autonomic-cooperative/gotosocial
0
0
Fork 0
Code Releases Activity

auth flow working for code

Browse Source
This commit is contained in:
tsmethurst
2021-03-18 23:27:43 +01:00
parent b6087cc08d
commit 1b11884121
14 changed files with 275 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files

63
internal/oauth/html.go
View File

@ -2,67 +2,8 @@ package oauth
const (
signInHTML = `
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Login</title>
<link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css">
<script src="//code.jquery.com/jquery-2.2.4.min.js"></script>
<script src="//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script>
</head>
<body>
<div class="container">
<h1>Login</h1>
<form action="/auth/sign_in" method="POST">
<div class="form-group">
<label for="email">Email</label>
<input type="text" class="form-control" name="username" required placeholder="Please enter your email address">
</div>
<div class="form-group">
<label for="password">Password</label>
<input type="password" class="form-control" name="password" placeholder="Please enter your password">
</div>
<button type="submit" class="btn btn-success">Login</button>
</form>
</div>
</body>
</html>`
`
authorizeHTML = `
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<title>Auth</title>
<link
rel="stylesheet"
href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css"
/>
<script src="//code.jquery.com/jquery-2.2.4.min.js"></script>
<script src="//maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script>
</head>
<body>
<div class="container">
<div class="jumbotron">
<form action="/oauth/authorize" method="POST">
<h1>Authorize</h1>
<p>The client would like to perform actions on your behalf.</p>
<p>
<button
type="submit"
class="btn btn-primary btn-lg"
style="width:200px;"
>
Allow
</button>
</p>
</form>
</div>
</div>
</body>
</html>`
`
)

110
internal/oauth/oauth.go
View File

@ -27,6 +27,7 @@ import (
"github.com/go-pg/pg/v10"
"github.com/gotosocial/gotosocial/internal/api"
"github.com/gotosocial/gotosocial/internal/gtsmodel"
"github.com/gotosocial/gotosocial/pkg/mastotypes"
"github.com/gotosocial/oauth2/v4"
"github.com/gotosocial/oauth2/v4/errors"
"github.com/gotosocial/oauth2/v4/manage"
@ -45,16 +46,12 @@ type API struct {
}
type login struct {
Email string `form:"username"`
Email string `form:"username"`
Password string `form:"password"`
}
type authorize struct {
ForceLogin string `form:"force_login,omitempty"`
ResponseType string `form:"response_type"`
ClientID string `form:"client_id"`
RedirectURI string `form:"redirect_uri"`
Scope string `form:"scope,omitempty"`
type code struct {
Code string `form:"code"`
}
func New(ts oauth2.TokenStore, cs oauth2.ClientStore, conn *pg.DB, log *logrus.Logger) *API {
@ -79,6 +76,9 @@ func New(ts oauth2.TokenStore, cs oauth2.ClientStore, conn *pg.DB, log *logrus.L
oauth2.AuthorizationCode,
oauth2.Refreshing,
},
AllowedCodeChallengeMethods: []oauth2.CodeChallengeMethod{
oauth2.CodeChallengePlain,
},
}
srv := server.NewServer(sc, manager)
@ -106,9 +106,13 @@ func New(ts oauth2.TokenStore, cs oauth2.ClientStore, conn *pg.DB, log *logrus.L
func (a *API) AddRoutes(s api.Server) error {
s.AttachHandler(http.MethodGet, "/auth/sign_in", a.SignInGETHandler)
s.AttachHandler(http.MethodPost, "/auth/sign_in", a.SignInPOSTHandler)
s.AttachHandler(http.MethodPost, "/oauth/token", a.TokenHandler)
s.AttachHandler(http.MethodGet, "/oauth/authorize", a.AuthorizeGETHandler)
s.AttachHandler(methodAny, "/auth", a.AuthHandler)
s.AttachHandler(http.MethodPost, "/oauth/authorize", a.AuthorizePOSTHandler)
// s.AttachHandler(http.MethodGet, "/auth", a.AuthGETHandler)
return nil
}
@ -125,7 +129,7 @@ func incorrectPassword() (string, error) {
// The form will then POST to the sign in page, which will be handled by SignInPOSTHandler
func (a *API) SignInGETHandler(c *gin.Context) {
a.log.WithField("func", "SignInGETHandler").Trace("serving sign in html")
c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(signInHTML))
c.HTML(http.StatusOK, "sign-in.tmpl", gin.H{})
}
// SignInPOSTHandler should be served at https://example.org/auth/sign_in.
@ -135,15 +139,16 @@ func (a *API) SignInPOSTHandler(c *gin.Context) {
l := a.log.WithField("func", "SignInPOSTHandler")
s := sessions.Default(c)
form := &login{}
if err := c.ShouldBind(form); err != nil || form.Email == "" || form.Password == "" {
if err := c.ShouldBind(form); err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return
}
l.Tracef("parsed form: %+v", form)
userid, err := a.ValidatePassword(form.Email, form.Password);
userid, err := a.ValidatePassword(form.Email, form.Password)
if err != nil {
c.String(http.StatusForbidden, err.Error())
return
}
s.Set("username", userid)
@ -151,11 +156,12 @@ func (a *API) SignInPOSTHandler(c *gin.Context) {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
l.Trace("redirecting to auth page")
c.Redirect(http.StatusFound, "/auth")
c.Redirect(http.StatusFound, "/oauth/authorize")
}
// TokenHandler should be served at https://example.org/oauth/token
// TokenHandler should be served as a POST at https://example.org/oauth/token
// The idea here is to serve an oauth access token to a user, which can be used for authorizing against non-public APIs.
// See https://docs.joinmastodon.org/methods/apps/oauth/#obtain-a-token
func (a *API) TokenHandler(c *gin.Context) {
@ -166,50 +172,61 @@ func (a *API) TokenHandler(c *gin.Context) {
}
}
// AuthorizeHandler should be served as GET at https://example.org/oauth/authorize
// AuthorizeGETHandler should be served as GET at https://example.org/oauth/authorize
// The idea here is to present an oauth authorize page to the user, with a button
// that they have to click to accept. See here: https://docs.joinmastodon.org/methods/apps/oauth/#authorize-a-user
func (a *API) AuthorizeGETHandler(c *gin.Context) {
l := a.log.WithField("func", "AuthorizeHandler")
l := a.log.WithField("func", "AuthorizeGETHandler")
s := sessions.Default(c)
form := &authorize{}
if err := c.ShouldBind(form); err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return
}
l.Tracef("parsed form: %+v", form)
if form.ResponseType == "" || form.ClientID == "" || form.RedirectURI == "" {
c.JSON(http.StatusBadRequest, gin.H{"error": "missing one of: response_type, client_id or redirect_uri"})
return
}
s.Set("force_login", form.ForceLogin)
s.Set("response_type", form.ResponseType)
s.Set("client_id", form.ClientID)
s.Set("redirect_uri", form.RedirectURI)
s.Set("scope", form.Scope)
if err := s.Save(); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
}
v := s.Get("username")
if username, ok := v.(string); !ok || username == "" {
l.Trace("username was empty, redirecting to sign in page")
l.Trace("username was empty, parsing form then redirecting to sign in page")
form := &mastotypes.OAuthAuthorize{}
if err := c.ShouldBind(form); err != nil {
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
return
}
l.Tracef("parsed form: %+v", form)
if form.ResponseType == "" || form.ClientID == "" || form.RedirectURI == "" {
c.JSON(http.StatusBadRequest, gin.H{"error": "missing one of: response_type, client_id or redirect_uri"})
return
}
// save these values from the form so we can use them elsewhere in the session
s.Set("force_login", form.ForceLogin)
s.Set("response_type", form.ResponseType)
s.Set("client_id", form.ClientID)
s.Set("redirect_uri", form.RedirectURI)
s.Set("scope", form.Scope)
if err := s.Save(); err != nil {
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
return
}
c.Redirect(http.StatusFound, "/auth/sign_in")
return
}
l.Trace("serving authorize html")
c.Data(http.StatusOK, "text/html; charset=utf-8", []byte(authorizeHTML))
c.HTML(http.StatusOK, "authorize.tmpl", gin.H{})
}
// AuthHandler should be served at https://example.org/auth
func (a *API) AuthHandler(c *gin.Context) {
l := a.log.WithField("func", "AuthHandler")
// AuthorizePOSTHandler should be served as POST at https://example.org/oauth/authorize
// The idea here is to present an oauth authorize page to the user, with a button
// that they have to click to accept. See here: https://docs.joinmastodon.org/methods/apps/oauth/#authorize-a-user
func (a *API) AuthorizePOSTHandler(c *gin.Context) {
l := a.log.WithField("func", "AuthorizePOSTHandler")
s := sessions.Default(c)
v := s.Get("username")
if username, ok := v.(string); !ok || username == "" {
c.JSON(http.StatusUnauthorized, gin.H{"error": "you are not signed in"})
}
values := url.Values{}
if v, ok := s.Get("force_login").(string); !ok {
@ -277,7 +294,13 @@ func (a *API) AuthHandler(c *gin.Context) {
// so that it can be used in further Oauth flows to generate a token/retreieve an oauth client from the db.
func (a *API) ValidatePassword(email string, password string) (userid string, err error) {
l := a.log.WithField("func", "PasswordAuthorizationHandler")
l.Tracef("email %s password %s", email, password)
// make sure an email/password was provided and bail if not
if email == "" || password == "" {
l.Debug("email or password was not provided")
return incorrectPassword()
}
// first we select the user from the database based on email address, bail if no user found for that email
gtsUser := &gtsmodel.User{}
if err := a.conn.Model(gtsUser).Where("email = ?", email).Select(); err != nil {
@ -297,8 +320,7 @@ func (a *API) ValidatePassword(email string, password string) (userid string, er
return incorrectPassword()
}
// If we've made it this far the email/password is correct so we need the oauth client-id of the user
// This is, conveniently, the same as the user ID, so we can just return it.
// If we've made it this far the email/password is correct, so we can just return the id of the user.
userid = gtsUser.ID
l.Tracef("returning (%s, %s)", userid, err)
return

15
internal/oauth/oauth_test.go
View File

@ -40,17 +40,24 @@ func (suite *OauthTestSuite) SetupSuite() {
suite.testUser = &gtsmodel.User{
ID: userID,
EncryptedPassword: string(encryptedPassword),
Email: "user@localhost",
Email: "user@example.org",
CreatedAt: time.Now(),
UpdatedAt: time.Now(),
AccountID: "some-account-id-it-doesn't-matter-really",
AccountID: "some-account-id-it-doesn't-matter-really-since-this-user-doesn't-actually-have-an-account!",
}
suite.testClient = &oauthClient{
ID: "a-known-client-id",
Secret: "some-secret",
Domain: "http://localhost:8080",
Domain: "https://example.org",
UserID: userID,
}
// because go tests are run within the test package directory, we need to fiddle with the templateconfig
// basedir in a way that we wouldn't normally have to do when running the binary, in order to make
// the templates actually load
c := config.Empty()
c.TemplateConfig.BaseDir = "../../web/template/"
suite.config = c
}
// SetupTest creates a postgres connection and creates the oauth_clients table before each test
@ -114,7 +121,7 @@ func (suite *OauthTestSuite) TestAPIInitialize() {
api.AddRoutes(r)
go r.Start()
time.Sleep(30 * time.Second)
// http://localhost:8080/oauth/authorize?client_id=a-known-client-id&redirect_uri=''&response_type=code
// http://localhost:8080/oauth/authorize?client_id=a-known-client-id&response_type=code&redirect_uri=https://example.org
}
func TestOauthTestSuite(t *testing.T) {