parent
73e66fd31f
commit
ccc2cf0e87
@ -1,31 +0,0 @@
|
||||
# Pleroma: A lightweight social networking server
|
||||
# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
defmodule Pleroma.Web.Plugs.SessionAuthenticationPlug do
|
||||
@moduledoc """
|
||||
Authenticates user by session-stored `:user_id` and request-contained username.
|
||||
Username can be provided via HTTP Basic Auth (the password is not checked and can be anything).
|
||||
"""
|
||||
|
||||
import Plug.Conn
|
||||
|
||||
alias Pleroma.Helpers.AuthHelper
|
||||
|
||||
def init(options) do
|
||||
options
|
||||
end
|
||||
|
||||
def call(%{assigns: %{user: %Pleroma.User{}}} = conn, _), do: conn
|
||||
|
||||
def call(conn, _) do
|
||||
with saved_user_id <- get_session(conn, :user_id),
|
||||
%{auth_user: %{id: ^saved_user_id}} <- conn.assigns do
|
||||
conn
|
||||
|> assign(:user, conn.assigns.auth_user)
|
||||
|> AuthHelper.skip_oauth()
|
||||
else
|
||||
_ -> conn
|
||||
end
|
||||
end
|
||||
end
|
@ -1,65 +0,0 @@
|
||||
# Pleroma: A lightweight social networking server
|
||||
# Copyright © 2017-2020 Pleroma Authors <https://pleroma.social/>
|
||||
# SPDX-License-Identifier: AGPL-3.0-only
|
||||
|
||||
defmodule Pleroma.Web.Plugs.SessionAuthenticationPlugTest do
|
||||
use Pleroma.Web.ConnCase, async: true
|
||||
|
||||
alias Pleroma.User
|
||||
alias Pleroma.Web.Plugs.OAuthScopesPlug
|
||||
alias Pleroma.Web.Plugs.PlugHelper
|
||||
alias Pleroma.Web.Plugs.SessionAuthenticationPlug
|
||||
|
||||
setup %{conn: conn} do
|
||||
session_opts = [
|
||||
store: :cookie,
|
||||
key: "_test",
|
||||
signing_salt: "cooldude"
|
||||
]
|
||||
|
||||
conn =
|
||||
conn
|
||||
|> Plug.Session.call(Plug.Session.init(session_opts))
|
||||
|> fetch_session()
|
||||
|> assign(:auth_user, %User{id: 1})
|
||||
|
||||
%{conn: conn}
|
||||
end
|
||||
|
||||
test "it does nothing if a user is assigned", %{conn: conn} do
|
||||
conn = assign(conn, :user, %User{})
|
||||
ret_conn = SessionAuthenticationPlug.call(conn, %{})
|
||||
|
||||
assert ret_conn == conn
|
||||
end
|
||||
|
||||
# Scenario: requester has the cookie and knows the username (not necessarily knows the password)
|
||||
test "if the auth_user has the same id as the user_id in the session, it assigns the user", %{
|
||||
conn: conn
|
||||
} do
|
||||
conn =
|
||||
conn
|
||||
|> put_session(:user_id, conn.assigns.auth_user.id)
|
||||
|> SessionAuthenticationPlug.call(%{})
|
||||
|
||||
assert conn.assigns.user == conn.assigns.auth_user
|
||||
assert conn.assigns.token == nil
|
||||
assert PlugHelper.plug_skipped?(conn, OAuthScopesPlug)
|
||||
end
|
||||
|
||||
# Scenario: requester has the cookie but doesn't know the username
|
||||
test "if the auth_user has a different id as the user_id in the session, it does nothing", %{
|
||||
conn: conn
|
||||
} do
|
||||
conn = put_session(conn, :user_id, -1)
|
||||
ret_conn = SessionAuthenticationPlug.call(conn, %{})
|
||||
|
||||
assert ret_conn == conn
|
||||
end
|
||||
|
||||
test "if the session does not contain user_id, it does nothing", %{
|
||||
conn: conn
|
||||
} do
|
||||
assert conn == SessionAuthenticationPlug.call(conn, %{})
|
||||
end
|
||||
end
|
Loading…
Reference in new issue