aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--config/test.exs2
-rw-r--r--docs/config.md20
-rw-r--r--lib/pleroma/user.ex4
-rw-r--r--lib/pleroma/web/auth/pleroma_authenticator.ex11
-rw-r--r--lib/pleroma/web/oauth/oauth_controller.ex6
-rw-r--r--test/web/activity_pub/transmogrifier/follow_handling_test.exs116
-rw-r--r--test/web/activity_pub/transmogrifier_test.exs54
-rw-r--r--test/web/twitter_api/twitter_api_test.exs6
8 files changed, 156 insertions, 63 deletions
diff --git a/config/test.exs b/config/test.exs
index 41cddb9bd..7861b9598 100644
--- a/config/test.exs
+++ b/config/test.exs
@@ -17,6 +17,8 @@ config :pleroma, Pleroma.Captcha,
# Print only warnings and errors during test
config :logger, level: :warn
+config :pleroma, :auth, oauth_consumer_strategies: []
+
config :pleroma, Pleroma.Upload, filters: [], link_name: false
config :pleroma, Pleroma.Uploaders.Local, uploads: "test/uploads"
diff --git a/docs/config.md b/docs/config.md
index f4a1868fd..93ede6464 100644
--- a/docs/config.md
+++ b/docs/config.md
@@ -514,7 +514,7 @@ Authentication / authorization settings.
* `auth_template`: authentication form template. By default it's `show.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/show.html.eex`.
* `oauth_consumer_template`: OAuth consumer mode authentication form template. By default it's `consumer.html` which corresponds to `lib/pleroma/web/templates/o_auth/o_auth/consumer.html.eex`.
-* `oauth_consumer_strategies`: the list of enabled OAuth consumer strategies; by default it's set by OAUTH_CONSUMER_STRATEGIES environment variable. Each entry in this space-delimited string should be of format `<strategy>` or `<strategy>:<dependency>` (e.g. `twitter` or `keycloak:ueberauth_keycloak_strategy` in case dependency is named differently than `ueberauth_<strategy>`).
+* `oauth_consumer_strategies`: the list of enabled OAuth consumer strategies; by default it's set by `OAUTH_CONSUMER_STRATEGIES` environment variable. Each entry in this space-delimited string should be of format `<strategy>` or `<strategy>:<dependency>` (e.g. `twitter` or `keycloak:ueberauth_keycloak_strategy` in case dependency is named differently than `ueberauth_<strategy>`).
## OAuth consumer mode
@@ -567,6 +567,24 @@ config :ueberauth, Ueberauth,
providers: [
microsoft: {Ueberauth.Strategy.Microsoft, [callback_params: []]}
]
+
+# Keycloak
+# Note: make sure to add `keycloak:ueberauth_keycloak_strategy` entry to `OAUTH_CONSUMER_STRATEGIES` environment variable
+keycloak_url = "https://publicly-reachable-keycloak-instance.org:8080"
+
+config :ueberauth, Ueberauth.Strategy.Keycloak.OAuth,
+ client_id: System.get_env("KEYCLOAK_CLIENT_ID"),
+ client_secret: System.get_env("KEYCLOAK_CLIENT_SECRET"),
+ site: keycloak_url,
+ authorize_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/auth",
+ token_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/token",
+ userinfo_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/userinfo",
+ token_method: :post
+
+config :ueberauth, Ueberauth,
+ providers: [
+ keycloak: {Ueberauth.Strategy.Keycloak, [uid_field: :email]}
+ ]
```
## OAuth 2.0 provider - :oauth2
diff --git a/lib/pleroma/user.ex b/lib/pleroma/user.ex
index cae2c14e3..d9f7e14b0 100644
--- a/lib/pleroma/user.ex
+++ b/lib/pleroma/user.ex
@@ -370,8 +370,8 @@ defmodule Pleroma.User do
ap_followers = followed.follower_address
cond do
- following?(follower, followed) or info.deactivated ->
- {:error, "Could not follow user: #{followed.nickname} is already on your list."}
+ info.deactivated ->
+ {:error, "Could not follow user: You are deactivated."}
deny_follow_blocked and blocks?(followed, follower) ->
{:error, "Could not follow user: #{followed.nickname} blocked you."}
diff --git a/lib/pleroma/web/auth/pleroma_authenticator.ex b/lib/pleroma/web/auth/pleroma_authenticator.ex
index c4a6fce08..a9164ad98 100644
--- a/lib/pleroma/web/auth/pleroma_authenticator.ex
+++ b/lib/pleroma/web/auth/pleroma_authenticator.ex
@@ -24,6 +24,14 @@ defmodule Pleroma.Web.Auth.PleromaAuthenticator do
end
end
+ @doc """
+ Gets or creates Pleroma.Registration record from Ueberauth assigns.
+ Note: some strategies (like `keycloak`) might need extra configuration to fill `uid` from callback response —
+ see [`docs/config.md`](docs/config.md).
+ """
+ def get_registration(%Plug.Conn{assigns: %{ueberauth_auth: %{uid: nil}}}),
+ do: {:error, :missing_uid}
+
def get_registration(%Plug.Conn{
assigns: %{ueberauth_auth: %{provider: provider, uid: uid} = auth}
}) do
@@ -51,9 +59,10 @@ defmodule Pleroma.Web.Auth.PleromaAuthenticator do
def get_registration(%Plug.Conn{} = _conn), do: {:error, :missing_credentials}
+ @doc "Creates Pleroma.User record basing on params and Pleroma.Registration record."
def create_from_registration(
%Plug.Conn{params: %{"authorization" => registration_attrs}},
- registration
+ %Registration{} = registration
) do
nickname = value([registration_attrs["nickname"], Registration.nickname(registration)])
email = value([registration_attrs["email"], Registration.email(registration)])
diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index ae2b80d95..79d803295 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -17,6 +17,8 @@ defmodule Pleroma.Web.OAuth.OAuthController do
alias Pleroma.Web.OAuth.Token.Strategy.Revoke, as: RevokeToken
alias Pleroma.Web.OAuth.Scopes
+ require Logger
+
if Pleroma.Config.oauth_consumer_enabled?(), do: plug(Ueberauth)
plug(:fetch_session)
@@ -318,7 +320,9 @@ defmodule Pleroma.Web.OAuth.OAuthController do
|> registration_details(%{"authorization" => registration_params})
end
else
- _ ->
+ error ->
+ Logger.debug(inspect(["OAUTH_ERROR", error, conn.assigns]))
+
conn
|> put_flash(:error, "Failed to set up user account.")
|> redirect(external: redirect_uri(conn, params["redirect_uri"]))
diff --git a/test/web/activity_pub/transmogrifier/follow_handling_test.exs b/test/web/activity_pub/transmogrifier/follow_handling_test.exs
new file mode 100644
index 000000000..5ddf6cd52
--- /dev/null
+++ b/test/web/activity_pub/transmogrifier/follow_handling_test.exs
@@ -0,0 +1,116 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.ActivityPub.Transmogrifier.FollowHandlingTest do
+ use Pleroma.DataCase
+ alias Pleroma.Activity
+ alias Pleroma.Repo
+ alias Pleroma.User
+ alias Pleroma.Web.ActivityPub.Transmogrifier
+ alias Pleroma.Web.ActivityPub.Utils
+
+ import Pleroma.Factory
+ import Ecto.Query
+
+ setup_all do
+ Tesla.Mock.mock_global(fn env -> apply(HttpRequestMock, :request, [env]) end)
+ :ok
+ end
+
+ describe "handle_incoming" do
+ test "it works for incoming follow requests" do
+ user = insert(:user)
+
+ data =
+ File.read!("test/fixtures/mastodon-follow-activity.json")
+ |> Poison.decode!()
+ |> Map.put("object", user.ap_id)
+
+ {:ok, %Activity{data: data, local: false}} = Transmogrifier.handle_incoming(data)
+
+ assert data["actor"] == "http://mastodon.example.org/users/admin"
+ assert data["type"] == "Follow"
+ assert data["id"] == "http://mastodon.example.org/users/admin#follows/2"
+ assert User.following?(User.get_cached_by_ap_id(data["actor"]), user)
+ end
+
+ test "it works for follow requests when you are already followed, creating a new accept activity" do
+ # This is important because the remote might have the wrong idea about the
+ # current follow status. This can lead to instance A thinking that x@A is
+ # followed by y@B, but B thinks they are not. In this case, the follow can
+ # never go through again because it will never get an Accept.
+ user = insert(:user)
+
+ data =
+ File.read!("test/fixtures/mastodon-follow-activity.json")
+ |> Poison.decode!()
+ |> Map.put("object", user.ap_id)
+
+ {:ok, %Activity{local: false}} = Transmogrifier.handle_incoming(data)
+
+ accepts =
+ from(
+ a in Activity,
+ where: fragment("?->>'type' = ?", a.data, "Accept")
+ )
+ |> Repo.all()
+
+ assert length(accepts) == 1
+
+ data =
+ File.read!("test/fixtures/mastodon-follow-activity.json")
+ |> Poison.decode!()
+ |> Map.put("id", String.replace(data["id"], "2", "3"))
+ |> Map.put("object", user.ap_id)
+
+ {:ok, %Activity{local: false}} = Transmogrifier.handle_incoming(data)
+
+ accepts =
+ from(
+ a in Activity,
+ where: fragment("?->>'type' = ?", a.data, "Accept")
+ )
+ |> Repo.all()
+
+ assert length(accepts) == 2
+ end
+
+ test "it rejects incoming follow requests from blocked users when deny_follow_blocked is enabled" do
+ Pleroma.Config.put([:user, :deny_follow_blocked], true)
+
+ user = insert(:user)
+ {:ok, target} = User.get_or_fetch("http://mastodon.example.org/users/admin")
+
+ {:ok, user} = User.block(user, target)
+
+ data =
+ File.read!("test/fixtures/mastodon-follow-activity.json")
+ |> Poison.decode!()
+ |> Map.put("object", user.ap_id)
+
+ {:ok, %Activity{data: %{"id" => id}}} = Transmogrifier.handle_incoming(data)
+
+ %Activity{} = activity = Activity.get_by_ap_id(id)
+
+ assert activity.data["state"] == "reject"
+ end
+
+ test "it works for incoming follow requests from hubzilla" do
+ user = insert(:user)
+
+ data =
+ File.read!("test/fixtures/hubzilla-follow-activity.json")
+ |> Poison.decode!()
+ |> Map.put("object", user.ap_id)
+ |> Utils.normalize_params()
+
+ {:ok, %Activity{data: data, local: false}} = Transmogrifier.handle_incoming(data)
+
+ assert data["actor"] == "https://hubzilla.example.org/channel/kaniini"
+ assert data["type"] == "Follow"
+ assert data["id"] == "https://hubzilla.example.org/channel/kaniini#follows/2"
+ assert User.following?(User.get_cached_by_ap_id(data["actor"]), user)
+ end
+ end
+end
diff --git a/test/web/activity_pub/transmogrifier_test.exs b/test/web/activity_pub/transmogrifier_test.exs
index 89c8f79c9..28971ae45 100644
--- a/test/web/activity_pub/transmogrifier_test.exs
+++ b/test/web/activity_pub/transmogrifier_test.exs
@@ -11,7 +11,6 @@ defmodule Pleroma.Web.ActivityPub.TransmogrifierTest do
alias Pleroma.User
alias Pleroma.Web.ActivityPub.ActivityPub
alias Pleroma.Web.ActivityPub.Transmogrifier
- alias Pleroma.Web.ActivityPub.Utils
alias Pleroma.Web.OStatus
alias Pleroma.Web.Websub.WebsubClientSubscription
@@ -248,59 +247,6 @@ defmodule Pleroma.Web.ActivityPub.TransmogrifierTest do
assert object_data["cc"] == to
end
- test "it works for incoming follow requests" do
- user = insert(:user)
-
- data =
- File.read!("test/fixtures/mastodon-follow-activity.json")
- |> Poison.decode!()
- |> Map.put("object", user.ap_id)
-
- {:ok, %Activity{data: data, local: false}} = Transmogrifier.handle_incoming(data)
-
- assert data["actor"] == "http://mastodon.example.org/users/admin"
- assert data["type"] == "Follow"
- assert data["id"] == "http://mastodon.example.org/users/admin#follows/2"
- assert User.following?(User.get_cached_by_ap_id(data["actor"]), user)
- end
-
- test "it rejects incoming follow requests from blocked users when deny_follow_blocked is enabled" do
- Pleroma.Config.put([:user, :deny_follow_blocked], true)
-
- user = insert(:user)
- {:ok, target} = User.get_or_fetch("http://mastodon.example.org/users/admin")
-
- {:ok, user} = User.block(user, target)
-
- data =
- File.read!("test/fixtures/mastodon-follow-activity.json")
- |> Poison.decode!()
- |> Map.put("object", user.ap_id)
-
- {:ok, %Activity{data: %{"id" => id}}} = Transmogrifier.handle_incoming(data)
-
- %Activity{} = activity = Activity.get_by_ap_id(id)
-
- assert activity.data["state"] == "reject"
- end
-
- test "it works for incoming follow requests from hubzilla" do
- user = insert(:user)
-
- data =
- File.read!("test/fixtures/hubzilla-follow-activity.json")
- |> Poison.decode!()
- |> Map.put("object", user.ap_id)
- |> Utils.normalize_params()
-
- {:ok, %Activity{data: data, local: false}} = Transmogrifier.handle_incoming(data)
-
- assert data["actor"] == "https://hubzilla.example.org/channel/kaniini"
- assert data["type"] == "Follow"
- assert data["id"] == "https://hubzilla.example.org/channel/kaniini#follows/2"
- assert User.following?(User.get_cached_by_ap_id(data["actor"]), user)
- end
-
test "it works for incoming likes" do
user = insert(:user)
{:ok, activity} = CommonAPI.post(user, %{"status" => "hello"})
diff --git a/test/web/twitter_api/twitter_api_test.exs b/test/web/twitter_api/twitter_api_test.exs
index d601c8f1f..475531a09 100644
--- a/test/web/twitter_api/twitter_api_test.exs
+++ b/test/web/twitter_api/twitter_api_test.exs
@@ -116,8 +116,7 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPITest do
{:ok, user, followed, _activity} = TwitterAPI.follow(user, %{"user_id" => followed.id})
assert User.ap_followers(followed) in user.following
- {:error, msg} = TwitterAPI.follow(user, %{"user_id" => followed.id})
- assert msg == "Could not follow user: #{followed.nickname} is already on your list."
+ {:ok, _, _, _} = TwitterAPI.follow(user, %{"user_id" => followed.id})
end
test "Follow another user using screen_name" do
@@ -132,8 +131,7 @@ defmodule Pleroma.Web.TwitterAPI.TwitterAPITest do
followed = User.get_cached_by_ap_id(followed.ap_id)
assert followed.info.follower_count == 1
- {:error, msg} = TwitterAPI.follow(user, %{"screen_name" => followed.nickname})
- assert msg == "Could not follow user: #{followed.nickname} is already on your list."
+ {:ok, _, _, _} = TwitterAPI.follow(user, %{"screen_name" => followed.nickname})
end
test "Unfollow another user using user_id" do
generated by cgit v1.2.3 (git 2.26.2) at 2025-04-25 19:21:17 +0000