API: Support OAuth client credentials
This commit is contained in:
parent
786b5cf283
commit
0aaaf8d6ef
|
@ -18,11 +18,11 @@ Supported mobile apps:
|
||||||
- twitlatte
|
- twitlatte
|
||||||
- AndStatus
|
- AndStatus
|
||||||
- Twidere
|
- Twidere
|
||||||
|
- Subway Tooter
|
||||||
|
|
||||||
Unsupported mobile apps:
|
Unsupported mobile apps:
|
||||||
|
|
||||||
- [Subway Tooter](https://github.com/tateisu/SubwayTooter) Uses the wrong grant_type when requesting a token, possibly a problem in the server type detection of the app. See issue https://github.com/tateisu/SubwayTooter/issues/156
|
- [Mammut](https://github.com/jamiesanson/Mammut) There are problems with the token request, see issue https://github.com/jamiesanson/Mammut/issues/19
|
||||||
- [Mammut](https://github.com/jamiesanson/Mammut) States that the instance doesn't exist. Most likely an issue in the vitality check of the app, see issue https://github.com/jamiesanson/Mammut/issues/19
|
|
||||||
- [Fedilab](https://framagit.org/tom79/fedilab) Automatically uses the legacy API, see issue: https://framagit.org/tom79/fedilab/-/issues/520
|
- [Fedilab](https://framagit.org/tom79/fedilab) Automatically uses the legacy API, see issue: https://framagit.org/tom79/fedilab/-/issues/520
|
||||||
|
|
||||||
## Entities
|
## Entities
|
||||||
|
|
|
@ -50,12 +50,7 @@ class Token extends BaseApi
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if ($grant_type != 'authorization_code') {
|
if (empty($client_id) || empty($client_secret)) {
|
||||||
Logger::warning('Unsupported or missing grant type', ['request' => $_REQUEST]);
|
|
||||||
DI::mstdnError()->UnprocessableEntity(DI::l10n()->t('Unsupported or missing grant type'));
|
|
||||||
}
|
|
||||||
|
|
||||||
if (empty($client_id) || empty($client_secret) || empty($redirect_uri)) {
|
|
||||||
Logger::warning('Incomplete request data', ['request' => $_REQUEST]);
|
Logger::warning('Incomplete request data', ['request' => $_REQUEST]);
|
||||||
DI::mstdnError()->UnprocessableEntity(DI::l10n()->t('Incomplete request data'));
|
DI::mstdnError()->UnprocessableEntity(DI::l10n()->t('Incomplete request data'));
|
||||||
}
|
}
|
||||||
|
@ -65,13 +60,23 @@ class Token extends BaseApi
|
||||||
DI::mstdnError()->UnprocessableEntity();
|
DI::mstdnError()->UnprocessableEntity();
|
||||||
}
|
}
|
||||||
|
|
||||||
// For security reasons only allow freshly created tokens
|
if ($grant_type == 'client_credentials') {
|
||||||
$condition = ["`application-id` = ? AND `code` = ? AND `created_at` > UTC_TIMESTAMP() - INTERVAL ? MINUTE", $application['id'], $code, 5];
|
// the "client_credentials" are used as a token for the application itself.
|
||||||
|
// see https://aaronparecki.com/oauth-2-simplified/#client-credentials
|
||||||
|
$token = self::createTokenForUser($application, 0, '');
|
||||||
|
} elseif ($grant_type == 'authorization_code') {
|
||||||
|
// For security reasons only allow freshly created tokens
|
||||||
|
$condition = ["`redirect_uri` = ? AND `id` = ? AND `code` = ? AND `created_at` > UTC_TIMESTAMP() - INTERVAL ? MINUTE",
|
||||||
|
$redirect_uri, $application['id'], $code, 5];
|
||||||
|
|
||||||
$token = DBA::selectFirst('application-token', ['access_token', 'created_at'], $condition);
|
$token = DBA::selectFirst('application-view', ['access_token', 'created_at'], $condition);
|
||||||
if (!DBA::isResult($token)) {
|
if (!DBA::isResult($token)) {
|
||||||
Logger::warning('Token not found or outdated', $condition);
|
Logger::warning('Token not found or outdated', $condition);
|
||||||
DI::mstdnError()->Unauthorized();
|
DI::mstdnError()->Unauthorized();
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
Logger::warning('Unsupported or missing grant type', ['request' => $_REQUEST]);
|
||||||
|
DI::mstdnError()->UnprocessableEntity(DI::l10n()->t('Unsupported or missing grant type'));
|
||||||
}
|
}
|
||||||
|
|
||||||
$object = new \Friendica\Object\Api\Mastodon\Token($token['access_token'], 'Bearer', $application['scopes'], $token['created_at']);
|
$object = new \Friendica\Object\Api\Mastodon\Token($token['access_token'], 'Bearer', $application['scopes'], $token['created_at']);
|
||||||
|
|
Loading…
Reference in New Issue
Block a user