2016-11-15 17:56:29 +02:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2017-06-07 21:09:25 +03:00
|
|
|
class Api::BaseController < ApplicationController
|
2016-11-09 18:48:44 +02:00
|
|
|
DEFAULT_STATUSES_LIMIT = 20
|
|
|
|
DEFAULT_ACCOUNTS_LIMIT = 40
|
|
|
|
|
2017-06-07 18:23:26 +03:00
|
|
|
include RateLimitHeaders
|
|
|
|
|
2017-04-09 23:21:52 +03:00
|
|
|
skip_before_action :store_current_location
|
Change unconfirmed user login behaviour (#11375)
Allow access to account settings, 2FA, authorized applications, and
account deletions to unconfirmed and pending users, as well as
users who had their accounts disabled. Suspended users cannot update
their e-mail or password or delete their account.
Display account status on account settings page, for example, when
an account is frozen, limited, unconfirmed or pending review.
After sign up, login users straight away and show a simple page that
tells them the status of their account with links to account settings
and logout, to reduce onboarding friction and allow users to correct
wrongly typed e-mail addresses.
Move the final sign-up step of SSO integrations to be the same
as above to reduce code duplication.
2019-07-22 11:48:50 +03:00
|
|
|
skip_before_action :require_functional!
|
2018-08-24 00:26:29 +03:00
|
|
|
|
2019-07-30 12:10:46 +03:00
|
|
|
before_action :require_authenticated_user!, if: :disallow_unauthenticated_api_access?
|
2019-05-03 21:39:19 +03:00
|
|
|
before_action :set_cache_headers
|
|
|
|
|
2018-01-08 21:01:33 +02:00
|
|
|
protect_from_forgery with: :null_session
|
2016-03-07 13:42:33 +02:00
|
|
|
|
2019-08-11 23:59:40 +03:00
|
|
|
skip_around_action :set_locale
|
|
|
|
|
2017-02-27 00:23:06 +02:00
|
|
|
rescue_from ActiveRecord::RecordInvalid, Mastodon::ValidationError do |e|
|
2016-09-30 23:31:16 +03:00
|
|
|
render json: { error: e.to_s }, status: 422
|
2016-08-26 20:12:19 +03:00
|
|
|
end
|
|
|
|
|
|
|
|
rescue_from ActiveRecord::RecordNotFound do
|
|
|
|
render json: { error: 'Record not found' }, status: 404
|
|
|
|
end
|
|
|
|
|
2017-07-20 02:59:07 +03:00
|
|
|
rescue_from HTTP::Error, Mastodon::UnexpectedResponseError do
|
2016-09-17 18:03:36 +03:00
|
|
|
render json: { error: 'Remote data could not be fetched' }, status: 503
|
|
|
|
end
|
|
|
|
|
2016-10-05 14:26:44 +03:00
|
|
|
rescue_from OpenSSL::SSL::SSLError do
|
|
|
|
render json: { error: 'Remote SSL certificate could not be verified' }, status: 503
|
|
|
|
end
|
|
|
|
|
2017-02-27 00:23:06 +02:00
|
|
|
rescue_from Mastodon::NotPermittedError do
|
2016-12-22 22:34:19 +02:00
|
|
|
render json: { error: 'This action is not allowed' }, status: 403
|
|
|
|
end
|
|
|
|
|
2016-11-21 17:19:35 +02:00
|
|
|
def doorkeeper_unauthorized_render_options(error: nil)
|
|
|
|
{ json: { error: (error.try(:description) || 'Not authorized') } }
|
2016-10-22 20:38:47 +03:00
|
|
|
end
|
|
|
|
|
|
|
|
def doorkeeper_forbidden_render_options(*)
|
|
|
|
{ json: { error: 'This action is outside the authorized scopes' } }
|
|
|
|
end
|
|
|
|
|
2016-03-07 13:42:33 +02:00
|
|
|
protected
|
|
|
|
|
2016-11-09 18:48:44 +02:00
|
|
|
def set_pagination_headers(next_path = nil, prev_path = nil)
|
|
|
|
links = []
|
2016-11-15 17:56:29 +02:00
|
|
|
links << [next_path, [%w(rel next)]] if next_path
|
|
|
|
links << [prev_path, [%w(rel prev)]] if prev_path
|
2017-08-18 11:42:59 +03:00
|
|
|
response.headers['Link'] = LinkHeader.new(links) unless links.empty?
|
2016-11-09 18:48:44 +02:00
|
|
|
end
|
|
|
|
|
2017-01-24 05:22:10 +02:00
|
|
|
def limit_param(default_limit)
|
|
|
|
return default_limit unless params[:limit]
|
|
|
|
[params[:limit].to_i.abs, default_limit * 2].min
|
|
|
|
end
|
|
|
|
|
2018-09-28 03:23:45 +03:00
|
|
|
def params_slice(*keys)
|
|
|
|
params.slice(*keys).permit(*keys)
|
|
|
|
end
|
|
|
|
|
2016-03-07 13:42:33 +02:00
|
|
|
def current_resource_owner
|
2016-11-23 10:20:34 +02:00
|
|
|
@current_user ||= User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
|
2016-03-07 13:42:33 +02:00
|
|
|
end
|
|
|
|
|
|
|
|
def current_user
|
2017-04-18 16:57:46 +03:00
|
|
|
current_resource_owner || super
|
2016-11-09 00:22:44 +02:00
|
|
|
rescue ActiveRecord::RecordNotFound
|
|
|
|
nil
|
|
|
|
end
|
|
|
|
|
2019-07-30 12:10:46 +03:00
|
|
|
def require_authenticated_user!
|
|
|
|
render json: { error: 'This API requires an authenticated user' }, status: 401 unless current_user
|
|
|
|
end
|
|
|
|
|
2016-11-09 00:22:44 +02:00
|
|
|
def require_user!
|
2018-12-25 20:35:26 +02:00
|
|
|
if !current_user
|
|
|
|
render json: { error: 'This method requires an authenticated user' }, status: 422
|
|
|
|
elsif current_user.disabled?
|
2018-04-30 10:13:14 +03:00
|
|
|
render json: { error: 'Your login is currently disabled' }, status: 403
|
2018-12-25 20:35:26 +02:00
|
|
|
elsif !current_user.confirmed?
|
2019-03-14 06:28:30 +02:00
|
|
|
render json: { error: 'Your login is missing a confirmed e-mail address' }, status: 403
|
|
|
|
elsif !current_user.approved?
|
|
|
|
render json: { error: 'Your login is currently pending approval' }, status: 403
|
2017-08-15 15:14:12 +03:00
|
|
|
else
|
2018-12-25 20:35:26 +02:00
|
|
|
set_user_activity
|
2017-08-15 15:14:12 +03:00
|
|
|
end
|
2016-03-07 13:42:33 +02:00
|
|
|
end
|
2016-09-27 00:55:21 +03:00
|
|
|
|
|
|
|
def render_empty
|
|
|
|
render json: {}, status: 200
|
|
|
|
end
|
2018-07-05 19:31:35 +03:00
|
|
|
|
|
|
|
def authorize_if_got_token!(*scopes)
|
|
|
|
doorkeeper_authorize!(*scopes) if doorkeeper_token
|
|
|
|
end
|
2019-05-03 21:39:19 +03:00
|
|
|
|
|
|
|
def set_cache_headers
|
|
|
|
response.headers['Cache-Control'] = 'no-cache, no-store, max-age=0, must-revalidate'
|
|
|
|
end
|
2019-07-30 12:10:46 +03:00
|
|
|
|
|
|
|
def disallow_unauthenticated_api_access?
|
|
|
|
authorized_fetch_mode?
|
|
|
|
end
|
2016-03-05 13:50:59 +02:00
|
|
|
end
|