mirror of
https://git.pleroma.social/pleroma/pleroma.git
synced 2024-12-23 08:36:29 +00:00
Merge branch 'feat/enforce-admin-scope-unconditionally' into 'develop'
Remove `:auth, :enforce_oauth_admin_scope_usage` See merge request pleroma/pleroma!3327
This commit is contained in:
Haelwenn
commit
c0437d1244
37 changed files with 153 additions and 337 deletions
|
|
@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
|
|||
|
||||
## Unreleased
|
||||
|
||||
### Removed
|
||||
|
||||
- `:auth, :enforce_oauth_admin_scope_usage` configuration option.
|
||||
|
||||
### Changed
|
||||
|
||||
- **Breaking**: Changed `mix pleroma.user toggle_confirmed` to `mix pleroma.user confirm`
|
||||
|
|
|
|||
|
|
@ -611,10 +611,7 @@ config :ueberauth,
|
|||
base_path: "/oauth",
|
||||
providers: ueberauth_providers
|
||||
|
||||
config :pleroma,
|
||||
:auth,
|
||||
enforce_oauth_admin_scope_usage: true,
|
||||
oauth_consumer_strategies: oauth_consumer_strategies
|
||||
config :pleroma, :auth, oauth_consumer_strategies: oauth_consumer_strategies
|
||||
|
||||
config :pleroma, Pleroma.Emails.Mailer, adapter: Swoosh.Adapters.Sendmail, enabled: false
|
||||
|
||||
|
|
|
|||
|
|
@ -2,13 +2,6 @@
|
|||
|
||||
Authentication is required and the user must be an admin.
|
||||
|
||||
Configuration options:
|
||||
|
||||
* `[:auth, :enforce_oauth_admin_scope_usage]` — OAuth admin scope requirement toggle.
|
||||
If `true`, admin actions explicitly demand admin OAuth scope(s) presence in OAuth token (client app must support admin scopes).
|
||||
If `false` and token doesn't have admin scope(s), `is_admin` user flag grants access to admin-specific actions.
|
||||
Note that client app needs to explicitly support admin scopes and request them when obtaining auth token.
|
||||
|
||||
## `GET /api/pleroma/admin/users`
|
||||
|
||||
### List users
|
||||
|
|
|
|||
|
|
@ -99,16 +99,4 @@ defmodule Pleroma.Config do
|
|||
def oauth_consumer_strategies, do: get([:auth, :oauth_consumer_strategies], [])
|
||||
|
||||
def oauth_consumer_enabled?, do: oauth_consumer_strategies() != []
|
||||
|
||||
def enforce_oauth_admin_scope_usage?, do: !!get([:auth, :enforce_oauth_admin_scope_usage])
|
||||
|
||||
def oauth_admin_scopes(scopes) when is_list(scopes) do
|
||||
Enum.flat_map(
|
||||
scopes,
|
||||
fn scope ->
|
||||
["admin:#{scope}"] ++
|
||||
if enforce_oauth_admin_scope_usage?(), do: [], else: [scope]
|
||||
end
|
||||
)
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -25,13 +25,13 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["read:accounts"], admin: true}
|
||||
%{scopes: ["admin:read:accounts"]}
|
||||
when action in [:right_get, :show_user_credentials, :create_backup]
|
||||
)
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:accounts"], admin: true}
|
||||
%{scopes: ["admin:write:accounts"]}
|
||||
when action in [
|
||||
:get_password_reset,
|
||||
:force_password_reset,
|
||||
|
|
@ -48,19 +48,19 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["read:statuses"], admin: true}
|
||||
%{scopes: ["admin:read:statuses"]}
|
||||
when action in [:list_user_statuses, :list_instance_statuses]
|
||||
)
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["read:chats"], admin: true}
|
||||
%{scopes: ["admin:read:chats"]}
|
||||
when action in [:list_user_chats]
|
||||
)
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["read"], admin: true}
|
||||
%{scopes: ["admin:read"]}
|
||||
when action in [
|
||||
:list_log,
|
||||
:stats,
|
||||
|
|
@ -70,7 +70,7 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write"], admin: true}
|
||||
%{scopes: ["admin:write"]}
|
||||
when action in [
|
||||
:restart,
|
||||
:resend_confirmation_email,
|
||||
|
|
|
|||
|
|
@ -21,12 +21,12 @@ defmodule Pleroma.Web.AdminAPI.ChatController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["read:chats"], admin: true} when action in [:show, :messages]
|
||||
%{scopes: ["admin:read:chats"]} when action in [:show, :messages]
|
||||
)
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:chats"], admin: true} when action in [:delete_message]
|
||||
%{scopes: ["admin:write:chats"]} when action in [:delete_message]
|
||||
)
|
||||
|
||||
action_fallback(Pleroma.Web.AdminAPI.FallbackController)
|
||||
|
|
|
|||
|
|
@ -10,11 +10,11 @@ defmodule Pleroma.Web.AdminAPI.ConfigController do
|
|||
alias Pleroma.Web.Plugs.OAuthScopesPlug
|
||||
|
||||
plug(Pleroma.Web.ApiSpec.CastAndValidate)
|
||||
plug(OAuthScopesPlug, %{scopes: ["write"], admin: true} when action == :update)
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action == :update)
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["read"], admin: true}
|
||||
%{scopes: ["admin:read"]}
|
||||
when action in [:show, :descriptions]
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -9,8 +9,8 @@ defmodule Pleroma.Web.AdminAPI.FrontendController do
|
|||
alias Pleroma.Web.Plugs.OAuthScopesPlug
|
||||
|
||||
plug(Pleroma.Web.ApiSpec.CastAndValidate)
|
||||
plug(OAuthScopesPlug, %{scopes: ["write"], admin: true} when action == :install)
|
||||
plug(OAuthScopesPlug, %{scopes: ["read"], admin: true} when action == :index)
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action == :install)
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:read"]} when action == :index)
|
||||
action_fallback(Pleroma.Web.AdminAPI.FallbackController)
|
||||
|
||||
defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.FrontendOperation
|
||||
|
|
|
|||
|
|
@ -15,8 +15,8 @@ defmodule Pleroma.Web.AdminAPI.InstanceDocumentController do
|
|||
|
||||
defdelegate open_api_operation(action), to: Pleroma.Web.ApiSpec.Admin.InstanceDocumentOperation
|
||||
|
||||
plug(OAuthScopesPlug, %{scopes: ["read"], admin: true} when action == :show)
|
||||
plug(OAuthScopesPlug, %{scopes: ["write"], admin: true} when action in [:update, :delete])
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:read"]} when action == :show)
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:write"]} when action in [:update, :delete])
|
||||
|
||||
def show(conn, %{name: document_name}) do
|
||||
with {:ok, url} <- InstanceDocument.get(document_name),
|
||||
|
|
|
|||
|
|
@ -14,11 +14,11 @@ defmodule Pleroma.Web.AdminAPI.InviteController do
|
|||
require Logger
|
||||
|
||||
plug(Pleroma.Web.ApiSpec.CastAndValidate)
|
||||
plug(OAuthScopesPlug, %{scopes: ["read:invites"], admin: true} when action == :index)
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:read:invites"]} when action == :index)
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:invites"], admin: true} when action in [:create, :revoke, :email]
|
||||
%{scopes: ["admin:write:invites"]} when action in [:create, :revoke, :email]
|
||||
)
|
||||
|
||||
action_fallback(Pleroma.Web.AdminAPI.FallbackController)
|
||||
|
|
|
|||
|
|
@ -15,12 +15,12 @@ defmodule Pleroma.Web.AdminAPI.MediaProxyCacheController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["read:media_proxy_caches"], admin: true} when action in [:index]
|
||||
%{scopes: ["admin:read:media_proxy_caches"]} when action in [:index]
|
||||
)
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:media_proxy_caches"], admin: true} when action in [:purge, :delete]
|
||||
%{scopes: ["admin:write:media_proxy_caches"]} when action in [:purge, :delete]
|
||||
)
|
||||
|
||||
action_fallback(Pleroma.Web.AdminAPI.FallbackController)
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ defmodule Pleroma.Web.AdminAPI.OAuthAppController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write"], admin: true}
|
||||
%{scopes: ["admin:write"]}
|
||||
when action in [:create, :index, :update, :delete]
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -15,11 +15,11 @@ defmodule Pleroma.Web.AdminAPI.RelayController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:follows"], admin: true}
|
||||
%{scopes: ["admin:write:follows"]}
|
||||
when action in [:follow, :unfollow]
|
||||
)
|
||||
|
||||
plug(OAuthScopesPlug, %{scopes: ["read"], admin: true} when action == :index)
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:read"]} when action == :index)
|
||||
|
||||
action_fallback(Pleroma.Web.AdminAPI.FallbackController)
|
||||
|
||||
|
|
|
|||
|
|
@ -19,11 +19,11 @@ defmodule Pleroma.Web.AdminAPI.ReportController do
|
|||
require Logger
|
||||
|
||||
plug(Pleroma.Web.ApiSpec.CastAndValidate)
|
||||
plug(OAuthScopesPlug, %{scopes: ["read:reports"], admin: true} when action in [:index, :show])
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:read:reports"]} when action in [:index, :show])
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:reports"], admin: true}
|
||||
%{scopes: ["admin:write:reports"]}
|
||||
when action in [:update, :notes_create, :notes_delete]
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -15,11 +15,11 @@ defmodule Pleroma.Web.AdminAPI.StatusController do
|
|||
require Logger
|
||||
|
||||
plug(Pleroma.Web.ApiSpec.CastAndValidate)
|
||||
plug(OAuthScopesPlug, %{scopes: ["read:statuses"], admin: true} when action in [:index, :show])
|
||||
plug(OAuthScopesPlug, %{scopes: ["admin:read:statuses"]} when action in [:index, :show])
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:statuses"], admin: true} when action in [:update, :delete]
|
||||
%{scopes: ["admin:write:statuses"]} when action in [:update, :delete]
|
||||
)
|
||||
|
||||
action_fallback(Pleroma.Web.AdminAPI.FallbackController)
|
||||
|
|
|
|||
|
|
@ -21,13 +21,13 @@ defmodule Pleroma.Web.AdminAPI.UserController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["read:accounts"], admin: true}
|
||||
%{scopes: ["admin:read:accounts"]}
|
||||
when action in [:list, :show]
|
||||
)
|
||||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:accounts"], admin: true}
|
||||
%{scopes: ["admin:write:accounts"]}
|
||||
when action in [
|
||||
:delete,
|
||||
:create,
|
||||
|
|
@ -40,7 +40,7 @@ defmodule Pleroma.Web.AdminAPI.UserController do
|
|||
|
||||
plug(
|
||||
OAuthScopesPlug,
|
||||
%{scopes: ["write:follows"], admin: true}
|
||||
%{scopes: ["admin:write:follows"]}
|
||||
when action in [:follow, :unfollow]
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -85,7 +85,7 @@ defmodule Pleroma.Web.ApiSpec do
|
|||
"name" => "Administration",
|
||||
"tags" => [
|
||||
"Chat administration",
|
||||
"Emoji packs",
|
||||
"Emoji pack administration",
|
||||
"Frontend managment",
|
||||
"Instance configuration",
|
||||
"Instance documents",
|
||||
|
|
@ -127,7 +127,7 @@ defmodule Pleroma.Web.ApiSpec do
|
|||
"Status actions"
|
||||
]
|
||||
},
|
||||
%{"name" => "Miscellaneous", "tags" => ["Reports", "Suggestions"]}
|
||||
%{"name" => "Miscellaneous", "tags" => ["Emoji packs", "Reports", "Suggestions"]}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ChatOperation do
|
|||
},
|
||||
security: [
|
||||
%{
|
||||
"oAuth" => ["write:chats"]
|
||||
"oAuth" => ["admin:write:chats"]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -57,7 +57,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ChatOperation do
|
|||
},
|
||||
security: [
|
||||
%{
|
||||
"oAuth" => ["read:chats"]
|
||||
"oAuth" => ["admin:read:chats"]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -88,7 +88,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ChatOperation do
|
|||
},
|
||||
security: [
|
||||
%{
|
||||
"oAuth" => ["read"]
|
||||
"oAuth" => ["admin:read"]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ConfigOperation do
|
|||
)
|
||||
| admin_api_params()
|
||||
],
|
||||
security: [%{"oAuth" => ["read"]}],
|
||||
security: [%{"oAuth" => ["admin:read"]}],
|
||||
responses: %{
|
||||
200 => Operation.response("Config", "application/json", config_response()),
|
||||
400 => Operation.response("Bad Request", "application/json", ApiError)
|
||||
|
|
@ -41,7 +41,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ConfigOperation do
|
|||
tags: ["Instance configuration"],
|
||||
summary: "Update instance configuration",
|
||||
operationId: "AdminAPI.ConfigController.update",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody:
|
||||
request_body("Parameters", %Schema{
|
||||
|
|
@ -74,7 +74,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ConfigOperation do
|
|||
tags: ["Instance configuration"],
|
||||
summary: "Retrieve config description",
|
||||
operationId: "AdminAPI.ConfigController.descriptions",
|
||||
security: [%{"oAuth" => ["read"]}],
|
||||
security: [%{"oAuth" => ["admin:read"]}],
|
||||
parameters: admin_api_params(),
|
||||
responses: %{
|
||||
200 =>
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.FrontendOperation do
|
|||
tags: ["Frontend managment"],
|
||||
summary: "Retrieve a list of available frontends",
|
||||
operationId: "AdminAPI.FrontendController.index",
|
||||
security: [%{"oAuth" => ["read"]}],
|
||||
security: [%{"oAuth" => ["admin:read"]}],
|
||||
responses: %{
|
||||
200 => Operation.response("Response", "application/json", list_of_frontends()),
|
||||
403 => Operation.response("Forbidden", "application/json", ApiError)
|
||||
|
|
@ -32,7 +32,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.FrontendOperation do
|
|||
tags: ["Frontend managment"],
|
||||
summary: "Install a frontend",
|
||||
operationId: "AdminAPI.FrontendController.install",
|
||||
security: [%{"oAuth" => ["read"]}],
|
||||
security: [%{"oAuth" => ["admin:read"]}],
|
||||
requestBody: request_body("Parameters", install_request(), required: true),
|
||||
responses: %{
|
||||
200 => Operation.response("Response", "application/json", list_of_frontends()),
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.InstanceDocumentOperation do
|
|||
tags: ["Instance documents"],
|
||||
summary: "Retrieve an instance document",
|
||||
operationId: "AdminAPI.InstanceDocumentController.show",
|
||||
security: [%{"oAuth" => ["read"]}],
|
||||
security: [%{"oAuth" => ["admin:read"]}],
|
||||
parameters: [
|
||||
Operation.parameter(:name, :path, %Schema{type: :string}, "The document name",
|
||||
required: true
|
||||
|
|
@ -39,7 +39,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.InstanceDocumentOperation do
|
|||
tags: ["Instance documents"],
|
||||
summary: "Update an instance document",
|
||||
operationId: "AdminAPI.InstanceDocumentController.update",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
requestBody: Helpers.request_body("Parameters", update_request()),
|
||||
parameters: [
|
||||
Operation.parameter(:name, :path, %Schema{type: :string}, "The document name",
|
||||
|
|
@ -77,7 +77,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.InstanceDocumentOperation do
|
|||
tags: ["Instance documents"],
|
||||
summary: "Delete an instance document",
|
||||
operationId: "AdminAPI.InstanceDocumentController.delete",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
parameters: [
|
||||
Operation.parameter(:name, :path, %Schema{type: :string}, "The document name",
|
||||
required: true
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.InviteOperation do
|
|||
tags: ["Invites"],
|
||||
summary: "Get a list of generated invites",
|
||||
operationId: "AdminAPI.InviteController.index",
|
||||
security: [%{"oAuth" => ["read:invites"]}],
|
||||
security: [%{"oAuth" => ["admin:read:invites"]}],
|
||||
parameters: admin_api_params(),
|
||||
responses: %{
|
||||
200 =>
|
||||
|
|
@ -51,7 +51,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.InviteOperation do
|
|||
tags: ["Invites"],
|
||||
summary: "Create an account registration invite token",
|
||||
operationId: "AdminAPI.InviteController.create",
|
||||
security: [%{"oAuth" => ["write:invites"]}],
|
||||
security: [%{"oAuth" => ["admin:write:invites"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody:
|
||||
request_body("Parameters", %Schema{
|
||||
|
|
@ -72,7 +72,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.InviteOperation do
|
|||
tags: ["Invites"],
|
||||
summary: "Revoke invite by token",
|
||||
operationId: "AdminAPI.InviteController.revoke",
|
||||
security: [%{"oAuth" => ["write:invites"]}],
|
||||
security: [%{"oAuth" => ["admin:write:invites"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody:
|
||||
request_body(
|
||||
|
|
@ -99,7 +99,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.InviteOperation do
|
|||
tags: ["Invites"],
|
||||
summary: "Sends registration invite via email",
|
||||
operationId: "AdminAPI.InviteController.email",
|
||||
security: [%{"oAuth" => ["write:invites"]}],
|
||||
security: [%{"oAuth" => ["admin:write:invites"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody:
|
||||
request_body(
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.MediaProxyCacheOperation do
|
|||
tags: ["MediaProxy cache"],
|
||||
summary: "Retrieve a list of banned MediaProxy URLs",
|
||||
operationId: "AdminAPI.MediaProxyCacheController.index",
|
||||
security: [%{"oAuth" => ["read:media_proxy_caches"]}],
|
||||
security: [%{"oAuth" => ["admin:read:media_proxy_caches"]}],
|
||||
parameters: [
|
||||
Operation.parameter(
|
||||
:query,
|
||||
|
|
@ -71,7 +71,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.MediaProxyCacheOperation do
|
|||
tags: ["MediaProxy cache"],
|
||||
summary: "Remove a banned MediaProxy URL",
|
||||
operationId: "AdminAPI.MediaProxyCacheController.delete",
|
||||
security: [%{"oAuth" => ["write:media_proxy_caches"]}],
|
||||
security: [%{"oAuth" => ["admin:write:media_proxy_caches"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody:
|
||||
request_body(
|
||||
|
|
@ -97,7 +97,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.MediaProxyCacheOperation do
|
|||
tags: ["MediaProxy cache"],
|
||||
summary: "Purge a URL from MediaProxy cache and optionally ban it",
|
||||
operationId: "AdminAPI.MediaProxyCacheController.purge",
|
||||
security: [%{"oAuth" => ["write:media_proxy_caches"]}],
|
||||
security: [%{"oAuth" => ["admin:write:media_proxy_caches"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody:
|
||||
request_body(
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
|
|||
summary: "Retrieve a list of OAuth applications",
|
||||
tags: ["OAuth application managment"],
|
||||
operationId: "AdminAPI.OAuthAppController.index",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
parameters: [
|
||||
Operation.parameter(:name, :query, %Schema{type: :string}, "App name"),
|
||||
Operation.parameter(:client_id, :query, %Schema{type: :string}, "Client ID"),
|
||||
|
|
@ -74,7 +74,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
|
|||
operationId: "AdminAPI.OAuthAppController.create",
|
||||
requestBody: request_body("Parameters", create_request()),
|
||||
parameters: admin_api_params(),
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
responses: %{
|
||||
200 => Operation.response("App", "application/json", oauth_app()),
|
||||
400 => Operation.response("Bad Request", "application/json", ApiError)
|
||||
|
|
@ -88,7 +88,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
|
|||
summary: "Update OAuth application",
|
||||
operationId: "AdminAPI.OAuthAppController.update",
|
||||
parameters: [id_param() | admin_api_params()],
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
requestBody: request_body("Parameters", update_request()),
|
||||
responses: %{
|
||||
200 => Operation.response("App", "application/json", oauth_app()),
|
||||
|
|
@ -106,7 +106,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.OAuthAppOperation do
|
|||
summary: "Delete OAuth application",
|
||||
operationId: "AdminAPI.OAuthAppController.delete",
|
||||
parameters: [id_param() | admin_api_params()],
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
responses: %{
|
||||
204 => no_content_response(),
|
||||
400 => no_content_response()
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.RelayOperation do
|
|||
tags: ["Relays"],
|
||||
summary: "Retrieve a list of relays",
|
||||
operationId: "AdminAPI.RelayController.index",
|
||||
security: [%{"oAuth" => ["read"]}],
|
||||
security: [%{"oAuth" => ["admin:read"]}],
|
||||
parameters: admin_api_params(),
|
||||
responses: %{
|
||||
200 =>
|
||||
|
|
@ -40,7 +40,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.RelayOperation do
|
|||
tags: ["Relays"],
|
||||
summary: "Follow a relay",
|
||||
operationId: "AdminAPI.RelayController.follow",
|
||||
security: [%{"oAuth" => ["write:follows"]}],
|
||||
security: [%{"oAuth" => ["admin:write:follows"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody: request_body("Parameters", relay_url()),
|
||||
responses: %{
|
||||
|
|
@ -54,7 +54,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.RelayOperation do
|
|||
tags: ["Relays"],
|
||||
summary: "Unfollow a relay",
|
||||
operationId: "AdminAPI.RelayController.unfollow",
|
||||
security: [%{"oAuth" => ["write:follows"]}],
|
||||
security: [%{"oAuth" => ["admin:write:follows"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody: request_body("Parameters", relay_unfollow()),
|
||||
responses: %{
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
|
|||
tags: ["Report managment"],
|
||||
summary: "Retrieve a list of reports",
|
||||
operationId: "AdminAPI.ReportController.index",
|
||||
security: [%{"oAuth" => ["read:reports"]}],
|
||||
security: [%{"oAuth" => ["admin:read:reports"]}],
|
||||
parameters: [
|
||||
Operation.parameter(
|
||||
:state,
|
||||
|
|
@ -73,7 +73,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
|
|||
summary: "Retrieve a report",
|
||||
operationId: "AdminAPI.ReportController.show",
|
||||
parameters: [id_param() | admin_api_params()],
|
||||
security: [%{"oAuth" => ["read:reports"]}],
|
||||
security: [%{"oAuth" => ["admin:read:reports"]}],
|
||||
responses: %{
|
||||
200 => Operation.response("Report", "application/json", report()),
|
||||
404 => Operation.response("Not Found", "application/json", ApiError)
|
||||
|
|
@ -86,7 +86,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
|
|||
tags: ["Report managment"],
|
||||
summary: "Change state of specified reports",
|
||||
operationId: "AdminAPI.ReportController.update",
|
||||
security: [%{"oAuth" => ["write:reports"]}],
|
||||
security: [%{"oAuth" => ["admin:write:reports"]}],
|
||||
parameters: admin_api_params(),
|
||||
requestBody: request_body("Parameters", update_request(), required: true),
|
||||
responses: %{
|
||||
|
|
@ -110,7 +110,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
|
|||
content: %Schema{type: :string, description: "The message"}
|
||||
}
|
||||
}),
|
||||
security: [%{"oAuth" => ["write:reports"]}],
|
||||
security: [%{"oAuth" => ["admin:write:reports"]}],
|
||||
responses: %{
|
||||
204 => no_content_response(),
|
||||
404 => Operation.response("Not Found", "application/json", ApiError)
|
||||
|
|
@ -128,7 +128,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.ReportOperation do
|
|||
Operation.parameter(:id, :path, :string, "Note ID")
|
||||
| admin_api_params()
|
||||
],
|
||||
security: [%{"oAuth" => ["write:reports"]}],
|
||||
security: [%{"oAuth" => ["admin:write:reports"]}],
|
||||
responses: %{
|
||||
204 => no_content_response(),
|
||||
404 => Operation.response("Not Found", "application/json", ApiError)
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.StatusOperation do
|
|||
tags: ["Status administration"],
|
||||
operationId: "AdminAPI.StatusController.index",
|
||||
summary: "Get all statuses",
|
||||
security: [%{"oAuth" => ["read:statuses"]}],
|
||||
security: [%{"oAuth" => ["admin:read:statuses"]}],
|
||||
parameters: [
|
||||
Operation.parameter(
|
||||
:godmode,
|
||||
|
|
@ -74,7 +74,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.StatusOperation do
|
|||
summary: "Get status",
|
||||
operationId: "AdminAPI.StatusController.show",
|
||||
parameters: [id_param() | admin_api_params()],
|
||||
security: [%{"oAuth" => ["read:statuses"]}],
|
||||
security: [%{"oAuth" => ["admin:read:statuses"]}],
|
||||
responses: %{
|
||||
200 => Operation.response("Status", "application/json", status()),
|
||||
404 => Operation.response("Not Found", "application/json", ApiError)
|
||||
|
|
@ -88,7 +88,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.StatusOperation do
|
|||
summary: "Change the scope of a status",
|
||||
operationId: "AdminAPI.StatusController.update",
|
||||
parameters: [id_param() | admin_api_params()],
|
||||
security: [%{"oAuth" => ["write:statuses"]}],
|
||||
security: [%{"oAuth" => ["admin:write:statuses"]}],
|
||||
requestBody: request_body("Parameters", update_request(), required: true),
|
||||
responses: %{
|
||||
200 => Operation.response("Status", "application/json", Status),
|
||||
|
|
@ -103,7 +103,7 @@ defmodule Pleroma.Web.ApiSpec.Admin.StatusOperation do
|
|||
summary: "Delete status",
|
||||
operationId: "AdminAPI.StatusController.delete",
|
||||
parameters: [id_param() | admin_api_params()],
|
||||
security: [%{"oAuth" => ["write:statuses"]}],
|
||||
security: [%{"oAuth" => ["admin:write:statuses"]}],
|
||||
responses: %{
|
||||
200 => empty_object_response(),
|
||||
404 => Operation.response("Not Found", "application/json", ApiError)
|
||||
|
|
|
|||
|
|
@ -16,10 +16,10 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiFileOperation do
|
|||
|
||||
def create_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Add new file to the pack",
|
||||
operationId: "PleromaAPI.EmojiPackController.add_file",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
requestBody: request_body("Parameters", create_request(), required: true),
|
||||
parameters: [name_param()],
|
||||
responses: %{
|
||||
|
|
@ -62,10 +62,10 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiFileOperation do
|
|||
|
||||
def update_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Add new file to the pack",
|
||||
operationId: "PleromaAPI.EmojiPackController.update_file",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
requestBody: request_body("Parameters", update_request(), required: true),
|
||||
parameters: [name_param()],
|
||||
responses: %{
|
||||
|
|
@ -106,10 +106,10 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiFileOperation do
|
|||
|
||||
def delete_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Delete emoji file from pack",
|
||||
operationId: "PleromaAPI.EmojiPackController.delete_file",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
parameters: [
|
||||
name_param(),
|
||||
Operation.parameter(:shortcode, :query, :string, "File shortcode",
|
||||
|
|
|
|||
|
|
@ -16,9 +16,9 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiPackOperation do
|
|||
|
||||
def remote_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Make request to another instance for emoji packs list",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
parameters: [
|
||||
url_param(),
|
||||
Operation.parameter(
|
||||
|
|
@ -115,10 +115,10 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiPackOperation do
|
|||
|
||||
def download_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Download pack from another instance",
|
||||
operationId: "PleromaAPI.EmojiPackController.download",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
requestBody: request_body("Parameters", download_request(), required: true),
|
||||
responses: %{
|
||||
200 => ok_response(),
|
||||
|
|
@ -145,10 +145,10 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiPackOperation do
|
|||
|
||||
def create_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Create an empty pack",
|
||||
operationId: "PleromaAPI.EmojiPackController.create",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
parameters: [name_param()],
|
||||
responses: %{
|
||||
200 => ok_response(),
|
||||
|
|
@ -161,10 +161,10 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiPackOperation do
|
|||
|
||||
def delete_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Delete a custom emoji pack",
|
||||
operationId: "PleromaAPI.EmojiPackController.delete",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
parameters: [name_param()],
|
||||
responses: %{
|
||||
200 => ok_response(),
|
||||
|
|
@ -177,10 +177,10 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiPackOperation do
|
|||
|
||||
def update_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Updates (replaces) pack metadata",
|
||||
operationId: "PleromaAPI.EmojiPackController.update",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
requestBody: request_body("Parameters", update_request(), required: true),
|
||||
parameters: [name_param()],
|
||||
responses: %{
|
||||
|
|
@ -193,10 +193,10 @@ defmodule Pleroma.Web.ApiSpec.PleromaEmojiPackOperation do
|
|||
|
||||
def import_from_filesystem_operation do
|
||||
%Operation{
|
||||
tags: ["Emoji packs"],
|
||||
tags: ["Emoji pack administration"],
|
||||
summary: "Imports packs from filesystem",
|
||||
operationId: "PleromaAPI.EmojiPackController.import",
|
||||
security: [%{"oAuth" => ["write"]}],
|
||||
security: [%{"oAuth" => ["admin:write"]}],
|
||||
responses: %{
|
||||
200 =>
|
||||
Operation.response("Array of imported pack names", "application/json", %Schema{
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileController do
|
|||
|
||||
plug(
|
||||
Pleroma.Web.Plugs.OAuthScopesPlug,
|
||||
%{scopes: ["write"], admin: true}
|
||||
%{scopes: ["admin:write"]}
|
||||
when action in [
|
||||
:create,
|
||||
:update,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackController do
|
|||
|
||||
plug(
|
||||
Pleroma.Web.Plugs.OAuthScopesPlug,
|
||||
%{scopes: ["write"], admin: true}
|
||||
%{scopes: ["admin:write"]}
|
||||
when action in [
|
||||
:import_from_filesystem,
|
||||
:remote,
|
||||
|
|
|
|||
|
|
@ -6,7 +6,6 @@ defmodule Pleroma.Web.Plugs.OAuthScopesPlug do
|
|||
import Plug.Conn
|
||||
import Pleroma.Web.Gettext
|
||||
|
||||
alias Pleroma.Config
|
||||
alias Pleroma.Helpers.AuthHelper
|
||||
|
||||
use Pleroma.Web, :plug
|
||||
|
|
@ -18,7 +17,6 @@ defmodule Pleroma.Web.Plugs.OAuthScopesPlug do
|
|||
op = options[:op] || :|
|
||||
token = assigns[:token]
|
||||
|
||||
scopes = transform_scopes(scopes, options)
|
||||
matched_scopes = (token && filter_descendants(scopes, token.scopes)) || []
|
||||
|
||||
cond do
|
||||
|
|
@ -57,13 +55,4 @@ defmodule Pleroma.Web.Plugs.OAuthScopesPlug do
|
|||
end
|
||||
)
|
||||
end
|
||||
|
||||
@doc "Transforms scopes by applying supported options (e.g. :admin)"
|
||||
def transform_scopes(scopes, options) do
|
||||
if options[:admin] do
|
||||
Config.oauth_admin_scopes(scopes)
|
||||
else
|
||||
scopes
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
|
|
@ -46,9 +46,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
|
|||
assert json_response(conn, 200)
|
||||
end
|
||||
|
||||
describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
|
||||
setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], true)
|
||||
|
||||
test "GET /api/pleroma/admin/users/:nickname requires admin:read:accounts or broader scope",
|
||||
%{admin: admin} do
|
||||
user = insert(:user)
|
||||
|
|
@ -92,60 +89,6 @@ defmodule Pleroma.Web.AdminAPI.AdminAPIControllerTest do
|
|||
assert json_response(conn, :forbidden)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe "unless [:auth, :enforce_oauth_admin_scope_usage]," do
|
||||
setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], false)
|
||||
|
||||
test "GET /api/pleroma/admin/users/:nickname requires " <>
|
||||
"read:accounts or admin:read:accounts or broader scope",
|
||||
%{admin: admin} do
|
||||
user = insert(:user)
|
||||
url = "/api/pleroma/admin/users/#{user.nickname}"
|
||||
|
||||
good_token1 = insert(:oauth_token, user: admin, scopes: ["admin"])
|
||||
good_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read"])
|
||||
good_token3 = insert(:oauth_token, user: admin, scopes: ["admin:read:accounts"])
|
||||
good_token4 = insert(:oauth_token, user: admin, scopes: ["read:accounts"])
|
||||
good_token5 = insert(:oauth_token, user: admin, scopes: ["read"])
|
||||
|
||||
good_tokens = [good_token1, good_token2, good_token3, good_token4, good_token5]
|
||||
|
||||
bad_token1 = insert(:oauth_token, user: admin, scopes: ["read:accounts:partial"])
|
||||
bad_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read:accounts:partial"])
|
||||
bad_token3 = nil
|
||||
|
||||
for good_token <- good_tokens do
|
||||
conn =
|
||||
build_conn()
|
||||
|> assign(:user, admin)
|
||||
|> assign(:token, good_token)
|
||||
|> get(url)
|
||||
|
||||
assert json_response(conn, 200)
|
||||
end
|
||||
|
||||
for good_token <- good_tokens do
|
||||
conn =
|
||||
build_conn()
|
||||
|> assign(:user, nil)
|
||||
|> assign(:token, good_token)
|
||||
|> get(url)
|
||||
|
||||
assert json_response(conn, :forbidden)
|
||||
end
|
||||
|
||||
for bad_token <- [bad_token1, bad_token2, bad_token3] do
|
||||
conn =
|
||||
build_conn()
|
||||
|> assign(:user, admin)
|
||||
|> assign(:token, bad_token)
|
||||
|> get(url)
|
||||
|
||||
assert json_response(conn, :forbidden)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe "PUT /api/pleroma/admin/users/tag" do
|
||||
setup %{conn: conn} do
|
||||
|
|
|
|||
|
|
@ -47,9 +47,6 @@ defmodule Pleroma.Web.AdminAPI.UserControllerTest do
|
|||
assert json_response(conn, 200)
|
||||
end
|
||||
|
||||
describe "with [:auth, :enforce_oauth_admin_scope_usage]," do
|
||||
setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], true)
|
||||
|
||||
test "GET /api/pleroma/admin/users/:nickname requires admin:read:accounts or broader scope",
|
||||
%{admin: admin} do
|
||||
user = insert(:user)
|
||||
|
|
@ -93,60 +90,6 @@ defmodule Pleroma.Web.AdminAPI.UserControllerTest do
|
|||
assert json_response(conn, :forbidden)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe "unless [:auth, :enforce_oauth_admin_scope_usage]," do
|
||||
setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], false)
|
||||
|
||||
test "GET /api/pleroma/admin/users/:nickname requires " <>
|
||||
"read:accounts or admin:read:accounts or broader scope",
|
||||
%{admin: admin} do
|
||||
user = insert(:user)
|
||||
url = "/api/pleroma/admin/users/#{user.nickname}"
|
||||
|
||||
good_token1 = insert(:oauth_token, user: admin, scopes: ["admin"])
|
||||
good_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read"])
|
||||
good_token3 = insert(:oauth_token, user: admin, scopes: ["admin:read:accounts"])
|
||||
good_token4 = insert(:oauth_token, user: admin, scopes: ["read:accounts"])
|
||||
good_token5 = insert(:oauth_token, user: admin, scopes: ["read"])
|
||||
|
||||
good_tokens = [good_token1, good_token2, good_token3, good_token4, good_token5]
|
||||
|
||||
bad_token1 = insert(:oauth_token, user: admin, scopes: ["read:accounts:partial"])
|
||||
bad_token2 = insert(:oauth_token, user: admin, scopes: ["admin:read:accounts:partial"])
|
||||
bad_token3 = nil
|
||||
|
||||
for good_token <- good_tokens do
|
||||
conn =
|
||||
build_conn()
|
||||
|> assign(:user, admin)
|
||||
|> assign(:token, good_token)
|
||||
|> get(url)
|
||||
|
||||
assert json_response(conn, 200)
|
||||
end
|
||||
|
||||
for good_token <- good_tokens do
|
||||
conn =
|
||||
build_conn()
|
||||
|> assign(:user, nil)
|
||||
|> assign(:token, good_token)
|
||||
|> get(url)
|
||||
|
||||
assert json_response(conn, :forbidden)
|
||||
end
|
||||
|
||||
for bad_token <- [bad_token1, bad_token2, bad_token3] do
|
||||
conn =
|
||||
build_conn()
|
||||
|> assign(:user, admin)
|
||||
|> assign(:token, bad_token)
|
||||
|> get(url)
|
||||
|
||||
assert json_response(conn, :forbidden)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
describe "DELETE /api/pleroma/admin/users" do
|
||||
test "single user", %{admin: admin, conn: conn} do
|
||||
|
|
|
|||
|
|
@ -13,8 +13,6 @@ defmodule Pleroma.Web.PleromaAPI.EmojiFileControllerTest do
|
|||
Pleroma.Config.get!([:instance, :static_dir]),
|
||||
"emoji"
|
||||
)
|
||||
setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], false)
|
||||
|
||||
setup do: clear_config([:instance, :public], true)
|
||||
|
||||
setup do
|
||||
|
|
|
|||
|
|
@ -13,7 +13,6 @@ defmodule Pleroma.Web.PleromaAPI.EmojiPackControllerTest do
|
|||
Pleroma.Config.get!([:instance, :static_dir]),
|
||||
"emoji"
|
||||
)
|
||||
setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage], false)
|
||||
|
||||
setup do: clear_config([:instance, :public], true)
|
||||
|
||||
|
|
|
|||
|
|
@ -169,42 +169,4 @@ defmodule Pleroma.Web.Plugs.OAuthScopesPlugTest do
|
|||
assert f.(["admin:read"], ["write", "admin"]) == ["admin:read"]
|
||||
end
|
||||
end
|
||||
|
||||
describe "transform_scopes/2" do
|
||||
setup do: clear_config([:auth, :enforce_oauth_admin_scope_usage])
|
||||
|
||||
setup do
|
||||
{:ok, %{f: &OAuthScopesPlug.transform_scopes/2}}
|
||||
end
|
||||
|
||||
test "with :admin option, prefixes all requested scopes with `admin:` " <>
|
||||
"and [optionally] keeps only prefixed scopes, " <>
|
||||
"depending on `[:auth, :enforce_oauth_admin_scope_usage]` setting",
|
||||
%{f: f} do
|
||||
clear_config([:auth, :enforce_oauth_admin_scope_usage], false)
|
||||
|
||||
assert f.(["read"], %{admin: true}) == ["admin:read", "read"]
|
||||
|
||||
assert f.(["read", "write"], %{admin: true}) == [
|
||||
"admin:read",
|
||||
"read",
|
||||
"admin:write",
|
||||
"write"
|
||||
]
|
||||
|
||||
clear_config([:auth, :enforce_oauth_admin_scope_usage], true)
|
||||
|
||||
assert f.(["read:accounts"], %{admin: true}) == ["admin:read:accounts"]
|
||||
|
||||
assert f.(["read", "write:reports"], %{admin: true}) == [
|
||||
"admin:read",
|
||||
"admin:write:reports"
|
||||
]
|
||||
end
|
||||
|
||||
test "with no supported options, returns unmodified scopes", %{f: f} do
|
||||
assert f.(["read"], %{}) == ["read"]
|
||||
assert f.(["read", "write"], %{}) == ["read", "write"]
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
|
|||
Loading…
Reference in a new issue