From a30dcb39bc5683d32d3257b7ac2104a59a90d53f Mon Sep 17 00:00:00 2001 From: Drew DeVault Date: Sat, 21 Nov 2020 10:23:48 -0500 Subject: [PATCH] Prohibit OAuth client auth for revoked clients --- auth/middleware.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/auth/middleware.go b/auth/middleware.go index a8bda2a9843324d6ea8a14af6abc5b2ecad28b8c..be0663ebd885e70a213855b57391647ad4409149 100644 --- a/auth/middleware.go +++ b/auth/middleware.go @@ -145,6 +145,7 @@ func authForUsername(ctx context.Context, username string) (*AuthContext, error) return &auth, nil } +// NOTE: This only works for meta.sr.ht (should we move it?) func authForOAuthClient(ctx context.Context, clientUUID string) (*AuthContext, error) { var auth AuthContext if err := database.WithTx(ctx, &sql.TxOptions{ @@ -166,7 +167,8 @@ func authForOAuthClient(ctx context.Context, clientUUID string) (*AuthContext, e }). From(`"oauth2_client" client`). Join(`"user" u ON u.id = client.owner_id`). - Where(`client.client_uuid = ?`, clientUUID) + Where(`client.client_uuid = ?`, clientUUID). + Where(`client.revoked = false`) if rows, err = query.RunWith(tx).Query(); err != nil { panic(err) }