diff options
| -rw-r--r-- | internal/oauth/oauth.go | 40 | ||||
| -rw-r--r-- | internal/oauth/oauth_test.go | 14 | ||||
| -rw-r--r-- | web/template/authorize.tmpl | 11 |
3 files changed, 46 insertions, 19 deletions
diff --git a/internal/oauth/oauth.go b/internal/oauth/oauth.go index 39fe2ddce..49e04a905 100644 --- a/internal/oauth/oauth.go +++ b/internal/oauth/oauth.go @@ -19,12 +19,14 @@ package oauth import ( + "fmt" "net/http" "net/url" "github.com/gin-contrib/sessions" "github.com/gin-gonic/gin" "github.com/go-pg/pg/v10" + "github.com/google/uuid" "github.com/gotosocial/gotosocial/internal/api" "github.com/gotosocial/gotosocial/internal/gtsmodel" "github.com/gotosocial/gotosocial/pkg/mastotypes" @@ -102,6 +104,8 @@ func New(ts oauth2.TokenStore, cs oauth2.ClientStore, conn *pg.DB, log *logrus.L } func (a *API) AddRoutes(s api.Server) error { + s.AttachHandler(http.MethodPost, "/api/v1/apps", a.AppsPOSTHandler) + s.AttachHandler(http.MethodGet, "/auth/sign_in", a.SignInGETHandler) s.AttachHandler(http.MethodPost, "/auth/sign_in", a.SignInPOSTHandler) @@ -110,7 +114,6 @@ func (a *API) AddRoutes(s api.Server) error { s.AttachHandler(http.MethodGet, "/oauth/authorize", a.AuthorizeGETHandler) s.AttachHandler(http.MethodPost, "/oauth/authorize", a.AuthorizePOSTHandler) - // s.AttachHandler(http.MethodGet, "/auth", a.AuthGETHandler) return nil } @@ -260,18 +263,21 @@ func (a *API) AuthorizeGETHandler(c *gin.Context) { l := a.log.WithField("func", "AuthorizeGETHandler") s := sessions.Default(c) + // Username will be set in the session by AuthorizePOSTHandler if the caller has already gone through the authentication flow + // If it's not set, then we don't know yet who the user is, so we need to redirect them to the sign in page. v := s.Get("username") if username, ok := v.(string); !ok || username == "" { l.Trace("username was empty, parsing form then redirecting to sign in page") + // first make sure they've filled out the authorize form with the required values form := &mastotypes.OAuthAuthorize{} - if err := c.ShouldBind(form); err != nil { c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) return } l.Tracef("parsed form: %+v", form) + // these fields are *required* so check 'em if form.ResponseType == "" || form.ClientID == "" || form.RedirectURI == "" { c.JSON(http.StatusBadRequest, gin.H{"error": "missing one of: response_type, client_id or redirect_uri"}) return @@ -288,18 +294,26 @@ func (a *API) AuthorizeGETHandler(c *gin.Context) { return } + // send them to the sign in page so we can tell who they are c.Redirect(http.StatusFound, "/auth/sign_in") return } + // Check if we have a code already. If we do, it means the user used urn:ietf:wg:oauth:2.0:oob as their redirect URI + // and were sent here, which means they just want the code displayed so they can use it out of band. code := &code{} - if err := c.Bind(code); err != nil || code.Code == "" { - // no code yet, serve auth html and let the user confirm - l.Trace("serving authorize html") - c.HTML(http.StatusOK, "authorize.tmpl", gin.H{}) + if err := c.Bind(code); err != nil { + c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()}) return } - c.String(http.StatusOK, code.Code) + + // the authorize template will either: + // 1. Display the code to the user if they're already authorized and were redirected here because they selected urn:ietf:wg:oauth:2.0:oob. + // 2. Display a form where they can get some information about the app that's trying to authorize, and approve it, which will then go to AuthorizePOSTHandler + l.Trace("serving authorize html") + c.HTML(http.StatusOK, "authorize.tmpl", gin.H{ + "code": code.Code, + }) } // AuthorizePOSTHandler should be served as POST at https://example.org/oauth/authorize @@ -417,16 +431,16 @@ func (a *API) ValidatePassword(email string, password string) (userid string, er return } -// UserAuthorizationHandler gets the user's email address from the form key 'username' +// UserAuthorizationHandler gets the user's ID from the 'username' field of the request form, // or redirects to the /auth/sign_in page, if this key is not present. -func (a *API) UserAuthorizationHandler(w http.ResponseWriter, r *http.Request) (username string, err error) { +func (a *API) UserAuthorizationHandler(w http.ResponseWriter, r *http.Request) (userID string, err error) { l := a.log.WithField("func", "UserAuthorizationHandler") - username = r.FormValue("username") - if username == "" { + userID = r.FormValue("username") + if userID == "" { l.Trace("username was empty, redirecting to sign in page") http.Redirect(w, r, "/auth/sign_in", http.StatusFound) return "", nil } - l.Tracef("returning (%s, %s)", username, err) - return username, err + l.Tracef("returning (%s, %s)", userID, err) + return userID, err } diff --git a/internal/oauth/oauth_test.go b/internal/oauth/oauth_test.go index 0c786456a..2e5be121b 100644 --- a/internal/oauth/oauth_test.go +++ b/internal/oauth/oauth_test.go @@ -7,7 +7,6 @@ import ( "github.com/go-pg/pg/v10" "github.com/go-pg/pg/v10/orm" - "github.com/google/uuid" "github.com/gotosocial/gotosocial/internal/api" "github.com/gotosocial/gotosocial/internal/config" "github.com/gotosocial/gotosocial/internal/gtsmodel" @@ -22,6 +21,7 @@ type OauthTestSuite struct { tokenStore oauth2.TokenStore clientStore oauth2.ClientStore conn *pg.DB + testAccount *gtsmodel.Account testUser *gtsmodel.User testClient *oauthClient config *config.Config @@ -36,20 +36,18 @@ func (suite *OauthTestSuite) SetupSuite() { logrus.Panicf("error encrypting user pass: %s", err) } - userID := uuid.NewString() + suite.testAccount = >smodel.Account{ + + } suite.testUser = >smodel.User{ - ID: userID, EncryptedPassword: string(encryptedPassword), Email: "user@localhost", - CreatedAt: time.Now(), - UpdatedAt: time.Now(), AccountID: "some-account-id-it-doesn't-matter-really-since-this-user-doesn't-actually-have-an-account!", } suite.testClient = &oauthClient{ ID: "a-known-client-id", Secret: "some-secret", Domain: "http://localhost:8080", - UserID: userID, } // because go tests are run within the test package directory, we need to fiddle with the templateconfig @@ -71,6 +69,8 @@ func (suite *OauthTestSuite) SetupTest() { &oauthClient{}, &oauthToken{}, >smodel.User{}, + >smodel.Account{}, + >smodel.Application{}, } for _, m := range models { @@ -100,6 +100,8 @@ func (suite *OauthTestSuite) TearDownTest() { &oauthClient{}, &oauthToken{}, >smodel.User{}, + >smodel.Account{}, + >smodel.Application{}, } for _, m := range models { if err := suite.conn.Model(m).DropTable(&orm.DropTableOptions{}); err != nil { diff --git a/web/template/authorize.tmpl b/web/template/authorize.tmpl index 0043e21ba..2b3b3ab07 100644 --- a/web/template/authorize.tmpl +++ b/web/template/authorize.tmpl @@ -11,6 +11,7 @@ <script src="//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script> </head> +{{if len .code | eq 0 }} <body> <div class="container"> <div class="jumbotron"> @@ -30,4 +31,14 @@ </div> </div> </body> +{{else}} + <body> + <div class="container"> + <div class="jumbotron"> + {{.code}} + </div> + </div> + </body> +{{end}} + </html> |