API: Support OAuth client credentials

diff --git a/doc/API-Mastodon.md b/doc/API-Mastodon.md
index 09cf169e2b7aba8ebf7a4f82f398f901af1fd630..a8566ce60af5021932a5c62e5227bc36801db941 100644 (file)
--- a/doc/API-Mastodon.md
+++ b/doc/API-Mastodon.md
@@ -18,11 +18,11 @@ Supported mobile apps:
 - twitlatte
 - AndStatus
 - Twidere
+- Subway Tooter
 
 Unsupported mobile apps:
 
-- [Subway Tooter](https://github.com/tateisu/SubwayTooter) Uses the wrong grant_type when requesting a token, possibly a problem in the server type detection of the app. See issue https://github.com/tateisu/SubwayTooter/issues/156
-- [Mammut](https://github.com/jamiesanson/Mammut) States that the instance doesn't exist. Most likely an issue in the vitality check of the app, see issue https://github.com/jamiesanson/Mammut/issues/19
+- [Mammut](https://github.com/jamiesanson/Mammut) There are problems with the token request, see issue https://github.com/jamiesanson/Mammut/issues/19
 - [Fedilab](https://framagit.org/tom79/fedilab) Automatically uses the legacy API, see issue: https://framagit.org/tom79/fedilab/-/issues/520
 
 ## Entities

diff --git a/src/Module/OAuth/Token.php b/src/Module/OAuth/Token.php
index 0a1a32b7441167770d0058437c7adf050311f965..c7a81096986317d3ec9d38d413890e454e88163b 100644 (file)
--- a/src/Module/OAuth/Token.php
+++ b/src/Module/OAuth/Token.php
@@ -50,12 +50,7 @@ class Token extends BaseApi
                        }
                }
 
-               if ($grant_type != 'authorization_code') {
-                       Logger::warning('Unsupported or missing grant type', ['request' => $_REQUEST]);
-                       DI::mstdnError()->UnprocessableEntity(DI::l10n()->t('Unsupported or missing grant type'));
-               }
-
-               if (empty($client_id) || empty($client_secret) || empty($redirect_uri)) {
+               if (empty($client_id) || empty($client_secret)) {
                        Logger::warning('Incomplete request data', ['request' => $_REQUEST]);
                        DI::mstdnError()->UnprocessableEntity(DI::l10n()->t('Incomplete request data'));
                }
@@ -65,13 +60,23 @@ class Token extends BaseApi
                        DI::mstdnError()->UnprocessableEntity();
                }
 
-               // For security reasons only allow freshly created tokens
-               $condition = ["`application-id` = ? AND `code` = ? AND `created_at` > UTC_TIMESTAMP() - INTERVAL ? MINUTE", $application['id'], $code, 5];
+               if ($grant_type == 'client_credentials') {
+                       // the "client_credentials" are used as a token for the application itself.
+                       // see https://aaronparecki.com/oauth-2-simplified/#client-credentials
+                       $token = self::createTokenForUser($application, 0, '');
+               } elseif ($grant_type == 'authorization_code') {
+                       // For security reasons only allow freshly created tokens
+                       $condition = ["`redirect_uri` = ? AND `id` = ? AND `code` = ? AND `created_at` > UTC_TIMESTAMP() - INTERVAL ? MINUTE",
+                               $redirect_uri, $application['id'], $code, 5];
 
-               $token = DBA::selectFirst('application-token', ['access_token', 'created_at'], $condition);
-               if (!DBA::isResult($token)) {
-                       Logger::warning('Token not found or outdated', $condition);
-                       DI::mstdnError()->Unauthorized();
+                       $token = DBA::selectFirst('application-view', ['access_token', 'created_at'], $condition);
+                       if (!DBA::isResult($token)) {
+                               Logger::warning('Token not found or outdated', $condition);
+                               DI::mstdnError()->Unauthorized();
+                       }
+               } else {
+                       Logger::warning('Unsupported or missing grant type', ['request' => $_REQUEST]);
+                       DI::mstdnError()->UnprocessableEntity(DI::l10n()->t('Unsupported or missing grant type'));
                }
 
                $object = new \Friendica\Object\Api\Mastodon\Token($token['access_token'], 'Bearer', $application['scopes'], $token['created_at']);