pleroma/admin-fe
0
0
Fork 0
Code Issues 48 Pull requests 19 Projects Releases Packages Wiki Activity

Added 'admin' & 'push' OAuth scopes #301

Closed
i1t wants to merge 3 commits from gitlab-mr-iid-69 into develop
pull from: gitlab-mr-iid-69
merge into: pleroma:develop
Conversation 12 Commits 3 Files changed 4 +4 -2
i1t commented 2019-12-07 14:53:48 +00:00
Member
Copy link

AdminFE support for pleroma/pleroma#5403

PleromaFE support for admin scope (required for "Login with PleromaFE" feature): pleroma/pleroma-fe#2291

Note: push scope is also added since it's a standard scope, and AdminFE should be full-featured. Open to removing it if there are arguments against it.

Note: disabled PleromaFE login feature since PleromaFE shouldn't request admin scope.

AdminFE support for https://git.pleroma.social/pleroma/pleroma/pulls/5403 PleromaFE support for `admin` scope (required for "Login with PleromaFE" feature): https://git.pleroma.social/pleroma/pleroma-fe/pulls/2291 Note: `push` scope is also added since it's a standard scope, and AdminFE should be full-featured. Open to removing it if there are arguments against it. Note: disabled PleromaFE login feature since PleromaFE shouldn't request admin scope.
maxf commented 2019-12-07 18:28:01 +00:00
Member
Copy link

It's a pity, since it was a handy feature :( Nothing to do, but delete it though, I guess. I'm ok with having push scope as well.

Could you please remove login feature altogether then, not just disable it?

It's a pity, since it was a handy feature :( Nothing to do, but delete it though, I guess. I'm ok with having `push` scope as well. Could you please remove login feature altogether then, not just disable it?
rinpatch commented 2019-12-07 19:18:30 +00:00
Member
Copy link

Note: disabled PleromaFE login feature since PleromaFE shouldn't request admin scope.

No it should, pleroma-fe has moderation features integrated into it

> Note: disabled PleromaFE login feature since PleromaFE shouldn't request admin scope. No it should, pleroma-fe has moderation features integrated into it
i1t commented 2019-12-07 19:19:41 +00:00
Author
Member
Copy link

@rinpatch, so I guess we add admin scope to PleromaFE and reenable PleromaFE login feature in AdminFE, correct?

@rinpatch, so I guess we add `admin` scope to PleromaFE and reenable PleromaFE login feature in AdminFE, correct?
rinpatch commented 2019-12-07 20:22:44 +00:00
Member
Copy link

yes

yes
i1t commented 2019-12-10 20:41:39 +00:00
Author
Member
Copy link

@rinpatch BE MR was merged, please merge this one.

@rinpatch BE MR was merged, please merge this one.
maxf commented 2019-12-10 20:50:14 +00:00
Member
Copy link

Don't merge it yet, it's not working locally for me

Don't merge it yet, it's not working locally for me
maxf commented 2019-12-10 20:51:02 +00:00
Member
Copy link
[error] #PID<0.869.0> running Pleroma.Web.Endpoint (connection #PID<0.862.0>, stream id 4) terminated
Server: localhost:4000 (http)
Request: GET /api/pleroma/admin/users?page=1&filters=
** (exit) an exception was raised:
    ** (FunctionClauseError) no function clause matching in String.starts_with?/2
        (elixir) lib/string.ex:1992: String.starts_with?(["read:accounts"], "read:")
        (elixir) lib/enum.ex:2948: Enum.find_list/3
        (elixir) lib/enum.ex:2934: Enum.filter_list/2
        (elixir) lib/enum.ex:2935: Enum.filter_list/2
        (pleroma) lib/pleroma/plugs/oauth_scopes_plug.ex:27: Pleroma.Plugs.OAuthScopesPlug.call/2
        (pleroma) lib/pleroma/web/admin_api/admin_api_controller.ex:5: Pleroma.Web.AdminAPI.AdminAPIController.phoenix_controller_pipeline/2
        (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.instrument/4
        (phoenix) lib/phoenix/router.ex:288: Phoenix.Router.__call__/2
        (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.plug_builder_call/2
        (pleroma) lib/plug/debugger.ex:122: Pleroma.Web.Endpoint."call (overridable 3)"/2
        (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.call/2
        (phoenix) lib/phoenix/endpoint/cowboy2_handler.ex:42: Phoenix.Endpoint.Cowboy2Handler.init/4
        (cowboy) /Users/max/Code/Pleroma/pleroma/deps/cowboy/src/cowboy_handler.erl:41: :cowboy_handler.execute/2
        (cowboy) /Users/max/Code/Pleroma/pleroma/deps/cowboy/src/cowboy_stream_h.erl:320: :cowboy_stream_h.execute/3
        (cowboy) /Users/max/Code/Pleroma/pleroma/deps/cowboy/src/cowboy_stream_h.erl:302: :cowboy_stream_h.request_process/3
        (stdlib) proc_lib.erl:249: :proc_lib.init_p_do_apply/3
``` [error] #PID<0.869.0> running Pleroma.Web.Endpoint (connection #PID<0.862.0>, stream id 4) terminated Server: localhost:4000 (http) Request: GET /api/pleroma/admin/users?page=1&filters= ** (exit) an exception was raised: ** (FunctionClauseError) no function clause matching in String.starts_with?/2 (elixir) lib/string.ex:1992: String.starts_with?(["read:accounts"], "read:") (elixir) lib/enum.ex:2948: Enum.find_list/3 (elixir) lib/enum.ex:2934: Enum.filter_list/2 (elixir) lib/enum.ex:2935: Enum.filter_list/2 (pleroma) lib/pleroma/plugs/oauth_scopes_plug.ex:27: Pleroma.Plugs.OAuthScopesPlug.call/2 (pleroma) lib/pleroma/web/admin_api/admin_api_controller.ex:5: Pleroma.Web.AdminAPI.AdminAPIController.phoenix_controller_pipeline/2 (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.instrument/4 (phoenix) lib/phoenix/router.ex:288: Phoenix.Router.__call__/2 (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.plug_builder_call/2 (pleroma) lib/plug/debugger.ex:122: Pleroma.Web.Endpoint."call (overridable 3)"/2 (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.call/2 (phoenix) lib/phoenix/endpoint/cowboy2_handler.ex:42: Phoenix.Endpoint.Cowboy2Handler.init/4 (cowboy) /Users/max/Code/Pleroma/pleroma/deps/cowboy/src/cowboy_handler.erl:41: :cowboy_handler.execute/2 (cowboy) /Users/max/Code/Pleroma/pleroma/deps/cowboy/src/cowboy_stream_h.erl:320: :cowboy_stream_h.execute/3 (cowboy) /Users/max/Code/Pleroma/pleroma/deps/cowboy/src/cowboy_stream_h.erl:302: :cowboy_stream_h.request_process/3 (stdlib) proc_lib.erl:249: :proc_lib.init_p_do_apply/3 ```
i1t commented 2019-12-11 08:58:28 +00:00
Author
Member
Copy link

@maxf, thanks for spotting this, the issue was caused by last-moment refactoring in BE MR, argh. Fixed in pleroma/pleroma#5431 (merged). Pl. retry with the latest develop branch (older, pre-pleroma/pleroma#5403 ones, will also work fine).

@maxf, thanks for spotting this, the issue was caused by last-moment refactoring in BE MR, argh. Fixed in https://git.pleroma.social/pleroma/pleroma/pulls/5431 (merged). Pl. retry with the latest develop branch (older, pre-https://git.pleroma.social/pleroma/pleroma/pulls/5403 ones, will also work fine).
maxf commented 2019-12-11 09:03:03 +00:00
Member
Copy link

Yep, everything works now

Yep, everything works now
i1t commented 2019-12-12 09:54:35 +00:00
Author
Member
Copy link

BE would currently reject any admin scope requested by a non-admin user. So, for moderation features, we should eiher:

  • provide non-admin endpoints to access them and do extra checks in them (doesn't sound like the best option)

  • provide a narrow moderation-specific admin scope (e.g. admin:moderation) and allow BE to grant those to non-admin users (confusing, seem wrong)

  • make BE gracefully drop admin scopes for non-admin users (without raising an error on unsupported scopes being requested) — seems the best approach to me.

Your thoughts?

BE would currently reject any admin scope requested by a non-admin user. So, for moderation features, we should eiher: * provide non-admin endpoints to access them and do extra checks in them (doesn't sound like the best option) * provide a narrow moderation-specific admin scope (e.g. `admin:moderation`) and allow BE to grant those to non-admin users (confusing, seem wrong) * make BE gracefully drop admin scopes for non-admin users (without raising an error on unsupported scopes being requested) — seems the best approach to me. Your thoughts?
i1t commented 2019-12-12 10:33:30 +00:00
Author
Member
Copy link

@rinpatch What are the endpoints which moderation features use? We can consider using moderate scope for them (and always request it just like admin but silently reject such scopes on BE side if user is not moderator / is not admin).

@rinpatch What are the endpoints which moderation features use? We can consider using `moderate` scope for them (and always request it just like `admin` but silently reject such scopes on BE side if user is not moderator / is not admin).
rinpatch commented 2019-12-12 11:24:05 +00:00
Member
Copy link

@i1t

make BE gracefully drop admin scopes for non-admin users (without raising an error on unsupported scopes being requested) — seems the best approach to me.

Yes, this is what I think we should do as well

What are the endpoints which moderation features use? We can consider using moderate scope for them (and always request it just like admin but silently reject such scopes on BE side if user is not moderator / is not admin).

Let's discuss moving moderation features under moderation scope in a separate issue

@i1t > make BE gracefully drop admin scopes for non-admin users (without raising an error on unsupported scopes being requested) — seems the best approach to me. Yes, this is what I think we should do as well > What are the endpoints which moderation features use? We can consider using `moderate` scope for them (and always request it just like `admin` but silently reject such scopes on BE side if user is not moderator / is not admin). Let's discuss moving moderation features under moderation scope in a separate issue

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
blocked

   
stale
No labels
blocked
stale
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/admin-fe!301
No description provided.