aboutsummaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
Diffstat (limited to 'lib')
-rw-r--r--lib/pleroma/plugs/oauth_scopes_plug.ex3
-rw-r--r--lib/pleroma/web/mastodon_api/mastodon_api_controller.ex12
-rw-r--r--lib/pleroma/web/oauth.ex19
-rw-r--r--lib/pleroma/web/oauth/app.ex2
-rw-r--r--lib/pleroma/web/oauth/authorization.ex9
-rw-r--r--lib/pleroma/web/oauth/oauth_controller.ex18
-rw-r--r--lib/pleroma/web/oauth/token.ex11
-rw-r--r--lib/pleroma/web/templates/layout/app.html.eex4
-rw-r--r--lib/pleroma/web/templates/o_auth/o_auth/show.html.eex12
9 files changed, 64 insertions, 26 deletions
diff --git a/lib/pleroma/plugs/oauth_scopes_plug.ex b/lib/pleroma/plugs/oauth_scopes_plug.ex
index a16adb004..a81e29830 100644
--- a/lib/pleroma/plugs/oauth_scopes_plug.ex
+++ b/lib/pleroma/plugs/oauth_scopes_plug.ex
@@ -4,7 +4,6 @@
defmodule Pleroma.Plugs.OAuthScopesPlug do
import Plug.Conn
- alias Pleroma.Web.OAuth
@behaviour Plug
@@ -12,7 +11,7 @@ defmodule Pleroma.Plugs.OAuthScopesPlug do
def call(%Plug.Conn{assigns: assigns} = conn, %{required_scopes: required_scopes}) do
token = assigns[:token]
- granted_scopes = token && OAuth.parse_scopes(token.scope)
+ granted_scopes = token && token.scopes
if is_nil(token) || required_scopes -- granted_scopes == [] do
conn
diff --git a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
index dbe7c2554..59f472e91 100644
--- a/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
+++ b/lib/pleroma/web/mastodon_api/mastodon_api_controller.ex
@@ -19,6 +19,7 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
alias Pleroma.Web.ActivityPub.ActivityPub
alias Pleroma.Web.ActivityPub.Utils
alias Pleroma.Web.CommonAPI
+ alias Pleroma.Web.OAuth
alias Pleroma.Web.OAuth.{Authorization, Token, App}
alias Pleroma.Web.MediaProxy
@@ -31,7 +32,10 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
action_fallback(:errors)
def create_app(conn, params) do
- with cs <- App.register_changeset(%App{}, params),
+ scopes = OAuth.parse_scopes(params["scope"] || params["scopes"])
+ app_attrs = params |> Map.drop(["scope", "scopes"]) |> Map.put("scopes", scopes)
+
+ with cs <- App.register_changeset(%App{}, app_attrs),
false <- cs.changes[:client_name] == @local_mastodon_name,
{:ok, app} <- Repo.insert(cs) do
res = %{
@@ -1162,7 +1166,11 @@ defmodule Pleroma.Web.MastodonAPI.MastodonAPIController do
{:ok, app}
else
_e ->
- cs = App.register_changeset(%App{}, Map.put(find_attrs, :scopes, "read,write,follow"))
+ cs =
+ App.register_changeset(
+ %App{},
+ Map.put(find_attrs, :scopes, ["read", "write", "follow"])
+ )
Repo.insert(cs)
end
diff --git a/lib/pleroma/web/oauth.ex b/lib/pleroma/web/oauth.ex
index 44b83433e..761b80fde 100644
--- a/lib/pleroma/web/oauth.ex
+++ b/lib/pleroma/web/oauth.ex
@@ -3,9 +3,22 @@
# SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.Web.OAuth do
- def parse_scopes(scopes) do
+ def parse_scopes(nil) do
+ nil
+ end
+
+ def parse_scopes(scopes) when is_list(scopes) do
scopes
- |> to_string()
- |> String.split([" ", ","])
+ end
+
+ def parse_scopes(scopes) do
+ scopes =
+ scopes
+ |> to_string()
+ |> String.trim()
+
+ if scopes == "",
+ do: [],
+ else: String.split(scopes, [" ", ","])
end
end
diff --git a/lib/pleroma/web/oauth/app.ex b/lib/pleroma/web/oauth/app.ex
index 967ac04b5..c04626a73 100644
--- a/lib/pleroma/web/oauth/app.ex
+++ b/lib/pleroma/web/oauth/app.ex
@@ -9,7 +9,7 @@ defmodule Pleroma.Web.OAuth.App do
schema "apps" do
field(:client_name, :string)
field(:redirect_uris, :string)
- field(:scopes, :string)
+ field(:scopes, {:array, :string}, default: [])
field(:website, :string)
field(:client_id, :string)
field(:client_secret, :string)
diff --git a/lib/pleroma/web/oauth/authorization.ex b/lib/pleroma/web/oauth/authorization.ex
index 0fbaa902b..c5b7ec9a5 100644
--- a/lib/pleroma/web/oauth/authorization.ex
+++ b/lib/pleroma/web/oauth/authorization.ex
@@ -6,14 +6,13 @@ defmodule Pleroma.Web.OAuth.Authorization do
use Ecto.Schema
alias Pleroma.{User, Repo}
- alias Pleroma.Web.OAuth
alias Pleroma.Web.OAuth.{Authorization, App}
import Ecto.{Changeset, Query}
schema "oauth_authorizations" do
field(:token, :string)
- field(:scope, :string)
+ field(:scopes, {:array, :string}, default: [])
field(:valid_until, :naive_datetime)
field(:used, :boolean, default: false)
belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId)
@@ -22,8 +21,8 @@ defmodule Pleroma.Web.OAuth.Authorization do
timestamps()
end
- def create_authorization(%App{} = app, %User{} = user, scope \\ nil) do
- scopes = OAuth.parse_scopes(scope || app.scopes)
+ def create_authorization(%App{} = app, %User{} = user, scopes \\ nil) do
+ scopes = scopes || app.scopes
token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
authorization = %Authorization{
@@ -31,7 +30,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
used: false,
user_id: user.id,
app_id: app.id,
- scope: Enum.join(scopes, " "),
+ scopes: scopes,
valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10)
}
diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index 15345d4ba..f00d5293d 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -5,6 +5,7 @@
defmodule Pleroma.Web.OAuth.OAuthController do
use Pleroma.Web, :controller
+ alias Pleroma.Web.OAuth
alias Pleroma.Web.OAuth.{Authorization, Token, App}
alias Pleroma.{Repo, User}
alias Comeonin.Pbkdf2
@@ -18,7 +19,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
render(conn, "show.html", %{
response_type: params["response_type"],
client_id: params["client_id"],
- scope: params["scope"],
+ scopes: scopes(params) || [],
redirect_uri: params["redirect_uri"],
state: params["state"]
})
@@ -38,7 +39,10 @@ defmodule Pleroma.Web.OAuth.OAuthController do
{:auth_active, true} <- {:auth_active, User.auth_active?(user)},
%App{} = app <- Repo.get_by(App, client_id: client_id),
true <- redirect_uri in String.split(app.redirect_uris),
- {:ok, auth} <- Authorization.create_authorization(app, user, params["scope"]) do
+ scopes <- scopes(params) || app.scopes,
+ [] <- scopes -- app.scopes,
+ true <- Enum.any?(scopes),
+ {:ok, auth} <- Authorization.create_authorization(app, user, scopes) do
# Special case: Local MastodonFE.
redirect_uri =
if redirect_uri == "." do
@@ -94,7 +98,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
refresh_token: token.refresh_token,
created_at: DateTime.to_unix(inserted_at),
expires_in: 60 * 10,
- scope: token.scope
+ scope: Enum.join(token.scopes)
}
json(conn, response)
@@ -113,14 +117,15 @@ defmodule Pleroma.Web.OAuth.OAuthController do
%User{} = user <- User.get_by_nickname_or_email(name),
true <- Pbkdf2.checkpw(password, user.password_hash),
{:auth_active, true} <- {:auth_active, User.auth_active?(user)},
- {:ok, auth} <- Authorization.create_authorization(app, user, params["scope"]),
+ scopes <- scopes(params) || app.scopes,
+ {:ok, auth} <- Authorization.create_authorization(app, user, scopes),
{:ok, token} <- Token.exchange_token(app, auth) do
response = %{
token_type: "Bearer",
access_token: token.token,
refresh_token: token.refresh_token,
expires_in: 60 * 10,
- scope: token.scope
+ scope: Enum.join(token.scopes, " ")
}
json(conn, response)
@@ -192,4 +197,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
nil
end
end
+
+ defp scopes(params),
+ do: OAuth.parse_scopes(params["scopes"] || params["scope"])
end
diff --git a/lib/pleroma/web/oauth/token.ex b/lib/pleroma/web/oauth/token.ex
index 61f43ed5a..1fae5ed3a 100644
--- a/lib/pleroma/web/oauth/token.ex
+++ b/lib/pleroma/web/oauth/token.ex
@@ -8,13 +8,12 @@ defmodule Pleroma.Web.OAuth.Token do
import Ecto.Query
alias Pleroma.{User, Repo}
- alias Pleroma.Web.OAuth
alias Pleroma.Web.OAuth.{Token, App, Authorization}
schema "oauth_tokens" do
field(:token, :string)
field(:refresh_token, :string)
- field(:scope, :string)
+ field(:scopes, {:array, :string}, default: [])
field(:valid_until, :naive_datetime)
belongs_to(:user, Pleroma.User, type: Pleroma.FlakeId)
belongs_to(:app, App)
@@ -25,19 +24,19 @@ defmodule Pleroma.Web.OAuth.Token do
def exchange_token(app, auth) do
with {:ok, auth} <- Authorization.use_token(auth),
true <- auth.app_id == app.id do
- create_token(app, Repo.get(User, auth.user_id), auth.scope)
+ create_token(app, Repo.get(User, auth.user_id), auth.scopes)
end
end
- def create_token(%App{} = app, %User{} = user, scope \\ nil) do
- scopes = OAuth.parse_scopes(scope || app.scopes)
+ def create_token(%App{} = app, %User{} = user, scopes \\ nil) do
+ scopes = scopes || app.scopes
token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64()
token = %Token{
token: token,
refresh_token: refresh_token,
- scope: Enum.join(scopes, " "),
+ scopes: scopes,
user_id: user.id,
app_id: app.id,
valid_until: NaiveDateTime.add(NaiveDateTime.utc_now(), 60 * 10)
diff --git a/lib/pleroma/web/templates/layout/app.html.eex b/lib/pleroma/web/templates/layout/app.html.eex
index 8dd3284d6..f944cbc26 100644
--- a/lib/pleroma/web/templates/layout/app.html.eex
+++ b/lib/pleroma/web/templates/layout/app.html.eex
@@ -54,6 +54,10 @@
border-bottom: 2px solid #4b8ed8;
}
+ input[type="checkbox"] {
+ width: auto;
+ }
+
button {
box-sizing: border-box;
width: 100%;
diff --git a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
index e1c0af975..1ecb5b444 100644
--- a/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
+++ b/lib/pleroma/web/templates/o_auth/o_auth/show.html.eex
@@ -5,12 +5,20 @@
<%= label f, :name, "Name or email" %>
<%= text_input f, :name %>
<br>
+<br>
<%= label f, :password, "Password" %>
<%= password_input f, :password %>
<br>
-<%= label f, :scope, "Scopes" %>
-<%= text_input f, :scope, value: @scope %>
<br>
+
+<%= label f, :scope, "Permissions" %>
+<br>
+<%= for scope <- @scopes do %>
+ <%= checkbox f, :"scopes_#{scope}", hidden_input: false, value: scope, checked_value: scope, name: "authorization[scopes][]" %>
+ <%= label f, :"scopes_#{scope}", String.capitalize(scope) %>
+ <br>
+<% end %>
+
<%= hidden_input f, :client_id, value: @client_id %>
<%= hidden_input f, :response_type, value: @response_type %>
<%= hidden_input f, :redirect_uri, value: @redirect_uri %>
generated by cgit v1.2.3 (git 2.26.2) at 2025-04-24 21:08:58 +0000