[#468] User UI for OAuth permissions restriction. Standardized storage format for `scopes` fields, updated usages.

This commit is contained in:
Ivan Tashkinov 2019-02-14 00:29:29 +03:00
parent a337bd114c
commit 063baca5e4
18 changed files with 98 additions and 43 deletions

View File

@ -4,7 +4,6 @@
defmodule Pleroma.Plugs.OAuthScopesPlug do defmodule Pleroma.Plugs.OAuthScopesPlug do
import Plug.Conn import Plug.Conn
alias Pleroma.Web.OAuth
@behaviour Plug @behaviour Plug
@ -12,7 +11,7 @@ def init(%{required_scopes: _} = options), do: options
def call(%Plug.Conn{assigns: assigns} = conn, %{required_scopes: required_scopes}) do def call(%Plug.Conn{assigns: assigns} = conn, %{required_scopes: required_scopes}) do
token = assigns[:token] token = assigns[:token]
granted_scopes = token && OAuth.parse_scopes(token.scope) granted_scopes = token && token.scopes
if is_nil(token) || required_scopes -- granted_scopes == [] do if is_nil(token) || required_scopes -- granted_scopes == [] do
conn conn

View File

@ -19,6 +19,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
alias Pleroma.Web.ActivityPub.ActivityPub alias Pleroma.Web.ActivityPub.ActivityPub
alias Pleroma.Web.ActivityPub.Utils alias Pleroma.Web.ActivityPub.Utils
alias Pleroma.Web.CommonAPI alias Pleroma.Web.CommonAPI
alias Pleroma.Web.OAuth
alias Pleroma.Web.OAuth.{Authorization, Token, App} alias Pleroma.Web.OAuth.{Authorization, Token, App}
alias Pleroma.Web.MediaProxy alias Pleroma.Web.MediaProxy
@ -31,7 +32,10 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
action_fallback(:errors) action_fallback(:errors)
def create_app(conn, params) do def create_app(conn, params) do
with cs <- App.register_changeset(%App{}, params), scopes = OAuth.parse_scopes(params["scope"] || params["scopes"])
app_attrs = params |> Map.drop(["scope", "scopes"]) |> Map.put("scopes", scopes)
with cs <- App.register_changeset(%App{}, app_attrs),
false <- cs.changes[:client_name] == @local_mastodon_name, false <- cs.changes[:client_name] == @local_mastodon_name,
{:ok, app} <- Repo.insert(cs) do {:ok, app} <- Repo.insert(cs) do
res = %{ res = %{
@ -1162,7 +1166,11 @@ defp get_or_make_app() do
{:ok, app} {:ok, app}
else else
_e -> _e ->
cs = App.register_changeset(%App{}, Map.put(find_attrs, :scopes, "read,write,follow")) cs =
App.register_changeset(
%App{},
Map.put(find_attrs, :scopes, ["read", "write", "follow"])
)
Repo.insert(cs) Repo.insert(cs)
end end

View File

@ -3,9 +3,22 @@
# SPDX-License-Identifier: AGPL-3.0-only # SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.OAuth do defmodule Pleroma.Web.OAuth do
def parse_scopes(scopes) do def parse_scopes(nil) do
nil
end
def parse_scopes(scopes) when is_list(scopes) do
scopes scopes
|> to_string() end
|> String.split([" ", ","])
def parse_scopes(scopes) do
scopes =
scopes
|> to_string()
|> String.trim()
if scopes == "",
do: [],
else: String.split(scopes, [" ", ","])
end end
end end

View File

@ -9,7 +9,7 @@ defmodule Pleroma.Web.OAuth.App do
schema "apps" do schema "apps" do
field(:client_name, :string) field(:client_name, :string)
field(:redirect_uris, :string) field(:redirect_uris, :string)
field(:scopes, :string) field(:scopes, {:array, :string}, default: [])
field(:website, :string) field(:website, :string)
field(:client_id, :string) field(:client_id, :string)
field(:client_secret, :string) field(:client_secret, :string)

View File

@ -6,14 +6,13 @@ defmodule Pleroma.Web.OAuth.Authorization do
use Ecto.Schema use Ecto.Schema
alias Pleroma.{User, Repo} alias Pleroma.{User, Repo}
alias Pleroma.Web.OAuth
alias Pleroma.Web.OAuth.{Authorization, App} alias Pleroma.Web.OAuth.{Authorization, App}
import Ecto.{Changeset, Query} import Ecto.{Changeset, Query}
schema "oauth_authorizations" do schema "oauth_authorizations" do
field(:token, :string) field(:token, :string)
field(:scope, :string) field(:scopes, {:array, :string}, default: [])
field(:valid_until, :naive_datetime) field(:valid_until, :naive_datetime)
field(:used, :boolean, default: false) field(:used, :boolean, default: false)
belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId) belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId)
@ -22,8 +21,8 @@ defmodule Pleroma.Web.OAuth.Authorization do
timestamps() timestamps()
end end
def create_authorization(%App{} = app, %User{} = user, scope \\ nil) do def create_authorization(%App{} = app, %User{} = user, scopes \\ nil) do
scopes = OAuth.parse_scopes(scope || app.scopes) scopes = scopes || app.scopes
token = :crypto.strong_rand_bytes(32) |> Base.url_encode64() token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
authorization = %Authorization{ authorization = %Authorization{
@ -31,7 +30,7 @@ def create_authorization(%App{} = app, %User{} = user, scope \\ nil) do
used: false, used: false,
user_id: user.id, user_id: user.id,
app_id: app.id, app_id: app.id,
scope: Enum.join(scopes, " "), scopes: scopes,
valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10) valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10)
} }

View File

@ -5,6 +5,7 @@
defmodule Pleroma.Web.OAuth.OAuthController do defmodule Pleroma.Web.OAuth.OAuthController do
use Pleroma.Web, :controller use Pleroma.Web, :controller
alias Pleroma.Web.OAuth
alias Pleroma.Web.OAuth.{Authorization, Token, App} alias Pleroma.Web.OAuth.{Authorization, Token, App}
alias Pleroma.{Repo, User} alias Pleroma.{Repo, User}
alias Comeonin.Pbkdf2 alias Comeonin.Pbkdf2
@ -18,7 +19,7 @@ def authorize(conn, params) do
render(conn, "show.html", %{ render(conn, "show.html", %{
response_type: params["response_type"], response_type: params["response_type"],
client_id: params["client_id"], client_id: params["client_id"],
scope: params["scope"], scopes: scopes(params) || [],
redirect_uri: params["redirect_uri"], redirect_uri: params["redirect_uri"],
state: params["state"] state: params["state"]
}) })
@ -38,7 +39,10 @@ def create_authorization(conn, %{
{:auth_active, true} <- {:auth_active, User.auth_active?(user)}, {:auth_active, true} <- {:auth_active, User.auth_active?(user)},
%App{} = app <- Repo.get_by(App, client_id: client_id), %App{} = app <- Repo.get_by(App, client_id: client_id),
true <- redirect_uri in String.split(app.redirect_uris), true <- redirect_uri in String.split(app.redirect_uris),
{:ok, auth} <- Authorization.create_authorization(app, user, params["scope"]) do scopes <- scopes(params) || app.scopes,
[] <- scopes -- app.scopes,
true <- Enum.any?(scopes),
{:ok, auth} <- Authorization.create_authorization(app, user, scopes) do
# Special case: Local MastodonFE. # Special case: Local MastodonFE.
redirect_uri = redirect_uri =
if redirect_uri == "." do if redirect_uri == "." do
@ -94,7 +98,7 @@ def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do
refresh_token: token.refresh_token, refresh_token: token.refresh_token,
created_at: DateTime.to_unix(inserted_at), created_at: DateTime.to_unix(inserted_at),
expires_in: 60 * 10, expires_in: 60 * 10,
scope: token.scope scope: Enum.join(token.scopes)
} }
json(conn, response) json(conn, response)
@ -113,14 +117,15 @@ def token_exchange(
%User{} = user <- User.get_by_nickname_or_email(name), %User{} = user <- User.get_by_nickname_or_email(name),
true <- Pbkdf2.checkpw(password, user.password_hash), true <- Pbkdf2.checkpw(password, user.password_hash),
{:auth_active, true} <- {:auth_active, User.auth_active?(user)}, {:auth_active, true} <- {:auth_active, User.auth_active?(user)},
{:ok, auth} <- Authorization.create_authorization(app, user, params["scope"]), scopes <- scopes(params) || app.scopes,
{:ok, auth} <- Authorization.create_authorization(app, user, scopes),
{:ok, token} <- Token.exchange_token(app, auth) do {:ok, token} <- Token.exchange_token(app, auth) do
response = %{ response = %{
token_type: "Bearer", token_type: "Bearer",
access_token: token.token, access_token: token.token,
refresh_token: token.refresh_token, refresh_token: token.refresh_token,
expires_in: 60 * 10, expires_in: 60 * 10,
scope: token.scope scope: Enum.join(token.scopes, " ")
} }
json(conn, response) json(conn, response)
@ -192,4 +197,7 @@ defp get_app_from_request(conn, params) do
nil nil
end end
end end
defp scopes(params),
do: OAuth.parse_scopes(params["scopes"] || params["scope"])
end end

View File

@ -8,13 +8,12 @@ defmodule Pleroma.Web.OAuth.Token do
import Ecto.Query import Ecto.Query
alias Pleroma.{User, Repo} alias Pleroma.{User, Repo}
alias Pleroma.Web.OAuth
alias Pleroma.Web.OAuth.{Token, App, Authorization} alias Pleroma.Web.OAuth.{Token, App, Authorization}
schema "oauth_tokens" do schema "oauth_tokens" do
field(:token, :string) field(:token, :string)
field(:refresh_token, :string) field(:refresh_token, :string)
field(:scope, :string) field(:scopes, {:array, :string}, default: [])
field(:valid_until, :naive_datetime) field(:valid_until, :naive_datetime)
belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId) belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId)
belongs_to(:app, App) belongs_to(:app, App)
@ -25,19 +24,19 @@ defmodule Pleroma.Web.OAuth.Token do
def exchange_token(app, auth) do def exchange_token(app, auth) do
with {:ok, auth} <- Authorization.use_token(auth), with {:ok, auth} <- Authorization.use_token(auth),
true <- auth.app_id == app.id do true <- auth.app_id == app.id do
create_token(app, Repo.get(User, auth.user_id), auth.scope) create_token(app, Repo.get(User, auth.user_id), auth.scopes)
end end
end end
def create_token(%App{} = app, %User{} = user, scope \\ nil) do def create_token(%App{} = app, %User{} = user, scopes \\ nil) do
scopes = OAuth.parse_scopes(scope || app.scopes) scopes = scopes || app.scopes
token = :crypto.strong_rand_bytes(32) |> Base.url_encode64() token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64() refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
token = %Token{ token = %Token{
token: token, token: token,
refresh_token: refresh_token, refresh_token: refresh_token,
scope: Enum.join(scopes, " "), scopes: scopes,
user_id: user.id, user_id: user.id,
app_id: app.id, app_id: app.id,
valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10) valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10)

View File

@ -54,6 +54,10 @@
border-bottom: 2px solid #4b8ed8; border-bottom: 2px solid #4b8ed8;
} }
input[type="checkbox"] {
width: auto;
}
button { button {
box-sizing: border-box; box-sizing: border-box;
width: 100%; width: 100%;

View File

@ -5,12 +5,20 @@
<%= label f, :name, "Name or email" %> <%= label f, :name, "Name or email" %>
<%= text_input f, :name %> <%= text_input f, :name %>
<br> <br>
<br>
<%= label f, :password, "Password" %> <%= label f, :password, "Password" %>
<%= password_input f, :password %> <%= password_input f, :password %>
<br> <br>
<%= label f, :scope, "Scopes" %>
<%= text_input f, :scope, value: @scope %>
<br> <br>
<%= label f, :scope, "Permissions" %>
<br>
<%= for scope <- @scopes do %>
<%= checkbox f, :"scopes_#{scope}", hidden_input: false, value: scope, checked_value: scope, name: "authorization[scopes][]" %>
<%= label f, :"scopes_#{scope}", String.capitalize(scope) %>
<br>
<% end %>
<%= hidden_input f, :client_id, value: @client_id %> <%= hidden_input f, :client_id, value: @client_id %>
<%= hidden_input f, :response_type, value: @response_type %> <%= hidden_input f, :response_type, value: @response_type %>
<%= hidden_input f, :redirect_uri, value: @redirect_uri %> <%= hidden_input f, :redirect_uri, value: @redirect_uri %>

View File

@ -20,8 +20,8 @@
"ex_aws_s3": {:hex, :ex_aws_s3, "2.0.1", "9e09366e77f25d3d88c5393824e613344631be8db0d1839faca49686e99b6704", [:mix], [{:ex_aws, "~> 2.0", [hex: :ex_aws, repo: "hexpm", optional: false]}, {:sweet_xml, ">= 0.0.0", [hex: :sweet_xml, repo: "hexpm", optional: true]}], "hexpm"}, "ex_aws_s3": {:hex, :ex_aws_s3, "2.0.1", "9e09366e77f25d3d88c5393824e613344631be8db0d1839faca49686e99b6704", [:mix], [{:ex_aws, "~> 2.0", [hex: :ex_aws, repo: "hexpm", optional: false]}, {:sweet_xml, ">= 0.0.0", [hex: :sweet_xml, repo: "hexpm", optional: true]}], "hexpm"},
"ex_doc": {:hex, :ex_doc, "0.19.1", "519bb9c19526ca51d326c060cb1778d4a9056b190086a8c6c115828eaccea6cf", [:mix], [{:earmark, "~> 1.1", [hex: :earmark, repo: "hexpm", optional: false]}, {:makeup_elixir, "~> 0.7", [hex: :makeup_elixir, repo: "hexpm", optional: false]}], "hexpm"}, "ex_doc": {:hex, :ex_doc, "0.19.1", "519bb9c19526ca51d326c060cb1778d4a9056b190086a8c6c115828eaccea6cf", [:mix], [{:earmark, "~> 1.1", [hex: :earmark, repo: "hexpm", optional: false]}, {:makeup_elixir, "~> 0.7", [hex: :makeup_elixir, repo: "hexpm", optional: false]}], "hexpm"},
"ex_machina": {:hex, :ex_machina, "2.2.0", "fec496331e04fc2db2a1a24fe317c12c0c4a50d2beb8ebb3531ed1f0d84be0ed", [:mix], [{:ecto, "~> 2.1", [hex: :ecto, repo: "hexpm", optional: true]}], "hexpm"}, "ex_machina": {:hex, :ex_machina, "2.2.0", "fec496331e04fc2db2a1a24fe317c12c0c4a50d2beb8ebb3531ed1f0d84be0ed", [:mix], [{:ecto, "~> 2.1", [hex: :ecto, repo: "hexpm", optional: true]}], "hexpm"},
"floki": {:hex, :floki, "0.20.4", "be42ac911fece24b4c72f3b5846774b6e61b83fe685c2fc9d62093277fb3bc86", [:mix], [{:html_entities, "~> 0.4.0", [hex: :html_entities, repo: "hexpm", optional: false]}, {:mochiweb, "~> 2.15", [hex: :mochiweb, repo: "hexpm", optional: false]}], "hexpm"},
"ex_syslogger": {:git, "https://github.com/slashmili/ex_syslogger.git", "f3963399047af17e038897c69e20d552e6899e1d", [tag: "1.4.0"]}, "ex_syslogger": {:git, "https://github.com/slashmili/ex_syslogger.git", "f3963399047af17e038897c69e20d552e6899e1d", [tag: "1.4.0"]},
"floki": {:hex, :floki, "0.20.4", "be42ac911fece24b4c72f3b5846774b6e61b83fe685c2fc9d62093277fb3bc86", [:mix], [{:html_entities, "~> 0.4.0", [hex: :html_entities, repo: "hexpm", optional: false]}, {:mochiweb, "~> 2.15", [hex: :mochiweb, repo: "hexpm", optional: false]}], "hexpm"},
"gen_smtp": {:hex, :gen_smtp, "0.13.0", "11f08504c4bdd831dc520b8f84a1dce5ce624474a797394e7aafd3c29f5dcd25", [:rebar3], [], "hexpm"}, "gen_smtp": {:hex, :gen_smtp, "0.13.0", "11f08504c4bdd831dc520b8f84a1dce5ce624474a797394e7aafd3c29f5dcd25", [:rebar3], [], "hexpm"},
"gettext": {:hex, :gettext, "0.15.0", "40a2b8ce33a80ced7727e36768499fc9286881c43ebafccae6bab731e2b2b8ce", [:mix], [], "hexpm"}, "gettext": {:hex, :gettext, "0.15.0", "40a2b8ce33a80ced7727e36768499fc9286881c43ebafccae6bab731e2b2b8ce", [:mix], [], "hexpm"},
"hackney": {:hex, :hackney, "1.14.3", "b5f6f5dcc4f1fba340762738759209e21914516df6be440d85772542d4a5e412", [:rebar3], [{:certifi, "2.4.2", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "6.0.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "1.0.1", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "1.0.2", [hex: :mimerl, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "1.1.4", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}], "hexpm"}, "hackney": {:hex, :hackney, "1.14.3", "b5f6f5dcc4f1fba340762738759209e21914516df6be440d85772542d4a5e412", [:rebar3], [{:certifi, "2.4.2", [hex: :certifi, repo: "hexpm", optional: false]}, {:idna, "6.0.0", [hex: :idna, repo: "hexpm", optional: false]}, {:metrics, "1.0.1", [hex: :metrics, repo: "hexpm", optional: false]}, {:mimerl, "1.0.2", [hex: :mimerl, repo: "hexpm", optional: false]}, {:ssl_verify_fun, "1.1.4", [hex: :ssl_verify_fun, repo: "hexpm", optional: false]}], "hexpm"},
@ -45,9 +45,9 @@
"pbkdf2_elixir": {:hex, :pbkdf2_elixir, "0.12.3", "6706a148809a29c306062862c803406e88f048277f6e85b68faf73291e820b84", [:mix], [], "hexpm"}, "pbkdf2_elixir": {:hex, :pbkdf2_elixir, "0.12.3", "6706a148809a29c306062862c803406e88f048277f6e85b68faf73291e820b84", [:mix], [], "hexpm"},
"phoenix": {:git, "https://github.com/phoenixframework/phoenix.git", "ea22dc50b574178a300ecd19253443960407df93", [branch: "v1.4"]}, "phoenix": {:git, "https://github.com/phoenixframework/phoenix.git", "ea22dc50b574178a300ecd19253443960407df93", [branch: "v1.4"]},
"phoenix_ecto": {:hex, :phoenix_ecto, "3.3.0", "702f6e164512853d29f9d20763493f2b3bcfcb44f118af2bc37bb95d0801b480", [:mix], [{:ecto, "~> 2.1", [hex: :ecto, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 2.9", [hex: :phoenix_html, repo: "hexpm", optional: true]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"}, "phoenix_ecto": {:hex, :phoenix_ecto, "3.3.0", "702f6e164512853d29f9d20763493f2b3bcfcb44f118af2bc37bb95d0801b480", [:mix], [{:ecto, "~> 2.1", [hex: :ecto, repo: "hexpm", optional: false]}, {:phoenix_html, "~> 2.9", [hex: :phoenix_html, repo: "hexpm", optional: true]}, {:plug, "~> 1.0", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
"phoenix_html": {:hex, :phoenix_html, "2.11.2", "86ebd768258ba60a27f5578bec83095bdb93485d646fc4111db8844c316602d6", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"}, "phoenix_html": {:hex, :phoenix_html, "2.13.1", "fa8f034b5328e2dfa0e4131b5569379003f34bc1fafdaa84985b0b9d2f12e68b", [:mix], [{:plug, "~> 1.5", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
"phoenix_pubsub": {:hex, :phoenix_pubsub, "1.1.1", "6668d787e602981f24f17a5fbb69cc98f8ab085114ebfac6cc36e10a90c8e93c", [:mix], [], "hexpm"}, "phoenix_pubsub": {:hex, :phoenix_pubsub, "1.1.1", "6668d787e602981f24f17a5fbb69cc98f8ab085114ebfac6cc36e10a90c8e93c", [:mix], [], "hexpm"},
"plug": {:hex, :plug, "1.7.1", "8516d565fb84a6a8b2ca722e74e2cd25ca0fc9d64f364ec9dbec09d33eb78ccd", [:mix], [{:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug_crypto, "~> 1.0", [hex: :plug_crypto, repo: "hexpm", optional: false]}], "hexpm"}, "plug": {:hex, :plug, "1.7.2", "d7b7db7fbd755e8283b6c0a50be71ec0a3d67d9213d74422d9372effc8e87fd1", [:mix], [{:mime, "~> 1.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug_crypto, "~> 1.0", [hex: :plug_crypto, repo: "hexpm", optional: false]}], "hexpm"},
"plug_cowboy": {:hex, :plug_cowboy, "1.0.0", "2e2a7d3409746d335f451218b8bb0858301c3de6d668c3052716c909936eb57a", [:mix], [{:cowboy, "~> 1.0", [hex: :cowboy, repo: "hexpm", optional: false]}, {:plug, "~> 1.7", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"}, "plug_cowboy": {:hex, :plug_cowboy, "1.0.0", "2e2a7d3409746d335f451218b8bb0858301c3de6d668c3052716c909936eb57a", [:mix], [{:cowboy, "~> 1.0", [hex: :cowboy, repo: "hexpm", optional: false]}, {:plug, "~> 1.7", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm"},
"plug_crypto": {:hex, :plug_crypto, "1.0.0", "18e49317d3fa343f24620ed22795ec29d4a5e602d52d1513ccea0b07d8ea7d4d", [:mix], [], "hexpm"}, "plug_crypto": {:hex, :plug_crypto, "1.0.0", "18e49317d3fa343f24620ed22795ec29d4a5e602d52d1513ccea0b07d8ea7d4d", [:mix], [], "hexpm"},
"poison": {:hex, :poison, "3.1.0", "d9eb636610e096f86f25d9a46f35a9facac35609a7591b3be3326e99a0484665", [:mix], [], "hexpm"}, "poison": {:hex, :poison, "3.1.0", "d9eb636610e096f86f25d9a46f35a9facac35609a7591b3be3326e99a0484665", [:mix], [], "hexpm"},

View File

@ -1,10 +1,10 @@
defmodule Pleroma.Repo.Migrations.AddScopeToOAuthEntities do defmodule Pleroma.Repo.Migrations.AddScopeSToOAuthEntities do
use Ecto.Migration use Ecto.Migration
def change do def change do
for t <- [:oauth_authorizations, :oauth_tokens] do for t <- [:oauth_authorizations, :oauth_tokens] do
alter table(t) do alter table(t) do
add :scope, :string add :scopes, {:array, :string}, default: [], null: false
end end
end end
end end

View File

@ -1,4 +1,4 @@
defmodule Pleroma.Repo.Migrations.DataMigrationPopulateOAuthScope do defmodule Pleroma.Repo.Migrations.DataMigrationPopulateOAuthScopes do
use Ecto.Migration use Ecto.Migration
require Ecto.Query require Ecto.Query
@ -11,16 +11,15 @@ defmodule Pleroma.Repo.Migrations.DataMigrationPopulateOAuthScope do
def up do def up do
for app <- Repo.all(Query.from(app in App)) do for app <- Repo.all(Query.from(app in App)) do
scopes = OAuth.parse_scopes(app.scopes) scopes = OAuth.parse_scopes(app.scopes)
scope = Enum.join(scopes, " ")
Repo.update_all( Repo.update_all(
Query.from(auth in Authorization, where: auth.app_id == ^app.id), Query.from(auth in Authorization, where: auth.app_id == ^app.id),
set: [scope: scope] set: [scopes: scopes]
) )
Repo.update_all( Repo.update_all(
Query.from(token in Token, where: token.app_id == ^app.id), Query.from(token in Token, where: token.app_id == ^app.id),
set: [scope: scope] set: [scopes: scopes]
) )
end end
end end

View File

@ -0,0 +1,17 @@
defmodule Pleroma.Repo.Migrations.ChangeAppsScopesToVarcharArray do
use Ecto.Migration
@alter_apps_scopes "ALTER TABLE apps ALTER COLUMN scopes"
def up do
execute "#{@alter_apps_scopes} TYPE varchar(255)[] USING string_to_array(scopes, ',')::varchar(255)[];"
execute "#{@alter_apps_scopes} SET DEFAULT ARRAY[]::character varying[];"
execute "#{@alter_apps_scopes} SET NOT NULL;"
end
def down do
execute "#{@alter_apps_scopes} DROP NOT NULL;"
execute "#{@alter_apps_scopes} DROP DEFAULT;"
execute "#{@alter_apps_scopes} TYPE varchar(255) USING array_to_string(scopes, ',')::varchar(255);"
end
end

View File

@ -80,7 +80,7 @@ test "receives well formatted events" do
Pleroma.Repo.insert( Pleroma.Repo.insert(
OAuth.App.register_changeset(%OAuth.App{}, %{ OAuth.App.register_changeset(%OAuth.App{}, %{
client_name: "client", client_name: "client",
scopes: "scope", scopes: ["scope"],
redirect_uris: "url" redirect_uris: "url"
}) })
) )

View File

@ -214,7 +214,7 @@ def oauth_app_factory do
%Pleroma.Web.OAuth.App{ %Pleroma.Web.OAuth.App{
client_name: "Some client", client_name: "Some client",
redirect_uris: "https://example.com/callback", redirect_uris: "https://example.com/callback",
scopes: "read", scopes: ["read"],
website: "https://example.com", website: "https://example.com",
client_id: "aaabbb==", client_id: "aaabbb==",
client_secret: "aaa;/&bbb" client_secret: "aaa;/&bbb"

View File

@ -12,7 +12,7 @@ test "create an authorization token for a valid app" do
Repo.insert( Repo.insert(
App.register_changeset(%App{}, %{ App.register_changeset(%App{}, %{
client_name: "client", client_name: "client",
scopes: "scope", scopes: ["scope"],
redirect_uris: "url" redirect_uris: "url"
}) })
) )
@ -32,7 +32,7 @@ test "use up a token" do
Repo.insert( Repo.insert(
App.register_changeset(%App{}, %{ App.register_changeset(%App{}, %{
client_name: "client", client_name: "client",
scopes: "scope", scopes: ["scope"],
redirect_uris: "url" redirect_uris: "url"
}) })
) )
@ -65,7 +65,7 @@ test "delete authorizations" do
Repo.insert( Repo.insert(
App.register_changeset(%App{}, %{ App.register_changeset(%App{}, %{
client_name: "client", client_name: "client",
scopes: "scope", scopes: ["scope"],
redirect_uris: "url" redirect_uris: "url"
}) })
) )

View File

@ -21,6 +21,7 @@ test "redirects with oauth authorization" do
"password" => "test", "password" => "test",
"client_id" => app.client_id, "client_id" => app.client_id,
"redirect_uri" => app.redirect_uris, "redirect_uri" => app.redirect_uris,
"scope" => Enum.join(app.scopes, " "),
"state" => "statepassed" "state" => "statepassed"
} }
}) })

View File

@ -14,7 +14,7 @@ test "exchanges a auth token for an access token" do
Repo.insert( Repo.insert(
App.register_changeset(%App{}, %{ App.register_changeset(%App{}, %{
client_name: "client", client_name: "client",
scopes: "scope", scopes: ["scope"],
redirect_uris: "url" redirect_uris: "url"
}) })
) )
@ -39,7 +39,7 @@ test "deletes all tokens of a user" do
Repo.insert( Repo.insert(
App.register_changeset(%App{}, %{ App.register_changeset(%App{}, %{
client_name: "client1", client_name: "client1",
scopes: "scope", scopes: ["scope"],
redirect_uris: "url" redirect_uris: "url"
}) })
) )
@ -48,7 +48,7 @@ test "deletes all tokens of a user" do
Repo.insert( Repo.insert(
App.register_changeset(%App{}, %{ App.register_changeset(%App{}, %{
client_name: "client2", client_name: "client2",
scopes: "scope", scopes: ["scope"],
redirect_uris: "url" redirect_uris: "url"
}) })
) )