OAuth2: Add approval and verified apps

app/blueprints/api/tokens.py

@@ -72,10 +72,8 @@ def create_edit_token(username, id=None):
 	access_token = None
 	if not is_new:
 		token = APIToken.query.get(id)
-		if token is None:
+		if token is None or token.owner != user:
 			abort(404)
-		elif token.owner != user:
-			abort(403)
 
 		access_token = session.pop("token_" + str(token.id), None)
 

app/blueprints/oauth/__init__.py

@@ -27,7 +27,7 @@ from wtforms.validators import InputRequired, Length
 
 from app import csrf
 from app.blueprints.users.settings import get_setting_tabs
-from app.models import db, OAuthClient, User, Permission, APIToken, AuditSeverity
+from app.models import db, OAuthClient, User, Permission, APIToken, AuditSeverity, UserRank
 from app.utils import random_string, add_audit_log
 
 bp = Blueprint("oauth", __name__)
@@ -63,6 +63,9 @@ def oauth_start():
 	if client.redirect_url != redirect_uri:
 		return "redirect_uri does not match client", 400
 
+	if not client.approved and client.owner != current_user:
+		abort(404)
+
 	scope = request.args.get("scope", "public")
 	if scope != "public":
 		return "Unsupported scope, only public is supported", 400
@@ -189,6 +192,7 @@ def create_edit_client(username, id_=None):
 			client.owner = user
 			client.id = random_string(24)
 			client.secret = random_string(32)
+			client.approved = current_user.rank.atLeast(UserRank.EDITOR)
 
 		form.populate_obj(client)
 

app/models/users.py

@@ -559,9 +559,12 @@ class OAuthClient(db.Model):
 	__tablename__ = "oauth_client"