| 1 | import { |
| 2 | Body, |
| 3 | Controller, |
| 4 | Delete, |
| 5 | Get, |
| 6 | Headers, |
| 7 | HttpCode, |
| 8 | HttpStatus, |
| 9 | Param, |
| 10 | Patch, |
| 11 | Post, |
| 12 | Put, |
| 13 | Query, |
| 14 | Req, |
| 15 | Session, |
| 16 | } from '@nestjs/common'; |
| 17 | import { |
| 18 | ApiBadRequestResponse, |
| 19 | ApiBody, |
| 20 | ApiConsumes, |
| 21 | ApiCreatedResponse, |
| 22 | ApiForbiddenResponse, |
| 23 | ApiNoContentResponse, |
| 24 | ApiNotFoundResponse, |
| 25 | ApiOkResponse, |
| 26 | ApiOperation, |
| 27 | ApiTags, |
| 28 | ApiUnsupportedMediaTypeResponse, |
| 29 | } from '@nestjs/swagger'; |
| 30 | import type { UserSession |
| 31 | import { fromNodeHeaders } |
| 32 | import type { Request |
| 33 | |
| 34 | import { ErrorResponseDTO } |
| 35 | import { UploadAvatarResponseDTO } |
| 36 | import { |
| 37 | AuthorizingOauthAppDTO, |
| 38 | ListAuthorizedOauthAppsResponseDTO, |
| 39 | CreatedOauthAppDTO, |
| 40 | CreateOauthAppDTO, |
| 41 | ListOauthAppsResponseDTO, |
| 42 | OauthAppDTO, |
| 43 | OauthAppSecretDTO, |
| 44 | UpdateOauthAppDTO, |
| 45 | } from './dto/oauth-app.dto.js'; |
| 46 | import { OauthAppsService } |
| 47 | |
| 48 | @ApiTags('OAuth apps') |
| 49 | @Controller('oauth-apps') |
| 50 | export class OauthAppsController |
| 51 | constructor(private readonly |
| 52 | |
| 53 | @Get() |
| 54 | @ApiOperation({ |
| 55 | summary: 'List the OAuth apps the signed-in account registered', |
| 56 | }) |
| 57 | @ApiOkResponse({ type |
| 58 | list(@Session() |
| 59 | return this.apps |
| 60 | } |
| 61 | |
| 62 | @Post() |
| 63 | @ApiOperation({ |
| 64 | summary: 'Register an OAuth app', |
| 65 | description: |
| 66 | 'The response carries the client secret. It is never shown again; rotate it to get a new one.', |
| 67 | }) |
| 68 | @ApiCreatedResponse({ type |
| 69 | @ApiBadRequestResponse({ type |
| 70 | create( |
| 71 | @Session() session |
| 72 | @Body() body |
| 73 | @Req() request |
| 74 | ) { |
| 75 | return this.apps |
| 76 | fromNodeHeaders(request.headers |
| 77 | session.user.id |
| 78 | body, |
| 79 | ); |
| 80 | } |
| 81 | |
| 82 | @Get('authorized' |
| 83 | @ApiOperation({ |
| 84 | summary: 'List the OAuth apps the signed-in account authorized', |
| 85 | }) |
| 86 | @ApiOkResponse({ type |
| 87 | listAuthorized(@Session() |
| 88 | return this.apps |
| 89 | } |
| 90 | |
| 91 | @Delete('authorized/:clientId' |
| 92 | @HttpCode(HttpStatus. |
| 93 | @ApiOperation({ |
| 94 | summary: 'Revoke an OAuth app the signed-in account authorized', |
| 95 | description: |
| 96 | "Its keys for this account stop working, and it asks for consent again next time. Other accounts' keys are untouched.", |
| 97 | }) |
| 98 | @ApiNoContentResponse() |
| 99 | @ApiNotFoundResponse({ type |
| 100 | revokeAuthorized( |
| 101 | @Session() session |
| 102 | @Param('clientId' |
| 103 | ) { |
| 104 | return this.apps |
| 105 | } |
| 106 | |
| 107 | @Get('authorize' |
| 108 | @ApiOperation({ |
| 109 | summary: 'Describe an OAuth app to the user asked to authorize it', |
| 110 | description: |
| 111 | 'Any enabled app, including ones built into Ghost. Never carries the secret.', |
| 112 | }) |
| 113 | @ApiOkResponse({ type |
| 114 | @ApiNotFoundResponse({ type |
| 115 | describe(@Query( |
| 116 | return this.apps |
| 117 | } |
| 118 | |
| 119 | @Get(':clientId' |
| 120 | @ApiOperation({ summary |
| 121 | @ApiOkResponse({ type |
| 122 | @ApiNotFoundResponse({ type |
| 123 | get(@Session() |
| 124 | return this.apps |
| 125 | } |
| 126 | |
| 127 | @Patch(':clientId' |
| 128 | @ApiOperation({ summary |
| 129 | @ApiOkResponse({ type |
| 130 | @ApiBadRequestResponse({ type |
| 131 | @ApiForbiddenResponse({ type |
| 132 | @ApiNotFoundResponse({ type |
| 133 | update( |
| 134 | @Session() session |
| 135 | @Param('clientId' |
| 136 | @Body() body |
| 137 | @Req() request |
| 138 | ) { |
| 139 | return this.apps |
| 140 | fromNodeHeaders(request.headers |
| 141 | session.user.id |
| 142 | clientId, |
| 143 | body, |
| 144 | ); |
| 145 | } |
| 146 | |
| 147 | @Post(':clientId/secret' |
| 148 | @ApiOperation({ |
| 149 | summary: "Replace an OAuth app's client secret", |
| 150 | description: 'The previous secret stops working at once.', |
| 151 | }) |
| 152 | @ApiCreatedResponse({ type |
| 153 | @ApiForbiddenResponse({ type |
| 154 | @ApiNotFoundResponse({ type |
| 155 | rotateSecret( |
| 156 | @Session() session |
| 157 | @Param('clientId' |
| 158 | @Req() request |
| 159 | ) { |
| 160 | return this.apps |
| 161 | fromNodeHeaders(request.headers |
| 162 | session.user.id |
| 163 | clientId, |
| 164 | ); |
| 165 | } |
| 166 | |
| 167 | @Put(':clientId/logo' |
| 168 | @ApiOperation({ |
| 169 | summary: "Upload an OAuth app's logo", |
| 170 | description: |
| 171 | 'Takes the raw image bytes, PNG or JPEG. Users see it when they are asked to authorize the app.', |
| 172 | }) |
| 173 | @ApiConsumes('image/png' |
| 174 | @ApiBody({ schema |
| 175 | @ApiOkResponse({ type |
| 176 | @ApiBadRequestResponse({ type |
| 177 | @ApiForbiddenResponse({ type |
| 178 | @ApiNotFoundResponse({ type |
| 179 | @ApiUnsupportedMediaTypeResponse({ type |
| 180 | setLogo( |
| 181 | @Session() session |
| 182 | @Param('clientId' |
| 183 | @Headers('content-type' |
| 184 | @Req() request |
| 185 | ): Promise<UploadAvatarResponseDTO |
| 186 | return this.apps |
| 187 | session.user.id |
| 188 | clientId, |
| 189 | contentType ?? '', |
| 190 | Buffer.isBuffer(request |
| 191 | ); |
| 192 | } |
| 193 | |
| 194 | @Delete(':clientId/logo' |
| 195 | @HttpCode(HttpStatus. |
| 196 | @ApiOperation({ summary |
| 197 | @ApiNoContentResponse() |
| 198 | @ApiForbiddenResponse({ type |
| 199 | @ApiNotFoundResponse({ type |
| 200 | removeLogo( |
| 201 | @Session() session |
| 202 | @Param('clientId' |
| 203 | ) { |
| 204 | return this.apps |
| 205 | } |
| 206 | |
| 207 | @Delete(':clientId' |
| 208 | @HttpCode(HttpStatus. |
| 209 | @ApiOperation({ |
| 210 | summary: 'Delete an OAuth app', |
| 211 | description: 'Every key the app was issued, for every user, stops working.', |
| 212 | }) |
| 213 | @ApiNoContentResponse() |
| 214 | @ApiForbiddenResponse({ type |
| 215 | @ApiNotFoundResponse({ type |
| 216 | remove( |
| 217 | @Session() session |
| 218 | @Param('clientId' |
| 219 | @Req() request |
| 220 | ) { |
| 221 | return this.apps |
| 222 | fromNodeHeaders(request.headers |
| 223 | session.user.id |
| 224 | clientId, |
| 225 | ); |
| 226 | } |
| 227 | } |
| 228 | |
| 229 | /** An organization's OAuth apps, for its admins. Once an app exists it is managed at `/oauth-apps/:clientId`, like a user's. */ |
| 230 | @ApiTags('OAuth apps') |
| 231 | @Controller('organizations/:slug/oauth-apps') |
| 232 | export class OrganizationOauthAppsController |
| 233 | constructor(private readonly |
| 234 | |
| 235 | @Get() |
| 236 | @ApiOperation({ summary |
| 237 | @ApiOkResponse({ type |
| 238 | @ApiForbiddenResponse({ type |
| 239 | @ApiNotFoundResponse({ type |
| 240 | list(@Session() |
| 241 | return this.apps |
| 242 | } |
| 243 | |
| 244 | @Post() |
| 245 | @ApiOperation({ |
| 246 | summary: 'Register an OAuth app for an organization', |
| 247 | description: |
| 248 | 'The response carries the client secret. It is never shown again; rotate it to get a new one.', |
| 249 | }) |
| 250 | @ApiCreatedResponse({ type |
| 251 | @ApiBadRequestResponse({ type |
| 252 | @ApiForbiddenResponse({ type |
| 253 | @ApiNotFoundResponse({ type |
| 254 | create( |
| 255 | @Session() session |
| 256 | @Param('slug' |
| 257 | @Body() body |
| 258 | @Req() request |
| 259 | ) { |
| 260 | return this.apps |
| 261 | fromNodeHeaders(request.headers |
| 262 | session.user.id |
| 263 | body, |
| 264 | slug, |
| 265 | ); |
| 266 | } |
| 267 | } |