Something went wrong. Try again.
A lexicon-driven AppView for ATProto.
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169mod common;
use axum::body::Body;use axum::http::{HeaderName, HeaderValue, Request, StatusCode};use happyview::db::now_rfc3339;use happyview::spaces::db as spaces_db;use happyview::spaces::types::*;use http_body_util::BodyExt;use serde_json::{Value, json};use serial_test::serial;use tower::ServiceExt;use uuid::Uuid;
use common::app::TestApp;
const AUTHORITY: &str = "did:plc:mint-authority";const MEMBER: &str = "did:plc:mint-member";const ATTACKER: &str = "did:plc:mint-attacker";
fn space_uri() -> String { format!("at://{AUTHORITY}/space/com.example.mint/main")}
async fn enable_spaces(app: &TestApp) { let (name, value) = app.admin_cookie(); let req = Request::builder() .method("PUT") .uri("/admin/settings/feature.spaces_enabled") .header(name, value) .header("content-type", "application/json") .body(Body::from(json!({ "value": "true" }).to_string())) .unwrap(); assert!( app.router .clone() .oneshot(req) .await .unwrap() .status() .is_success(), "failed to enable spaces" );}
fn cookie_for(app: &TestApp, did: &str) -> (HeaderName, HeaderValue) { common::auth::admin_cookie_header(did, &app.state.cookie_key)}
async fn json_of(resp: axum::http::Response<Body>) -> Value { let body = resp.into_body().collect().await.unwrap().to_bytes(); serde_json::from_slice(&body).unwrap_or(json!(null))}
/// Set up a space with `MEMBER` as a read member, and return a fresh delegation/// token issued to `MEMBER`.async fn setup_and_get_delegation_token(app: &TestApp) -> String { enable_spaces(app).await;
let space_id = Uuid::new_v4().to_string(); let now = now_rfc3339(); let space = Space { id: space_id.clone(), did: AUTHORITY.to_string(), authority_did: AUTHORITY.to_string(), creator_did: AUTHORITY.to_string(), type_nsid: "com.example.mint".to_string(), skey: "main".to_string(), display_name: None, description: None, mint_policy: MintPolicy::MemberList, app_access: AppAccess::Open, managing_app_did: None, config: SpaceConfig::default(), revision: None, created_at: now.clone(), updated_at: now.clone(), }; spaces_db::create_space(&app.state.db, app.state.db_backend, &space) .await .unwrap(); spaces_db::add_member( &app.state.db, app.state.db_backend, &SpaceMember { id: Uuid::new_v4().to_string(), space_id, did: MEMBER.to_string(), access: SpaceAccess::Read, is_delegation: false, granted_by: Some(AUTHORITY.to_string()), created_at: now, }, ) .await .unwrap();
// MEMBER obtains a delegation token (proof of membership). let (name, value) = cookie_for(app, MEMBER); let req = Request::builder() .method("GET") .uri(format!( "/xrpc/com.atproto.space.getDelegationToken?space={}", urlencoding::encode(&space_uri()) )) .header(name, value) .body(Body::empty()) .unwrap(); let resp = app.router.clone().oneshot(req).await.unwrap(); assert_eq!(resp.status(), StatusCode::OK, "getDelegationToken failed"); json_of(resp).await["delegationToken"] .as_str() .expect("delegationToken") .to_string()}
fn get_credential_req(grant: &str, cookie: (HeaderName, HeaderValue)) -> Request<Body> { Request::builder() .method("POST") .uri("/xrpc/com.atproto.space.getSpaceCredential") .header(cookie.0, cookie.1) .header("content-type", "application/json") .body(Body::from(json!({ "grant": grant }).to_string())) .unwrap()}
/// An attacker who captures a member's delegation token cannot mint a credential/// in the member's name. Before the fix this returned 200.#[tokio::test]#[serial]async fn get_space_credential_rejects_foreign_caller() { common::require_db!(); let app = TestApp::new_with_encryption().await; let grant = setup_and_get_delegation_token(&app).await;
let resp = app .router .clone() .oneshot(get_credential_req(&grant, cookie_for(&app, ATTACKER))) .await .unwrap(); assert_eq!( resp.status(), StatusCode::FORBIDDEN, "a caller must not mint a credential from another member's delegation token" );}
/// The member the delegation token was issued to can mint their own credential.#[tokio::test]#[serial]async fn get_space_credential_allows_own_caller() { common::require_db!(); let app = TestApp::new_with_encryption().await; let grant = setup_and_get_delegation_token(&app).await;
let resp = app .router .clone() .oneshot(get_credential_req(&grant, cookie_for(&app, MEMBER))) .await .unwrap(); assert_eq!(resp.status(), StatusCode::OK); let body = json_of(resp).await; assert!( body["credential"].as_str().is_some(), "expected a credential" );}