| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Make opentracing trace into event persistence (#10134) | Richard van der Hoff | 2021-06-16 | 1 | -2/+2 |
| | | | | | | | | | | | | | | | * Trace event persistence When we persist a batch of events, set the parent opentracing span to the that from the request, so that we can trace all the way in. * changelog * When we force tracing, set a baggage item ... so that we can check again later. * Link in both directions between persist_events spans | ||||
| * | Set opentracing priority before setting other tags (#10092) | Richard van der Hoff | 2021-05-28 | 1 | -4/+4 |
| | | | | ... because tags on spans which aren't being sampled get thrown away. | ||||
| * | Support enabling opentracing by user (#9978) | Richard van der Hoff | 2021-05-14 | 1 | -0/+5 |
| | | | | | | Add a config option which allows enabling opentracing by user id, eg for debugging requests made by a test user. | ||||
| * | Add type hints to auth and auth_blocking. (#9876) | Patrick Cloke | 2021-04-23 | 1 | -39/+39 |
| | | |||||
| * | Check for space membership during a remote join of a restricted room (#9814) | Patrick Cloke | 2021-04-23 | 1 | -0/+1 |
| | | | | | | | When receiving a /send_join request for a room with join rules set to 'restricted', check if the user is a member of the spaces defined in the 'allow' key of the join rules. This only applies to an experimental room version, as defined in MSC3083. | ||||
| * | Port "Allow users to click account renewal links multiple times without ↵ | Andrew Morgan | 2021-04-19 | 1 | -2/+4 |
| | | | | | | hitting an 'Invalid Token' page #74" from synapse-dinsic (#9832) This attempts to be a direct port of https://github.com/matrix-org/synapse-dinsic/pull/74 to mainline. There was some fiddling required to deal with the changes that have been made to mainline since (mainly dealing with the split of `RegistrationWorkerStore` from `RegistrationStore`, and the changes made to `self.make_request` in test code). | ||||
| * | Remove redundant "coding: utf-8" lines (#9786) | Jonathan de Jong | 2021-04-14 | 1 | -1/+0 |
| | | | | | | | | Part of #9744 Removes all redundant `# -*- coding: utf-8 -*-` lines from files, as python 3 automatically reads source code as utf-8 now. `Signed-off-by: Jonathan de Jong <jonathan@automatia.nl>` | ||||
| * | Make it possible to use dmypy (#9692) | Erik Johnston | 2021-03-26 | 1 | -0/+5 |
| | | | | | | | | | | Running `dmypy run` will do a `mypy` check while spinning up a daemon that makes rerunning `dmypy run` a lot faster. `dmypy` doesn't support `follow_imports = silent` and has `local_partial_types` enabled, so this PR enables those options and fixes the issues that were newly raised. Note that `local_partial_types` will be enabled by default in upcoming mypy releases. | ||||
| * | Fix additional type hints from Twisted 21.2.0. (#9591) | Patrick Cloke | 2021-03-12 | 1 | -1/+1 |
| | | |||||
| * | Record the SSO Auth Provider in the login token (#9510) | Richard van der Hoff | 2021-03-04 | 1 | -32/+9 |
| | | | | This great big stack of commits is a a whole load of hoop-jumping to make it easier to store additional values in login tokens, and then to actually store the SSO Identity Provider in the login token. (Making use of that data will follow in a subsequent PR.) | ||||
| * | Update black, and run auto formatting over the codebase (#9381) | Eric Eastwood | 2021-02-16 | 1 | -5/+11 |
| | | | | | | | | - Update black version to the latest - Run black auto formatting over the codebase - Run autoformatting according to [`docs/code_style.md `](https://github.com/matrix-org/synapse/blob/80d6dc9783aa80886a133756028984dbf8920168/docs/code_style.md) - Update `code_style.md` docs around installing black to use the correct version | ||||
| * | Kill off `HomeServer.get_ip_from_request()` (#9080) | Richard van der Hoff | 2021-01-12 | 1 | -2/+2 |
| | | | | Homeserver.get_ip_from_request() used to be a bit more complicated, but now it is totally redundant. Let's get rid of it. | ||||
| * | Remove SynapseRequest.get_user_agent (#9069) | Richard van der Hoff | 2021-01-12 | 1 | -1/+2 |
| | | | | | | | | | | | | SynapseRequest is in danger of becoming a bit of a dumping-ground for "useful stuff relating to Requests", which isn't really its intention (its purpose is to override render, finished and connectionLost to set up the LoggingContext and write the right entries to the request log). Putting utility functions inside SynapseRequest means that lots of our code ends up requiring a SynapseRequest when there is nothing synapse-specific about the Request at all, and any old twisted.web.iweb.IRequest will do. This increases code coupling and makes testing more difficult. In short: move get_user_agent out to a utility function. | ||||
| * | Do not assume that the contents dictionary includes history_visibility. (#8945) | Patrick Cloke | 2020-12-16 | 1 | -2/+3 |
| | | |||||
| * | Honour AS ratelimit settings for /login requests (#8920) | Erik Johnston | 2020-12-11 | 1 | -1/+3 |
| | | | | | Fixes #8846. | ||||
| * | Add ability for access tokens to belong to one user but grant access to ↵ | Erik Johnston | 2020-10-29 | 1 | -67/+46 |
| | | | | | | | | | | | another user. (#8616) We do it this way round so that only the "owner" can delete the access token (i.e. `/logout/all` by the "owner" also deletes that token, but `/logout/all` by the "target user" doesn't). A future PR will add an API for creating such a token. When the target user and authenticated entity are different the `Processed request` log line will be logged with a: `{@admin:server as @bob:server} ...`. I'm not convinced by that format (especially since it adds spaces in there, making it harder to use `cut -d ' '` to chop off the start of log lines). Suggestions welcome. | ||||
| * | Fix handling of User-Agent headers with bad utf-8. (#8632) | Erik Johnston | 2020-10-23 | 1 | -3/+1 |
| | | |||||
| * | type annotations for LruCache | Richard van der Hoff | 2020-10-16 | 1 | -1/+3 |
| | | |||||
| * | Make LruCache register its own metrics (#8561) | Richard van der Hoff | 2020-10-16 | 1 | -3/+1 |
| | | | | | | rather than have everything that instantiates an LruCache manage metrics separately, have LruCache do it itself. | ||||
| * | Don't push if an user account has expired (#8353) | Mathieu Velten | 2020-09-23 | 1 | -5/+1 |
| | | |||||
| * | Stop sub-classing object (#8249) | Patrick Cloke | 2020-09-04 | 1 | -1/+1 |
| | | |||||
| * | Add a shadow-banned flag to users. (#8092) | Patrick Cloke | 2020-08-14 | 1 | -1/+11 |
| | | |||||
| * | Convert synapse.api to async/await (#8031) | Patrick Cloke | 2020-08-06 | 1 | -67/+56 |
| | | |||||
| * | Convert a synapse.events to async/await. (#7949) | Patrick Cloke | 2020-07-27 | 1 | -1/+1 |
| | | |||||
| * | Convert state resolution to async/await (#7942) | Patrick Cloke | 2020-07-24 | 1 | -4/+8 |
| | | |||||
| * | Fix some spelling mistakes / typos. (#7811) | Patrick Cloke | 2020-07-09 | 1 | -1/+1 |
| | | |||||
| * | isort 5 compatibility (#7786) | Will Hunt | 2020-07-05 | 1 | -2/+1 |
| | | | | The CI appears to use the latest version of isort, which is a problem when isort gets a major version bump. Rather than try to pin the version, I've done the necessary to make isort5 happy with synapse. | ||||
| * | Replace iteritems/itervalues/iterkeys with native versions. (#7692) | Patrick Cloke | 2020-06-15 | 1 | -3/+1 |
| | | |||||
| * | Fix type information on `assert_*_is_admin` methods (#7645) | Richard van der Hoff | 2020-06-05 | 1 | -4/+4 |
| | | | | These things don't return Deferreds. | ||||
| * | Allow expired accounts to logout (#7443) | Andrew Morgan | 2020-05-14 | 1 | -17/+33 |
| | | |||||
| * | Allow configuration of Synapse's cache without using synctl or environment ↵ | Amber Brown | 2020-05-11 | 1 | -2/+2 |
| | | | | | variables (#6391) | ||||
| * | Stop Auth methods from polling the config on every req. (#7420) | Andrew Morgan | 2020-05-06 | 1 | -73/+10 |
| | | |||||
| * | async/await is_server_admin (#7363) | Andrew Morgan | 2020-05-01 | 1 | -5/+4 |
| | | |||||
| * | Allow deleting an alias if the user has sufficient power level (#6986) | Patrick Cloke | 2020-03-04 | 1 | -7/+2 |
| | | |||||
| * | Publishing/removing from the directory requires a power level greater than ↵ | Patrick Cloke | 2020-02-21 | 1 | -5/+5 |
| | | | | | canonical aliases. | ||||
| * | Add `allow_departed_users` param to `check_in_room_or_world_readable` | Richard van der Hoff | 2020-02-19 | 1 | -3/+13 |
| | | | | | | | | ... and set it everywhere it's called. while we're here, rename it for consistency with `check_user_in_room` (and to help check that I haven't missed any instances) | ||||
| * | Refactor the membership check methods in Auth | Richard van der Hoff | 2020-02-18 | 1 | -43/+37 |
| | | | | | | these were getting a bit unwieldy, so let's combine `check_joined_room` and `check_user_was_in_room` into a single `check_user_in_room`. | ||||
| * | Pass room version object into event_auth.check and check_redaction (#6788) | Richard van der Hoff | 2020-01-28 | 1 | -2/+5 |
| | | | | | | | | These are easier to work with than the strings and we normally have one around. This fixes `FederationHander._persist_auth_tree` which was passing a RoomVersion object into event_auth.check instead of a string. | ||||
| * | Add StateMap type alias (#6715) | Erik Johnston | 2020-01-16 | 1 | -6/+2 |
| | | |||||
| * | Change EventContext to use the Storage class (#6564) | Erik Johnston | 2019-12-20 | 1 | -1/+1 |
| | | |||||
| * | Add auth events as per spec. (#6556) | Erik Johnston | 2019-12-16 | 1 | -67/+34 |
| | | | | | | Previously we tried to be clever and filter out some unnecessary event IDs to keep the auth chain small, but that had some annoying interactions with state res v2 so we stop doing that for now. | ||||
| * | Remove usage of deprecated logger.warn method from codebase (#6271) | Andrew Morgan | 2019-10-31 | 1 | -1/+1 |
| | | | | Replace every instance of `logger.warn` with `logger.warning` as the former is deprecated. | ||||
| * | Option to suppress resource exceeded alerting (#6173) | Neil Johnson | 2019-10-24 | 1 | -3/+9 |
| | | | | | The expected use case is to suppress MAU limiting on small instances | ||||
| * | Remove Auth.check method (#6217) | Richard van der Hoff | 2019-10-18 | 1 | -18/+1 |
| | | | | This method was somewhat redundant, and confusing. | ||||
| * | Add device and appservice tags | Erik Johnston | 2019-09-25 | 1 | -0/+3 |
| | | |||||
| * | Don't create new span for get_user_by_req | Erik Johnston | 2019-09-25 | 1 | -1/+0 |
| | | | | | | | We don't actually care about what happens in `get_user_by_req` and having it as a separate span means that the entity tag isn't added to the servlet spans, making it harder to search. | ||||
| * | Ensure support users can be registered even if MAU limit is reached | Jason Robinson | 2019-09-11 | 1 | -2/+9 |
| | | | | | | | | | | This allows support users to be created even on MAU limits via the admin API. Support users are excluded from MAU after creation, so it makes sense to exclude them in creation - except if the whole host is in disabled state. Signed-off-by: Jason Robinson <jasonr@matrix.org> | ||||
| * | Remove double return statements (#5962) | Andrew Morgan | 2019-09-03 | 1 | -1/+0 |
| | | | | | | | | | | | Remove all the "double return" statements which were a result of us removing all the instances of ``` defer.returnValue(...) return ``` statements when we switched to python3 fully. | ||||
| * | Remove unnecessary parentheses around return statements (#5931) | Andrew Morgan | 2019-08-30 | 1 | -7/+7 |
| | | | | | | Python will return a tuple whether there are parentheses around the returned values or not. I'm just sick of my editor complaining about this all over the place :) | ||||
| * | Opentracing misc (#5856) | Jorik Schellekens | 2019-08-16 | 1 | -0/+4 |
| | | | | | | | | | | | | Add authenticated_entity and servlet_names tags. Functionally: - Add a tag for authenticated_entity - Add a tag for servlet_names Stylistically: Moved to importing methods directly from opentracing. | ||||
| * | Remove non-functional 'expire_access_token' setting (#5782) | Richard van der Hoff | 2019-07-30 | 1 | -23/+5 |
| | | | | | | | | | The `expire_access_token` didn't do what it sounded like it should do. What it actually did was make Synapse enforce the 'time' caveat on macaroons used as access tokens, but since our access token macaroons never contained such a caveat, it was always a no-op. (The code to add 'time' caveats was removed back in v0.18.5, in #1656) | ||||
| * | Replace returnValue with return (#5736) | Amber Brown | 2019-07-23 | 1 | -24/+20 |
| | | |||||
| * | Ignore redactions of m.room.create events (#5701) | Richard van der Hoff | 2019-07-17 | 1 | -15/+0 |
| | | |||||
| * | Implement access token expiry (#5660) | Richard van der Hoff | 2019-07-12 | 1 | -0/+12 |
| | | | | | Record how long an access token is valid for, and raise a soft-logout once it expires. | ||||
| * | Clean up exception handling for access_tokens (#5656) | Richard van der Hoff | 2019-07-11 | 1 | -88/+39 |
| | | | | | | | | | | | | | | | | | First of all, let's get rid of `TOKEN_NOT_FOUND_HTTP_STATUS`. It was a hack we did at one point when it was possible to return either a 403 or a 401 if the creds were missing. We always return a 401 in these cases now (thankfully), so it's not needed. Let's also stop abusing `AuthError` for these cases. Honestly they have nothing that relates them to the other places that `AuthError` is used, other than the fact that they are loosely under the 'Auth' banner. It makes no sense for them to share exception classes. Instead, let's add a couple of new exception classes: `InvalidClientTokenError` and `MissingClientTokenError`, for the `M_UNKNOWN_TOKEN` and `M_MISSING_TOKEN` cases respectively - and an `InvalidClientCredentialsError` base class for the two of them. | ||||
| * | Run Black. (#5482) | Amber Brown | 2019-06-20 | 1 | -86/+73 |
| | | |||||
| * | Better wording | Brendan Abolivier | 2019-06-10 | 1 | -1/+1 |
| | | |||||
| * | Doc | Brendan Abolivier | 2019-06-10 | 1 | -0/+5 |
| | | |||||
| * | Don't check whether the user's account is expired on /send_mail requests | Brendan Abolivier | 2019-06-05 | 1 | -2/+8 |
| | | |||||
| * | Factor out an "assert_requester_is_admin" function (#5120) | Richard van der Hoff | 2019-05-02 | 1 | -1/+1 |
| | | | | | Rather than copying-and-pasting the same four lines hundreds of times | ||||
| * | Add management endpoints for account validity | Brendan Abolivier | 2019-04-17 | 1 | -1/+1 |
| | | |||||
| * | Send out emails with links to extend an account's validity period | Brendan Abolivier | 2019-04-17 | 1 | -2/+3 |
| | | |||||
| * | Add account expiration feature | Brendan Abolivier | 2019-04-09 | 1 | -0/+12 |
| | | |||||
| * | Support 3PID login in password providers (#4931) | Andrew Morgan | 2019-03-26 | 1 | -11/+11 |
| | | | | | | Adds a new method, check_3pid_auth, which gives password providers the chance to allow authentication with third-party identifiers such as email or msisdn. | ||||
| * | Enforce hs_disabled_message correctly | Richard van der Hoff | 2019-03-19 | 1 | -3/+5 |
| | | | | | | Fixes a bug where hs_disabled_message was not enforced for 3pid-based requests if there was no server_notices_mxid configured. | ||||
| * | Merge branch 'develop' of github.com:matrix-org/synapse into ↵ | Erik Johnston | 2019-01-29 | 1 | -12/+1 |
| |\ | | | | | | | erikj/redactions_eiah | ||||
| | * | Remove dead function | Erik Johnston | 2019-01-29 | 1 | -11/+0 |
| | | | |||||
| | * | Replace usage of builder.user_id with builder.sender | Erik Johnston | 2019-01-29 | 1 | -1/+1 |
| | | | | | | | | | | | `.user_id` is proxed to `.sender` in FrozenEvent, so this has no functional change | ||||
| * | | Implement rechecking of redactions | Erik Johnston | 2019-01-29 | 1 | -2/+2 |
| |/ | |||||
| * | Pass through room version to event auth | Erik Johnston | 2019-01-25 | 1 | -4/+10 |
| | | |||||
| * | Fix None guard in config.server.is_threepid_reserved | Neil Johnson | 2019-01-22 | 1 | -1/+3 |
| | | |||||
| * | Merge branch rav/macaroon_key_fix_0.34 into rav/macaroon_key_fix_0.34.1 | Richard van der Hoff | 2019-01-10 | 1 | -38/+27 |
| |\ | | | | | | | Fixes #4371 | ||||
| | * | Merge branch 'rav/macaroon_key_fix' into rav/macaroon_key_fix_0.34 | Richard van der Hoff | 2019-01-10 | 1 | -38/+27 |
| | |\ | |||||
| | | * | Skip macaroon check for access tokens in the db | Richard van der Hoff | 2019-01-10 | 1 | -38/+27 |
| | | | | |||||
| * | | | create support user (#4141) | Neil Johnson | 2018-12-14 | 1 | -2/+3 |
| |/ / | | | | | | | | | | | Allow for the creation of a support user. A support user can access the server, join rooms, interact with other users, but does not appear in the user directory nor does it contribute to monthly active user limits. | ||||
| * | | Add an option to enable recording IPs for appservice users (#3831) | Travis Ralston | 2018-12-04 | 1 | -9/+20 |
| | | | |||||
| * | | assert rather than warn hhs-4 | Neil Johnson | 2018-08-31 | 1 | -3/+2 |
| | | | |||||
| * | | move threepid checker to config, add missing yields | Neil Johnson | 2018-08-31 | 1 | -2/+11 |
| | | | |||||
| * | | fix reference to is_threepid_reserved | Neil Johnson | 2018-08-31 | 1 | -1/+1 |
| | | | |||||
| * | | ensure post registration auth checks do not fail erroneously | Neil Johnson | 2018-08-31 | 1 | -5/+2 |
| | | | |||||
| * | | fix bug where preserved threepid user comes to sign up and server is mau blocked | Neil Johnson | 2018-08-31 | 1 | -1/+9 |
| | | | |||||
| * | | Change admin_uri to admin_contact in config and errors | Erik Johnston | 2018-08-24 | 1 | -2/+2 |
| | | | |||||
| * | | Implement trail users | Erik Johnston | 2018-08-23 | 1 | -1/+5 |
| | | | |||||
| * | | Merge branch 'develop' of github.com:matrix-org/synapse into ↵ | Erik Johnston | 2018-08-22 | 1 | -7/+7 |
| |\ \ | | | | | | | | | | neilj/server_notices_on_blocking | ||||
| | * | | Port over enough to get some sytests running on Python 3 (#3668) | Amber Brown | 2018-08-20 | 1 | -7/+7 |
| | | | | |||||
| * | | | rename error code | Neil Johnson | 2018-08-18 | 1 | -2/+2 |
| | | | | |||||
| * | | | special case server_notices_mxid | Neil Johnson | 2018-08-18 | 1 | -0/+6 |
| |/ / | |||||
| * | | Merge branch 'develop' into neilj/limit_exceeded_error | Neil Johnson | 2018-08-17 | 1 | -1/+2 |
| |\ \ | |||||
| | * | | call reap on start up and fix under reaping bug | Neil Johnson | 2018-08-16 | 1 | -1/+1 |
| | | | | |||||
| * | | | add new error type ResourceLimit | Neil Johnson | 2018-08-16 | 1 | -4/+6 |
| |/ / | |||||
| * | | replace admin_email with admin_uri for greater flexibility | Neil Johnson | 2018-08-15 | 1 | -5/+5 |
| | | | |||||
| * | | Merge branch 'develop' of github.com:matrix-org/synapse into neilj/admin_email | Neil Johnson | 2018-08-14 | 1 | -1/+11 |
| |\ \ | |||||
| | * | | make comments clearer | Neil Johnson | 2018-08-14 | 1 | -1/+2 |
| | | | | |||||
| | * | | rename _user_last_seen_monthly_active | Neil Johnson | 2018-08-09 | 1 | -1/+1 |
| | | | | |||||
| | * | | fix errant parenthesis | Neil Johnson | 2018-08-09 | 1 | -1/+1 |
| | | | | |||||
| | * | | only block on sync where user is not part of the mau cohort | Neil Johnson | 2018-08-09 | 1 | -2/+11 |
| | | | | |||||
| * | | | support admin_email config and pass through into blocking errors, return ↵ | Neil Johnson | 2018-08-13 | 1 | -2/+6 |
| | | | | | | | | | | | | | AuthError in all cases | ||||
| * | | | Revert "support admin_email config and pass through into blocking errors, ↵ | Neil Johnson | 2018-08-13 | 1 | -6/+2 |
| | | | | | | | | | | | | | | | | | | | return AuthError in all cases" This reverts commit 0d43f991a19840a224d3dac78d79f13d78212ee6. | ||||
| * | | | support admin_email config and pass through into blocking errors, return ↵ | Neil Johnson | 2018-08-13 | 1 | -2/+6 |
| |/ / | | | | | | | AuthError in all cases | ||||
| * | | Merge branch 'neilj/mau_tracker' of github.com:matrix-org/synapse into ↵ | Neil Johnson | 2018-08-06 | 1 | -4/+1 |
| |\ \ | | | | | | | | | | neilj/disable_hs | ||||
| | * | | update comments to reflect new sig | Neil Johnson | 2018-08-06 | 1 | -4/+1 |
| | | | | |||||
| * | | | disable HS from config | Neil Johnson | 2018-08-04 | 1 | -0/+4 |
| |/ / | |||||
| * | | wip commit - tests failing | Neil Johnson | 2018-08-03 | 1 | -2/+4 |
| | | | |||||
| * | | do mau checks based on monthly_active_users table | Neil Johnson | 2018-08-02 | 1 | -0/+13 |
| | | | |||||
| * | | insertion into monthly_active_users | Neil Johnson | 2018-08-02 | 1 | -1/+1 |
| |/ | |||||
| * | Python 3: Convert some unicode/bytes uses (#3569) | Amber Brown | 2018-08-02 | 1 | -2/+2 |
| | | |||||
| * | Merge branch 'develop' into erikj/client_apis_move | Erik Johnston | 2018-07-24 | 1 | -2/+4 |
| |\ | |||||
| | * | Use new getters | Erik Johnston | 2018-07-23 | 1 | -2/+4 |
| | | | |||||
| * | | Move check_in_room_or_world_readable to Auth | Erik Johnston | 2018-07-20 | 1 | -0/+34 |
| |/ | |||||
| * | Make auth & transactions more testable (#3499) | Amber Brown | 2018-07-14 | 1 | -62/+62 |
| | | |||||
| * | run isort | Amber Brown | 2018-07-09 | 1 | -3/+4 |
| | | |||||
| * | add ip_range_whitelist parameter to limit where ASes can connect from | Matthew Hodgson | 2018-06-28 | 1 | -0/+6 |
| | | |||||
| * | Don't print invalid access tokens in the logs | Travis Ralston | 2018-06-24 | 1 | -2/+2 |
| | | | | | | Tokens shouldn't be appearing the logs, valid or invalid. Signed-off-by: Travis Ralston <travpc@gmail.com> | ||||
| * | Refactor get_send_level to take a power_levels event | Richard van der Hoff | 2018-06-14 | 1 | -1/+1 |
| | | | | | it makes it easier for me to reason about | ||||
| * | Consistently use six's iteritems and wrap lazy keys/values in list() if ↵ | Amber Brown | 2018-05-31 | 1 | -1/+3 |
| | | | | | they're not meant to be lazy (#3307) | ||||
| * | replacing portions | Amber Brown | 2018-05-21 | 1 | -1/+1 |
| | | |||||
| * | Add b prefixes to some strings that are bytes in py3 | Adrian Tschira | 2018-04-04 | 1 | -5/+5 |
| | | | | | | | This has no effect on python2 Signed-off-by: Adrian Tschira <nota@notafile.com> | ||||
| * | Improve comments on get_user_by_access_token | Richard van der Hoff | 2017-11-29 | 1 | -1/+5 |
| | | | | | because I have to reverse-engineer this every time. | ||||
| * | Add a config option to block all room invites (#2457) | Richard van der Hoff | 2017-09-19 | 1 | -0/+8 |
| | | | | | | - allows sysadmins the ability to lock down their servers so that people can't send their users room invites. | ||||
| * | Merge pull request #2309 from matrix-org/erikj/user_ip_repl | Erik Johnston | 2017-07-06 | 1 | -1/+1 |
| |\ | | | | | Fix up user_ip replication commands | ||||
| | * | Fix up | Erik Johnston | 2017-06-27 | 1 | -1/+1 |
| | | | |||||
| * | | Cache macaroon parse and validation | Erik Johnston | 2017-06-29 | 1 | -13/+60 |
| |/ | | | | | | Turns out this can be quite expensive for requests, and is easily cachable. We don't cache the lookup to the DB so invalidation still works. | ||||
| * | Batch upsert user ips | Erik Johnston | 2017-06-27 | 1 | -2/+1 |
| | | |||||
| * | Change is_host_joined to use current_state table | Erik Johnston | 2017-06-09 | 1 | -11/+2 |
| | | | | | | | This bypasses a bug where using the state groups to figure out if a host is in a room sometimes errors if the servers isn't in the room. (For example when the server rejected an invite to a remote room) | ||||
| * | Fix a couple of logcontext leaks | Richard van der Hoff | 2017-03-23 | 1 | -3/+2 |
| | | | | | | Use preserve_fn to correctly manage the logcontexts around things we don't want to yield on. | ||||
| * | Change resolve_state_groups call site logging to DEBUG | Erik Johnston | 2017-01-17 | 1 | -1/+1 |
| | | |||||
| * | Remove unused function | Erik Johnston | 2017-01-13 | 1 | -3/+0 |
| | | |||||
| * | Split event auth code into seperate module | Erik Johnston | 2017-01-13 | 1 | -645/+9 |
| | | |||||
| * | Split out static auth methods from Auth object | Erik Johnston | 2017-01-10 | 1 | -419/+495 |
| | | |||||
| * | Fix flake8 and update changelog v0.18.6-rc3 | Mark Haines | 2017-01-05 | 1 | -1/+1 |
| | | |||||
| * | add logging for all the places we call resolve_state_groups. my kingdom for ↵ | Matthew Hodgson | 2017-01-05 | 1 | -0/+1 |
| | | | | | a backtrace that actually works. | ||||
| * | Prevent user tokens being used as guest tokens (#1675) | Richard van der Hoff | 2016-12-06 | 1 | -15/+36 |
| | | | | | | Make sure that a user cannot pretend to be a guest by adding 'guest = True' caveats. | ||||
| * | Rip out more refresh_token code | Richard van der Hoff | 2016-11-30 | 1 | -3/+2 |
| | | | | | | | | | We might as well treat all refresh_tokens as invalid. Just return a 403 from /tokenrefresh, so that we don't have a load of dead, untestable code hanging around. Still TODO: removing the table from the schema. | ||||
| * | Merge pull request #1656 from matrix-org/rav/remove_time_caveat | Richard van der Hoff | 2016-11-30 | 1 | -3/+13 |
| |\ | | | | | Stop putting a time caveat on access tokens | ||||
| | * | Comments | Richard van der Hoff | 2016-11-30 | 1 | -3/+9 |
| | | | | | | | | | Update comments in verify_macaroon | ||||
| | * | Stop putting a time caveat on access tokens | Richard van der Hoff | 2016-11-29 | 1 | -0/+4 |
| | | | | | | | | | | | | | | | | | The 'time' caveat on the access tokens was something of a lie, since we weren't enforcing it; more pertinently its presence stops us ever adding useful time caveats. Let's move in the right direction by not lying in our caveats. | ||||
| * | | Merge pull request #1653 from matrix-org/rav/guest_e2e | Richard van der Hoff | 2016-11-29 | 1 | -1/+5 |
| |\ \ | |/ |/| | Implement E2E for guests | ||||
| | * | Give guest users a device_id | Richard van der Hoff | 2016-11-25 | 1 | -1/+5 |
| | | | | | | | | | | | We need to create devices for guests so that they can use e2e, but we don't have anywhere to store it, so just use a fixed one. | ||||
| * | | Remove redundant list of known caveat prefixes | Richard van der Hoff | 2016-11-24 | 1 | -26/+8 |
| |/ | | | | Also add some comments. | ||||
| * | Merge pull request #1098 from matrix-org/markjh/bearer_token | Mark Haines | 2016-10-25 | 1 | -9/+37 |
| |\ | | | | | Allow clients to supply access_tokens as headers | ||||
| | * | Fix unit tests | Mark Haines | 2016-09-12 | 1 | -1/+1 |
| | | | |||||
| | * | Allow clients to supply access_tokens as headers | Mark Haines | 2016-09-09 | 1 | -9/+37 |
| | | | | | | | | | | | | | | | | | | | | | Clients can continue to supply access tokens as query parameters or can supply the token as a header: Authorization: Bearer <access_token_goes_here> This matches the ouath2 format of https://tools.ietf.org/html/rfc6750#section-2.1 | ||||
| * | | Closing brace on following line | Luke Barnard | 2016-10-20 | 1 | -1/+2 |
| | | | |||||
| * | | as_user->app_service, less redundant comments, better positioned comments | Luke Barnard | 2016-10-20 | 1 | -3/+3 |
| | | | |||||
| * | | flake8 | Luke Barnard | 2016-10-20 | 1 | -1/+3 |
| | | | |||||
| * | | Use real AS object by passing it through the requester | Luke Barnard | 2016-10-20 | 1 | -7/+7 |
| | | | | | | | | | This means synapse does not have to check if the AS is interested, but instead it effectively re-uses what it already knew about the requesting user | ||||
| * | | Merge pull request #1157 from Rugvip/nolimit | Erik Johnston | 2016-10-11 | 1 | -4/+3 |
| |\ \ | | | | | | | Remove rate limiting from app service senders and fix get_or_create_user requester | ||||
| | * | | storage/appservice: make appservice methods only relying on the cache ↵ | Patrik Oldsberg | 2016-10-06 | 1 | -4/+3 |
| | | | | | | | | | | | | | synchronous | ||||
| * | | | api/auth: fix for not being allowed to set your own state_key | Patrik Oldsberg | 2016-09-30 | 1 | -10/+0 |
| |/ / | | | | | | | Signed-off-by: Patrik Oldsberg <patrik.oldsberg@ericsson.com> | ||||
| * | | Update comments | Erik Johnston | 2016-09-22 | 1 | -2/+3 |
| | | | |||||
| * | | Add comments | Erik Johnston | 2016-09-22 | 1 | -0/+3 |
| | | | |||||
| * | | Shuffle things around to make unit tests work | Erik Johnston | 2016-09-22 | 1 | -14/+15 |
| | | | |||||
| * | | Allow invites via 3pid to bypass sender sig check | Erik Johnston | 2016-09-22 | 1 | -1/+16 |
| |/ | | | | | | | | | | | | | | When a server sends a third party invite another server may be the one that the inviting user registers with. In this case it is that remote server that will issue an actual invitation, and wants to do it "in the name of" the original invitee. However, the new proper invite will not be signed by the original server, and thus other servers would reject the invite if it was seen as coming from the original user. To fix this, a special case has been added to the auth rules whereby another server can send an invite "in the name of" another server's user, so long as that user had previously issued a third party invite that is now being accepted. | ||||
| * | Add helper function for getting access_tokens from requests | Mark Haines | 2016-09-09 | 1 | -7/+51 |
| | | | | | | | Rather than reimplementing the token parsing in the various places. This will make it easier to change the token parsing to allow access_tokens in HTTP headers. | ||||
| * | Handle the fact that workers can't generate state groups | Erik Johnston | 2016-08-31 | 1 | -2/+4 |
| | | |||||
| * | Correctly handle the difference between prev and current state | Erik Johnston | 2016-08-31 | 1 | -2/+2 |
| | | |||||
| * | Cache check_host_in_room | Erik Johnston | 2016-08-26 | 1 | -14/+6 |
| | | |||||
| * | Add measure on check_host_in_room | Erik Johnston | 2016-08-26 | 1 | -11/+12 |
| | | |||||
| * | Pull out full state less | Erik Johnston | 2016-08-25 | 1 | -6/+7 |
| | | |||||
| * | Replace context.current_state with context.current_state_ids | Erik Johnston | 2016-08-25 | 1 | -24/+44 |
| | | |||||
| * | Fix login with m.login.token | Richard van der Hoff | 2016-08-08 | 1 | -15/+30 |
| | | | | | | login with token (as used by CAS auth) was broken by 067596d, such that it always returned a 401. | ||||
| * | Merge pull request #952 from matrix-org/markjh/more_fixes | Mark Haines | 2016-07-26 | 1 | -0/+4 |
| |\ | | | | | Check if the user is banned when handling 3pid invites | ||||
| | * | Check if the user is banned when handling 3pid invites | Mark Haines | 2016-07-26 | 1 | -0/+4 |
| | | | |||||
| * | | Add `create_requester` function | Richard van der Hoff | 2016-07-26 | 1 | -13/+11 |
| |/ | | | | | Wrap the `Requester` constructor with a function which provides sensible defaults, and use it throughout | ||||
| * | Record device_id in client_ips | Richard van der Hoff | 2016-07-20 | 1 | -6/+23 |
| | | | | | | Record the device_id when we add a client ip; it's somewhat redundant as we could get it via the access_token, but it will make querying rather easier. | ||||
| * | More doc-comments | Richard van der Hoff | 2016-07-20 | 1 | -3/+2 |
| | | | | | Fix some more comments on some things | ||||
| * | Fix 500 ISE when sending alias event without a state_key | Mark Haines | 2016-07-15 | 1 | -0/+5 |
| | | |||||
| * | Merge pull request #919 from matrix-org/erikj/auth_fix | Erik Johnston | 2016-07-15 | 1 | -1/+25 |
| |\ | | | | | Various auth.py fixes. | ||||
| | * | Check sender signed event | Erik Johnston | 2016-07-14 | 1 | -2/+8 |
| | | | |||||
| | * | Check if alias event's state_key matches sender's domain | Erik Johnston | 2016-07-13 | 1 | -0/+11 |
| | | | |||||
| | * | Check creation event's room_id domain matches sender's | Erik Johnston | 2016-07-13 | 1 | -0/+7 |
| | | | |||||
| * | | Bug fix: expire invalid access tokens | Negar Fazeli | 2016-07-13 | 1 | -0/+3 |
| |/ | |||||
| * | Fix bug where we did not correctly explode when multiple user_ids were set ↵ | Erik Johnston | 2016-07-07 | 1 | -5/+10 |
| | | | | | in macaroon | ||||
| * | Working unsubscribe links going straight to the HS | David Baker | 2016-06-02 | 1 | -0/+7 |
| | | | | | and authed by macaroons that let you delete pushers and nothing else | ||||
| * | Merge remote-tracking branch 'origin/develop' into dbkr/email_unsubscribe | David Baker | 2016-06-02 | 1 | -0/+18 |
| |\ | |||||
| | * | special case m.room.third_party_invite event auth to match invites, ↵ | Matthew Hodgson | 2016-06-01 | 1 | -0/+18 |
| | | | | | | | | | otherwise they get out of sync and you get https://github.com/vector-im/vector-web/issues/1208 | ||||
| * | | WIP on unsubscribing email notifs without logging in | David Baker | 2016-06-01 | 1 | -9/+16 |
| |/ | |||||
| * | Spell "domain" correctly | Mark Haines | 2016-05-16 | 1 | -8/+8 |
| | | | | | s/domian/domain/g | ||||
| * | Create user with expiry | Negi Fazeli | 2016-05-13 | 1 | -1/+2 |
| | | | | | | | - Add unittests for client, api and handler Signed-off-by: Negar Fazeli <negar.fazeli@ericsson.com> | ||||
| * | Add and use get_domian_from_id | Erik Johnston | 2016-05-09 | 1 | -8/+8 |
| | | |||||
| * | Measure Auth.check | Erik Johnston | 2016-04-13 | 1 | -47/+50 |
| | | |||||
| * | Don't auto log failed auth checks | Erik Johnston | 2016-04-13 | 1 | -53/+45 |
| | | |||||
| * | Add published room list edit API | Erik Johnston | 2016-03-21 | 1 | -4/+50 |
| | | |||||
| * | Send the user ID matching the guest access token, since there is no Matrix ↵ | David Baker | 2016-03-07 | 1 | -2/+2 |
| | | | | | API to discover what user ID an access token is for. | ||||
| * | Allow third_party_signed to be specified on /join | Daniel Wagner-Hall | 2016-02-23 | 1 | -21/+36 |
| | | |||||
| * | Fix up logcontexts | Erik Johnston | 2016-02-08 | 1 | -1/+3 |
| | | |||||
| * | Log more diagnostics for unrecognised access tokens | Daniel Wagner-Hall | 2016-02-02 | 1 | -0/+2 |
| | | |||||
| * | Fix flake8 warnings for new flake8 | Daniel Wagner-Hall | 2016-02-02 | 1 | -1/+1 |
| | | |||||
| * | Don't error on AS non-ghost user use | Daniel Wagner-Hall | 2016-01-18 | 1 | -0/+2 |
| | | | | | | This will probably go away either when we fix our existing ASes, or when we kill the concept of non-ghost users. | ||||
| * | Pull out app service user lookup | Daniel Wagner-Hall | 2016-01-18 | 1 | -31/+28 |
| | | | | | I find this a lot simpler than nested try-catches and stuff | ||||
| * | Require AS users to be registered before use | Daniel Wagner-Hall | 2016-01-13 | 1 | -0/+5 |
| | | |||||
| * | Introduce a Requester object | Daniel Wagner-Hall | 2016-01-11 | 1 | -3/+5 |
| | | | | | | | | | | This tracks data about the entity which made the request. This is instead of passing around a tuple, which requires call-site modifications every time a new piece of optional context is passed around. I tried to introduce a User object. I gave up. | ||||
| * | Allow guests to upgrade their accounts | Daniel Wagner-Hall | 2016-01-05 | 1 | -3/+3 |
| | | |||||
| * | Strip address and such out of 3pid invites | Daniel Wagner-Hall | 2015-12-17 | 1 | -1/+1 |
| | | | | | We're not meant to leak that into the graph | ||||
| * | Allow user to redact with an equal power | Erik Johnston | 2015-11-26 | 1 | -1/+1 |
| | | | | | | Users only need their power level to be equal to the redact level for them to be allowed to redact events. | ||||
| * | Merge branch 'develop' into daniel/forgetrooms | Paul "LeoNerd" Evans | 2015-11-19 | 1 | -8/+17 |
| |\ | |||||
| | * | Take a boolean not a list of lambdas | Daniel Wagner-Hall | 2015-11-19 | 1 | -8/+17 |
| | | | |||||
| * | | Allow users to forget rooms | Daniel Wagner-Hall | 2015-11-17 | 1 | -0/+7 |
| |/ | |||||
| * | Always check guest = true in macaroons | Steven Hammerton | 2015-11-17 | 1 | -1/+2 |
| | | |||||
| * | Share more code between macaroon validation | Steven Hammerton | 2015-11-11 | 1 | -9/+10 |
| | | |||||
| * | Exchange 3pid invites for m.room.member invites | Daniel Wagner-Hall | 2015-11-05 | 1 | -35/+38 |
| | | |||||
| * | Allow guests to register and call /events?room_id= | Daniel Wagner-Hall | 2015-11-04 | 1 | -41/+54 |
| | | | | | | | | This follows the same flows-based flow as regular registration, but as the only implemented flow has no requirements, it auto-succeeds. In the future, other flows (e.g. captcha) may be required, so clients should treat this like the regular registration flow choices. | ||||
| * | Reject events which are too large | Daniel Wagner-Hall | 2015-10-22 | 1 | -1/+21 |
| | | | | | SPEC-222 | ||||
| * | Allow rejecting invites | Daniel Wagner-Hall | 2015-10-20 | 1 | -1/+5 |
| | | | | | | This is done by using the same /leave flow as you would use if you had already accepted the invite and wanted to leave. | ||||
| * | Stuff signed data in a standalone object | Daniel Wagner-Hall | 2015-10-16 | 1 | -7/+14 |
| | | | | | | Makes both generating it in sydent, and verifying it here, simpler at the cost of some repetition | ||||
| * | Add signing host and keyname to signatures | Daniel Wagner-Hall | 2015-10-16 | 1 | -5/+9 |
| | | |||||
| * | Verify third party ID server certificates | Daniel Wagner-Hall | 2015-10-16 | 1 | -0/+11 |
| | | |||||
| * | Remove unnecessary class-wrapping | Daniel Wagner-Hall | 2015-10-13 | 1 | -3/+3 |
| | | |||||
| * | Add some docstring | Daniel Wagner-Hall | 2015-10-13 | 1 | -0/+15 |
| | | |||||
| * | Move event contents into third_party_layout field | Daniel Wagner-Hall | 2015-10-13 | 1 | -9/+12 |
| | | |||||
| * | Add third party invites to auth_events for joins | Daniel Wagner-Hall | 2015-10-06 | 1 | -0/+5 |
| | | |||||
| * | Merge branch 'develop' into daniel/3pidinvites | Daniel Wagner-Hall | 2015-10-05 | 1 | -1/+24 |
| |\ | |||||
| | * | Merge branch 'develop' of github.com:matrix-org/synapse into erikj/unfederatable | Erik Johnston | 2015-10-02 | 1 | -3/+140 |
| | |\ | |||||
| | * \ | Merge branch 'develop' of github.com:matrix-org/synapse into erikj/unfederatable | Erik Johnston | 2015-09-14 | 1 | -8/+27 |
| | |\ \ | |||||
| | * | | | Also check the domains for membership state_keys | Erik Johnston | 2015-09-01 | 1 | -0/+9 |
| | | | | | |||||
| | * | | | Merge branch 'erikj/check_room_exists' into erikj/unfederatable | Erik Johnston | 2015-09-01 | 1 | -0/+8 |
| | |\ \ \ | |||||
| | * | | | | Check against sender rather than event_id | Erik Johnston | 2015-09-01 | 1 | -3/+3 |
| | | | | | | |||||
| | * | | | | Add flag which disables federation of the room | Erik Johnston | 2015-09-01 | 1 | -1/+15 |
| | | | | | | |||||
| * | | | | | Implement third party identifier invites | Daniel Wagner-Hall | 2015-10-01 | 1 | -1/+32 |
| | |_|_|/ |/| | | | |||||
| * | | | | Merge pull request #276 from ↵ | Mark Haines | 2015-09-21 | 1 | -0/+51 |
| |\ \ \ \ | | | | | | | | | | | | | | | | | | | | | matrix-org/markjh/history_for_rooms_that_have_been_left SPEC-216: Allow users to view the history of rooms that they have left. | ||||
| | * | | | | Clarify which event is returned by check_user_was_in_room | Mark Haines | 2015-09-21 | 1 | -2/+3 |
| | | | | | | |||||
| | * | | | | Allow rooms/{roomId}/state for a room that has been left | Mark Haines | 2015-09-09 | 1 | -1/+2 |
| | | | | | | |||||
| | * | | | | Allow room initialSync for users that have left the room, returning a ↵ | Mark Haines | 2015-09-09 | 1 | -0/+49 |
| | | | | | | | | | | | | | | | | | | | | | snapshot of how the room was when they left it | ||||
| * | | | | | Merge pull request #256 from matrix-org/auth | Daniel Wagner-Hall | 2015-09-14 | 1 | -3/+89 |
| |\ \ \ \ \ | |_|_|_|/ |/| | | | | Attempt to validate macaroons | ||||
| | * | | | | s/user_id/user/g for consistency | Daniel Wagner-Hall | 2015-09-01 | 1 | -10/+10 |
| | | | | | | |||||
| | * | | | | Attempt to validate macaroons | Daniel Wagner-Hall | 2015-08-26 | 1 | -9/+95 |
| | | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A couple of weird caveats: * If we can't validate your macaroon, we fall back to checking that your access token is in the DB, and ignoring the failure * Even if we can validate your macaroon, we still have to hit the DB to get the access token ID, which we pretend is a device ID all over the codebase. This mostly adds the interesting code, and points out the two pieces we need to delete (and necessary conditions) in order to fix the above caveats. | ||||
| * | | | | Merge pull request #265 from matrix-org/erikj/check_room_exists | Erik Johnston | 2015-09-14 | 1 | -0/+8 |
| |\ \ \ \ | |_|/ / |/| | / | | |/ | |/| | Check room exists when authenticating an event | ||||
| | * | | Fix tests | Erik Johnston | 2015-09-01 | 1 | -1/+1 |
| | | | | |||||
| | * | | Check room exists when authenticating an event, by asserting they reference ↵ | Erik Johnston | 2015-09-01 | 1 | -0/+8 |
| | |/ | | | | | | | a creation event | ||||
| * | | Check domain of events properly | Daniel Wagner-Hall | 2015-09-01 | 1 | -1/+3 |
| | | | | | | | | | Federated servers still need to delegate authority to owning servers | ||||
| * | | Allow users to redact their own events | Daniel Wagner-Hall | 2015-08-28 | 1 | -8/+25 |
| |/ | |||||
| * | Stop looking up "admin", which we never read | Daniel Wagner-Hall | 2015-08-25 | 1 | -3/+1 |
| | | |||||
| * | Re-wrap line | Daniel Wagner-Hall | 2015-08-25 | 1 | -3/+1 |
| | | |||||
| * | Remove completely unused concepts from codebase | Daniel Wagner-Hall | 2015-08-25 | 1 | -10/+7 |
| | | | | | | | | | | | Removes device_id and ClientInfo device_id is never actually written, and the matrix.org DB has no non-null entries for it. Right now, it's just cluttering up code. This doesn't remove the columns from the database, because that's fiddly. | ||||
| * | s/by_token/by_access_token/g | Daniel Wagner-Hall | 2015-08-20 | 1 | -3/+3 |
| | | | | | We're about to have two kinds of token, access and refresh | ||||
| * | Set request.authenticated_entity for application services | Erik Johnston | 2015-08-18 | 1 | -0/+3 |
| | | |||||
| * | Add missing space because linter | Daniel Wagner-Hall | 2015-08-11 | 1 | -1/+1 |
| | | |||||
| * | Minor docs cleanup | Daniel Wagner-Hall | 2015-08-11 | 1 | -2/+7 |
| | | |||||
| * | Remove redundant if-guard | Daniel Wagner-Hall | 2015-08-11 | 1 | -13/+12 |
| | | | | | The startswith("@") does the job | ||||
| * | Merge branch 'develop' of github.com:matrix-org/synapse into ↵ | Erik Johnston | 2015-07-13 | 1 | -1/+2 |
| |\ | | | | | | | erikj/power_level_sanity | ||||
| | * | Add m.room.history_visibility to newly created rooms' m.room.power_levels | Erik Johnston | 2015-07-06 | 1 | -0/+1 |
| | | | |||||
| | * | Add m.room.history_visibility to list of auth events | Erik Johnston | 2015-07-03 | 1 | -1/+1 |
| | | | |||||
| * | | Sanitize power level checks | Erik Johnston | 2015-07-10 | 1 | -15/+21 |
| | | | |||||
| * | | You shouldn't be able to ban/kick users with higher power levels | Erik Johnston | 2015-07-10 | 1 | -2/+5 |
| |/ | |||||
| * | Log more when we have processed the request | Erik Johnston | 2015-06-15 | 1 | -0/+2 |
| | | |||||
| * | Typo | Erik Johnston | 2015-05-01 | 1 | -1/+1 |
| | | |||||
| * | Remove some run_on_reactors | Erik Johnston | 2015-05-01 | 1 | -3/+0 |
| | | |||||
| * | Don't log all auth events every time we call auth.check | Erik Johnston | 2015-05-01 | 1 | -1/+4 |
| | | |||||
| * | Don't wait for storage of access_token | Erik Johnston | 2015-05-01 | 1 | -1/+1 |
| | | |||||
| * | Merge pull request #126 from matrix-org/csauth | Mark Haines | 2015-04-28 | 1 | -19/+27 |
| |\ | | | | | Client / Server Auth Refactor | ||||
 |
index : matrix/thirdparty/synapse.git | |
| Unnamed repository; edit this file 'description' to name the repository. |
| summary refs log tree commit diff |