feat: implement private mode (#678)

Webvoid · JPO-Klanik · debounced · web-flow · commit b0ce41a801db · 2024-04-27T10:46:12.000-04:00
Co-authored-by: Julien PONTILLO &lt;jpontillo@klanik.com&gt;
Co-authored-by: debounced &lt;35878315+nobodyatroot@users.noreply.github.com&gt;
Co-authored-by: e-five &lt;146029455+e-five256@users.noreply.github.com&gt;
diff --git a/config/packages/security.yaml b/config/packages/security.yaml
@@ -60,6 +60,55 @@ security:
         # This makes the logout route accessible during two-factor authentication. Allows the user to
         # cancel two-factor authentication, if they need to.
         - { path: ^/logout, role: PUBLIC_ACCESS }
+        # This makes the login form and oauth routes accessible even when private instance is enabled
+        - { path: ^/register, role: PUBLIC_ACCESS }
+        - { path: ^/verify/email, role: PUBLIC_ACCESS }
+        - { path: ^/reset-password, role: PUBLIC_ACCESS }
+        - { path: ^/login, role: PUBLIC_ACCESS }
+        - { path: ^/resend-email-activation, role: PUBLIC_ACCESS }
+        - { path: ^/consent, role: PUBLIC_ACCESS }
+        - { path: ^/oauth, role: PUBLIC_ACCESS }
+        - { path: ^/terms, role: PUBLIC_ACCESS }
+        - { path: ^/privacy-policy, role: PUBLIC_ACCESS }
+        # Allow ActivityPub routes to work publicly
+        - { attributes: { '_route': 'ap_webfinger' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_hostmeta' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_node_info' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_node_info_v2' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_instance' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_instance_front' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_instance_inbox' }, role: PUBLIC_ACCESS }
+        - {
+              attributes: { '_route': 'ap_instance_outbox' },
+              role: PUBLIC_ACCESS,
+          }
+        - { attributes: { '_route': 'ap_shared_inbox' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_object' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_user' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_user_inbox' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_user_outbox' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_user_followers' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_user_following' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_magazine' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_magazine_inbox' }, role: PUBLIC_ACCESS }
+        - {
+              attributes: { '_route': 'ap_magazine_outbox' },
+              role: PUBLIC_ACCESS,
+          }
+        - {
+              attributes: { '_route': 'ap_magazine_followers' },
+              role: PUBLIC_ACCESS,
+          }
+        - {
+              attributes: { '_route': 'ap_magazine_moderators' },
+              role: PUBLIC_ACCESS,
+          }
+        - { attributes: { '_route': 'ap_entry' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_entry_comment' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_post' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_post_comment' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_report' }, role: PUBLIC_ACCESS }
+        - { attributes: { '_route': 'ap_contexts' }, role: PUBLIC_ACCESS }
         # allow custom style route access during two-factor authentication
         # to avoid redirecting (wrongly) to this route after two-factor authentication is completed
         - { path: ^/custom-style, role: PUBLIC_ACCESS }
@@ -71,6 +120,7 @@ security:
         - { path: ^/token, roles: PUBLIC_ACCESS }
         - { path: ^/api/doc, roles: PUBLIC_ACCESS }
         - { path: ^/api/client, roles: PUBLIC_ACCESS }
+        - { path: ^/, roles: PUBLIC_ACCESS_UNLESS_PRIVATE_INSTANCE }
 
     role_hierarchy:
         ROLE_OAUTH2_WRITE:
diff --git a/config/services.yaml b/config/services.yaml
@@ -190,7 +190,6 @@ services:
                   event: kernel.controller,
                   priority: -5,
               }
-        arguments: ["%kbin_federation_enabled%"]
 
     App\EventListener\UserActivityListener:
         tags:
diff --git a/src/DTO/SettingsDto.php b/src/DTO/SettingsDto.php
@@ -29,6 +29,7 @@ public function __construct(
         public bool $KBIN_MERCURE_ENABLED,
         public bool $KBIN_FEDERATION_PAGE_ENABLED,
         public bool $KBIN_ADMIN_ONLY_OAUTH_CLIENTS,
+        public bool $MBIN_PRIVATE_INSTANCE,
         public bool $KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN,
         public bool $MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY,
         public bool $MBIN_SSO_REGISTRATIONS_ENABLED,
@@ -56,6 +57,7 @@ public function mergeIntoDto(SettingsDto $dto): SettingsDto
         $dto->KBIN_MERCURE_ENABLED = $this->KBIN_MERCURE_ENABLED ?? $dto->KBIN_MERCURE_ENABLED;
         $dto->KBIN_FEDERATION_PAGE_ENABLED = $this->KBIN_FEDERATION_PAGE_ENABLED ?? $dto->KBIN_FEDERATION_PAGE_ENABLED;
         $dto->KBIN_ADMIN_ONLY_OAUTH_CLIENTS = $this->KBIN_ADMIN_ONLY_OAUTH_CLIENTS ?? $dto->KBIN_ADMIN_ONLY_OAUTH_CLIENTS;
+        $dto->MBIN_PRIVATE_INSTANCE = $this->MBIN_PRIVATE_INSTANCE ?? $dto->MBIN_PRIVATE_INSTANCE;
         $dto->KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN = $this->KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN ?? $dto->KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN;
         $dto->MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY = $this->MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY ?? $dto->MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY;
         $dto->MBIN_SSO_REGISTRATIONS_ENABLED = $this->MBIN_SSO_REGISTRATIONS_ENABLED ?? $dto->MBIN_SSO_REGISTRATIONS_ENABLED;
@@ -85,6 +87,7 @@ public function jsonSerialize(): mixed
             'KBIN_MERCURE_ENABLED' => $this->KBIN_MERCURE_ENABLED,
             'KBIN_FEDERATION_PAGE_ENABLED' => $this->KBIN_FEDERATION_PAGE_ENABLED,
             'KBIN_ADMIN_ONLY_OAUTH_CLIENTS' => $this->KBIN_ADMIN_ONLY_OAUTH_CLIENTS,
+            'MBIN_PRIVATE_INSTANCE' => $this->MBIN_PRIVATE_INSTANCE,
             'KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN' => $this->KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN,
             'MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY' => $this->MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY,
             'MBIN_SSO_REGISTRATIONS_ENABLED' => $this->MBIN_SSO_REGISTRATIONS_ENABLED,
diff --git a/src/EventListener/FederationStatusListener.php b/src/EventListener/FederationStatusListener.php
@@ -4,18 +4,19 @@
 
 namespace App\EventListener;
 
+use App\Service\SettingsManager;
 use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
 class FederationStatusListener
 {
-    public function __construct(private readonly bool $kbinFederationEnabled)
+    public function __construct(private readonly SettingsManager $settingsManager)
     {
     }
 
     public function onKernelController(ControllerEvent $event)
     {
-        if (!$event->isMainRequest() || $this->kbinFederationEnabled) {
+        if (!$event->isMainRequest() || $this->settingsManager->get('KBIN_FEDERATION_ENABLED')) {
             return;
         }
 
diff --git a/src/Form/SettingsType.php b/src/Form/SettingsType.php
@@ -36,6 +36,7 @@ public function buildForm(FormBuilderInterface $builder, array $options): void
             ->add('KBIN_MERCURE_ENABLED', CheckboxType::class, ['required' => false])
             ->add('KBIN_FEDERATION_PAGE_ENABLED', CheckboxType::class, ['required' => false])
             ->add('KBIN_ADMIN_ONLY_OAUTH_CLIENTS', CheckboxType::class, ['required' => false])
+            ->add('MBIN_PRIVATE_INSTANCE', CheckboxType::class, ['required' => false])
             ->add('KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN', CheckboxType::class, ['required' => false])
             ->add('MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY', CheckboxType::class, ['required' => false])
             ->add('MBIN_RESTRICT_MAGAZINE_CREATION', CheckboxType::class, ['required' => false])
diff --git a/src/Security/Voter/PrivateInstanceVoter.php b/src/Security/Voter/PrivateInstanceVoter.php
@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Security\Voter;
+
+use App\Entity\User;
+use App\Service\SettingsManager;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+
+class PrivateInstanceVoter extends Voter
+{
+    public function __construct(private SettingsManager $settingsManager)
+    {
+    }
+
+    protected function supports(string $attribute, $subject): bool
+    {
+        return 'PUBLIC_ACCESS_UNLESS_PRIVATE_INSTANCE' === $attribute;
+    }
+
+    protected function voteOnAttribute(string $attribute, $subject, TokenInterface $token): bool
+    {
+        if ($this->settingsManager->get('MBIN_PRIVATE_INSTANCE')) {
+            $user = $token->getUser();
+
+            if (!$user instanceof User) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
diff --git a/src/Service/SettingsManager.php b/src/Service/SettingsManager.php
@@ -64,6 +64,7 @@ public function __construct(
                 $this->find($results, 'KBIN_MERCURE_ENABLED', FILTER_VALIDATE_BOOLEAN) ?? true,
                 $this->find($results, 'KBIN_FEDERATION_PAGE_ENABLED', FILTER_VALIDATE_BOOLEAN) ?? $this->kbinFederationPageEnabled,
                 $this->find($results, 'KBIN_ADMIN_ONLY_OAUTH_CLIENTS', FILTER_VALIDATE_BOOLEAN) ?? $this->kbinAdminOnlyOauthClients,
+                $this->find($results, 'MBIN_PRIVATE_INSTANCE', FILTER_VALIDATE_BOOLEAN) ?? false,
                 $this->find($results, 'KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN', FILTER_VALIDATE_BOOLEAN) ?? true,
                 $this->find($results, 'MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY', FILTER_VALIDATE_BOOLEAN) ?? false,
                 $this->find($results, 'MBIN_SSO_REGISTRATIONS_ENABLED', FILTER_VALIDATE_BOOLEAN) ?? true,
diff --git a/src/Twig/Extension/SettingsExtension.php b/src/Twig/Extension/SettingsExtension.php
@@ -28,6 +28,7 @@ public function getFunctions(): array
             new TwigFunction('kbin_federation_page_enabled', [SettingsExtensionRuntime::class, 'kbinFederationPageEnabled']),
             new TwigFunction('mbin_current_version', [SettingsExtensionRuntime::class, 'mbinCurrentVersion']),
             new TwigFunction('mbin_restrict_magazine_creation', [SettingsExtensionRuntime::class, 'mbinRestrictMagazineCreation']),
+            new TwigFunction('mbin_private_instance', [SettingsExtensionRuntime::class, 'mbinPrivateInstance']),
         ];
     }
 }
diff --git a/src/Twig/Runtime/SettingsExtensionRuntime.php b/src/Twig/Runtime/SettingsExtensionRuntime.php
@@ -103,4 +103,9 @@ public function mbinRestrictMagazineCreation(): bool
     {
         return $this->settings->get('MBIN_RESTRICT_MAGAZINE_CREATION');
     }
+
+    public function mbinPrivateInstance(): bool
+    {
+        return $this->settings->get('MBIN_PRIVATE_INSTANCE');
+    }
 }
diff --git a/templates/admin/settings.html.twig b/templates/admin/settings.html.twig
@@ -63,6 +63,10 @@
                 {{ form_label(form.KBIN_ADMIN_ONLY_OAUTH_CLIENTS, 'restrict_oauth_clients') }}
                 {{ form_widget(form.KBIN_ADMIN_ONLY_OAUTH_CLIENTS) }}
             </div>
+            <div class="checkbox">
+                {{ form_label(form.MBIN_PRIVATE_INSTANCE, 'private_instance') }}
+                {{ form_widget(form.MBIN_PRIVATE_INSTANCE) }}
+            </div>
             <div class="checkbox">
                 {{ form_label(form.KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN, 'federated_search_only_loggedin') }}
                 {{ form_widget(form.KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN) }}
diff --git a/templates/base.html.twig b/templates/base.html.twig
@@ -80,11 +80,13 @@
               class="{{ html_classes({'view-compact': COMPACT is same as V_TRUE}) }}">
             {% block body %}{% endblock %}
         </main>
-        <aside id="sidebar">
-            {% block sidebar %}
-                {% include 'layout/_sidebar.html.twig' with {sidebar_top: block('sidebar_top'), header_nav: block('header_nav')} %}
-            {% endblock %}
-        </aside>
+        {% if not mbin_private_instance() or (mbin_private_instance() and app.user is defined and app.user is not same as null) %}
+            <aside id="sidebar">
+                {% block sidebar %}
+                    {% include 'layout/_sidebar.html.twig' with {sidebar_top: block('sidebar_top'), header_nav: block('header_nav')} %}
+                {% endblock %}
+            </aside>
+        {% endif %}
         {% if app.user is defined and app.user is not same as null and
             SUBSCRIPTIONS_SHOW is not same as V_FALSE and
             SUBSCRIPTIONS_SEPARATE is same as V_TRUE
diff --git a/tests/Functional/Controller/Api/Instance/Admin/InstanceSettingsRetrieveApiTest.php b/tests/Functional/Controller/Api/Instance/Admin/InstanceSettingsRetrieveApiTest.php
@@ -27,6 +27,7 @@ class InstanceSettingsRetrieveApiTest extends WebTestCase
         'KBIN_MERCURE_ENABLED',
         'KBIN_FEDERATION_PAGE_ENABLED',
         'KBIN_ADMIN_ONLY_OAUTH_CLIENTS',
+        'MBIN_PRIVATE_INSTANCE',
         'KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN',
         'MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY',
         'MBIN_SSO_REGISTRATIONS_ENABLED',
diff --git a/tests/Functional/Controller/Api/Instance/Admin/InstanceSettingsUpdateApiTest.php b/tests/Functional/Controller/Api/Instance/Admin/InstanceSettingsUpdateApiTest.php
@@ -27,6 +27,7 @@ class InstanceSettingsUpdateApiTest extends WebTestCase
         'KBIN_MERCURE_ENABLED',
         'KBIN_FEDERATION_PAGE_ENABLED',
         'KBIN_ADMIN_ONLY_OAUTH_CLIENTS',
+        'MBIN_PRIVATE_INSTANCE',
         'KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN',
         'MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY',
         'MBIN_SSO_REGISTRATIONS_ENABLED',
@@ -104,6 +105,7 @@ public function testApiCanUpdateInstanceSettings(): void
             'KBIN_MERCURE_ENABLED' => false,
             'KBIN_FEDERATION_PAGE_ENABLED' => false,
             'KBIN_ADMIN_ONLY_OAUTH_CLIENTS' => true,
+            'MBIN_PRIVATE_INSTANCE' => true,
             'KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN' => false,
             'MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY' => false,
             'MBIN_SSO_REGISTRATIONS_ENABLED' => true,
@@ -139,6 +141,7 @@ public function testApiCanUpdateInstanceSettings(): void
             'KBIN_MERCURE_ENABLED' => true,
             'KBIN_FEDERATION_PAGE_ENABLED' => true,
             'KBIN_ADMIN_ONLY_OAUTH_CLIENTS' => false,
+            'MBIN_PRIVATE_INSTANCE' => false,
             'KBIN_FEDERATED_SEARCH_ONLY_LOGGEDIN' => true,
             'MBIN_SIDEBAR_SECTIONS_LOCAL_ONLY' => true,
             'MBIN_SSO_REGISTRATIONS_ENABLED' => false,
diff --git a/translations/messages.en.yaml b/translations/messages.en.yaml
@@ -483,6 +483,7 @@ oauth.client_identifier.invalid: Invalid OAuth Client ID!
 oauth.client_not_granted_message_read_permission: This app has not received permission
   to read your messages.
 restrict_oauth_clients: Restrict OAuth2 Client creation to Admins
+private_instance: Force users to login before they can access any content
 block: Block
 unblock: Unblock
 oauth2.grant.moderate.magazine.ban.delete: Unban users in your moderated magazines.

Original file line number	Diff line number	Diff line change
`@@ -190,7 +190,6 @@ services:`
`190`	`190`	`event: kernel.controller,`
`191`	`191`	`priority: -5,`
`192`	`192`	`}`
`193`		`- arguments: ["%kbin_federation_enabled%"]`
`194`	`193`
`195`	`194`	`App\EventListener\UserActivityListener:`
`196`	`195`	`tags:`
Original file line number	Diff line number	Diff line change
`@@ -4,18 +4,19 @@`
`4`	`4`
`5`	`5`	`namespace App\EventListener;`
`6`	`6`
	`7`	`+use App\Service\SettingsManager;`
`7`	`8`	`use Symfony\Component\HttpKernel\Event\ControllerEvent;`
`8`	`9`	`use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;`
`9`	`10`
`10`	`11`	`class FederationStatusListener`
`11`	`12`	`{`
`12`		`- public function __construct(private readonly bool $kbinFederationEnabled)`
	`13`	`+ public function __construct(private readonly SettingsManager $settingsManager)`
`13`	`14`	`{`
`14`	`15`	`}`
`15`	`16`
`16`	`17`	`public function onKernelController(ControllerEvent $event)`
`17`	`18`	`{`
`18`		`- if (!$event->isMainRequest() \|\| $this->kbinFederationEnabled) {`
	`19`	`+ if (!$event->isMainRequest() \|\| $this->settingsManager->get('KBIN_FEDERATION_ENABLED')) {`
`19`	`20`	`return;`
`20`	`21`	`}`
`21`	`22`
Original file line number	Diff line number	Diff line change
`@@ -28,6 +28,7 @@ public function getFunctions(): array`
`28`	`28`	`new TwigFunction('kbin_federation_page_enabled', [SettingsExtensionRuntime::class, 'kbinFederationPageEnabled']),`
`29`	`29`	`new TwigFunction('mbin_current_version', [SettingsExtensionRuntime::class, 'mbinCurrentVersion']),`
`30`	`30`	`new TwigFunction('mbin_restrict_magazine_creation', [SettingsExtensionRuntime::class, 'mbinRestrictMagazineCreation']),`
	`31`	`+ new TwigFunction('mbin_private_instance', [SettingsExtensionRuntime::class, 'mbinPrivateInstance']),`
`31`	`32`	`];`
`32`	`33`	`}`
`33`	`34`	`}`
Original file line number	Diff line number	Diff line change
`@@ -103,4 +103,9 @@ public function mbinRestrictMagazineCreation(): bool`
`103`	`103`	`{`
`104`	`104`	`return $this->settings->get('MBIN_RESTRICT_MAGAZINE_CREATION');`
`105`	`105`	`}`
	`106`	`+`
	`107`	`+ public function mbinPrivateInstance(): bool`
	`108`	`+ {`
	`109`	`+ return $this->settings->get('MBIN_PRIVATE_INSTANCE');`
	`110`	`+ }`
`106`	`111`	`}`