33 Commits (9ab7e66caeb68df565b47f024ad69a7d29a49e8c)

Author	SHA1	Message	Date
Emelia Smith	049b159beb	Add read:me OAuth 2.0 scope, allowing more limited access to user data (#29087)	8 months ago
Matt Jankowski	8d47ba893a	Fix `Style/PercentLiteralDelimiters` cop (#30006)	9 months ago
Emelia Smith	46142cdbdd	Disable administrative doorkeeper routes (#29187)	11 months ago
Matt Jankowski	c875dfc90b	Fix `Lint/UnusedBlockArgument` cop (#27777)	1 year ago
Nick Schonning	1d557305d2	Enable Rubocop Style/FrozenStringLiteralComment (#23793)	1 year ago
trwnh	a2931d19ae	Add missing admin scopes (fix #20892) (#20918)	2 years ago
Eugen Rochko	96129c2f10	Fix confirmation redirect to app without `Location` header (#18523)	3 years ago
Eugen Rochko	3b8d085436	Fix app name, website and redirect URIs not having a maximum length (#16042) ... Fix app scopes not being validated	4 years ago
Eugen Rochko	5d8398c8b8	Add E2EE API (#13820)	5 years ago
Eugen Rochko	59c697a30c	Fix resource_owner_from_credentials in Doorkeeper initializer (#12743) ... - Nil error when e-mail not found - LDAP authentication used in place of PAM authentication	5 years ago
ntl-purism	f3a93987b6	LDAP & PAM added to OAuth password grant strategy (#7999) (#12390) ... When authenticating via OAuth, the resource owner password grant strategy is allowed by Mastodon, but (without this PR), it does not attempt to authenticate against LDAP or PAM. As a result, LDAP or PAM authenticated users cannot sign in to Mastodon with their email/password credentials via OAuth (for instance, for native/mobile app users). This PR fleshes out the authentication strategy supplied to doorkeeper in its initializer by looking up the user with LDAP and/or PAM when devise is configured to use LDAP/PAM backends. It attempts to follow the same logic as the Auth::SessionsController for handling email/password credentials. Note #1: Since this pull request affects an initializer, it's unclear how to add test automation. Note #2: The PAM authentication path has not been manually tested. It was added for completeness sake, and it is hoped that it can be manually tested before merging.	5 years ago
ThibG	dfea7368c9	Add bookmarks (#7107) ... * Add backend support for bookmarks Bookmarks behave like favourites, except they aren't shared with other users and do not have an associated counter. * Add spec for bookmark endpoints * Add front-end support for bookmarks * Introduce OAuth scopes for bookmarks * Add bookmarks to archive takeout * Fix migration * Coding style fixes * Fix rebase issue * Update bookmarked_statuses to latest UI changes * Update bookmark actions to properly reflect status changes in state * Add bookmarks item to single-column layout * Make active bookmarks red	5 years ago
Eugen Rochko	7696f77245	Add moderation API (#9387) ... Fix #8580 Fix #7143	6 years ago
Eugen Rochko	a38a452481	Add unread indicator to conversations (#9009)	6 years ago
Eugen Rochko	1f6ed4f86a	Add more granular OAuth scopes (#7929) ... * Add more granular OAuth scopes * Add human-readable descriptions of the new scopes * Ensure new scopes look good on the app UI * Add tests * Group scopes in screen and color-code dangerous ones * Fix wrong extra scope	7 years ago
Eugen Rochko	b4fb766b23	Add REST API for Web Push Notifications subscriptions (#7445) ... - POST /api/v1/push/subscription - PUT /api/v1/push/subscription - DELETE /api/v1/push/subscription - New OAuth scope: "push" (required for the above methods)	7 years ago
Eugen Rochko	db3ed498b0	When OAuth password verification fails, return 401 instead of redirect (#5111) ... Call to warden.authenticate! in resource_owner_from_credentials would make the request redirect to sign-in path, which is a bad response for apps. Now bad credentials just return nil, which leads to HTTP 401 from Doorkeeper. Also, accounts with enabled 2FA cannot be logged into this way.	7 years ago
Colin Mitchell	871c0d251a	Application prefs section (#2758) ... * Add code for creating/managing apps to settings section * Add specs for app changes * Fix controller spec * Fix view file I pasted over by mistake * Add locale strings. Add 'my apps' to nav * Add Client ID/Secret to App page. Add some visual separation * Fix rubocop warnings * Fix embarrassing typo I lost an `end` statement while fixing a merge conflict. * Add code for creating/managing apps to settings section - Add specs for app changes - Add locale strings. Add 'my apps' to nav - Add Client ID/Secret to App page. Add some visual separation - Fix some bugs/warnings * Update to match code standards * Trigger notification * Add warning about not sharing API secrets * Tweak spec a bit * Cleanup fixture creation by using let! * Remove unused key * Add foreign key for application<->user	7 years ago
Eugen Rochko	df605f0f8b	Add "signed in as" header to some pages (#4523)	8 years ago
Eugen Rochko	88725d6ce8	OEmbed support for PreviewCard (#2337) ... * OEmbed support for PreviewCard * Improve ProviderDiscovery code failure treatment * Do not crawl links if there is a content warning, since those don't display a link card anyway * Reset db schema * Fresh migrate * Fix rubocop style issues Fix #1681 - return existing access token when applicable instead of creating new * Fix test * Extract http client to helper * Improve oembed controller	8 years ago
Eugen Rochko	720d1f8f3d	Restrict access to oauth/applications to admins only	8 years ago
Eugen Rochko	a9e40a3d80	Adding OAuth access scopes, fixing OAuth authorization UI, adding rate limiting ... to the API	8 years ago
Eugen Rochko	f06f295890	Fix doorkeeper skip_authorization	8 years ago
Eugen Rochko	492224b93f	Allow non-https redirect URIs for OAuth apps (AndStatus seems to require this)	8 years ago
Eugen Rochko	7e14eefc81	Replace logo, fix #57 - delete/unreblog/unfavourite API, fix #45 - app ... registration API	8 years ago
Eugen Rochko	92afd29650	The frontend will now be an OAuth app, auto-authorized. The frontend will use an access token for API requests ... Adding better errors for the API controllers, posting a simple status works from the frontend now	8 years ago
Eugen Rochko	44e57f64dd	Improving statuses, adding a composer drawer, which doesn't work yet	8 years ago
Eugen Rochko	9cb690c706	Access tokens no longer expire, case-insensitive local username validation, as well as case-insensitive Webfinger look-up	9 years ago
Eugen Rochko	6fec8afc3f	Bind oauth applications to users	9 years ago
Eugen Rochko	1aa477ac2f	Customized more doorkeeper views, only logged in users can create oauth apps	9 years ago
Eugen Rochko	447cfef62d	Improving feed queries, switching API to doorkeeper authentication	9 years ago
Eugen Rochko	b919f39b31	Customizing doorkeeper views for authorizing app	9 years ago
Eugen Rochko	ab6696e855	Adding doorkeeper, adding a REST API ... POST /api/statuses Params: status (text contents), in_reply_to_id (optional) GET /api/statuses/:id POST /api/statuses/:id/reblog GET /api/accounts/:id GET /api/accounts/:id/following GET /api/accounts/:id/followers POST /api/accounts/:id/follow POST /api/accounts/:id/unfollow POST /api/follows Params: uri (e.g. user@domain) OAuth authentication is currently disabled, but the API can be used with HTTP Auth.	9 years ago