Merge branch '1427-oauth-admin-scopes' into 'develop'
[#1427] OAuth admin scopes Closes #1427 See merge request pleroma/pleroma!2025
This commit is contained in:
commit
aac0187ec1
|
@ -51,6 +51,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
|
||||||
- MRF: New module which handles incoming posts based on their age. By default, all incoming posts that are older than 2 days will be unlisted and not shown to their followers.
|
- MRF: New module which handles incoming posts based on their age. By default, all incoming posts that are older than 2 days will be unlisted and not shown to their followers.
|
||||||
- User notification settings: Add `privacy_option` option.
|
- User notification settings: Add `privacy_option` option.
|
||||||
- User settings: Add _This account is a_ option.
|
- User settings: Add _This account is a_ option.
|
||||||
|
- OAuth: admin scopes support (relevant setting: `[:auth, :enforce_oauth_admin_scope_usage]`).
|
||||||
<details>
|
<details>
|
||||||
<summary>API Changes</summary>
|
<summary>API Changes</summary>
|
||||||
|
|
||||||
|
|
|
@ -563,7 +563,10 @@
|
||||||
base_path: "/oauth",
|
base_path: "/oauth",
|
||||||
providers: ueberauth_providers
|
providers: ueberauth_providers
|
||||||
|
|
||||||
config :pleroma, :auth, oauth_consumer_strategies: oauth_consumer_strategies
|
config :pleroma,
|
||||||
|
:auth,
|
||||||
|
enforce_oauth_admin_scope_usage: false,
|
||||||
|
oauth_consumer_strategies: oauth_consumer_strategies
|
||||||
|
|
||||||
config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Sendmail, enabled: false
|
config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Sendmail, enabled: false
|
||||||
|
|
||||||
|
|
|
@ -2094,6 +2094,15 @@
|
||||||
type: :group,
|
type: :group,
|
||||||
description: "Authentication / authorization settings",
|
description: "Authentication / authorization settings",
|
||||||
children: [
|
children: [
|
||||||
|
%{
|
||||||
|
key: :enforce_oauth_admin_scope_usage,
|
||||||
|
type: :boolean,
|
||||||
|
description:
|
||||||
|
"OAuth admin scope requirement toggle. " <>
|
||||||
|
"If `true`, admin actions explicitly demand admin OAuth scope(s) presence in OAuth token " <>
|
||||||
|
"(client app must support admin scopes). If `false` and token doesn't have admin scope(s)," <>
|
||||||
|
"`is_admin` user flag grants access to admin-specific actions."
|
||||||
|
},
|
||||||
%{
|
%{
|
||||||
key: :auth_template,
|
key: :auth_template,
|
||||||
type: :string,
|
type: :string,
|
||||||
|
|
|
@ -2,6 +2,13 @@
|
||||||
|
|
||||||
Authentication is required and the user must be an admin.
|
Authentication is required and the user must be an admin.
|
||||||
|
|
||||||
|
Configuration options:
|
||||||
|
|
||||||
|
* `[:auth, :enforce_oauth_admin_scope_usage]` — OAuth admin scope requirement toggle.
|
||||||
|
If `true`, admin actions explicitly demand admin OAuth scope(s) presence in OAuth token (client app must support admin scopes).
|
||||||
|
If `false` and token doesn't have admin scope(s), `is_admin` user flag grants access to admin-specific actions.
|
||||||
|
Note that client app needs to explicitly support admin scopes and request them when obtaining auth token.
|
||||||
|
|
||||||
## `GET /api/pleroma/admin/users`
|
## `GET /api/pleroma/admin/users`
|
||||||
|
|
||||||
### List users
|
### List users
|
||||||
|
|
|
@ -8,7 +8,6 @@ defmodule Mix.Tasks.Pleroma.User do
|
||||||
alias Ecto.Changeset
|
alias Ecto.Changeset
|
||||||
alias Pleroma.User
|
alias Pleroma.User
|
||||||
alias Pleroma.UserInviteToken
|
alias Pleroma.UserInviteToken
|
||||||
alias Pleroma.Web.OAuth
|
|
||||||
|
|
||||||
@shortdoc "Manages Pleroma users"
|
@shortdoc "Manages Pleroma users"
|
||||||
@moduledoc File.read!("docs/administration/CLI_tasks/user.md")
|
@moduledoc File.read!("docs/administration/CLI_tasks/user.md")
|
||||||
|
@ -354,8 +353,7 @@ def run(["sign_out", nickname]) do
|
||||||
start_pleroma()
|
start_pleroma()
|
||||||
|
|
||||||
with %User{local: true} = user <- User.get_cached_by_nickname(nickname) do
|
with %User{local: true} = user <- User.get_cached_by_nickname(nickname) do
|
||||||
OAuth.Token.delete_user_tokens(user)
|
User.global_sign_out(user)
|
||||||
OAuth.Authorization.delete_user_authorizations(user)
|
|
||||||
|
|
||||||
shell_info("#{nickname} signed out from all apps.")
|
shell_info("#{nickname} signed out from all apps.")
|
||||||
else
|
else
|
||||||
|
@ -393,10 +391,7 @@ defp set_moderator(user, value) do
|
||||||
end
|
end
|
||||||
|
|
||||||
defp set_admin(user, value) do
|
defp set_admin(user, value) do
|
||||||
{:ok, user} =
|
{:ok, user} = User.admin_api_update(user, %{is_admin: value})
|
||||||
user
|
|
||||||
|> Changeset.change(%{is_admin: value})
|
|
||||||
|> User.update_and_set_cache()
|
|
||||||
|
|
||||||
shell_info("Admin status of #{user.nickname}: #{user.is_admin}")
|
shell_info("Admin status of #{user.nickname}: #{user.is_admin}")
|
||||||
user
|
user
|
||||||
|
|
|
@ -65,4 +65,11 @@ def delete(key) do
|
||||||
def oauth_consumer_strategies, do: get([:auth, :oauth_consumer_strategies], [])
|
def oauth_consumer_strategies, do: get([:auth, :oauth_consumer_strategies], [])
|
||||||
|
|
||||||
def oauth_consumer_enabled?, do: oauth_consumer_strategies() != []
|
def oauth_consumer_enabled?, do: oauth_consumer_strategies() != []
|
||||||
|
|
||||||
|
def enforce_oauth_admin_scope_usage?, do: !!get([:auth, :enforce_oauth_admin_scope_usage])
|
||||||
|
|
||||||
|
def oauth_admin_scopes(scope) do
|
||||||
|
["admin:#{scope}"] ++
|
||||||
|
if enforce_oauth_admin_scope_usage?(), do: [], else: [scope]
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -6,6 +6,7 @@ defmodule Pleroma.Plugs.OAuthScopesPlug do
|
||||||
import Plug.Conn
|
import Plug.Conn
|
||||||
import Pleroma.Web.Gettext
|
import Pleroma.Web.Gettext
|
||||||
|
|
||||||
|
alias Pleroma.Config
|
||||||
alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
|
alias Pleroma.Plugs.EnsurePublicOrAuthenticatedPlug
|
||||||
|
|
||||||
@behaviour Plug
|
@behaviour Plug
|
||||||
|
@ -15,6 +16,14 @@ def init(%{scopes: _} = options), do: options
|
||||||
def call(%Plug.Conn{assigns: assigns} = conn, %{scopes: scopes} = options) do
|
def call(%Plug.Conn{assigns: assigns} = conn, %{scopes: scopes} = options) do
|
||||||
op = options[:op] || :|
|
op = options[:op] || :|
|
||||||
token = assigns[:token]
|
token = assigns[:token]
|
||||||
|
|
||||||
|
scopes =
|
||||||
|
if options[:admin] do
|
||||||
|
Config.oauth_admin_scopes(scopes)
|
||||||
|
else
|
||||||
|
scopes
|
||||||
|
end
|
||||||
|
|
||||||
matched_scopes = token && filter_descendants(scopes, token.scopes)
|
matched_scopes = token && filter_descendants(scopes, token.scopes)
|
||||||
|
|
||||||
cond do
|
cond do
|
||||||
|
|
|
@ -5,19 +5,38 @@
|
||||||
defmodule Pleroma.Plugs.UserIsAdminPlug do
|
defmodule Pleroma.Plugs.UserIsAdminPlug do
|
||||||
import Pleroma.Web.TranslationHelpers
|
import Pleroma.Web.TranslationHelpers
|
||||||
import Plug.Conn
|
import Plug.Conn
|
||||||
|
|
||||||
alias Pleroma.User
|
alias Pleroma.User
|
||||||
|
alias Pleroma.Web.OAuth
|
||||||
|
|
||||||
def init(options) do
|
def init(options) do
|
||||||
options
|
options
|
||||||
end
|
end
|
||||||
|
|
||||||
def call(%{assigns: %{user: %User{is_admin: true}}} = conn, _) do
|
def call(%{assigns: %{user: %User{is_admin: true}} = assigns} = conn, _) do
|
||||||
conn
|
token = assigns[:token]
|
||||||
|
|
||||||
|
cond do
|
||||||
|
not Pleroma.Config.enforce_oauth_admin_scope_usage?() ->
|
||||||
|
conn
|
||||||
|
|
||||||
|
token && OAuth.Scopes.contains_admin_scopes?(token.scopes) ->
|
||||||
|
# Note: checking for _any_ admin scope presence, not necessarily fitting requested action.
|
||||||
|
# Thus, controller must explicitly invoke OAuthScopesPlug to verify scope requirements.
|
||||||
|
conn
|
||||||
|
|
||||||
|
true ->
|
||||||
|
fail(conn)
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
def call(conn, _) do
|
def call(conn, _) do
|
||||||
|
fail(conn)
|
||||||
|
end
|
||||||
|
|
||||||
|
defp fail(conn) do
|
||||||
conn
|
conn
|
||||||
|> render_error(:forbidden, "User is not admin.")
|
|> render_error(:forbidden, "User is not an admin or OAuth admin scope is not granted.")
|
||||||
|> halt
|
|> halt()
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -1839,13 +1839,28 @@ defp truncate_field(%{"name" => name, "value" => value}) do
|
||||||
end
|
end
|
||||||
|
|
||||||
def admin_api_update(user, params) do
|
def admin_api_update(user, params) do
|
||||||
user
|
changeset =
|
||||||
|> cast(params, [
|
cast(user, params, [
|
||||||
:is_moderator,
|
:is_moderator,
|
||||||
:is_admin,
|
:is_admin,
|
||||||
:show_role
|
:show_role
|
||||||
])
|
])
|
||||||
|> update_and_set_cache()
|
|
||||||
|
with {:ok, updated_user} <- update_and_set_cache(changeset) do
|
||||||
|
if user.is_admin && !updated_user.is_admin do
|
||||||
|
# Tokens & authorizations containing any admin scopes must be revoked (revoking all).
|
||||||
|
# This is an extra safety measure (tokens' admin scopes won't be accepted for non-admins).
|
||||||
|
global_sign_out(user)
|
||||||
|
end
|
||||||
|
|
||||||
|
{:ok, updated_user}
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
@doc "Signs user out of all applications"
|
||||||
|
def global_sign_out(user) do
|
||||||
|
OAuth.Authorization.delete_user_authorizations(user)
|
||||||
|
OAuth.Token.delete_user_tokens(user)
|
||||||
end
|
end
|
||||||
|
|
||||||
def mascot_update(user, url) do
|
def mascot_update(user, url) do
|
||||||
|
|
|
@ -30,13 +30,13 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["read:accounts"]}
|
%{scopes: ["read:accounts"], admin: true}
|
||||||
when action in [:list_users, :user_show, :right_get, :invites]
|
when action in [:list_users, :user_show, :right_get, :invites]
|
||||||
)
|
)
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["write:accounts"]}
|
%{scopes: ["write:accounts"], admin: true}
|
||||||
when action in [
|
when action in [
|
||||||
:get_invite_token,
|
:get_invite_token,
|
||||||
:revoke_invite,
|
:revoke_invite,
|
||||||
|
@ -58,35 +58,37 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["read:reports"]} when action in [:list_reports, :report_show]
|
%{scopes: ["read:reports"], admin: true}
|
||||||
|
when action in [:list_reports, :report_show]
|
||||||
)
|
)
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["write:reports"]}
|
%{scopes: ["write:reports"], admin: true}
|
||||||
when action in [:report_update_state, :report_respond]
|
when action in [:report_update_state, :report_respond]
|
||||||
)
|
)
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["read:statuses"]} when action == :list_user_statuses
|
%{scopes: ["read:statuses"], admin: true}
|
||||||
|
when action == :list_user_statuses
|
||||||
)
|
)
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["write:statuses"]}
|
%{scopes: ["write:statuses"], admin: true}
|
||||||
when action in [:status_update, :status_delete]
|
when action in [:status_update, :status_delete]
|
||||||
)
|
)
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["read"]}
|
%{scopes: ["read"], admin: true}
|
||||||
when action in [:config_show, :migrate_to_db, :migrate_from_db, :list_log]
|
when action in [:config_show, :migrate_to_db, :migrate_from_db, :list_log]
|
||||||
)
|
)
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["write"]}
|
%{scopes: ["write"], admin: true}
|
||||||
when action in [:relay_follow, :relay_unfollow, :config_update]
|
when action in [:relay_follow, :relay_unfollow, :config_update]
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
|
@ -222,7 +222,7 @@ def token_exchange(
|
||||||
{:user_active, true} <- {:user_active, !user.deactivated},
|
{:user_active, true} <- {:user_active, !user.deactivated},
|
||||||
{:password_reset_pending, false} <-
|
{:password_reset_pending, false} <-
|
||||||
{:password_reset_pending, user.password_reset_pending},
|
{:password_reset_pending, user.password_reset_pending},
|
||||||
{:ok, scopes} <- validate_scopes(app, params),
|
{:ok, scopes} <- validate_scopes(app, params, user),
|
||||||
{:ok, auth} <- Authorization.create_authorization(app, user, scopes),
|
{:ok, auth} <- Authorization.create_authorization(app, user, scopes),
|
||||||
{:ok, token} <- Token.exchange_token(app, auth) do
|
{:ok, token} <- Token.exchange_token(app, auth) do
|
||||||
json(conn, Token.Response.build(user, token))
|
json(conn, Token.Response.build(user, token))
|
||||||
|
@ -471,7 +471,7 @@ defp do_create_authorization(
|
||||||
{:get_user, (user && {:ok, user}) || Authenticator.get_user(conn)},
|
{:get_user, (user && {:ok, user}) || Authenticator.get_user(conn)},
|
||||||
%App{} = app <- Repo.get_by(App, client_id: client_id),
|
%App{} = app <- Repo.get_by(App, client_id: client_id),
|
||||||
true <- redirect_uri in String.split(app.redirect_uris),
|
true <- redirect_uri in String.split(app.redirect_uris),
|
||||||
{:ok, scopes} <- validate_scopes(app, auth_attrs),
|
{:ok, scopes} <- validate_scopes(app, auth_attrs, user),
|
||||||
{:auth_active, true} <- {:auth_active, User.auth_active?(user)} do
|
{:auth_active, true} <- {:auth_active, User.auth_active?(user)} do
|
||||||
Authorization.create_authorization(app, user, scopes)
|
Authorization.create_authorization(app, user, scopes)
|
||||||
end
|
end
|
||||||
|
@ -487,12 +487,12 @@ defp get_session_registration_id(%Plug.Conn{} = conn), do: get_session(conn, :re
|
||||||
defp put_session_registration_id(%Plug.Conn{} = conn, registration_id),
|
defp put_session_registration_id(%Plug.Conn{} = conn, registration_id),
|
||||||
do: put_session(conn, :registration_id, registration_id)
|
do: put_session(conn, :registration_id, registration_id)
|
||||||
|
|
||||||
@spec validate_scopes(App.t(), map()) ::
|
@spec validate_scopes(App.t(), map(), User.t()) ::
|
||||||
{:ok, list()} | {:error, :missing_scopes | :unsupported_scopes}
|
{:ok, list()} | {:error, :missing_scopes | :unsupported_scopes}
|
||||||
defp validate_scopes(app, params) do
|
defp validate_scopes(%App{} = app, params, %User{} = user) do
|
||||||
params
|
params
|
||||||
|> Scopes.fetch_scopes(app.scopes)
|
|> Scopes.fetch_scopes(app.scopes)
|
||||||
|> Scopes.validate(app.scopes)
|
|> Scopes.validate(app.scopes, user)
|
||||||
end
|
end
|
||||||
|
|
||||||
def default_redirect_uri(%App{} = app) do
|
def default_redirect_uri(%App{} = app) do
|
||||||
|
|
|
@ -7,6 +7,9 @@ defmodule Pleroma.Web.OAuth.Scopes do
|
||||||
Functions for dealing with scopes.
|
Functions for dealing with scopes.
|
||||||
"""
|
"""
|
||||||
|
|
||||||
|
alias Pleroma.Plugs.OAuthScopesPlug
|
||||||
|
alias Pleroma.User
|
||||||
|
|
||||||
@doc """
|
@doc """
|
||||||
Fetch scopes from request params.
|
Fetch scopes from request params.
|
||||||
|
|
||||||
|
@ -53,15 +56,36 @@ def to_string(scopes), do: Enum.join(scopes, " ")
|
||||||
@doc """
|
@doc """
|
||||||
Validates scopes.
|
Validates scopes.
|
||||||
"""
|
"""
|
||||||
@spec validate(list() | nil, list()) ::
|
@spec validate(list() | nil, list(), User.t()) ::
|
||||||
{:ok, list()} | {:error, :missing_scopes | :unsupported_scopes}
|
{:ok, list()} | {:error, :missing_scopes | :unsupported_scopes}
|
||||||
def validate([], _app_scopes), do: {:error, :missing_scopes}
|
def validate(blank_scopes, _app_scopes, _user) when blank_scopes in [nil, []],
|
||||||
def validate(nil, _app_scopes), do: {:error, :missing_scopes}
|
do: {:error, :missing_scopes}
|
||||||
|
|
||||||
def validate(scopes, app_scopes) do
|
def validate(scopes, app_scopes, %User{} = user) do
|
||||||
case Pleroma.Plugs.OAuthScopesPlug.filter_descendants(scopes, app_scopes) do
|
with {:ok, _} <- ensure_scopes_support(scopes, app_scopes),
|
||||||
|
{:ok, scopes} <- authorize_admin_scopes(scopes, app_scopes, user) do
|
||||||
|
{:ok, scopes}
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
defp ensure_scopes_support(scopes, app_scopes) do
|
||||||
|
case OAuthScopesPlug.filter_descendants(scopes, app_scopes) do
|
||||||
^scopes -> {:ok, scopes}
|
^scopes -> {:ok, scopes}
|
||||||
_ -> {:error, :unsupported_scopes}
|
_ -> {:error, :unsupported_scopes}
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
|
defp authorize_admin_scopes(scopes, app_scopes, %User{} = user) do
|
||||||
|
if user.is_admin || !contains_admin_scopes?(scopes) || !contains_admin_scopes?(app_scopes) do
|
||||||
|
{:ok, scopes}
|
||||||
|
else
|
||||||
|
{:error, :unsupported_scopes}
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
def contains_admin_scopes?(scopes) do
|
||||||
|
scopes
|
||||||
|
|> OAuthScopesPlug.filter_descendants(["admin"])
|
||||||
|
|> Enum.any?()
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -7,7 +7,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiAPIController do
|
||||||
|
|
||||||
plug(
|
plug(
|
||||||
OAuthScopesPlug,
|
OAuthScopesPlug,
|
||||||
%{scopes: ["write"]}
|
%{scopes: ["write"], admin: true}
|
||||||
when action in [
|
when action in [
|
||||||
:create,
|
:create,
|
||||||
:delete,
|
:delete,
|
||||||
|
|
|
@ -8,36 +8,116 @@ defmodule Pleroma.Plugs.UserIsAdminPlugTest do
|
||||||
alias Pleroma.Plugs.UserIsAdminPlug
|
alias Pleroma.Plugs.UserIsAdminPlug
|
||||||
import Pleroma.Factory
|
import Pleroma.Factory
|
||||||
|
|
||||||
test "accepts a user that is admin" do
|
describe "unless [:auth, :enforce_oauth_admin_scope_usage]," do
|
||||||
user = insert(:user, is_admin: true)
|
clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
|
||||||
|
Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
|
||||||
|
end
|
||||||
|
|
||||||
conn =
|
test "accepts a user that is an admin" do
|
||||||
build_conn()
|
user = insert(:user, is_admin: true)
|
||||||
|> assign(:user, user)
|
|
||||||
|
|
||||||
ret_conn =
|
conn = assign(build_conn(), :user, user)
|
||||||
conn
|
|
||||||
|> UserIsAdminPlug.call(%{})
|
|
||||||
|
|
||||||
assert conn == ret_conn
|
ret_conn = UserIsAdminPlug.call(conn, %{})
|
||||||
|
|
||||||
|
assert conn == ret_conn
|
||||||
|
end
|
||||||
|
|
||||||
|
test "denies a user that isn't an admin" do
|
||||||
|
user = insert(:user)
|
||||||
|
|
||||||
|
conn =
|
||||||
|
build_conn()
|
||||||
|
|> assign(:user, user)
|
||||||
|
|> UserIsAdminPlug.call(%{})
|
||||||
|
|
||||||
|
assert conn.status == 403
|
||||||
|
end
|
||||||
|
|
||||||
|
test "denies when a user isn't set" do
|
||||||
|
conn = UserIsAdminPlug.call(build_conn(), %{})
|
||||||
|
|
||||||
|
assert conn.status == 403
|
||||||
|
end
|
||||||
end
|
end
|
||||||
|
|
||||||
test "denies a user that isn't admin" do
|
describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
|
||||||
user = insert(:user)
|
clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
|
||||||
|
Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
|
||||||
|
end
|
||||||
|
|
||||||
conn =
|
setup do
|
||||||
build_conn()
|
admin_user = insert(:user, is_admin: true)
|
||||||
|> assign(:user, user)
|
non_admin_user = insert(:user, is_admin: false)
|
||||||
|> UserIsAdminPlug.call(%{})
|
blank_user = nil
|
||||||
|
|
||||||
assert conn.status == 403
|
{:ok, %{users: [admin_user, non_admin_user, blank_user]}}
|
||||||
end
|
end
|
||||||
|
|
||||||
test "denies when a user isn't set" do
|
test "if token has any of admin scopes, accepts a user that is an admin", %{conn: conn} do
|
||||||
conn =
|
user = insert(:user, is_admin: true)
|
||||||
build_conn()
|
token = insert(:oauth_token, user: user, scopes: ["admin:something"])
|
||||||
|> UserIsAdminPlug.call(%{})
|
|
||||||
|
|
||||||
assert conn.status == 403
|
conn =
|
||||||
|
conn
|
||||||
|
|> assign(:user, user)
|
||||||
|
|> assign(:token, token)
|
||||||
|
|
||||||
|
ret_conn = UserIsAdminPlug.call(conn, %{})
|
||||||
|
|
||||||
|
assert conn == ret_conn
|
||||||
|
end
|
||||||
|
|
||||||
|
test "if token has any of admin scopes, denies a user that isn't an admin", %{conn: conn} do
|
||||||
|
user = insert(:user, is_admin: false)
|
||||||
|
token = insert(:oauth_token, user: user, scopes: ["admin:something"])
|
||||||
|
|
||||||
|
conn =
|
||||||
|
conn
|
||||||
|
|> assign(:user, user)
|
||||||
|
|> assign(:token, token)
|
||||||
|
|> UserIsAdminPlug.call(%{})
|
||||||
|
|
||||||
|
assert conn.status == 403
|
||||||
|
end
|
||||||
|
|
||||||
|
test "if token has any of admin scopes, denies when a user isn't set", %{conn: conn} do
|
||||||
|
token = insert(:oauth_token, scopes: ["admin:something"])
|
||||||
|
|
||||||
|
conn =
|
||||||
|
conn
|
||||||
|
|> assign(:user, nil)
|
||||||
|
|> assign(:token, token)
|
||||||
|
|> UserIsAdminPlug.call(%{})
|
||||||
|
|
||||||
|
assert conn.status == 403
|
||||||
|
end
|
||||||
|
|
||||||
|
test "if token lacks admin scopes, denies users regardless of is_admin flag",
|
||||||
|
%{users: users} do
|
||||||
|
for user <- users do
|
||||||
|
token = insert(:oauth_token, user: user)
|
||||||
|
|
||||||
|
conn =
|
||||||
|
build_conn()
|
||||||
|
|> assign(:user, user)
|
||||||
|
|> assign(:token, token)
|
||||||
|
|> UserIsAdminPlug.call(%{})
|
||||||
|
|
||||||
|
assert conn.status == 403
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
|
test "if token is missing, denies users regardless of is_admin flag", %{users: users} do
|
||||||
|
for user <- users do
|
||||||
|
conn =
|
||||||
|
build_conn()
|
||||||
|
|> assign(:user, user)
|
||||||
|
|> assign(:token, nil)
|
||||||
|
|> UserIsAdminPlug.call(%{})
|
||||||
|
|
||||||
|
assert conn.status == 403
|
||||||
|
end
|
||||||
|
end
|
||||||
end
|
end
|
||||||
end
|
end
|
||||||
|
|
|
@ -25,6 +25,60 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
|
||||||
:ok
|
:ok
|
||||||
end
|
end
|
||||||
|
|
||||||
|
clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
|
||||||
|
Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], false)
|
||||||
|
end
|
||||||
|
|
||||||
|
describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
|
||||||
|
clear_config([:auth, :enforce_oauth_admin_scope_usage]) do
|
||||||
|
Pleroma.Config.put([:auth, :enforce_oauth_admin_scope_usage], true)
|
||||||
|
end
|
||||||
|
|
||||||
|
test "GET /api/pleroma/admin/users/:nickname requires admin:read:accounts or broader scope" do
|
||||||
|
user = insert(:user)
|
||||||
|
admin = insert(:user, is_admin: true)
|
||||||
|
url = "/api/pleroma/admin/users/#{user.nickname}"
|
||||||
|
|
||||||
|
good_token1 = insert(:oauth_token, user: admin, scopes: ["admin"])
|
||||||
|
good_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read"])
|
||||||
|
good_token3 = insert(:oauth_token, user: admin, scopes: ["admin:read:accounts"])
|
||||||
|
|
||||||
|
bad_token1 = insert(:oauth_token, user: admin, scopes: ["read:accounts"])
|
||||||
|
bad_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read:accounts:partial"])
|
||||||
|
bad_token3 = nil
|
||||||
|
|
||||||
|
for good_token <- [good_token1, good_token2, good_token3] do
|
||||||
|
conn =
|
||||||
|
build_conn()
|
||||||
|
|> assign(:user, admin)
|
||||||
|
|> assign(:token, good_token)
|
||||||
|
|> get(url)
|
||||||
|
|
||||||
|
assert json_response(conn, 200)
|
||||||
|
end
|
||||||
|
|
||||||
|
for good_token <- [good_token1, good_token2, good_token3] do
|
||||||
|
conn =
|
||||||
|
build_conn()
|
||||||
|
|> assign(:user, nil)
|
||||||
|
|> assign(:token, good_token)
|
||||||
|
|> get(url)
|
||||||
|
|
||||||
|
assert json_response(conn, :forbidden)
|
||||||
|
end
|
||||||
|
|
||||||
|
for bad_token <- [bad_token1, bad_token2, bad_token3] do
|
||||||
|
conn =
|
||||||
|
build_conn()
|
||||||
|
|> assign(:user, admin)
|
||||||
|
|> assign(:token, bad_token)
|
||||||
|
|> get(url)
|
||||||
|
|
||||||
|
assert json_response(conn, :forbidden)
|
||||||
|
end
|
||||||
|
end
|
||||||
|
end
|
||||||
|
|
||||||
describe "DELETE /api/pleroma/admin/users" do
|
describe "DELETE /api/pleroma/admin/users" do
|
||||||
test "single user" do
|
test "single user" do
|
||||||
admin = insert(:user, is_admin: true)
|
admin = insert(:user, is_admin: true)
|
||||||
|
@ -98,7 +152,7 @@ test "Create" do
|
||||||
assert ["lain", "lain2"] -- Enum.map(log_entry.data["subjects"], & &1["nickname"]) == []
|
assert ["lain", "lain2"] -- Enum.map(log_entry.data["subjects"], & &1["nickname"]) == []
|
||||||
end
|
end
|
||||||
|
|
||||||
test "Cannot create user with exisiting email" do
|
test "Cannot create user with existing email" do
|
||||||
admin = insert(:user, is_admin: true)
|
admin = insert(:user, is_admin: true)
|
||||||
user = insert(:user)
|
user = insert(:user)
|
||||||
|
|
||||||
|
@ -129,7 +183,7 @@ test "Cannot create user with exisiting email" do
|
||||||
]
|
]
|
||||||
end
|
end
|
||||||
|
|
||||||
test "Cannot create user with exisiting nickname" do
|
test "Cannot create user with existing nickname" do
|
||||||
admin = insert(:user, is_admin: true)
|
admin = insert(:user, is_admin: true)
|
||||||
user = insert(:user)
|
user = insert(:user)
|
||||||
|
|
||||||
|
@ -1560,7 +1614,8 @@ test "returns 403 when requested by a non-admin" do
|
||||||
|> assign(:user, user)
|
|> assign(:user, user)
|
||||||
|> get("/api/pleroma/admin/reports")
|
|> get("/api/pleroma/admin/reports")
|
||||||
|
|
||||||
assert json_response(conn, :forbidden) == %{"error" => "User is not admin."}
|
assert json_response(conn, :forbidden) ==
|
||||||
|
%{"error" => "User is not an admin or OAuth admin scope is not granted."}
|
||||||
end
|
end
|
||||||
|
|
||||||
test "returns 403 when requested by anonymous" do
|
test "returns 403 when requested by anonymous" do
|
||||||
|
|
Loading…
Reference in New Issue