No OneTemporary
Actions

Authored By

Unknown

Size

58 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/lib/pleroma/web/auth/authenticator.ex b/lib/pleroma/web/auth/authenticator.ex
	index 89d88af32..b02f595dc 100644
	--- a/lib/pleroma/web/auth/authenticator.ex
	+++ b/lib/pleroma/web/auth/authenticator.ex
	@@ -1,45 +1,45 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.Authenticator do
	alias Pleroma.Registration
	alias Pleroma.User

	def implementation do
	Pleroma.Config.get(
	Pleroma.Web.Auth.Authenticator,
	Pleroma.Web.Auth.PleromaAuthenticator
	)
	end

	- @callback get_user(Plug.Conn.t(), Map.t()) :: {:ok, User.t()} \| {:error, any()}
	- def get_user(plug, params), do: implementation().get_user(plug, params)
	+ @callback get_user(Plug.Conn.t()) :: {:ok, User.t()} \| {:error, any()}
	+ def get_user(plug), do: implementation().get_user(plug)

	- @callback create_from_registration(Plug.Conn.t(), Map.t(), Registration.t()) ::
	+ @callback create_from_registration(Plug.Conn.t(), Registration.t()) ::
	{:ok, User.t()} \| {:error, any()}
	- def create_from_registration(plug, params, registration),
	- do: implementation().create_from_registration(plug, params, registration)
	+ def create_from_registration(plug, registration),
	+ do: implementation().create_from_registration(plug, registration)

	- @callback get_registration(Plug.Conn.t(), Map.t()) ::
	+ @callback get_registration(Plug.Conn.t()) ::
	{:ok, Registration.t()} \| {:error, any()}
	- def get_registration(plug, params),
	- do: implementation().get_registration(plug, params)
	+ def get_registration(plug), do: implementation().get_registration(plug)

	@callback handle_error(Plug.Conn.t(), any()) :: any()
	- def handle_error(plug, error), do: implementation().handle_error(plug, error)
	+ def handle_error(plug, error),
	+ do: implementation().handle_error(plug, error)

	@callback auth_template() :: String.t() \| nil
	def auth_template do
	# Note: `config :pleroma, :auth_template, "..."` support is deprecated
	implementation().auth_template() \|\|
	Pleroma.Config.get([:auth, :auth_template], Pleroma.Config.get(:auth_template)) \|\|
	"show.html"
	end

	@callback oauth_consumer_template() :: String.t() \| nil
	def oauth_consumer_template do
	implementation().oauth_consumer_template() \|\|
	Pleroma.Config.get([:auth, :oauth_consumer_template], "consumer.html")
	end
	end
	diff --git a/lib/pleroma/web/auth/ldap_authenticator.ex b/lib/pleroma/web/auth/ldap_authenticator.ex
	index 8b6d5a77f..363c99597 100644
	--- a/lib/pleroma/web/auth/ldap_authenticator.ex
	+++ b/lib/pleroma/web/auth/ldap_authenticator.ex
	@@ -1,150 +1,144 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.LDAPAuthenticator do
	alias Pleroma.User

	require Logger

	@behaviour Pleroma.Web.Auth.Authenticator
	@base Pleroma.Web.Auth.PleromaAuthenticator

	@connection_timeout 10_000
	@search_timeout 10_000

	- defdelegate get_registration(conn, params), to: @base
	+ defdelegate get_registration(conn), to: @base
	+ defdelegate create_from_registration(conn, registration), to: @base
	+ defdelegate handle_error(conn, error), to: @base
	+ defdelegate auth_template, to: @base
	+ defdelegate oauth_consumer_template, to: @base

	- defdelegate create_from_registration(conn, params, registration), to: @base
	-
	- def get_user(%Plug.Conn{} = conn, params) do
	+ def get_user(%Plug.Conn{} = conn) do
	if Pleroma.Config.get([:ldap, :enabled]) do
	{name, password} =
	- case params do
	+ case conn.params do
	%{"authorization" => %{"name" => name, "password" => password}} ->
	{name, password}

	%{"grant_type" => "password", "username" => name, "password" => password} ->
	{name, password}
	end

	case ldap_user(name, password) do
	%User{} = user ->
	{:ok, user}

	{:error, {:ldap_connection_error, _}} ->
	# When LDAP is unavailable, try default authenticator
	- @base.get_user(conn, params)
	+ @base.get_user(conn)

	error ->
	error
	end
	else
	# Fall back to default authenticator
	- @base.get_user(conn, params)
	+ @base.get_user(conn)
	end
	end

	- def handle_error(%Plug.Conn{} = _conn, error) do
	- error
	- end
	-
	- def auth_template, do: nil
	-
	- def oauth_consumer_template, do: nil
	-
	defp ldap_user(name, password) do
	ldap = Pleroma.Config.get(:ldap, [])
	host = Keyword.get(ldap, :host, "localhost")
	port = Keyword.get(ldap, :port, 389)
	ssl = Keyword.get(ldap, :ssl, false)
	sslopts = Keyword.get(ldap, :sslopts, [])

	options =
	[{:port, port}, {:ssl, ssl}, {:timeout, @connection_timeout}] ++
	if sslopts != [], do: [{:sslopts, sslopts}], else: []

	case :eldap.open([to_charlist(host)], options) do
	{:ok, connection} ->
	try do
	if Keyword.get(ldap, :tls, false) do
	:application.ensure_all_started(:ssl)

	case :eldap.start_tls(
	connection,
	Keyword.get(ldap, :tlsopts, []),
	@connection_timeout
	) do
	:ok ->
	:ok

	error ->
	Logger.error("Could not start TLS: #{inspect(error)}")
	end
	end

	bind_user(connection, ldap, name, password)
	after
	:eldap.close(connection)
	end

	{:error, error} ->
	Logger.error("Could not open LDAP connection: #{inspect(error)}")
	{:error, {:ldap_connection_error, error}}
	end
	end

	defp bind_user(connection, ldap, name, password) do
	uid = Keyword.get(ldap, :uid, "cn")
	base = Keyword.get(ldap, :base)

	case :eldap.simple_bind(connection, "#{uid}=#{name},#{base}", password) do
	:ok ->
	case User.get_by_nickname_or_email(name) do
	%User{} = user ->
	user

	_ ->
	register_user(connection, base, uid, name, password)
	end

	error ->
	error
	end
	end

	defp register_user(connection, base, uid, name, password) do
	case :eldap.search(connection, [
	{:base, to_charlist(base)},
	{:filter, :eldap.equalityMatch(to_charlist(uid), to_charlist(name))},
	{:scope, :eldap.wholeSubtree()},
	{:attributes, ['mail', 'email']},
	{:timeout, @search_timeout}
	]) do
	{:ok, {:eldap_search_result, [{:eldap_entry, _, attributes}], _}} ->
	with {_, [mail]} <- List.keyfind(attributes, 'mail', 0) do
	params = %{
	email: :erlang.list_to_binary(mail),
	name: name,
	nickname: name,
	password: password,
	password_confirmation: password
	}

	changeset = User.register_changeset(%User{}, params)

	case User.register(changeset) do
	{:ok, user} -> user
	error -> error
	end
	else
	_ ->
	Logger.error("Could not find LDAP attribute mail: #{inspect(attributes)}")
	{:error, :ldap_registration_missing_attributes}
	end

	error ->
	error
	end
	end
	end
	diff --git a/lib/pleroma/web/auth/pleroma_authenticator.ex b/lib/pleroma/web/auth/pleroma_authenticator.ex
	index c826adb4c..d647f1e05 100644
	--- a/lib/pleroma/web/auth/pleroma_authenticator.ex
	+++ b/lib/pleroma/web/auth/pleroma_authenticator.ex
	@@ -1,97 +1,100 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.Auth.PleromaAuthenticator do
	alias Comeonin.Pbkdf2
	alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.User

	@behaviour Pleroma.Web.Auth.Authenticator

	- def get_user(%Plug.Conn{} = _conn, params) do
	+ def get_user(%Plug.Conn{} = conn) do
	{name, password} =
	- case params do
	+ case conn.params do
	%{"authorization" => %{"name" => name, "password" => password}} ->
	{name, password}

	%{"grant_type" => "password", "username" => name, "password" => password} ->
	{name, password}
	end

	with {_, %User{} = user} <- {:user, User.get_by_nickname_or_email(name)},
	{_, true} <- {:checkpw, Pbkdf2.checkpw(password, user.password_hash)} do
	{:ok, user}
	else
	error ->
	{:error, error}
	end
	end

	- def get_registration(
	- %Plug.Conn{assigns: %{ueberauth_auth: %{provider: provider, uid: uid} = auth}},
	- _params
	- ) do
	+ def get_registration(%Plug.Conn{
	+ assigns: %{ueberauth_auth: %{provider: provider, uid: uid} = auth}
	+ }) do
	registration = Registration.get_by_provider_uid(provider, uid)

	if registration do
	{:ok, registration}
	else
	info = auth.info

	- Registration.changeset(%Registration{}, %{
	+ %Registration{}
	+ \|> Registration.changeset(%{
	provider: to_string(provider),
	uid: to_string(uid),
	info: %{
	"nickname" => info.nickname,
	"email" => info.email,
	"name" => info.name,
	"description" => info.description
	}
	})
	\|> Repo.insert()
	end
	end

	- def get_registration(%Plug.Conn{} = _conn, _params), do: {:error, :missing_credentials}
	+ def get_registration(%Plug.Conn{} = _conn), do: {:error, :missing_credentials}

	- def create_from_registration(_conn, params, registration) do
	- nickname = value([params["nickname"], Registration.nickname(registration)])
	- email = value([params["email"], Registration.email(registration)])
	- name = value([params["name"], Registration.name(registration)]) \|\| nickname
	- bio = value([params["bio"], Registration.description(registration)])
	+ def create_from_registration(
	+ %Plug.Conn{params: %{"authorization" => registration_attrs}},
	+ registration
	+ ) do
	+ nickname = value([registration_attrs["nickname"], Registration.nickname(registration)])
	+ email = value([registration_attrs["email"], Registration.email(registration)])
	+ name = value([registration_attrs["name"], Registration.name(registration)]) \|\| nickname
	+ bio = value([registration_attrs["bio"], Registration.description(registration)])

	random_password = :crypto.strong_rand_bytes(64) \|> Base.encode64()

	with {:ok, new_user} <-
	User.register_changeset(
	%User{},
	%{
	email: email,
	nickname: nickname,
	name: name,
	bio: bio,
	password: random_password,
	password_confirmation: random_password
	},
	external: true,
	confirmed: true
	)
	\|> Repo.insert(),
	{:ok, _} <-
	Registration.changeset(registration, %{user_id: new_user.id}) \|> Repo.update() do
	{:ok, new_user}
	end
	end

	defp value(list), do: Enum.find(list, &(to_string(&1) != ""))

	def handle_error(%Plug.Conn{} = _conn, error) do
	error
	end

	def auth_template, do: nil

	def oauth_consumer_template, do: nil
	end
	diff --git a/lib/pleroma/web/oauth/fallback_controller.ex b/lib/pleroma/web/oauth/fallback_controller.ex
	index afaa00242..e3984f009 100644
	--- a/lib/pleroma/web/oauth/fallback_controller.ex
	+++ b/lib/pleroma/web/oauth/fallback_controller.ex
	@@ -1,29 +1,29 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.FallbackController do
	use Pleroma.Web, :controller
	alias Pleroma.Web.OAuth.OAuthController

	def call(conn, {:register, :generic_error}) do
	conn
	\|> put_status(:internal_server_error)
	\|> put_flash(:error, "Unknown error, please check the details and try again.")
	\|> OAuthController.registration_details(conn.params)
	end

	def call(conn, {:register, _error}) do
	conn
	\|> put_status(:unauthorized)
	\|> put_flash(:error, "Invalid Username/Password")
	\|> OAuthController.registration_details(conn.params)
	end

	def call(conn, _error) do
	conn
	\|> put_status(:unauthorized)
	\|> put_flash(:error, "Invalid Username/Password")
	- \|> OAuthController.authorize(conn.params["authorization"])
	+ \|> OAuthController.authorize(conn.params)
	end
	end
	diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
	index bee7084ad..8e5a83466 100644
	--- a/lib/pleroma/web/oauth/oauth_controller.ex
	+++ b/lib/pleroma/web/oauth/oauth_controller.ex
	@@ -1,436 +1,439 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthController do
	use Pleroma.Web, :controller

	alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.User
	alias Pleroma.Web.Auth.Authenticator
	alias Pleroma.Web.ControllerHelper
	alias Pleroma.Web.OAuth.App
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Token

	import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2]

	if Pleroma.Config.oauth_consumer_enabled?(), do: plug(Ueberauth)

	plug(:fetch_session)
	plug(:fetch_flash)

	action_fallback(Pleroma.Web.OAuth.FallbackController)

	def authorize(%{assigns: %{token: %Token{} = token}} = conn, params) do
	if ControllerHelper.truthy_param?(params["force_login"]) do
	do_authorize(conn, params)
	else
	redirect_uri =
	if is_binary(params["redirect_uri"]) do
	params["redirect_uri"]
	else
	app = Repo.preload(token, :app).app

	app.redirect_uris
	\|> String.split()
	\|> Enum.at(0)
	end

	redirect(conn, external: redirect_uri(conn, redirect_uri))
	end
	end

	def authorize(conn, params), do: do_authorize(conn, params)

	- defp do_authorize(conn, params) do
	- app = Repo.get_by(App, client_id: params["client_id"])
	+ defp do_authorize(conn, %{"authorization" => auth_attrs}) do
	+ app = Repo.get_by(App, client_id: auth_attrs["client_id"])
	available_scopes = (app && app.scopes) \|\| []
	- scopes = oauth_scopes(params, nil) \|\| available_scopes
	+ scopes = oauth_scopes(auth_attrs, nil) \|\| available_scopes

	render(conn, Authenticator.auth_template(), %{
	- response_type: params["response_type"],
	- client_id: params["client_id"],
	+ response_type: auth_attrs["response_type"],
	+ client_id: auth_attrs["client_id"],
	available_scopes: available_scopes,
	scopes: scopes,
	- redirect_uri: params["redirect_uri"],
	- state: params["state"],
	- params: params
	+ redirect_uri: auth_attrs["redirect_uri"],
	+ state: auth_attrs["state"],
	+ params: auth_attrs
	})
	end

	+ defp do_authorize(conn, auth_attrs), do: do_authorize(conn, %{"authorization" => auth_attrs})
	+
	def create_authorization(
	conn,
	- %{"authorization" => auth_params} = params,
	+ %{"authorization" => _} = params,
	opts \\ []
	) do
	with {:ok, auth} <- do_create_authorization(conn, params, opts[:user]) do
	- after_create_authorization(conn, auth, auth_params)
	+ after_create_authorization(conn, auth, params)
	else
	error ->
	- handle_create_authorization_error(conn, error, auth_params)
	+ handle_create_authorization_error(conn, error, params)
	end
	end

	- def after_create_authorization(conn, auth, %{"redirect_uri" => redirect_uri} = auth_params) do
	+ def after_create_authorization(conn, auth, %{
	+ "authorization" => %{"redirect_uri" => redirect_uri} = auth_attrs
	+ }) do
	redirect_uri = redirect_uri(conn, redirect_uri)

	if redirect_uri == "urn:ietf:wg:oauth:2.0:oob" do
	render(conn, "results.html", %{
	auth: auth
	})
	else
	connector = if String.contains?(redirect_uri, "?"), do: "&", else: "?"
	url = "#{redirect_uri}#{connector}"
	url_params = %{:code => auth.token}

	url_params =
	- if auth_params["state"] do
	- Map.put(url_params, :state, auth_params["state"])
	+ if auth_attrs["state"] do
	+ Map.put(url_params, :state, auth_attrs["state"])
	else
	url_params
	end

	url = "#{url}#{Plug.Conn.Query.encode(url_params)}"

	redirect(conn, external: url)
	end
	end

	- defp handle_create_authorization_error(conn, {scopes_issue, _}, auth_params)
	+ defp handle_create_authorization_error(
	+ conn,
	+ {scopes_issue, _},
	+ %{"authorization" => _} = params
	+ )
	when scopes_issue in [:unsupported_scopes, :missing_scopes] do
	# Per https://github.com/tootsuite/mastodon/blob/
	# 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L39
	conn
	\|> put_flash(:error, "This action is outside the authorized scopes")
	\|> put_status(:unauthorized)
	- \|> authorize(auth_params)
	+ \|> authorize(params)
	end

	- defp handle_create_authorization_error(conn, {:auth_active, false}, auth_params) do
	+ defp handle_create_authorization_error(
	+ conn,
	+ {:auth_active, false},
	+ %{"authorization" => _} = params
	+ ) do
	# Per https://github.com/tootsuite/mastodon/blob/
	# 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L76
	conn
	\|> put_flash(:error, "Your login is missing a confirmed e-mail address")
	\|> put_status(:forbidden)
	- \|> authorize(auth_params)
	+ \|> authorize(params)
	end

	- defp handle_create_authorization_error(conn, error, _auth_params) do
	+ defp handle_create_authorization_error(conn, error, %{"authorization" => _}) do
	Authenticator.handle_error(conn, error)
	end

	def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do
	with %App{} = app <- get_app_from_request(conn, params),
	fixed_token = fix_padding(params["code"]),
	%Authorization{} = auth <-
	Repo.get_by(Authorization, token: fixed_token, app_id: app.id),
	%User{} = user <- User.get_by_id(auth.user_id),
	{:ok, token} <- Token.exchange_token(app, auth),
	{:ok, inserted_at} <- DateTime.from_naive(token.inserted_at, "Etc/UTC") do
	response = %{
	token_type: "Bearer",
	access_token: token.token,
	refresh_token: token.refresh_token,
	created_at: DateTime.to_unix(inserted_at),
	expires_in: 60 * 10,
	scope: Enum.join(token.scopes, " "),
	me: user.ap_id
	}

	json(conn, response)
	else
	_error ->
	put_status(conn, 400)
	\|> json(%{error: "Invalid credentials"})
	end
	end

	def token_exchange(
	conn,
	%{"grant_type" => "password"} = params
	) do
	- with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn, params)},
	+ with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn)},
	%App{} = app <- get_app_from_request(conn, params),
	{:auth_active, true} <- {:auth_active, User.auth_active?(user)},
	{:user_active, true} <- {:user_active, !user.info.deactivated},
	scopes <- oauth_scopes(params, app.scopes),
	[] <- scopes -- app.scopes,
	true <- Enum.any?(scopes),
	{:ok, auth} <- Authorization.create_authorization(app, user, scopes),
	{:ok, token} <- Token.exchange_token(app, auth) do
	response = %{
	token_type: "Bearer",
	access_token: token.token,
	refresh_token: token.refresh_token,
	expires_in: 60 * 10,
	scope: Enum.join(token.scopes, " "),
	me: user.ap_id
	}

	json(conn, response)
	else
	{:auth_active, false} ->
	# Per https://github.com/tootsuite/mastodon/blob/
	# 51e154f5e87968d6bb115e053689767ab33e80cd/app/controllers/api/base_controller.rb#L76
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: "Your login is missing a confirmed e-mail address"})

	{:user_active, false} ->
	conn
	\|> put_status(:forbidden)
	\|> json(%{error: "Your account is currently disabled"})

	_error ->
	put_status(conn, 400)
	\|> json(%{error: "Invalid credentials"})
	end
	end

	def token_exchange(
	conn,
	%{"grant_type" => "password", "name" => name, "password" => _password} = params
	) do
	params =
	params
	\|> Map.delete("name")
	\|> Map.put("username", name)

	token_exchange(conn, params)
	end

	def token_revoke(conn, %{"token" => token} = params) do
	with %App{} = app <- get_app_from_request(conn, params),
	%Token{} = token <- Repo.get_by(Token, token: token, app_id: app.id),
	{:ok, %Token{}} <- Repo.delete(token) do
	json(conn, %{})
	else
	_error ->
	# RFC 7009: invalid tokens [in the request] do not cause an error response
	json(conn, %{})
	end
	end

	@doc "Prepares OAuth request to provider for Ueberauth"
	- def prepare_request(conn, %{"provider" => provider} = params) do
	+ def prepare_request(conn, %{"provider" => provider, "authorization" => auth_attrs}) do
	scope =
	- oauth_scopes(params, [])
	+ oauth_scopes(auth_attrs, [])
	\|> Enum.join(" ")

	state =
	- params
	+ auth_attrs
	\|> Map.delete("scopes")
	\|> Map.put("scope", scope)
	\|> Poison.encode!()

	params =
	- params
	+ auth_attrs
	\|> Map.drop(~w(scope scopes client_id redirect_uri))
	\|> Map.put("state", state)

	# Handing the request to Ueberauth
	redirect(conn, to: o_auth_path(conn, :request, provider, params))
	end

	def request(conn, params) do
	message =
	if params["provider"] do
	"Unsupported OAuth provider: #{params["provider"]}."
	else
	"Bad OAuth request."
	end

	conn
	\|> put_flash(:error, message)
	\|> redirect(to: "/")
	end

	def callback(%{assigns: %{ueberauth_failure: failure}} = conn, params) do
	params = callback_params(params)
	messages = for e <- Map.get(failure, :errors, []), do: e.message
	message = Enum.join(messages, "; ")

	conn
	\|> put_flash(:error, "Failed to authenticate: #{message}.")
	\|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	end

	def callback(conn, params) do
	params = callback_params(params)

	- with {:ok, registration} <- Authenticator.get_registration(conn, params) do
	+ with {:ok, registration} <- Authenticator.get_registration(conn) do
	user = Repo.preload(registration, :user).user
	- auth_params = Map.take(params, ~w(client_id redirect_uri scope scopes state))
	+ auth_attrs = Map.take(params, ~w(client_id redirect_uri scope scopes state))

	if user do
	create_authorization(
	conn,
	- %{"authorization" => auth_params},
	+ %{"authorization" => auth_attrs},
	user: user
	)
	else
	registration_params =
	- Map.merge(auth_params, %{
	+ Map.merge(auth_attrs, %{
	"nickname" => Registration.nickname(registration),
	"email" => Registration.email(registration)
	})

	conn
	\|> put_session(:registration_id, registration.id)
	- \|> registration_details(registration_params)
	+ \|> registration_details(%{"authorization" => registration_params})
	end
	else
	_ ->
	conn
	\|> put_flash(:error, "Failed to set up user account.")
	\|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
	end
	end

	defp callback_params(%{"state" => state} = params) do
	Map.merge(params, Poison.decode!(state))
	end

	- def registration_details(conn, params) do
	+ def registration_details(conn, %{"authorization" => auth_attrs}) do
	render(conn, "register.html", %{
	- client_id: params["client_id"],
	- redirect_uri: params["redirect_uri"],
	- state: params["state"],
	- scopes: oauth_scopes(params, []),
	- nickname: params["nickname"],
	- email: params["email"]
	+ client_id: auth_attrs["client_id"],
	+ redirect_uri: auth_attrs["redirect_uri"],
	+ state: auth_attrs["state"],
	+ scopes: oauth_scopes(auth_attrs, []),
	+ nickname: auth_attrs["nickname"],
	+ email: auth_attrs["email"]
	})
	end

	- def register(conn, %{"op" => "connect"} = params) do
	- authorization_params = Map.put(params, "name", params["auth_name"])
	- create_authorization_params = %{"authorization" => authorization_params}
	-
	+ def register(conn, %{"authorization" => _, "op" => "connect"} = params) do
	with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	%Registration{} = registration <- Repo.get(Registration, registration_id),
	{_, {:ok, auth}} <-
	- {:create_authorization, do_create_authorization(conn, create_authorization_params)},
	+ {:create_authorization, do_create_authorization(conn, params)},
	%User{} = user <- Repo.preload(auth, :user).user,
	{:ok, _updated_registration} <- Registration.bind_to_user(registration, user) do
	conn
	\|> put_session_registration_id(nil)
	- \|> after_create_authorization(auth, authorization_params)
	+ \|> after_create_authorization(auth, params)
	else
	{:create_authorization, error} ->
	- {:register, handle_create_authorization_error(conn, error, create_authorization_params)}
	+ {:register, handle_create_authorization_error(conn, error, params)}

	_ ->
	{:register, :generic_error}
	end
	end

	- def register(conn, %{"op" => "register"} = params) do
	+ def register(conn, %{"authorization" => _, "op" => "register"} = params) do
	with registration_id when not is_nil(registration_id) <- get_session_registration_id(conn),
	%Registration{} = registration <- Repo.get(Registration, registration_id),
	- {:ok, user} <- Authenticator.create_from_registration(conn, params, registration) do
	+ {:ok, user} <- Authenticator.create_from_registration(conn, registration) do
	conn
	\|> put_session_registration_id(nil)
	\|> create_authorization(
	- %{
	- "authorization" => %{
	- "client_id" => params["client_id"],
	- "redirect_uri" => params["redirect_uri"],
	- "scopes" => oauth_scopes(params, nil)
	- }
	- },
	+ params,
	user: user
	)
	else
	{:error, changeset} ->
	message =
	Enum.map(changeset.errors, fn {field, {error, _}} ->
	"#{field} #{error}"
	end)
	\|> Enum.join("; ")

	message =
	String.replace(
	message,
	"ap_id has already been taken",
	"nickname has already been taken"
	)

	conn
	\|> put_status(:forbidden)
	\|> put_flash(:error, "Error: #{message}.")
	\|> registration_details(params)

	_ ->
	{:register, :generic_error}
	end
	end

	defp do_create_authorization(
	conn,
	%{
	"authorization" =>
	%{
	"client_id" => client_id,
	"redirect_uri" => redirect_uri
	- } = auth_params
	- } = params,
	+ } = auth_attrs
	+ },
	user \\ nil
	) do
	with {_, {:ok, %User{} = user}} <-
	- {:get_user, (user && {:ok, user}) \|\| Authenticator.get_user(conn, params)},
	+ {:get_user, (user && {:ok, user}) \|\| Authenticator.get_user(conn)},
	%App{} = app <- Repo.get_by(App, client_id: client_id),
	true <- redirect_uri in String.split(app.redirect_uris),
	- scopes <- oauth_scopes(auth_params, []),
	+ scopes <- oauth_scopes(auth_attrs, []),
	{:unsupported_scopes, []} <- {:unsupported_scopes, scopes -- app.scopes},
	# Note: `scope` param is intentionally not optional in this context
	{:missing_scopes, false} <- {:missing_scopes, scopes == []},
	{:auth_active, true} <- {:auth_active, User.auth_active?(user)} do
	Authorization.create_authorization(app, user, scopes)
	end
	end

	# XXX - for whatever reason our token arrives urlencoded, but Plug.Conn should be
	# decoding it. Investigate sometime.
	defp fix_padding(token) do
	token
	\|> URI.decode()
	\|> Base.url_decode64!(padding: false)
	\|> Base.url_encode64(padding: false)
	end

	defp get_app_from_request(conn, params) do
	# Per RFC 6749, HTTP Basic is preferred to body params
	{client_id, client_secret} =
	with ["Basic " <> encoded] <- get_req_header(conn, "authorization"),
	{:ok, decoded} <- Base.decode64(encoded),
	[id, secret] <-
	String.split(decoded, ":")
	\|> Enum.map(fn s -> URI.decode_www_form(s) end) do
	{id, secret}
	else
	_ -> {params["client_id"], params["client_secret"]}
	end

	if client_id && client_secret do
	Repo.get_by(
	App,
	client_id: client_id,
	client_secret: client_secret
	)
	else
	nil
	end
	end

	# Special case: Local MastodonFE
	defp redirect_uri(conn, "."), do: mastodon_api_url(conn, :login)

	defp redirect_uri(_conn, redirect_uri), do: redirect_uri

	defp get_session_registration_id(conn), do: get_session(conn, :registration_id)

	defp put_session_registration_id(conn, registration_id),
	do: put_session(conn, :registration_id, registration_id)
	end
	diff --git a/lib/pleroma/web/templates/o_auth/o_auth/_scopes.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/_scopes.html.eex
	index 4b8fb5dae..e6cfe108b 100644
	--- a/lib/pleroma/web/templates/o_auth/o_auth/_scopes.html.eex
	+++ b/lib/pleroma/web/templates/o_auth/o_auth/_scopes.html.eex
	@@ -1,13 +1,13 @@
	<div class="scopes-input">
	<%= label @form, :scope, "Permissions" %>

	<div class="scopes">
	<%= for scope <- @available_scopes do %>
	<%# Note: using hidden input with `unchecked_value` in order to distinguish user's empty selection from `scope` param being omitted %>
	<div class="scope">
	- <%= checkbox @form, :"scope_#{scope}", value: scope in @scopes && scope, checked_value: scope, unchecked_value: "", name: assigns[:scope_param] \|\| "scope[]" %>
	+ <%= checkbox @form, :"scope_#{scope}", value: scope in @scopes && scope, checked_value: scope, unchecked_value: "", name: "authorization[scope][]" %>
	<%= label @form, :"scope_#{scope}", String.capitalize(scope) %>
	</div>
	<% end %>
	</div>
	</div>
	diff --git a/lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex
	index 85f62ca64..4bcda7300 100644
	--- a/lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex
	+++ b/lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex
	@@ -1,13 +1,13 @@
	<h2>Sign in with external provider</h2>

	-<%= form_for @conn, o_auth_path(@conn, :prepare_request), [method: "get"], fn f -> %>
	+<%= form_for @conn, o_auth_path(@conn, :prepare_request), [as: "authorization", method: "get"], fn f -> %>
	<%= render @view_module, "_scopes.html", Map.put(assigns, :form, f) %>

	<%= hidden_input f, :client_id, value: @client_id %>
	<%= hidden_input f, :redirect_uri, value: @redirect_uri %>
	<%= hidden_input f, :state, value: @state %>

	<%= for strategy <- Pleroma.Config.oauth_consumer_strategies() do %>
	<%= submit "Sign in with #{String.capitalize(strategy)}", name: "provider", value: strategy %>
	<% end %>
	<% end %>
	diff --git a/lib/pleroma/web/templates/o_auth/o_auth/register.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/register.html.eex
	index 126390391..facedc8db 100644
	--- a/lib/pleroma/web/templates/o_auth/o_auth/register.html.eex
	+++ b/lib/pleroma/web/templates/o_auth/o_auth/register.html.eex
	@@ -1,43 +1,42 @@
	<%= if get_flash(@conn, :info) do %>
	<p class="alert alert-info" role="alert"><%= get_flash(@conn, :info) %></p>
	<% end %>
	<%= if get_flash(@conn, :error) do %>
	<p class="alert alert-danger" role="alert"><%= get_flash(@conn, :error) %></p>
	<% end %>

	<h2>Registration Details</h2>

	<p>If you'd like to register a new account, please provide the details below.</p>
	-
	-<%= form_for @conn, o_auth_path(@conn, :register), [], fn f -> %>
	+<%= form_for @conn, o_auth_path(@conn, :register), [as: "authorization"], fn f -> %>

	<div class="input">
	<%= label f, :nickname, "Nickname" %>
	<%= text_input f, :nickname, value: @nickname %>
	</div>
	<div class="input">
	<%= label f, :email, "Email" %>
	<%= text_input f, :email, value: @email %>
	</div>

	<%= submit "Proceed as new user", name: "op", value: "register" %>

	<p>Alternatively, sign in to connect to existing account.</p>

	<div class="input">
	- <%= label f, :auth_name, "Name or email" %>
	- <%= text_input f, :auth_name %>
	+ <%= label f, :name, "Name or email" %>
	+ <%= text_input f, :name %>
	</div>
	<div class="input">
	<%= label f, :password, "Password" %>
	<%= password_input f, :password %>
	</div>

	<%= submit "Proceed as existing user", name: "op", value: "connect" %>

	<%= hidden_input f, :client_id, value: @client_id %>
	<%= hidden_input f, :redirect_uri, value: @redirect_uri %>
	<%= hidden_input f, :scope, value: Enum.join(@scopes, " ") %>
	<%= hidden_input f, :state, value: @state %>

	<% end %>
	diff --git a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
	index 87278e636..3e360a52c 100644
	--- a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
	+++ b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
	@@ -1,31 +1,31 @@
	<%= if get_flash(@conn, :info) do %>
	<p class="alert alert-info" role="alert"><%= get_flash(@conn, :info) %></p>
	<% end %>
	<%= if get_flash(@conn, :error) do %>
	<p class="alert alert-danger" role="alert"><%= get_flash(@conn, :error) %></p>
	<% end %>

	<h2>OAuth Authorization</h2>

	<%= form_for @conn, o_auth_path(@conn, :authorize), [as: "authorization"], fn f -> %>
	<div class="input">
	<%= label f, :name, "Name or email" %>
	<%= text_input f, :name %>
	</div>
	<div class="input">
	<%= label f, :password, "Password" %>
	<%= password_input f, :password %>
	</div>

	-<%= render @view_module, "_scopes.html", Map.merge(assigns, %{form: f, scope_param: "authorization[scope][]"}) %>
	+<%= render @view_module, "_scopes.html", Map.merge(assigns, %{form: f}) %>

	<%= hidden_input f, :client_id, value: @client_id %>
	<%= hidden_input f, :response_type, value: @response_type %>
	<%= hidden_input f, :redirect_uri, value: @redirect_uri %>
	<%= hidden_input f, :state, value: @state %>
	<%= submit "Authorize" %>
	<% end %>

	<%= if Pleroma.Config.oauth_consumer_enabled?() do %>
	<%= render @view_module, Pleroma.Web.Auth.Authenticator.oauth_consumer_template(), assigns %>
	<% end %>
	diff --git a/test/web/oauth/oauth_controller_test.exs b/test/web/oauth/oauth_controller_test.exs
	index ac7843f9b..fb505fab3 100644
	--- a/test/web/oauth/oauth_controller_test.exs
	+++ b/test/web/oauth/oauth_controller_test.exs
	@@ -1,680 +1,696 @@
	# Pleroma: A lightweight social networking server
	# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
	# SPDX-License-Identifier: AGPL-3.0-only

	defmodule Pleroma.Web.OAuth.OAuthControllerTest do
	use Pleroma.Web.ConnCase
	import Pleroma.Factory
	import Mock

	alias Pleroma.Registration
	alias Pleroma.Repo
	alias Pleroma.Web.OAuth.Authorization
	alias Pleroma.Web.OAuth.Token

	@session_opts [
	store: :cookie,
	key: "_test",
	signing_salt: "cooldude"
	]

	describe "in OAuth consumer mode, " do
	setup do
	oauth_consumer_strategies_path = [:auth, :oauth_consumer_strategies]
	oauth_consumer_strategies = Pleroma.Config.get(oauth_consumer_strategies_path)
	Pleroma.Config.put(oauth_consumer_strategies_path, ~w(twitter facebook))

	on_exit(fn ->
	Pleroma.Config.put(oauth_consumer_strategies_path, oauth_consumer_strategies)
	end)

	[
	app: insert(:oauth_app),
	conn:
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	test "GET /oauth/authorize renders auth forms, including OAuth consumer form", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read"
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ "Sign in with Twitter"
	assert response =~ o_auth_path(conn, :prepare_request)
	end

	test "GET /oauth/prepare_request encodes parameters as `state` and redirects", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/prepare_request",
	%{
	"provider" => "twitter",
	- "scope" => "read follow",
	- "client_id" => app.client_id,
	- "redirect_uri" => app.redirect_uris,
	- "state" => "a_state"
	+ "authorization" => %{
	+ "scope" => "read follow",
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state"
	+ }
	}
	)

	assert response = html_response(conn, 302)

	redirect_query = URI.parse(redirected_to(conn)).query
	assert %{"state" => state_param} = URI.decode_query(redirect_query)
	assert {:ok, state_components} = Poison.decode(state_param)

	expected_client_id = app.client_id
	expected_redirect_uri = app.redirect_uris

	assert %{
	"scope" => "read follow",
	"client_id" => ^expected_client_id,
	"redirect_uri" => ^expected_redirect_uri,
	"state" => "a_state"
	} = state_components
	end

	test "with user-bound registration, GET /oauth/<provider>/callback redirects to `redirect_uri` with `code`",
	%{app: app, conn: conn} do
	registration = insert(:registration)

	state_params = %{
	"scope" => Enum.join(app.scopes, " "),
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => ""
	}

	with_mock Pleroma.Web.Auth.Authenticator,
	- get_registration: fn _, _ -> {:ok, registration} end do
	+ get_registration: fn _ -> {:ok, registration} end do
	conn =
	get(
	conn,
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Poison.encode!(state_params)
	}
	)

	assert response = html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
	end
	end

	test "with user-unbound registration, GET /oauth/<provider>/callback renders registration_details page",
	%{app: app, conn: conn} do
	registration = insert(:registration, user: nil)

	state_params = %{
	"scope" => "read write",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => "a_state"
	}

	with_mock Pleroma.Web.Auth.Authenticator,
	- get_registration: fn _, _ -> {:ok, registration} end do
	+ get_registration: fn _ -> {:ok, registration} end do
	conn =
	get(
	conn,
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Poison.encode!(state_params)
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ ~r/name="op" type="submit" value="register"/
	assert response =~ ~r/name="op" type="submit" value="connect"/
	assert response =~ Registration.email(registration)
	assert response =~ Registration.nickname(registration)
	end
	end

	test "on authentication error, GET /oauth/<provider>/callback redirects to `redirect_uri`", %{
	app: app,
	conn: conn
	} do
	state_params = %{
	"scope" => Enum.join(app.scopes, " "),
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => ""
	}

	conn =
	conn
	\|> assign(:ueberauth_failure, %{errors: [%{message: "(error description)"}]})
	\|> get(
	"/oauth/twitter/callback",
	%{
	"oauth_token" => "G-5a3AAAAAAAwMH9AAABaektfSM",
	"oauth_verifier" => "QZl8vUqNvXMTKpdmUnGejJxuHG75WWWs",
	"provider" => "twitter",
	"state" => Poison.encode!(state_params)
	}
	)

	assert response = html_response(conn, 302)
	assert redirected_to(conn) == app.redirect_uris
	assert get_flash(conn, :error) == "Failed to authenticate: (error description)."
	end

	test "GET /oauth/registration_details renders registration details form", %{
	app: app,
	conn: conn
	} do
	conn =
	get(
	conn,
	"/oauth/registration_details",
	%{
	- "scopes" => app.scopes,
	- "client_id" => app.client_id,
	- "redirect_uri" => app.redirect_uris,
	- "state" => "a_state",
	- "nickname" => nil,
	- "email" => "john@doe.com"
	+ "authorization" => %{
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "nickname" => nil,
	+ "email" => "john@doe.com"
	+ }
	}
	)

	assert response = html_response(conn, 200)
	assert response =~ ~r/name="op" type="submit" value="register"/
	assert response =~ ~r/name="op" type="submit" value="connect"/
	end

	test "with valid params, POST /oauth/register?op=register redirects to `redirect_uri` with `code`",
	%{
	app: app,
	conn: conn
	} do
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "register",
	- "scopes" => app.scopes,
	- "client_id" => app.client_id,
	- "redirect_uri" => app.redirect_uris,
	- "state" => "a_state",
	- "nickname" => "availablenick",
	- "email" => "available@email.com"
	+ "authorization" => %{
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "nickname" => "availablenick",
	+ "email" => "available@email.com"
	+ }
	}
	)

	assert response = html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
	end

	test "with invalid params, POST /oauth/register?op=register renders registration_details page",
	%{
	app: app,
	conn: conn
	} do
	another_user = insert(:user)
	registration = insert(:registration, user: nil, info: %{"nickname" => nil, "email" => nil})

	params = %{
	"op" => "register",
	- "scopes" => app.scopes,
	- "client_id" => app.client_id,
	- "redirect_uri" => app.redirect_uris,
	- "state" => "a_state",
	- "nickname" => "availablenickname",
	- "email" => "available@email.com"
	+ "authorization" => %{
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "nickname" => "availablenickname",
	+ "email" => "available@email.com"
	+ }
	}

	for {bad_param, bad_param_value} <-
	[{"nickname", another_user.nickname}, {"email", another_user.email}] do
	- bad_params = Map.put(params, bad_param, bad_param_value)
	+ bad_registration_attrs = %{
	+ "authorization" => Map.put(params["authorization"], bad_param, bad_param_value)
	+ }
	+
	+ bad_params = Map.merge(params, bad_registration_attrs)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post("/oauth/register", bad_params)

	assert html_response(conn, 403) =~ ~r/name="op" type="submit" value="register"/
	assert get_flash(conn, :error) == "Error: #{bad_param} has already been taken."
	end
	end

	test "with valid params, POST /oauth/register?op=connect redirects to `redirect_uri` with `code`",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt("testpassword"))
	registration = insert(:registration, user: nil)

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post(
	"/oauth/register",
	%{
	"op" => "connect",
	- "scopes" => app.scopes,
	- "client_id" => app.client_id,
	- "redirect_uri" => app.redirect_uris,
	- "state" => "a_state",
	- "auth_name" => user.nickname,
	- "password" => "testpassword"
	+ "authorization" => %{
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "name" => user.nickname,
	+ "password" => "testpassword"
	+ }
	}
	)

	assert response = html_response(conn, 302)
	assert redirected_to(conn) =~ ~r/#{app.redirect_uris}\?code=.+/
	end

	test "with invalid params, POST /oauth/register?op=connect renders registration_details page",
	%{
	app: app,
	conn: conn
	} do
	user = insert(:user)
	registration = insert(:registration, user: nil)

	params = %{
	"op" => "connect",
	- "scopes" => app.scopes,
	- "client_id" => app.client_id,
	- "redirect_uri" => app.redirect_uris,
	- "state" => "a_state",
	- "auth_name" => user.nickname,
	- "password" => "wrong password"
	+ "authorization" => %{
	+ "scopes" => app.scopes,
	+ "client_id" => app.client_id,
	+ "redirect_uri" => app.redirect_uris,
	+ "state" => "a_state",
	+ "name" => user.nickname,
	+ "password" => "wrong password"
	+ }
	}

	conn =
	conn
	\|> put_session(:registration_id, registration.id)
	\|> post("/oauth/register", params)

	assert html_response(conn, 401) =~ ~r/name="op" type="submit" value="connect"/
	assert get_flash(conn, :error) == "Invalid Username/Password"
	end
	end

	describe "GET /oauth/authorize" do
	setup do
	[
	app: insert(:oauth_app, redirect_uris: "https://redirect.url"),
	conn:
	build_conn()
	\|> Plug.Session.call(Plug.Session.init(@session_opts))
	\|> fetch_session()
	]
	end

	test "renders authentication page", %{app: app, conn: conn} do
	conn =
	get(
	conn,
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "renders authentication page if user is already authenticated but `force_login` is tru-ish",
	%{app: app, conn: conn} do
	token = insert(:oauth_token, app_id: app.id)

	conn =
	conn
	\|> put_session(:oauth_token, token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read",
	"force_login" => "true"
	}
	)

	assert html_response(conn, 200) =~ ~s(type="submit")
	end

	test "redirects to app if user is already authenticated", %{app: app, conn: conn} do
	token = insert(:oauth_token, app_id: app.id)

	conn =
	conn
	\|> put_session(:oauth_token, token.token)
	\|> get(
	"/oauth/authorize",
	%{
	"response_type" => "code",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read"
	}
	)

	assert redirected_to(conn) == "https://redirect.url"
	end
	end

	describe "POST /oauth/authorize" do
	test "redirects with oauth authorization" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write", "follow"])

	conn =
	build_conn()
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"scope" => "read write",
	"state" => "statepassed"
	}
	})

	target = redirected_to(conn)
	assert target =~ app.redirect_uris

	query = URI.parse(target).query \|> URI.query_decoder() \|> Map.new()

	assert %{"state" => "statepassed", "code" => code} = query
	auth = Repo.get_by(Authorization, token: code)
	assert auth
	assert auth.scopes == ["read", "write"]
	end

	test "returns 401 for wrong credentials", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "wrong",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => "statepassed",
	"scope" => Enum.join(app.scopes, " ")
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ app.redirect_uris

	# Error message
	assert result =~ "Invalid Username/Password"
	end

	test "returns 401 for missing scopes", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app)

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => "statepassed",
	"scope" => ""
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ app.redirect_uris

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end

	test "returns 401 for scopes beyond app scopes", %{conn: conn} do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	result =
	conn
	\|> post("/oauth/authorize", %{
	"authorization" => %{
	"name" => user.nickname,
	"password" => "test",
	"client_id" => app.client_id,
	"redirect_uri" => app.redirect_uris,
	"state" => "statepassed",
	"scope" => "read write follow"
	}
	})
	\|> html_response(:unauthorized)

	# Keep the details
	assert result =~ app.client_id
	assert result =~ app.redirect_uris

	# Error message
	assert result =~ "This action is outside the authorized scopes"
	end
	end

	describe "POST /oauth/token" do
	test "issues a token for an all-body request" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["read", "write"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["write"])

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => app.redirect_uris,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token, "me" => ap_id} = json_response(conn, 200)

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == auth.scopes
	assert user.ap_id == ap_id
	end

	test "issues a token for `password` grant_type with valid credentials, with full permissions by default" do
	password = "testpassword"
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))

	app = insert(:oauth_app, scopes: ["read", "write"])

	# Note: "scope" param is intentionally omitted
	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert %{"access_token" => token} = json_response(conn, 200)

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == app.scopes
	end

	test "issues a token for request with HTTP basic auth client credentials" do
	user = insert(:user)
	app = insert(:oauth_app, scopes: ["scope1", "scope2", "scope3"])

	{:ok, auth} = Authorization.create_authorization(app, user, ["scope1", "scope2"])
	assert auth.scopes == ["scope1", "scope2"]

	app_encoded =
	(URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret))
	\|> Base.encode64()

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic " <> app_encoded)
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => app.redirect_uris
	})

	assert %{"access_token" => token, "scope" => scope} = json_response(conn, 200)

	assert scope == "scope1 scope2"

	token = Repo.get_by(Token, token: token)
	assert token
	assert token.scopes == ["scope1", "scope2"]
	end

	test "rejects token exchange with invalid client credentials" do
	user = insert(:user)
	app = insert(:oauth_app)

	{:ok, auth} = Authorization.create_authorization(app, user)

	conn =
	build_conn()
	\|> put_req_header("authorization", "Basic JTIxOiVGMCU5RiVBNCVCNwo=")
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => auth.token,
	"redirect_uri" => app.redirect_uris
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to unconfirmed user and confirmation is required" do
	setting = Pleroma.Config.get([:instance, :account_activation_required])

	unless setting do
	Pleroma.Config.put([:instance, :account_activation_required], true)
	on_exit(fn -> Pleroma.Config.put([:instance, :account_activation_required], setting) end)
	end

	password = "testpassword"
	user = insert(:user, password_hash: Comeonin.Pbkdf2.hashpwsalt(password))
	info_change = Pleroma.User.Info.confirmation_changeset(user.info, :unconfirmed)

	{:ok, user} =
	user
	\|> Ecto.Changeset.change()
	\|> Ecto.Changeset.put_embed(:info, info_change)
	\|> Repo.update()

	refute Pleroma.User.auth_active?(user)

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects token exchange for valid credentials belonging to deactivated user" do
	password = "testpassword"

	user =
	insert(:user,
	password_hash: Comeonin.Pbkdf2.hashpwsalt(password),
	info: %{deactivated: true}
	)

	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "password",
	"username" => user.nickname,
	"password" => password,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 403)
	assert %{"error" => _} = resp
	refute Map.has_key?(resp, "access_token")
	end

	test "rejects an invalid authorization code" do
	app = insert(:oauth_app)

	conn =
	build_conn()
	\|> post("/oauth/token", %{
	"grant_type" => "authorization_code",
	"code" => "Imobviouslyinvalid",
	"redirect_uri" => app.redirect_uris,
	"client_id" => app.client_id,
	"client_secret" => app.client_secret
	})

	assert resp = json_response(conn, 400)
	assert %{"error" => _} = json_response(conn, 400)
	refute Map.has_key?(resp, "access_token")
	end
	end
	end

File Metadata

Mime Type: text/x-diff
Expires: Sun, Nov 1, 6:13 AM (15 h, 15 s)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1802638
Default Alt Text: (58 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions