hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge branch 'auth-improvements' into 'develop'

Browse source 
Cookie auth rework / Auth subsystem refactoring and tweaks

Closes pleroma/secteam/pleroma#3

See merge request pleroma/pleroma!3112
This commit is contained in:
lain 2020-12-09 15:55:45 +00:00
commit 477c6c8e55
45 changed files with 974 additions and 791 deletions
Download patch file Download diff file Expand all files Collapse all files

5
test/pleroma/user_test.exs
View file

@ -2176,4 +2176,9 @@ defmodule Pleroma.UserTest do
assert User.avatar_url(user, no_default: true) == nil
end
test "get_host/1" do
user = insert(:user, ap_id: "https://lain.com/users/lain", nickname: "lain")
assert User.get_host(user) == "lain.com"
end
end

4
test/pleroma/web/admin_api/controllers/admin_api_controller_test.exs
View file

@ -941,7 +941,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
describe "/api/pleroma/admin/stats" do
test "status visibility count", %{conn: conn} do
admin = insert(:user, is_admin: true)
user = insert(:user)
CommonAPI.post(user, %{visibility: "public", status: "hey"})
CommonAPI.post(user, %{visibility: "unlisted", status: "hey"})
@ -949,7 +948,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
response =
conn
|> assign(:user, admin)
|> get("/api/pleroma/admin/stats")
|> json_response(200)
@ -958,7 +956,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
end
test "by instance", %{conn: conn} do
admin = insert(:user, is_admin: true)
user1 = insert(:user)
instance2 = "instance2.tld"
user2 = insert(:user, %{ap_id: "https://#{instance2}/@actor"})
@ -969,7 +966,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
response =
conn
|> assign(:user, admin)
|> get("/api/pleroma/admin/stats", instance: instance2)
|> json_response(200)

12
test/pleroma/web/admin_api/controllers/config_controller_test.exs
View file

@ -1417,11 +1417,7 @@ defmodule Pleroma.Web.AdminAPI.ConfigControllerTest do
describe "GET /api/pleroma/admin/config/descriptions" do
test "structure", %{conn: conn} do
admin = insert(:user, is_admin: true)
conn =
assign(conn, :user, admin)
|> get("/api/pleroma/admin/config/descriptions")
conn = get(conn, "/api/pleroma/admin/config/descriptions")
assert [child | _others] = json_response_and_validate_schema(conn, 200)
@ -1439,11 +1435,7 @@ defmodule Pleroma.Web.AdminAPI.ConfigControllerTest do
{:esshd}
])
admin = insert(:user, is_admin: true)
conn =
assign(conn, :user, admin)
|> get("/api/pleroma/admin/config/descriptions")
conn = get(conn, "/api/pleroma/admin/config/descriptions")
children = json_response_and_validate_schema(conn, 200)

4
test/pleroma/web/mastodon_api/controllers/auth_controller_test.exs
View file

@ -39,7 +39,7 @@ defmodule Pleroma.Web.MastodonAPI.AuthControllerTest do
|> get("/web/login", %{code: auth.token})
assert conn.status == 302
assert redirected_to(conn) == path
assert redirected_to(conn) =~ path
end
test "redirects to the getting-started page when referer is not present", %{conn: conn} do
@ -49,7 +49,7 @@ defmodule Pleroma.Web.MastodonAPI.AuthControllerTest do
conn = get(conn, "/web/login", %{code: auth.token})
assert conn.status == 302
assert redirected_to(conn) == "/web/getting-started"
assert redirected_to(conn) =~ "/web/getting-started"
end
end

3
test/pleroma/web/mastodon_api/masto_fe_controller_test.exs
View file

@ -64,7 +64,8 @@ defmodule Pleroma.Web.MastodonAPI.MastoFEControllerTest do
end
test "does not redirect logged in users to the login page", %{conn: conn, path: path} do
token = insert(:oauth_token, scopes: ["read"])
{:ok, app} = Pleroma.Web.MastodonAPI.AuthController.local_mastofe_app()
token = insert(:oauth_token, app: app, scopes: ["read"])
conn =
conn

86
test/pleroma/web/o_auth/o_auth_controller_test.exs
View file

@ -4,8 +4,10 @@
defmodule Pleroma.Web.OAuth.OAuthControllerTest do
use Pleroma.Web.ConnCase
import Pleroma.Factory
alias Pleroma.Helpers.AuthHelper
alias Pleroma.MFA
alias Pleroma.MFA.TOTP
alias Pleroma.Repo
@ -454,7 +456,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
|> put_session(:oauth_token, token.token)
|> AuthHelper.put_session_token(token.token)
|> get(
"/oauth/authorize",
%{
@ -478,7 +480,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
|> put_session(:oauth_token, token.token)
|> AuthHelper.put_session_token(token.token)
|> get(
"/oauth/authorize",
%{
@ -501,7 +503,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
|> put_session(:oauth_token, token.token)
|> AuthHelper.put_session_token(token.token)
|> get(
"/oauth/authorize",
%{
@ -527,7 +529,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
|> put_session(:oauth_token, token.token)
|> AuthHelper.put_session_token(token.token)
|> get(
"/oauth/authorize",
%{
@ -551,7 +553,7 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
conn =
conn
|> put_session(:oauth_token, token.token)
|> AuthHelper.put_session_token(token.token)
|> get(
"/oauth/authorize",
%{
@ -609,6 +611,41 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
end
end
test "authorize from cookie" do
user = insert(:user)
app = insert(:oauth_app)
oauth_token = insert(:oauth_token, user: user, app: app)
redirect_uri = OAuthController.default_redirect_uri(app)
conn =
build_conn()
|> Plug.Session.call(Plug.Session.init(@session_opts))
|> fetch_session()
|> AuthHelper.put_session_token(oauth_token.token)
|> post(
"/oauth/authorize",
%{
"authorization" => %{
"name" => user.nickname,
"client_id" => app.client_id,
"redirect_uri" => redirect_uri,
"scope" => app.scopes,
"state" => "statepassed"
}
}
)
target = redirected_to(conn)
assert target =~ redirect_uri
query = URI.parse(target).query |> URI.query_decoder() |> Map.new()
assert %{"state" => "statepassed", "code" => code} = query
auth = Repo.get_by(Authorization, token: code)
assert auth
assert auth.scopes == app.scopes
end
test "redirect to on two-factor auth page" do
otp_secret = TOTP.generate_secret()
@ -1219,8 +1256,43 @@ defmodule Pleroma.Web.OAuth.OAuthControllerTest do
end
end
describe "POST /oauth/revoke - bad request" do
test "returns 500" do
describe "POST /oauth/revoke" do
test "when authenticated with request token, revokes it and clears it from session" do
oauth_token = insert(:oauth_token)
conn =
build_conn()
|> Plug.Session.call(Plug.Session.init(@session_opts))
|> fetch_session()
|> AuthHelper.put_session_token(oauth_token.token)
|> post("/oauth/revoke", %{"token" => oauth_token.token})
assert json_response(conn, 200)
refute AuthHelper.get_session_token(conn)
assert Token.get_by_token(oauth_token.token) == {:error, :not_found}
end
test "if request is authenticated with a different token, " <>
"revokes requested token but keeps session token" do
user = insert(:user)
oauth_token = insert(:oauth_token, user: user)
other_app_oauth_token = insert(:oauth_token, user: user)
conn =
build_conn()
|> Plug.Session.call(Plug.Session.init(@session_opts))
|> fetch_session()
|> AuthHelper.put_session_token(oauth_token.token)
|> post("/oauth/revoke", %{"token" => other_app_oauth_token.token})
assert json_response(conn, 200)
assert AuthHelper.get_session_token(conn) == oauth_token.token
assert Token.get_by_token(other_app_oauth_token.token) == {:error, :not_found}
end
test "returns 500 on bad request" do
response =
build_conn()
|> post("/oauth/revoke", %{})

5
test/pleroma/web/pleroma_api/controllers/chat_controller_test.exs
View file

@ -264,9 +264,10 @@ defmodule Pleroma.Web.PleromaAPI.ChatControllerTest do
assert length(result) == 3
# Trying to get the chat of a different user
other_user_chat = Chat.get(other_user.id, user.ap_id)
conn
|> assign(:user, other_user)
|> get("/api/v1/pleroma/chats/#{chat.id}/messages")
|> get("/api/v1/pleroma/chats/#{other_user_chat.id}/messages")
|> json_response_and_validate_schema(404)
end
end

2
test/pleroma/web/plugs/admin_secret_authentication_plug_test.exs
View file

@ -49,6 +49,7 @@ defmodule Pleroma.Web.Plugs.AdminSecretAuthenticationPlugTest do
|> AdminSecretAuthenticationPlug.call(%{})
assert conn.assigns[:user].is_admin
assert conn.assigns[:token] == nil
assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
end
@ -69,6 +70,7 @@ defmodule Pleroma.Web.Plugs.AdminSecretAuthenticationPlugTest do
|> AdminSecretAuthenticationPlug.call(%{})
assert conn.assigns[:user].is_admin
assert conn.assigns[:token] == nil
assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
end
end

3
test/pleroma/web/plugs/authentication_plug_test.exs
View file

@ -48,6 +48,7 @@ defmodule Pleroma.Web.Plugs.AuthenticationPlugTest do
|> AuthenticationPlug.call(%{})
assert conn.assigns.user == conn.assigns.auth_user
assert conn.assigns.token == nil
assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
end
@ -62,6 +63,7 @@ defmodule Pleroma.Web.Plugs.AuthenticationPlugTest do
|> AuthenticationPlug.call(%{})
assert conn.assigns.user.id == conn.assigns.auth_user.id
assert conn.assigns.token == nil
assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
user = User.get_by_id(user.id)
@ -83,6 +85,7 @@ defmodule Pleroma.Web.Plugs.AuthenticationPlugTest do
|> AuthenticationPlug.call(%{})
assert conn.assigns.user.id == conn.assigns.auth_user.id
assert conn.assigns.token == nil
assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
user = User.get_by_id(user.id)

29
test/pleroma/web/plugs/ensure_user_key_plug_test.exs
View file

@ -1,29 +0,0 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Plugs.EnsureUserKeyPlugTest do
use Pleroma.Web.ConnCase, async: true
alias Pleroma.Web.Plugs.EnsureUserKeyPlug
test "if the conn has a user key set, it does nothing", %{conn: conn} do
conn =
conn
|> assign(:user, 1)
ret_conn =
conn
|> EnsureUserKeyPlug.call(%{})
assert conn == ret_conn
end
test "if the conn has no key set, it sets it to nil", %{conn: conn} do
conn =
conn
|> EnsureUserKeyPlug.call(%{})
assert Map.has_key?(conn.assigns, :user)
end
end

69
test/pleroma/web/plugs/ensure_user_token_assigns_plug_test.exs Normal file
View file

@ -0,0 +1,69 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Plugs.EnsureUserTokenAssignsPlugTest do
use Pleroma.Web.ConnCase, async: true
import Pleroma.Factory
alias Pleroma.Web.Plugs.EnsureUserTokenAssignsPlug
test "with :user assign set to a User record " <>
"and :token assign set to a Token belonging to this user, " <>
"it does nothing" do
%{conn: conn} = oauth_access(["read"])
ret_conn = EnsureUserTokenAssignsPlug.call(conn, %{})
assert conn == ret_conn
end
test "with :user assign set to a User record " <>
"but :token assign not set or not a Token, " <>
"it assigns :token to `nil`",
%{conn: conn} do
user = insert(:user)
conn = assign(conn, :user, user)
ret_conn = EnsureUserTokenAssignsPlug.call(conn, %{})
assert %{token: nil} = ret_conn.assigns
ret_conn2 =
conn
|> assign(:token, 1)
|> EnsureUserTokenAssignsPlug.call(%{})
assert %{token: nil} = ret_conn2.assigns
end
# Abnormal (unexpected) scenario
test "with :user assign set to a User record " <>
"but :token assign set to a Token NOT belonging to :user, " <>
"it drops auth info" do
%{conn: conn} = oauth_access(["read"])
other_user = insert(:user)
conn = assign(conn, :user, other_user)
ret_conn = EnsureUserTokenAssignsPlug.call(conn, %{})
assert %{user: nil, token: nil} = ret_conn.assigns
end
test "if :user assign is not set to a User record, it sets :user and :token to nil", %{
conn: conn
} do
ret_conn = EnsureUserTokenAssignsPlug.call(conn, %{})
assert %{user: nil, token: nil} = ret_conn.assigns
ret_conn2 =
conn
|> assign(:user, 1)
|> EnsureUserTokenAssignsPlug.call(%{})
assert %{user: nil, token: nil} = ret_conn2.assigns
end
end

82
test/pleroma/web/plugs/legacy_authentication_plug_test.exs
View file

@ -1,82 +0,0 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Plugs.LegacyAuthenticationPlugTest do
use Pleroma.Web.ConnCase
import Pleroma.Factory
alias Pleroma.User
alias Pleroma.Web.Plugs.LegacyAuthenticationPlug
alias Pleroma.Web.Plugs.OAuthScopesPlug
alias Pleroma.Web.Plugs.PlugHelper
setup do
user =
insert(:user,
password: "password",
password_hash:
"$6$9psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
)
%{user: user}
end
test "it does nothing if a user is assigned", %{conn: conn, user: user} do
conn =
conn
|> assign(:auth_credentials, %{username: "dude", password: "password"})
|> assign(:auth_user, user)
|> assign(:user, %User{})
ret_conn =
conn
|> LegacyAuthenticationPlug.call(%{})
assert ret_conn == conn
end
@tag :skip_on_mac
test "if `auth_user` is present and password is correct, " <>
"it authenticates the user, resets the password, marks OAuthScopesPlug as skipped",
%{
conn: conn,
user: user
} do
conn =
conn
|> assign(:auth_credentials, %{username: "dude", password: "password"})
|> assign(:auth_user, user)
conn = LegacyAuthenticationPlug.call(conn, %{})
assert conn.assigns.user.id == user.id
assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
end
@tag :skip_on_mac
test "it does nothing if the password is wrong", %{
conn: conn,
user: user
} do
conn =
conn
|> assign(:auth_credentials, %{username: "dude", password: "wrong_password"})
|> assign(:auth_user, user)
ret_conn =
conn
|> LegacyAuthenticationPlug.call(%{})
assert conn == ret_conn
end
test "with no credentials or user it does nothing", %{conn: conn} do
ret_conn =
conn
|> LegacyAuthenticationPlug.call(%{})
assert ret_conn == conn
end
end

98
test/pleroma/web/plugs/o_auth_plug_test.exs
View file

@ -5,43 +5,49 @@
defmodule Pleroma.Web.Plugs.OAuthPlugTest do
use Pleroma.Web.ConnCase, async: true
alias Pleroma.Helpers.AuthHelper
alias Pleroma.Web.OAuth.Token
alias Pleroma.Web.OAuth.Token.Strategy.Revoke
alias Pleroma.Web.Plugs.OAuthPlug
import Pleroma.Factory
alias Plug.Session
@session_opts [
store: :cookie,
key: "_test",
signing_salt: "cooldude"
]
import Pleroma.Factory
setup %{conn: conn} do
user = insert(:user)
{:ok, %{token: token}} = Pleroma.Web.OAuth.Token.create(insert(:oauth_app), user)
%{user: user, token: token, conn: conn}
{:ok, oauth_token} = Token.create(insert(:oauth_app), user)
%{user: user, token: oauth_token, conn: conn}
end
test "with valid token(uppercase), it assigns the user", %{conn: conn} = opts do
test "it does nothing if a user is assigned", %{conn: conn} do
conn = assign(conn, :user, %Pleroma.User{})
ret_conn = OAuthPlug.call(conn, %{})
assert ret_conn == conn
end
test "with valid token (uppercase) in auth header, it assigns the user", %{conn: conn} = opts do
conn =
conn
|> put_req_header("authorization", "BEARER #{opts[:token]}")
|> put_req_header("authorization", "BEARER #{opts[:token].token}")
|> OAuthPlug.call(%{})
assert conn.assigns[:user] == opts[:user]
end
test "with valid token(downcase), it assigns the user", %{conn: conn} = opts do
test "with valid token (downcase) in auth header, it assigns the user", %{conn: conn} = opts do
conn =
conn
|> put_req_header("authorization", "bearer #{opts[:token]}")
|> put_req_header("authorization", "bearer #{opts[:token].token}")
|> OAuthPlug.call(%{})
assert conn.assigns[:user] == opts[:user]
end
test "with valid token(downcase) in url parameters, it assigns the user", opts do
test "with valid token (downcase) in url parameters, it assigns the user", opts do
conn =
:get
|> build_conn("/?access_token=#{opts[:token]}")
|> build_conn("/?access_token=#{opts[:token].token}")
|> put_req_header("content-type", "application/json")
|> fetch_query_params()
|> OAuthPlug.call(%{})
@ -49,16 +55,16 @@ defmodule Pleroma.Web.Plugs.OAuthPlugTest do
assert conn.assigns[:user] == opts[:user]
end
test "with valid token(downcase) in body parameters, it assigns the user", opts do
test "with valid token (downcase) in body parameters, it assigns the user", opts do
conn =
:post
|> build_conn("/api/v1/statuses", access_token: opts[:token], status: "test")
|> build_conn("/api/v1/statuses", access_token: opts[:token].token, status: "test")
|> OAuthPlug.call(%{})
assert conn.assigns[:user] == opts[:user]
end
test "with invalid token, it not assigns the user", %{conn: conn} do
test "with invalid token, it does not assign the user", %{conn: conn} do
conn =
conn
|> put_req_header("authorization", "bearer TTTTT")
@ -67,14 +73,56 @@ defmodule Pleroma.Web.Plugs.OAuthPlugTest do
refute conn.assigns[:user]
end
test "when token is missed but token in session, it assigns the user", %{conn: conn} = opts do
conn =
conn
|> Plug.Session.call(Plug.Session.init(@session_opts))
|> fetch_session()
|> put_session(:oauth_token, opts[:token])
|> OAuthPlug.call(%{})
describe "with :oauth_token in session, " do
setup %{token: oauth_token, conn: conn} do
session_opts = [
store: :cookie,
key: "_test",
signing_salt: "cooldude"
]
assert conn.assigns[:user] == opts[:user]
conn =
conn
|> Session.call(Session.init(session_opts))
|> fetch_session()
|> AuthHelper.put_session_token(oauth_token.token)
%{conn: conn}
end
test "if session-stored token matches a valid OAuth token, assigns :user and :token", %{
conn: conn,
user: user,
token: oauth_token
} do
conn = OAuthPlug.call(conn, %{})
assert conn.assigns.user && conn.assigns.user.id == user.id
assert conn.assigns.token && conn.assigns.token.id == oauth_token.id
end
test "if session-stored token matches an expired OAuth token, does nothing", %{
conn: conn,
token: oauth_token
} do
expired_valid_until = NaiveDateTime.add(NaiveDateTime.utc_now(), -3600 * 24, :second)
oauth_token
|> Ecto.Changeset.change(valid_until: expired_valid_until)
|> Pleroma.Repo.update()
ret_conn = OAuthPlug.call(conn, %{})
assert ret_conn == conn
end
test "if session-stored token matches a revoked OAuth token, does nothing", %{
conn: conn,
token: oauth_token
} do
Revoke.revoke(oauth_token)
ret_conn = OAuthPlug.call(conn, %{})
assert ret_conn == conn
end
end
end

63
test/pleroma/web/plugs/session_authentication_plug_test.exs
View file

@ -1,63 +0,0 @@
# Pleroma: A lightweight social networking server
# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.Plugs.SessionAuthenticationPlugTest do
use Pleroma.Web.ConnCase, async: true
alias Pleroma.User
alias Pleroma.Web.Plugs.SessionAuthenticationPlug
setup %{conn: conn} do
session_opts = [
store: :cookie,
key: "_test",
signing_salt: "cooldude"
]
conn =
conn
|> Plug.Session.call(Plug.Session.init(session_opts))
|> fetch_session
|> assign(:auth_user, %User{id: 1})
%{conn: conn}
end
test "it does nothing if a user is assigned", %{conn: conn} do
conn =
conn
|> assign(:user, %User{})
ret_conn =
conn
|> SessionAuthenticationPlug.call(%{})
assert ret_conn == conn
end
test "if the auth_user has the same id as the user_id in the session, it assigns the user", %{
conn: conn
} do
conn =
conn
|> put_session(:user_id, conn.assigns.auth_user.id)
|> SessionAuthenticationPlug.call(%{})
assert conn.assigns.user == conn.assigns.auth_user
end
test "if the auth_user has a different id as the user_id in the session, it does nothing", %{
conn: conn
} do
conn =
conn
|> put_session(:user_id, -1)
ret_conn =
conn
|> SessionAuthenticationPlug.call(%{})
assert ret_conn == conn
end
end

20
test/pleroma/web/plugs/set_user_session_id_plug_test.exs
View file

@ -5,7 +5,7 @@
defmodule Pleroma.Web.Plugs.SetUserSessionIdPlugTest do
use Pleroma.Web.ConnCase, async: true
alias Pleroma.User
alias Pleroma.Helpers.AuthHelper
alias Pleroma.Web.Plugs.SetUserSessionIdPlug
setup %{conn: conn} do
@ -18,28 +18,26 @@ defmodule Pleroma.Web.Plugs.SetUserSessionIdPlugTest do
conn =
conn
|> Plug.Session.call(Plug.Session.init(session_opts))
|> fetch_session
|> fetch_session()
%{conn: conn}
end
test "doesn't do anything if the user isn't set", %{conn: conn} do
ret_conn =
conn
|> SetUserSessionIdPlug.call(%{})
ret_conn = SetUserSessionIdPlug.call(conn, %{})
assert ret_conn == conn
end
test "sets the user_id in the session to the user id of the user assign", %{conn: conn} do
Code.ensure_compiled(Pleroma.User)
test "sets session token basing on :token assign", %{conn: conn} do
%{user: user, token: oauth_token} = oauth_access(["read"])
conn =
ret_conn =
conn
|> assign(:user, %User{id: 1})
|> assign(:user, user)
|> assign(:token, oauth_token)
|> SetUserSessionIdPlug.call(%{})
id = get_session(conn, :user_id)
assert id == 1
assert AuthHelper.get_session_token(ret_conn) == oauth_token.token
end
end