end
def require_user!
- if current_user && !current_user.disabled?
+ if current_user && !current_user.disabled? && current_user.confirmed?
set_user_activity
elsif current_user
render json: { error: 'Your login is currently disabled' }, status: 403
# frozen_string_literal: true
class Api::V1::AccountsController < Api::BaseController
- before_action -> { authorize_if_got_token! :read, :'read:accounts' }, except: [:follow, :unfollow, :block, :unblock, :mute, :unmute]
+ before_action -> { authorize_if_got_token! :read, :'read:accounts' }, except: [:create, :follow, :unfollow, :block, :unblock, :mute, :unmute]
before_action -> { doorkeeper_authorize! :follow, :'write:follows' }, only: [:follow, :unfollow]
before_action -> { doorkeeper_authorize! :follow, :'write:mutes' }, only: [:mute, :unmute]
before_action -> { doorkeeper_authorize! :follow, :'write:blocks' }, only: [:block, :unblock]
+ before_action -> { doorkeeper_authorize! :write, :'write:accounts' }, only: [:create]
- before_action :require_user!, except: [:show]
- before_action :set_account
+ before_action :require_user!, except: [:show, :create]
+ before_action :set_account, except: [:create]
before_action :check_account_suspension, only: [:show]
+ before_action :check_enabled_registrations, only: [:create]
respond_to :json
render json: @account, serializer: REST::AccountSerializer
end
+ def create
+ token = AppSignUpService.new.call(doorkeeper_token.application, account_params)
+ response = Doorkeeper::OAuth::TokenResponse.new(token)
+
+ headers.merge!(response.headers)
+
+ self.response_body = Oj.dump(response.body)
+ self.status = response.status
+ end
+
def follow
FollowService.new.call(current_user.account, @account, reblogs: truthy_param?(:reblogs))
def check_account_suspension
gone if @account.suspended?
end
+
+ def account_params
+ params.permit(:username, :email, :password, :agreement)
+ end
+
+ def check_enabled_registrations
+ forbidden if single_user_mode? || !Setting.open_registrations
+ end
end
before_action :set_body_classes
before_action :set_user, only: [:finish_signup]
- # GET/PATCH /users/:id/finish_signup
def finish_signup
return unless request.patch? && params[:user]
+
if @user.update(user_params)
@user.skip_reconfirmation!
bypass_sign_in(@user)
def user_params
params.require(:user).permit(:email)
end
+
+ def after_confirmation_path_for(_resource_name, user)
+ if user.created_by_application && truthy_param?(:redirect_to_app)
+ user.created_by_application.redirect_uri
+ else
+ super
+ end
+ end
end
resource.locale = I18n.locale
resource.invite_code = params[:invite_code] if resource.invite_code.blank?
+ resource.agreement = true
resource.build_account if resource.account.nil?
end
# invite_id :bigint(8)
# remember_token :string
# chosen_languages :string is an Array
+# created_by_application_id :bigint(8)
#
class User < ApplicationRecord
belongs_to :account, inverse_of: :user
belongs_to :invite, counter_cache: :uses, optional: true
+ belongs_to :created_by_application, class_name: 'Doorkeeper::Application', optional: true
accepts_nested_attributes_for :account
has_many :applications, class_name: 'Doorkeeper::Application', as: :owner
validates :locale, inclusion: I18n.available_locales.map(&:to_s), if: :locale?
validates_with BlacklistedEmailValidator, if: :email_changed?
validates_with EmailMxValidator, if: :validate_email_dns?
+ validates :agreement, acceptance: { allow_nil: false, accept: [true, 'true', '1'] }, on: :create
scope :recent, -> { order(id: :desc) }
scope :admins, -> { where(admin: true) }
end
if resource.blank?
- resource = new(email: attributes[:email])
+ resource = new(email: attributes[:email], agreement: true)
if Devise.check_at_sign && !resource[:email].index('@')
resource[:email] = Rpam2.getenv(resource.find_pam_service, attributes[:email], attributes[:password], 'email', false)
resource[:email] = "#{attributes[:email]}@#{resource.find_pam_suffix}" unless resource[:email]
resource = joins(:account).find_by(accounts: { username: attributes[Devise.ldap_uid.to_sym].first })
if resource.blank?
- resource = new(email: attributes[:mail].first, account_attributes: { username: attributes[Devise.ldap_uid.to_sym].first })
+ resource = new(email: attributes[:mail].first, agreement: true, account_attributes: { username: attributes[Devise.ldap_uid.to_sym].first })
resource.ldap_setup(attributes)
end
--- /dev/null
+# frozen_string_literal: true
+
+class AppSignUpService < BaseService
+ def call(app, params)
+ return unless allowed_registrations?
+
+ user_params = params.slice(:email, :password, :agreement)
+ account_params = params.slice(:username)
+ user = User.create!(user_params.merge(created_by_application: app, password_confirmation: user_params[:password], account_attributes: account_params))
+
+ Doorkeeper::AccessToken.create!(application: app,
+ resource_owner_id: user.id,
+ scopes: app.scopes,
+ expires_in: Doorkeeper.configuration.access_token_expires_in,
+ use_refresh_token: Doorkeeper.configuration.refresh_token_enabled?)
+ end
+
+ private
+
+ def allowed_registrations?
+ Setting.open_registrations && !Rails.configuration.x.single_user_mode
+ end
+end
%tbody
%tr
%td.button-primary
- = link_to confirmation_url(@resource, confirmation_token: @token) do
- %span= t 'devise.mailer.confirmation_instructions.action'
+ - if @resource.created_by_application
+ = link_to confirmation_url(@resource, confirmation_token: @token, redirect_to_app: 'true') do
+ %span= t 'devise.mailer.confirmation_instructions.action_with_app', app: @resource.created_by_application.name
+ - else
+ = link_to confirmation_url(@resource, confirmation_token: @token) do
+ %span= t 'devise.mailer.confirmation_instructions.action'
%table.email-table{ cellspacing: 0, cellpadding: 0 }
%tbody
<%= t 'devise.mailer.confirmation_instructions.explanation', host: site_hostname %>
-=> <%= confirmation_url(@resource, confirmation_token: @token) %>
+=> <%= confirmation_url(@resource, confirmation_token: @token, redirect_to_app: @resource.created_by_application ? 'true' : nil) %>
<%= strip_tags(t('devise.mailer.confirmation_instructions.extra_html', terms_path: about_more_url, policy_path: terms_url)) %>
req.authenticated_user_id if req.post? && req.path.start_with?('/api/v1/media')
end
+ throttle('throttle_api_sign_up', limit: 5, period: 30.minutes) do |req|
+ req.ip if req.post? && req.path == '/api/v1/accounts'
+ end
+
throttle('protected_paths', limit: 25, period: 5.minutes) do |req|
req.ip if req.post? && req.path =~ PROTECTED_PATHS_REGEX
end
mailer:
confirmation_instructions:
action: Verify email address
+ action_with_app: Confirm and return to %{app}
explanation: You have created an account on %{host} with this email address. You are one click away from activating it. If this wasn't you, please ignore this email.
extra_html: Please also check out <a href="%{terms_path}">the rules of the instance</a> and <a href="%{policy_path}">our terms of service</a>.
subject: 'Mastodon: Confirmation instructions for %{instance}'
resources :relationships, only: :index
end
- resources :accounts, only: [:show] do
+ resources :accounts, only: [:create, :show] do
resources :statuses, only: :index, controller: 'accounts/statuses'
resources :followers, only: :index, controller: 'accounts/follower_accounts'
resources :following, only: :index, controller: 'accounts/following_accounts'
--- /dev/null
+class AddCreatedByApplicationIdToUsers < ActiveRecord::Migration[5.2]
+ disable_ddl_transaction!
+
+ def change
+ add_reference :users, :created_by_application, foreign_key: { to_table: 'oauth_applications', on_delete: :nullify }, index: false
+ add_index :users, :created_by_application_id, algorithm: :concurrently
+ end
+end
#
# It's strongly recommended that you check this file into your version control system.
-ActiveRecord::Schema.define(version: 2018_12_13_185533) do
+ActiveRecord::Schema.define(version: 2018_12_19_235220) do
# These are extensions that must be enabled in order to support this database
enable_extension "plpgsql"
t.bigint "invite_id"
t.string "remember_token"
t.string "chosen_languages", array: true
+ t.bigint "created_by_application_id"
t.index ["account_id"], name: "index_users_on_account_id"
t.index ["confirmation_token"], name: "index_users_on_confirmation_token", unique: true
+ t.index ["created_by_application_id"], name: "index_users_on_created_by_application_id"
t.index ["email"], name: "index_users_on_email", unique: true
t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
end
add_foreign_key "subscriptions", "accounts", name: "fk_9847d1cbb5", on_delete: :cascade
add_foreign_key "users", "accounts", name: "fk_50500f500d", on_delete: :cascade
add_foreign_key "users", "invites", on_delete: :nullify
+ add_foreign_key "users", "oauth_applications", column: "created_by_application_id", on_delete: :nullify
add_foreign_key "web_push_subscriptions", "oauth_access_tokens", column: "access_token_id", on_delete: :cascade
add_foreign_key "web_push_subscriptions", "users", on_delete: :cascade
add_foreign_key "web_settings", "users", name: "fk_11910667b2", on_delete: :cascade
def create(username)
account = Account.new(username: username)
password = SecureRandom.hex
- user = User.new(email: options[:email], password: password, admin: options[:role] == 'admin', moderator: options[:role] == 'moderator', confirmed_at: Time.now.utc)
+ user = User.new(email: options[:email], password: password, agreement: true, admin: options[:role] == 'admin', moderator: options[:role] == 'moderator', confirmed_at: options[:confirmed] ? Time.now.utc : nil)
if options[:reattach]
account = Account.find_local(username) || Account.new(username: username)
end
end
+ describe 'POST #create' do
+ let(:app) { Fabricate(:application) }
+ let(:token) { Doorkeeper::AccessToken.find_or_create_for(app, nil, 'read write', nil, false) }
+ let(:agreement) { nil }
+
+ before do
+ post :create, params: { username: 'test', password: '12345678', email: 'hello@world.tld', agreement: agreement }
+ end
+
+ context 'given truthy agreement' do
+ let(:agreement) { 'true' }
+
+ it 'returns http success' do
+ expect(response).to have_http_status(200)
+ end
+
+ it 'returns a new access token as JSON' do
+ expect(body_as_json[:access_token]).to_not be_blank
+ end
+
+ it 'creates a user' do
+ user = User.find_by(email: 'hello@world.tld')
+ expect(user).to_not be_nil
+ expect(user.created_by_application_id).to eq app.id
+ end
+ end
+
+ context 'given no agreement' do
+ it 'returns http unprocessable entity' do
+ expect(response).to have_http_status(422)
+ end
+ end
+ end
+
describe 'GET #show' do
let(:scopes) { 'read:accounts' }
email { sequence(:email) { |i| "#{i}#{Faker::Internet.email}" } }
password "123456789"
confirmed_at { Time.zone.now }
+ agreement true
end
end
it 'should allow a non-blacklisted user to be created' do
- user = User.new(email: 'foo@example.com', account: account, password: password)
+ user = User.new(email: 'foo@example.com', account: account, password: password, agreement: true)
expect(user.valid?).to be_truthy
end
it 'should not allow a blacklisted user to be created' do
- user = User.new(email: 'foo@mvrht.com', account: account, password: password)
+ user = User.new(email: 'foo@mvrht.com', account: account, password: password, agreement: true)
expect(user.valid?).to be_falsey
end
it 'should not allow a subdomain blacklisted user to be created' do
- user = User.new(email: 'foo@mvrht.com.topdomain.tld', account: account, password: password)
+ user = User.new(email: 'foo@mvrht.com.topdomain.tld', account: account, password: password, agreement: true)
expect(user.valid?).to be_falsey
end
end
it 'should not allow a user to be created unless they are whitelisted' do
- user = User.new(email: 'foo@example.com', account: account, password: password)
+ user = User.new(email: 'foo@example.com', account: account, password: password, agreement: true)
expect(user.valid?).to be_falsey
end
it 'should allow a user to be created if they are whitelisted' do
- user = User.new(email: 'foo@mastodon.space', account: account, password: password)
+ user = User.new(email: 'foo@mastodon.space', account: account, password: password, agreement: true)
expect(user.valid?).to be_truthy
end
it 'should not allow a user with a whitelisted top domain as subdomain in their email address to be created' do
- user = User.new(email: 'foo@mastodon.space.userdomain.com', account: account, password: password)
+ user = User.new(email: 'foo@mastodon.space.userdomain.com', account: account, password: password, agreement: true)
expect(user.valid?).to be_falsey
end
it_behaves_like 'Settings-extended' do
def create!
- User.create!(account: Fabricate(:account), email: 'foo@mastodon.space', password: 'abcd1234')
+ User.create!(account: Fabricate(:account), email: 'foo@mastodon.space', password: 'abcd1234', agreement: true)
end
def fabricate
--- /dev/null
+require 'rails_helper'
+
+RSpec.describe AppSignUpService, type: :service do
+ let(:app) { Fabricate(:application, scopes: 'read write') }
+ let(:good_params) { { username: 'alice', password: '12345678', email: 'good@email.com', agreement: true } }
+
+ subject { described_class.new }
+
+ describe '#call' do
+ it 'returns nil when registrations are closed' do
+ Setting.open_registrations = false
+ expect(subject.call(app, good_params)).to be_nil
+ end
+
+ it 'raises an error when params are missing' do
+ expect { subject.call(app, {}) }.to raise_error ActiveRecord::RecordInvalid
+ end
+
+ it 'creates an unconfirmed user with access token' do
+ access_token = subject.call(app, good_params)
+ expect(access_token).to_not be_nil
+ user = User.find_by(id: access_token.resource_owner_id)
+ expect(user).to_not be_nil
+ expect(user.confirmed?).to be false
+ end
+
+ it 'creates access token with the app\'s scopes' do
+ access_token = subject.call(app, good_params)
+ expect(access_token).to_not be_nil
+ expect(access_token.scopes.to_s).to eq 'read write'
+ end
+
+ it 'creates an account' do
+ access_token = subject.call(app, good_params)
+ expect(access_token).to_not be_nil
+ user = User.find_by(id: access_token.resource_owner_id)
+ expect(user).to_not be_nil
+ expect(user.account).to_not be_nil
+ end
+ end
+end
cat aescling's git repositories / mastodon.git / commitdiff