No OneTemporary
Actions

Authored By

Unknown

Size

31 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/changelog.d/oauth-user-preload.change b/changelog.d/oauth-user-preload.change
	new file mode 100644
	index 000000000..43f5ea06b
	--- /dev/null
	+++ b/changelog.d/oauth-user-preload.change
	@@ -0,0 +1 @@
	+Avoid a duplicate user query during OAuth authentication.
	diff --git a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	index 26e38aac8..6cd7469f9 100644
	--- a/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	+++ b/lib/pleroma/web/mastodon_api/controllers/status_controller.ex
	@@ -1,729 +1,732 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.MastodonAPI.StatusController do
	use Pleroma.Web, :controller

	import Pleroma.Web.ControllerHelper,
	only: [try_render: 3, add_link_headers: 2]

	require Ecto.Query
	require Pleroma.Constants

	alias Pleroma.Activity
	alias Pleroma.Bookmark
	alias Pleroma.BookmarkFolder
	alias Pleroma.Language.Translation
	alias Pleroma.Object
	alias Pleroma.Repo
	alias Pleroma.ScheduledActivity
	alias Pleroma.User
	alias Pleroma.Web.ActivityPub.ActivityPub
	alias Pleroma.Web.ActivityPub.Visibility
	alias Pleroma.Web.CommonAPI
	alias Pleroma.Web.MastodonAPI.AccountView
	alias Pleroma.Web.MastodonAPI.ScheduledActivityView
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.Plugs.OAuthScopesPlug
	alias Pleroma.Web.Plugs.RateLimiter

	plug(Pleroma.Web.ApiSpec.CastAndValidate, replace_params: false)

	plug(:skip_public_check when action in [:index, :show])

	@unauthenticated_access %{fallback: :proceed_unauthenticated, scopes: []}

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:statuses"]}
	when action in [
	:index,
	:show,
	:context,
	:show_history,
	:show_source,
	:quotes
	]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:statuses"]} when action == :translate)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:statuses"]}
	when action in [
	:create,
	:delete,
	:reblog,
	:unreblog,
	:update
	]
	)

	plug(OAuthScopesPlug, %{scopes: ["read:favourites"]} when action == :favourites)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:favourites"]} when action in [:favourite, :unfavourite]
	)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:mutes"]} when action in [:mute_conversation, :unmute_conversation]
	)

	plug(
	OAuthScopesPlug,
	%{@unauthenticated_access \| scopes: ["read:accounts"]}
	when action in [:favourited_by, :reblogged_by]
	)

	plug(OAuthScopesPlug, %{scopes: ["write:accounts"]} when action in [:pin, :unpin])

	plug(OAuthScopesPlug, %{scopes: ["read:bookmarks"]} when action == :bookmarks)

	plug(
	OAuthScopesPlug,
	%{scopes: ["write:bookmarks"]} when action in [:bookmark, :unbookmark]
	)

	@rate_limited_status_actions ~w(reblog unreblog favourite unfavourite create delete translate)a

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:reblog_unreblog", params: [:id]]
	when action in ~w(reblog unreblog)a
	)

	plug(
	RateLimiter,
	[name: :status_id_action, bucket_name: "status_id_action:fav_unfav", params: [:id]]
	when action in ~w(favourite unfavourite)a
	)

	plug(RateLimiter, [name: :statuses_actions] when action in @rate_limited_status_actions)

	action_fallback(Pleroma.Web.MastodonAPI.FallbackController)

	defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.StatusOperation

	@doc """
	GET `/api/v1/statuses?ids[]=1&ids[]=2`

	`ids` query param is required
	"""
	def index(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} =
	conn,
	_
	) do
	ids = Map.get(params, :id, Map.get(params, :ids))
	limit = 100

	activities =
	ids
	\|> Enum.take(limit)
	\|> Activity.all_by_ids_with_object()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))

	render(conn, "index.json",
	activities: activities,
	for: user,
	as: :activity,
	with_muted: Map.get(params, :with_muted, false)
	)
	end

	@doc """
	POST /api/v1/statuses
	"""
	# Creates a scheduled status when `scheduled_at` param is present and it's far enough
	def create(
	%{
	assigns: %{user: user},
	private: %{
	open_api_spex: %{body_params: %{status: _, scheduled_at: scheduled_at} = params}
	}
	} = conn,
	_
	)
	when not is_nil(scheduled_at) do
	params =
	Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	\|> put_application(conn)

	attrs = %{
	params: Map.new(params, fn {key, value} -> {to_string(key), value} end),
	scheduled_at: scheduled_at
	}

	with {:far_enough, true} <- {:far_enough, ScheduledActivity.far_enough?(scheduled_at)},
	{:ok, scheduled_activity} <- ScheduledActivity.create(user, attrs) do
	conn
	\|> put_view(ScheduledActivityView)
	\|> render("show.json", scheduled_activity: scheduled_activity)
	else
	{:far_enough, _} ->
	params = Map.drop(params, [:scheduled_at])

	put_in(
	conn,
	[Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
	params
	)
	\|> do_create

	error ->
	error
	end
	end

	# Creates a regular status
	def create(
	%{
	private: %{open_api_spex: %{body_params: %{status: _}}}
	} = conn,
	_
	) do
	do_create(conn)
	end

	def create(
	%{
	assigns: %{user: _user},
	private: %{open_api_spex: %{body_params: %{media_ids: _} = params}}
	} = conn,
	_
	) do
	params = Map.put(params, :status, "")

	put_in(
	conn,
	[Access.key(:private), Access.key(:open_api_spex), Access.key(:body_params)],
	params
	)
	\|> do_create
	end

	defp do_create(
	%{assigns: %{user: user}, private: %{open_api_spex: %{body_params: params}}} = conn
	) do
	params =
	Map.put(params, :in_reply_to_status_id, params[:in_reply_to_id])
	\|> put_application(conn)

	with {:ok, activity} <- CommonAPI.post(user, params) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	as: :activity,
	with_direct_conversation_id: true
	)
	else
	{:error, {:reject, message}} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})

	{:error, message} ->
	conn
	\|> put_status(:unprocessable_entity)
	\|> json(%{error: message})
	end
	end

	@doc "GET /api/v1/statuses/:id/history"
	def show_history(
	%{assigns: assigns, private: %{open_api_spex: %{params: %{id: id} = params}}} = conn,
	_
	) do
	with user = assigns[:user],
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "history.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "GET /api/v1/statuses/:id/source"
	def show_source(%{assigns: assigns, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with user = assigns[:user],
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "source.json",
	activity: activity,
	for: user
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "PUT /api/v1/statuses/:id"
	def update(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: body_params, params: %{id: id} = params}}
	} = conn,
	_
	) do
	with {_, %Activity{}} = {_, activity} <- {:activity, Activity.get_by_id_with_object(id)},
	{_, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	{_, true} <- {:is_create, activity.data["type"] == "Create"},
	actor <- Activity.user_actor(activity),
	{_, true} <- {:own_status, actor.id == user.id},
	changes <- body_params \|> put_application(conn),
	{_, {:ok, _update_activity}} <- {:pipeline, CommonAPI.update(activity, user, changes)},
	{_, %Activity{}} = {_, activity} <- {:refetched, Activity.get_by_id_with_object(id)} do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	{:own_status, _} -> {:error, :forbidden}
	{:pipeline, _} -> {:error, :internal_server_error}
	_ -> {:error, :not_found}
	end
	end

	@doc "GET /api/v1/statuses/:id"
	def show(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id} = params}}} =
	conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_muted: Map.get(params, :with_muted, false)
	)
	else
	_ -> {:error, :not_found}
	end
	end

	@doc "DELETE /api/v1/statuses/:id"
	def delete(%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn, _) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	# CommonAPI already checks whether user is allowed to delete
	{:ok, %Activity{}} <- CommonAPI.delete(id, user) do
	try_render(conn, "show.json",
	activity: activity,
	for: user,
	with_direct_conversation_id: true,
	with_source: true
	)
	else
	_e -> {:error, :not_found}
	end
	end

	@doc "POST /api/v1/statuses/:id/reblog"
	def reblog(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: params, params: %{id: ap_id_or_id}}}
	} = conn,
	_
	) do
	with {:ok, announce} <- CommonAPI.repeat(ap_id_or_id, user, params),
	# CommonAPI already checks whether user is allowed to reblog
	%Activity{} = announce <- Activity.normalize(announce.data) do
	try_render(conn, "show.json", %{activity: announce, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/unreblog"
	def unreblog(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	conn,
	_
	) do
	with {:ok, _unannounce} <- CommonAPI.unrepeat(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", %{activity: activity, for: user, as: :activity})
	end
	end

	@doc "POST /api/v1/statuses/:id/favourite"
	def favourite(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	conn,
	_
	) do
	with {:ok, _fav} <- CommonAPI.favorite(activity_id, user),
	# CommonAPI already checks whether user is allowed to reblog
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/unfavourite"
	def unfavourite(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: activity_id}}}} =
	conn,
	_
	) do
	with {:ok, _unfav} <- CommonAPI.unfavorite(activity_id, user),
	%Activity{} = activity <- Activity.get_by_id(activity_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	end
	end

	@doc "POST /api/v1/statuses/:id/pin"
	def pin(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
	conn,
	_
	) do
	with {:ok, activity} <- CommonAPI.pin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	# Order matters, if status is not owned by user and is not visible to user
	# return 404 just like other endpoints
	{:error, :pinned_statuses_limit_reached} ->
	{:error, "You have already pinned the maximum number of statuses"}

	{:error, :ownership_error} ->
	{:error, :unprocessable_entity, "Someone else's status cannot be pinned"}

	{:error, :visibility_error} ->
	{:error, :not_found, "Record not found"}

	{:error, :non_public_error} ->
	{:error, :unprocessable_entity, "Non-public status cannot be pinned"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/unpin"
	def unpin(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: ap_id_or_id}}}} =
	conn,
	_
	) do
	# CommonAPI already checks whether user can unpin
	with {:ok, activity} <- CommonAPI.unpin(ap_id_or_id, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	# Order matters, if status is not owned by user and is not visible to user
	# return 404 just like other endpoints
	{:error, :visibility_error} ->
	{:error, :not_found, "Record not found"}

	{:error, :ownership_error} ->
	{:error, :unprocessable_entity, "Someone else's status cannot be unpinned"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/bookmark"
	def bookmark(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: body_params, params: %{id: id}}}
	} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	folder_id <- Map.get(body_params, :folder_id, nil),
	folder_id <-
	if(folder_id && BookmarkFolder.belongs_to_user?(folder_id, user.id),
	do: folder_id,
	else: nil
	),
	{:ok, _bookmark} <- Bookmark.create(user.id, activity.id, folder_id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	false ->
	{:error, :not_found, "Record not found"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/unbookmark"
	def unbookmark(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	%User{} = user <- User.get_cached_by_nickname(user.nickname),
	true <- Visibility.visible_for_user?(activity, user),
	{:ok, _bookmark} <- Bookmark.destroy(user.id, activity.id) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	false ->
	{:error, :not_found, "Record not found"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/mute"
	def mute_conversation(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: params, params: %{id: id}}}
	} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	# CommonAPI already checks whether user is allowed to mute
	{:ok, activity} <- CommonAPI.add_mute(activity, user, params) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	{:error, :visibility_error} ->
	{:error, :not_found, "Record not found"}

	error ->
	error
	end
	end

	@doc "POST /api/v1/statuses/:id/unmute"
	def unmute_conversation(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{params: %{id: id}}}
	} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id(id),
	# CommonAPI already checks whether user is allowed to unmute
	{:ok, activity} <- CommonAPI.remove_mute(activity, user) do
	try_render(conn, "show.json", activity: activity, for: user, as: :activity)
	else
	{:error, :visibility_error} ->
	{:error, :not_found, "Record not found"}

	error ->
	error
	end
	end

	@doc "GET /api/v1/statuses/:id/favourited_by"
	def favourited_by(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	with true <- Pleroma.Config.get([:instance, :show_reactions]),
	%Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"likes" => likes}} <- Object.normalize(activity, fetch: false) do
	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^likes)
	\|> Ecto.Query.order_by([u], fragment("array_position(?, ?)", ^likes, u.ap_id))
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/reblogged_by"
	def reblogged_by(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id_with_object(id),
	{:visible, true} <- {:visible, Visibility.visible_for_user?(activity, user)},
	%Object{data: %{"announcements" => announces, "id" => ap_id}} <-
	Object.normalize(activity, fetch: false) do
	announces =
	"Announce"
	\|> Activity.Queries.by_type()
	\|> Ecto.Query.where([a], a.actor in ^announces)
	# this is to use the index
	\|> Activity.Queries.by_object_id(ap_id)
	\|> Repo.all()
	\|> Enum.filter(&Visibility.visible_for_user?(&1, user))
	\|> Enum.map(& &1.actor)
	\|> Enum.uniq()

	users =
	User
	\|> Ecto.Query.where([u], u.ap_id in ^announces)
	\|> Ecto.Query.order_by([u], fragment("array_position(?, ?)", ^announces, u.ap_id))
	\|> Repo.all()
	\|> Enum.filter(&(not User.blocks?(user, &1)))

	conn
	\|> put_view(AccountView)
	\|> render("index.json", for: user, users: users, as: :user)
	else
	{:visible, false} -> {:error, :not_found}
	_ -> json(conn, [])
	end
	end

	@doc "GET /api/v1/statuses/:id/context"
	def context(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id}}}} = conn,
	_
	) do
	with %Activity{} = activity <- Activity.get_by_id(id) do
	activities =
	ActivityPub.fetch_activities_for_context(activity.data["context"], %{
	blocking_user: user,
	user: user,
	exclude_id: activity.id
	})

	render(conn, "context.json", activity: activity, activities: activities, user: user)
	end
	end

	@doc "POST /api/v1/statuses/:id/translate"
	def translate(
	%{
	assigns: %{user: user},
	private: %{open_api_spex: %{body_params: params, params: %{id: status_id}}}
	} = conn,
	_
	) do
	with %Activity{object: object} <- Activity.get_by_id_with_object(status_id),
	{:visibility, visibility} when visibility in ["public", "unlisted"] <-
	{:visibility, Visibility.get_visibility(object)},
	{:language, language} when is_binary(language) <-
	{:language, Map.get(params, :lang) \|\| user.language},
	{:ok, result} <-
	Translation.translate(
	object.data["content"],
	object.data["language"],
	language
	) do
	render(conn, "translation.json", result)
	else
	{:language, nil} ->
	render_error(conn, :bad_request, "Language not specified")

	{:visibility, _} ->
	render_error(conn, :not_found, "Record not found")

	{:error, :not_found} ->
	render_error(conn, :not_found, "Translation service not configured")

	{:error, error} when error in [:unexpected_response, :quota_exceeded, :too_many_requests] ->
	render_error(conn, :service_unavailable, "Translation service not available")

	_ ->
	render_error(conn, :internal_server_error, "Translation failed")
	end
	end

	@doc "GET /api/v1/favourites"
	def favourites(
	%{assigns: %{user: %User{} = user}, private: %{open_api_spex: %{params: params}}} = conn,
	_
	) do
	activities = ActivityPub.fetch_favourites(user, params)

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	@doc "GET /api/v1/bookmarks"
	def bookmarks(%{assigns: %{user: user}, private: %{open_api_spex: %{params: params}}} = conn, _) do
	user = User.get_cached_by_id(user.id)
	folder_id = Map.get(params, :folder_id)

	bookmarks =
	user.id
	\|> Bookmark.for_user_query(folder_id)
	\|> Pleroma.Pagination.fetch_paginated(params)

	activities =
	bookmarks
	\|> Enum.map(fn b -> Map.put(b.activity, :bookmark, Map.delete(b, :activity)) end)

	conn
	\|> add_link_headers(bookmarks)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	end

	@doc "GET /api/v1/statuses/:id/quotes"
	def quotes(
	%{assigns: %{user: user}, private: %{open_api_spex: %{params: %{id: id} = params}}} =
	conn,
	_
	) do
	with %Activity{object: object} = activity <- Activity.get_by_id_with_object(id),
	true <- Visibility.visible_for_user?(activity, user) do
	params =
	params
	\|> Map.put(:type, "Create")
	\|> Map.put(:blocking_user, user)
	\|> Map.put(:quote_url, object.data["id"])

	recipients =
	if user do
	[Pleroma.Constants.as_public()] ++ [user.ap_id \| User.following(user)]
	else
	[Pleroma.Constants.as_public()]
	end

	activities =
	recipients
	\|> ActivityPub.fetch_activities(params)
	\|> Enum.reverse()

	conn
	\|> add_link_headers(activities)
	\|> render("index.json",
	activities: activities,
	for: user,
	as: :activity
	)
	else
	nil -> {:error, :not_found}
	false -> {:error, :not_found}
	end
	end

	- defp put_application(params, %{assigns: %{token: %Token{user: %User{} = user} = token}} = _conn) do
	+ defp put_application(
	+ params,
	+ %{assigns: %{token: %Token{} = token, user: %User{} = user}} = _conn
	+ ) do
	if user.disclose_client do
	%{client_name: client_name, website: website} = Repo.preload(token, :app).app
	Map.put(params, :generator, %{type: "Application", name: client_name, url: website})
	else
	Map.put(params, :generator, nil)
	end
	end

	defp put_application(params, _), do: Map.put(params, :generator, nil)
	end
	diff --git a/lib/pleroma/web/plugs/o_auth_plug.ex b/lib/pleroma/web/plugs/o_auth_plug.ex
	index 488968691..b59ac9d3e 100644
	--- a/lib/pleroma/web/plugs/o_auth_plug.ex
	+++ b/lib/pleroma/web/plugs/o_auth_plug.ex
	@@ -1,109 +1,109 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Plugs.OAuthPlug do
	@moduledoc "Performs OAuth authentication by token from params / headers / cookies."

	import Plug.Conn
	import Ecto.Query

	alias Pleroma.Helpers.AuthHelper
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Token

	@realm_reg Regex.compile!("Bearer\:?\s+(.*)$", "i")

	def init(options), do: options

	def call(%{assigns: %{user: %User{}}} = conn, _), do: conn

	def call(conn, _) do
	with {:ok, token_str} <- fetch_token_str(conn) do
	with {:ok, user, user_token} <- fetch_user_and_token(token_str),
	false <- Token.expired?(user_token) do
	conn
	\|> assign(:token, user_token)
	\|> assign(:user, user)
	else
	_ ->
	with {:ok, app, app_token} <- fetch_app_and_token(token_str),
	false <- Token.expired?(app_token) do
	conn
	\|> assign(:token, app_token)
	\|> assign(:app, app)
	else
	_ -> conn
	end
	end
	else
	_ -> conn
	end
	end

	# Gets user by token
	#
	@spec fetch_user_and_token(String.t()) :: {:ok, User.t(), Token.t()} \| nil
	defp fetch_user_and_token(token) do
	token_query =
	from(t in Token,
	where: t.token == ^token
	)

	- with %Token{user_id: user_id} = token_record <- Repo.one(token_query) \|> Repo.preload(:user),
	+ with %Token{user_id: user_id} = token_record <- Repo.one(token_query),
	false <- is_nil(user_id),
	%User{} = user <- User.get_cached_by_id(user_id) do
	{:ok, user, token_record}
	else
	_ -> nil
	end
	end

	@spec fetch_app_and_token(String.t()) :: {:ok, App.t(), Token.t()} \| nil
	defp fetch_app_and_token(token) do
	query =
	from(t in Token, where: t.token == ^token, join: app in assoc(t, :app), preload: [app: app])

	with %Token{app: app} = token_record <- Repo.one(query) do
	{:ok, app, token_record}
	end
	end

	# Gets token string from conn (in params / headers / session)
	#
	@spec fetch_token_str(Plug.Conn.t() \| list(String.t())) :: :no_token_found \| {:ok, String.t()}
	defp fetch_token_str(%Plug.Conn{params: %{"access_token" => access_token}} = _conn) do
	{:ok, access_token}
	end

	defp fetch_token_str(%Plug.Conn{} = conn) do
	headers = get_req_header(conn, "authorization")

	with {:ok, token} <- fetch_token_str(headers) do
	{:ok, token}
	else
	_ -> fetch_token_from_session(conn)
	end
	end

	defp fetch_token_str([token \| tail]) do
	trimmed_token = String.trim(token)

	case Regex.run(@realm_reg, trimmed_token) do
	[_, match] -> {:ok, String.trim(match)}
	_ -> fetch_token_str(tail)
	end
	end

	defp fetch_token_str([]), do: :no_token_found

	@spec fetch_token_from_session(Plug.Conn.t()) :: :no_token_found \| {:ok, String.t()}
	defp fetch_token_from_session(conn) do
	case AuthHelper.get_session_token(conn) do
	nil -> :no_token_found
	token -> {:ok, token}
	end
	end
	end
	diff --git a/test/pleroma/web/plugs/o_auth_plug_test.exs b/test/pleroma/web/plugs/o_auth_plug_test.exs
	index 8917eadd1..2509e4203 100644
	--- a/test/pleroma/web/plugs/o_auth_plug_test.exs
	+++ b/test/pleroma/web/plugs/o_auth_plug_test.exs
	@@ -1,128 +1,140 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2022 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Plugs.OAuthPlugTest do
	use Pleroma.Web.ConnCase, async: true

	alias Pleroma.Helpers.AuthHelper
	alias Pleroma.Web.OAuth.Token
	alias Pleroma.Web.OAuth.Token.Strategy.Revoke
	alias Pleroma.Web.Plugs.OAuthPlug
	alias Plug.Session

	import Pleroma.Factory

	setup %{conn: conn} do
	user = insert(:user)
	{:ok, oauth_token} = Token.create(insert(:oauth_app), user)
	%{user: user, token: oauth_token, conn: conn}
	end

	test "it does nothing if a user is assigned", %{conn: conn} do
	conn = assign(conn, :user, %Pleroma.User{})
	ret_conn = OAuthPlug.call(conn, %{})

	assert ret_conn == conn
	end

	test "with valid token (uppercase) in auth header, it assigns the user", %{conn: conn} = opts do
	conn =
	conn
	\|> put_req_header("authorization", "BEARER #{opts[:token].token}")
	\|> OAuthPlug.call(%{})

	assert conn.assigns[:user] == opts[:user]
	end

	test "with valid token (downcase) in auth header, it assigns the user", %{conn: conn} = opts do
	conn =
	conn
	\|> put_req_header("authorization", "bearer #{opts[:token].token}")
	\|> OAuthPlug.call(%{})

	assert conn.assigns[:user] == opts[:user]
	end

	+ test "with a valid token, it does not preload the duplicate user association", %{
	+ conn: conn,
	+ token: token
	+ } do
	+ conn =
	+ conn
	+ \|> put_req_header("authorization", "bearer #{token.token}")
	+ \|> OAuthPlug.call(%{})
	+
	+ assert %Ecto.Association.NotLoaded{} = conn.assigns.token.user
	+ end
	+
	test "with valid token (downcase) in url parameters, it assigns the user", opts do
	conn =
	:get
	\|> build_conn("/?access_token=#{opts[:token].token}")
	\|> put_req_header("content-type", "application/json")
	\|> fetch_query_params()
	\|> OAuthPlug.call(%{})

	assert conn.assigns[:user] == opts[:user]
	end

	test "with valid token (downcase) in body parameters, it assigns the user", opts do
	conn =
	:post
	\|> build_conn("/api/v1/statuses", access_token: opts[:token].token, status: "test")
	\|> OAuthPlug.call(%{})

	assert conn.assigns[:user] == opts[:user]
	end

	test "with invalid token, it does not assign the user", %{conn: conn} do
	conn =
	conn
	\|> put_req_header("authorization", "bearer TTTTT")
	\|> OAuthPlug.call(%{})

	refute conn.assigns[:user]
	end

	describe "with :oauth_token in session, " do
	setup %{token: oauth_token, conn: conn} do
	session_opts = [
	store: :cookie,
	key: "_test",
	signing_salt: "cooldude"
	]

	conn =
	conn
	\|> Session.call(Session.init(session_opts))
	\|> fetch_session()
	\|> AuthHelper.put_session_token(oauth_token.token)

	%{conn: conn}
	end

	test "if session-stored token matches a valid OAuth token, assigns :user and :token", %{
	conn: conn,
	user: user,
	token: oauth_token
	} do
	conn = OAuthPlug.call(conn, %{})

	assert conn.assigns.user && conn.assigns.user.id == user.id
	assert conn.assigns.token && conn.assigns.token.id == oauth_token.id
	end

	test "if session-stored token matches an expired OAuth token, does nothing", %{
	conn: conn,
	token: oauth_token
	} do
	expired_valid_until = NaiveDateTime.add(NaiveDateTime.utc_now(), -3600 * 24, :second)

	oauth_token
	\|> Ecto.Changeset.change(valid_until: expired_valid_until)
	\|> Pleroma.Repo.update()

	ret_conn = OAuthPlug.call(conn, %{})
	assert ret_conn == conn
	end

	test "if session-stored token matches a revoked OAuth token, does nothing", %{
	conn: conn,
	token: oauth_token
	} do
	Revoke.revoke(oauth_token)

	ret_conn = OAuthPlug.call(conn, %{})
	assert ret_conn == conn
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Fri, Oct 30, 7:54 PM (17 h, 35 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1800482
Default Alt Text: (31 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions