Pleroma/test/plugs/oauth_scopes_plug_test.exs

# Pleroma: A lightweight social networking server
# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only

defmodule Pleroma.Plugs.OAuthScopesPlugTest do
  use Pleroma.Web.ConnCase, async: true

  alias Pleroma.Plugs.OAuthScopesPlug
  alias Pleroma.Repo

  import Pleroma.Factory

  test "proceeds with no op if `assigns[:token]` is nil", %{conn: conn} do
    conn =
      conn
      |> assign(:user, insert(:user))
      |> OAuthScopesPlug.call(%{scopes: ["read"]})

    refute conn.halted
    assert conn.assigns[:user]
  end

  test "proceeds with no op if `token.scopes` fulfill specified 'any of' conditions", %{
    conn: conn
  } do
    token = insert(:oauth_token, scopes: ["read", "write"]) |> Repo.preload(:user)

    conn =
      conn
      |> assign(:user, token.user)
      |> assign(:token, token)
      |> OAuthScopesPlug.call(%{scopes: ["read"]})

    refute conn.halted
    assert conn.assigns[:user]
  end

  test "proceeds with no op if `token.scopes` fulfill specified 'all of' conditions", %{
    conn: conn
  } do
    token = insert(:oauth_token, scopes: ["scope1", "scope2", "scope3"]) |> Repo.preload(:user)

    conn =
      conn
      |> assign(:user, token.user)
      |> assign(:token, token)
      |> OAuthScopesPlug.call(%{scopes: ["scope2", "scope3"], op: :&})

    refute conn.halted
    assert conn.assigns[:user]
  end

  test "proceeds with cleared `assigns[:user]` if `token.scopes` doesn't fulfill specified 'any of' conditions " <>
         "and `fallback: :proceed_unauthenticated` option is specified",
       %{conn: conn} do
    token = insert(:oauth_token, scopes: ["read", "write"]) |> Repo.preload(:user)

    conn =
      conn
      |> assign(:user, token.user)
      |> assign(:token, token)
      |> OAuthScopesPlug.call(%{scopes: ["follow"], fallback: :proceed_unauthenticated})

    refute conn.halted
    refute conn.assigns[:user]
  end

  test "proceeds with cleared `assigns[:user]` if `token.scopes` doesn't fulfill specified 'all of' conditions " <>
         "and `fallback: :proceed_unauthenticated` option is specified",
       %{conn: conn} do
    token = insert(:oauth_token, scopes: ["read", "write"]) |> Repo.preload(:user)

    conn =
      conn
      |> assign(:user, token.user)
      |> assign(:token, token)
      |> OAuthScopesPlug.call(%{
        scopes: ["read", "follow"],
        op: :&,
        fallback: :proceed_unauthenticated
      })

    refute conn.halted
    refute conn.assigns[:user]
  end

  test "returns 403 and halts " <>
         "in case of no :fallback option and `token.scopes` not fulfilling specified 'any of' conditions",
       %{conn: conn} do
    token = insert(:oauth_token, scopes: ["read", "write"])
    any_of_scopes = ["follow"]

    conn =
      conn
      |> assign(:token, token)
      |> OAuthScopesPlug.call(%{scopes: any_of_scopes})

    assert conn.halted
    assert 403 == conn.status

    expected_error = "Insufficient permissions: #{Enum.join(any_of_scopes, ", ")}."
    assert Jason.encode!(%{error: expected_error}) == conn.resp_body
  end

  test "returns 403 and halts " <>
         "in case of no :fallback option and `token.scopes` not fulfilling specified 'all of' conditions",
       %{conn: conn} do
    token = insert(:oauth_token, scopes: ["read", "write"])
    all_of_scopes = ["write", "follow"]

    conn =
      conn
      |> assign(:token, token)
      |> OAuthScopesPlug.call(%{scopes: all_of_scopes, op: :&})

    assert conn.halted
    assert 403 == conn.status

    expected_error =
      "Insufficient permissions: #{Enum.join(all_of_scopes -- token.scopes, ", ")}."

    assert Jason.encode!(%{error: expected_error}) == conn.resp_body
  end

  describe "with hierarchical scopes, " do
    test "proceeds with no op if `token.scopes` fulfill specified 'any of' conditions", %{
      conn: conn
    } do
      token = insert(:oauth_token, scopes: ["read", "write"]) |> Repo.preload(:user)

      conn =
        conn
        |> assign(:user, token.user)
        |> assign(:token, token)
        |> OAuthScopesPlug.call(%{scopes: ["read:something"]})

      refute conn.halted
      assert conn.assigns[:user]
    end

    test "proceeds with no op if `token.scopes` fulfill specified 'all of' conditions", %{
      conn: conn
    } do
      token = insert(:oauth_token, scopes: ["scope1", "scope2", "scope3"]) |> Repo.preload(:user)

      conn =
        conn
        |> assign(:user, token.user)
        |> assign(:token, token)
        |> OAuthScopesPlug.call(%{scopes: ["scope1:subscope", "scope2:subscope"], op: :&})

      refute conn.halted
      assert conn.assigns[:user]
    end
  end
end