tidying up

This commit is contained in:
tsmethurst 2021-03-20 19:06:28 +01:00
parent 2b7b562a43
commit d0e6625d6e
3 changed files with 46 additions and 19 deletions

View File

@ -19,12 +19,14 @@
package oauth package oauth
import ( import (
"fmt"
"net/http" "net/http"
"net/url" "net/url"
"github.com/gin-contrib/sessions" "github.com/gin-contrib/sessions"
"github.com/gin-gonic/gin" "github.com/gin-gonic/gin"
"github.com/go-pg/pg/v10" "github.com/go-pg/pg/v10"
"github.com/google/uuid"
"github.com/gotosocial/gotosocial/internal/api" "github.com/gotosocial/gotosocial/internal/api"
"github.com/gotosocial/gotosocial/internal/gtsmodel" "github.com/gotosocial/gotosocial/internal/gtsmodel"
"github.com/gotosocial/gotosocial/pkg/mastotypes" "github.com/gotosocial/gotosocial/pkg/mastotypes"
@ -102,6 +104,8 @@ func New(ts oauth2.TokenStore, cs oauth2.ClientStore, conn *pg.DB, log *logrus.L
} }
func (a *API) AddRoutes(s api.Server) error { func (a *API) AddRoutes(s api.Server) error {
s.AttachHandler(http.MethodPost, "/api/v1/apps", a.AppsPOSTHandler)
s.AttachHandler(http.MethodGet, "/auth/sign_in", a.SignInGETHandler) s.AttachHandler(http.MethodGet, "/auth/sign_in", a.SignInGETHandler)
s.AttachHandler(http.MethodPost, "/auth/sign_in", a.SignInPOSTHandler) s.AttachHandler(http.MethodPost, "/auth/sign_in", a.SignInPOSTHandler)
@ -110,7 +114,6 @@ func (a *API) AddRoutes(s api.Server) error {
s.AttachHandler(http.MethodGet, "/oauth/authorize", a.AuthorizeGETHandler) s.AttachHandler(http.MethodGet, "/oauth/authorize", a.AuthorizeGETHandler)
s.AttachHandler(http.MethodPost, "/oauth/authorize", a.AuthorizePOSTHandler) s.AttachHandler(http.MethodPost, "/oauth/authorize", a.AuthorizePOSTHandler)
// s.AttachHandler(http.MethodGet, "/auth", a.AuthGETHandler)
return nil return nil
} }
@ -260,18 +263,21 @@ func (a *API) AuthorizeGETHandler(c *gin.Context) {
l := a.log.WithField("func", "AuthorizeGETHandler") l := a.log.WithField("func", "AuthorizeGETHandler")
s := sessions.Default(c) s := sessions.Default(c)
// Username will be set in the session by AuthorizePOSTHandler if the caller has already gone through the authentication flow
// If it's not set, then we don't know yet who the user is, so we need to redirect them to the sign in page.
v := s.Get("username") v := s.Get("username")
if username, ok := v.(string); !ok || username == "" { if username, ok := v.(string); !ok || username == "" {
l.Trace("username was empty, parsing form then redirecting to sign in page") l.Trace("username was empty, parsing form then redirecting to sign in page")
// first make sure they've filled out the authorize form with the required values
form := &mastotypes.OAuthAuthorize{} form := &mastotypes.OAuthAuthorize{}
if err := c.ShouldBind(form); err != nil { if err := c.ShouldBind(form); err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()}) c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return return
} }
l.Tracef("parsed form: %+v", form) l.Tracef("parsed form: %+v", form)
// these fields are *required* so check 'em
if form.ResponseType == "" || form.ClientID == "" || form.RedirectURI == "" { if form.ResponseType == "" || form.ClientID == "" || form.RedirectURI == "" {
c.JSON(http.StatusBadRequest, gin.H{"error": "missing one of: response_type, client_id or redirect_uri"}) c.JSON(http.StatusBadRequest, gin.H{"error": "missing one of: response_type, client_id or redirect_uri"})
return return
@ -288,18 +294,26 @@ func (a *API) AuthorizeGETHandler(c *gin.Context) {
return return
} }
// send them to the sign in page so we can tell who they are
c.Redirect(http.StatusFound, "/auth/sign_in") c.Redirect(http.StatusFound, "/auth/sign_in")
return return
} }
// Check if we have a code already. If we do, it means the user used urn:ietf:wg:oauth:2.0:oob as their redirect URI
// and were sent here, which means they just want the code displayed so they can use it out of band.
code := &code{} code := &code{}
if err := c.Bind(code); err != nil || code.Code == "" { if err := c.Bind(code); err != nil {
// no code yet, serve auth html and let the user confirm c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
l.Trace("serving authorize html")
c.HTML(http.StatusOK, "authorize.tmpl", gin.H{})
return return
} }
c.String(http.StatusOK, code.Code)
// the authorize template will either:
// 1. Display the code to the user if they're already authorized and were redirected here because they selected urn:ietf:wg:oauth:2.0:oob.
// 2. Display a form where they can get some information about the app that's trying to authorize, and approve it, which will then go to AuthorizePOSTHandler
l.Trace("serving authorize html")
c.HTML(http.StatusOK, "authorize.tmpl", gin.H{
"code": code.Code,
})
} }
// AuthorizePOSTHandler should be served as POST at https://example.org/oauth/authorize // AuthorizePOSTHandler should be served as POST at https://example.org/oauth/authorize
@ -417,16 +431,16 @@ func (a *API) ValidatePassword(email string, password string) (userid string, er
return return
} }
// UserAuthorizationHandler gets the user's email address from the form key 'username' // UserAuthorizationHandler gets the user's ID from the 'username' field of the request form,
// or redirects to the /auth/sign_in page, if this key is not present. // or redirects to the /auth/sign_in page, if this key is not present.
func (a *API) UserAuthorizationHandler(w http.ResponseWriter, r *http.Request) (username string, err error) { func (a *API) UserAuthorizationHandler(w http.ResponseWriter, r *http.Request) (userID string, err error) {
l := a.log.WithField("func", "UserAuthorizationHandler") l := a.log.WithField("func", "UserAuthorizationHandler")
username = r.FormValue("username") userID = r.FormValue("username")
if username == "" { if userID == "" {
l.Trace("username was empty, redirecting to sign in page") l.Trace("username was empty, redirecting to sign in page")
http.Redirect(w, r, "/auth/sign_in", http.StatusFound) http.Redirect(w, r, "/auth/sign_in", http.StatusFound)
return "", nil return "", nil
} }
l.Tracef("returning (%s, %s)", username, err) l.Tracef("returning (%s, %s)", userID, err)
return username, err return userID, err
} }

View File

@ -7,7 +7,6 @@ import (
"github.com/go-pg/pg/v10" "github.com/go-pg/pg/v10"
"github.com/go-pg/pg/v10/orm" "github.com/go-pg/pg/v10/orm"
"github.com/google/uuid"
"github.com/gotosocial/gotosocial/internal/api" "github.com/gotosocial/gotosocial/internal/api"
"github.com/gotosocial/gotosocial/internal/config" "github.com/gotosocial/gotosocial/internal/config"
"github.com/gotosocial/gotosocial/internal/gtsmodel" "github.com/gotosocial/gotosocial/internal/gtsmodel"
@ -22,6 +21,7 @@ type OauthTestSuite struct {
tokenStore oauth2.TokenStore tokenStore oauth2.TokenStore
clientStore oauth2.ClientStore clientStore oauth2.ClientStore
conn *pg.DB conn *pg.DB
testAccount *gtsmodel.Account
testUser *gtsmodel.User testUser *gtsmodel.User
testClient *oauthClient testClient *oauthClient
config *config.Config config *config.Config
@ -36,20 +36,18 @@ func (suite *OauthTestSuite) SetupSuite() {
logrus.Panicf("error encrypting user pass: %s", err) logrus.Panicf("error encrypting user pass: %s", err)
} }
userID := uuid.NewString() suite.testAccount = &gtsmodel.Account{
}
suite.testUser = &gtsmodel.User{ suite.testUser = &gtsmodel.User{
ID: userID,
EncryptedPassword: string(encryptedPassword), EncryptedPassword: string(encryptedPassword),
Email: "user@localhost", Email: "user@localhost",
CreatedAt: time.Now(),
UpdatedAt: time.Now(),
AccountID: "some-account-id-it-doesn't-matter-really-since-this-user-doesn't-actually-have-an-account!", AccountID: "some-account-id-it-doesn't-matter-really-since-this-user-doesn't-actually-have-an-account!",
} }
suite.testClient = &oauthClient{ suite.testClient = &oauthClient{
ID: "a-known-client-id", ID: "a-known-client-id",
Secret: "some-secret", Secret: "some-secret",
Domain: "http://localhost:8080", Domain: "http://localhost:8080",
UserID: userID,
} }
// because go tests are run within the test package directory, we need to fiddle with the templateconfig // because go tests are run within the test package directory, we need to fiddle with the templateconfig
@ -71,6 +69,8 @@ func (suite *OauthTestSuite) SetupTest() {
&oauthClient{}, &oauthClient{},
&oauthToken{}, &oauthToken{},
&gtsmodel.User{}, &gtsmodel.User{},
&gtsmodel.Account{},
&gtsmodel.Application{},
} }
for _, m := range models { for _, m := range models {
@ -100,6 +100,8 @@ func (suite *OauthTestSuite) TearDownTest() {
&oauthClient{}, &oauthClient{},
&oauthToken{}, &oauthToken{},
&gtsmodel.User{}, &gtsmodel.User{},
&gtsmodel.Account{},
&gtsmodel.Application{},
} }
for _, m := range models { for _, m := range models {
if err := suite.conn.Model(m).DropTable(&orm.DropTableOptions{}); err != nil { if err := suite.conn.Model(m).DropTable(&orm.DropTableOptions{}); err != nil {

View File

@ -11,6 +11,7 @@
<script src="//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script> <script src="//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script>
</head> </head>
{{if len .code | eq 0 }}
<body> <body>
<div class="container"> <div class="container">
<div class="jumbotron"> <div class="jumbotron">
@ -30,4 +31,14 @@
</div> </div>
</div> </div>
</body> </body>
{{else}}
<body>
<div class="container">
<div class="jumbotron">
{{.code}}
</div>
</div>
</body>
{{end}}
</html> </html>