hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Make auth tokens usable once and expire them.

Browse source
This commit is contained in:
Roger Braun 2017-09-09 12:02:59 +02:00
commit 95cedd6000
4 changed files with 91 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/pleroma/web/oauth/token.ex
View file

@ -2,7 +2,7 @@ defmodule Pleroma.Web.OAuth.Token do
use Ecto.Schema
alias Pleroma.{User, Repo}
alias Pleroma.Web.OAuth.{Token, App}
alias Pleroma.Web.OAuth.{Token, App, Authorization}
schema "oauth_tokens" do
field :token, :string
@ -14,6 +14,13 @@ defmodule Pleroma.Web.OAuth.Token do
timestamps()
end
def exchange_token(app, auth) do
with {:ok, auth} <- Authorization.use_token(auth),
true <- auth.app_id == app.id do
create_token(app, Repo.get(User, auth.user_id))
end
end
def create_token(%App{} = app, %User{} = user) do
token = :crypto.strong_rand_bytes(32) |> Base.url_encode64
refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64