thepraandClaude Opus 5.5
4d9be37c1c
OpenIddict 7.7 (MongoDB stores, keys kept in Mongo so tokens survive
restarts) serves /oauth/authorize, /oauth/token, /oauth/revoke and the
discovery documents, including /.well-known/oauth-authorization-server:
- authorization code (PKCE optional) and client credentials, Mastodon's
scopes including the granular ones, non-expiring reference tokens,
`created_at` in the token response, and the urn:ietf:wg:oauth:2.0:oob
page that shows the code;
- /oauth/login signs the private login into a fifteen-minute cookie that
only /oauth sees (rate limited, antiforgery-protected); /oauth/authorize
then asks which persona the application acts as. The token's subject
is that persona's id and nothing else; no root id reaches a token, an
authorization or a log line;
- the token exchange refuses a persona whose login is banned or deleted,
and every API request checks the same.
/api/v1/apps registers applications dynamically, /api/v1/apps/
verify_credentials, /api/v1/instance (v1 and v2, "4.2.0 (compatible;
PrivaPub)") and verify_credentials answer in Mastodon's shapes: snake_case
with explicit nulls, Rails-style parameters from query, form or JSON,
{"error": ...} on failure, Link paging. CORS exposes Link.
/api goes to OpenIddict validation and everything else to the existing
JWT; the JWT failure handler no longer sends the exception and stack trace
to the client.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB
38 lines
1.5 KiB
C#
38 lines
1.5 KiB
C#
namespace PrivaPub.Api.Mastodon.Auth
|
|
{
|
|
public static class MastodonScopes
|
|
{
|
|
public static readonly string[] All =
|
|
{
|
|
"read", "write", "follow", "push", "profile",
|
|
"read:accounts", "read:blocks", "read:bookmarks", "read:favourites", "read:filters", "read:follows", "read:lists",
|
|
"read:mutes", "read:notifications", "read:search", "read:statuses",
|
|
"write:accounts", "write:blocks", "write:bookmarks", "write:conversations", "write:favourites", "write:filters",
|
|
"write:follows", "write:lists", "write:media", "write:mutes", "write:notifications", "write:reports", "write:statuses"
|
|
};
|
|
|
|
public static IReadOnlyList<string> Parse(string scopes)
|
|
{
|
|
var parsed = (scopes ?? string.Empty).Split(new[] { ' ', '+', ',' }, StringSplitOptions.RemoveEmptyEntries)
|
|
.Where(s => All.Contains(s))
|
|
.Distinct()
|
|
.ToList();
|
|
return parsed.Count == 0 ? new[] { "read" } : parsed;
|
|
}
|
|
|
|
public static bool Grants(IEnumerable<string> granted, string required)
|
|
{
|
|
var scopes = granted as ICollection<string> ?? granted.ToList();
|
|
if (scopes.Contains(required))
|
|
return true;
|
|
var colon = required.IndexOf(':');
|
|
if (colon > 0 && scopes.Contains(required[..colon]))
|
|
return true;
|
|
return required.StartsWith("read:follows") || required.StartsWith("write:follows") || required.StartsWith("write:blocks")
|
|
|| required.StartsWith("read:blocks") || required.StartsWith("write:mutes") || required.StartsWith("read:mutes")
|
|
? scopes.Contains("follow")
|
|
: false;
|
|
}
|
|
}
|
|
}
|