docs/API.md

@@ -1,3 +1,36 @@
+# API documentation
+
+## Getting an API token
+
+To get access to the API, you should register your app and obtain a
+token. To do so, use the `/api/v1/apps` API (accessible without a token) to create
+a new app. Store the result somewhere for future use.
+
+Then send a request to `/api/v1/oauth2`, with the following GET parameters:
+
+- `client_id`, your client ID.
+- `client_secret`, your client secret.
+- `scopes`, the scopes you want to access. They are separated by `+`, and can either
+be `read` (global read), `write` (global write), `read:SCOPE` (read only in `SCOPE`),
+or `write:SCOPE` (write only in `SCOPE`).
+- `username` the username (not the email, display name nor the fully qualified name) of the
+user using your app.
+- `password`, the password of the user.
+
+Plume will respond with something similar to:
+
+```json
+{
+  "token": "<YOUR TOKEN HERE>"
+}
+```
+
+To authenticate your requests you should put this token in the `Authorization` header:
+
+```
+Authorization: Bearer <YOUR TOKEN HERE>
+```
+
 <script src="//unpkg.com/swagger-ui-dist@3/swagger-ui-bundle.js"></script>
 
 <div id="api"></div>

docs/api.yaml

@@ -10,6 +10,10 @@ servers:
     description: Demo instance
 
 paths:
+  /apps:
+    post:
+      description:
+        Registers an application.
   /posts/{id}:
     get:
       description:
@@ -27,6 +31,21 @@ paths:
         List posts.
 
 definitions:
+  App:
+    type: "object"
+    properties:
+      name:
+        type: "string"
+        example: "My app"
+      website:
+        type: "string"
+        example: "https://my.app"
+      client_id:
+        type: "string"
+        example: "My app"
+      client_secret:
+        type: "string"
+        example: "My app"
   Post:
     type: "object"
     properties:

migrations/postgres/2018-10-19-165407_create_apps/down.sql

@@ -0,0 +1,2 @@
+-- This file should undo anything in `up.sql`
+DROP TABLE apps;

migrations/postgres/2018-10-19-165407_create_apps/up.sql

@@ -0,0 +1,10 @@
+-- Your SQL goes here
+CREATE TABLE apps (
+    id SERIAL PRIMARY KEY,
+    name TEXT NOT NULL DEFAULT '',
+    client_id TEXT NOT NULL,
+    client_secret TEXT NOT NULL,
+    redirect_uri TEXT,
+    website TEXT,
+    creation_date TIMESTAMP NOT NULL DEFAULT now()
+);

migrations/postgres/2018-10-21-163227_create_api_token/down.sql

@@ -0,0 +1,2 @@
+-- This file should undo anything in `up.sql`
+DROP TABLE api_tokens;

migrations/postgres/2018-10-21-163227_create_api_token/up.sql

@@ -0,0 +1,9 @@
+-- Your SQL goes here
+CREATE TABLE api_tokens (
+    id SERIAL PRIMARY KEY,
+    creation_date TIMESTAMP NOT NULL DEFAULT now(),
+    value TEXT NOT NULL,
+    scopes TEXT NOT NULL,
+    app_id INTEGER NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE
+)

migrations/sqlite/2018-10-19-165450_create_apps/down.sql

@@ -0,0 +1,2 @@
+-- This file should undo anything in `up.sql`
+DROP TABLE apps;

migrations/sqlite/2018-10-19-165450_create_apps/up.sql

@@ -0,0 +1,10 @@
+-- Your SQL goes here
+CREATE TABLE apps (
+    id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL DEFAULT '',
+    client_id TEXT NOT NULL,
+    client_secret TEXT NOT NULL,
+    redirect_uri TEXT,
+    website TEXT,
+    creation_date DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+);

migrations/sqlite/2018-10-21-163241_create_api_token/down.sql

@@ -0,0 +1,2 @@
+-- This file should undo anything in `up.sql`
+DROP TABLE api_tokens;

migrations/sqlite/2018-10-21-163241_create_api_token/up.sql

@@ -0,0 +1,9 @@
+-- Your SQL goes here
+CREATE TABLE api_tokens (
+    id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    creation_date DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    value TEXT NOT NULL,
+    scopes TEXT NOT NULL,
+    app_id INTEGER NOT NULL REFERENCES apps(id) ON DELETE CASCADE,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE
+)

plume-api/src/apps.rs

@@ -0,0 +1,13 @@
+use canapi::Endpoint;
+
+#[derive(Clone, Default, Serialize, Deserialize)]
+pub struct AppEndpoint {
+    pub id: Option<i32>,
+    pub name: String,
+    pub website: Option<String>,
+    pub redirect_uri: Option<String>,
+    pub client_id: Option<String>,
+    pub client_secret: Option<String>,
+}
+
+api!("/api/v1/apps" => AppEndpoint);

plume-api/src/lib.rs

@@ -15,4 +15,5 @@ macro_rules! api {
     };
 }
 
+pub mod apps;
 pub mod posts;

plume-common/src/utils.rs

@@ -1,11 +1,19 @@
 use gettextrs::gettext;
 use heck::CamelCase;
+use openssl::rand::rand_bytes;
 use pulldown_cmark::{Event, Parser, Options, Tag, html};
 use rocket::{
     http::uri::Uri,
     response::{Redirect, Flash}
 };
 
+/// Generates an hexadecimal representation of 32 bytes of random data
+pub fn random_hex() -> String {
+	let mut bytes = [0; 32];
+    rand_bytes(&mut bytes).expect("Error while generating client id");
+    bytes.into_iter().fold(String::new(), |res, byte| format!("{}{:x}", res, byte))
+}
+
 /// Remove non alphanumeric characters and CamelCase a string
 pub fn make_actor_id(name: String) -> String {
     name.as_str()

plume-models/src/api_tokens.rs

@@ -0,0 +1,88 @@
+use chrono::NaiveDateTime;
+use diesel::{self, ExpressionMethods, QueryDsl, RunQueryDsl};
+use rocket::{
+    Outcome,
+    http::Status,
+    request::{self, FromRequest, Request}
+};
+
+use db_conn::DbConn;
+use schema::api_tokens;
+
+#[derive(Clone, Queryable)]
+pub struct ApiToken {
+    pub id: i32,
+    pub creation_date: NaiveDateTime,
+    pub value: String,
+
+    /// Scopes, separated by +
+    /// Global scopes are read and write
+    /// and both can be limited to an endpoint by affixing them with :ENDPOINT
+    ///
+    /// Examples :
+    ///
+    /// read
+    /// read+write
+    /// read:posts
+    /// read:posts+write:posts
+    pub scopes: String,
+    pub app_id: i32,
+    pub user_id: i32,
+}
+
+#[derive(Insertable)]
+#[table_name = "api_tokens"]
+pub struct NewApiToken {
+    pub value: String,
+    pub scopes: String,
+    pub app_id: i32,
+    pub user_id: i32,
+}
+
+impl ApiToken {
+    get!(api_tokens);
+    insert!(api_tokens, NewApiToken);
+    find_by!(api_tokens, find_by_value, value as String);
+
+    pub fn can(&self, what: &'static str, scope: &'static str) -> bool {
+        let full_scope = what.to_owned() + ":" + scope;
+        for s in self.scopes.split('+') {
+            if s == what || s == full_scope {
+                return true
+            }
+        }
+        false
+    }
+
+    pub fn can_read(&self, scope: &'static str) -> bool {
+        self.can("read", scope)
+    }
+
+    pub fn can_write(&self, scope: &'static str) -> bool {
+        self.can("write", scope)
+    }
+}
+
+impl<'a, 'r> FromRequest<'a, 'r> for ApiToken {
+    type Error = ();
+
+    fn from_request(request: &'a Request<'r>) -> request::Outcome<ApiToken, ()> {
+        let headers: Vec<_> = request.headers().get("Authorization").collect();
+        if headers.len() != 1 {
+            return Outcome::Failure((Status::BadRequest, ()));
+        }
+
+        let mut parsed_header = headers[0].split(' ');
+        let auth_type = parsed_header.next().expect("Expect a token type");
+        let val = parsed_header.next().expect("Expect a token value");
+
+        if auth_type == "Bearer" {
+            let conn = request.guard::<DbConn>().expect("Couldn't connect to DB");
+            if let Some(token) = ApiToken::find_by_value(&*conn, val.to_string()) {
+                return Outcome::Success(token);
+            }
+        }
+
+        return Outcome::Forward(());
+    }
+}

plume-models/src/apps.rs

@@ -0,0 +1,77 @@
+use canapi::{Error, Provider};
+use chrono::NaiveDateTime;
+use diesel::{self, RunQueryDsl, QueryDsl, ExpressionMethods};
+
+use plume_api::apps::AppEndpoint;
+use plume_common::utils::random_hex;
+use Connection;
+use schema::apps;
+
+#[derive(Clone, Queryable)]
+pub struct App {
+    pub id: i32,
+    pub name: String,
+    pub client_id: String,
+    pub client_secret: String,
+    pub redirect_uri: Option<String>,
+    pub website: Option<String>,
+    pub creation_date: NaiveDateTime,
+}
+
+#[derive(Insertable)]
+#[table_name= "apps"]
+pub struct NewApp {
+    pub name: String,
+    pub client_id: String,
+    pub client_secret: String,
+    pub redirect_uri: Option<String>,
+    pub website: Option<String>,
+}
+
+impl Provider<Connection> for App {
+    type Data = AppEndpoint;
+
+    fn get(_conn: &Connection, _id: i32) -> Result<AppEndpoint, Error> {
+        unimplemented!()
+    }
+
+    fn list(_conn: &Connection, _query: AppEndpoint) -> Vec<AppEndpoint> {
+        unimplemented!()
+    }
+
+    fn create(conn: &Connection, data: AppEndpoint) -> Result<AppEndpoint, Error> {
+        let client_id = random_hex();
+
+        let client_secret = random_hex();
+        let app = App::insert(conn, NewApp {
+            name: data.name,
+            client_id: client_id,
+            client_secret: client_secret,
+            redirect_uri: data.redirect_uri,
+            website: data.website,
+        });
+
+        Ok(AppEndpoint {
+            id: Some(app.id),
+            name: app.name,
+            client_id: Some(app.client_id),
+            client_secret: Some(app.client_secret),
+            redirect_uri: app.redirect_uri,
+            website: app.website,
+        })
+    }
+
+    fn update(_conn: &Connection, _id: i32, _new_data: AppEndpoint) -> Result<AppEndpoint, Error> {
+        unimplemented!()
+    }
+
+    fn delete(_conn: &Connection, _id: i32) {
+        unimplemented!()
+    }
+}
+
+impl App {
+    get!(apps);
+    insert!(apps, NewApp);
+    find_by!(apps, find_by_client_id, client_id as String);
+}

plume-models/src/lib.rs

@@ -214,6 +214,8 @@ pub fn ap_url(url: String) -> String {
 }
 
 pub mod admin;
+pub mod api_tokens;
+pub mod apps;
 pub mod blog_authors;
 pub mod blogs;
 pub mod comments;

plume-models/src/posts.rs

@@ -57,19 +57,27 @@ pub struct NewPost {
     pub source: String,
 }
 
-impl Provider<Connection> for Post {
+impl<'a> Provider<(&'a Connection, Option<i32>)> for Post {
     type Data = PostEndpoint;
 
-    fn get(conn: &Connection, id: i32) -> Result<PostEndpoint, Error> {
-        Post::get(conn, id).map(|p| Ok(PostEndpoint {
-            id: Some(p.id),
-            title: Some(p.title.clone()),
-            subtitle: Some(p.subtitle.clone()),
-            content: Some(p.content.get().clone())
-        })).unwrap_or(Err(Error::NotFound("Get Post".to_string())))
+    fn get((conn, user_id): &(&'a Connection, Option<i32>), id: i32) -> Result<PostEndpoint, Error> {
+        if let Some(post) = Post::get(conn, id) {
+            if !post.published && !user_id.map(|u| post.is_author(conn, u)).unwrap_or(false) {
+                return Err(Error::Authorization("You are not authorized to access this post yet.".to_string()))
+            }
+
+            Ok(PostEndpoint {
+                id: Some(post.id),
+                title: Some(post.title.clone()),
+                subtitle: Some(post.subtitle.clone()),
+                content: Some(post.content.get().clone())
+            })
+        } else {
+            Err(Error::NotFound("Request post was not found".to_string()))
+        }
     }
 
-    fn list(conn: &Connection, filter: PostEndpoint) -> Vec<PostEndpoint> {
+    fn list((conn, user_id): &(&'a Connection, Option<i32>), filter: PostEndpoint) -> Vec<PostEndpoint> {
         let mut query = posts::table.into_boxed();
         if let Some(title) = filter.title {
             query = query.filter(posts::title.eq(title));
@@ -81,7 +89,8 @@ impl Provider<Connection> for Post {
             query = query.filter(posts::content.eq(content));
         }
 
-        query.get_results::<Post>(conn).map(|ps| ps.into_iter()
+        query.get_results::<Post>(*conn).map(|ps| ps.into_iter()
+            .filter(|p| p.published || user_id.map(|u| p.is_author(conn, u)).unwrap_or(false))
             .map(|p| PostEndpoint {
                 id: Some(p.id),
                 title: Some(p.title.clone()),
@@ -92,16 +101,21 @@ impl Provider<Connection> for Post {
         ).unwrap_or(vec![])
     }
 
-    fn create(_conn: &Connection, _query: PostEndpoint) -> Result<PostEndpoint, Error> {
+    fn create((_conn, _user_id): &(&'a Connection, Option<i32>), _query: PostEndpoint) -> Result<PostEndpoint, Error> {
         unimplemented!()
     }
 
-    fn update(_conn: &Connection, _id: i32, _new_data: PostEndpoint) -> Result<PostEndpoint, Error> {
+    fn update((_conn, _user_id): &(&'a Connection, Option<i32>), _id: i32, _new_data: PostEndpoint) -> Result<PostEndpoint, Error> {
         unimplemented!()
     }
 
-    fn delete(conn: &Connection, id: i32) {
-        Post::get(conn, id).map(|p| p.delete(conn));
+    fn delete((conn, user_id): &(&'a Connection, Option<i32>), id: i32) {
+        let user_id = user_id.expect("Post as Provider::delete: not authenticated");
+        if let Some(post) = Post::get(conn, id) {
+            if post.is_author(conn, user_id) {
+                post.delete(conn);
+            }
+        }
     }
 }
 
@@ -260,6 +274,15 @@ impl Post {
         users::table.filter(users::id.eq_any(author_list)).load::<User>(conn).expect("Post::get_authors: loading error")
     }
 
+    pub fn is_author(&self, conn: &Connection, author_id: i32) -> bool {
+        use schema::post_authors;
+        PostAuthor::belonging_to(self)
+            .filter(post_authors::author_id.eq(author_id))
+            .count()
+            .get_result::<i64>(conn)
+            .expect("Post::is_author: loading error") > 0
+    }
+
     pub fn get_blog(&self, conn: &Connection) -> Blog {
         use schema::blogs;
         blogs::table.filter(blogs::id.eq(self.blog_id))

plume-models/src/schema.rs

@@ -1,3 +1,26 @@
+table! {
+    api_tokens (id) {
+        id -> Int4,
+        creation_date -> Timestamp,
+        value -> Text,
+        scopes -> Text,
+        app_id -> Int4,
+        user_id -> Int4,
+    }
+}
+
+table! {
+    apps (id) {
+        id -> Int4,
+        name -> Text,
+        client_id -> Text,
+        client_secret -> Text,
+        redirect_uri -> Nullable<Text>,
+        website -> Nullable<Text>,
+        creation_date -> Timestamp,
+    }
+}
+
 table! {
     blog_authors (id) {
         id -> Int4,
@@ -172,6 +195,8 @@ table! {
     }
 }
 
+joinable!(api_tokens -> apps (app_id));
+joinable!(api_tokens -> users (user_id));
 joinable!(blog_authors -> blogs (blog_id));
 joinable!(blog_authors -> users (author_id));
 joinable!(blogs -> instances (instance_id));
@@ -192,6 +217,8 @@ joinable!(tags -> posts (post_id));
 joinable!(users -> instances (instance_id));
 
 allow_tables_to_appear_in_same_query!(
+    api_tokens,
+    apps,
     blog_authors,
     blogs,
     comments,

src/api/apps.rs

@@ -0,0 +1,16 @@
+use canapi::Provider;
+use rocket_contrib::Json;
+use serde_json;
+
+use plume_api::apps::AppEndpoint;
+use plume_models::{
+    Connection,
+    db_conn::DbConn,
+    apps::App,
+};
+
+#[post("/apps", data = "<data>")]
+fn create(conn: DbConn, data: Json<AppEndpoint>) -> Json<serde_json::Value> {
+    let post = <App as Provider<Connection>>::create(&*conn, (*data).clone()).ok();
+    Json(json!(post))
+}

src/api/authorization.rs

@@ -0,0 +1,54 @@
+use rocket::{
+    Outcome,
+    http::Status,
+    request::{self, FromRequest, Request}
+};
+use std::marker::PhantomData;
+use plume_models::{self, api_tokens::ApiToken};
+
+// Actions
+pub trait Action {
+    fn to_str() -> &'static str;
+}
+pub struct Read;
+impl Action for Read {
+    fn to_str() -> &'static str {
+        "read"
+    }
+}
+pub struct Write;
+impl Action for Write {
+    fn to_str() -> &'static str {
+        "write"
+    }
+}
+
+// Scopes
+pub trait Scope {
+    fn to_str() -> &'static str;
+}
+impl Scope for plume_models::posts::Post {
+    fn to_str() -> &'static str {
+        "posts"
+    }
+}
+
+pub struct Authorization<A, S> (pub ApiToken, PhantomData<(A, S)>);
+
+impl<'a, 'r, A, S> FromRequest<'a, 'r> for Authorization<A, S>
+where A: Action,
+      S: Scope
+{
+    type Error = ();
+
+    fn from_request(request: &'a Request<'r>) -> request::Outcome<Authorization<A, S>, ()> {
+        request.guard::<ApiToken>()
+            .map_failure(|_| (Status::Unauthorized, ()))
+            .and_then(|token| if token.can(A::to_str(), S::to_str()) {
+                Outcome::Success(Authorization(token, PhantomData))
+            } else {
+                Outcome::Failure((Status::Unauthorized, ()))
+            })
+    }
+}
+

src/api/mod.rs

@@ -1 +1,59 @@
+use rocket_contrib::Json;
+use serde_json;
+
+use plume_common::utils::random_hex;
+use plume_models::{
+    apps::App,
+    api_tokens::*,
+    db_conn::DbConn,
+    users::User,
+};
+
+#[derive(FromForm)]
+struct OAuthRequest {
+    client_id: String,
+    client_secret: String,
+    password: String,
+    username: String,
+    scopes: String,
+}
+
+#[get("/oauth2?<query>")]
+fn oauth(query: OAuthRequest, conn: DbConn) -> Json<serde_json::Value> {
+    let app = App::find_by_client_id(&*conn, query.client_id).expect("OAuth request from unknown client");
+    if app.client_secret == query.client_secret {
+        if let Some(user) = User::find_local(&*conn, query.username) {
+            if user.auth(query.password) {
+                let token = ApiToken::insert(&*conn, NewApiToken {
+                    app_id: app.id,
+                    user_id: user.id,
+                    value: random_hex(),
+                    scopes: query.scopes,
+                });
+                Json(json!({
+                    "token": token.value
+                }))
+            } else {
+                Json(json!({
+                    "error": "Invalid credentials"
+                }))
+            }
+        } else {
+            // Making fake password verification to avoid different
+            // response times that would make it possible to know
+            // if a username is registered or not.
+            User::get(&*conn, 1).unwrap().auth(query.password);
+            Json(json!({
+                "error": "Invalid credentials"
+            }))
+        }
+    } else {
+        Json(json!({
+            "error": "Invalid client_secret"
+        }))
+    }
+}
+
+pub mod apps;
+pub mod authorization;
 pub mod posts;

src/api/posts.rs

@@ -10,16 +10,17 @@ use plume_models::{
     db_conn::DbConn,
     posts::Post,
 };
+use api::authorization::*;
 
 #[get("/posts/<id>")]
-fn get(id: i32, conn: DbConn) -> Json<serde_json::Value> {
-    let post = <Post as Provider<Connection>>::get(&*conn, id).ok();
+fn get(id: i32, conn: DbConn, auth: Option<Authorization<Read, Post>>) -> Json<serde_json::Value> {
+    let post = <Post as Provider<(&Connection, Option<i32>)>>::get(&(&*conn, auth.map(|a| a.0.user_id)), id).ok();
     Json(json!(post))
 }
 
 #[get("/posts")]
-fn list(conn: DbConn, uri: &Origin) -> Json<serde_json::Value> {
+fn list(conn: DbConn, uri: &Origin, auth: Option<Authorization<Read, Post>>) -> Json<serde_json::Value> {
     let query: PostEndpoint = serde_qs::from_str(uri.query().unwrap_or("")).expect("api::list: invalid query error");
-    let post = <Post as Provider<Connection>>::list(&*conn, query);
+    let post = <Post as Provider<(&Connection, Option<i32>)>>::list(&(&*conn, auth.map(|a| a.0.user_id)), query);
     Json(json!(post))
 }

src/main.rs

@@ -156,6 +156,10 @@ fn main() {
             routes::errors::csrf_violation
         ])
         .mount("/api/v1", routes![
+            api::oauth,
+
+            api::apps::create,
+
             api::posts::get,
             api::posts::list,
         ])
@@ -176,6 +180,7 @@ fn main() {
                     ("/@/<name>/inbox".to_owned(), "/@/<name>/inbox".to_owned(), rocket::http::Method::Post),
                     ("/login".to_owned(), "/login".to_owned(), rocket::http::Method::Post),
                     ("/users/new".to_owned(), "/users/new".to_owned(), rocket::http::Method::Post),
+                    ("/api/<path..>".to_owned(), "/api/<path..>".to_owned(), rocket::http::Method::Post)
                 ])
                 .finalize().expect("main: csrf fairing creation error"))
         .launch();