Merge pull request #126 from ThisIsMissEm/refactor/oauth-logic

Author: dahlia

.env.test

@@ -1,8 +1,8 @@
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/hollo_test
 SECRET_KEY="test_determinist_key_DO_NOT_USE_IN_PRODUCTION"
 
-LOG_LEVEL=debug
-LOG_QUERY=true
+# LOG_LEVEL=debug
+# LOG_QUERY=true
 
 # Setting ALLOW_PRIVATE_ADDRESS to true disables SSRF (Server-Side Request Forgery) protection
 # Set to true to test in local network

bin/routes.ts

@@ -0,0 +1,6 @@
+import { showRoutes } from "hono/dev";
+import app from "../src/index";
+
+showRoutes(app, {
+  colorize: true,
+});

package.json

@@ -7,6 +7,7 @@
   "scripts": {
     "prod": "pnpm run migrate && tsx --env-file-if-exists=.env --dns-result-order=ipv6first bin/server.ts",
     "dev": "pnpm run migrate && tsx watch --env-file-if-exists=.env --dns-result-order=ipv6first bin/server.ts",
+    "list:routes": "tsx --env-file-if-exists=.env bin/routes.ts",
     "test": "pnpm run migrate:test && tsx --env-file-if-exists=.env.test --test",
     "test:ci": "tsx --test --test-reporter=@reporters/github --test-reporter-destination=stdout --test-reporter=spec --test-reporter-destination=stdout",
     "check": "tsc && biome check .",

src/api/v1/accounts.test.ts

@@ -0,0 +1,105 @@
+import { afterEach, beforeEach, describe, it } from "node:test";
+import type { TestContext } from "node:test";
+
+import { cleanDatabase } from "../../../tests/helpers";
+import {
+  createAccount,
+  createOAuthApplication,
+  getAccessToken,
+} from "../../../tests/helpers/oauth";
+
+import app from "../../index";
+
+describe("/api/v1/accounts/", () => {
+  let client: Awaited<ReturnType<typeof createOAuthApplication>>;
+  let account: Awaited<ReturnType<typeof createAccount>>;
+
+  beforeEach(async () => {
+    account = await createAccount();
+    client = await createOAuthApplication({
+      scopes: ["read:accounts", "write"],
+    });
+  });
+
+  afterEach(async () => {
+    await cleanDatabase();
+  });
+
+  describe("verify_credentials", () => {
+    it("Successfully returns the current accounts profile with a valid access token", async (t: TestContext) => {
+      t.plan(7);
+
+      const accessToken = await getAccessToken(client, account, [
+        "read:accounts",
+      ]);
+
+      const response = await app.request(
+        "/api/v1/accounts/verify_credentials",
+        {
+          method: "GET",
+          headers: {
+            Authorization: accessToken.authorizationHeader,
+          },
+        },
+      );
+
+      t.assert.equal(response.status, 200);
+      t.assert.equal(response.headers.get("content-type"), "application/json");
+      t.assert.equal(response.headers.get("access-control-allow-origin"), "*");
+
+      const credentialAccount = await response.json();
+
+      t.assert.equal(typeof credentialAccount, "object");
+      t.assert.equal(credentialAccount.id, account.id);
+      t.assert.equal(credentialAccount.username, "hollo");
+      t.assert.equal(credentialAccount.acct, "hollo@hollo.test");
+    });
+
+    it("does not return the account when an invalid scope is used", async (t: TestContext) => {
+      t.plan(4);
+
+      const accessToken = await getAccessToken(client, account, ["write"]);
+
+      const response = await app.request(
+        "/api/v1/accounts/verify_credentials",
+        {
+          method: "GET",
+          headers: {
+            Authorization: accessToken.authorizationHeader,
+          },
+        },
+      );
+
+      t.assert.equal(response.status, 403);
+      t.assert.equal(response.headers.get("content-type"), "application/json");
+      t.assert.equal(response.headers.get("access-control-allow-origin"), "*");
+
+      const error = await response.json();
+
+      t.assert.deepStrictEqual(error, {
+        error: "insufficient_scope",
+      });
+    });
+
+    it("does not return the account when no access token is used", async (t: TestContext) => {
+      t.plan(4);
+
+      const response = await app.request(
+        "/api/v1/accounts/verify_credentials",
+        {
+          method: "GET",
+        },
+      );
+
+      t.assert.equal(response.status, 401);
+      t.assert.equal(response.headers.get("content-type"), "application/json");
+      t.assert.equal(response.headers.get("access-control-allow-origin"), "*");
+
+      const error = await response.json();
+
+      t.assert.deepStrictEqual(error, {
+        error: "unauthorized",
+      });
+    });
+  });
+});

src/api/v1/accounts.ts

@@ -36,7 +36,11 @@ import {
   persistAccountPosts,
   unfollowAccount,
 } from "../../federation/account";
-import { type Variables, scopeRequired, tokenRequired } from "../../oauth";
+import {
+  type Variables,
+  scopeRequired,
+  tokenRequired,
+} from "../../oauth/middleware";
 import {
   type Account,
   type AccountOwner,

src/api/v1/apps.ts

@@ -3,7 +3,7 @@ import { getLogger } from "@logtape/logtape";
 import { Hono } from "hono";
 import { z } from "zod";
 import { db } from "../../db";
-import { type Variables, tokenRequired } from "../../oauth";
+import { type Variables, tokenRequired } from "../../oauth/middleware";
 import {
   type NewApplication,
   type Scope,

src/api/v1/featured_tags.ts

@@ -13,7 +13,11 @@ import { Hono } from "hono";
 import { z } from "zod";
 import db from "../../db";
 import { serializeFeaturedTag } from "../../entities/tag";
-import { type Variables, scopeRequired, tokenRequired } from "../../oauth";
+import {
+  type Variables,
+  scopeRequired,
+  tokenRequired,
+} from "../../oauth/middleware";
 import type * as schema from "../../schema";
 import { featuredTags, posts } from "../../schema";
 import { type Uuid, isUuid, uuidv7 } from "../../uuid";

src/api/v1/follow_requests.ts

@@ -9,7 +9,11 @@ import {
 } from "../../entities/account";
 import { federation } from "../../federation";
 import { updateAccountStats } from "../../federation/account";
-import { type Variables, scopeRequired, tokenRequired } from "../../oauth";
+import {
+  type Variables,
+  scopeRequired,
+  tokenRequired,
+} from "../../oauth/middleware";
 import { accounts, blocks, follows, mutes } from "../../schema";
 import { isUuid } from "../../uuid";
 

src/api/v1/index.ts

@@ -7,7 +7,11 @@ import { db } from "../../db";
 import { serializeAccount } from "../../entities/account";
 import { getPostRelations, serializePost } from "../../entities/status";
 import { serializeTag } from "../../entities/tag";
-import { type Variables, scopeRequired, tokenRequired } from "../../oauth";
+import {
+  type Variables,
+  scopeRequired,
+  tokenRequired,
+} from "../../oauth/middleware";
 import {
   accounts as accountsTable,
   blocks,

src/api/v1/lists.ts

@@ -5,7 +5,11 @@ import { z } from "zod";
 import { db } from "../../db";
 import { serializeAccount } from "../../entities/account";
 import { serializeList } from "../../entities/list";
-import { type Variables, scopeRequired, tokenRequired } from "../../oauth";
+import {
+  type Variables,
+  scopeRequired,
+  tokenRequired,
+} from "../../oauth/middleware";
 import { listMembers, lists } from "../../schema";
 import { isUuid, uuid, uuidv7 } from "../../uuid";