summary refs log tree commit diff
path: root/tests/api/test_auth.py (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Move the "email unsubscribe" resource, refactor the macaroon generator & ↵Quentin Gliech2022-06-141-10/+5
| | | | | | | | | | | | | | | | | | | | | simplify the access token verification logic. (#12986) This simplifies the access token verification logic by removing the `rights` parameter which was only ever used for the unsubscribe link in email notifications. The latter has been moved under the `/_synapse` namespace, since it is not a standard API. This also makes the email verification link more secure, by embedding the app_id and pushkey in the macaroon and verifying it. This prevents the user from tampering the query parameters of that unsubscribe link. Macaroon generation is refactored: - Centralised all macaroon generation and verification logic to the `MacaroonGenerator` - Moved to `synapse.utils` - Changed the constructor to require only a `Clock`, hostname, and a secret key (instead of a full `Homeserver`). - Added tests for all methods.
* Decouple `synapse.api.auth_blocking.AuthBlocking` from ↵Quentin Gliech2022-06-141-15/+27
| | | | `synapse.api.auth.Auth`. (#13021)
* Remove remaining bits of groups code. (#12936)Patrick Cloke2022-06-011-2/+0
| | | | | | * Update worker docs to remove group endpoints. * Removes an unused parameter to `ApplicationService`. * Break dependency between media repo and groups. * Avoid copying `m.room.related_groups` state events during room upgrades.
* Use `getClientAddress` instead of `getClientIP`. (#12599)Patrick Cloke2022-05-041-9/+9
| | | | | getClientIP was deprecated in Twisted 18.4.0, which also added getClientAddress. The Synapse minimum version for Twisted is currently 18.9.0, so all supported versions have the new API.
* Replace assertEquals and friends with non-deprecated versions. (#12092)Patrick Cloke2022-02-281-18/+18
|
* Remove `HomeServer.get_datastore()` (#12031)Richard van der Hoff2022-02-231-2/+6
| | | | | | | The presence of this method was confusing, and mostly present for backwards compatibility. Let's get rid of it. Part of #11733
* Allow tracking puppeted users for MAU (#11561)Jason Robinson2022-01-121-0/+33
| | | | | | | | | | | | | | | Currently when puppeting another user, the user doing the puppeting is tracked for client IPs and MAU (if configured). When tracking MAU is important, it becomes necessary to be possible to also track the client IPs and MAU of puppeted users. As an example a client that manages user creation and creation of tokens via the Synapse admin API, passing those tokens for the client to use. This PR adds optional configuration to enable tracking of puppeted users into monthly active users. The default behaviour stays the same. Signed-off-by: Jason Robinson <jasonr@matrix.org>
* Add experimental support for MSC3202: allowing application services to ↵reivilibre2021-12-151-0/+64
| | | | masquerade as specific devices. (#11538)
* Use direct references for configuration variables (part 6). (#10916)Patrick Cloke2021-09-291-7/+7
|
* Fix AuthBlocking check when requester is appservice (#10881)Jason Robinson2021-09-241-0/+62
| | | | | If the MAU count had been reached, Synapse incorrectly blocked appservice users even though they've been explicitly configured not to be tracked (the default). This was due to bypassing the relevant if as it was chained behind another earlier hit if as an elif. Signed-off-by: Jason Robinson <jasonr@matrix.org>
* Use direct references for configuration variables (part 4). (#10893)Patrick Cloke2021-09-231-2/+2
|
* MSC2918 Refresh tokens implementation (#9450)Quentin Gliech2021-06-241-0/+1
| | | | | | | | | | This implements refresh tokens, as defined by MSC2918 This MSC has been implemented client side in Hydrogen Web: vector-im/hydrogen-web#235 The basics of the MSC works: requesting refresh tokens on login, having the access tokens expire, and using the refresh token to get a new one. Signed-off-by: Quentin Gliech <quentingliech@gmail.com>
* Change the format of access tokens away from macaroons (#5588)Richard van der Hoff2021-05-121-63/+0
|
* Remove redundant "coding: utf-8" lines (#9786)Jonathan de Jong2021-04-141-1/+0
| | | | | | | Part of #9744 Removes all redundant `# -*- coding: utf-8 -*-` lines from files, as python 3 automatically reads source code as utf-8 now. `Signed-off-by: Jonathan de Jong <jonathan@automatia.nl>`
* Use mock from the stdlib. (#9772)Patrick Cloke2021-04-091-1/+1
|
* Update black, and run auto formatting over the codebase (#9381)Eric Eastwood2021-02-161-1/+4
| | | | | | | - Update black version to the latest - Run black auto formatting over the codebase - Run autoformatting according to [`docs/code_style.md `](https://github.com/matrix-org/synapse/blob/80d6dc9783aa80886a133756028984dbf8920168/docs/code_style.md) - Update `code_style.md` docs around installing black to use the correct version
* Convert additional test-cases to homeserver test case. (#9396)Patrick Cloke2021-02-161-132/+92
| | | And convert some inlineDeferreds to async-friendly functions.
* Add admin API for logging in as a user (#8617)Erik Johnston2020-11-171-1/+5
|
* Add ability for access tokens to belong to one user but grant access to ↵Erik Johnston2020-10-291-16/+13
| | | | | | | | | | another user. (#8616) We do it this way round so that only the "owner" can delete the access token (i.e. `/logout/all` by the "owner" also deletes that token, but `/logout/all` by the "target user" doesn't). A future PR will add an API for creating such a token. When the target user and authenticated entity are different the `Processed request` log line will be logged with a: `{@admin:server as @bob:server} ...`. I'm not convinced by that format (especially since it adds spaces in there, making it harder to use `cut -d ' '` to chop off the start of log lines). Suggestions welcome.
* Remove the deprecated Handlers object (#8494)Patrick Cloke2020-10-091-9/+3
| | | All handlers now available via get_*_handler() methods on the HomeServer.
* Stop sub-classing object (#8249)Patrick Cloke2020-09-041-1/+1
|
* Convert synapse.api to async/await (#8031)Patrick Cloke2020-08-061-27/+42
|
* Stop Auth methods from polling the config on every req. (#7420)Andrew Morgan2020-05-061-16/+20
|
* Convert auth handler to async/await (#7261)Patrick Cloke2020-04-151-24/+40
|
* Ensure support users can be registered even if MAU limit is reachedJason Robinson2019-09-111-0/+18
| | | | | | | | | This allows support users to be created even on MAU limits via the admin API. Support users are excluded from MAU after creation, so it makes sense to exclude them in creation - except if the whole host is in disabled state. Signed-off-by: Jason Robinson <jasonr@matrix.org>
* Implement access token expiry (#5660)Richard van der Hoff2019-07-121-2/+4
| | | | Record how long an access token is valid for, and raise a soft-logout once it expires.
* Clean up exception handling for access_tokens (#5656)Richard van der Hoff2019-07-111-7/+24
| | | | | | | | | | | | | | | | First of all, let's get rid of `TOKEN_NOT_FOUND_HTTP_STATUS`. It was a hack we did at one point when it was possible to return either a 403 or a 401 if the creds were missing. We always return a 401 in these cases now (thankfully), so it's not needed. Let's also stop abusing `AuthError` for these cases. Honestly they have nothing that relates them to the other places that `AuthError` is used, other than the fact that they are loosely under the 'Auth' banner. It makes no sense for them to share exception classes. Instead, let's add a couple of new exception classes: `InvalidClientTokenError` and `MissingClientTokenError`, for the `M_UNKNOWN_TOKEN` and `M_MISSING_TOKEN` cases respectively - and an `InvalidClientCredentialsError` base class for the two of them.
* Inline issue_access_token (#5659)Richard van der Hoff2019-07-111-1/+1
| | | | | | | | this is only used in one place, so it's clearer if we inline it and reduce the API surface. Also, fixes a buglet where we would create an access token even if we were about to block the user (we would never return the AT, so the user could never use it, but it was still created and added to the db.)
* Remove access-token support from RegistrationStore.register (#5642)Richard van der Hoff2019-07-101-1/+1
| | | | | The 'token' param is no longer used anywhere except the tests, so let's kill that off too.
* Run Black. (#5482)Amber Brown2019-06-201-6/+6
|
* Enforce hs_disabled_message correctlyRichard van der Hoff2019-03-191-0/+17
| | | | | Fixes a bug where hs_disabled_message was not enforced for 3pid-based requests if there was no server_notices_mxid configured.
* Merge branch rav/macaroon_key_fix_0.34 into rav/macaroon_key_fix_0.34.1Richard van der Hoff2019-01-101-154/+1
|\ | | | | | | Fixes #4371
| * Merge branch 'rav/macaroon_key_fix' into rav/macaroon_key_fix_0.34Richard van der Hoff2019-01-101-154/+1
| |\
| | * Skip macaroon check for access tokens in the dbRichard van der Hoff2019-01-101-148/+1
| | |
* | | create support user (#4141)Neil Johnson2018-12-141-0/+2
|/ / | | | | | | | | | | Allow for the creation of a support user. A support user can access the server, join rooms, interact with other users, but does not appear in the user directory nor does it contribute to monthly active user limits.
* | Port tests/ to Python 3 (#3808)Amber Brown2018-09-071-0/+1
| |
* | fix bug where preserved threepid user comes to sign up and server is mau blockedNeil Johnson2018-08-311-0/+17
| |
* | Change admin_uri to admin_contact in config and errorsErik Johnston2018-08-241-2/+2
| |
* | rename error codeNeil Johnson2018-08-181-2/+2
| |
* | special case server_notices_mxidNeil Johnson2018-08-181-0/+8
| |
* | add new error type ResourceLimitNeil Johnson2018-08-161-3/+3
| |
* | update error codes for resource limitingNeil Johnson2018-08-151-2/+2
| |
* | replace admin_email with admin_uri for greater flexibilityNeil Johnson2018-08-151-2/+2
| |
* | support admin_email config and pass through into blocking errors, return ↵Neil Johnson2018-08-131-1/+5
| | | | | | | | AuthError in all cases
* | Revert "support admin_email config and pass through into blocking errors, ↵Neil Johnson2018-08-131-5/+1
| | | | | | | | | | | | return AuthError in all cases" This reverts commit 0d43f991a19840a224d3dac78d79f13d78212ee6.
* | support admin_email config and pass through into blocking errors, return ↵Neil Johnson2018-08-131-1/+5
| | | | | | | | AuthError in all cases
* | Run tests under PostgreSQL (#3423)Amber Brown2018-08-131-1/+1
| |
* | Run black.black2018-08-101-41/+35
| |
* | disable HS from configNeil Johnson2018-08-041-1/+10
| |
* | remove unused importNeil Johnson2018-08-031-1/+1
| |
* | bug fixesNeil Johnson2018-08-031-7/+3
| |
* | do mau checks based on monthly_active_users tableNeil Johnson2018-08-021-1/+30
|/
* Python 3: Convert some unicode/bytes uses (#3569)Amber Brown2018-08-021-16/+19
|
* run isortAmber Brown2018-07-091-2/+5
|
* add testMatthew Hodgson2018-06-281-0/+33
|
* fix testsMatthew Hodgson2018-06-281-3/+15
|
* Prevent user tokens being used as guest tokens (#1675)Richard van der Hoff2016-12-061-15/+78
| | | | | Make sure that a user cannot pretend to be a guest by adding 'guest = True' caveats.
* Fix unit testsMark Haines2016-09-121-9/+9
|
* Record device_id in client_ipsRichard van der Hoff2016-07-201-1/+9
| | | | | Record the device_id when we add a client ip; it's somewhat redundant as we could get it via the access_token, but it will make querying rather easier.
* Bug fix: expire invalid access tokensNegar Fazeli2016-07-131-1/+30
|
* Create user with expiryNegi Fazeli2016-05-131-6/+6
| | | | | | - Add unittests for client, api and handler Signed-off-by: Negar Fazeli <negar.fazeli@ericsson.com>
* Fix flake8 warnings for testsMark Haines2016-02-191-2/+2
|
* Introduce a Requester objectDaniel Wagner-Hall2016-01-111-6/+6
| | | | | | | | | This tracks data about the entity which made the request. This is instead of passing around a tuple, which requires call-site modifications every time a new piece of optional context is passed around. I tried to introduce a User object. I gave up.
* Allow guests to upgrade their accountsDaniel Wagner-Hall2016-01-051-9/+9
|
* Allow guests to register and call /events?room_id=Daniel Wagner-Hall2015-11-041-3/+22
| | | | | | | This follows the same flows-based flow as regular registration, but as the only implemented flow has no requirements, it auto-succeeds. In the future, other flows (e.g. captcha) may be required, so clients should treat this like the regular registration flow choices.
* s/user_id/user/g for consistencyDaniel Wagner-Hall2015-09-011-4/+4
|
* Turn TODO into thing which actually will failDaniel Wagner-Hall2015-08-261-6/+9
|
* Attempt to validate macaroonsDaniel Wagner-Hall2015-08-261-2/+140
| | | | | | | | | | | | | A couple of weird caveats: * If we can't validate your macaroon, we fall back to checking that your access token is in the DB, and ignoring the failure * Even if we can validate your macaroon, we still have to hit the DB to get the access token ID, which we pretend is a device ID all over the codebase. This mostly adds the interesting code, and points out the two pieces we need to delete (and necessary conditions) in order to fix the above caveats.
* Stop looking up "admin", which we never readDaniel Wagner-Hall2015-08-251-2/+0
|
* Remove completely unused concepts from codebaseDaniel Wagner-Hall2015-08-251-5/+3
| | | | | | | | | | Removes device_id and ClientInfo device_id is never actually written, and the matrix.org DB has no non-null entries for it. Right now, it's just cluttering up code. This doesn't remove the columns from the database, because that's fiddly.
* s/by_token/by_access_token/gDaniel Wagner-Hall2015-08-201-8/+8
| | | | We're about to have two kinds of token, access and refresh
* Remove unused imports.Kegan Dougal2015-02-091-2/+2
|
* Modify auth.get_user_by_req for authing appservices directly.Kegan Dougal2015-02-091-0/+139
Add logic to map the appservice token to the autogenned appservice user ID. Add unit tests for all forms of get_user_by_req (user/appservice, valid/bad/missing tokens)
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-27 14:15:34 +0000