2020-07-16 14:51:24 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
|
|
|
class ApiKeyScope < ActiveRecord::Base
|
|
|
|
validates_presence_of :resource
|
|
|
|
validates_presence_of :action
|
|
|
|
|
|
|
|
class << self
|
|
|
|
def list_actions
|
2020-08-18 14:12:04 -04:00
|
|
|
actions = %w[list#category_feed]
|
2020-07-16 14:51:24 -04:00
|
|
|
|
|
|
|
%i[latest unread new top].each { |f| actions.concat(["list#category_#{f}", "list##{f}"]) }
|
|
|
|
|
|
|
|
actions
|
|
|
|
end
|
|
|
|
|
|
|
|
def default_mappings
|
2020-08-24 11:15:08 -04:00
|
|
|
return @default_mappings unless @default_mappings.nil?
|
2020-08-18 14:12:04 -04:00
|
|
|
|
2020-08-24 11:15:08 -04:00
|
|
|
mappings = {
|
2021-11-10 10:48:00 -05:00
|
|
|
global: {
|
|
|
|
read: { methods: %i[get] }
|
|
|
|
},
|
2020-07-16 14:51:24 -04:00
|
|
|
topics: {
|
2020-08-24 11:15:08 -04:00
|
|
|
write: { actions: %w[posts#create], params: %i[topic_id] },
|
2022-03-04 12:44:56 -05:00
|
|
|
update: { actions: %w[topics#update], params: %i[topic_id] },
|
2020-08-18 14:12:04 -04:00
|
|
|
read: {
|
2020-08-24 11:15:08 -04:00
|
|
|
actions: %w[topics#show topics#feed topics#posts],
|
|
|
|
params: %i[topic_id], aliases: { topic_id: :id }
|
2020-08-18 14:12:04 -04:00
|
|
|
},
|
|
|
|
read_lists: {
|
|
|
|
actions: list_actions, params: %i[category_id],
|
2020-08-24 11:15:08 -04:00
|
|
|
aliases: { category_id: :category_slug_path_with_id }
|
|
|
|
},
|
|
|
|
wordpress: { actions: %w[topics#wordpress], params: %i[topic_id] }
|
|
|
|
},
|
2021-06-18 11:53:10 -04:00
|
|
|
posts: {
|
|
|
|
edit: { actions: %w[posts#update], params: %i[id] }
|
|
|
|
},
|
2022-03-04 16:29:47 -05:00
|
|
|
categories: {
|
|
|
|
list: { actions: %w[categories#index] },
|
|
|
|
show: { actions: %w[categories#show], params: %i[id] }
|
|
|
|
},
|
2021-11-22 12:49:08 -05:00
|
|
|
uploads: {
|
2021-12-14 23:08:11 -05:00
|
|
|
create: {
|
|
|
|
actions: %w[
|
|
|
|
uploads#create
|
|
|
|
uploads#generate_presigned_put
|
|
|
|
uploads#complete_external_upload
|
|
|
|
uploads#create_multipart
|
|
|
|
uploads#batch_presign_multipart_parts
|
|
|
|
uploads#abort_multipart
|
|
|
|
uploads#complete_multipart
|
|
|
|
]
|
|
|
|
}
|
2021-11-22 12:49:08 -05:00
|
|
|
},
|
2020-08-24 11:15:08 -04:00
|
|
|
users: {
|
|
|
|
bookmarks: { actions: %w[users#bookmarks], params: %i[username] },
|
|
|
|
sync_sso: { actions: %w[admin/users#sync_sso], params: %i[sso sig] },
|
2021-02-17 12:42:44 -05:00
|
|
|
show: { actions: %w[users#show], params: %i[username external_id external_provider] },
|
2020-11-24 07:54:24 -05:00
|
|
|
check_emails: { actions: %w[users#check_emails], params: %i[username] },
|
|
|
|
update: { actions: %w[users#update], params: %i[username] },
|
2020-11-26 05:39:38 -05:00
|
|
|
log_out: { actions: %w[admin/users#log_out] },
|
2020-11-24 07:54:24 -05:00
|
|
|
anonymize: { actions: %w[admin/users#anonymize] },
|
|
|
|
delete: { actions: %w[admin/users#destroy] },
|
2021-07-15 23:10:04 -04:00
|
|
|
list: { actions: %w[admin/users#index] },
|
2020-11-16 12:14:12 -05:00
|
|
|
},
|
|
|
|
email: {
|
|
|
|
receive_emails: { actions: %w[admin/email#handle_mail] }
|
2021-12-05 21:27:25 -05:00
|
|
|
},
|
|
|
|
badges: {
|
|
|
|
create: { actions: %w[admin/badges#create] },
|
|
|
|
show: { actions: %w[badges#show] },
|
|
|
|
update: { actions: %w[admin/badges#update] },
|
|
|
|
delete: { actions: %w[admin/badges#destroy] },
|
|
|
|
list_user_badges: { actions: %w[user_badges#username], params: %i[username] },
|
|
|
|
assign_badge_to_user: { actions: %w[user_badges#create], params: %i[username] },
|
|
|
|
revoke_badge_from_user: { actions: %w[user_badges#destroy] },
|
2020-07-16 14:51:24 -04:00
|
|
|
}
|
|
|
|
}
|
2020-08-24 11:15:08 -04:00
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
parse_resources!(mappings)
|
2020-08-24 11:15:08 -04:00
|
|
|
@default_mappings = mappings
|
2020-07-16 14:51:24 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def scope_mappings
|
|
|
|
plugin_mappings = DiscoursePluginRegistry.api_key_scope_mappings
|
2021-02-22 18:10:53 -05:00
|
|
|
return default_mappings if plugin_mappings.empty?
|
2020-07-16 14:51:24 -04:00
|
|
|
|
2021-02-22 18:10:53 -05:00
|
|
|
default_mappings.deep_dup.tap do |mappings|
|
2021-11-10 10:48:00 -05:00
|
|
|
plugin_mappings.each do |plugin_mapping|
|
|
|
|
parse_resources!(plugin_mapping)
|
|
|
|
mappings.deep_merge!(plugin_mapping)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2020-08-18 14:12:04 -04:00
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
def parse_resources!(mappings)
|
|
|
|
mappings.each_value do |resource_actions|
|
|
|
|
resource_actions.each_value do |action_data|
|
|
|
|
action_data[:urls] = find_urls(actions: action_data[:actions], methods: action_data[:methods])
|
2020-07-16 14:51:24 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2020-08-18 14:12:04 -04:00
|
|
|
|
2021-11-10 10:48:00 -05:00
|
|
|
def find_urls(actions:, methods:)
|
2022-04-06 16:16:06 -04:00
|
|
|
urls = Set.new
|
2021-11-10 10:48:00 -05:00
|
|
|
|
|
|
|
if actions.present?
|
2022-03-10 14:01:22 -05:00
|
|
|
route_sets = [Rails.application.routes]
|
2022-01-20 14:29:03 -05:00
|
|
|
Rails::Engine.descendants.each do |engine|
|
|
|
|
next if engine == Rails::Application # abstract engine, can't call routes on it
|
|
|
|
next if engine == Discourse::Application # equiv. to Rails.application
|
2022-03-10 14:01:22 -05:00
|
|
|
route_sets << engine.routes
|
2022-01-20 14:29:03 -05:00
|
|
|
end
|
|
|
|
|
2022-03-10 14:01:22 -05:00
|
|
|
route_sets.each do |set|
|
|
|
|
engine_mount_path = set.find_script_name({}).presence
|
|
|
|
engine_mount_path = nil if engine_mount_path == "/"
|
|
|
|
set.routes.each do |route|
|
|
|
|
defaults = route.defaults
|
|
|
|
action = "#{defaults[:controller].to_s}##{defaults[:action]}"
|
|
|
|
path = route.path.spec.to_s.gsub(/\(\.:format\)/, '')
|
2022-04-06 16:15:06 -04:00
|
|
|
api_supported_path = (
|
|
|
|
path.end_with?('.rss') ||
|
|
|
|
!route.path.requirements[:format] ||
|
|
|
|
route.path.requirements[:format].match?('json')
|
|
|
|
)
|
2022-03-10 14:01:22 -05:00
|
|
|
excluded_paths = %w[/new-topic /new-message /exception]
|
|
|
|
|
|
|
|
if actions.include?(action) && api_supported_path && !excluded_paths.include?(path)
|
|
|
|
urls << "#{engine_mount_path}#{path} (#{route.verb})"
|
|
|
|
end
|
2021-06-18 11:53:10 -04:00
|
|
|
end
|
2020-08-18 14:12:04 -04:00
|
|
|
end
|
|
|
|
end
|
2021-11-10 10:48:00 -05:00
|
|
|
|
|
|
|
if methods.present?
|
|
|
|
methods.each do |method|
|
2021-12-05 21:51:47 -05:00
|
|
|
urls << "* (#{method})"
|
2021-11-10 10:48:00 -05:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2022-04-06 16:16:06 -04:00
|
|
|
urls.to_a
|
2020-08-18 14:12:04 -04:00
|
|
|
end
|
2020-07-16 14:51:24 -04:00
|
|
|
end
|
|
|
|
|
2020-10-06 12:20:15 -04:00
|
|
|
def permits?(env)
|
|
|
|
RouteMatcher.new(**mapping.except(:urls), allowed_param_values: allowed_parameters).match?(env: env)
|
2020-07-16 14:51:24 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
private
|
|
|
|
|
|
|
|
def mapping
|
|
|
|
@mapping ||= self.class.scope_mappings.dig(resource.to_sym, action.to_sym)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
# == Schema Information
|
|
|
|
#
|
|
|
|
# Table name: api_key_scopes
|
|
|
|
#
|
|
|
|
# id :bigint not null, primary key
|
|
|
|
# api_key_id :integer not null
|
|
|
|
# resource :string not null
|
|
|
|
# action :string not null
|
|
|
|
# allowed_parameters :json
|
|
|
|
# created_at :datetime not null
|
|
|
|
# updated_at :datetime not null
|
|
|
|
#
|
|
|
|
# Indexes
|
|
|
|
#
|
|
|
|
# index_api_key_scopes_on_api_key_id (api_key_id)
|
|
|
|
#
|