5d2fc6de32
* Add REST API for creating an account The method is available to apps with a token obtained via the client credentials grant. It creates a user and account records, as well as an access token for the app that initiated the request. The user is unconfirmed, and an e-mail is sent as usual. The method returns the access token, which the app should save for later. The REST API is not available to users with unconfirmed accounts, so the app must be smart to wait for the user to click a link in their e-mail inbox. The method is rate-limited by IP to 5 requests per 30 minutes. * Redirect users back to app from confirmation if they were created with an app * Add tests * Return 403 on the method if registrations are not open * Require agreement param to be true in the API when creating an account
88 lines
2.4 KiB
Ruby
88 lines
2.4 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
class Api::BaseController < ApplicationController
|
|
DEFAULT_STATUSES_LIMIT = 20
|
|
DEFAULT_ACCOUNTS_LIMIT = 40
|
|
|
|
include RateLimitHeaders
|
|
|
|
skip_before_action :store_current_location
|
|
skip_before_action :check_user_permissions
|
|
|
|
protect_from_forgery with: :null_session
|
|
|
|
rescue_from ActiveRecord::RecordInvalid, Mastodon::ValidationError do |e|
|
|
render json: { error: e.to_s }, status: 422
|
|
end
|
|
|
|
rescue_from ActiveRecord::RecordNotFound do
|
|
render json: { error: 'Record not found' }, status: 404
|
|
end
|
|
|
|
rescue_from HTTP::Error, Mastodon::UnexpectedResponseError do
|
|
render json: { error: 'Remote data could not be fetched' }, status: 503
|
|
end
|
|
|
|
rescue_from OpenSSL::SSL::SSLError do
|
|
render json: { error: 'Remote SSL certificate could not be verified' }, status: 503
|
|
end
|
|
|
|
rescue_from Mastodon::NotPermittedError do
|
|
render json: { error: 'This action is not allowed' }, status: 403
|
|
end
|
|
|
|
def doorkeeper_unauthorized_render_options(error: nil)
|
|
{ json: { error: (error.try(:description) || 'Not authorized') } }
|
|
end
|
|
|
|
def doorkeeper_forbidden_render_options(*)
|
|
{ json: { error: 'This action is outside the authorized scopes' } }
|
|
end
|
|
|
|
protected
|
|
|
|
def set_pagination_headers(next_path = nil, prev_path = nil)
|
|
links = []
|
|
links << [next_path, [%w(rel next)]] if next_path
|
|
links << [prev_path, [%w(rel prev)]] if prev_path
|
|
response.headers['Link'] = LinkHeader.new(links) unless links.empty?
|
|
end
|
|
|
|
def limit_param(default_limit)
|
|
return default_limit unless params[:limit]
|
|
[params[:limit].to_i.abs, default_limit * 2].min
|
|
end
|
|
|
|
def params_slice(*keys)
|
|
params.slice(*keys).permit(*keys)
|
|
end
|
|
|
|
def current_resource_owner
|
|
@current_user ||= User.find(doorkeeper_token.resource_owner_id) if doorkeeper_token
|
|
end
|
|
|
|
def current_user
|
|
current_resource_owner || super
|
|
rescue ActiveRecord::RecordNotFound
|
|
nil
|
|
end
|
|
|
|
def require_user!
|
|
if current_user && !current_user.disabled? && current_user.confirmed?
|
|
set_user_activity
|
|
elsif current_user
|
|
render json: { error: 'Your login is currently disabled' }, status: 403
|
|
else
|
|
render json: { error: 'This method requires an authenticated user' }, status: 422
|
|
end
|
|
end
|
|
|
|
def render_empty
|
|
render json: {}, status: 200
|
|
end
|
|
|
|
def authorize_if_got_token!(*scopes)
|
|
doorkeeper_authorize!(*scopes) if doorkeeper_token
|
|
end
|
|
end
|