summary refs log tree commit diff
path: root/tests/config (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Remove 3pid and identity serversRory&2025-06-283-26/+1
|
* Remove CAS authRory&2025-06-281-11/+0
|
* Fix a couple type annotations in the `RootConfig`/`Config` (#18409)Eric Eastwood2025-05-136-13/+20
| | | | | | | | | Fix a couple type annotations in the `RootConfig`/`Config`. Discovered while cribbing this code for another project. It's really sucks that `mypy` type checking doesn't catch this. I assume this is because we also have a `synapse/config/_base.pyi` that overrides all of this. Still unclear to me why the `Iterable[str]` vs `StrSequence` issue wasn't caught as that's what `ConfigError` expects.
* Add worker_replication_secret_path config option (#18191)V024602025-02-261-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Workers now get their secrets from files, too! There are not many config options left to pathify :) Includes documentation and unit tests. ### Pull Request Checklist <!-- Please read https://element-hq.github.io/synapse/latest/development/contributing_guide.html before submitting your pull request --> * [x] Pull request is based on the develop branch * [x] Pull request includes a [changelog file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog). The entry should: - Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from `EventStore` to `EventWorkerStore`.". - Use markdown where necessary, mostly for `code blocks`. - End with either a period (.) or an exclamation mark (!). - Start with a capital letter. - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry. * [x] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters)) --------- Co-authored-by: Devon Hudson <devon.dmytro@gmail.com>
* Add form_secret_path config option (#18090)V024602025-02-251-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I [was told](https://github.com/element-hq/synapse/pull/17983#issuecomment-2593370897) about another config option with a secret, so I got `form_secret` a companion: `form_secret_path` This PR makes NixOS and Kubernetes users a little bit happy. Includes docs and tests. ### Pull Request Checklist <!-- Please read https://element-hq.github.io/synapse/latest/development/contributing_guide.html before submitting your pull request --> * [x] Pull request is based on the develop branch * [x] Pull request includes a [changelog file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog). The entry should: - Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from `EventStore` to `EventWorkerStore`.". - Use markdown where necessary, mostly for `code blocks`. - End with either a period (.) or an exclamation mark (!). - Start with a capital letter. - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry. * [x] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
* Add --no-secrets-in-config command line option (#18092)V024602025-02-252-1/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds the `--no-secrets-in-config` command line option that makes Synapse reject all configurations containing keys with in-line secret values. Currently this rejects - `turn_shared_secret` - `registration_shared_secret` - `macaroon_secret_key` - `recaptcha_private_key` - `recaptcha_public_key` - `experimental_features.msc3861.client_secret` - `experimental_features.msc3861.jwk` - `experimental_features.msc3861.admin_token` - `form_secret` - `redis.password` - `worker_replication_secret` > [!TIP] > Hey, you! Yes, you! 😊 If you think this list is missing an item, please leave a comment below. Thanks :) This PR complements my other PRs[^1] that add the corresponding `_path` variants for this class of config options. It enables admins to enforce a policy of no secrets in configuration files and guards against accident and malice. Because I consider the flag `--no-secrets-in-config` to be security-relevant, I did not add a corresponding `--secrets-in-config` flag; this way, if Synapse command line options are appended at various places, there is no way to weaken the once-set setting with a succeeding flag. [^1]: [#17690](https://github.com/element-hq/synapse/pull/17690), [#17717](https://github.com/element-hq/synapse/pull/17717), [#17983](https://github.com/element-hq/synapse/pull/17983), [#17984](https://github.com/element-hq/synapse/pull/17984), [#18004](https://github.com/element-hq/synapse/pull/18004), [#18090](https://github.com/element-hq/synapse/pull/18090) ### Pull Request Checklist <!-- Please read https://element-hq.github.io/synapse/latest/development/contributing_guide.html before submitting your pull request --> * [x] Pull request is based on the develop branch * [x] Pull request includes a [changelog file](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#changelog). The entry should: - Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from `EventStore` to `EventWorkerStore`.". - Use markdown where necessary, mostly for `code blocks`. - End with either a period (.) or an exclamation mark (!). - Start with a capital letter. - Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry. * [x] [Code style](https://element-hq.github.io/synapse/latest/code_style.html) is correct (run the [linters](https://element-hq.github.io/synapse/latest/development/contributing_guide.html#run-the-linters))
* Add MSC3861 config options admin_token_path and client_secret_path (#18004)V024602025-02-041-0/+10
| | | | | | | | | | | | | | Another PR on my quest to a `*_path` variant for every secret. Adds two config options `admin_token_path` and `client_secret_path` to the experimental config under `experimental_features.msc3861`. Also includes tests. I tried to be a good citizen here by following `attrs` conventions and not rewriting the corresponding non-path variants in the class, but instead adding methods to retrieve the value. Reading secrets from files has the security advantage of separating the secrets from the config. It also simplifies secrets management in Kubernetes. Also useful to NixOS users.
* Add `macaroon_secret_key_path` config option (#17983)V024602024-12-162-10/+18
| | | | | | Another config option on my quest to a `*_path` variant for every secret. This time it’s `macaroon_secret_key_path`. Reading secrets from files has the security advantage of separating the secrets from the config. It also simplifies secrets management in Kubernetes. Also useful to NixOS users.
* Add config option redis.password_path (#17717)V024602024-10-071-0/+56
| | | | | | | | | | | Adds the option to load the Redis password from a file, instead of giving it in the config directly. The code is similar to how it’s done for `registration_shared_secret_path`. I changed the example in the documentation to represent the best practice regarding the handling of secrets. Reading secrets from files has the security advantage of separating the secrets from the config. It also simplifies secrets management in Kubernetes.
* Correctly mention previous copyright (#16820)Erik Johnston2024-01-2315-0/+16
| | | | | During the migration the automated script to update the copyright headers accidentally got rid of some of the existing copyright lines. Reinstate them.
* Allow room creation but not publishing to continue if room publication rules ↵Shay2024-01-221-2/+35
| | | | | | | | | | | | | are violated when creating a new room. (#16811) Prior to this PR, if a request to create a public (public as in published to the rooms directory) room violated the room list publication rules set in the [config](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#room_list_publication_rules), the request to create the room was denied and the room was not created. This PR changes the behavior such that when a request to create a room published to the directory violates room list publication rules, the room is still created but the room is not published to the directory.
* Merge remote-tracking branch 'gitlab/clokep/license-license' into new_developErik Johnston2023-12-1318-182/+288
|\
| * Update license headersPatrick Cloke2023-11-2118-182/+288
| |
* | Keep track of `user_ips` and `monthly_active_users` when delegating auth ↵David Robertson2023-11-231-9/+1
|/ | | | | | | | | | | | | (#16672) * Describe `insert_client_ip` * Pull out client_ips and MAU tracking to BaseAuth * Define HAS_AUTHLIB once in tests sick of copypasting * Track ips and token usage when delegating auth * Test that we track MAU and user_ips * Don't track `__oidc_admin`
* Describe which rate limiter was hit in logs (#16135)David Robertson2023-08-301-0/+31
|
* Disable `m.3pid_changes` capability when MSC3861 is enabled. (#16134)Mathieu Velten2023-08-221-0/+5
|
* Disallow user_consent where experimental MSC3861 is enabled (#16127)Hugh Nimmo-Smith2023-08-221-0/+16
|
* Remove `worker_replication_*` deprecated settings, with helpful errors on ↵Jason Little2023-07-071-26/+1
| | | | | | startup (#15860) Co-authored-by: reivilibre <oliverw@matrix.org>
* Implement stable support for MSC3882 to allow an existing device/session to ↵Hugh Nimmo-Smith2023-06-011-2/+2
| | | | | | | | generate a login token for use on a new device/session (#15388) Implements stable support for MSC3882; this involves updating Synapse's support to match the MSC / the spec says. Continue to support the unstable version to allow clients to transition.
* Make the config tests spawn the homeserver only when neededQuentin Gliech2023-05-301-194/+154
|
* Tests for JWKS endpointHugh Nimmo-Smith2023-05-301-11/+106
|
* Refactor config to be an experimental featureHugh Nimmo-Smith2023-05-301-0/+202
| | | | Also enforce you can't combine it with incompatible config options
* Fix a bug introduced in Synapse v1.84.0 where workers do not start up when ↵reivilibre2023-05-261-4/+39
| | | | | | | | | | | | | | | | | | | | | no `instance_map` was provided. (#15672) * Fix #15669: always populate instance map even if it was empty * Fix some tests * Fix more tests * Newsfile Signed-off-by: Olivier Wilkinson (reivilibre) <oliverw@matrix.org> * CI fix: don't forget to update apt repository sources before installing olddeps deps * Add test testing the backwards compatibility --------- Signed-off-by: Olivier Wilkinson (reivilibre) <oliverw@matrix.org>
* Throw if the appservice config list is the wrong type (#15425)Will Hunt2023-04-121-0/+40
| | | | | | | | | | | * raise a ConfigError on an invalid app_service_config_files * changelog * Move config check to read_config * Add test * Ensure list also contains strings
* Use immutabledict instead of frozendict (#15113)David Robertson2023-03-221-3/+3
| | | | | | | | | | Additionally: * Consistently use `freeze()` in test --------- Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: 6543 <6543@obermui.de>
* Add missing type hints to tests.config. (#14681)Patrick Cloke2022-12-1614-91/+102
|
* Allow selecting "prejoin" events by state keys (#14642)David Robertson2022-12-131-0/+145
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Declare new config * Parse new config * Read new config * Don't use trial/our TestCase where it's not needed Before: ``` $ time trial tests/events/test_utils.py > /dev/null real 0m2.277s user 0m2.186s sys 0m0.083s ``` After: ``` $ time trial tests/events/test_utils.py > /dev/null real 0m0.566s user 0m0.508s sys 0m0.056s ``` * Helper to upsert to event fields without exceeding size limits. * Use helper when adding invite/knock state Now that we allow admins to include events in prejoin room state with arbitrary state keys, be a good Matrix citizen and ensure they don't accidentally create an oversized event. * Changelog * Move StateFilter tests should have done this in #14668 * Add extra methods to StateFilter * Use StateFilter * Ensure test file enforces typed defs; alphabetise * Workaround surprising get_current_state_ids * Whoops, fix mypy
* Reload cache factors from disk on SIGHUP (#12673)David Robertson2022-05-111-0/+8
|
* Add the `update_user_directory_from_worker` configuration option ↵reivilibre2022-05-101-0/+27
| | | | | (superseding `update_user_directory`) to allow a generic worker to be designated as the worker to update the user directory. (#12654) Co-authored-by: Shay <hillerys@element.io>
* Add the `notify_appservices_from_worker` configuration option (superseding ↵reivilibre2022-05-061-0/+288
| | | | `notify_appservices`) to allow a generic worker to be designated as the worker to send traffic to Application Services. (#12452)
* Add missing type hints to config classes. (#12402)Patrick Cloke2022-04-112-10/+22
|
* Add restrictions by default to open registration in Synapse (#12091)Shay2022-03-251-2/+20
|
* Add config settings for background update parameters (#11980)Shay2022-03-111-0/+58
|
* Support configuring the lifetime of non-refreshable access tokens separately ↵reivilibre2021-12-031-0/+78
| | | | to refreshable access tokens. (#11445)
* Add missing type hints to config base classes (#11377)Patrick Cloke2021-11-231-8/+14
|
* Remove legacy code related to deprecated ↵Shay2021-11-181-0/+9
| | | | | | | | | | | | | | | | | | | | | `trust_identity_server_for_password_resets` config flag (#11333) * remove code legacy code related to deprecated config flag "trust_identity_server_for_password_resets" from synapse/config/emailconfig.py * remove legacy code supporting depreciated config flag "trust_identity_server_for_password_resets" from synapse/config/registration.py * remove legacy code supporting depreciated config flag "trust_identity_server_for_password_resets" from synapse/handlers/identity.py * add tests to ensure config error is thrown and synapse refuses to start when depreciated config flag is found * add changelog * slightly change behavior to only check for deprecated flag if set to 'true' * Update changelog.d/11333.misc Co-authored-by: reivilibre <oliverw@matrix.org> Co-authored-by: reivilibre <oliverw@matrix.org>
* Fix synapse.config module "read" command (#11145)Jason Robinson2021-10-223-55/+104
| | | | | | | | | | `synapse.config.__main__` has the possibility to read a config item. This can be used to conveniently also validate the config is valid before trying to start Synapse. The "read" command broke in https://github.com/matrix-org/synapse/pull/10916 as it now requires passing in "server.server_name" for example. Also made the read command optional so one can just call this with just the confirm file reference and get a "Config parses OK" if things are ok. Signed-off-by: Jason Robinson <jasonr@matrix.org> Co-authored-by: Brendan Abolivier <babolivier@matrix.org>
* Reset global cache state before cache tests. (#11036)Patrick Cloke2021-10-121-13/+11
| | | | | | This reverts #11019 and structures the code a bit more like it was before #10985. The global cache state must be reset before running the tests since other test cases might have configured caching (and thus touched the global state).
* Ensure each cache config test uses separate state. (#11019)Patrick Cloke2021-10-071-8/+12
| | | Hopefully this fixes these tests sometimes failing in CI.
* Require direct references to configuration variables. (#10985)Patrick Cloke2021-10-064-63/+58
| | | | | | This removes the magic allowing accessing configurable variables directly from the config object. It is now required that a specific configuration class is used (e.g. `config.foo` must be replaced with `config.server.foo`).
* Use direct references for configuration variables (part 7). (#10959)Patrick Cloke2021-10-041-3/+3
|
* Use direct references for configuration variables (part 4). (#10893)Patrick Cloke2021-09-232-6/+6
|
* Add config option to use non-default manhole password and keys (#10643)Azrenbeth2021-09-061-4/+4
|
* Allow using several custom template directories (#10587)Brendan Abolivier2021-08-171-3/+61
| | | Allow using several directories in read_templates.
* [pyupgrade] `tests/` (#10347)Jonathan de Jong2021-07-131-2/+2
|
* Remove support for ACME v1 (#10194)Brendan Abolivier2021-06-171-97/+0
| | | | | Fixes #9778 ACME v1 has been fully decommissioned for existing installs on June 1st 2021(see https://community.letsencrypt.org/t/end-of-life-plan-for-acmev1/88430/27), so we can now safely remove it from Synapse.
* Remove redundant code to reload tls cert (#10054)Richard van der Hoff2021-05-271-2/+1
| | | | | we don't need to reload the tls cert if we don't have any tls listeners. Follow-up to #9280.
* Remove redundant "coding: utf-8" lines (#9786)Jonathan de Jong2021-04-1411-11/+0
| | | | | | | Part of #9744 Removes all redundant `# -*- coding: utf-8 -*-` lines from files, as python 3 automatically reads source code as utf-8 now. `Signed-off-by: Jonathan de Jong <jonathan@automatia.nl>`
* Fix reported bugbear: too broad exception assertion (#9753)Andrew Morgan2021-04-061-2/+3
|
* Update black, and run auto formatting over the codebase (#9381)Eric Eastwood2021-02-161-3/+3
| | | | | | | - Update black version to the latest - Run black auto formatting over the codebase - Run autoformatting according to [`docs/code_style.md `](https://github.com/matrix-org/synapse/blob/80d6dc9783aa80886a133756028984dbf8920168/docs/code_style.md) - Update `code_style.md` docs around installing black to use the correct version
* Convert blacklisted IPv4 addresses to compatible IPv6 addresses. (#9240)Patrick Cloke2021-02-031-1/+60
| | | Also add a few more IP ranges to the default blacklist.
* Fix validate_config on nested objects (#9054)Richard van der Hoff2021-01-081-0/+53
|
* Use the default templates when a custom template file cannot be found (#8037)Andrew Morgan2020-08-171-0/+82
| | | Fixes https://github.com/matrix-org/synapse/issues/6583
* Fix specifying cache factors via env vars with * in name. (#7580)Erik Johnston2020-05-271-0/+28
| | | | | This mostly applise to `*stateGroupCache*` and co. Broke in #6391.
* Don't apply cache factor to event cache. (#7578)Erik Johnston2020-05-271-0/+16
| | | | This is already correctly done when we instansiate the cache, but wasn't when it got reloaded (which always happens at least once on startup).
* Fix new flake8 errors (#7470)Erik Johnston2020-05-121-1/+1
|
* Allow configuration of Synapse's cache without using synctl or environment ↵Amber Brown2020-05-111-0/+127
| | | | variables (#6391)
* Improve database configuration docs (#6988)Richard van der Hoff2020-03-201-20/+2
| | | | | Attempts to clarify the sample config for databases, and add some stuff about tcp keepalives to `postgres.md`.
* Share SSL contexts for non-federation requests (#7094)Richard van der Hoff2020-03-171-10/+19
| | | | | | | Extends #5794 etc to the SimpleHttpClient so that it also applies to non-federation requests. Fixes #7092.
* Clarify list/set/dict/tuple comprehensions and enforce via flake8 (#6957)Patrick Cloke2020-02-211-1/+1
| | | | Ensure good comprehension hygiene using flake8-comprehensions.
* Refactor HomeserverConfig so it can be typechecked (#6137)Amber Brown2019-10-101-9/+16
|
* Fix well-known lookups with the federation certificate whitelist (#5997)Amber Brown2019-09-141-0/+40
|
* Servers-known-about statistic (#5981)Amber Brown2019-09-072-23/+36
|
* Config templating (#5900)Jorik Schellekens2019-08-283-1/+196
| | | | | | | | | | | | Template config files * Imagine a system composed entirely of x, y, z etc and the basic operations.. Wait George, why XOR? Why not just neq? George: Eh, I didn't think of that.. Co-Authored-By: Erik Johnston <erik@matrix.org>
* Fixes to the federation rate limiter (#5621)Richard van der Hoff2019-07-051-0/+40
| | | | | | | - Put the default window_size back to 1000ms (broken by #5181) - Make the `rc_federation` config actually do something - fix an off-by-one error in the 'concurrent' limit - Avoid creating an unused `_PerHostRatelimiter` object for every single incoming request
* Update the TLS cipher string and provide configurability for TLS on outgoing ↵Amber Brown2019-06-281-1/+114
| | | | federation (#5550)
* Pass config_dir_path and data_dir_path into Config.read_config. (#5522)Richard van der Hoff2019-06-241-1/+1
| | | | | | * Pull config_dir_path and data_dir_path calculation out of read_config_files * Pass config_dir_path and data_dir_path into read_config
* Run Black. (#5482)Amber Brown2019-06-202-5/+5
|
* Run Black on the tests again (#5170)Amber Brown2019-05-104-93/+105
|
* Neilj/fix threepid auth check (with tests) (#4474)Neil Johnson2019-04-011-0/+32
| | | test threepid checking
* Use yaml safe_loadErik Johnston2019-03-222-3/+3
|
* Clarify and fix behaviour when there are multiple aliasesErik Johnston2019-02-141-0/+6
|
* Add configurable room list publishing rulesErik Johnston2019-02-141-0/+73
| | | | | This allows specifying who and what is allowed to be published onto the public room list
* Fix error when loading cert if tls is disabled (#4618)Richard van der Hoff2019-02-121-1/+1
| | | | | | If TLS is disabled, it should not be an error if no cert is given. Fixes #4554.
* fix testsRichard van der Hoff2019-02-111-2/+6
|
* Do not generate self-signed TLS certificates by default. (#4509)Amber Brown2019-01-292-2/+75
|
* Require ECDH key exchange & remove dh_params (#4429)Amber Brown2019-01-221-1/+0
| | | * remove dh_params and set better cipher string
* Merge branch 'develop' of github.com:matrix-org/synapse into ↵Erik Johnston2018-10-251-1/+1
|\ | | | | | | erikj/alias_disallow_list
| * Fix a number of flake8 errorsRichard van der Hoff2018-10-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | Broadly three things here: * disable W504 which seems a bit whacko * remove a bunch of `as e` expressions from exception handlers that don't use them * use `r""` for strings which include backslashes Also, we don't use pep8 any more, so we can get rid of the duplicate config there.
* | Use allow/denyErik Johnston2018-10-251-4/+4
| |
* | Add tests for config generationErik Johnston2018-10-191-0/+67
|/
* Run black.black2018-08-102-34/+42
|
* run isortAmber Brown2018-07-092-0/+4
|
* Make tests py3 compatibleAdrian Tschira2018-04-161-1/+1
| | | | | | | | | | | This is a mixed commit that fixes various small issues * print parentheses * 01 is invalid syntax (it was octal in py2) * [x for i in 1, 2] is invalid syntax * six moves Signed-off-by: Adrian Tschira <nota@notafile.com>
* Fix broken config UTsRichard van der Hoff2018-01-091-1/+16
| | | | | https://github.com/matrix-org/synapse/pull/2755 broke log-config generation, which in turn broke the unit tests.
* Add function to load config without generating itMark Haines2016-06-092-3/+21
| | | | | | | | | | | | | | | | Renames ``load_config`` to ``load_or_generate_config`` Adds a method called ``load_config`` that just loads the config. The main synapse.app.homeserver will continue to use ``load_or_generate_config`` to retain backwards compat. However new worker processes can use ``load_config`` to load the config avoiding some of the cruft needed to generate the config. As the new ``load_config`` method is expected to be used by new configs it removes support for the legacy commandline overrides that ``load_or_generate_config`` supports
* Check that the disable_registration config key is handled correctlyMark Haines2016-02-221-0/+21
|
* TypoErik Johnston2016-02-091-1/+1
|
* Fix testErik Johnston2016-02-091-3/+4
|
* Error if macaroon key is missing from configDaniel Wagner-Hall2016-02-053-0/+141
Currently we store all access tokens in the DB, and fall back to that check if we can't validate the macaroon, so our fallback works here, but for guests, their macaroons don't get persisted, so we don't get to find them in the database. Each restart, we generate a new ephemeral key, so guests lose access after each server restart. I tried to fix up the config stuff to be less insane, but gave up, so instead I bolt on yet another piece of custom one-off insanity. Also, add some basic tests for config generation and loading.
generated by cgit-magenta 1.5.1 (git 2.48.1) at 2025-09-02 08:14:01 +0000