No OneTemporary
Actions

Authored By

Unknown

Size

29 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/mfa.ex b/lib/pleroma/mfa.ex
	index 2b77f5426..01b743f4f 100644
	--- a/lib/pleroma/mfa.ex
	+++ b/lib/pleroma/mfa.ex
	@@ -1,155 +1,155 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.MFA do
	@moduledoc """
	The MFA context.
	"""

	alias Pleroma.User

	alias Pleroma.MFA.BackupCodes
	alias Pleroma.MFA.Changeset
	alias Pleroma.MFA.Settings
	alias Pleroma.MFA.TOTP

	@doc """
	Returns MFA methods the user has enabled.

	## Examples

	iex> Pleroma.MFA.supported_method(User)
	"totp, u2f"
	"""
	@spec supported_methods(User.t()) :: String.t()
	def supported_methods(user) do
	settings = fetch_settings(user)

	Settings.mfa_methods()
	\|> Enum.reduce([], fn m, acc ->
	if method_enabled?(m, settings) do
	acc ++ [m]
	else
	acc
	end
	end)
	\|> Enum.join(",")
	end

	@doc "Checks that user enabled MFA"
	def require?(user) do
	fetch_settings(user).enabled
	end

	@doc """
	Display MFA settings of user
	"""
	def mfa_settings(user) do
	settings = fetch_settings(user)

	Settings.mfa_methods()
	\|> Enum.map(fn m -> [m, method_enabled?(m, settings)] end)
	\|> Enum.into(%{enabled: settings.enabled}, fn [a, b] -> {a, b} end)
	end

	@doc false
	def fetch_settings(%User{} = user) do
	user.multi_factor_authentication_settings \|\| %Settings{}
	end

	@doc "clears backup codes"
	def invalidate_backup_code(%User{} = user, hash_code) do
	%{backup_codes: codes} = fetch_settings(user)

	user
	\|> Changeset.cast_backup_codes(codes -- [hash_code])
	\|> User.update_and_set_cache()
	end

	@doc "generates backup codes"
	@spec generate_backup_codes(User.t()) :: {:ok, list(binary)} \| {:error, String.t()}
	def generate_backup_codes(%User{} = user) do
	with codes <- BackupCodes.generate(),
	hashed_codes <- Enum.map(codes, &Pbkdf2.hash_pwd_salt/1),
	changeset <- Changeset.cast_backup_codes(user, hashed_codes),
	{:ok, _} <- User.update_and_set_cache(changeset) do
	{:ok, codes}
	else
	{:error, msg} ->
	%{error: msg}
	end
	end

	@doc """
	Generates secret key and set delivery_type to 'app' for TOTP method.
	"""
	@spec setup_totp(User.t()) :: {:ok, User.t()} \| {:error, Ecto.Changeset.t()}
	def setup_totp(user) do
	user
	\|> Changeset.setup_totp(%{secret: TOTP.generate_secret(), delivery_type: "app"})
	\|> User.update_and_set_cache()
	end

	@doc """
	Confirms the TOTP method for user.

	`attrs`:
	`password` - current user password
	`code` - TOTP token
	"""
	@spec confirm_totp(User.t(), map()) :: {:ok, User.t()} \| {:error, Ecto.Changeset.t() \| atom()}
	def confirm_totp(%User{} = user, attrs) do
	with settings <- user.multi_factor_authentication_settings.totp,
	{:ok, :pass} <- TOTP.validate_token(settings.secret, attrs["code"]) do
	user
	\|> Changeset.confirm_totp()
	\|> User.update_and_set_cache()
	end
	end

	@doc """
	Disables the TOTP method for user.

	`attrs`:
	`password` - current user password
	"""
	@spec disable_totp(User.t()) :: {:ok, User.t()} \| {:error, Ecto.Changeset.t()}
	def disable_totp(%User{} = user) do
	user
	\|> Changeset.disable_totp()
	\|> Changeset.disable()
	\|> User.update_and_set_cache()
	end

	@doc """
	Force disables all MFA methods for user.
	"""
	@spec disable(User.t()) :: {:ok, User.t()} \| {:error, Ecto.Changeset.t()}
	def disable(%User{} = user) do
	user
	\|> Changeset.disable_totp()
	\|> Changeset.disable(true)
	\|> User.update_and_set_cache()
	end

	@doc """
	Checks if the user has MFA method enabled.
	"""
	def method_enabled?(method, settings) do
	with {:ok, %{confirmed: true} = _} <- Map.fetch(settings, method) do
	true
	else
	_ -> false
	end
	end

	@doc """
	Checks if the user has enabled at least one MFA method.
	"""
	def enabled?(settings) do
	Settings.mfa_methods()
	\|> Enum.map(fn m -> method_enabled?(m, settings) end)
	\|> Enum.any?()
	end
	end
	diff --git a/lib/pleroma/mfa/backup_codes.ex b/lib/pleroma/mfa/backup_codes.ex
	index 2b5ec34f8..9875310ff 100644
	--- a/lib/pleroma/mfa/backup_codes.ex
	+++ b/lib/pleroma/mfa/backup_codes.ex
	@@ -1,31 +1,31 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.MFA.BackupCodes do
	@moduledoc """
	This module contains functions for generating backup codes.
	"""
	alias Pleroma.Config

	@config_ns [:instance, :multi_factor_authentication, :backup_codes]

	@doc """
	Generates backup codes.
	"""
	@spec generate(Keyword.t()) :: list(String.t())
	def generate(opts \\ []) do
	number_of_codes = Keyword.get(opts, :number_of_codes, default_backup_codes_number())
	code_length = Keyword.get(opts, :length, default_backup_codes_code_length())

	Enum.map(1..number_of_codes, fn _ ->
	:crypto.strong_rand_bytes(div(code_length, 2))
	\|> Base.encode16(case: :lower)
	end)
	end

	defp default_backup_codes_number, do: Config.get(@config_ns ++ [:number], 5)

	defp default_backup_codes_code_length,
	do: Config.get(@config_ns ++ [:length], 16)
	end
	diff --git a/lib/pleroma/mfa/changeset.ex b/lib/pleroma/mfa/changeset.ex
	index 9b020aa8e..77c4fa202 100644
	--- a/lib/pleroma/mfa/changeset.ex
	+++ b/lib/pleroma/mfa/changeset.ex
	@@ -1,64 +1,64 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.MFA.Changeset do
	alias Pleroma.MFA
	alias Pleroma.MFA.Settings
	alias Pleroma.User

	def disable(%Ecto.Changeset{} = changeset, force \\ false) do
	settings =
	changeset
	\|> Ecto.Changeset.apply_changes()
	\|> MFA.fetch_settings()

	if force \|\| not MFA.enabled?(settings) do
	put_change(changeset, %Settings{settings \| enabled: false})
	else
	changeset
	end
	end

	def disable_totp(%User{multi_factor_authentication_settings: settings} = user) do
	user
	\|> put_change(%Settings{settings \| totp: %Settings.TOTP{}})
	end

	def confirm_totp(%User{multi_factor_authentication_settings: settings} = user) do
	totp_settings = %Settings.TOTP{settings.totp \| confirmed: true}

	user
	\|> put_change(%Settings{settings \| totp: totp_settings, enabled: true})
	end

	def setup_totp(%User{} = user, attrs) do
	mfa_settings = MFA.fetch_settings(user)

	totp_settings =
	%Settings.TOTP{}
	\|> Ecto.Changeset.cast(attrs, [:secret, :delivery_type])

	user
	\|> put_change(%Settings{mfa_settings \| totp: Ecto.Changeset.apply_changes(totp_settings)})
	end

	def cast_backup_codes(%User{} = user, codes) do
	user
	\|> put_change(%Settings{
	user.multi_factor_authentication_settings
	\| backup_codes: codes
	})
	end

	defp put_change(%User{} = user, settings) do
	user
	\|> Ecto.Changeset.change()
	\|> put_change(settings)
	end

	defp put_change(%Ecto.Changeset{} = changeset, settings) do
	changeset
	\|> Ecto.Changeset.put_change(:multi_factor_authentication_settings, settings)
	end
	end
	diff --git a/lib/pleroma/mfa/settings.ex b/lib/pleroma/mfa/settings.ex
	index 2764b889c..de6e2228f 100644
	--- a/lib/pleroma/mfa/settings.ex
	+++ b/lib/pleroma/mfa/settings.ex
	@@ -1,24 +1,24 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.MFA.Settings do
	use Ecto.Schema

	@primary_key false

	@mfa_methods [:totp]
	embedded_schema do
	field(:enabled, :boolean, default: false)
	field(:backup_codes, {:array, :string}, default: [])

	embeds_one :totp, TOTP, on_replace: :delete, primary_key: false do
	field(:secret, :string)
	# app \| sms
	field(:delivery_type, :string, default: "app")
	field(:confirmed, :boolean, default: false)
	end
	end

	def mfa_methods, do: @mfa_methods
	end
	diff --git a/lib/pleroma/mfa/token.ex b/lib/pleroma/mfa/token.ex
	index 25ff7fb29..0b2449971 100644
	--- a/lib/pleroma/mfa/token.ex
	+++ b/lib/pleroma/mfa/token.ex
	@@ -1,106 +1,106 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.MFA.Token do
	use Ecto.Schema
	import Ecto.Query
	import Ecto.Changeset

	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Token, as: OAuthToken

	@expires 300

	schema "mfa_tokens" do
	field(:token, :string)
	field(:valid_until, :naive_datetime_usec)

	belongs_to(:user, User, type: FlakeId.Ecto.CompatType)
	belongs_to(:authorization, Authorization)

	timestamps()
	end

	def get_by_token(token) do
	from(
	t in __MODULE__,
	where: t.token == ^token,
	preload: [:user, :authorization]
	)
	\|> Repo.find_resource()
	end

	def validate(token) do
	with {:fetch_token, {:ok, token}} <- {:fetch_token, get_by_token(token)},
	{:expired, false} <- {:expired, is_expired?(token)} do
	{:ok, token}
	else
	{:expired, _} -> {:error, :expired_token}
	{:fetch_token, _} -> {:error, :not_found}
	error -> {:error, error}
	end
	end

	def create_token(%User{} = user) do
	%__MODULE__{}
	\|> change
	\|> assign_user(user)
	\|> put_token
	\|> put_valid_until
	\|> Repo.insert()
	end

	def create_token(user, authorization) do
	%__MODULE__{}
	\|> change
	\|> assign_user(user)
	\|> assign_authorization(authorization)
	\|> put_token
	\|> put_valid_until
	\|> Repo.insert()
	end

	defp assign_user(changeset, user) do
	changeset
	\|> put_assoc(:user, user)
	\|> validate_required([:user])
	end

	defp assign_authorization(changeset, authorization) do
	changeset
	\|> put_assoc(:authorization, authorization)
	\|> validate_required([:authorization])
	end

	defp put_token(changeset) do
	changeset
	\|> change(%{token: OAuthToken.Utils.generate_token()})
	\|> validate_required([:token])
	\|> unique_constraint(:token)
	end

	defp put_valid_until(changeset) do
	expires_in = NaiveDateTime.add(NaiveDateTime.utc_now(), @expires)

	changeset
	\|> change(%{valid_until: expires_in})
	\|> validate_required([:valid_until])
	end

	def is_expired?(%__MODULE__{valid_until: valid_until}) do
	NaiveDateTime.diff(NaiveDateTime.utc_now(), valid_until) > 0
	end

	def is_expired?(_), do: false

	def delete_expired_tokens do
	from(
	q in __MODULE__,
	where: fragment("?", q.valid_until) < ^Timex.now()
	)
	\|> Repo.delete_all()
	end
	end
	diff --git a/lib/pleroma/mfa/totp.ex b/lib/pleroma/mfa/totp.ex
	index 1407afc57..d2ea2b3aa 100644
	--- a/lib/pleroma/mfa/totp.ex
	+++ b/lib/pleroma/mfa/totp.ex
	@@ -1,86 +1,86 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.MFA.TOTP do
	@moduledoc """
	This module represents functions to create secrets for
	TOTP Application as well as validate them with a time based token.
	"""
	alias Pleroma.Config

	@config_ns [:instance, :multi_factor_authentication, :totp]

	@doc """
	https://github.com/google/google-authenticator/wiki/Key-Uri-Format
	"""
	def provisioning_uri(secret, label, opts \\ []) do
	query =
	%{
	secret: secret,
	issuer: Keyword.get(opts, :issuer, default_issuer()),
	digits: Keyword.get(opts, :digits, default_digits()),
	period: Keyword.get(opts, :period, default_period())
	}
	\|> Enum.filter(fn {_, v} -> not is_nil(v) end)
	\|> Enum.into(%{})
	\|> URI.encode_query()

	%URI{scheme: "otpauth", host: "totp", path: "/" <> label, query: query}
	\|> URI.to_string()
	end

	defp default_period, do: Config.get(@config_ns ++ [:period])
	defp default_digits, do: Config.get(@config_ns ++ [:digits])

	defp default_issuer,
	do: Config.get(@config_ns ++ [:issuer], Config.get([:instance, :name]))

	@doc "Creates a random Base 32 encoded string"
	def generate_secret do
	Base.encode32(:crypto.strong_rand_bytes(10))
	end

	@doc "Generates a valid token based on a secret"
	def generate_token(secret) do
	:pot.totp(secret)
	end

	@doc """
	Validates a given token based on a secret.

	optional parameters:
	`token_length` default `6`
	`interval_length` default `30`
	`window` default 0

	Returns {:ok, :pass} if the token is valid and
	{:error, :invalid_token} if it is not.
	"""
	@spec validate_token(String.t(), String.t()) ::
	{:ok, :pass} \| {:error, :invalid_token \| :invalid_secret_and_token}
	def validate_token(secret, token)
	when is_binary(secret) and is_binary(token) do
	opts = [
	token_length: default_digits(),
	interval_length: default_period()
	]

	validate_token(secret, token, opts)
	end

	def validate_token(_, _), do: {:error, :invalid_secret_and_token}

	@doc "See `validate_token/2`"
	@spec validate_token(String.t(), String.t(), Keyword.t()) ::
	{:ok, :pass} \| {:error, :invalid_token \| :invalid_secret_and_token}
	def validate_token(secret, token, options)
	when is_binary(secret) and is_binary(token) do
	case :pot.valid_totp(token, secret, options) do
	true -> {:ok, :pass}
	false -> {:error, :invalid_token}
	end
	end

	def validate_token(_, _, _), do: {:error, :invalid_secret_and_token}
	end
	diff --git a/lib/pleroma/web/auth/totp_authenticator.ex b/lib/pleroma/web/auth/totp_authenticator.ex
	index ce8a76219..1794e407c 100644
	--- a/lib/pleroma/web/auth/totp_authenticator.ex
	+++ b/lib/pleroma/web/auth/totp_authenticator.ex
	@@ -1,45 +1,45 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.TOTPAuthenticator do
	alias Pleroma.MFA
	alias Pleroma.MFA.TOTP
	alias Pleroma.Plugs.AuthenticationPlug
	alias Pleroma.User

	@doc "Verify code or check backup code."
	@spec verify(String.t(), User.t()) ::
	{:ok, :pass} \| {:error, :invalid_token \| :invalid_secret_and_token}
	def verify(
	token,
	%User{
	multi_factor_authentication_settings:
	%{enabled: true, totp: %{secret: secret, confirmed: true}} = _
	} = _user
	)
	when is_binary(token) and byte_size(token) > 0 do
	TOTP.validate_token(secret, token)
	end

	def verify(_, _), do: {:error, :invalid_token}

	@spec verify_recovery_code(User.t(), String.t()) ::
	{:ok, :pass} \| {:error, :invalid_token}
	def verify_recovery_code(
	%User{multi_factor_authentication_settings: %{enabled: true, backup_codes: codes}} = user,
	code
	)
	when is_list(codes) and is_binary(code) do
	hash_code = Enum.find(codes, fn hash -> AuthenticationPlug.checkpw(code, hash) end)

	if hash_code do
	MFA.invalidate_backup_code(user, hash_code)
	{:ok, :pass}
	else
	{:error, :invalid_token}
	end
	end

	def verify_recovery_code(_, _), do: {:error, :invalid_token}
	end
	diff --git a/lib/pleroma/web/oauth/mfa_controller.ex b/lib/pleroma/web/oauth/mfa_controller.ex
	index e52cccd85..53e19f82e 100644
	--- a/lib/pleroma/web/oauth/mfa_controller.ex
	+++ b/lib/pleroma/web/oauth/mfa_controller.ex
	@@ -1,97 +1,97 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.MFAController do
	@moduledoc """
	The model represents api to use Multi Factor authentications.
	"""

	use Pleroma.Web, :controller

	alias Pleroma.MFA
	alias Pleroma.Web.Auth.TOTPAuthenticator
	alias Pleroma.Web.OAuth.MFAView, as: View
	alias Pleroma.Web.OAuth.OAuthController
	alias Pleroma.Web.OAuth.Token

	plug(:fetch_session when action in [:show, :verify])
	plug(:fetch_flash when action in [:show, :verify])

	@doc """
	Display form to input mfa code or recovery code.
	"""
	def show(conn, %{"mfa_token" => mfa_token} = params) do
	template = Map.get(params, "challenge_type", "totp")

	conn
	\|> put_view(View)
	\|> render("#{template}.html", %{
	mfa_token: mfa_token,
	redirect_uri: params["redirect_uri"],
	state: params["state"]
	})
	end

	@doc """
	Verification code and continue authorization.
	"""
	def verify(conn, %{"mfa" => %{"mfa_token" => mfa_token} = mfa_params} = _) do
	with {:ok, %{user: user, authorization: auth}} <- MFA.Token.validate(mfa_token),
	{:ok, _} <- validates_challenge(user, mfa_params) do
	conn
	\|> OAuthController.after_create_authorization(auth, %{
	"authorization" => %{
	"redirect_uri" => mfa_params["redirect_uri"],
	"state" => mfa_params["state"]
	}
	})
	else
	_ ->
	conn
	\|> put_flash(:error, "Two-factor authentication failed.")
	\|> put_status(:unauthorized)
	\|> show(mfa_params)
	end
	end

	@doc """
	Verification second step of MFA (or recovery) and returns access token.

	## Endpoint
	POST /oauth/mfa/challenge

	params:
	`client_id`
	`client_secret`
	`mfa_token` - access token to check second step of mfa
	`challenge_type` - 'totp' or 'recovery'
	`code`

	"""
	def challenge(conn, %{"mfa_token" => mfa_token} = params) do
	with {:ok, app} <- Token.Utils.fetch_app(conn),
	{:ok, %{user: user, authorization: auth}} <- MFA.Token.validate(mfa_token),
	{:ok, _} <- validates_challenge(user, params),
	{:ok, token} <- Token.exchange_token(app, auth) do
	json(conn, Token.Response.build(user, token))
	else
	_error ->
	conn
	\|> put_status(400)
	\|> json(%{error: "Invalid code"})
	end
	end

	# Verify TOTP Code
	defp validates_challenge(user, %{"challenge_type" => "totp", "code" => code} = _) do
	TOTPAuthenticator.verify(code, user)
	end

	# Verify Recovery Code
	defp validates_challenge(user, %{"challenge_type" => "recovery", "code" => code} = _) do
	TOTPAuthenticator.verify_recovery_code(user, code)
	end

	defp validates_challenge(_, _), do: {:error, :unsupported_challenge_type}
	end
	diff --git a/lib/pleroma/web/oauth/mfa_view.ex b/lib/pleroma/web/oauth/mfa_view.ex
	index e88e7066b..41d5578dc 100644
	--- a/lib/pleroma/web/oauth/mfa_view.ex
	+++ b/lib/pleroma/web/oauth/mfa_view.ex
	@@ -1,8 +1,8 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.MFAView do
	use Pleroma.Web, :view
	import Phoenix.HTML.Form
	end
	diff --git a/lib/pleroma/web/oauth/token/clean_worker.ex b/lib/pleroma/web/oauth/token/clean_worker.ex
	index 2c3bb9ded..e3aa4eb7e 100644
	--- a/lib/pleroma/web/oauth/token/clean_worker.ex
	+++ b/lib/pleroma/web/oauth/token/clean_worker.ex
	@@ -1,38 +1,38 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.Token.CleanWorker do
	@moduledoc """
	The module represents functions to clean an expired OAuth and MFA tokens.
	"""
	use GenServer

	@ten_seconds 10_000
	@one_day 86_400_000

	alias Pleroma.MFA
	alias Pleroma.Web.OAuth
	alias Pleroma.Workers.BackgroundWorker

	def start_link(_), do: GenServer.start_link(__MODULE__, %{})

	def init(_) do
	Process.send_after(self(), :perform, @ten_seconds)
	{:ok, nil}
	end

	@doc false
	def handle_info(:perform, state) do
	BackgroundWorker.enqueue("clean_expired_tokens", %{})
	interval = Pleroma.Config.get([:oauth2, :clean_expired_tokens_interval], @one_day)

	Process.send_after(self(), :perform, interval)
	{:noreply, state}
	end

	def perform(:clean) do
	OAuth.Token.delete_expired_tokens()
	MFA.Token.delete_expired_tokens()
	end
	end
	diff --git a/lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex b/lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex
	index eb9989cdf..b86791d09 100644
	--- a/lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex
	+++ b/lib/pleroma/web/pleroma_api/controllers/two_factor_authentication_controller.ex
	@@ -1,133 +1,133 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.PleromaAPI.TwoFactorAuthenticationController do
	@moduledoc "The module represents actions to manage MFA"
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper, only: [json_response: 3]

	alias Pleroma.MFA
	alias Pleroma.MFA.TOTP
	alias Pleroma.Plugs.OAuthScopesPlug
	alias Pleroma.Web.CommonAPI.Utils

	plug(OAuthScopesPlug, %{scopes: ["read:security"]} when action in [:settings])

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:security"]} when action in [:setup, :confirm, :disable, :backup_codes]
	)

	@doc """
	Gets user multi factor authentication settings

	## Endpoint
	GET /api/pleroma/accounts/mfa

	"""
	def settings(%{assigns: %{user: user}} = conn, _params) do
	json(conn, %{settings: MFA.mfa_settings(user)})
	end

	@doc """
	Prepare setup mfa method

	## Endpoint
	GET /api/pleroma/accounts/mfa/setup/[:method]

	"""
	def setup(%{assigns: %{user: user}} = conn, %{"method" => "totp"} = _params) do
	with {:ok, user} <- MFA.setup_totp(user),
	%{secret: secret} = _ <- user.multi_factor_authentication_settings.totp do
	provisioning_uri = TOTP.provisioning_uri(secret, "#{user.email}")

	json(conn, %{provisioning_uri: provisioning_uri, key: secret})
	else
	{:error, message} ->
	json_response(conn, :unprocessable_entity, %{error: message})
	end
	end

	def setup(conn, _params) do
	json_response(conn, :bad_request, %{error: "undefined method"})
	end

	@doc """
	Confirms setup and enable mfa method

	## Endpoint
	POST /api/pleroma/accounts/mfa/confirm/:method

	- params:
	`code` - confirmation code
	`password` - current password
	"""
	def confirm(
	%{assigns: %{user: user}} = conn,
	%{"method" => "totp", "password" => _, "code" => _} = params
	) do
	with {:ok, _user} <- Utils.confirm_current_password(user, params["password"]),
	{:ok, _user} <- MFA.confirm_totp(user, params) do
	json(conn, %{})
	else
	{:error, message} ->
	json_response(conn, :unprocessable_entity, %{error: message})
	end
	end

	def confirm(conn, _) do
	json_response(conn, :bad_request, %{error: "undefined mfa method"})
	end

	@doc """
	Disable mfa method and disable mfa if need.
	"""
	def disable(%{assigns: %{user: user}} = conn, %{"method" => "totp"} = params) do
	with {:ok, user} <- Utils.confirm_current_password(user, params["password"]),
	{:ok, _user} <- MFA.disable_totp(user) do
	json(conn, %{})
	else
	{:error, message} ->
	json_response(conn, :unprocessable_entity, %{error: message})
	end
	end

	def disable(%{assigns: %{user: user}} = conn, %{"method" => "mfa"} = params) do
	with {:ok, user} <- Utils.confirm_current_password(user, params["password"]),
	{:ok, _user} <- MFA.disable(user) do
	json(conn, %{})
	else
	{:error, message} ->
	json_response(conn, :unprocessable_entity, %{error: message})
	end
	end

	def disable(conn, _) do
	json_response(conn, :bad_request, %{error: "undefined mfa method"})
	end

	@doc """
	Generates backup codes.

	## Endpoint
	GET /api/pleroma/accounts/mfa/backup_codes

	## Response
	### Success
	`{codes: [codes]}`

	### Error
	`{error: [error_message]}`

	"""
	def backup_codes(%{assigns: %{user: user}} = conn, _params) do
	with {:ok, codes} <- MFA.generate_backup_codes(user) do
	json(conn, %{codes: codes})
	else
	{:error, message} ->
	json_response(conn, :unprocessable_entity, %{error: message})
	end
	end
	end
	diff --git a/test/web/auth/pleroma_authenticator_test.exs b/test/web/auth/pleroma_authenticator_test.exs
	index 731bd5932..1ba0dfecc 100644
	--- a/test/web/auth/pleroma_authenticator_test.exs
	+++ b/test/web/auth/pleroma_authenticator_test.exs
	@@ -1,48 +1,48 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.PleromaAuthenticatorTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.Web.Auth.PleromaAuthenticator
	import Pleroma.Factory

	setup do
	password = "testpassword"
	name = "AgentSmith"
	user = insert(:user, nickname: name, password_hash: Pbkdf2.hash_pwd_salt(password))
	{:ok, [user: user, name: name, password: password]}
	end

	test "get_user/authorization", %{name: name, password: password} do
	name = name <> "1"
	user = insert(:user, nickname: name, password_hash: Bcrypt.hash_pwd_salt(password))

	params = %{"authorization" => %{"name" => name, "password" => password}}
	res = PleromaAuthenticator.get_user(%Plug.Conn{params: params})

	assert {:ok, returned_user} = res
	assert returned_user.id == user.id
	assert "$pbkdf2" <> _ = returned_user.password_hash
	end

	test "get_user/authorization with invalid password", %{name: name} do
	params = %{"authorization" => %{"name" => name, "password" => "password"}}
	res = PleromaAuthenticator.get_user(%Plug.Conn{params: params})

	assert {:error, {:checkpw, false}} == res
	end

	test "get_user/grant_type_password", %{user: user, name: name, password: password} do
	params = %{"grant_type" => "password", "username" => name, "password" => password}
	res = PleromaAuthenticator.get_user(%Plug.Conn{params: params})

	assert {:ok, user} == res
	end

	test "error credintails" do
	res = PleromaAuthenticator.get_user(%Plug.Conn{params: %{}})
	assert {:error, :invalid_credentials} == res
	end
	end
	diff --git a/test/web/auth/totp_authenticator_test.exs b/test/web/auth/totp_authenticator_test.exs
	index e502e0ae8..84d4cd840 100644
	--- a/test/web/auth/totp_authenticator_test.exs
	+++ b/test/web/auth/totp_authenticator_test.exs
	@@ -1,51 +1,51 @@
	# Pleroma: A lightweight social networking server
	-# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	+# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.TOTPAuthenticatorTest do
	use Pleroma.Web.ConnCase

	alias Pleroma.MFA
	alias Pleroma.MFA.BackupCodes
	alias Pleroma.MFA.TOTP
	alias Pleroma.Web.Auth.TOTPAuthenticator

	import Pleroma.Factory

	test "verify token" do
	otp_secret = TOTP.generate_secret()
	otp_token = TOTP.generate_token(otp_secret)

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	assert TOTPAuthenticator.verify(otp_token, user) == {:ok, :pass}
	assert TOTPAuthenticator.verify(nil, user) == {:error, :invalid_token}
	assert TOTPAuthenticator.verify("", user) == {:error, :invalid_token}
	end

	test "checks backup codes" do
	[code \| _] = backup_codes = BackupCodes.generate()

	hashed_codes =
	backup_codes
	\|> Enum.map(&Pbkdf2.hash_pwd_salt(&1))

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	backup_codes: hashed_codes,
	totp: %MFA.Settings.TOTP{secret: "otp_secret", confirmed: true}
	}
	)

	assert TOTPAuthenticator.verify_recovery_code(user, code) == {:ok, :pass}
	refute TOTPAuthenticator.verify_recovery_code(code, refresh_record(user)) == {:ok, :pass}
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Thu, Oct 29, 1:44 PM (1 d, 5 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1798157
Default Alt Text: (29 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions