42 lines
2.9 KiB
Bash
42 lines
2.9 KiB
Bash
 
|
#!/usr/bin/env bash
|
||
|
|
# Gets a Mastodon API token for one persona through PrivaPub's real OAuth code flow, as a client would: register an app,
|
||
|
|
# sign in with the root's password at /oauth/login, choose the persona at /oauth/authorize, read the out-of-band code and
|
||
|
|
# exchange it. Prints "<access token> <client id> <client secret>" so the caller can revoke the token afterwards.
|
||
|
|
# usage: tools/smoke/oauth.sh <base url> <root login> <root password> <persona> [scopes]
|
||
|
|
set -euo pipefail
|
||
|
|
BASE="${1:?base url}"; LOGIN="${2:?root login}"; PASSWORD="${3:?root password}"; PERSONA="${4:?persona}"; SCOPES="${5:-read}"
|
||
|
|
jar=$(mktemp -d); trap 'rm -rf "$jar"' EXIT
|
||
|
|
json() { python3 -c "import sys,json; d=json.load(sys.stdin); print($1)"; }
|
||
|
|
|
||
|
|
app=$(curl -fsS -X POST "$BASE/api/v1/apps" --data-urlencode client_name=privapub-oauth \
|
||
|
|
--data-urlencode redirect_uris=urn:ietf:wg:oauth:2.0:oob --data-urlencode "scopes=$SCOPES")
|
||
|
|
cid=$(echo "$app" | json "d['client_id']"); cs=$(echo "$app" | json "d['client_secret']")
|
||
|
|
scope_q=$(python3 -c "import sys,urllib.parse; print(urllib.parse.quote(sys.argv[1]))" "$SCOPES")
|
||
|
|
q="client_id=$cid&redirect_uri=urn:ietf:wg:oauth:2.0:oob&response_type=code&scope=$scope_q"
|
||
|
|
|
||
|
|
xt=$(curl -fsS -c "$jar/c" -b "$jar/c" "$BASE/oauth/login?returnUrl=/oauth/authorize?$q" \
|
||
|
|
| grep -o 'name="__RequestVerificationToken" type="hidden" value="[^"]*"' | sed 's/.*value="//;s/"//')
|
||
|
|
curl -sS -o /dev/null -c "$jar/c" -b "$jar/c" -X POST "$BASE/oauth/login" --data-urlencode "returnUrl=/oauth/authorize?$q" \
|
||
|
|
--data-urlencode "__RequestVerificationToken=$xt" --data-urlencode "userName=$LOGIN" --data-urlencode "password=$PASSWORD"
|
||
|
|
curl -fsS -c "$jar/c" -b "$jar/c" "$BASE/oauth/authorize?$q&signed_in=1" > "$jar/choose.html"
|
||
|
|
form=$(python3 - "$jar/choose.html" "$PERSONA" <<'PY'
|
||
|
|
import re, sys, urllib.parse, html
|
||
|
|
page = open(sys.argv[1]).read()
|
||
|
|
pairs = [(k, html.unescape(v)) for k, v in re.findall(r'<input type="hidden" name="([^"]*)" value="([^"]*)"', page)]
|
||
|
|
persona = None
|
||
|
|
for block in re.findall(r'<label[^>]*>(.*?)</label>', page, re.S):
|
||
|
|
if '@' + sys.argv[2] + '@' in block or '@' + sys.argv[2] + '<' in block or '>' + sys.argv[2] + '<' in block:
|
||
|
|
found = re.search(r'name="avatarId" value="([^"]*)"', block)
|
||
|
|
if found:
|
||
|
|
persona = found.group(1)
|
||
|
|
if persona is None:
|
||
|
|
sys.exit("persona '%s' is not offered at /oauth/authorize" % sys.argv[2])
|
||
|
|
print(urllib.parse.urlencode(pairs + [("avatarId", persona), ("decision", "allow")]))
|
||
|
|
PY
|
||
|
|
)
|
||
|
|
code=$(curl -fsS -c "$jar/c" -b "$jar/c" -X POST "$BASE/oauth/authorize" --data "$form" | grep -o '<code>[^<]*</code>' | sed 's/<[^>]*>//g')
|
||
|
|
[ -n "$code" ] || { echo "no authorization code" >&2; exit 1; }
|
||
|
|
token=$(curl -fsS -X POST "$BASE/oauth/token" --data-urlencode grant_type=authorization_code --data-urlencode "code=$code" \
|
||
|
|
--data-urlencode "client_id=$cid" --data-urlencode "client_secret=$cs" --data-urlencode redirect_uri=urn:ietf:wg:oauth:2.0:oob \
|
||
|
|
| json "d['access_token']")
|
||
|
|
echo "$token $cid $cs"
|