Commit graph

292 commits

Author SHA1 Message Date
Tommie Gannert dba1965c8b Fix two lint errors. 2022-06-08 09:40:11 +02:00
Tommie Gannert 4da104c5c3 Merge remote-tracking branch 'origin/main' into loginsso 2022-06-08 09:24:56 +02:00
Tommie Gannert 4362422a6d Fix two lint errors. 2022-06-08 09:24:08 +02:00
Tommie Gannert 210ab1eef6 Add SSO tests.
Renames cookie oidc_nonce to sso_nonce, since it's defined in a file
that doesn't know about OIDC specifically.
2022-06-08 09:14:11 +02:00
Neil Alexander 6d4bd5d890
Rate limiting changes (#2519)
* Rate limiting changes

This makes the following changes:

* For logged in users, the rate limiting now applies to the device session rather than the remote IP address;
* For non-logged in users, the rate limiting continues to apply to remote address as it does today;
* It is now possible to add user IDs to the `exempt_user_ids` option under `rate_limiting` to exclude bots from rate limiting;
* Admin and appservice users are now exempt from rate limiting by default.

* Fix build with media API
2022-06-07 14:24:04 +01:00
Till 3e9c734da5
Make setting state idempotent (#2512)
* Make Setting state twice is idempotent pass

* Add passing tests

* PR comment & comments
2022-06-03 06:43:51 +02:00
Neil Alexander ea16614f71
Update versions 2022-06-01 09:39:17 +01:00
Tommie Gannert b8844fb1e2 Fix a lint warning. 2022-05-27 23:08:53 +02:00
Tommie Gannert ffa527340a Fix a lint error. 2022-05-27 23:00:44 +02:00
Tommie Gannert f814f9bdf1 Fall back to numeric localpart if there is no suggested username.
Fixes https://github.com/matrix-org/dendrite/issues/2498.
2022-05-27 22:29:20 +02:00
Tommie Gannert 09f0dca6aa Refactor SSO configuration.
It makes more sense to base provider defaults on brand. Type is not
1:1 to brand.

Splits apart OIDC and OAuth2 to match actual specs.
2022-05-27 22:15:52 +02:00
Tommie Gannert d351a48379 Fix a golangci-lint issue. 2022-05-27 19:37:41 +02:00
Tommie Gannert ac706be242 Improve error reporting for OAuth2 SSO requests. 2022-05-27 19:30:05 +02:00
Tommie Gannert 6663882cf2 Fix OAuth2 user info credentials and add HTTP error handling. 2022-05-27 18:09:41 +02:00
Tommie Gannert 43bac75c5f Fix callback URL building in SSOCallback.
It ended up without scheme and host. Do what SSORedirect does instead.
2022-05-27 12:31:38 +02:00
Tommie Gannert 618e18f259 Change cookie oidc_nonce to SameSite=None.
https://github.com/matrix-org/dendrite/issues/1297#issuecomment-1139357227
2022-05-27 09:58:31 +02:00
Tommie Gannert 46b4abd4cf golangci-lint fixes. 2022-05-25 19:05:16 +02:00
Tommie Gannert 6de730b2ee Fixes for SSO.
* Verbose logging.
* Cookie needs a path.
* Configurable callback URL.
* Various sanity checks.
2022-05-25 18:33:11 +02:00
Neil Alexander 81843e8836
Restricted join support on /make_join, /send_join (#2478)
* Add `QueryRestrictedJoinAllowed`

* Add `Resident` flag to `QueryRestrictedJoinAllowedResponse`

* Check restricted joins on federation API

* Return `Restricted` to determine if the room was restricted or not

* Populate `AuthorisedVia` properly

* Sign the event on `/send_join`, return it in the `/send_join` response in the `"event"` key

* Kick back joins with invalid authorising user IDs, use event from `"event"` key if returned in `RespSendJoin`

* Use invite helper in `QueryRestrictedJoinAllowed`

* Only use users with the power to invite, change error bubbling a bit

* Placate the almighty linter

One day I will nuke `gocyclo` from orbit and everything in the world will be much better for it.

* Review comments
2022-05-25 10:05:30 +01:00
Tommie Gannert 58233c790a Split SSO into OAuth2 and OIDC. Add OIDC discovery.
GitHub implements OAuth2, but not OpenID Connect.

This means it needs more magic constants than those that can do OIDC
discovery (and where Userinfo is in OIDC-compatible.)

Fixes the HTTP client to have a timeout.
2022-05-25 01:17:08 +02:00
Neil Alexander ead0112aa1
Fix join_authorised_via_users_server key name in SendEvent 2022-05-24 10:22:26 +01:00
Neil Alexander 7379b02b70
Give PL100 to invited users in trusted_private_chat preset (#2485) 2022-05-24 10:10:25 +01:00
Neil Alexander c83837e684
Strip join_authorised_by_users_server when updating membership events using /rooms/{roomID}/state (#2482) 2022-05-24 09:11:23 +01:00
Tommie Gannert a6b13a703d Add automatic registration of SSO accounts. 2022-05-23 18:16:54 +02:00
Tommie Gannert 03cf5a5c08 Replace ThreePID lookups with the new SSO lookups. 2022-05-23 17:55:38 +02:00
Tommie Gannert c1c2a0448c Disable m.login.token if there are no enabled login methods to use it. 2022-05-23 16:25:29 +02:00
Tommie Gannert 43989aa017 Support for m.login.sso.
This is forked from @anandv96's #1374. Closes #1297.
2022-05-23 16:25:29 +02:00
Till a53c9300aa
Fix /deactivate (#2474)
* Fix /deactivate

* Update test to correctly check the expected response
2022-05-20 13:27:11 +02:00
kegsay c15bfefd0d
Add RoomExists flag to QueryMembershipForUser (#2450)
Fixes https://github.com/matrix-org/complement/pull/369
2022-05-11 11:29:23 +01:00
Neil Alexander 77722c5a4f
Back out matrix-org/dendrite#2421 by restoring http.Clients
This creates problems with non-HTTPS endpoints and should fix #2444.
2022-05-10 11:08:10 +01:00
Neil Alexander 09d754cfbf
One NATS instance per BaseDendrite (#2438)
* One NATS instance per `BaseDendrite`

* Fix roomserver
2022-05-09 14:15:24 +01:00
kegsay 85704eff20
Clean up interface definitions (#2427)
* tidy up interfaces

* remove unused GetCreatorIDForAlias

* Add RoomserverUserAPI interface

* Define more interfaces

* Use AppServiceInternalAPI for consistent naming

* clean up federationapi constructor a bit

* Fix monolith in -http mode
2022-05-06 12:39:26 +01:00
kegsay 9957752a9d
Define component interfaces based on consumers (2/2) (#2425)
* convert remaining interfaces

* Tidy up the userapi interfaces
2022-05-05 19:30:38 +01:00
kegsay 506de4bb3d
Define component interfaces based on consumers (1/2) (#2423)
* Specify interfaces used by appservice, do half of clientapi

* convert more deps of clientapi to finer-grained interfaces

* Convert mediaapi and rest of clientapi

* Somehow this got missed
2022-05-05 13:17:38 +01:00
Neil Alexander d9e71b93b6
Use gomatrixserverlib.Client instead of http.Client (#2421)
* Update to matrix-org/gomatrixserverlib#303

* Use `gomatrixserverlib.Client` for phone-home stats

* Use `gomatrixserverlib.Client` for push notifications

* Use `gomatrixserverlib.Client` for appservices

* Use `gomatrixserverlib.Client` for three-PID invites
2022-05-05 11:33:16 +01:00
Till 1bfe87aa56
Fix user already joined when using server notices (#2364) 2022-05-05 12:01:28 +02:00
kegsay d86dcbef66
syncapi: define specific interfaces for internal HTTP communications (#2416)
* syncapi: use finer-grained interfaces when making the syncapi

* Use specific interfaces for syncapi-roomserver interactions

* Define query access token api for shared http auth code
2022-05-05 09:56:03 +01:00
Neil Alexander dd061a172e
Tidy up AddPublicRoutes (#2412)
* Simplify federation API `AddPublicRoutes`

* Simplify client API `AddPublicRoutes`

* Simplify media API `AddPublicRoutes`

* Simplify sync API `AddPublicRoutes`

* Simplify `AddAllPublicRoutes`
2022-05-03 17:17:02 +01:00
Neil Alexander 2a4517f8e6
Move admin functions into their own file in the client API 2022-04-29 09:10:08 +01:00
Neil Alexander c6ea2c9ff2
Add /_dendrite/admin/evacuateRoom/{roomID} (#2401)
* Add new endpoint to allow admins to evacuate the local server from the room

* Guard endpoint

* Use right prefix

* Auth API

* More useful return error rather than a panic

* More useful return value again

* Update the path

* Try using inputer instead

* oh provide the config

* Try that again

* Return affected user IDs

* Don't create so many forward extremities

* Add missing `Path` to name

Co-authored-by: Till <2353100+S7evinK@users.noreply.github.com>
2022-04-28 16:02:30 +01:00
Till feac9db43f
Add transactionsCache to redact endpoint (#2375) 2022-04-26 10:28:41 +02:00
fcwoknhenuxdfiyv-nextcloud abf71649b0
Make sure resp.Username is defined before hashing. Fixes #2356 (#2357)
Co-authored-by: Jason Quigley <jason@onecha.net>
2022-04-19 09:46:54 +01:00
Till e8dd37d533
Add metrics for internal API requests (#2310)
* Add response size and requests total to internal handler

* Move MustRegister calls to New* funcs

* Move MustRegister back to init

* Init at some place, minimize changes
2022-04-08 12:24:40 +02:00
Neil Alexander b8c97431b9
Prevent setting push rules via account data endpoint (#2333) 2022-04-08 10:46:23 +01:00
Neil Alexander 2dc35403d1
Send avatar updates asynchronously, same as display name updates 2022-04-07 15:50:42 +01:00
Till 60ee7eef4c
Add possibility to ignore users (#2329)
* Add ignore users

* Ignore users in pushrules
Add passing tests

* Update sytest lists

* Store ignore knowledge in the sync API

* Fix copyrights

Co-authored-by: Neil Alexander <neilalexander@users.noreply.github.com>
2022-04-07 15:08:19 +01:00
Neil Alexander 99ef547295
Simplify presence stringification (should help with vector-im/element-android#5712) 2022-04-07 10:10:28 +01:00
Till e5e3350ce1
Add presence module V2 (#2312)
* Syncapi presence

* Clientapi http presence handler

* Why is this here?

* Missing files

* FederationAPI presence implementation

* Add new presence stream

* Pinecone update

* Pinecone update

* Add passing tests

* Make linter happy

* Add presence producer

* Add presence config option

* Set user to unavailable after x minutes

* Only set currently_active if online
Avoid unneeded presence updates when syncing

* Tweaks

* Query devices for last_active_ts
Fixes & tweaks

* Export SharedUsers/SharedUsers

* Presence stream in MemoryStorage

* Remove status_msg_nil

* Fix sytest crashes

* Make presence types const and use stringer for it

* Change options to allow inbound/outbound presence

* Fix option & typo

* Update configs

Co-authored-by: Neil Alexander <neilalexander@users.noreply.github.com>
2022-04-06 13:11:19 +02:00
David Spenler 2defc4249d
Added /upgrade endpoint (#2307)
* Added /upgrade endpoint

* fix

* Fix lints

* More lint lifex

* Move room upgrading to the roomserver

* Remove extraneous arg

* Fix HTTP API for `PerformUpgrade`

* Reduce number of API calls in `generateInitialEvents`, preserve membership fields

* Refactor `generateInitialEvents` to preserve old state events for all but the essential room setup events

* Handle ban events in the state transfer

* Refactor and comment `createTemporaryPowerLevels`

* Only send two power levels if we needed to override the levels, preserve miscellaneous fields in the create event

* Fix copyrights

* Review comments @S7evinK

* Update sytest whitelist

* Specify empty state keys, use `EventLevel`, remove unnecessary check on state copy

* Add comment to `restrictOldRoomPowerLevels`

* Ensure canonical aliases exist before clearing

* Copy invites as well as bans

* Fix return error on `m.room.tombstone` handling in client API

* Relax checks for well-formedness of join rules, membership event etc

Co-authored-by: Alex Kursell <alex@awk.run>
Co-authored-by: Neil Alexander <neilalexander@users.noreply.github.com>
Co-authored-by: kegsay <kegan@matrix.org>
2022-04-05 10:04:08 +01:00
S7evinK 49dc49b232
Remove eduserver (#2306)
* Move receipt sending to own JetStream producer

* Move SendToDevice to producer

* Remove most parts of the EDU server

* Fix SendToDevice & copyrights

* Move structs, cleanup EDU Server traces

* Use HeadersOnly subscription

* Missing file

* Fix linter issues

* Move consumers to own files

* Rename durable consumer; Consumer cleanup

* Docs/config cleanup
2022-03-29 14:14:35 +02:00