No OneTemporary
Actions

Authored By

Unknown

Size

74 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/oauth-registration-redirect_uris.fix b/changelog.d/oauth-registration-redirect_uris.fix
	index e69de29bb..76ace55df 100644
	--- a/changelog.d/oauth-registration-redirect_uris.fix
	+++ b/changelog.d/oauth-registration-redirect_uris.fix
	@@ -0,0 +1 @@
	+Fix OAuth app registration to accept `redirect_uris` as an array of strings (RFC 7591), while keeping backwards compatibility with string input.
	diff --git a/lib/pleroma/web/api_spec/operations/admin/o_auth_app_operation.ex b/lib/pleroma/web/api_spec/operations/admin/o_auth_app_operation.ex
	index 5d4306754..7d83066ca 100644
	--- a/lib/pleroma/web/api_spec/operations/admin/o_auth_app_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/admin/o_auth_app_operation.ex
	@@ -1,219 +1,223 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.Schemas.ApiError

	import Pleroma.Web.ApiSpec.Helpers

	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	def index_operation do
	%Operation{
	summary: "Retrieve a list of OAuth applications",
	tags: ["OAuth application management"],
	operationId: "AdminAPI.OAuthAppController.index",
	security: [%{"oAuth" => ["admin:write"]}],
	parameters: [
	Operation.parameter(:name, :query, %Schema{type: :string}, "App name"),
	Operation.parameter(:client_id, :query, %Schema{type: :string}, "Client ID"),
	Operation.parameter(:page, :query, %Schema{type: :integer, default: 1}, "Page"),
	Operation.parameter(
	:trusted,
	:query,
	%Schema{type: :boolean, default: false},
	"Trusted apps"
	),
	Operation.parameter(
	:page_size,
	:query,
	%Schema{type: :integer, default: 50},
	"Number of apps to return"
	)
	\| admin_api_params()
	],
	responses: %{
	200 =>
	Operation.response("List of apps", "application/json", %Schema{
	type: :object,
	properties: %{
	apps: %Schema{type: :array, items: oauth_app()},
	count: %Schema{type: :integer},
	page_size: %Schema{type: :integer}
	},
	example: %{
	"apps" => [
	%{
	"id" => 1,
	"name" => "App name",
	"client_id" => "yHoDSiWYp5mPV6AfsaVOWjdOyt5PhWRiafi6MRd1lSk",
	"client_secret" => "nLmis486Vqrv2o65eM9mLQx_m_4gH-Q6PcDpGIMl6FY",
	"redirect_uri" => "https://example.com/oauth-callback",
	"website" => "https://example.com",
	"trusted" => true
	}
	],
	"count" => 1,
	"page_size" => 50
	}
	})
	}
	}
	end

	def create_operation do
	%Operation{
	tags: ["OAuth application management"],
	summary: "Create an OAuth application",
	operationId: "AdminAPI.OAuthAppController.create",
	requestBody: request_body("Parameters", create_request()),
	parameters: admin_api_params(),
	security: [%{"oAuth" => ["admin:write"]}],
	responses: %{
	200 => Operation.response("App", "application/json", oauth_app()),
	400 => Operation.response("Bad Request", "application/json", ApiError)
	}
	}
	end

	def update_operation do
	%Operation{
	tags: ["OAuth application management"],
	summary: "Update OAuth application",
	operationId: "AdminAPI.OAuthAppController.update",
	parameters: [id_param() \| admin_api_params()],
	security: [%{"oAuth" => ["admin:write"]}],
	requestBody: request_body("Parameters", update_request()),
	responses: %{
	200 => Operation.response("App", "application/json", oauth_app()),
	400 =>
	Operation.response("Bad Request", "application/json", %Schema{
	oneOf: [ApiError, %Schema{type: :string}]
	})
	}
	}
	end

	def delete_operation do
	%Operation{
	tags: ["OAuth application management"],
	summary: "Delete OAuth application",
	operationId: "AdminAPI.OAuthAppController.delete",
	parameters: [id_param() \| admin_api_params()],
	security: [%{"oAuth" => ["admin:write"]}],
	responses: %{
	204 => no_content_response(),
	400 => no_content_response()
	}
	}
	end

	defp create_request do
	%Schema{
	title: "oAuthAppCreateRequest",
	type: :object,
	required: [:name, :redirect_uris],
	properties: %{
	name: %Schema{type: :string, description: "Application Name"},
	scopes: %Schema{type: :array, items: %Schema{type: :string}, description: "oAuth scopes"},
	redirect_uris: %Schema{
	- type: :array,
	- items: %Schema{type: :string},
	+ oneOf: [
	+ %Schema{type: :string},
	+ %Schema{type: :array, items: %Schema{type: :string}}
	+ ],
	description:
	"Where the user should be redirected after authorization. To display the authorization code to the user instead of redirecting to a web page, use `urn:ietf:wg:oauth:2.0:oob` in this parameter."
	},
	website: %Schema{
	type: :string,
	nullable: true,
	description: "A URL to the homepage of the app"
	},
	trusted: %Schema{
	type: :boolean,
	nullable: true,
	default: false,
	description: "Is the app trusted?"
	}
	},
	example: %{
	"name" => "My App",
	"redirect_uris" => ["https://myapp.com/auth/callback"],
	"website" => "https://myapp.com/",
	"scopes" => ["read", "write"],
	"trusted" => true
	}
	}
	end

	defp update_request do
	%Schema{
	title: "oAuthAppUpdateRequest",
	type: :object,
	properties: %{
	name: %Schema{type: :string, description: "Application Name"},
	scopes: %Schema{type: :array, items: %Schema{type: :string}, description: "oAuth scopes"},
	redirect_uris: %Schema{
	- type: :array,
	- items: %Schema{type: :string},
	+ oneOf: [
	+ %Schema{type: :string},
	+ %Schema{type: :array, items: %Schema{type: :string}}
	+ ],
	description:
	"Where the user should be redirected after authorization. To display the authorization code to the user instead of redirecting to a web page, use `urn:ietf:wg:oauth:2.0:oob` in this parameter."
	},
	website: %Schema{
	type: :string,
	nullable: true,
	description: "A URL to the homepage of the app"
	},
	trusted: %Schema{
	type: :boolean,
	nullable: true,
	default: false,
	description: "Is the app trusted?"
	}
	},
	example: %{
	"name" => "My App",
	"redirect_uris" => ["https://myapp.com/auth/callback"],
	"website" => "https://myapp.com/",
	"scopes" => ["read", "write"],
	"trusted" => true
	}
	}
	end

	defp oauth_app do
	%Schema{
	title: "oAuthApp",
	type: :object,
	properties: %{
	id: %Schema{type: :integer},
	name: %Schema{type: :string},
	client_id: %Schema{type: :string},
	client_secret: %Schema{type: :string},
	redirect_uri: %Schema{type: :string},
	website: %Schema{type: :string, nullable: true},
	trusted: %Schema{type: :boolean}
	},
	example: %{
	"id" => 123,
	"name" => "My App",
	"client_id" => "TWhM-tNSuncnqN7DBJmoyeLnk6K3iJJ71KKXxgL1hPM",
	"client_secret" => "ZEaFUFmF0umgBX1qKJDjaU99Q31lDkOU8NutzTOoliw",
	"redirect_uri" => "https://myapp.com/oauth-callback",
	"website" => "https://myapp.com/",
	"trusted" => false
	}
	}
	end

	def id_param do
	Operation.parameter(:id, :path, :integer, "App ID",
	example: 1337,
	required: true
	)
	end
	end
	diff --git a/lib/pleroma/web/api_spec/operations/app_operation.ex b/lib/pleroma/web/api_spec/operations/app_operation.ex
	index dfa2237c0..71c15a665 100644
	--- a/lib/pleroma/web/api_spec/operations/app_operation.ex
	+++ b/lib/pleroma/web/api_spec/operations/app_operation.ex
	@@ -1,123 +1,126 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.ApiSpec.AppOperation do
	alias OpenApiSpex.Operation
	alias OpenApiSpex.Schema
	alias Pleroma.Web.ApiSpec.Helpers
	alias Pleroma.Web.ApiSpec.Schemas.App

	@spec open_api_operation(atom) :: Operation.t()
	def open_api_operation(action) do
	operation = String.to_existing_atom("#{action}_operation")
	apply(__MODULE__, operation, [])
	end

	@spec create_operation() :: Operation.t()
	def create_operation do
	%Operation{
	tags: ["Applications"],
	summary: "Create an application",
	description: "Create a new application to obtain OAuth2 credentials",
	operationId: "AppController.create",
	requestBody: Helpers.request_body("Parameters", create_request(), required: true),
	responses: %{
	200 => Operation.response("App", "application/json", App),
	422 =>
	Operation.response(
	"Unprocessable Entity",
	"application/json",
	%Schema{
	type: :object,
	description:
	"If a required parameter is missing or improperly formatted, the request will fail.",
	properties: %{
	error: %Schema{type: :string}
	},
	example: %{
	"error" => "Validation failed: Redirect URI must be an absolute URI."
	}
	}
	)
	}
	}
	end

	def verify_credentials_operation do
	%Operation{
	tags: ["Applications"],
	summary: "Verify the application works",
	description: "Confirm that the app's OAuth2 credentials work.",
	operationId: "AppController.verify_credentials",
	security: [%{"oAuth" => ["read"]}],
	responses: %{
	200 =>
	Operation.response("App", "application/json", %Schema{
	type: :object,
	description:
	"If the Authorization header was provided with a valid token, you should see your app returned as an Application entity.",
	properties: %{
	name: %Schema{type: :string},
	vapid_key: %Schema{type: :string},
	website: %Schema{type: :string, nullable: true}
	},
	example: %{
	"name" => "My App",
	"vapid_key" =>
	"BCk-QqERU0q-CfYZjcuB6lnyyOYfJ2AifKqfeGIm7Z-HiTU5T9eTG5GxVA0_OH5mMlI4UkkDTpaZwozy0TzdZ2M=",
	"website" => "https://myapp.com/"
	}
	}),
	422 =>
	Operation.response(
	"Unauthorized",
	"application/json",
	%Schema{
	type: :object,
	description:
	"If the Authorization header contains an invalid token, is malformed, or is not present, an error will be returned indicating an authorization failure.",
	properties: %{
	error: %Schema{type: :string}
	},
	example: %{
	"error" => "The access token is invalid."
	}
	}
	)
	}
	}
	end

	defp create_request do
	%Schema{
	title: "AppCreateRequest",
	description: "POST body for creating an app",
	type: :object,
	properties: %{
	client_name: %Schema{type: :string, description: "A name for your application."},
	redirect_uris: %Schema{
	- type: :string,
	+ oneOf: [
	+ %Schema{type: :string},
	+ %Schema{type: :array, items: %Schema{type: :string}}
	+ ],
	description:
	"Where the user should be redirected after authorization. To display the authorization code to the user instead of redirecting to a web page, use `urn:ietf:wg:oauth:2.0:oob` in this parameter."
	},
	scopes: %Schema{
	type: :string,
	description: "Space separated list of scopes",
	default: "read"
	},
	website: %Schema{
	type: :string,
	nullable: true,
	description: "A URL to the homepage of your app"
	}
	},
	required: [:client_name, :redirect_uris],
	example: %{
	"client_name" => "My App",
	"redirect_uris" => "https://myapp.com/auth/callback",
	"website" => "https://myapp.com/"
	}
	}
	end
	end
	diff --git a/lib/pleroma/web/o_auth/app.ex b/lib/pleroma/web/o_auth/app.ex
	index f1145d500..a2841b2bb 100644
	--- a/lib/pleroma/web/o_auth/app.ex
	+++ b/lib/pleroma/web/o_auth/app.ex
	@@ -1,184 +1,207 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.App do
	use Ecto.Schema
	import Ecto.Changeset
	import Ecto.Query
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.OAuth.Token

	@type t :: %__MODULE__{}

	schema "apps" do
	field(:client_name, :string)
	- field(:redirect_uris, {:array, :string})
	+ field(:redirect_uris, :string)
	field(:scopes, {:array, :string}, default: [])
	field(:website, :string)
	field(:client_id, :string)
	field(:client_secret, :string)
	field(:trusted, :boolean, default: false)

	belongs_to(:user, User, type: FlakeId.Ecto.CompatType)

	has_many(:oauth_authorizations, Pleroma.Web.OAuth.Authorization, on_delete: :delete_all)
	has_many(:oauth_tokens, Pleroma.Web.OAuth.Token, on_delete: :delete_all)

	timestamps()
	end

	@spec changeset(t(), map()) :: Ecto.Changeset.t()
	def changeset(struct, params) do
	+ params = normalize_redirect_uris_param(params)
	+
	cast(struct, params, [:client_name, :redirect_uris, :scopes, :website, :trusted, :user_id])
	end

	+ defp normalize_redirect_uris_param(%{} = params) do
	+ case params do
	+ %{redirect_uris: redirect_uris} when is_list(redirect_uris) ->
	+ Map.put(params, :redirect_uris, normalize_redirect_uris(redirect_uris))
	+
	+ %{"redirect_uris" => redirect_uris} when is_list(redirect_uris) ->
	+ Map.put(params, "redirect_uris", normalize_redirect_uris(redirect_uris))
	+
	+ _ ->
	+ params
	+ end
	+ end
	+
	+ defp normalize_redirect_uris(redirect_uris) when is_list(redirect_uris) do
	+ redirect_uris
	+ \|> Enum.filter(&is_binary/1)
	+ \|> Enum.map(&String.trim/1)
	+ \|> Enum.reject(&(&1 == ""))
	+ \|> Enum.join("\n")
	+ end
	+
	@spec register_changeset(t(), map()) :: Ecto.Changeset.t()
	def register_changeset(struct, params \\ %{}) do
	changeset =
	struct
	\|> changeset(params)
	\|> validate_required([:client_name, :redirect_uris, :scopes])

	if changeset.valid? do
	changeset
	\|> put_change(
	:client_id,
	:crypto.strong_rand_bytes(32) \|> Base.url_encode64(padding: false)
	)
	\|> put_change(
	:client_secret,
	:crypto.strong_rand_bytes(32) \|> Base.url_encode64(padding: false)
	)
	else
	changeset
	end
	end

	@spec create(map()) :: {:ok, t()} \| {:error, Ecto.Changeset.t()}
	def create(params) do
	%__MODULE__{}
	\|> register_changeset(params)
	\|> Repo.insert()
	end

	@spec update(pos_integer(), map()) :: {:ok, t()} \| {:error, Ecto.Changeset.t()} \| nil
	def update(id, params) do
	with %__MODULE__{} = app <- Repo.get(__MODULE__, id) do
	app
	\|> changeset(params)
	\|> Repo.update()
	end
	end

	@doc """
	Gets app by attrs or create new with attrs.
	And updates the scopes if need.
	"""
	@spec get_or_make(map(), list(String.t())) :: {:ok, t()} \| {:error, Ecto.Changeset.t()}
	def get_or_make(attrs, scopes) do
	with %__MODULE__{} = app <- Repo.get_by(__MODULE__, attrs) do
	update_scopes(app, scopes)
	else
	_e ->
	%__MODULE__{}
	\|> register_changeset(Map.put(attrs, :scopes, scopes))
	\|> Repo.insert()
	end
	end

	defp update_scopes(%__MODULE__{} = app, []), do: {:ok, app}
	defp update_scopes(%__MODULE__{scopes: scopes} = app, scopes), do: {:ok, app}

	defp update_scopes(%__MODULE__{} = app, scopes) do
	app
	\|> change(%{scopes: scopes})
	\|> Repo.update()
	end

	@spec search(map()) :: {:ok, [t()], non_neg_integer()}
	def search(params) do
	query = from(a in __MODULE__)

	query =
	if params[:client_name] do
	from(a in query, where: a.client_name == ^params[:client_name])
	else
	query
	end

	query =
	if params[:client_id] do
	from(a in query, where: a.client_id == ^params[:client_id])
	else
	query
	end

	query =
	if Map.has_key?(params, :trusted) do
	from(a in query, where: a.trusted == ^params[:trusted])
	else
	query
	end

	query =
	from(u in query,
	limit: ^params[:page_size],
	offset: ^((params[:page] - 1) * params[:page_size])
	)

	count = Repo.aggregate(__MODULE__, :count, :id)

	{:ok, Repo.all(query), count}
	end

	@spec get_user_apps(User.t()) :: {:ok, [t()], non_neg_integer()}
	def get_user_apps(%User{id: user_id}) do
	from(a in __MODULE__, where: a.user_id == ^user_id)
	\|> Repo.all()
	end

	@spec destroy(pos_integer()) :: {:ok, t()} \| {:error, Ecto.Changeset.t()}
	def destroy(id) do
	with %__MODULE__{} = app <- Repo.get(__MODULE__, id) do
	Repo.delete(app)
	end
	end

	@spec errors(Ecto.Changeset.t()) :: map()
	def errors(changeset) do
	Enum.reduce(changeset.errors, %{}, fn
	{:client_name, {error, _}}, acc ->
	Map.put(acc, :name, error)

	{key, {error, _}}, acc ->
	Map.put(acc, key, error)
	end)
	end

	@spec maybe_update_owner(Token.t()) :: :ok
	def maybe_update_owner(%Token{app_id: app_id, user_id: user_id}) when not is_nil(user_id) do
	__MODULE__.update(app_id, %{user_id: user_id})

	:ok
	end

	def maybe_update_owner(_), do: :ok

	@spec remove_orphans(pos_integer()) :: :ok
	def remove_orphans(limit \\ 100) do
	fifteen_mins_ago = DateTime.add(DateTime.utc_now(), -900, :second)

	Repo.transaction(fn ->
	from(a in __MODULE__,
	where: is_nil(a.user_id) and a.inserted_at < ^fifteen_mins_ago,
	limit: ^limit
	)
	\|> Repo.all()
	\|> Enum.each(&Repo.delete(&1))
	end)

	:ok
	end
	end
	diff --git a/test/pleroma/web/admin_api/controllers/o_auth_app_controller_test.exs b/test/pleroma/web/admin_api/controllers/o_auth_app_controller_test.exs
	index 10eefbeca..2c2d13bb7 100644
	--- a/test/pleroma/web/admin_api/controllers/o_auth_app_controller_test.exs
	+++ b/test/pleroma/web/admin_api/controllers/o_auth_app_controller_test.exs
	@@ -1,219 +1,241 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.AdminAPI.OAuthAppControllerTest do
	use Pleroma.Web.ConnCase, async: true
	use Oban.Testing, repo: Pleroma.Repo

	import Pleroma.Factory

	alias Pleroma.Web.Endpoint

	setup do
	admin = insert(:user, is_admin: true)
	token = insert(:oauth_admin_token, user: admin)

	conn =
	build_conn()
	\|> assign(:user, admin)
	\|> assign(:token, token)

	{:ok, %{admin: admin, token: token, conn: conn}}
	end

	describe "POST /api/pleroma/admin/oauth_app" do
	test "errors", %{conn: conn} do
	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/oauth_app", %{})
	\|> json_response_and_validate_schema(400)

	assert %{
	"error" => "Missing field: name. Missing field: redirect_uris."
	} = response
	end

	test "success", %{conn: conn} do
	base_url = Endpoint.url()
	app_name = "Trusted app"

	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/oauth_app", %{
	name: app_name,
	redirect_uris: base_url
	})
	\|> json_response_and_validate_schema(200)

	assert %{
	"client_id" => _,
	"client_secret" => _,
	"name" => ^app_name,
	"redirect_uri" => ^base_url,
	"trusted" => false
	} = response
	end

	+ test "success with redirect_uris array", %{conn: conn} do
	+ base_url = Endpoint.url()
	+ app_name = "Trusted app"
	+
	+ response =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/pleroma/admin/oauth_app", %{
	+ name: app_name,
	+ redirect_uris: [base_url]
	+ })
	+ \|> json_response_and_validate_schema(200)
	+
	+ assert %{
	+ "client_id" => _,
	+ "client_secret" => _,
	+ "name" => ^app_name,
	+ "redirect_uri" => ^base_url,
	+ "trusted" => false
	+ } = response
	+ end
	+
	test "with trusted", %{conn: conn} do
	base_url = Endpoint.url()
	app_name = "Trusted app"

	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/pleroma/admin/oauth_app", %{
	name: app_name,
	redirect_uris: base_url,
	trusted: true
	})
	\|> json_response_and_validate_schema(200)

	assert %{
	"client_id" => _,
	"client_secret" => _,
	"name" => ^app_name,
	"redirect_uri" => ^base_url,
	"trusted" => true
	} = response
	end
	end

	describe "GET /api/pleroma/admin/oauth_app" do
	setup do
	app = insert(:oauth_app)
	{:ok, app: app}
	end

	test "list", %{conn: conn} do
	response =
	conn
	\|> get("/api/pleroma/admin/oauth_app")
	\|> json_response_and_validate_schema(200)

	assert %{"apps" => apps, "count" => count, "page_size" => _} = response

	assert length(apps) == count
	end

	test "with page size", %{conn: conn} do
	insert(:oauth_app)
	page_size = 1

	response =
	conn
	\|> get("/api/pleroma/admin/oauth_app?page_size=#{page_size}")
	\|> json_response_and_validate_schema(200)

	assert %{"apps" => apps, "count" => _, "page_size" => ^page_size} = response

	assert length(apps) == page_size
	end

	test "search by client name", %{conn: conn, app: app} do
	response =
	conn
	\|> get("/api/pleroma/admin/oauth_app?name=#{app.client_name}")
	\|> json_response_and_validate_schema(200)

	assert %{"apps" => [returned], "count" => _, "page_size" => _} = response

	assert returned["client_id"] == app.client_id
	assert returned["name"] == app.client_name
	end

	test "search by client id", %{conn: conn, app: app} do
	response =
	conn
	\|> get("/api/pleroma/admin/oauth_app?client_id=#{app.client_id}")
	\|> json_response_and_validate_schema(200)

	assert %{"apps" => [returned], "count" => _, "page_size" => _} = response

	assert returned["client_id"] == app.client_id
	assert returned["name"] == app.client_name
	end

	test "only trusted", %{conn: conn} do
	app = insert(:oauth_app, trusted: true)

	response =
	conn
	\|> get("/api/pleroma/admin/oauth_app?trusted=true")
	\|> json_response_and_validate_schema(200)

	assert %{"apps" => [returned], "count" => _, "page_size" => _} = response

	assert returned["client_id"] == app.client_id
	assert returned["name"] == app.client_name
	end
	end

	describe "DELETE /api/pleroma/admin/oauth_app/:id" do
	test "with id", %{conn: conn} do
	app = insert(:oauth_app)

	response =
	conn
	\|> delete("/api/pleroma/admin/oauth_app/" <> to_string(app.id))
	\|> json_response_and_validate_schema(:no_content)

	assert response == ""
	end

	test "with nonexistent id", %{conn: conn} do
	response =
	conn
	\|> delete("/api/pleroma/admin/oauth_app/0")
	\|> json_response_and_validate_schema(:bad_request)

	assert response == ""
	end
	end

	describe "PATCH /api/pleroma/admin/oauth_app/:id" do
	test "with id", %{conn: conn} do
	app = insert(:oauth_app)

	name = "another name"
	url = "https://example.com"
	scopes = ["admin"]
	id = app.id
	website = "http://website.com"

	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> patch("/api/pleroma/admin/oauth_app/#{id}", %{
	name: name,
	trusted: true,
	redirect_uris: url,
	scopes: scopes,
	website: website
	})
	\|> json_response_and_validate_schema(200)

	assert %{
	"client_id" => _,
	"client_secret" => _,
	"id" => ^id,
	"name" => ^name,
	"redirect_uri" => ^url,
	"trusted" => true,
	"website" => ^website
	} = response
	end

	test "without id", %{conn: conn} do
	response =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> patch("/api/pleroma/admin/oauth_app/0")
	\|> json_response_and_validate_schema(:bad_request)

	assert response == ""
	end
	end
	end
	diff --git a/test/pleroma/web/mastodon_api/controllers/app_controller_test.exs b/test/pleroma/web/mastodon_api/controllers/app_controller_test.exs
	index bc9d4048c..45902d7d9 100644
	--- a/test/pleroma/web/mastodon_api/controllers/app_controller_test.exs
	+++ b/test/pleroma/web/mastodon_api/controllers/app_controller_test.exs
	@@ -1,92 +1,119 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.AppControllerTest do
	use Pleroma.Web.ConnCase, async: true

	alias Pleroma.Repo
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.Push

	import Pleroma.Factory

	test "apps/verify_credentials", %{conn: conn} do
	user_bound_token = insert(:oauth_token)
	app_bound_token = insert(:oauth_token, user: nil)
	refute app_bound_token.user

	for token <- [app_bound_token, user_bound_token] do
	conn =
	conn
	\|> put_req_header("authorization", "Bearer #{token.token}")
	\|> get("/api/v1/apps/verify_credentials")

	app = Repo.preload(token, :app).app

	expected = %{
	"name" => app.client_name,
	"website" => app.website,
	"vapid_key" => Push.vapid_config() \|> Keyword.get(:public_key)
	}

	assert expected == json_response_and_validate_schema(conn, 200)
	end
	end

	test "creates an oauth app", %{conn: conn} do
	app_attrs = build(:oauth_app)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> post("/api/v1/apps", %{
	client_name: app_attrs.client_name,
	redirect_uris: app_attrs.redirect_uris
	})

	[app] = Repo.all(App)

	expected = %{
	"name" => app.client_name,
	"website" => app.website,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret,
	"id" => app.id \|> to_string(),
	"redirect_uri" => app.redirect_uris,
	"vapid_key" => Push.vapid_config() \|> Keyword.get(:public_key)
	}

	assert expected == json_response_and_validate_schema(conn, 200)
	assert app.user_id == nil
	end

	+ test "creates an oauth app with redirect_uris array", %{conn: conn} do
	+ app_attrs = build(:oauth_app)
	+
	+ conn =
	+ conn
	+ \|> put_req_header("content-type", "application/json")
	+ \|> post("/api/v1/apps", %{
	+ client_name: app_attrs.client_name,
	+ redirect_uris: [app_attrs.redirect_uris]
	+ })
	+
	+ [app] = Repo.all(App)
	+
	+ expected = %{
	+ "name" => app.client_name,
	+ "website" => app.website,
	+ "client_id" => app.client_id,
	+ "client_secret" => app.client_secret,
	+ "id" => app.id \|> to_string(),
	+ "redirect_uri" => app.redirect_uris,
	+ "vapid_key" => Push.vapid_config() \|> Keyword.get(:public_key)
	+ }
	+
	+ assert expected == json_response_and_validate_schema(conn, 200)
	+ assert app.user_id == nil
	+ end
	+
	test "creates an oauth app with a user", %{conn: conn} do
	user = insert(:user)
	app_attrs = build(:oauth_app)

	conn =
	conn
	\|> put_req_header("content-type", "application/json")
	\|> assign(:user, user)
	\|> post("/api/v1/apps", %{
	client_name: app_attrs.client_name,
	redirect_uris: app_attrs.redirect_uris
	})

	[app] = Repo.all(App)

	expected = %{
	"name" => app.client_name,
	"website" => app.website,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret,
	"id" => app.id \|> to_string(),
	"redirect_uri" => app.redirect_uris,
	"vapid_key" => Push.vapid_config() \|> Keyword.get(:public_key)
	}

	assert expected == json_response_and_validate_schema(conn, 200)
	assert app.user_id == user.id
	end
	end
	diff --git a/test/pleroma/web/o_auth/app_test.exs b/test/pleroma/web/o_auth/app_test.exs
	index f90bee358..a69ba371e 100644
	--- a/test/pleroma/web/o_auth/app_test.exs
	+++ b/test/pleroma/web/o_auth/app_test.exs
	@@ -1,85 +1,85 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.AppTest do
	use Pleroma.DataCase, async: true

	alias Pleroma.Web.OAuth.App
	import Pleroma.Factory

	describe "get_or_make/2" do
	test "gets exist app" do
	- attrs = %{client_name: "Mastodon-Local", redirect_uris: ["."]}
	+ attrs = %{client_name: "Mastodon-Local", redirect_uris: "."}
	app = insert(:oauth_app, Map.merge(attrs, %{scopes: ["read", "write"]}))
	{:ok, %App{} = exist_app} = App.get_or_make(attrs, [])
	assert exist_app == app
	end

	test "make app" do
	- attrs = %{client_name: "Mastodon-Local", redirect_uris: ["."]}
	+ attrs = %{client_name: "Mastodon-Local", redirect_uris: "."}
	{:ok, %App{} = app} = App.get_or_make(attrs, ["write"])
	assert app.scopes == ["write"]
	end

	test "gets exist app and updates scopes" do
	- attrs = %{client_name: "Mastodon-Local", redirect_uris: ["."]}
	+ attrs = %{client_name: "Mastodon-Local", redirect_uris: "."}
	app = insert(:oauth_app, Map.merge(attrs, %{scopes: ["read", "write"]}))
	{:ok, %App{} = exist_app} = App.get_or_make(attrs, ["read", "write", "follow", "push"])
	assert exist_app.id == app.id
	assert exist_app.scopes == ["read", "write", "follow", "push"]
	end

	test "has unique client_id" do
	- insert(:oauth_app, client_name: "", redirect_uris: [""], client_id: "boop")
	+ insert(:oauth_app, client_name: "", redirect_uris: "", client_id: "boop")

	error =
	- catch_error(insert(:oauth_app, client_name: "", redirect_uris: [""], client_id: "boop"))
	+ catch_error(insert(:oauth_app, client_name: "", redirect_uris: "", client_id: "boop"))

	assert %Ecto.ConstraintError{} = error
	assert error.constraint == "apps_client_id_index"
	assert error.type == :unique
	end
	end

	test "get_user_apps/1" do
	user = insert(:user)

	apps = [
	insert(:oauth_app, user_id: user.id),
	insert(:oauth_app, user_id: user.id),
	insert(:oauth_app, user_id: user.id)
	]

	assert Enum.sort(App.get_user_apps(user)) == Enum.sort(apps)
	end

	test "removes orphaned apps" do
	- attrs = %{client_name: "Mastodon-Local", redirect_uris: ["."]}
	+ attrs = %{client_name: "Mastodon-Local", redirect_uris: "."}
	{:ok, %App{} = old_app} = App.get_or_make(attrs, ["write"])

	# backdate the old app so it's within the threshold for being cleaned up
	one_hour_ago = DateTime.add(DateTime.utc_now(), -3600)

	{:ok, _} =
	"UPDATE apps SET inserted_at = $1, updated_at = $1 WHERE id = $2"
	\|> Pleroma.Repo.query([one_hour_ago, old_app.id])

	# Create the new app after backdating the old one
	- attrs = %{client_name: "PleromaFE", redirect_uris: ["."]}
	+ attrs = %{client_name: "PleromaFE", redirect_uris: "."}
	{:ok, %App{} = app} = App.get_or_make(attrs, ["write"])

	# Ensure the new app has a recent timestamp
	now = DateTime.utc_now()

	{:ok, _} =
	"UPDATE apps SET inserted_at = $1, updated_at = $1 WHERE id = $2"
	\|> Pleroma.Repo.query([now, app.id])

	App.remove_orphans()

	assert [returned_app] = Pleroma.Repo.all(App)
	assert returned_app.client_name == "PleromaFE"
	assert returned_app.id == app.id
	end
	end
	diff --git a/test/pleroma/web/o_auth/o_auth_controller_test.exs b/test/pleroma/web/o_auth/o_auth_controller_test.exs
	index 3788b9c65..260442771 100644
	--- a/test/pleroma/web/o_auth/o_auth_controller_test.exs
	+++ b/test/pleroma/web/o_auth/o_auth_controller_test.exs
	@@ -1,1315 +1,1315 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthControllerTest do
	use Pleroma.Web.ConnCase

	import Pleroma.Factory

	alias Pleroma.Helpers.AuthHelper
	alias Pleroma.MFA
	alias Pleroma.MFA.TOTP
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.OAuthController
	alias Pleroma.Web.OAuth.Token

	@session_opts [
	store: :cookie,
	key: "_test",
	signing_salt: "cooldude"
	]
	setup do
	clear_config([:instance, :account_activation_required])
	clear_config([:instance, :account_approval_required])
	end

	describe "in OAuth consumer mode, " do
	setup do
	[
	app: insert(:oauth_app),
	conn:
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	setup do: clear_config([:auth, :oauth_consumer_strategies], ~w(twitter facebook))

	test "GET /oauth/authorize renders auth forms, including OAuth consumer form", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ "Sign in with Twitter"
	assert response =~ o_auth_path(conn, :prepare_request)
	end

	test "GET /oauth/prepare_request encodes parameters as `state` and redirects", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/prepare_request",
	%{
	"provider" => "twitter",
	"authorization" => %{
	"scope" => "read follow",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state"
	}
	}
	)

	assert html_response(conn, 302)

	redirect_query = URI.parse(redirected_to(conn)).query
	assert %{"state" => state_param} = URI.decode_query(redirect_query)
	assert {:ok, state_components} = Jason.decode(state_param)

	expected_client_id = app.client_id
	expected_redirect_uri = app.redirect_uris

	assert %{
	"scope" => "read follow",
	"client_id" => ^expected_client_id,
	"redirect_uri" => ^expected_redirect_uri,
	"state" => "a_state"
	} = state_components
	end

	test "with user-bound registration, GET /oauth/<provider>/callback redirects to `redirect_uri` with `code`",
	%{app: app, conn: conn} do
	registration = insert(:registration)
	redirect_uri = OAuthController.default_redirect_uri(app)

	state_params = %{
	"scope" => Enum.join(app.scopes, " "),
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => ""
	}

	conn =
	conn
	\|> assign(:ueberauth_auth, %{provider: registration.provider, uid: registration.uid})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Jason.encode!(state_params)
	}
	)

	assert html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with user-unbound registration, GET /oauth/<provider>/callback renders registration_details page",
	%{app: app, conn: conn} do
	user = insert(:user)

	state_params = %{
	"scope" => "read write",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state"
	}

	conn =
	conn
	\|> assign(:ueberauth_auth, %{
	provider: "twitter",
	uid: "171799000",
	info: %{nickname: user.nickname, email: user.email, name: user.name, description: nil}
	})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Jason.encode!(state_params)
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ ~r/name="op" type="submit" value="register"/
	assert response =~ ~r/name="op" type="submit" value="connect"/
	assert response =~ user.email
	assert response =~ user.nickname
	end

	test "on authentication error, GET /oauth/<provider>/callback redirects to `redirect_uri`", %{
	app: app,
	conn: conn
	} do
	state_params = %{
	"scope" => Enum.join(app.scopes, " "),
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => ""
	}

	conn =
	conn
	\|> assign(:ueberauth_failure, %{errors: [%{message: "(error description)"}]})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Jason.encode!(state_params)
	}
	)

	assert html_response(conn, 302)
	assert redirected_to(conn) == app.redirect_uris
	assert conn.assigns.flash["error"] == "Failed to authenticate: (error description)."
	end

	test "GET /oauth/registration_details renders registration details form", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/registration_details",
	%{
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"nickname" => nil,
	"email" => "john@doe.com"
	}
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ ~r/name="op" type="submit" value="register"/
	assert response =~ ~r/name="op" type="submit" value="connect"/
	end

	test "with valid params, POST /oauth/register?op=register redirects to `redirect_uri` with `code`",
	%{
	app: app,
	conn: conn
	} do
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "a_state",
	"nickname" => "availablenick",
	"email" => "available@email.com"
	}
	}
	)

	assert html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with unlisted `redirect_uri`, POST /oauth/register?op=register results in HTTP 401",
	%{
	app: app,
	conn: conn
	} do
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})
	unlisted_redirect_uri = "http://cross-site-request.com"

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "a_state",
	"nickname" => "availablenick",
	"email" => "available@email.com"
	}
	}
	)

	assert html_response(conn, 401)
	end

	test "with invalid params, POST /oauth/register?op=register renders registration_details page",
	%{
	app: app,
	conn: conn
	} do
	another_user = insert(:user)
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})

	params = %{
	"op" => "register",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"nickname" => "availablenickname",
	"email" => "available@email.com"
	}
	}

	for {bad_param, bad_param_value} <-
	[{"nickname", another_user.nickname}, {"email", another_user.email}] do
	bad_registration_attrs = %{
	"authorization" => Map.put(params["authorization"], bad_param, bad_param_value)
	}

	bad_params = Map.merge(params, bad_registration_attrs)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post("/oauth/register", bad_params)

	assert html_response(conn, 403) =~ ~r/name="op" type="submit" value="register"/
	assert conn.assigns.flash["error"] == "Error: #{bad_param} has already been taken."
	end
	end

	test "with valid params, POST /oauth/register?op=connect redirects to `redirect_uri` with `code`",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("testpassword"))
	registration = insert(:registration, user: nil)
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "testpassword"
	}
	}
	)

	assert html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{redirect_uri}\?code=.+/
	end

	test "with unlisted `redirect_uri`, POST /oauth/register?op=connect results in HTTP 401`",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt("testpassword"))
	registration = insert(:registration, user: nil)
	unlisted_redirect_uri = "http://cross-site-request.com"

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "testpassword"
	}
	}
	)

	assert html_response(conn, 401)
	end

	test "with invalid params, POST /oauth/register?op=connect renders registration_details page",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user)
	registration = insert(:registration, user: nil)

	params = %{
	"op" => "connect",
	"authorization" => %{
	"scopes" => app.scopes,
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "a_state",
	"name" => user.nickname,
	"password" => "wrong password"
	}
	}

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post("/oauth/register", params)

	assert html_response(conn, 401) =~ ~r/name="op" type="submit" value="connect"/
	assert conn.assigns.flash["error"] == "Invalid Username/Password"
	end
	end

	describe "GET /oauth/authorize" do
	setup do
	[
	- app: insert(:oauth_app, redirect_uris: ["https://redirect.url"]),
	+ app: insert(:oauth_app, redirect_uris: "https://redirect.url"),
	conn:
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	test "renders authentication page", %{app: app, conn: conn} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "properly handles internal calls with `authorization`-wrapped params", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"authorization" => %{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "renders authentication page if user is already authenticated but `force_login` is tru-ish",
	%{app: app, conn: conn} do
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read",
	"force_login" => "true"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "renders authentication page if user is already authenticated but user request with another client",
	%{
	app: app,
	conn: conn
	} do
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => "another_client_id",
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "with existing authentication and non-OOB `redirect_uri`, redirects to app with `token` and `state` params",
	%{
	app: app,
	conn: conn
	} do
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"state" => "specific_client_state",
	"scope" => "read"
	}
	)

	assert URI.decode(redirected_to(conn)) ==
	"https://redirect.url?access_token=#{token.token}&state=specific_client_state"
	end

	test "with existing authentication and unlisted non-OOB `redirect_uri`, redirects without credentials",
	%{
	app: app,
	conn: conn
	} do
	unlisted_redirect_uri = "http://cross-site-request.com"
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => unlisted_redirect_uri,
	"state" => "specific_client_state",
	"scope" => "read"
	}
	)

	assert redirected_to(conn) == unlisted_redirect_uri
	end

	test "with existing authentication and OOB `redirect_uri`, redirects to app with `token` and `state` params",
	%{
	app: app,
	conn: conn
	} do
	token = insert(:oauth_token, app: app)

	conn =
	conn
	\|> AuthHelper.put_session_token(token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => "urn:ietf:wg:oauth:2.0:oob",
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ "Authorization exists"
	end
	end

	describe "POST /oauth/authorize" do
	test "redirects with oauth authorization, " <>
	"granting requested app-supported scopes to both admin- and non-admin users" do
	app_scopes = ["read", "write", "admin", "secret_scope"]
	app = insert(:oauth_app, scopes: app_scopes)
	redirect_uri = OAuthController.default_redirect_uri(app)

	non_admin = insert(:user, is_admin: false)
	admin = insert(:user, is_admin: true)
	scopes_subset = ["read:subscope", "write", "admin"]

	# In case scope param is missing, expecting _all_ app-supported scopes to be granted
	for user <- [non_admin, admin],
	{requested_scopes, expected_scopes} <-
	%{scopes_subset => scopes_subset, nil: app_scopes} do
	conn =
	post(
	build_conn(),
	"/oauth/authorize",
	%{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"scope" => requested_scopes,
	"state" => "statepassed"
	}
	}
	)

	target = redirected_to(conn)
	assert target =~ redirect_uri

	query = URI.parse(target).query \|> URI.query_decoder() \|> Map.new()

	assert %{"state" => "statepassed", "code" => code} = query
	auth = Repo.get_by(Authorization, token: code)
	assert auth
	assert auth.scopes == expected_scopes
	end
	end

	test "authorize from cookie" do
	user = insert(:user)
	app = insert(:oauth_app)
	oauth_token = insert(:oauth_token, user: user, app: app)
	redirect_uri = OAuthController.default_redirect_uri(app)

	conn =
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	\|> AuthHelper.put_session_token(oauth_token.token)
	\|> post(
	"/oauth/authorize",
	%{
	"authorization" => %{
	"name" => user.nickname,
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"scope" => app.scopes,
	"state" => "statepassed"
	}
	}
	)

	target = redirected_to(conn)
	assert target =~ redirect_uri

	query = URI.parse(target).query \|> URI.query_decoder() \|> Map.new()

	assert %{"state" => "statepassed", "code" => code} = query
	auth = Repo.get_by(Authorization, token: code)
	assert auth
	assert auth.scopes == app.scopes
	end

	test "redirect to on two-factor auth page" do
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	app = insert(:oauth_app, scopes: ["read", "write", "follow"])

	conn =
	build_conn()
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read write",
	"state" => "statepassed"
	}
	})

	result = html_response(conn, 200)

	mfa_token = Repo.get_by(MFA.Token, user_id: user.id)
	assert result =~ app.redirect_uris
	assert result =~ "statepassed"
	assert result =~ mfa_token.token
	assert result =~ "Two-factor authentication"
	end

	test "returns 401 for wrong credentials", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app)
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "wrong",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => Enum.join(app.scopes, " ")
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "Invalid Username/Password"
	end

	test "returns 401 for missing scopes" do
	user = insert(:user, is_admin: false)
	app = insert(:oauth_app, scopes: ["read", "write", "admin"])
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	build_conn()
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => ""
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end

	test "returns 401 for scopes beyond app scopes hierarchy", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])
	redirect_uri = OAuthController.default_redirect_uri(app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => redirect_uri,
	"state" => "statepassed",
	"scope" => "read write follow"
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ redirect_uri

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end
	end

	describe "POST /oauth/token" do
	test "issues a token for an all-body request" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])

	# Verify app has no associated user yet
	assert %Pleroma.Web.OAuth.App{user_id: nil} = Repo.get_by(App, %{id: app.id})

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "me" => ap_id} = json_response(conn, 200)

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == auth.scopes
	assert user.ap_id == ap_id

	# Verify app has an associated user now
	user_id = user.id
	assert %Pleroma.Web.OAuth.App{user_id: ^user_id} = Repo.get_by(App, %{id: app.id})
	end

	test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do
	password = "testpassword"
	user = insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password))

	app = insert(:oauth_app, scopes: ["read", "write"])

	# Note: "scope" param is intentionally omitted
	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"id" => id, "access_token" => access_token} = json_response(conn, 200)

	token = Repo.get_by(Token, token: access_token)
	assert token
	assert token.id == id
	assert token.token == access_token
	assert token.scopes == app.scopes
	end

	test "issues a mfa token for `password` grant_type, when MFA enabled" do
	password = "testpassword"
	otp_secret = TOTP.generate_secret()

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	multi_factor_authentication_settings: %MFA.Settings{
	enabled: true,
	totp: %MFA.Settings.TOTP{secret: otp_secret, confirmed: true}
	}
	)

	app = insert(:oauth_app, scopes: ["read", "write"])

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(403)

	assert match?(
	%{
	"supported_challenge_types" => "totp",
	"mfa_token" => _,
	"error" => "mfa_required"
	},
	response
	)

	token = Repo.get_by(MFA.Token, token: response["mfa_token"])
	assert token.user_id == user.id
	assert token.authorization_id
	end

	test "issues a token for request with HTTP basic auth client credentials" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["scope1", "scope2", "scope3"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["scope1", "scope2"])
	assert auth.scopes == ["scope1", "scope2"]

	app_encoded =
	(URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
	\|> Base.encode64()

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic " <> app_encoded)
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app)
	})

	assert %{"access_token" => token, "scope" => scope} = json_response(conn, 200)

	assert scope == "scope1 scope2"

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == ["scope1", "scope2"]
	end

	test "issue a token for client_credentials grant type" do
	app = insert(:oauth_app, scopes: ["read", "write"])

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "client_credentials",
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "refresh_token" => refresh, "scope" => scope} =
	json_response(conn, 200)

	assert token
	token_from_db = Repo.get_by(Token, token: token)
	assert token_from_db
	assert refresh
	assert scope == "read write"
	end

	test "rejects token exchange with invalid client credentials" do
	user = insert(:user)
	app = insert(:oauth_app)

	{:ok, auth} = Authorization.create_authorization(app, user)

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => OAuthController.default_redirect_uri(app)
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
	clear_config([:instance, :account_activation_required], true)
	password = "testpassword"

	{:ok, user} =
	insert(:user, password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password))
	\|> User.confirmation_changeset(set_confirmation: false)
	\|> User.update_and_set_cache()

	refute Pleroma.User.account_status(user) == :active

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to deactivated user" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	is_active: false
	)

	app = insert(:oauth_app)

	resp =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(403)

	assert resp == %{
	"error" => "Your account is currently disabled",
	"identifier" => "account_is_disabled"
	}
	end

	test "rejects token exchange for user with password_reset_pending set to true" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	password_reset_pending: true
	)

	app = insert(:oauth_app, scopes: ["read", "write"])

	resp =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(403)

	assert resp == %{
	"error" => "Password reset is required",
	"identifier" => "password_reset_required"
	}
	end

	test "rejects token exchange for user with confirmation_pending set to true" do
	clear_config([:instance, :account_activation_required], true)
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	is_confirmed: false
	)

	app = insert(:oauth_app, scopes: ["read", "write"])

	resp =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(403)

	assert resp == %{
	"error" => "Your login is missing a confirmed e-mail address",
	"identifier" => "missing_confirmed_email"
	}
	end

	test "rejects token exchange for valid credentials belonging to an unapproved user" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Pleroma.Password.Pbkdf2.hash_pwd_salt(password),
	is_approved: false
	)

	refute Pleroma.User.account_status(user) == :active

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects an invalid authorization code" do
	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => "Imobviouslyinvalid",
	"redirect_uri" => OAuthController.default_redirect_uri(app),
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = json_response(conn, 400)
	refute Map.has_key?(resp, "access_token")
	end
	end

	describe "POST /oauth/token - refresh token" do
	setup do: clear_config([:oauth2, :issue_new_refresh_token])

	test "issues a new access token with keep fresh token" do
	clear_config([:oauth2, :issue_new_refresh_token], true)
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	new_token = Repo.get_by(Token, token: response["access_token"])
	assert new_token.refresh_token == token.refresh_token
	assert new_token.scopes == auth.scopes
	assert new_token.user_id == user.id
	assert new_token.app_id == app.id
	end

	test "issues a new access token with new fresh token" do
	clear_config([:oauth2, :issue_new_refresh_token], false)
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	new_token = Repo.get_by(Token, token: response["access_token"])
	refute new_token.refresh_token == token.refresh_token
	assert new_token.scopes == auth.scopes
	assert new_token.user_id == user.id
	assert new_token.app_id == app.id
	end

	test "returns 400 if we try use access token" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => token.token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(400)

	assert %{"error" => "Invalid credentials"} == response
	end

	test "returns 400 if refresh_token invalid" do
	app = insert(:oauth_app, scopes: ["read", "write"])

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => "token.refresh_token",
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(400)

	assert %{"error" => "Invalid credentials"} == response
	end

	test "issues a new token if token expired" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])
	{:ok, token} = Token.exchange_token(app, auth)

	change =
	Ecto.Changeset.change(
	token,
	%{valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), -86_400 * 30)}
	)

	{:ok, access_token} = Repo.update(change)

	response =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "refresh_token",
	"refresh_token" => access_token.refresh_token,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})
	\|> json_response(200)

	ap_id = user.ap_id

	assert match?(
	%{
	"scope" => "write",
	"token_type" => "Bearer",
	"access_token" => _,
	"refresh_token" => _,
	"me" => ^ap_id
	},
	response
	)

	refute Repo.get_by(Token, token: token.token)
	token = Repo.get_by(Token, token: response["access_token"])
	assert token
	assert token.scopes == auth.scopes
	assert token.user_id == user.id
	assert token.app_id == app.id
	end
	end

	describe "POST /oauth/token - bad request" do
	test "returns 500" do
	response =
	build_conn()
	\|> post("/oauth/token", %{})
	\|> json_response(500)

	assert %{"error" => "Bad request"} == response
	end
	end

	describe "POST /oauth/revoke" do
	test "when authenticated with request token, revokes it and clears it from session" do
	oauth_token = insert(:oauth_token)

	conn =
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	\|> AuthHelper.put_session_token(oauth_token.token)
	\|> post("/oauth/revoke", %{"token" => oauth_token.token})

	assert json_response(conn, 200)

	refute AuthHelper.get_session_token(conn)
	assert Token.get_by_token(oauth_token.token) == {:error, :not_found}
	end

	test "if request is authenticated with a different token, " <>
	"revokes requested token but keeps session token" do
	user = insert(:user)
	oauth_token = insert(:oauth_token, user: user)
	other_app_oauth_token = insert(:oauth_token, user: user)

	conn =
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	\|> AuthHelper.put_session_token(oauth_token.token)
	\|> post("/oauth/revoke", %{"token" => other_app_oauth_token.token})

	assert json_response(conn, 200)

	assert AuthHelper.get_session_token(conn) == oauth_token.token
	assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found}
	end

	test "returns 500 on bad request" do
	response =
	build_conn()
	\|> post("/oauth/revoke", %{})
	\|> json_response(500)

	assert %{"error" => "Bad request"} == response
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Fri, Oct 30, 4:16 AM (23 h, 40 s)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1799418
Default Alt Text: (74 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions