From b6a001a34c09a35070049065367ccb7f0382a1e1 Mon Sep 17 00:00:00 2001 From: "Haelwenn (lanodan) Monnier" Date: Sat, 2 Mar 2019 04:04:16 +0100 Subject: [PATCH 1/2] Web.OAuth.OAuthController: Fix scopes Enum.join for OAuth response --- lib/pleroma/web/oauth/oauth_controller.ex | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex index 7c1a3adbd..4309cf58f 100644 --- a/lib/pleroma/web/oauth/oauth_controller.ex +++ b/lib/pleroma/web/oauth/oauth_controller.ex @@ -114,7 +114,7 @@ def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do refresh_token: token.refresh_token, created_at: DateTime.to_unix(inserted_at), expires_in: 60 * 10, - scope: Enum.join(token.scopes) + scope: Enum.join(token.scopes, " ") } json(conn, response) From bb9e40968a90b882ba85e71a2622756e40563207 Mon Sep 17 00:00:00 2001 From: "Haelwenn (lanodan) Monnier" Date: Sat, 2 Mar 2019 04:10:43 +0100 Subject: [PATCH 2/2] Web.OAuth.OAuthControllerTest: Add test against token formatting --- test/web/oauth/oauth_controller_test.exs | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/test/web/oauth/oauth_controller_test.exs b/test/web/oauth/oauth_controller_test.exs index 53d83e6e8..ed94416ff 100644 --- a/test/web/oauth/oauth_controller_test.exs +++ b/test/web/oauth/oauth_controller_test.exs @@ -165,10 +165,10 @@ test "issues a token for `password` grant_type with valid credentials, with full test "issues a token for request with HTTP basic auth client credentials" do user = insert(:user) - app = insert(:oauth_app, scopes: ["scope1", "scope2"]) + app = insert(:oauth_app, scopes: ["scope1", "scope2", "scope3"]) - {:ok, auth} = Authorization.create_authorization(app, user, ["scope2"]) - assert auth.scopes == ["scope2"] + {:ok, auth} = Authorization.create_authorization(app, user, ["scope1", "scope2"]) + assert auth.scopes == ["scope1", "scope2"] app_encoded = (URI.encode_www_form(app.client_id) <> ":" <> URI.encode_www_form(app.client_secret)) @@ -183,11 +183,13 @@ test "issues a token for request with HTTP basic auth client credentials" do "redirect_uri" => app.redirect_uris }) - assert %{"access_token" => token} = json_response(conn, 200) + assert %{"access_token" => token, "scope" => scope} = json_response(conn, 200) + + assert scope == "scope1 scope2" token = Repo.get_by(Token, token: token) assert token - assert token.scopes == ["scope2"] + assert token.scopes == ["scope1", "scope2"] end test "rejects token exchange with invalid client credentials" do