+ {@ctx.client_name || @ctx.client_id} + wants to connect to your Plausible account + + {@ctx.client_uri} + +
++ This will allow the application to: +
++ The connection will only be able to access the data of the selected team. +
++ {@message} +
++ You haven't connected any applications yet. +
+ + <.table :if={@oauth_grants != []} rows={@oauth_grants}> + <:thead> + <.th>Application + <.th hide_on_mobile>Team + <.th hide_on_mobile>Scopes + <.th hide_on_mobile>Last used + <.th invisible>Actions + + <:tbody :let={grant}> + <.td truncate max_width="max-w-60"> + {grant.client_name || grant.client_id} + + {grant.client_id} + + + <.td hide_on_mobile>{(grant.team && grant.team.name) || "—"} + <.td hide_on_mobile>{Enum.join(grant.scopes, ", ")} + <.td hide_on_mobile>{Plausible.OAuth.AccessToken.last_used_humanize(grant)} + <.td actions> + <.delete_button + href={Routes.settings_path(@conn, :revoke_oauth_connector, grant.id)} + method="delete" + data-confirm="Are you sure you want to revoke this application's access?" + /> + + + + diff --git a/lib/plausible_web/views/oauth_view.ex b/lib/plausible_web/views/oauth_view.ex new file mode 100644 index 000000000000..463c8c6c4042 --- /dev/null +++ b/lib/plausible_web/views/oauth_view.ex @@ -0,0 +1,18 @@ +defmodule PlausibleWeb.OAuthView do + # Mirrors the `PlausibleWeb, :view` macro but pins the template `path` to + # "oauth" (the default derivation would underscore `OAuth` to "o_auth"). + use Phoenix.View, root: "lib/plausible_web/templates", path: "oauth" + + use Phoenix.Component, global_prefixes: ~w(x-) + + import PlausibleWeb.Components.Generic + + @scope_descriptions %{ + "stats:read:*" => "Read your sites' analytics (Stats API)", + "sites:read:*" => "Read the list and details of your sites" + } + + def scope_description(scope) do + Map.get(@scope_descriptions, scope, scope) + end +end diff --git a/lib/workers/oauth_cleanup.ex b/lib/workers/oauth_cleanup.ex new file mode 100644 index 000000000000..e6ef2a332aab --- /dev/null +++ b/lib/workers/oauth_cleanup.ex @@ -0,0 +1,14 @@ +defmodule Plausible.Workers.OAuthCleanup do + @moduledoc """ + Periodically purges expired OAuth authorization codes and fully-expired + access/refresh token rows. + """ + + use Oban.Worker, queue: :oauth_cleanup + + @impl Oban.Worker + def perform(_job) do + Plausible.OAuth.delete_expired() + :ok + end +end diff --git a/priv/repo/migrations/20260721120000_create_oauth_tables.exs b/priv/repo/migrations/20260721120000_create_oauth_tables.exs new file mode 100644 index 000000000000..3809c9688d5e --- /dev/null +++ b/priv/repo/migrations/20260721120000_create_oauth_tables.exs @@ -0,0 +1,47 @@ +defmodule Plausible.Repo.Migrations.CreateOauthTables do + use Ecto.Migration + + def change do + create table(:oauth_authorization_codes) do + add :code_hash, :string, null: false + add :client_id, :string, null: false + add :client_name, :string + add :redirect_uri, :string, null: false + add :code_challenge, :string, null: false + add :code_challenge_method, :string, null: false + add :scopes, {:array, :string}, null: false, default: [] + add :resource, :string + add :user_id, references(:users, on_delete: :delete_all), null: false + add :team_id, references(:teams, on_delete: :delete_all), null: false + add :expires_at, :utc_datetime_usec, null: false + + timestamps(updated_at: false) + end + + create unique_index(:oauth_authorization_codes, [:code_hash]) + create index(:oauth_authorization_codes, [:expires_at]) + + create table(:oauth_access_tokens) do + add :access_token_hash, :string, null: false + add :access_token_prefix, :string, null: false + add :refresh_token_hash, :string + add :refresh_token_prefix, :string + add :client_id, :string, null: false + add :client_name, :string + add :scopes, {:array, :string}, null: false, default: [] + add :resource, :string + add :user_id, references(:users, on_delete: :delete_all), null: false + add :team_id, references(:teams, on_delete: :delete_all), null: false + add :access_token_expires_at, :utc_datetime_usec, null: false + add :refresh_token_expires_at, :utc_datetime_usec + add :last_used_at, :utc_datetime_usec + + timestamps() + end + + create unique_index(:oauth_access_tokens, [:access_token_hash]) + create unique_index(:oauth_access_tokens, [:refresh_token_hash]) + create index(:oauth_access_tokens, [:access_token_expires_at]) + create index(:oauth_access_tokens, [:user_id]) + end +end diff --git a/test/plausible/oauth_test.exs b/test/plausible/oauth_test.exs new file mode 100644 index 000000000000..6c17ca404cb9 --- /dev/null +++ b/test/plausible/oauth_test.exs @@ -0,0 +1,515 @@ +defmodule Plausible.OAuthTest do + use Plausible.DataCase, async: true + use Plausible.Test.Support.DNS + + alias Plausible.OAuth + alias Plausible.OAuth.{AccessToken, AuthorizationCode, Token} + + @redirect_uri "https://client.example/callback" + @client_id "https://client.example/oauth-metadata" + @resource "https://plausible.example/mcp" + + defp verifier_and_challenge do + verifier = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false) + challenge = :crypto.hash(:sha256, verifier) |> Base.url_encode64(padding: false) + {verifier, challenge} + end + + defp code_attrs(challenge, overrides \\ %{}) do + Map.merge( + %{ + client_id: @client_id, + redirect_uri: @redirect_uri, + code_challenge: challenge, + code_challenge_method: "S256", + scopes: ["stats:read:*", "sites:read:*"], + resource: @resource + }, + overrides + ) + end + + describe "verify_pkce/3" do + test "accepts a valid S256 verifier" do + {verifier, challenge} = verifier_and_challenge() + assert OAuth.verify_pkce(challenge, verifier, "S256") == :ok + end + + test "rejects an incorrect verifier" do + {_verifier, challenge} = verifier_and_challenge() + assert OAuth.verify_pkce(challenge, "not-the-verifier", "S256") == {:error, :invalid_grant} + end + + test "rejects the plain method even when values match" do + {verifier, _challenge} = verifier_and_challenge() + assert OAuth.verify_pkce(verifier, verifier, "plain") == {:error, :invalid_grant} + end + + test "rejects missing verifier" do + {_verifier, challenge} = verifier_and_challenge() + assert OAuth.verify_pkce(challenge, nil, "S256") == {:error, :invalid_grant} + end + end + + describe "normalize_scopes/1" do + @all ["stats:read:*", "sites:read:*"] + + test "defaults to all supported scopes when absent, empty or blank" do + assert OAuth.normalize_scopes(nil) == {:ok, @all} + assert OAuth.normalize_scopes("") == {:ok, @all} + assert OAuth.normalize_scopes(" ") == {:ok, @all} + end + + test "accepts a subset of supported scopes in canonical order" do + assert OAuth.normalize_scopes("sites:read:*") == {:ok, ["sites:read:*"]} + assert OAuth.normalize_scopes("sites:read:* stats:read:*") == {:ok, @all} + end + + test "rejects the whole request if any scope is unsupported" do + assert OAuth.normalize_scopes("stats:write:*") == {:error, :invalid_scope} + assert OAuth.normalize_scopes("bogus other") == {:error, :invalid_scope} + assert OAuth.normalize_scopes("stats:read:* bogus:scope") == {:error, :invalid_scope} + end + end + + describe "authorization codes" do + setup do + user = new_user() + {:ok, team} = Plausible.Teams.get_or_create(user) + {:ok, user: user, team: team} + end + + test "create + consume round-trips and is single-use", %{user: user, team: team} do + {verifier, challenge} = verifier_and_challenge() + {:ok, raw} = OAuth.create_authorization_code(user, team, code_attrs(challenge)) + + assert {:ok, %AuthorizationCode{} = code} = + OAuth.consume_authorization_code(raw, verifier, @redirect_uri, @resource) + + assert code.user_id == user.id + assert code.team_id == team.id + assert code.scopes == ["stats:read:*", "sites:read:*"] + + # Second consumption fails - the code was deleted. + assert {:error, :invalid_grant} = + OAuth.consume_authorization_code(raw, verifier, @redirect_uri, @resource) + end + + test "refuses to create a code without a team", %{user: user} do + {_verifier, challenge} = verifier_and_challenge() + + assert {:error, changeset} = + OAuth.create_authorization_code(user, nil, code_attrs(challenge)) + + refute changeset.valid? + assert Keyword.has_key?(changeset.errors, :team_id) + end + + test "rejects a bad PKCE verifier", %{user: user, team: team} do + {_verifier, challenge} = verifier_and_challenge() + {:ok, raw} = OAuth.create_authorization_code(user, team, code_attrs(challenge)) + + assert {:error, :invalid_grant} = + OAuth.consume_authorization_code(raw, "wrong", @redirect_uri, @resource) + end + + test "rejects redirect_uri mismatch", %{user: user, team: team} do + {verifier, challenge} = verifier_and_challenge() + {:ok, raw} = OAuth.create_authorization_code(user, team, code_attrs(challenge)) + + assert {:error, :invalid_grant} = + OAuth.consume_authorization_code( + raw, + verifier, + "https://evil.example/cb", + @resource + ) + end + + test "rejects resource mismatch", %{user: user, team: team} do + {verifier, challenge} = verifier_and_challenge() + {:ok, raw} = OAuth.create_authorization_code(user, team, code_attrs(challenge)) + + assert {:error, :invalid_grant} = + OAuth.consume_authorization_code(raw, verifier, @redirect_uri, "https://evil/mcp") + end + + test "client_name propagates from the authorization code to the grant", %{ + user: user, + team: team + } do + {verifier, challenge} = verifier_and_challenge() + attrs = code_attrs(challenge, %{client_name: "Claude Code"}) + + {:ok, raw} = OAuth.create_authorization_code(user, team, attrs) + {:ok, code} = OAuth.consume_authorization_code(raw, verifier, @redirect_uri, @resource) + assert code.client_name == "Claude Code" + + {:ok, _tokens} = OAuth.issue_tokens(code) + assert [grant] = OAuth.list_grants(user) + assert grant.client_name == "Claude Code" + end + + test "rejects an expired code", %{user: user, team: team} do + {verifier, challenge} = verifier_and_challenge() + code = Token.generate(:code) + + Repo.insert!( + AuthorizationCode.changeset(%{ + code_hash: code.hash, + client_id: @client_id, + redirect_uri: @redirect_uri, + code_challenge: challenge, + code_challenge_method: "S256", + scopes: ["stats:read:*"], + resource: @resource, + user_id: user.id, + team_id: team.id, + expires_at: DateTime.add(DateTime.utc_now(), -60, :second) + }) + ) + + assert {:error, :invalid_grant} = + OAuth.consume_authorization_code(code.raw, verifier, @redirect_uri, @resource) + end + end + + describe "tokens" do + setup do + user = new_user() + {:ok, team} = Plausible.Teams.get_or_create(user) + {verifier, challenge} = verifier_and_challenge() + {:ok, raw} = OAuth.create_authorization_code(user, team, code_attrs(challenge)) + {:ok, code} = OAuth.consume_authorization_code(raw, verifier, @redirect_uri, @resource) + {:ok, tokens} = OAuth.issue_tokens(code) + {:ok, user: user, team: team, tokens: tokens} + end + + test "issue_tokens returns a standard token response", %{tokens: tokens} do + assert tokens.token_type == "Bearer" + assert tokens.expires_in == OAuth.access_token_ttl() + assert is_binary(tokens.access_token) + assert is_binary(tokens.refresh_token) + assert tokens.scope == "stats:read:* sites:read:*" + end + + test "find_access_token resolves a valid token with preloads", %{ + tokens: tokens, + user: user, + team: team + } do + assert {:ok, token} = OAuth.find_access_token(tokens.access_token) + assert token.user.id == user.id + assert token.team.id == team.id + end + + test "refresh rotates the pair and invalidates the old tokens", %{tokens: tokens} do + assert {:ok, new_tokens} = OAuth.refresh_tokens(tokens.refresh_token) + refute new_tokens.access_token == tokens.access_token + refute new_tokens.refresh_token == tokens.refresh_token + + # Old refresh token can't be reused. + assert {:error, :invalid_grant} = OAuth.refresh_tokens(tokens.refresh_token) + # Old access token no longer resolves. + assert {:error, :invalid_token} = OAuth.find_access_token(tokens.access_token) + # New access token works. + assert {:ok, _} = OAuth.find_access_token(new_tokens.access_token) + end + + test "find_access_token rejects expired tokens", %{user: user, team: team} do + access = Token.generate(:access) + + Repo.insert!( + AccessToken.changeset(%{ + access_token_hash: access.hash, + access_token_prefix: access.prefix, + client_id: @client_id, + scopes: ["stats:read:*"], + user_id: user.id, + team_id: team.id, + access_token_expires_at: DateTime.add(DateTime.utc_now(), -60, :second) + }) + ) + + assert {:error, :invalid_token} = OAuth.find_access_token(access.raw) + end + end + + describe "grants management" do + setup do + user = new_user() + {:ok, team} = Plausible.Teams.get_or_create(user) + {:ok, user: user, team: team} + end + + defp insert_token(user, team, opts) do + access = Token.generate(:access) + now = DateTime.utc_now() + + Repo.insert!( + AccessToken.changeset(%{ + access_token_hash: access.hash, + access_token_prefix: access.prefix, + refresh_token_hash: Token.generate(:refresh).hash, + refresh_token_prefix: "plausible-mcp-rt-x", + client_id: Keyword.get(opts, :client_id, @client_id), + scopes: ["stats:read:*"], + user_id: user.id, + team_id: team.id, + access_token_expires_at: + Keyword.get(opts, :access_expires_at, DateTime.add(now, 3600, :second)), + refresh_token_expires_at: + Keyword.get(opts, :refresh_expires_at, DateTime.add(now, 86_400, :second)) + }) + ) + end + + test "list_grants returns usable grants, newest first, excluding fully-expired", %{ + user: user, + team: team + } do + now = DateTime.utc_now() + + _expired = + insert_token(user, team, + access_expires_at: DateTime.add(now, -120, :second), + refresh_expires_at: DateTime.add(now, -60, :second) + ) + + active = insert_token(user, team, client_id: "https://client.example/active") + + # A grant whose access token expired but refresh is still valid is still usable. + refreshable = + insert_token(user, team, + client_id: "https://client.example/refreshable", + access_expires_at: DateTime.add(now, -60, :second) + ) + + grants = OAuth.list_grants(user) + ids = Enum.map(grants, & &1.id) + + assert active.id in ids + assert refreshable.id in ids + assert length(grants) == 2 + assert Enum.all?(grants, &Ecto.assoc_loaded?(&1.team)) + end + + test "list_grants is scoped to the user", %{user: user, team: team} do + other = new_user() + {:ok, other_team} = Plausible.Teams.get_or_create(other) + insert_token(other, other_team, []) + + grant = insert_token(user, team, []) + + assert Enum.map(OAuth.list_grants(user), & &1.id) == [grant.id] + end + + test "revoke_grant deletes the row and is user-scoped", %{user: user, team: team} do + grant = insert_token(user, team, []) + + assert :ok = OAuth.revoke_grant(user, grant.id) + assert OAuth.list_grants(user) == [] + # Already gone. + assert {:error, :not_found} = OAuth.revoke_grant(user, grant.id) + end + + test "revoke_grant won't delete another user's grant", %{user: user, team: team} do + other = new_user() + grant = insert_token(user, team, []) + + assert {:error, :not_found} = OAuth.revoke_grant(other, grant.id) + assert [_] = OAuth.list_grants(user) + end + + test "revoke_grants_for_team_member deletes only that user+team's grants", %{ + user: user, + team: team + } do + other_user = new_user() + {:ok, other_team} = Plausible.Teams.get_or_create(other_user) + + kept_other_user = insert_token(other_user, other_team, []) + # Same user, but a different team - must be kept. + kept_other_team = insert_token(user, other_team, []) + _revoked_1 = insert_token(user, team, []) + _revoked_2 = insert_token(user, team, []) + + assert 2 = OAuth.revoke_grants_for_team_member(user, team) + + remaining = Repo.all(AccessToken) |> Enum.map(& &1.id) |> Enum.sort() + assert remaining == Enum.sort([kept_other_user.id, kept_other_team.id]) + end + + test "grants are cascade-deleted at the DB level when the user is deleted", %{ + user: user, + team: team + } do + insert_token(user, team, []) + assert Repo.aggregate(AccessToken, :count) == 1 + + # Account deletion doesn't go through the team-membership removal path, but + # the `on_delete: :delete_all` FK on user_id guarantees the grant is purged. + assert {:ok, :deleted} = Plausible.Auth.delete_user(user) + assert Repo.aggregate(AccessToken, :count) == 0 + end + + test "grants are cascade-deleted at the DB level when the team is deleted", %{team: team} do + # Use a separate owner so deleting the team doesn't also delete our user. + user = new_user() + insert_token(user, team, []) + assert Repo.aggregate(AccessToken, :count) == 1 + + Repo.delete!(team) + assert Repo.aggregate(AccessToken, :count) == 0 + end + + test "mark_used stamps last_used_at and throttles subsequent writes", %{ + user: user, + team: team + } do + token = insert_token(user, team, []) + assert is_nil(token.last_used_at) + + assert :ok = OAuth.mark_used(token) + t1 = Repo.reload!(token).last_used_at + assert t1 + + # Second call within the throttle window doesn't move the timestamp. + assert :ok = OAuth.mark_used(token) + t2 = Repo.reload!(token).last_used_at + assert t2 == t1 + end + end + + describe "fetch_client_metadata/1" do + test "rejects non-HTTPS client_id" do + assert OAuth.fetch_client_metadata("http://client.example/meta") == + {:error, :client_id_not_https} + end + + test "uses the SSRF-safe client and rejects restricted addresses" do + # No :client_metadata_fetcher override -> the real Plausible.SSRF client is + # used. Resolve the client_id host to a private address; SSRF must refuse to + # connect before any request is made. + stub_dns(%{"client.example" => {[{10, 0, 0, 1}], []}}) + + assert {:error, :restricted_address} = OAuth.fetch_client_metadata(@client_id) + end + + test "rejects a non-resolvable client_id host via the SSRF client" do + stub_dns(%{"client.example" => {[], []}}) + + assert {:error, :dns_resolution_failed} = OAuth.fetch_client_metadata(@client_id) + end + + test "validates a self-referential document with a configured fetcher" do + with_fetcher(fn url -> + {:ok, + Jason.encode!(%{ + "client_id" => url, + "redirect_uris" => [@redirect_uri], + "client_name" => "Test Client" + })} + end) + + assert {:ok, doc} = OAuth.fetch_client_metadata(@client_id) + assert doc["client_id"] == @client_id + assert doc["redirect_uris"] == [@redirect_uri] + end + + test "rejects a document whose client_id does not match the URL" do + with_fetcher(fn _url -> + {:ok, + Jason.encode!(%{"client_id" => "https://other", "redirect_uris" => [@redirect_uri]})} + end) + + assert OAuth.fetch_client_metadata(@client_id) == {:error, :client_id_mismatch} + end + + test "rejects a document without redirect_uris" do + with_fetcher(fn url -> + {:ok, Jason.encode!(%{"client_id" => url})} + end) + + assert OAuth.fetch_client_metadata(@client_id) == {:error, :missing_redirect_uris} + end + end + + describe "redirect_uri_registered?/2" do + test "requires an exact match for non-loopback URIs" do + registered = ["https://client.example/cb"] + assert OAuth.redirect_uri_registered?("https://client.example/cb", registered) + refute OAuth.redirect_uri_registered?("https://client.example/other", registered) + refute OAuth.redirect_uri_registered?("https://evil.example/cb", registered) + end + + test "matches loopback URIs ignoring the port (RFC 8252)" do + # Claude Code declares these and connects on an ephemeral port. + registered = ["http://localhost/callback", "http://127.0.0.1/callback"] + + assert OAuth.redirect_uri_registered?("http://localhost:3118/callback", registered) + assert OAuth.redirect_uri_registered?("http://127.0.0.1:52001/callback", registered) + end + + test "loopback match still enforces scheme, host and path" do + registered = ["http://localhost/callback"] + + refute OAuth.redirect_uri_registered?("https://localhost:3000/callback", registered) + refute OAuth.redirect_uri_registered?("http://localhost:3000/evil", registered) + # Host must match: a public host is never treated as loopback. + refute OAuth.redirect_uri_registered?("http://evil.example:3000/callback", registered) + end + + test "handles nil" do + refute OAuth.redirect_uri_registered?(nil, ["http://localhost/callback"]) + end + end + + describe "delete_expired/0" do + test "purges expired codes and fully-expired tokens" do + user = new_user() + {:ok, team} = Plausible.Teams.get_or_create(user) + now = DateTime.utc_now() + + expired_code = Token.generate(:code) + + Repo.insert!( + AuthorizationCode.changeset(%{ + code_hash: expired_code.hash, + client_id: @client_id, + redirect_uri: @redirect_uri, + code_challenge: "x", + code_challenge_method: "S256", + user_id: user.id, + team_id: team.id, + expires_at: DateTime.add(now, -60, :second) + }) + ) + + expired_token = Token.generate(:access) + + Repo.insert!( + AccessToken.changeset(%{ + access_token_hash: expired_token.hash, + access_token_prefix: expired_token.prefix, + client_id: @client_id, + user_id: user.id, + team_id: team.id, + access_token_expires_at: DateTime.add(now, -120, :second), + refresh_token_expires_at: DateTime.add(now, -60, :second) + }) + ) + + assert %{authorization_codes: codes, access_tokens: tokens} = OAuth.delete_expired() + assert codes >= 1 + assert tokens >= 1 + assert Repo.aggregate(AuthorizationCode, :count) == 0 + assert Repo.aggregate(AccessToken, :count) == 0 + end + end + + defp with_fetcher(fun) do + Application.put_env(:plausible, Plausible.OAuth, client_metadata_fetcher: fun) + on_exit(fn -> Application.delete_env(:plausible, Plausible.OAuth) end) + end +end diff --git a/test/plausible_web/controllers/oauth/metadata_controller_test.exs b/test/plausible_web/controllers/oauth/metadata_controller_test.exs new file mode 100644 index 000000000000..74b1edfbed4c --- /dev/null +++ b/test/plausible_web/controllers/oauth/metadata_controller_test.exs @@ -0,0 +1,56 @@ +defmodule PlausibleWeb.OAuth.MetadataControllerTest do + use PlausibleWeb.ConnCase, async: false + + describe "with :mcp_server enabled" do + setup do + # Enable the global flag via the Ecto store (sandbox-scoped, rolled back at + # the end of the test). The cache is flushed on exit so the flag reads back + # as disabled for subsequent tests without a post-sandbox DB write. + FunWithFlags.enable(:mcp_server) + on_exit(fn -> FunWithFlags.Store.Cache.flush() end) + :ok + end + + test "GET /.well-known/oauth-authorization-server advertises CIMD and no DCR", %{conn: conn} do + resp = conn |> get("/.well-known/oauth-authorization-server") |> json_response(200) + + assert resp["issuer"] == PlausibleWeb.Endpoint.url() + assert resp["authorization_endpoint"] =~ "/login/oauth/authorize" + assert resp["token_endpoint"] =~ "/login/oauth/token" + assert resp["response_types_supported"] == ["code"] + assert resp["grant_types_supported"] == ["authorization_code", "refresh_token"] + assert resp["code_challenge_methods_supported"] == ["S256"] + assert resp["token_endpoint_auth_methods_supported"] == ["none"] + assert resp["client_id_metadata_document_supported"] == true + assert "stats:read:*" in resp["scopes_supported"] + # CIMD-only: no dynamic client registration endpoint. + refute Map.has_key?(resp, "registration_endpoint") + end + + test "well-known AS metadata is also served under the /mcp suffix", %{conn: conn} do + resp = conn |> get("/.well-known/oauth-authorization-server/mcp") |> json_response(200) + assert resp["client_id_metadata_document_supported"] == true + end + + test "GET /.well-known/oauth-protected-resource returns PRM", %{conn: conn} do + resp = conn |> get("/.well-known/oauth-protected-resource") |> json_response(200) + + assert resp["resource"] == PlausibleWeb.Endpoint.url() <> "/mcp" + assert resp["authorization_servers"] == [PlausibleWeb.Endpoint.url()] + assert resp["bearer_methods_supported"] == ["header"] + assert "stats:read:*" in resp["scopes_supported"] + end + + test "PRM is also served under the /mcp suffix", %{conn: conn} do + resp = conn |> get("/.well-known/oauth-protected-resource/mcp") |> json_response(200) + assert resp["resource"] == PlausibleWeb.Endpoint.url() <> "/mcp" + end + end + + describe "with :mcp_server disabled" do + test "well-known endpoints 404", %{conn: conn} do + assert conn |> get("/.well-known/oauth-authorization-server") |> json_response(404) + assert conn |> get("/.well-known/oauth-protected-resource") |> json_response(404) + end + end +end diff --git a/test/plausible_web/controllers/oauth/oauth_flow_test.exs b/test/plausible_web/controllers/oauth/oauth_flow_test.exs new file mode 100644 index 000000000000..2a27daece0aa --- /dev/null +++ b/test/plausible_web/controllers/oauth/oauth_flow_test.exs @@ -0,0 +1,389 @@ +defmodule PlausibleWeb.OAuth.FlowTest do + use PlausibleWeb.ConnCase, async: false + + @redirect_uri "https://client.example/callback" + @client_id "https://client.example/oauth-metadata" + @resource "https://plausible.example/mcp" + + setup %{conn: conn} do + FunWithFlags.enable(:mcp_server) + on_exit(fn -> FunWithFlags.Store.Cache.flush() end) + + put_fetcher(fn url -> + {:ok, + Jason.encode!(%{ + "client_id" => url, + "redirect_uris" => [@redirect_uri], + "client_name" => "Test Client" + })} + end) + + user = new_user() + {:ok, team} = Plausible.Teams.get_or_create(user) + {:ok, conn: conn} = log_in(%{user: user, conn: conn}) + + {:ok, conn: conn, user: user, team: team} + end + + defp put_fetcher(fun) do + Application.put_env(:plausible, Plausible.OAuth, client_metadata_fetcher: fun) + on_exit(fn -> Application.delete_env(:plausible, Plausible.OAuth) end) + end + + defp pkce do + verifier = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false) + challenge = :crypto.hash(:sha256, verifier) |> Base.url_encode64(padding: false) + {verifier, challenge} + end + + defp authorize_params(challenge, overrides \\ %{}) do + Map.merge( + %{ + "client_id" => @client_id, + "redirect_uri" => @redirect_uri, + "response_type" => "code", + "code_challenge" => challenge, + "code_challenge_method" => "S256", + "scope" => "stats:read:* sites:read:*", + "state" => "xyz-state", + "resource" => @resource + }, + overrides + ) + end + + defp token_conn do + build_conn() |> put_req_header("accept", "application/json") + end + + defp code_from_redirect(conn) do + location = redirected_to(conn, 302) + assert String.starts_with?(location, @redirect_uri) + %URI{query: query} = URI.parse(location) + URI.decode_query(query) + end + + # Models a client following an absolute URL it read out of a discovery + # document: for an in-process request we only need the path, which is exactly + # the coupling a real client has — it uses whatever the server advertises. + defp path_of(url), do: URI.parse(url).path + + # RFC 8414 §3: the authorization server metadata URL is the well-known segment + # inserted between the issuer's host and path. Our issuer is path-less, so it + # lands at the origin root. + defp as_metadata_url(issuer) do + uri = URI.parse(issuer) + + %{uri | path: "/.well-known/oauth-authorization-server" <> (uri.path || "")} + |> URI.to_string() + end + + describe "GET /login/oauth/authorize" do + test "renders the consent screen with client and scope info", %{conn: conn} do + {_verifier, challenge} = pkce() + conn = get(conn, "/login/oauth/authorize?" <> URI.encode_query(authorize_params(challenge))) + + html = html_response(conn, 200) + assert html =~ "Authorize access" + assert html =~ "Test Client" + assert html =~ "Stats API" + end + + test "404s when the :mcp_server flag is disabled", %{conn: conn} do + FunWithFlags.disable(:mcp_server) + {_verifier, challenge} = pkce() + conn = get(conn, "/login/oauth/authorize?" <> URI.encode_query(authorize_params(challenge))) + assert conn.status == 404 + end + + test "redirects to login when unauthenticated" do + {_verifier, challenge} = pkce() + + conn = + build_conn() + |> get("/login/oauth/authorize?" <> URI.encode_query(authorize_params(challenge))) + + assert redirected_to(conn) =~ "/login" + end + + test "renders an error page for an invalid client_id", %{conn: conn} do + put_fetcher(fn _url -> {:error, :boom} end) + {_verifier, challenge} = pkce() + + conn = get(conn, "/login/oauth/authorize?" <> URI.encode_query(authorize_params(challenge))) + assert html_response(conn, 400) =~ "Authorization error" + end + + test "redirects back with error for unsupported response_type", %{conn: conn} do + {_verifier, challenge} = pkce() + params = authorize_params(challenge, %{"response_type" => "token"}) + + conn = get(conn, "/login/oauth/authorize?" <> URI.encode_query(params)) + query = code_from_redirect(conn) + assert query["error"] == "unsupported_response_type" + assert query["state"] == "xyz-state" + end + + test "redirects back with invalid_request when code_challenge missing", %{conn: conn} do + params = authorize_params("", %{"code_challenge" => ""}) + conn = get(conn, "/login/oauth/authorize?" <> URI.encode_query(params)) + assert code_from_redirect(conn)["error"] == "invalid_request" + end + + test "redirects back with invalid_scope when no supported scope requested", %{conn: conn} do + {_verifier, challenge} = pkce() + params = authorize_params(challenge, %{"scope" => "stats:write:*"}) + + conn = get(conn, "/login/oauth/authorize?" <> URI.encode_query(params)) + query = code_from_redirect(conn) + assert query["error"] == "invalid_scope" + assert query["state"] == "xyz-state" + end + + test "defaults to all supported scopes when scope is absent", %{conn: conn} do + {_verifier, challenge} = pkce() + + params = + challenge + |> authorize_params() + |> Map.delete("scope") + + conn = get(conn, "/login/oauth/authorize?" <> URI.encode_query(params)) + assert html_response(conn, 200) =~ "Authorize access" + end + end + + describe "when the user has no team" do + setup %{conn: conn} do + # Re-log-in as a freshly-created user with no team memberships at all. + {:ok, conn: conn} = log_in(%{user: new_user(), conn: conn}) + {:ok, conn: conn} + end + + test "GET consent shows an error instead of the form", %{conn: conn} do + {_verifier, challenge} = pkce() + conn = get(conn, "/login/oauth/authorize?" <> URI.encode_query(authorize_params(challenge))) + + assert html_response(conn, 400) =~ "belong to a team" + end + + test "POST approve is refused and issues no code", %{conn: conn} do + {_verifier, challenge} = pkce() + + conn = + post( + conn, + "/login/oauth/authorize", + authorize_params(challenge, %{"action" => "approve"}) + ) + + assert html_response(conn, 400) =~ "belong to a team" + assert Plausible.Repo.aggregate(Plausible.OAuth.AuthorizationCode, :count) == 0 + end + end + + describe "full authorization_code + refresh flow" do + test "approve -> code -> token -> refresh", %{conn: conn, user: user} do + {verifier, challenge} = pkce() + + # Approve consent + conn = + post( + conn, + "/login/oauth/authorize", + authorize_params(challenge, %{"action" => "approve"}) + ) + + query = code_from_redirect(conn) + assert query["state"] == "xyz-state" + code = query["code"] + assert is_binary(code) + + # Exchange the code + resp = + token_conn() + |> post("/login/oauth/token", %{ + "grant_type" => "authorization_code", + "code" => code, + "code_verifier" => verifier, + "redirect_uri" => @redirect_uri, + "resource" => @resource + }) + |> json_response(200) + + assert resp["token_type"] == "Bearer" + assert is_binary(resp["access_token"]) + assert is_binary(resp["refresh_token"]) + assert resp["expires_in"] == Plausible.OAuth.access_token_ttl() + + # The client name from the CIMD document is captured on the grant. + assert [grant] = Plausible.OAuth.list_grants(user) + assert grant.client_name == "Test Client" + + # Refresh rotates the tokens + refreshed = + token_conn() + |> post("/login/oauth/token", %{ + "grant_type" => "refresh_token", + "refresh_token" => resp["refresh_token"] + }) + |> json_response(200) + + assert is_binary(refreshed["access_token"]) + refute refreshed["access_token"] == resp["access_token"] + end + + test "the code is single-use", %{conn: conn} do + {verifier, challenge} = pkce() + + conn = + post( + conn, + "/login/oauth/authorize", + authorize_params(challenge, %{"action" => "approve"}) + ) + + code = code_from_redirect(conn)["code"] + + exchange = fn -> + token_conn() + |> post("/login/oauth/token", %{ + "grant_type" => "authorization_code", + "code" => code, + "code_verifier" => verifier, + "redirect_uri" => @redirect_uri, + "resource" => @resource + }) + end + + assert exchange.() |> json_response(200) + assert exchange.() |> json_response(400) |> Map.get("error") == "invalid_grant" + end + + test "deny redirects with access_denied", %{conn: conn} do + {_verifier, challenge} = pkce() + + conn = + post(conn, "/login/oauth/authorize", authorize_params(challenge, %{"action" => "deny"})) + + assert code_from_redirect(conn)["error"] == "access_denied" + end + end + + describe "discovery-driven flow (client follows advertised metadata)" do + # This test hardcodes NO OAuth endpoint path. Every path it hits is read out + # of the discovery documents at request time: PRM -> authorization server + # metadata -> {authorization,token}_endpoint. Rename the routes (and the + # metadata that advertises them) and this test follows along automatically — + # which is the point: those endpoint locations are discovered, not fixed by + # the protocol. Contrast the well-known paths, which are fixed by RFC 8414 / + # RFC 9728 and therefore *are* spelled out literally here. + test "approve -> code -> token -> refresh through discovered endpoints", %{ + conn: conn, + user: user + } do + # 1. Protected Resource Metadata names the authorization server(s) and the + # resource. A client discovers this unauthenticated. + prm = + build_conn() + |> get("/.well-known/oauth-protected-resource") + |> json_response(200) + + assert [as_issuer] = prm["authorization_servers"] + resource = prm["resource"] + + # 2. Fetch the authorization server metadata from the discovered issuer and + # read the endpoints it advertises. + as_meta = + build_conn() + |> get(path_of(as_metadata_url(as_issuer))) + |> json_response(200) + + authorize_path = path_of(as_meta["authorization_endpoint"]) + token_path = path_of(as_meta["token_endpoint"]) + + # These came from metadata, not from a literal in this test. + assert String.starts_with?(authorize_path, "/") + assert String.starts_with?(token_path, "/") + + # 3. Drive the whole grant through the discovered paths and resource only. + {verifier, challenge} = pkce() + + approve_params = + challenge + |> authorize_params(%{"action" => "approve"}) + |> Map.put("resource", resource) + + code = + conn + |> post(authorize_path, approve_params) + |> code_from_redirect() + |> Map.get("code") + + assert is_binary(code) + + resp = + token_conn() + |> post(token_path, %{ + "grant_type" => "authorization_code", + "code" => code, + "code_verifier" => verifier, + "redirect_uri" => @redirect_uri, + "resource" => resource + }) + |> json_response(200) + + assert resp["token_type"] == "Bearer" + assert is_binary(resp["access_token"]) + assert is_binary(resp["refresh_token"]) + assert [grant] = Plausible.OAuth.list_grants(user) + assert grant.client_name == "Test Client" + + # The discovered token endpoint serves refresh too. + refreshed = + token_conn() + |> post(token_path, %{ + "grant_type" => "refresh_token", + "refresh_token" => resp["refresh_token"] + }) + |> json_response(200) + + assert is_binary(refreshed["access_token"]) + refute refreshed["access_token"] == resp["access_token"] + end + end + + describe "POST /login/oauth/token errors" do + test "invalid code returns invalid_grant" do + resp = + token_conn() + |> post("/login/oauth/token", %{ + "grant_type" => "authorization_code", + "code" => "nope", + "code_verifier" => "v", + "redirect_uri" => @redirect_uri + }) + |> json_response(400) + + assert resp["error"] == "invalid_grant" + end + + test "unsupported grant_type" do + resp = + token_conn() + |> post("/login/oauth/token", %{"grant_type" => "client_credentials"}) + |> json_response(400) + + assert resp["error"] == "unsupported_grant_type" + end + + test "missing grant_type" do + resp = + token_conn() + |> post("/login/oauth/token", %{}) + |> json_response(400) + + assert resp["error"] == "invalid_request" + end + end +end diff --git a/test/plausible_web/controllers/settings_controller_oauth_test.exs b/test/plausible_web/controllers/settings_controller_oauth_test.exs new file mode 100644 index 000000000000..39752de505d2 --- /dev/null +++ b/test/plausible_web/controllers/settings_controller_oauth_test.exs @@ -0,0 +1,71 @@ +defmodule PlausibleWeb.SettingsControllerOAuthTest do + use PlausibleWeb.ConnCase, async: true + + alias Plausible.Repo + alias Plausible.OAuth.{AccessToken, Token} + + setup [:create_user, :log_in] + + defp insert_grant(user, opts \\ []) do + {:ok, team} = Plausible.Teams.get_or_create(user) + access = Token.generate(:access) + now = DateTime.utc_now() + + Repo.insert!( + AccessToken.changeset(%{ + access_token_hash: access.hash, + access_token_prefix: access.prefix, + client_id: + Keyword.get(opts, :client_id, "https://claude.ai/oauth/claude-code-client-metadata"), + client_name: Keyword.get(opts, :client_name, "Claude Code"), + scopes: ["stats:read:*", "sites:read:*"], + user_id: user.id, + team_id: team.id, + access_token_expires_at: DateTime.add(now, 3600, :second), + refresh_token_expires_at: DateTime.add(now, 86_400, :second) + }) + ) + end + + describe "GET /settings/security - connected applications" do + test "lists the user's grants with a revoke link", %{conn: conn, user: user} do + grant = insert_grant(user) + + html = conn |> get(Routes.settings_path(conn, :security)) |> html_response(200) + + assert html =~ "Connected applications" + # Human-readable name, with the CIMD URL shown as a secondary line. + assert html =~ "Claude Code" + assert html =~ "https://claude.ai/oauth/claude-code-client-metadata" + assert html =~ Routes.settings_path(conn, :revoke_oauth_connector, grant.id) + end + + test "section is hidden when there are no grants and the flag is off", %{conn: conn} do + html = conn |> get(Routes.settings_path(conn, :security)) |> html_response(200) + refute html =~ "Connected applications" + end + end + + describe "DELETE /settings/security/oauth-connectors/:id" do + test "revokes the grant", %{conn: conn, user: user} do + grant = insert_grant(user) + + conn = delete(conn, Routes.settings_path(conn, :revoke_oauth_connector, grant.id)) + + assert redirected_to(conn) == Routes.settings_path(conn, :security) <> "#oauth-connectors" + assert Plausible.OAuth.list_grants(user) == [] + end + + test "cannot revoke another user's grant", %{conn: conn, user: user} do + other = new_user() + grant = insert_grant(other) + + conn = delete(conn, Routes.settings_path(conn, :revoke_oauth_connector, grant.id)) + + assert Phoenix.Flash.get(conn.assigns.flash, :error) =~ "not found" + assert [_] = Plausible.OAuth.list_grants(other) + # The current user's own list is unaffected. + assert Plausible.OAuth.list_grants(user) == [] + end + end +end diff --git a/test/plausible_web/plugs/authorize_oauth_api_test.exs b/test/plausible_web/plugs/authorize_oauth_api_test.exs new file mode 100644 index 000000000000..1d6982dd349b --- /dev/null +++ b/test/plausible_web/plugs/authorize_oauth_api_test.exs @@ -0,0 +1,146 @@ +defmodule PlausibleWeb.Plugs.AuthorizeOAuthAPITest do + use PlausibleWeb.ConnCase, async: false + + alias PlausibleWeb.Plugs.AuthorizeOAuthAPI + alias Plausible.OAuth + alias Plausible.OAuth.{AccessToken, Token} + alias Plausible.Repo + + @redirect_uri "https://client.example/callback" + @client_id "https://client.example/oauth-metadata" + @resource "https://plausible.example/mcp" + + setup %{conn: conn} do + user = new_user() + {:ok, team} = Plausible.Teams.get_or_create(user) + {:ok, conn: prepare_conn_for_auth(conn), user: user, team: team} + end + + test "halts 401 with a discovery WWW-Authenticate header when no token is provided", %{ + conn: conn + } do + conn = conn |> get("/") |> AuthorizeOAuthAPI.call(nil) + + assert conn.halted + assert json_response(conn, 401)["error"] == "unauthorized" + + [header] = get_resp_header(conn, "www-authenticate") + assert header =~ "Bearer resource_metadata=" + assert header =~ "/.well-known/oauth-protected-resource" + refute header =~ "error=" + end + + test "halts 401 invalid_token for a bogus bearer token", %{conn: conn} do + conn = call_with_token(conn, "not-a-real-token") + + assert conn.halted + assert json_response(conn, 401)["error"] == "invalid_token" + + [header] = get_resp_header(conn, "www-authenticate") + assert header =~ ~s(error="invalid_token") + end + + test "halts 401 invalid_token for an expired token", %{conn: conn, user: user, team: team} do + raw = insert_expired_token(user, team, ["stats:read:*"]) + conn = call_with_token(conn, raw) + + assert conn.halted + assert json_response(conn, 401)["error"] == "invalid_token" + end + + test "passes and assigns the identity + granted scopes for a valid token", %{ + conn: conn, + user: user, + team: team + } do + %{access_token: raw} = issue_tokens(user, team, ["stats:read:*", "sites:read:*"]) + conn = call_with_token(conn, raw) + + refute conn.halted + assert conn.assigns.current_user.id == user.id + assert conn.assigns.current_team.id == team.id + assert conn.assigns.oauth_scopes == ["stats:read:*", "sites:read:*"] + end + + test "stamps last_used_at on the token when it authenticates", %{ + conn: conn, + user: user, + team: team + } do + %{access_token: raw} = issue_tokens(user, team, ["stats:read:*"]) + + refute call_with_token(conn, raw).halted + + assert {:ok, token} = OAuth.find_access_token(raw) + assert token.last_used_at + end + + test "halts 429 when over the burst request limit", %{conn: _conn} do + patch_env(Plausible.Auth.ApiKey, burst_request_limit: 3, burst_period_seconds: 60) + + user = new_user(team: [hourly_api_request_limit: 1_000]) + team = team_of(user) + %{access_token: raw} = issue_tokens(user, team, ["stats:read:*"]) + + limit = Plausible.Auth.ApiKey.burst_request_limit() + + # A fixed-window limiter lets up to `2 * limit` through near a boundary, so + # only the `2 * limit + 1`th request is guaranteed to be throttled. + conns = for _ <- 1..(2 * limit + 1), do: call_with_token(get_fresh_conn(), raw) + + assert throttled = Enum.find(conns, & &1.halted) + assert json_response(throttled, 429)["error"] == "too_many_requests" + end + + defp prepare_conn_for_auth(conn) do + conn + |> put_private(PlausibleWeb.FirstLaunchPlug, :skip) + |> bypass_through(PlausibleWeb.Router) + end + + defp get_fresh_conn(), do: build_conn() |> prepare_conn_for_auth() + + defp call_with_token(conn, token) do + conn + |> put_req_header("authorization", "Bearer #{token}") + |> get("/") + |> AuthorizeOAuthAPI.call(nil) + end + + defp issue_tokens(user, team, scopes) do + verifier = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false) + challenge = :crypto.hash(:sha256, verifier) |> Base.url_encode64(padding: false) + + attrs = %{ + client_id: @client_id, + redirect_uri: @redirect_uri, + code_challenge: challenge, + code_challenge_method: "S256", + scopes: scopes, + resource: @resource + } + + {:ok, raw} = OAuth.create_authorization_code(user, team, attrs) + {:ok, code} = OAuth.consume_authorization_code(raw, verifier, @redirect_uri, @resource) + {:ok, tokens} = OAuth.issue_tokens(code) + tokens + end + + defp insert_expired_token(user, team, scopes) do + access = Token.generate(:access) + + Repo.insert!( + AccessToken.changeset(%{ + access_token_hash: access.hash, + access_token_prefix: access.prefix, + client_id: @client_id, + scopes: scopes, + user_id: user.id, + team_id: team.id, + access_token_expires_at: DateTime.add(DateTime.utc_now(), -60, :second) + }) + ) + + access.raw + end +end diff --git a/test/workers/oauth_cleanup_test.exs b/test/workers/oauth_cleanup_test.exs new file mode 100644 index 000000000000..f5ae24ebd0bb --- /dev/null +++ b/test/workers/oauth_cleanup_test.exs @@ -0,0 +1,45 @@ +defmodule Plausible.Workers.OAuthCleanupTest do + use Plausible.DataCase, async: true + + alias Plausible.OAuth.{AccessToken, AuthorizationCode, Token} + alias Plausible.Workers.OAuthCleanup + + test "purges expired authorization codes and fully-expired tokens" do + user = new_user() + {:ok, team} = Plausible.Teams.get_or_create(user) + now = DateTime.utc_now() + + code = Token.generate(:code) + + Repo.insert!( + AuthorizationCode.changeset(%{ + code_hash: code.hash, + client_id: "https://client.example/meta", + redirect_uri: "https://client.example/cb", + code_challenge: "x", + code_challenge_method: "S256", + user_id: user.id, + team_id: team.id, + expires_at: DateTime.add(now, -60, :second) + }) + ) + + token = Token.generate(:access) + + Repo.insert!( + AccessToken.changeset(%{ + access_token_hash: token.hash, + access_token_prefix: token.prefix, + client_id: "https://client.example/meta", + user_id: user.id, + team_id: team.id, + access_token_expires_at: DateTime.add(now, -120, :second), + refresh_token_expires_at: DateTime.add(now, -60, :second) + }) + ) + + assert :ok = OAuthCleanup.perform(%Oban.Job{}) + assert Repo.aggregate(AuthorizationCode, :count) == 0 + assert Repo.aggregate(AccessToken, :count) == 0 + end +end