Add whitelist mode (#11291)

[mastodon.git] / app / controllers / application_controller.rb

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 61ca71123f0d52ffab27c2c8621430f50d9cc593..0d3913ee07daaa84df486980dfa147dfee0ee4be 100644 (file)
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -5,18 +5,29 @@ class ApplicationController < ActionController::Base
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
 
-  force_ssl if: "Rails.env.production? && ENV['LOCAL_HTTPS'] == 'true'"
+  force_ssl if: :https_enabled?
 
   include Localized
+  include UserTrackingConcern
+  include SessionTrackingConcern
+  include CacheConcern
+  include DomainControlHelper
+
   helper_method :current_account
+  helper_method :current_session
+  helper_method :current_theme
+  helper_method :single_user_mode?
+  helper_method :use_seamless_external_login?
+  helper_method :whitelist_mode?
 
   rescue_from ActionController::RoutingError, with: :not_found
   rescue_from ActiveRecord::RecordNotFound, with: :not_found
   rescue_from ActionController::InvalidAuthenticityToken, with: :unprocessable_entity
+  rescue_from ActionController::UnknownFormat, with: :not_acceptable
+  rescue_from Mastodon::NotPermittedError, with: :forbidden
 
   before_action :store_current_location, except: :raise_not_found, unless: :devise_controller?
-  before_action :set_user_activity
-  before_action :check_suspension, if: :user_signed_in?
+  before_action :require_functional!, if: :user_signed_in?
 
   def raise_not_found
     raise ActionController::RoutingError, "No route matches #{params[:unmatched_route]}"
@@ -24,76 +35,93 @@ class ApplicationController < ActionController::Base
 
   private
 
+  def https_enabled?
+    Rails.env.production?
+  end
+
+  def authorized_fetch_mode?
+    ENV['AUTHORIZED_FETCH'] == 'true' || Rails.configuration.x.whitelist_mode
+  end
+
+  def public_fetch_mode?
+    !authorized_fetch_mode?
+  end
+
   def store_current_location
-    store_location_for(:user, request.url)
+    store_location_for(:user, request.url) unless request.format == :json
   end
 
   def require_admin!
-    redirect_to root_path unless current_user&.admin?
+    forbidden unless current_user&.admin?
   end
 
-  def set_user_activity
-    return unless !current_user.nil? && (current_user.current_sign_in_at.nil? || current_user.current_sign_in_at < 24.hours.ago)
-
-    # Mark user as signed-in today
-    current_user.update_tracked_fields(request)
+  def require_staff!
+    forbidden unless current_user&.staff?
+  end
 
-    # If the sign in is after a two week break, we need to regenerate their feed
-    RegenerationWorker.perform_async(current_user.account_id) if current_user.last_sign_in_at < 14.days.ago
+  def require_functional!
+    redirect_to edit_user_registration_path unless current_user.functional?
   end
 
-  def check_suspension
-    head 403 if current_user.account.suspended?
+  def after_sign_out_path_for(_resource_or_scope)
+    new_user_session_path
   end
 
   protected
 
+  def truthy_param?(key)
+    ActiveModel::Type::Boolean.new.cast(params[key])
+  end
+
+  def forbidden
+    respond_with_error(403)
+  end
+
   def not_found
-    respond_to do |format|
-      format.any  { head 404 }
-      format.html { render 'errors/404', layout: 'error', status: 404 }
-    end
+    respond_with_error(404)
   end
 
   def gone
-    respond_to do |format|
-      format.any  { head 410 }
-      format.html { render 'errors/410', layout: 'error', status: 410 }
-    end
+    respond_with_error(410)
   end
 
   def unprocessable_entity
-    respond_to do |format|
-      format.any  { head 422 }
-      format.html { render 'errors/422', layout: 'error', status: 422 }
-    end
+    respond_with_error(422)
   end
 
-  def current_account
-    @current_account ||= current_user.try(:account)
+  def not_acceptable
+    respond_with_error(406)
   end
 
-  def cache_collection(raw, klass)
-    return raw unless klass.respond_to?(:with_includes)
+  def single_user_mode?
+    @single_user_mode ||= Rails.configuration.x.single_user_mode && Account.where('id > 0').exists?
+  end
 
-    raw                    = raw.cache_ids.to_a if raw.is_a?(ActiveRecord::Relation)
-    uncached_ids           = []
-    cached_keys_with_value = Rails.cache.read_multi(*raw.map(&:cache_key))
+  def use_seamless_external_login?
+    Devise.pam_authentication || Devise.ldap_authentication
+  end
 
-    raw.each do |item|
-      uncached_ids << item.id unless cached_keys_with_value.key?(item.cache_key)
-    end
+  def current_account
+    return @current_account if defined?(@current_account)
 
-    klass.reload_stale_associations!(cached_keys_with_value.values) if klass.respond_to?(:reload_stale_associations!)
+    @current_account = current_user&.account
+  end
 
-    unless uncached_ids.empty?
-      uncached = klass.where(id: uncached_ids).with_includes.map { |item| [item.id, item] }.to_h
+  def current_session
+    return @current_session if defined?(@current_session)
 
-      uncached.values.each do |item|
-        Rails.cache.write(item.cache_key, item)
-      end
-    end
+    @current_session = SessionActivation.find_by(session_id: cookies.signed['_session_id']) if cookies.signed['_session_id'].present?
+  end
 
-    raw.map { |item| cached_keys_with_value[item.cache_key] || uncached[item.id] }.compact
+  def current_theme
+    return Setting.theme unless Themes.instance.names.include? current_user&.setting_theme
+    current_user.setting_theme
+  end
+
+  def respond_with_error(code)
+    respond_to do |format|
+      format.any  { head code }
+      format.html { render "errors/#{code}", layout: 'error', status: code }
+    end
   end
 end