(allura) 16/33: [#8607] check client_id when making bearer token

[br...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch db/8607
in repository https://gitbox.apache.org/repos/asf/allura.git

commit 9a32ca3312f437a5d93d4e66a54c75d5deac6de1
Author: Dave Brondsema <da...@brondsema.net>
AuthorDate: Mon May 18 15:10:49 2026 -0400

    [#8607] check client_id when making bearer token
---
 Allura/allura/controllers/auth.py           |  5 +++++
 Allura/allura/tests/functional/test_auth.py | 33 +++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/Allura/allura/controllers/auth.py b/Allura/allura/controllers/auth.py
index 385cc6c08..0917f19df 100644
--- a/Allura/allura/controllers/auth.py
+++ b/Allura/allura/controllers/auth.py
@@ -1577,6 +1577,11 @@ def generate_bearer_token(self, client_id):
         """
         Manually generates an OAuth2 access token without needing to go through the OAuth2 flow.
         """
+        client = M.OAuth2ClientApp.query.get(client_id=client_id)
+        if client is None or client.user_id != c.user._id:
+            flash('Invalid client ID', 'error')
+            redirect('.')
+
         M.OAuth2AccessToken(
             client_id=client_id,
             user_id=c.user._id,
diff --git a/Allura/allura/tests/functional/test_auth.py b/Allura/allura/tests/functional/test_auth.py
index 31cb3e413..8338a2ecc 100644
--- a/Allura/allura/tests/functional/test_auth.py
+++ b/Allura/allura/tests/functional/test_auth.py
@@ -2586,6 +2586,39 @@ def test_authorization_code_no_duplicates(self, mock_client):
         ac = M.OAuth2AuthorizationCode.query.find(dict(client_id=c.client_id)).all()
         assert len(ac) == 1
 
+    @mock.patch.dict(config, {'auth.oauth2.enabled': True})
+    def test_generate_bearer_token_ownership_check(self):
+        user = M.User.by_username('test-admin')
+        M.OAuth2ClientApp(
+            client_id='client_12345',
+            client_secret='98765',
+            user_id=user._id,
+            name='testoauth2',
+            description='test client',
+            response_type='code',
+            redirect_uris=['https://localhost/']
+        )
+        ThreadLocalODMSession.flush_all()
+
+        self.app.get('/').follow()
+
+        # As test-user (not the owner), should be rejected
+        r = self.app.get('/auth/oauth/')
+        form = [f for f in r.forms.values() if f.action == 'generate_bearer_token'][0]
+        r = form.submit(extra_environ={'username': 'test-user'})
+        assert 'Invalid client ID' in self.webflash(r)
+        assert M.OAuth2AccessToken.query.get(client_id='client_12345') is None
+
+        # As test-admin (the owner), should succeed
+        r = self.app.get('/auth/oauth/')
+        form = [f for f in r.forms.values() if f.action == 'generate_bearer_token'][0]
+        r = form.submit()
+        assert '' == self.webflash(r)
+        token = M.OAuth2AccessToken.query.get(client_id='client_12345')
+        assert token is not None
+        assert token.is_bearer is True
+        assert token.user_id == user._id
+
 
 class TestOAuthRequestToken(TestController):