From 73904e8f788bb462ce1090cbd36504f6ea49c245 Mon Sep 17 00:00:00 2001
From: D Anzorge <d.anzorge@gmail.com>
Date: Fri, 1 Jun 2018 18:01:56 +0200
Subject: [PATCH] Make OAuth token endpoint work with HTTP Basic auth

client_id/client_secret can now be supplied in an Authorization header
---
 lib/pleroma/web/oauth/oauth_controller.ex | 38 +++++++++++++++++++++----------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex
index 11dc1806f..bc6c365c9 100644
--- a/lib/pleroma/web/oauth/oauth_controller.ex
+++ b/lib/pleroma/web/oauth/oauth_controller.ex
@@ -56,12 +56,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
   # TODO
   # - proper scope handling
   def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do
-    with %App{} = app <-
-           Repo.get_by(
-             App,
-             client_id: params["client_id"],
-             client_secret: params["client_secret"]
-           ),
+    with %App{} = app <- get_app_from_request(conn, params),
          fixed_token = fix_padding(params["code"]),
          %Authorization{} = auth <-
            Repo.get_by(Authorization, token: fixed_token, app_id: app.id),
@@ -86,12 +81,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do
         conn,
         %{"grant_type" => "password", "name" => name, "password" => password} = params
       ) do
-    with %App{} = app <-
-           Repo.get_by(
-             App,
-             client_id: params["client_id"],
-             client_secret: params["client_secret"]
-           ),
+    with %App{} = app <- get_app_from_request(conn, params),
          %User{} = user <- User.get_cached_by_nickname(name),
          true <- Pbkdf2.checkpw(password, user.password_hash),
          {:ok, auth} <- Authorization.create_authorization(app, user),
@@ -115,4 +105,28 @@ defmodule Pleroma.Web.OAuth.OAuthController do
     |> Base.url_decode64!(padding: false)
     |> Base.url_encode64()
   end
+
+  defp get_app_from_request(conn, params) do
+    # Per RFC 6749, HTTP Basic is preferred to body params
+    {client_id, client_secret} =
+      with ["Basic " <> encoded] <- get_req_header(conn, "authorization"),
+           {:ok, decoded} <- Base.decode64(encoded),
+           [id, secret] <-
+             String.split(decoded, ":")
+             |> Enum.map(fn s -> URI.decode_www_form(s) end) do
+        {id, secret}
+      else
+        _ -> {params["client_id"], params["client_secret"]}
+      end
+
+    if client_id && client_secret do
+      Repo.get_by(
+        App,
+        client_id: client_id,
+        client_secret: client_secret
+      )
+    else
+      nil
+    end
+  end
 end