbcode"
	],
	autofollowed_nicknames: [],
	autofollowing_nicknames: [],
	max_pinned_statuses: 1,
	attachment_links: false,
	max_report_comment_size: 1000,
	report_strip_status: true,
	safe_dm_mentions: false,
	healthcheck: false,
	remote_post_retention_days: 90,
	skip_thread_containment: true,
	limit_to_local_content: :unauthenticated,
	user_bio_length: 5000,
	user_name_length: 100,
	max_account_fields: 10,
	max_remote_account_fields: 20,
	account_field_name_length: 512,
	account_field_value_length: 2048,
	registration_reason_length: 500,
	external_user_synchronization: true,
	extended_nickname_format: true,
	cleanup_attachments: false,
	multi_factor_authentication: [
	totp: [
	# digits 6 or 8
	digits: 6,
	period: 30
	],
	backup_codes: [
	number: 5,
	length: 16
	]
	],
	show_reactions: true,
	password_reset_token_validity: 60 * 60 * 24,
	profile_directory: true,
	admin_privileges: [
	:users_read,
	:users_manage_invites,
	:users_manage_activation_state,
	:users_manage_tags,
	:users_manage_credentials,
	:users_delete,
	:messages_read,
	:messages_delete,
	:instances_delete,
	:reports_manage_reports,
	:moderation_log_read,
	:announcements_manage_announcements,
	:emoji_manage_emoji,
	:statistics_read
	],
	moderator_privileges: [:messages_delete, :reports_manage_reports],
	max_endorsed_users: 20,
	birthday_required: false,
	birthday_min_age: 0,
	max_media_attachments: 1_000

	config :pleroma, :welcome,
	direct_message: [
	enabled: false,
	sender_nickname: nil,
	message: nil
	],
	chat_message: [
	enabled: false,
	sender_nickname: nil,
	message: nil
	],
	email: [
	enabled: false,
	sender: nil,
	subject: "Welcome to <%= instance_name %>",
	html: "Welcome to <%= instance_name %>",
	text: "Welcome to <%= instance_name %>"
	]

	config :pleroma, :feed,
	post_title: %{
	max_length: 100,
	omission: "..."
	}

	config :pleroma, :markup,
	# XXX - unfortunately, inline images must be enabled by default right now, because
	# of custom emoji. Issue #275 discusses defanging that somehow.
	allow_inline_images: true,
	allow_headings: false,
	allow_tables: false,
	allow_fonts: false,
	scrub_policy: [
	Pleroma.HTML.Scrubber.Default,
	Pleroma.HTML.Transform.MediaProxy
	]

	config :pleroma, :frontend_configurations,
	pleroma_fe: %{
	alwaysShowSubjectInput: true,
	background: "/images/city.jpg",
	collapseMessageWithSubject: false,
	disableChat: false,
	greentext: false,
	hideFilteredStatuses: false,
	hideMutedPosts: false,
	hidePostStats: false,
	hideSitename: false,
	hideUserStats: false,
	loginMethod: "password",
	logo: "/static/logo.svg",
	logoMargin: ".1em",
	logoMask: true,
	minimalScopesMode: false,
	noAttachmentLinks: false,
	nsfwCensorImage: "",
	postContentType: "text/plain",
	redirectRootLogin: "/main/friends",
	redirectRootNoLogin: "/main/all",
	scopeCopy: true,
	sidebarRight: false,
	showFeaturesPanel: true,
	showInstanceSpecificPanel: false,
	subjectLineBehavior: "email",
	theme: "pleroma-dark",
	webPushNotifications: false
	}

	config :pleroma, :assets,
	mascots: [
	pleroma_fox_tan: %{
	url: "/images/pleroma-fox-tan-smol.png",
	mime_type: "image/png"
	},
	pleroma_fox_tan_shy: %{
	url: "/images/pleroma-fox-tan-shy.png",
	mime_type: "image/png"
	}
	],
	default_mascot: :pleroma_fox_tan

	config :pleroma, :manifest,
	icons: [
	%{
	src: "/static/logo.svg",
	sizes: "144x144",
	purpose: "any",
	type: "image/svg+xml"
	}
	],
	theme_color: "#282c37",
	background_color: "#191b22"

	config :pleroma, :activitypub,
	unfollow_blocked: true,
	outgoing_blocks: true,
	blockers_visible: true,
	follow_handshake_timeout: 500,
	note_replies_output_limit: 5,
	sign_object_fetches: true,
	authorized_fetch_mode: false

	config :pleroma, :streamer,
	workers: 3,
	overflow_workers: 2

	config :pleroma, :user, deny_follow_blocked: true

	config :pleroma, :mrf_normalize_markup, scrub_policy: Pleroma.HTML.Scrubber.Default

	config :pleroma, :mrf_rejectnonpublic,
	allow_followersonly: false,
	allow_direct: false

	config :pleroma, :mrf_hellthread,
	delist_threshold: 10,
	reject_threshold: 20

	config :pleroma, :mrf_simple,
	media_removal: [],
	media_nsfw: [],
	federated_timeline_removal: [],
	report_removal: [],
	reject: [],
	followers_only: [],
	accept: [],
	avatar_removal: [],
	banner_removal: [],
	reject_deletes: []

	config :pleroma, :mrf_keyword,
	reject: [],
	federated_timeline_removal: [],
	replace: []

	config :pleroma, :mrf_emoji,
	remove_url: [],
	remove_shortcode: [],
	federated_timeline_removal_url: [],
	federated_timeline_removal_shortcode: []

	config :pleroma, :mrf_hashtag,
	sensitive: ["nsfw"],
	reject: [],
	federated_timeline_removal: []

	config :pleroma, :mrf_subchain, match_actor: %{}

	config :pleroma, :mrf_activity_expiration, days: 365

	config :pleroma, :mrf_vocabulary,
	accept: [],
	reject: []

	config :pleroma, :mrf_dnsrbl,
	nameserver: "127.0.0.1",
	port: 53,
	zone: "bl.pleroma.com"

	# threshold of 7 days
	config :pleroma, :mrf_object_age,
	threshold: 604_800,
	actions: [:delist, :strip_followers]

	config :pleroma, :mrf_nsfw_api,
	url: "http://127.0.0.1:5000/",
	threshold: 0.7,
	mark_sensitive: true,
	unlist: false,
	reject: false

	config :pleroma, :mrf_follow_bot, follower_nickname: nil

	config :pleroma, :mrf_inline_quote, template: "<bdi>RT:</bdi> {url}"

	config :pleroma, :mrf_force_mention,
	mention_parent: true,
	mention_quoted: true

	config :pleroma, :mrf_antimentionspam, user_age_limit: 30_000

	config :pleroma, :rich_media,
	enabled: true,
	ignore_hosts: [],
	ignore_tld: ["local", "localdomain", "lan"],
	parsers: [
	Pleroma.Web.RichMedia.Parsers.TwitterCard,
	Pleroma.Web.RichMedia.Parsers.OEmbed
	],
	timeout: 5_000,
	ttl_setters: [
	Pleroma.Web.RichMedia.Parser.TTL.AwsSignedUrl,
	Pleroma.Web.RichMedia.Parser.TTL.Opengraph
	],
	max_body: 5_000_000

	config :pleroma, :media_proxy,
	enabled: false,
	invalidation: [
	enabled: false,
	provider: Pleroma.Web.MediaProxy.Invalidation.Script
	],
	proxy_opts: [
	redirect_on_failure: false,
	max_body_length: 25 * 1_048_576,
	# Note: max_read_duration defaults to Pleroma.ReverseProxy.max_read_duration_default/1
	max_read_duration: 30_000,
	http: [
	follow_redirect: true,
	pool: :media
	]
	],
	whitelist: []

	config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Http,
	method: :purge,
	headers: [],
	options: []

	config :pleroma, Pleroma.Web.MediaProxy.Invalidation.Script,
	script_path: nil,
	url_format: nil

	# Note: media preview proxy depends on media proxy to be enabled
	config :pleroma, :media_preview_proxy,
	enabled: false,
	thumbnail_max_width: 600,
	thumbnail_max_height: 600,
	image_quality: 85,
	min_content_length: 100 * 1024

	config :pleroma, :shout,
	enabled: true,
	limit: 5_000

	config :phoenix, :format_encoders, json: Jason, "activity+json": Jason

	config :phoenix, :json_library, Jason

	config :phoenix, :filter_parameters, ["password", "confirm"]

	config :pleroma, :gopher,
	enabled: false,
	ip: {0, 0, 0, 0},
	port: 9999

	config :pleroma, Pleroma.Web.Metadata,
	providers: [
	Pleroma.Web.Metadata.Providers.OpenGraph,
	Pleroma.Web.Metadata.Providers.TwitterCard
	],
	unfurl_nsfw: false

	config :pleroma, Pleroma.Web.Preload,
	providers: [
	Pleroma.Web.Preload.Providers.Instance
	]

	config :pleroma, :http_security,
	enabled: true,
	sts: false,
	sts_max_age: 31_536_000,
	ct_max_age: 2_592_000,
	referrer_policy: "same-origin",
	allow_unsafe_eval: false

	config :cors_plug,
	max_age: 86_400,
	methods: ["POST", "PUT", "DELETE", "GET", "PATCH", "OPTIONS"],
	expose: [
	"Link",
	"X-RateLimit-Reset",
	"X-RateLimit-Limit",
	"X-RateLimit-Remaining",
	"X-Request-Id",
	"Idempotency-Key"
	],
	credentials: true,
	headers: ["Authorization", "Content-Type", "Idempotency-Key"]

	config :pleroma, Pleroma.User,
	restricted_nicknames: [
	".well-known",
	"~",
	"about",
	"activities",
	"api",
	"auth",
	"check_password",
	"dev",
	"friend-requests",
	"inbox",
	"internal",
	"main",
	"media",
	"nodeinfo",
	"notice",
	"oauth",
	"objects",
	"ostatus_subscribe",
	"pleroma",
	"proxy",
	"push",
	"registration",
	"relay",
	"settings",
	"status",
	"tag",
	"user-search",
	"user_exists",
	"users",
	"web",
	"verify_credentials",
	"update_credentials",
	"relationships",
	"search",
	"confirmation_resend",
	"mfa"
	],
	email_blacklist: []

	# The Pruner :max_age must be longer than Worker :unique
	# value or it cannot enforce uniqueness.
	config :pleroma, Oban,
	repo: Pleroma.Repo,
	log: false,
	queues: [
	activity_expiration: 10,
	federator_incoming: 5,
	federator_outgoing: 25,
	web_push: 50,
	background: 20,
	search_indexing: [limit: 10, paused: true],
	slow: 5
	],
	plugins: [{Oban.Plugins.Pruner, max_age: 900}],
	crontab: [
	{"0 0 * * 0", Pleroma.Workers.Cron.DigestEmailsWorker},
	- {"0 0 * * *", Pleroma.Workers.Cron.NewUsersDigestWorker}
	+ {"0 0 * * *", Pleroma.Workers.Cron.NewUsersDigestWorker},
	+ {"/10 * * *", Pleroma.Workers.Cron.AppCleanupWorker}
	]

	config :pleroma, Pleroma.Formatter,
	class: false,
	rel: "ugc",
	new_window: false,
	truncate: false,
	strip_prefix: false,
	extra: true,
	validate_tld: :no_scheme

	config :pleroma, :ldap,
	enabled: System.get_env("LDAP_ENABLED") == "true",
	host: System.get_env("LDAP_HOST") \|\| "localhost",
	port: String.to_integer(System.get_env("LDAP_PORT") \|\| "389"),
	ssl: System.get_env("LDAP_SSL") == "true",
	sslopts: [],
	tls: System.get_env("LDAP_TLS") == "true",
	tlsopts: [],
	base: System.get_env("LDAP_BASE") \|\| "dc=example,dc=com",
	uid: System.get_env("LDAP_UID") \|\| "cn"

	oauth_consumer_strategies =
	System.get_env("OAUTH_CONSUMER_STRATEGIES")
	\|> to_string()
	\|> String.split()
	\|> Enum.map(&hd(String.split(&1, ":")))

	ueberauth_providers =
	for strategy <- oauth_consumer_strategies do
	strategy_module_name = "Elixir.Ueberauth.Strategy.#{String.capitalize(strategy)}"
	strategy_module = String.to_atom(strategy_module_name)
	{String.to_atom(strategy), {strategy_module, [callback_params: ["state"]]}}
	end

	config :ueberauth,
	Ueberauth,
	base_path: "/oauth",
	providers: ueberauth_providers

	config :pleroma, :auth, oauth_consumer_strategies: oauth_consumer_strategies

	config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Sendmail, enabled: false

	config :pleroma, Pleroma.Emails.UserEmail,
	logo: nil,
	styling: %{
	link_color: "#d8a070",
	background_color: "#2C3645",
	content_background_color: "#1B2635",
	header_color: "#d8a070",
	text_color: "#b9b9ba",
	text_muted_color: "#b9b9ba"
	}

	config :pleroma, Pleroma.Emails.NewUsersDigestEmail, enabled: false

	config :pleroma, Pleroma.PromEx,
	disabled: false,
	manual_metrics_start_delay: :no_delay,
	drop_metrics_groups: [],
	grafana: [
	host: System.get_env("GRAFANA_HOST", "http://localhost:3000"),
	auth_token: System.get_env("GRAFANA_TOKEN"),
	upload_dashboards_on_start: false,
	folder_name: "BEAM",
	annotate_app_lifecycle: true
	],
	metrics_server: [
	port: 4021,
	path: "/metrics",
	protocol: :http,
	pool_size: 5,
	cowboy_opts: [],
	auth_strategy: :none
	],
	datasource: "Prometheus"

	config :pleroma, Pleroma.ScheduledActivity,
	daily_user_limit: 25,
	total_user_limit: 300,
	enabled: true

	config :pleroma, :email_notifications,
	digest: %{
	active: false,
	interval: 7,
	inactivity_threshold: 7
	}

	config :pleroma, :oauth2,
	token_expires_in: 3600 * 24 * 365 * 100,
	issue_new_refresh_token: true,
	clean_expired_tokens: false

	config :pleroma, :database, rum_enabled: false

	config :pleroma, :features, improved_hashtag_timeline: :auto

	config :pleroma, :populate_hashtags_table, fault_rate_allowance: 0.01

	config :pleroma, :delete_context_objects, fault_rate_allowance: 0.01

	config :pleroma, :env, Mix.env()

	config :http_signatures,
	adapter: Pleroma.Signature

	config :pleroma, :rate_limit,
	authentication: {60_000, 15},
	timeline: {500, 3},
	search: [{1000, 10}, {1000, 30}],
	app_account_creation: {1_800_000, 25},
	+ oauth_app_creation: {900_000, 5},
	relations_actions: {10_000, 10},
	relation_id_action: {60_000, 2},
	statuses_actions: {10_000, 15},
	status_id_action: {60_000, 3},
	password_reset: {1_800_000, 5},
	account_confirmation_resend: {8_640_000, 5},
	ap_routes: {60_000, 15}

	config :pleroma, Pleroma.Workers.PurgeExpiredActivity, enabled: true, min_lifetime: 600

	config :pleroma, Pleroma.Web.Plugs.RemoteIp,
	enabled: true,
	headers: ["x-forwarded-for"],
	proxies: [],
	reserved: [
	"127.0.0.0/8",
	"::1/128",
	"fc00::/7",
	"10.0.0.0/8",
	"172.16.0.0/12",
	"192.168.0.0/16"
	]

	config :pleroma, :static_fe, enabled: false

	# Example of frontend configuration
	# This example will make us serve the primary frontend from the
	# frontends directory within your `:pleroma, :instance, static_dir`.
	# e.g., instance/static/frontends/pleroma/develop/
	#
	# With no frontend configuration, the bundled files from the `static` directory will
	# be used.
	#
	# config :pleroma, :frontends,
	# primary: %{"name" => "pleroma-fe", "ref" => "develop"},
	# admin: %{"name" => "admin-fe", "ref" => "stable"},
	# available: %{...}

	config :pleroma, :frontends,
	available: %{
	"kenoma" => %{
	"name" => "kenoma",
	"git" => "https://git.pleroma.social/lambadalambda/kenoma",
	"build_url" =>
	"https://git.pleroma.social/lambadalambda/kenoma/-/jobs/artifacts/${ref}/download?job=build",
	"ref" => "master"
	},
	"pleroma-fe" => %{
	"name" => "pleroma-fe",
	"git" => "https://git.pleroma.social/pleroma/pleroma-fe",
	"build_url" =>
	"https://git.pleroma.social/pleroma/pleroma-fe/-/jobs/artifacts/${ref}/download?job=build",
	"ref" => "develop"
	},
	"fedi-fe" => %{
	"name" => "fedi-fe",
	"git" => "https://git.pleroma.social/pleroma/fedi-fe",
	"build_url" =>
	"https://git.pleroma.social/pleroma/fedi-fe/-/jobs/artifacts/${ref}/download?job=build_release",
	"ref" => "master",
	"custom-http-headers" => [
	{"service-worker-allowed", "/"}
	]
	},
	"admin-fe" => %{
	"name" => "admin-fe",
	"git" => "https://git.pleroma.social/pleroma/admin-fe",
	"build_url" =>
	"https://git.pleroma.social/pleroma/admin-fe/-/jobs/artifacts/${ref}/download?job=build",
	"ref" => "develop"
	},
	"soapbox" => %{
	"name" => "soapbox",
	"git" => "https://gitlab.com/soapbox-pub/soapbox",
	"build_url" =>
	"https://gitlab.com/soapbox-pub/soapbox/-/jobs/artifacts/${ref}/download?job=build-production",
	"ref" => "v3.0.0-beta.1",
	"build_dir" => "static"
	},
	"glitch-lily" => %{
	"name" => "glitch-lily",
	"git" => "https://lily-is.land/infra/glitch-lily",
	"build_url" =>
	"https://lily-is.land/infra/glitch-lily/-/jobs/artifacts/${ref}/download?job=build",
	"ref" => "servant",
	"build_dir" => "public"
	}
	}

	config :pleroma, :web_cache_ttl,
	activity_pub: nil,
	activity_pub_question: 30_000

	config :pleroma, :modules, runtime_dir: "instance/modules"

	config :pleroma, configurable_from_database: false

	config :pleroma, Pleroma.Repo,
	parameters: [gin_fuzzy_search_limit: "500", jit: "off"],
	prepare: :unnamed

	config :pleroma, :connections_pool,
	reclaim_multiplier: 0.1,
	connection_acquisition_wait: 250,
	connection_acquisition_retries: 5,
	max_connections: 250,
	max_idle_time: 30_000,
	retry: 0,
	connect_timeout: 5_000

	config :pleroma, :pools,
	federation: [
	size: 75,
	max_waiting: 20,
	recv_timeout: 10_000
	],
	media: [
	size: 75,
	max_waiting: 20,
	recv_timeout: 15_000
	],
	rich_media: [
	size: 25,
	max_waiting: 20,
	recv_timeout: 15_000
	],
	upload: [
	size: 25,
	max_waiting: 20,
	recv_timeout: 15_000
	],
	default: [
	size: 50,
	max_waiting: 2,
	recv_timeout: 5_000
	]

	config :pleroma, :hackney_pools,
	federation: [
	max_connections: 50,
	timeout: 10_000
	],
	media: [
	max_connections: 50,
	timeout: 15_000
	],
	rich_media: [
	max_connections: 50,
	timeout: 15_000
	],
	upload: [
	max_connections: 25,
	timeout: 15_000
	]

	config :pleroma, :majic_pool, size: 2

	private_instance? = :if_instance_is_private

	config :pleroma, :restrict_unauthenticated,
	timelines: %{local: private_instance?, federated: private_instance?},
	profiles: %{local: private_instance?, remote: private_instance?},
	activities: %{local: private_instance?, remote: private_instance?}

	config :pleroma, Pleroma.Web.ApiSpec.CastAndValidate, strict: false

	config :pleroma, :mrf,
	policies: [
	Pleroma.Web.ActivityPub.MRF.ObjectAgePolicy,
	Pleroma.Web.ActivityPub.MRF.TagPolicy,
	Pleroma.Web.ActivityPub.MRF.InlineQuotePolicy
	],
	transparency: true,
	transparency_exclusions: []

	config :tzdata, :http_client, Pleroma.HTTP.Tzdata

	config :ex_aws, http_client: Pleroma.HTTP.ExAws

	config :web_push_encryption, http_client: Pleroma.HTTP.WebPush

	config :pleroma, :instances_favicons, enabled: false

	config :floki, :html_parser, Floki.HTMLParser.FastHtml

	config :pleroma, Pleroma.Web.Auth.Authenticator, Pleroma.Web.Auth.PleromaAuthenticator

	config :pleroma, Pleroma.User.Backup,
	purge_after_days: 30,
	limit_days: 7,
	dir: nil,
	process_chunk_size: 100,
	timeout: :timer.minutes(30)

	config :pleroma, ConcurrentLimiter, [
	{Pleroma.Search, [max_running: 30, max_waiting: 50]}
	]

	config :pleroma, Pleroma.Web.WebFinger, domain: nil, update_nickname_on_user_fetch: true

	config :pleroma, Pleroma.Search, module: Pleroma.Search.DatabaseSearch

	config :pleroma, Pleroma.Search.Meilisearch,
	url: "http://127.0.0.1:7700/",
	private_key: nil,
	initial_indexing_chunk_size: 100_000

	config :pleroma, Pleroma.Application,
	background_migrators: true,
	internal_fetch: true,
	load_custom_modules: true,
	max_restarts: 3,
	streamer_registry: true

	config :pleroma, Pleroma.Uploaders.Uploader, timeout: 30_000

	config :pleroma, Pleroma.Search.QdrantSearch,
	qdrant_url: "http://127.0.0.1:6333/",
	qdrant_api_key: "",
	openai_url: "http://127.0.0.1:11345",
	# The healthcheck url has to be set to nil when used with the real openai
	# API, as it doesn't have a healthcheck endpoint.
	openai_healthcheck_url: "http://127.0.0.1:11345/health",
	openai_model: "snowflake/snowflake-arctic-embed-xs",
	openai_api_key: "",
	qdrant_index_configuration: %{
	vectors: %{size: 384, distance: "Cosine"}
	}

	# Import environment specific config. This must remain at the bottom
	# of this file so it overrides the configuration defined above.
	import_config "#{Mix.env()}.exs"
	diff --git a/lib/pleroma/web/mastodon_api/controllers/app_controller.ex b/lib/pleroma/web/mastodon_api/controllers/app_controller.ex
	index 844673ae0..6cfeb712e 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/app_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/app_controller.ex
	@@ -1,57 +1,59 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AppController do
	@moduledoc """
	Controller for supporting app-related actions.
	If authentication is an option, app tokens (user-unbound) must be supported.
	"""

	use Pleroma.Web, :controller

	alias Pleroma.Maps
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Scopes
	alias Pleroma.Web.OAuth.Token

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	+ plug(Pleroma.Web.Plugs.RateLimiter, [name: :oauth_app_creation] when action == :create)
	+
	plug(:skip_auth when action in [:create, :verify_credentials])

	plug(Pleroma.Web.ApiSpec.CastAndValidate)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.AppOperation

	@doc "POST /api/v1/apps"
	def create(%{body_params: params} = conn, _params) do
	scopes = Scopes.fetch_scopes(params, ["read"])
	user_id = get_user_id(conn)

	app_attrs =
	params
	\|> Map.take([:client_name, :redirect_uris, :website])
	\|> Map.put(:scopes, scopes)
	\|> Maps.put_if_present(:user_id, user_id)

	with cs <- App.register_changeset(%App{}, app_attrs),
	{:ok, app} <- Repo.insert(cs) do
	render(conn, "show.json", app: app)
	end
	end

	defp get_user_id(%{assigns: %{user: %User{id: user_id}}}), do: user_id
	defp get_user_id(_conn), do: nil

	@doc """
	GET /api/v1/apps/verify_credentials
	Gets compact non-secret representation of the app. Supports app tokens and user tokens.
	"""
	def verify_credentials(%{assigns: %{token: %Token{} = token}} = conn, _) do
	with %{app: %App{} = app} <- Repo.preload(token, :app) do
	render(conn, "compact_non_secret.json", app: app)
	end
	end
	end
	diff --git a/lib/pleroma/web/o_auth/app.ex b/lib/pleroma/web/o_auth/app.ex
	index d1bf6dd18..7661c2566 100644
	--- a/lib/pleroma/web/o_auth/app.ex
	+++ b/lib/pleroma/web/o_auth/app.ex
	@@ -1,158 +1,184 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.App do
	use Ecto.Schema
	import Ecto.Changeset
	import Ecto.Query
	alias Pleroma.Repo
	alias Pleroma.User
	+ alias Pleroma.Web.OAuth.Token

	@type t :: %__MODULE__{}

	schema "apps" do
	field(:client_name, :string)
	field(:redirect_uris, :string)
	field(:scopes, {:array, :string}, default: [])
	field(:website, :string)
	field(:client_id, :string)
	field(:client_secret, :string)
	field(:trusted, :boolean, default: false)

	belongs_to(:user, User, type: FlakeId.Ecto.CompatType)

	has_many(:oauth_authorizations, Pleroma.Web.OAuth.Authorization, on_delete: :delete_all)
	has_many(:oauth_tokens, Pleroma.Web.OAuth.Token, on_delete: :delete_all)

	timestamps()
	end

	@spec changeset(t(), map()) :: Ecto.Changeset.t()
	def changeset(struct, params) do
	cast(struct, params, [:client_name, :redirect_uris, :scopes, :website, :trusted, :user_id])
	end

	@spec register_changeset(t(), map()) :: Ecto.Changeset.t()
	def register_changeset(struct, params \\ %{}) do
	changeset =
	struct
	\|> changeset(params)
	\|> validate_required([:client_name, :redirect_uris, :scopes])

	if changeset.valid? do
	changeset
	\|> put_change(
	:client_id,
	:crypto.strong_rand_bytes(32) \|> Base.url_encode64(padding: false)
	)
	\|> put_change(
	:client_secret,
	:crypto.strong_rand_bytes(32) \|> Base.url_encode64(padding: false)
	)
	else
	changeset
	end
	end

	@spec create(map()) :: {:ok, t()} \| {:error, Ecto.Changeset.t()}
	def create(params) do
	%__MODULE__{}
	\|> register_changeset(params)
	\|> Repo.insert()
	end

	@spec update(pos_integer(), map()) :: {:ok, t()} \| {:error, Ecto.Changeset.t()} \| nil
	def update(id, params) do
	with %__MODULE__{} = app <- Repo.get(__MODULE__, id) do
	app
	\|> changeset(params)
	\|> Repo.update()
	end
	end

	@doc """
	Gets app by attrs or create new with attrs.
	And updates the scopes if need.
	"""
	@spec get_or_make(map(), list(String.t())) :: {:ok, t()} \| {:error, Ecto.Changeset.t()}
	def get_or_make(attrs, scopes) do
	with %__MODULE__{} = app <- Repo.get_by(__MODULE__, attrs) do
	update_scopes(app, scopes)
	else
	_e ->
	%__MODULE__{}
	\|> register_changeset(Map.put(attrs, :scopes, scopes))
	\|> Repo.insert()
	end
	end

	defp update_scopes(%__MODULE__{} = app, []), do: {:ok, app}
	defp update_scopes(%__MODULE__{scopes: scopes} = app, scopes), do: {:ok, app}

	defp update_scopes(%__MODULE__{} = app, scopes) do
	app
	\|> change(%{scopes: scopes})
	\|> Repo.update()
	end

	@spec search(map()) :: {:ok, [t()], non_neg_integer()}
	def search(params) do
	query = from(a in __MODULE__)

	query =
	if params[:client_name] do
	from(a in query, where: a.client_name == ^params[:client_name])
	else
	query
	end

	query =
	if params[:client_id] do
	from(a in query, where: a.client_id == ^params[:client_id])
	else
	query
	end

	query =
	if Map.has_key?(params, :trusted) do
	from(a in query, where: a.trusted == ^params[:trusted])
	else
	query
	end

	query =
	from(u in query,
	limit: ^params[:page_size],
	offset: ^((params[:page] - 1) * params[:page_size])
	)

	count = Repo.aggregate(__MODULE__, :count, :id)

	{:ok, Repo.all(query), count}
	end

	@spec get_user_apps(User.t()) :: {:ok, [t()], non_neg_integer()}
	def get_user_apps(%User{id: user_id}) do
	from(a in __MODULE__, where: a.user_id == ^user_id)
	\|> Repo.all()
	end

	@spec destroy(pos_integer()) :: {:ok, t()} \| {:error, Ecto.Changeset.t()}
	def destroy(id) do
	with %__MODULE__{} = app <- Repo.get(__MODULE__, id) do
	Repo.delete(app)
	end
	end

	@spec errors(Ecto.Changeset.t()) :: map()
	def errors(changeset) do
	Enum.reduce(changeset.errors, %{}, fn
	{:client_name, {error, _}}, acc ->
	Map.put(acc, :name, error)

	{key, {error, _}}, acc ->
	Map.put(acc, key, error)
	end)
	end
	+
	+ @spec maybe_update_owner(Token.t()) :: :ok
	+ def maybe_update_owner(%Token{app_id: app_id, user_id: user_id}) when not is_nil(user_id) do
	+ __MODULE__.update(app_id, %{user_id: user_id})
	+
	+ :ok
	+ end
	+
	+ def maybe_update_owner(_), do: :ok
	+
	+ @spec remove_orphans(pos_integer()) :: :ok
	+ def remove_orphans(limit \\ 100) do
	+ fifteen_mins_ago = DateTime.add(DateTime.utc_now(), -900, :second)
	+
	+ Repo.transaction(fn ->
	+ from(a in __MODULE__,
	+ where: is_nil(a.user_id) and a.inserted_at < ^fifteen_mins_ago,
	+ limit: ^limit
	+ )
	+ \|> Repo.all()
	+ \|> Enum.each(&Repo.delete(&1))
	+ end)
	+
	+ :ok
	+ end
	end
	diff --git a/lib/pleroma/web/o_auth/o_auth_controller.ex b/lib/pleroma/web/o_auth/o_auth_controller.ex
	index 47b03215f..0b3de5481 100644
	--- a/lib/pleroma/web/o_auth/o_auth_controller.ex
	+++ b/lib/pleroma/web/o_auth/o_auth_controller.ex
	@@ -1,628 +1,630 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthController do
	use Pleroma.Web, :controller

	alias Pleroma.Helpers.AuthHelper
	alias Pleroma.Helpers.UriHelper
	alias Pleroma.Maps
	alias Pleroma.MFA
	alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.Auth.WrapperAuthenticator, as: Authenticator
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.MFAController
	alias Pleroma.Web.OAuth.MFAView
	alias Pleroma.Web.OAuth.OAuthView
	alias Pleroma.Web.OAuth.Scopes
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.OAuth.Token.Strategy.RefreshToken
	alias Pleroma.Web.OAuth.Token.Strategy.Revoke, as: RevokeToken
	alias Pleroma.Web.Plugs.RateLimiter
	alias Pleroma.Web.Utils.Params

	require Logger

	if Pleroma.Config.oauth_consumer_enabled?(), do: plug(Ueberauth)

	plug(:fetch_session)
	plug(:fetch_flash)

	plug(:skip_auth)

	plug(RateLimiter, [name: :authentication] when action == :create_authorization)

	action_fallback(Pleroma.Web.OAuth.FallbackController)

	@oob_token_redirect_uri "urn:ietf:wg:oauth:2.0:oob"

	# Note: this definition is only called from error-handling methods with `conn.params` as 2nd arg
	def authorize(%Plug.Conn{} = conn, %{"authorization" => _} = params) do
	{auth_attrs, params} = Map.pop(params, "authorization")
	authorize(conn, Map.merge(params, auth_attrs))
	end

	def authorize(%Plug.Conn{assigns: %{token: %Token{}}} = conn, %{"force_login" => _} = params) do
	if Params.truthy_param?(params["force_login"]) do
	do_authorize(conn, params)
	else
	handle_existing_authorization(conn, params)
	end
	end

	# Note: the token is set in oauth_plug, but the token and client do not always go together.
	# For example, MastodonFE's token is set if user requests with another client,
	# after user already authorized to MastodonFE.
	# So we have to check client and token.
	def authorize(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{"client_id" => client_id} = params
	) do
	with %Token{} = t <- Repo.get_by(Token, token: token.token) \|> Repo.preload(:app),
	^client_id <- t.app.client_id do
	handle_existing_authorization(conn, params)
	else
	_ -> do_authorize(conn, params)
	end
	end

	def authorize(%Plug.Conn{} = conn, params), do: do_authorize(conn, params)

	defp do_authorize(%Plug.Conn{} = conn, params) do
	app = Repo.get_by(App, client_id: params["client_id"])
	available_scopes = (app && app.scopes) \|\| []
	scopes = Scopes.fetch_scopes(params, available_scopes)

	user =
	with %{assigns: %{user: %User{} = user}} <- conn do
	user
	else
	_ -> nil
	end

	scopes =
	if scopes == [] do
	available_scopes
	else
	scopes
	end

	# Note: `params` might differ from `conn.params`; use `@params` not `@conn.params` in template
	render(conn, Authenticator.auth_template(), %{
	user: user,
	app: app && Map.delete(app, :client_secret),
	response_type: params["response_type"],
	client_id: params["client_id"],
	available_scopes: available_scopes,
	scopes: scopes,
	redirect_uri: params["redirect_uri"],
	state: params["state"],
	params: params
	})
	end

	defp handle_existing_authorization(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{"redirect_uri" => @oob_token_redirect_uri}
	) do
	render(conn, "oob_token_exists.html", %{token: token})
	end

	defp handle_existing_authorization(
	%Plug.Conn{assigns: %{token: %Token{} = token}} = conn,
	%{} = params
	) do
	app = Repo.preload(token, :app).app

	redirect_uri =
	if is_binary(params["redirect_uri"]) do
	params["redirect_uri"]
	else
	default_redirect_uri(app)
	end

	if redirect_uri in String.split(app.redirect_uris) do
	redirect_uri = redirect_uri(conn, redirect_uri)
	url_params = %{access_token: token.token}
	url_params = Maps.put_if_present(url_params, :state, params["state"])
	url = UriHelper.modify_uri_params(redirect_uri, url_params)
	redirect(conn, external: url)
	else
	conn
	\|> put_flash(:error, dgettext("errors", "Unlisted redirect_uri."))
	\|> redirect(external: redirect_uri(conn, redirect_uri))
	end
	end

	def create_authorization(_, _, opts \\ [])

	def create_authorization(%Plug.Conn{assigns: %{user: %User{} = user}} = conn, params, []) do
	create_authorization(conn, params, user: user)
	end

	def create_authorization(%Plug.Conn{} = conn, %{"authorization" => _} = params, opts) do
	with {:ok, auth, user} <- do_create_authorization(conn, params, opts[:user]),
	{:mfa_required, _, _, false} <- {:mfa_required, user, auth, MFA.require?(user)} do
	after_create_authorization(conn, auth, params)
	else
	error ->
	handle_create_authorization_error(conn, error, params)
	end
	end

	def after_create_authorization(%Plug.Conn{} = conn, %Authorization{} = auth, %{
	"authorization" => %{"redirect_uri" => @oob_token_redirect_uri}
	}) do
	# Enforcing the view to reuse the template when calling from other controllers
	conn
	\|> put_view(OAuthView)
	\|> render("oob_authorization_created.html", %{auth: auth})
	end

	def after_create_authorization(%Plug.Conn{} = conn, %Authorization{} = auth, %{
	"authorization" => %{"redirect_uri" => redirect_uri} = auth_attrs
	}) do
	app = Repo.preload(auth, :app).app

	# An extra safety measure before we redirect (also done in `do_create_authorization/2`)
	if redirect_uri in String.split(app.redirect_uris) do
	redirect_uri = redirect_uri(conn, redirect_uri)
	url_params = %{code: auth.token}
	url_params = Maps.put_if_present(url_params, :state, auth_attrs["state"])
	url = UriHelper.modify_uri_params(redirect_uri, url_params)
	redirect(conn, external: url)
	else
	conn
	\|> put_flash(:error, dgettext("errors", "Unlisted redirect_uri."))
	\|> redirect(external: redirect_uri(conn, redirect_uri))
	end
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:error, scopes_issue},
	%{"authorization" => _} = params
	)
	when scopes_issue in [:unsupported_scopes, :missing_scopes] do
	# Per https://github.com/tootsuite/mastodon/blob/
	# 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L39
	conn
	\|> put_flash(:error, dgettext("errors", "This action is outside the authorized scopes"))
	\|> put_status(:unauthorized)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :confirmation_pending},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Your login is missing a confirmed e-mail address"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:mfa_required, user, auth, _},
	params
	) do
	{:ok, token} = MFA.Token.create(user, auth)

	data = %{
	"mfa_token" => token.token,
	"redirect_uri" => params["authorization"]["redirect_uri"],
	"state" => params["authorization"]["state"]
	}

	MFAController.show(conn, data)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :password_reset_pending},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Password reset is required"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(
	%Plug.Conn{} = conn,
	{:account_status, :deactivated},
	%{"authorization" => _} = params
	) do
	conn
	\|> put_flash(:error, dgettext("errors", "Your account is currently disabled"))
	\|> put_status(:forbidden)
	\|> authorize(params)
	end

	defp handle_create_authorization_error(%Plug.Conn{} = conn, error, %{"authorization" => _}) do
	Authenticator.handle_error(conn, error)
	end

	@doc "Renew access_token with refresh_token"
	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "refresh_token", "refresh_token" => token} = _params
	) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	{:ok, %{user: user} = token} <- Token.get_by_refresh_token(app, token),
	{:ok, token} <- RefreshToken.grant(token) do
	after_token_exchange(conn, %{user: user, token: token})
	else
	_error -> render_invalid_credentials_error(conn)
	end
	end

	def token_exchange(%Plug.Conn{} = conn, %{"grant_type" => "authorization_code"} = params) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	fixed_token = Token.Utils.fix_padding(params["code"]),
	{:ok, auth} <- Authorization.get_by_token(app, fixed_token),
	%User{} = user <- User.get_cached_by_id(auth.user_id),
	{:ok, token} <- Token.exchange_token(app, auth) do
	after_token_exchange(conn, %{user: user, token: token})
	else
	error ->
	handle_token_exchange_error(conn, error)
	end
	end

	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "password"} = params
	) do
	with {:ok, %User{} = user} <- Authenticator.get_user(conn),
	{:ok, app} <- Token.Utils.fetch_app(conn),
	requested_scopes <- Scopes.fetch_scopes(params, app.scopes),
	{:ok, token} <- login(user, app, requested_scopes) do
	after_token_exchange(conn, %{user: user, token: token})
	else
	error ->
	handle_token_exchange_error(conn, error)
	end
	end

	def token_exchange(
	%Plug.Conn{} = conn,
	%{"grant_type" => "password", "name" => name, "password" => _password} = params
	) do
	params =
	params
	\|> Map.delete("name")
	\|> Map.put("username", name)

	token_exchange(conn, params)
	end

	def token_exchange(%Plug.Conn{} = conn, %{"grant_type" => "client_credentials"} = _params) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	{:ok, auth} <- Authorization.create_authorization(app, %User{}),
	{:ok, token} <- Token.exchange_token(app, auth) do
	after_token_exchange(conn, %{token: token})
	else
	_error ->
	handle_token_exchange_error(conn, :invalid_credentials)
	end
	end

	# Bad request
	def token_exchange(%Plug.Conn{} = conn, params), do: bad_request(conn, params)

	def after_token_exchange(%Plug.Conn{} = conn, %{token: token} = view_params) do
	+ App.maybe_update_owner(token)
	+
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> json(OAuthView.render("token.json", view_params))
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:mfa_required, user, auth, _}) do
	conn
	\|> put_status(:forbidden)
	\|> json(build_and_response_mfa_token(user, auth))
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:account_status, :deactivated}) do
	render_error(
	conn,
	:forbidden,
	"Your account is currently disabled",
	%{},
	"account_is_disabled"
	)
	end

	defp handle_token_exchange_error(
	%Plug.Conn{} = conn,
	{:account_status, :password_reset_pending}
	) do
	render_error(
	conn,
	:forbidden,
	"Password reset is required",
	%{},
	"password_reset_required"
	)
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:account_status, :confirmation_pending}) do
	render_error(
	conn,
	:forbidden,
	"Your login is missing a confirmed e-mail address",
	%{},
	"missing_confirmed_email"
	)
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, {:account_status, :approval_pending}) do
	render_error(
	conn,
	:forbidden,
	"Your account is awaiting approval.",
	%{},
	"awaiting_approval"
	)
	end

	defp handle_token_exchange_error(%Plug.Conn{} = conn, _error) do
	render_invalid_credentials_error(conn)
	end

	def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do
	with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token),
	{:ok, oauth_token} <- RevokeToken.revoke(oauth_token) do
	conn =
	with session_token = AuthHelper.get_session_token(conn),
	%Token{token: ^session_token} <- oauth_token do
	AuthHelper.delete_session_token(conn)
	else
	_ -> conn
	end

	json(conn, %{})
	else
	_error ->
	# RFC 7009: invalid tokens [in the request] do not cause an error response
	json(conn, %{})
	end
	end

	def token_revoke(%Plug.Conn{} = conn, params), do: bad_request(conn, params)

	# Response for bad request
	defp bad_request(%Plug.Conn{} = conn, _) do
	render_error(conn, :internal_server_error, "Bad request")
	end

	@doc "Prepares OAuth request to provider for Ueberauth"
	def prepare_request(%Plug.Conn{} = conn, %{
	"provider" => provider,
	"authorization" => auth_attrs
	}) do
	scope =
	auth_attrs
	\|> Scopes.fetch_scopes([])
	\|> Scopes.to_string()

	state =
	auth_attrs
	\|> Map.delete("scopes")
	\|> Map.put("scope", scope)
	\|> Jason.encode!()

	params =
	auth_attrs
	\|> Map.drop(~w(scope scopes client_id redirect_uri))
	\|> Map.put("state", state)

	# Handing the request to Ueberauth
	redirect(conn, to: Routes.o_auth_path(conn, :request, provider, params))
	end

	def request(%Plug.Conn{} = conn, params) do
	message =
	if params["provider"] do
	dgettext("errors", "Unsupported OAuth provider: %{provider}.",
	provider: params["provider"]
	)
	else
	dgettext("errors", "Bad OAuth request.")
	end

	conn
	\|> put_flash(:error, message)
	\|> redirect(to: "/")
	end

	def callback(%Plug.Conn{assigns: %{ueberauth_failure: failure}} = conn, params) do
	params = callback_params(params)
	messages = for e <- Map.get(failure, :errors, []), do: e.message
	message = Enum.join(messages, "; ")

	conn
	\|> put_flash(
	:error,
	dgettext("errors", "Failed to authenticate: %{message}.", message: message)
	)
	\|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	end

	def callback(%Plug.Conn{} = conn, params) do
	params = callback_params(params)

	with {:ok, registration} <- Authenticator.get_registration(conn) do
	auth_attrs = Map.take(params, ~w(client_id redirect_uri scope scopes state))

	case Repo.get_assoc(registration, :user) do
	{:ok, user} ->
	create_authorization(conn, %{"authorization" => auth_attrs}, user: user)

	_ ->
	registration_params =
	Map.merge(auth_attrs, %{
	"nickname" => Registration.nickname(registration),
	"email" => Registration.email(registration)
	})

	conn
	\|> put_session_registration_id(registration.id)
	\|> registration_details(%{"authorization" => registration_params})
	end
	else
	error ->
	Logger.debug(inspect(["OAUTH_ERROR", error, conn.assigns]))

	conn
	\|> put_flash(:error, dgettext("errors", "Failed to set up user account."))
	\|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	end
	end

	defp callback_params(%{"state" => state} = params) do
	Map.merge(params, Jason.decode!(state))
	end

	def registration_details(%Plug.Conn{} = conn, %{"authorization" => auth_attrs}) do
	render(conn, "register.html", %{
	client_id: auth_attrs["client_id"],
	redirect_uri: auth_attrs["redirect_uri"],
	state: auth_attrs["state"],
	scopes: Scopes.fetch_scopes(auth_attrs, []),
	nickname: auth_attrs["nickname"],
	email: auth_attrs["email"]
	})
	end

	def register(%Plug.Conn{} = conn, %{"authorization" => _, "op" => "connect"} = params) do
	with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	%Registration{} = registration <- Repo.get(Registration, registration_id),
	{_, {:ok, auth, _user}} <-
	{:create_authorization, do_create_authorization(conn, params)},
	%User{} = user <- Repo.preload(auth, :user).user,
	{:ok, _updated_registration} <- Registration.bind_to_user(registration, user) do
	conn
	\|> put_session_registration_id(nil)
	\|> after_create_authorization(auth, params)
	else
	{:create_authorization, error} ->
	{:register, handle_create_authorization_error(conn, error, params)}

	_ ->
	{:register, :generic_error}
	end
	end

	def register(%Plug.Conn{} = conn, %{"authorization" => _, "op" => "register"} = params) do
	with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	%Registration{} = registration <- Repo.get(Registration, registration_id),
	{:ok, user} <- Authenticator.create_from_registration(conn, registration) do
	conn
	\|> put_session_registration_id(nil)
	\|> create_authorization(
	params,
	user: user
	)
	else
	{:error, changeset} ->
	message =
	Enum.map(changeset.errors, fn {field, {error, _}} ->
	"#{field} #{error}"
	end)
	\|> Enum.join("; ")

	message =
	String.replace(
	message,
	"ap_id has already been taken",
	"nickname has already been taken"
	)

	conn
	\|> put_status(:forbidden)
	\|> put_flash(:error, "Error: #{message}.")
	\|> registration_details(params)

	_ ->
	{:register, :generic_error}
	end
	end

	defp do_create_authorization(conn, auth_attrs, user \\ nil)

	defp do_create_authorization(
	%Plug.Conn{} = conn,
	%{
	"authorization" =>
	%{
	"client_id" => client_id,
	"redirect_uri" => redirect_uri
	} = auth_attrs
	},
	user
	) do
	with {_, {:ok, %User{} = user}} <-
	{:get_user, (user && {:ok, user}) \|\| Authenticator.get_user(conn)},
	%App{} = app <- Repo.get_by(App, client_id: client_id),
	true <- redirect_uri in String.split(app.redirect_uris),
	requested_scopes <- Scopes.fetch_scopes(auth_attrs, app.scopes),
	{:ok, auth} <- do_create_authorization(user, app, requested_scopes) do
	{:ok, auth, user}
	end
	end

	defp do_create_authorization(%User{} = user, %App{} = app, requested_scopes)
	when is_list(requested_scopes) do
	with {:account_status, :active} <- {:account_status, User.account_status(user)},
	{:ok, scopes} <- validate_scopes(app, requested_scopes),
	{:ok, auth} <- Authorization.create_authorization(app, user, scopes) do
	{:ok, auth}
	end
	end

	# Note: intended to be a private function but opened for AccountController that logs in on signup
	@doc "If checks pass, creates authorization and token for given user, app and requested scopes."
	def login(%User{} = user, %App{} = app, requested_scopes) when is_list(requested_scopes) do
	with {:ok, auth} <- do_create_authorization(user, app, requested_scopes),
	{:mfa_required, _, _, false} <- {:mfa_required, user, auth, MFA.require?(user)},
	{:ok, token} <- Token.exchange_token(app, auth) do
	{:ok, token}
	end
	end

	defp redirect_uri(%Plug.Conn{}, redirect_uri), do: redirect_uri

	defp get_session_registration_id(%Plug.Conn{} = conn), do: get_session(conn, :registration_id)

	defp put_session_registration_id(%Plug.Conn{} = conn, registration_id),
	do: put_session(conn, :registration_id, registration_id)

	defp build_and_response_mfa_token(user, auth) do
	with {:ok, token} <- MFA.Token.create(user, auth) do
	MFAView.render("mfa_response.json", %{token: token, user: user})
	end
	end

	@spec validate_scopes(App.t(), list()) ::
	{:ok, list()} \| {:error, :missing_scopes \| :unsupported_scopes}
	defp validate_scopes(%App{} = app, requested_scopes) when is_list(requested_scopes) do
	Scopes.validate(requested_scopes, app.scopes)
	end

	def default_redirect_uri(%App{} = app) do
	app.redirect_uris
	\|> String.split()
	\|> Enum.at(0)
	end

	defp render_invalid_credentials_error(conn) do
	render_error(conn, :bad_request, "Invalid credentials")
	end
	end
	diff --git a/lib/pleroma/workers/cron/app_cleanup_worker.ex b/lib/pleroma/workers/cron/app_cleanup_worker.ex
	new file mode 100644
	index 000000000..ee71cd7b6
	--- /dev/null
	+++ b/lib/pleroma/workers/cron/app_cleanup_worker.ex
	@@ -0,0 +1,21 @@
	+# Pleroma: A lightweight social networking server
	+# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	+# SPDX-License-Identifier: AGPL-3.0-only
	+
	+defmodule Pleroma.Workers.Cron.AppCleanupWorker do
	+ @moduledoc """
	+ Cleans up registered apps that were never associated with a user.
	+ """
	+
	+ use Oban.Worker, queue: "background"
	+
	+ alias Pleroma.Web.OAuth.App
	+
	+ @impl true
	+ def perform(_job) do
	+ App.remove_orphans()
	+ end
	+
	+ @impl true
	+ def timeout(_job), do: :timer.seconds(30)
	+end
	diff --git a/priv/repo/migrations/20240904142434_assign_app_user.exs b/priv/repo/migrations/20240904142434_assign_app_user.exs
	new file mode 100644
	index 000000000..11bec529b
	--- /dev/null
	+++ b/priv/repo/migrations/20240904142434_assign_app_user.exs
	@@ -0,0 +1,21 @@
	+defmodule Pleroma.Repo.Migrations.AssignAppUser do
	+ use Ecto.Migration
	+
	+ alias Pleroma.Repo
	+ alias Pleroma.Web.OAuth.App
	+ alias Pleroma.Web.OAuth.Token
	+
	+ def up do
	+ Repo.all(Token)
	+ \|> Enum.group_by(fn x -> Map.get(x, :app_id) end)
	+ \|> Enum.each(fn {_app_id, tokens} ->
	+ token =
	+ Enum.filter(tokens, fn x -> not is_nil(x.user_id) end)
	+ \|> List.first()
	+
	+ App.maybe_update_owner(token)
	+ end)
	+ end
	+
	+ def down, do: :ok
	+end
	diff --git a/test/pleroma/web/o_auth/app_test.exs b/test/pleroma/web/o_auth/app_test.exs
	index 96a67de6b..44219cf90 100644
	--- a/test/pleroma/web/o_auth/app_test.exs
	+++ b/test/pleroma/web/o_auth/app_test.exs
	@@ -1,56 +1,73 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.AppTest do
	use Pleroma.DataCase, async: true

	alias Pleroma.Web.OAuth.App
	import Pleroma.Factory

	describe "get_or_make/2" do
	test "gets exist app" do
	attrs = %{client_name: "Mastodon-Local", redirect_uris: "."}
	app = insert(:oauth_app, Map.merge(attrs, %{scopes: ["read", "write"]}))
	{:ok, %App{} = exist_app} = App.get_or_make(attrs, [])
	assert exist_app == app
	end

	test "make app" do
	attrs = %{client_name: "Mastodon-Local", redirect_uris: "."}
	{:ok, %App{} = app} = App.get_or_make(attrs, ["write"])
	assert app.scopes == ["write"]
	end

	test "gets exist app and updates scopes" do
	attrs = %{client_name: "Mastodon-Local", redirect_uris: "."}
	app = insert(:oauth_app, Map.merge(attrs, %{scopes: ["read", "write"]}))
	{:ok, %App{} = exist_app} = App.get_or_make(attrs, ["read", "write", "follow", "push"])
	assert exist_app.id == app.id
	assert exist_app.scopes == ["read", "write", "follow", "push"]
	end

	test "has unique client_id" do
	insert(:oauth_app, client_name: "", redirect_uris: "", client_id: "boop")

	error =
	catch_error(insert(:oauth_app, client_name: "", redirect_uris: "", client_id: "boop"))

	assert %Ecto.ConstraintError{} = error
	assert error.constraint == "apps_client_id_index"
	assert error.type == :unique
	end
	end

	test "get_user_apps/1" do
	user = insert(:user)

	apps = [
	insert(:oauth_app, user_id: user.id),
	insert(:oauth_app, user_id: user.id),
	insert(:oauth_app, user_id: user.id)
	]

	assert Enum.sort(App.get_user_apps(user)) == Enum.sort(apps)
	end
	+
	+ test "removes orphaned apps" do
	+ attrs = %{client_name: "Mastodon-Local", redirect_uris: "."}
	+ {:ok, %App{} = old_app} = App.get_or_make(attrs, ["write"])
	+
	+ attrs = %{client_name: "PleromaFE", redirect_uris: "."}
	+ {:ok, %App{} = app} = App.get_or_make(attrs, ["write"])
	+
	+ # backdate the old app so it's within the threshold for being cleaned up
	+ {:ok, _} =
	+ "UPDATE apps SET inserted_at = now() - interval '1 hour' WHERE id = #{old_app.id}"
	+ \|> Pleroma.Repo.query()
	+
	+ App.remove_orphans()
	+
	+ assert [app] == Pleroma.Repo.all(App)
	+ end
	end
	diff --git a/test/pleroma/web/o_auth/o_auth_controller_test.exs b/test/pleroma/web/o_auth/o_auth_controller_test.exs
	index 83a08d9fc..260442771 100644
	--- a/test/pleroma/web/o_auth/o_auth_controller_test.exs
	+++ b/test/pleroma/web/o_auth/o_auth_controller_test.exs
	@@ -1,1307 +1,1315 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthControllerTest do
	use Pleroma.Web.ConnCase

	import Pleroma.Factory

	alias Pleroma.Helpers.AuthHelper
	alias Pleroma.MFA
	alias Pleroma.MFA.TOTP
	alias Pleroma.Repo
	alias Pleroma.User
	+ alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.OAuthController
	alias Pleroma.Web.OAuth.Token

	@session_opts [
	store: :cookie,
	key: "_test",
	signing_salt: "cooldude"
	]
	setup do
	clear_config([:instance, :account_activation_required])
	clear_config([:instance, :account_approval_required])
	end

	describe "in OAuth consumer mode, " do
	setup do
	[
	app: insert(:oauth_app),
	conn:
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	setup do: clear_config([:auth, :oauth_consumer_strategies], ~w(twitter facebook))

	test "GET /oauth/authorize renders auth forms, including OAuth consumer form", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ "Sign in with Twitter"
	assert response =~ o_auth_path(conn, :prepare_request)
	end

	test "GET /oauth/prepare_request encodes parameters as `state` and redirects", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/prepare_request",
	%{
	"provider" => "twitter",
	"authorization" => %{
	"scope" => "read follow",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state"
	}
	}
	)

	assert html_response(conn, 302)

	redirect_query = URI.parse(redirected_to(conn)).query
	assert %{"state" => state_param} = URI.decode_query(redirect_query)
	assert {:ok, state_components} = Jason.decode(state_param)

	expected_client_id = app.client_id
	expected_redirect_uri = app.redirect_uris

	assert %{
	"scope" => "read follow",
	"client_id" => ^expected_client_id,
	"redirect_uri" => ^expected_redirect_uri,
	"state" => "a_state"
	} = state_components
	end

	test "with user-bound registration, GET /oauth/<provider>/callback redirects to `redirect_uri` with `code`",
	%{app: app, conn: conn} do
	registration = insert(:registration)
	redirect_uri = OAuthController.default_redirect_uri(app)

	state_params = %{
	"scope" => Enum.join(app.scopes, " "),
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => ""
	}

	conn =
	conn
	\|> assign(:ueberauth_auth, %{provider: registration.provider, uid: registration.uid})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Jason.encode!(state_params)
	}
	)

	assert html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with user-unbound registration, GET /oauth/<provider>/callback renders registration_details page",
	%{app: app, conn: conn} do
	user = insert(:user)

	state_params = %{
	"scope" => "read write",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state"
	}

	conn =
	conn
	\|> assign(:ueberauth_auth, %{
	provider: "twitter",
	uid: "171799000",
	info: %{nickname: user.nickname, email: user.email, name: user.name, description: nil}
	})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Jason.encode!(state_params)
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ ~r/name="op" type="submit" value="register"/
	assert response =~ ~r/name="op" type="submit" value="connect"/
	assert response =~ user.email
	assert response =~ user.nickname
	end

	test "on authentication error, GET /oauth/<provider>/callback redirects to `redirect_uri`", %{
	app: app,
	conn: conn
	} do
	state_params = %{
	"scope" => Enum.join(app.scopes, " "),
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => ""
	}

	conn =
	conn
	\|> assign(:ueberauth_failure, %{errors: [%{message: "(error description)"}]})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Jason.encode!(state_params)
	}
	)

	assert html_response(conn, 302)
	assert redirected_to(conn) == app.redirect_uris
	assert conn.assigns.flash["error"] == "Failed to authenticate: (error description)."
	end

	test "GET /oauth/registration_details renders registration details form", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/registration_details",
	%{
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"nickname" => nil,
	"email" => "john@doe.com"
	}
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ ~r/name="op" type="submit" value="register"/
	assert response =~ ~r/name="op" type="submit" value="connect"/
	end

	test "with valid params, POST /oauth/register?op=register redirects to `redirect_uri` with `code`",
	%{
	app: app,
	conn: conn
	} do
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "a_state",
	"nickname" => "availablenick",
	"email" => "available@email.com"
	}
	}
	)

	assert html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with unlisted `redirect_uri`, POST /oauth/register?op=register results in HTTP 401",
	%{
	app: app,
	conn: conn
	} do
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
	unlisted_redirect_uri = "http://cross-site-request.com"

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "a_state",
	"nickname" => "availablenick",
	"email" => "available@email.com"
	}
	}
	)

	assert html_response(conn, 401)
	end

	test "with invalid params, POST /oauth/register?op=register renders registration_details page",
	%{
	app: app,
	conn: conn
	} do
	another_user = insert(:user)
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})

	params = %{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"nickname" => "availablenickname",
	"email" => "available@email.com"
	}
	}

	for {bad_param, bad_param_value} <-
	[{"nickname", another_user.nickname}, {"email", another_user.email}] do
	bad_registration_attrs = %{
	"authorization" => Map.put(params["authorization"], bad_param, bad_param_value)
	}

	bad_params = Map.merge(params, bad_registration_attrs)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post("/oauth/register", bad_params)

	assert html_response(conn, 403) =~ ~r/name="op" type="submit" value="register"/
	assert conn.assigns.flash["error"] == "Error: #{bad_param} has already been taken."
	end
	end

	test "with valid params, POST /oauth/register?op=connect redirects to `redirect_uri` with `code`",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("testpassword"))
	registration = insert(:registration, user: nil)
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "testpassword"
	}
	}
	)

	assert html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with unlisted `redirect_uri`, POST /oauth/register?op=connect results in HTTP 401`",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("testpassword"))
	registration = insert(:registration, user: nil)
	unlisted_redirect_uri = "http://cross-site-request.com"

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "testpassword"
	}
	}
	)

	assert html_response(conn, 401)
	end

	test "with invalid params, POST /oauth/register?op=connect renders registration_details page",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user)
	registration = insert(:registration, user: nil)

	params = %{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "wrong password"
	}
	}

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post("/oauth/register", params)

	assert html_response(conn, 401) =~ ~r/name="op" type="submit" value="connect"/
	assert conn.assigns.flash["error"] == "Invalid Username/Password"
	end
	end

	describe "GET /oauth/authorize" do
	setup do
	[
	app: insert(:oauth_app, redirect_uris: "https://redirect.url"),
	conn:
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	test "renders authentication page", %{app: app, conn: conn} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "properly handles internal calls with `authorization`-wrapped params", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"authorization" => %{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "renders authentication page if user is already authenticated but `force_login` is tru-ish",
	%{app: app, conn: conn} do
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read",
	"force_login" => "true"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "renders authentication page if user is already authenticated but user request with another client",
	%{
	app: app,
	conn: conn
	} do
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => "another_client_id",
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "with existing authentication and non-OOB `redirect_uri`, redirects to app with `token` and `state` params",
	%{
	app: app,
	conn: conn
	} do
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "specific_client_state",
	"scope" => "read"
	}
	)

	assert URI.decode(redirected_to(conn)) ==
	"https://redirect.url?access_token=#{token.token}&state=specific_client_state"
	end

	test "with existing authentication and unlisted non-OOB `redirect_uri`, redirects without credentials",
	%{
	app: app,
	conn: conn
	} do
	unlisted_redirect_uri = "http://cross-site-request.com"
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "specific_client_state",
	"scope" => "read"
	}
	)

	assert redirected_to(conn) == unlisted_redirect_uri
	end

	test "with existing authentication and OOB `redirect_uri`, redirects to app with `token` and `state` params",
	%{
	app: app,
	conn: conn
	} do
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ "Authorization exists"
	end
	end

	describe "POST /oauth/authorize" do
	test "redirects with oauth authorization, " <>
	"granting requested app-supported scopes to both admin- and non-admin users" do
	app_scopes = ["read", "write", "admin", "secret_scope"]
	app = insert(:oauth_app, scopes: app_scopes)
	redirect_uri = OAuthController.default_redirect_uri(app)

	non_admin = insert(:user, is_admin: false)
	admin = insert(:user, is_admin: true)
	scopes_subset = ["read:subscope", "write", "admin"]

	# In case scope param is missing, expecting _all_ app-supported scopes to be granted
	for user <- [non_admin, admin],
	{requested_scopes, expected_scopes} <-
	%{scopes_subset => scopes_subset, nil: app_scopes} do
	conn =
	post(
	build_conn(),
	"/oauth/authorize",
	%{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"scope" => requested_scopes,
	"state" => "statepassed"
	}
	}
	)

	target = redirected_to(conn)
	assert target =~ redirect_uri

	query = URI.parse(target).query \|> URI.query_decoder() \|> Map.new()

	assert %{"state" => "statepassed", "code" => code} = query
	auth = Repo.get_by(Authorization, token: code)
	assert auth
	assert auth.scopes == expected_scopes
	end
	end

	test "authorize from cookie" do
	user = insert(:user)
	app = insert(:oauth_app)
	oauth_token = insert(:oauth_token, user: user, app: app)
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	\|> AuthHelper.put_session_token(oauth_token.token)
	\|> post(
	"/oauth/authorize",
	%{
	"authorization" => %{
	"name" => user.nickname,
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"scope" => app.scopes,
	"state" => "statepassed"
	}
	}
	)

	target = redirected_to(conn)
	assert target =~ redirect_uri

	query = URI.parse(target).query \|> URI.query_decoder() \|> Map.new()

	assert %{"state" => "statepassed", "code" => code} = query
	auth = Repo.get_by(Authorization, token: code)
	assert auth
	assert auth.scopes == app.scopes
	end

	test "redirect to on two-factor auth page" do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	app = insert(:oauth_app, scopes: ["read", "write", "follow"])

	conn =
	build_conn()
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read write",
	"state" => "statepassed"
	}
	})

	result = html_response(conn, 200)

	mfa_token = Repo.get_by(MFA.Token, user_id: user.id)
	assert result =~ app.redirect_uris
	assert result =~ "statepassed"
	assert result =~ mfa_token.token
	assert result =~ "Two-factor authentication"
	end

	test "returns 401 for wrong credentials", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app)
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "wrong",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => Enum.join(app.scopes, " ")
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "Invalid Username/Password"
	end

	test "returns 401 for missing scopes" do
	user = insert(:user, is_admin: false)
	app = insert(:oauth_app, scopes: ["read", "write", "admin"])
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	build_conn()
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => ""
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end

	test "returns 401 for scopes beyond app scopes hierarchy", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => "read write follow"
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end
	end

	describe "POST /oauth/token" do
	test "issues a token for an all-body request" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])

	+ # Verify app has no associated user yet
	+ assert %Pleroma.Web.OAuth.App{user_id: nil} = Repo.get_by(App, %{id: app.id})
	+
	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "me" => ap_id} = json_response(conn, 200)

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == auth.scopes
	assert user.ap_id == ap_id
	+
	+ # Verify app has an associated user now
	+ user_id = user.id
	+ assert %Pleroma.Web.OAuth.App{user_id: ^user_id} = Repo.get_by(App, %{id: app.id})
	end

	test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do
	password = "testpassword"
	user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password))

	app = insert(:oauth_app, scopes: ["read", "write"])

	# Note: "scope" param is intentionally omitted
	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"id" => id, "access_token" => access_token} = json_response(conn, 200)

	token = Repo.get_by(Token, token: access_token)
	assert token
	assert token.id == id
	assert token.token == access_token
	assert token.scopes == app.scopes
	end

	test "issues a mfa token for `password` grant_type, when MFA enabled" do
	password = "testpassword"
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	app = insert(:oauth_app, scopes: ["read", "write"])

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(403)

	assert match?(
	%{
	"supported_challenge_types" => "totp",
	"mfa_token" => _,
	"error" => "mfa_required"
	},
	response
	)

	token = Repo.get_by(MFA.Token, token: response["mfa_token"])
	assert token.user_id == user.id
	assert token.authorization_id
	end

	test "issues a token for request with HTTP basic auth client credentials" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["scope1", "scope2", "scope3"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["scope1", "scope2"])
	assert auth.scopes == ["scope1", "scope2"]

	app_encoded =
	(URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
	\|> Base.encode64()

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic " <> app_encoded)
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app)
	})

	assert %{"access_token" => token, "scope" => scope} = json_response(conn, 200)

	assert scope == "scope1 scope2"

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == ["scope1", "scope2"]
	end

	test "issue a token for client_credentials grant type" do
	app = insert(:oauth_app, scopes: ["read", "write"])

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "client_credentials",
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
	json_response(conn, 200)

	assert token
	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	assert refresh
	assert scope == "read write"
	end

	test "rejects token exchange with invalid client credentials" do
	user = insert(:user)
	app = insert(:oauth_app)

	{:ok, auth} = Authorization.create_authorization(app, user)

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app)
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
	clear_config([:instance, :account_activation_required], true)
	password = "testpassword"

	{:ok, user} =
	insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password))
	\|> User.confirmation_changeset(set_confirmation: false)
	\|> User.update_and_set_cache()

	refute Pleroma.User.account_status(user) == :active

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to deactivated user" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	is_active: false
	)

	app = insert(:oauth_app)

	resp =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(403)

	assert resp == %{
	"error" => "Your account is currently disabled",
	"identifier" => "account_is_disabled"
	}
	end

	test "rejects token exchange for user with password_reset_pending set to true" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	password_reset_pending: true
	)

	app = insert(:oauth_app, scopes: ["read", "write"])

	resp =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(403)

	assert resp == %{
	"error" => "Password reset is required",
	"identifier" => "password_reset_required"
	}
	end

	test "rejects token exchange for user with confirmation_pending set to true" do
	clear_config([:instance, :account_activation_required], true)
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	is_confirmed: false
	)

	app = insert(:oauth_app, scopes: ["read", "write"])

	resp =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(403)

	assert resp == %{
	"error" => "Your login is missing a confirmed e-mail address",
	"identifier" => "missing_confirmed_email"
	}
	end

	test "rejects token exchange for valid credentials belonging to an unapproved user" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	is_approved: false
	)

	refute Pleroma.User.account_status(user) == :active

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects an invalid authorization code" do
	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => "Imobviouslyinvalid",
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = json_response(conn, 400)
	refute Map.has_key?(resp, "access_token")
	end
	end

	describe "POST /oauth/token - refresh token" do
	setup do: clear_config([:oauth2, :issue_new_refresh_token])

	test "issues a new access token with keep fresh token" do
	clear_config([:oauth2, :issue_new_refresh_token], true)
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	new_token = Repo.get_by(Token, token: response["access_token"])
	assert new_token.refresh_token == token.refresh_token
	assert new_token.scopes == auth.scopes
	assert new_token.user_id == user.id
	assert new_token.app_id == app.id
	end

	test "issues a new access token with new fresh token" do
	clear_config([:oauth2, :issue_new_refresh_token], false)
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	new_token = Repo.get_by(Token, token: response["access_token"])
	refute new_token.refresh_token == token.refresh_token
	assert new_token.scopes == auth.scopes
	assert new_token.user_id == user.id
	assert new_token.app_id == app.id
	end

	test "returns 400 if we try use access token" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(400)

	assert %{"error" => "Invalid credentials"} == response
	end

	test "returns 400 if refresh_token invalid" do
	app = insert(:oauth_app, scopes: ["read", "write"])

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => "token.refresh_token",
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(400)

	assert %{"error" => "Invalid credentials"} == response
	end

	test "issues a new token if token expired" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	change =
	Ecto.Changeset.change(
	token,
	%{valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), -86_400 * 30)}
	)

	{:ok, access_token} = Repo.update(change)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => access_token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	token = Repo.get_by(Token, token: response["access_token"])
	assert token
	assert token.scopes == auth.scopes
	assert token.user_id == user.id
	assert token.app_id == app.id
	end
	end

	describe "POST /oauth/token - bad request" do
	test "returns 500" do
	response =
	build_conn()
	\|> post("/oauth/token", %{})
	\|> json_response(500)

	assert %{"error" => "Bad request"} == response
	end
	end

	describe "POST /oauth/revoke" do
	test "when authenticated with request token, revokes it and clears it from session" do
	oauth_token = insert(:oauth_token)

	conn =
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	\|> AuthHelper.put_session_token(oauth_token.token)
	\|> post("/oauth/revoke", %{"token" => oauth_token.token})

	assert json_response(conn, 200)

	refute AuthHelper.get_session_token(conn)
	assert Token.get_by_token(oauth_token.token) == {:error, :not_found}
	end

	test "if request is authenticated with a different token, " <>
	"revokes requested token but keeps session token" do
	user = insert(:user)
	oauth_token = insert(:oauth_token, user: user)
	other_app_oauth_token = insert(:oauth_token, user: user)

	conn =
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	\|> AuthHelper.put_session_token(oauth_token.token)
	\|> post("/oauth/revoke", %{"token" => other_app_oauth_token.token})

	assert json_response(conn, 200)

	assert AuthHelper.get_session_token(conn) == oauth_token.token
	assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found}
	end

	test "returns 500 on bad request" do
	response =
	build_conn()
	\|> post("/oauth/revoke", %{})
	\|> json_response(500)

	assert %{"error" => "Bad request"} == response
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Thu, Oct 29, 7:20 PM (1 d, 22 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1798557
Default Alt Text: (100 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions