Changeset 49276

Timestamp:

10/22/2020 03:04:23 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

App Passwords: Support an app_id to uniquely identify instances of an app.

Apps may now optionally include an app_id parameter when directing the user to the Authorize Application screen. This allows for instances of an application to be identified and potentially revoked or blocked.

Props TimothyBlynJacobs, georgestephanis.
Fixes #51583.

Location:

trunk

Files:

• src/js/_enqueues/admin/auth-app.js (modified) (2 diffs)
• src/wp-admin/authorize-application.php (modified) (5 diffs)
• src/wp-admin/includes/user.php (modified) (2 diffs)
• src/wp-includes/class-wp-application-passwords.php (modified) (1 diff)
• src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php (modified) (3 diffs)
• tests/phpunit/tests/rest-api/rest-application-passwords-controller.php (modified) (7 diffs)
• tests/qunit/fixtures/wp-api-generated.js (modified) (2 diffs)

trunk/src/js/_enqueues/admin/auth-app.js

@@ -17 +17 @@
 
     $approveBtn.click( function( e ) {
-        var name = $appNameField.val();
+        var name = $appNameField.val(),
+            appId = $( 'input[name="app_id"]', $form ).val();
 
         e.preventDefault();
@@ -32 +33 @@
             name: name
         };
+
+        if ( appId.length > 0 ) {
+            request.app_id = appId;
+        }
 
         /**

trunk/src/wp-admin/authorize-application.php

@@ -19 +19 @@
     $reject_url  = $_POST['reject_url'];
     $app_name    = $_POST['app_name'];
+    $app_id      = $_POST['app_id'];
     $redirect    = '';
 
@@ -28 +29 @@
         }
     } elseif ( isset( $_POST['approve'] ) ) {
-        $created = WP_Application_Passwords::create_new_application_password( get_current_user_id(), array( 'name' => $app_name ) );
+        $created = WP_Application_Passwords::create_new_application_password(
+            get_current_user_id(),
+            array(
+                'name'   => $app_name,
+                'app_id' => $app_id,
+            )
+        );
 
         if ( is_wp_error( $created ) ) {
@@ -57 +64 @@
 
 $app_name    = ! empty( $_REQUEST['app_name'] ) ? $_REQUEST['app_name'] : '';
+$app_id      = ! empty( $_REQUEST['app_id'] ) ? $_REQUEST['app_id'] : '';
 $success_url = ! empty( $_REQUEST['success_url'] ) ? $_REQUEST['success_url'] : null;
 
@@ -69 +77 @@
 $user = wp_get_current_user();
 
-$request  = compact( 'app_name', 'success_url', 'reject_url' );
+$request  = compact( 'app_name', 'app_id', 'success_url', 'reject_url' );
 $is_valid = wp_is_authorize_application_password_request_valid( $request, $user );
 
@@ -184 +192 @@
                 <?php wp_nonce_field( 'authorize_application_password' ); ?>
                 <input type="hidden" name="action" value="authorize_application_password" />
+                <input type="hidden" name="app_id" value="<?php echo esc_attr( $app_id ); ?>" />
                 <input type="hidden" name="success_url" value="<?php echo esc_url( $success_url ); ?>" />
                 <input type="hidden" name="reject_url" value="<?php echo esc_url( $reject_url ); ?>" />

trunk/src/wp-admin/includes/user.php

@@ -605 +605 @@
  *
  *     @type string $app_name    The suggested name of the application.
+ *     @type string $app_id      A uuid provided by the application to uniquely identify it.
  *     @type string $success_url The url the user will be redirected to after approving the application.
  *     @type string $reject_url  The url the user will be redirected to after rejecting the application.
@@ -636 +637 @@
     }
 
+    if ( ! empty( $request['app_id'] ) && ! wp_is_uuid( $request['app_id'] ) ) {
+        $error->add(
+            'invalid_app_id',
+            __( 'The app id must be a uuid.' )
+        );
+    }
+
     /**
      * Fires before application password errors are returned.

trunk/src/wp-includes/class-wp-application-passwords.php

@@ -52 +52 @@
         $new_item = array(
             'uuid'      => wp_generate_uuid4(),
+            'app_id'    => empty( $args['app_id'] ) ? '' : $args['app_id'],
             'name'      => $args['name'],
             'password'  => $hashed_password,

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-application-passwords-controller.php

@@ -413 +413 @@
         );
 
+        if ( $request['app_id'] && ! $request['uuid'] ) {
+            $prepared->app_id = $request['app_id'];
+        }
+
         /**
          * Filters an application password before it is inserted via the REST API.
@@ -442 +446 @@
         $prepared = array(
             'uuid'      => $item['uuid'],
+            'app_id'    => empty( $item['app_id'] ) ? '' : $item['app_id'],
             'name'      => $item['name'],
             'created'   => gmdate( 'Y-m-d\TH:i:s', $item['created'] ),
@@ -616 +621 @@
                     'readonly'    => true,
                 ),
+                'app_id'    => array(
+                    'description' => __( 'A uuid provided by the application to uniquely identify it. It is recommended to use an UUID v5 with the URL or DNS namespace.' ),
+                    'type'        => 'string',
+                    'format'      => 'uuid',
+                    'context'     => array( 'view', 'edit', 'embed' ),
+                ),
                 'name'      => array(
                     'description' => __( 'The name of the application password.' ),

trunk/tests/phpunit/tests/rest-api/rest-application-passwords-controller.php

@@ -309 +309 @@
         wp_set_current_user( self::$admin );
 
+        $app_id  = wp_generate_uuid4();
         $request = new WP_REST_Request( 'POST', '/wp/v2/users/me/application-passwords' );
-        $request->set_body_params( array( 'name' => 'App' ) );
+        $request->set_body_params(
+            array(
+                'name'   => 'App',
+                'app_id' => $app_id,
+            )
+        );
         $response = rest_do_request( $request );
 
@@ -319 +325 @@
         $this->check_response( $response->get_data(), $passwords[0], true );
         $this->assertEquals( 'App', $response->get_data()['name'] );
+        $this->assertEquals( $app_id, $response->get_data()['app_id'] );
         $this->assertNull( $response->get_data()['last_used'] );
         $this->assertNull( $response->get_data()['last_ip'] );
@@ -512 +519 @@
         $response = rest_do_request( $request );
         $this->assertErrorResponse( 'rest_application_password_not_found', $response, 404 );
+    }
+
+    /**
+     * @ticket 51583
+     */
+    public function test_update_item_cannot_overwrite_app_id() {
+        wp_set_current_user( self::$admin );
+        list( , $item ) = WP_Application_Passwords::create_new_application_password( self::$admin, array( 'name' => 'App' ) );
+
+        $uuid    = $item['uuid'];
+        $request = new WP_REST_Request( 'PUT', '/wp/v2/users/me/application-passwords/' . $uuid );
+        $request->set_body_params( array( 'app_id' => wp_generate_uuid4() ) );
+        $response = rest_do_request( $request );
+        $this->assertEquals( '', $response->get_data()['app_id'] );
+
+        $app_id = wp_generate_uuid4();
+
+        list( , $item ) = WP_Application_Passwords::create_new_application_password(
+            self::$admin,
+            array(
+                'name'   => 'App',
+                'app_id' => $app_id,
+            )
+        );
+
+        $uuid    = $item['uuid'];
+        $request = new WP_REST_Request( 'PUT', '/wp/v2/users/me/application-passwords/' . $uuid );
+        $request->set_body_params( array( 'app_id' => wp_generate_uuid4() ) );
+        $response = rest_do_request( $request );
+        $this->assertEquals( $app_id, $response->get_data()['app_id'] );
     }
 
@@ -776 +813 @@
     protected function check_response( $response, $item, $password = false ) {
         $this->assertArrayHasKey( 'uuid', $response );
+        $this->assertArrayHasKey( 'app_id', $response );
         $this->assertArrayHasKey( 'name', $response );
         $this->assertArrayHasKey( 'created', $response );
@@ -782 +820 @@
 
         $this->assertEquals( $item['uuid'], $response['uuid'] );
+        $this->assertEquals( $item['app_id'], $response['app_id'] );
         $this->assertEquals( $item['name'], $response['name'] );
         $this->assertEquals( gmdate( 'Y-m-d\TH:i:s', $item['created'] ), $response['created'] );
@@ -813 +852 @@
         $properties = $data['schema']['properties'];
 
-        $this->assertCount( 6, $properties );
         $this->assertArrayHasKey( 'uuid', $properties );
+        $this->assertArrayHasKey( 'app_id', $properties );
         $this->assertArrayHasKey( 'name', $properties );
         $this->assertArrayHasKey( 'password', $properties );
@@ -820 +859 @@
         $this->assertArrayHasKey( 'last_used', $properties );
         $this->assertArrayHasKey( 'last_ip', $properties );
+        $this->assertCount( 7, $properties );
     }
 }

trunk/tests/qunit/fixtures/wp-api-generated.js

@@ -4918 +4918 @@
                     ],
                     "args": {
+                        "app_id": {
+                            "description": "A machine-readable string provided by the application to uniquely identify it.",
+                            "type": "string",
+                            "required": false
+                        },
                         "name": {
                             "description": "The name of the application password.",
@@ -4968 +4973 @@
                     ],
                     "args": {
+                        "app_id": {
+                            "description": "A machine-readable string provided by the application to uniquely identify it.",
+                            "type": "string",
+                            "required": false
+                        },
                         "name": {
                             "description": "The name of the application password.",