Mercurial > prosody-hg

comparison core/usermanager.lua @ 11200:bf8f2da84007

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge 0.11->trunk
author Kim Alvefur <zash@zash.se>
date Thu, 05 Nov 2020 22:31:25 +0100
parents 52886aad9ee1
children afe80b64e209
comparison
equal deleted inserted replaced
11199:6c7c50a4de32 11200:bf8f2da84007
7 -- 7 --
8 8
9 local modulemanager = require "core.modulemanager"; 9 local modulemanager = require "core.modulemanager";
10 local log = require "util.logger".init("usermanager"); 10 local log = require "util.logger".init("usermanager");
11 local type = type; 11 local type = type;
12 local ipairs = ipairs;
13 local jid_bare = require "util.jid".bare; 12 local jid_bare = require "util.jid".bare;
13 local jid_split = require "util.jid".split;
14 local jid_prep = require "util.jid".prep; 14 local jid_prep = require "util.jid".prep;
15 local config = require "core.configmanager"; 15 local config = require "core.configmanager";
16 local sasl_new = require "util.sasl".new; 16 local sasl_new = require "util.sasl".new;
17 local storagemanager = require "core.storagemanager"; 17 local storagemanager = require "core.storagemanager";
18 local set = require "util.set";
18 19
19 local prosody = _G.prosody; 20 local prosody = _G.prosody;
20 local hosts = prosody.hosts; 21 local hosts = prosody.hosts;
21 22
22 local setmetatable = setmetatable; 23 local setmetatable = setmetatable;
32 return setmetatable({name = "null", get_sasl_handler = dummy_get_sasl_handler}, { 33 return setmetatable({name = "null", get_sasl_handler = dummy_get_sasl_handler}, {
33 __index = function(self, method) return dummy; end --luacheck: ignore 212 34 __index = function(self, method) return dummy; end --luacheck: ignore 212
34 }); 35 });
35 end 36 end
36 37
38 local global_admins_config = config.get("*", "admins");
39 if type(global_admins_config) ~= "table" then
40 global_admins_config = nil; -- TODO: factor out moduleapi magic config handling and use it here
41 end
42 local global_admins = set.new(global_admins_config) / jid_prep;
43
44 local admin_role = { ["prosody:admin"] = true };
45 local global_authz_provider = {
46 get_user_roles = function (user) end; --luacheck: ignore 212/user
47 get_jid_roles = function (jid)
48 if global_admins:contains(jid) then
49 return admin_role;
50 end
51 end;
52 };
53
37 local provider_mt = { __index = new_null_provider() }; 54 local provider_mt = { __index = new_null_provider() };
38 55
39 local function initialize_host(host) 56 local function initialize_host(host)
40 local host_session = hosts[host]; 57 local host_session = hosts[host];
58
59 local authz_provider_name = config.get(host, "authorization") or "internal";
60
61 local authz_mod = modulemanager.load(host, "authz_"..authz_provider_name);
62 host_session.authz = authz_mod or global_authz_provider;
63
41 if host_session.type ~= "local" then return; end 64 if host_session.type ~= "local" then return; end
42 65
43 host_session.events.add_handler("item-added/auth-provider", function (event) 66 host_session.events.add_handler("item-added/auth-provider", function (event)
44 local provider = event.item; 67 local provider = event.item;
45 local auth_provider = config.get(host, "authentication") or default_provider; 68 local auth_provider = config.get(host, "authentication") or default_provider;
64 local auth_provider = config.get(host, "authentication") or default_provider; 87 local auth_provider = config.get(host, "authentication") or default_provider;
65 if config.get(host, "anonymous_login") then auth_provider = "anonymous"; end -- COMPAT 0.7 88 if config.get(host, "anonymous_login") then auth_provider = "anonymous"; end -- COMPAT 0.7
66 if auth_provider ~= "null" then 89 if auth_provider ~= "null" then
67 modulemanager.load(host, "auth_"..auth_provider); 90 modulemanager.load(host, "auth_"..auth_provider);
68 end 91 end
92
69 end; 93 end;
70 prosody.events.add_handler("host-activated", initialize_host, 100); 94 prosody.events.add_handler("host-activated", initialize_host, 100);
71 95
72 local function test_password(username, host, password) 96 local function test_password(username, host, password)
73 return hosts[host].users.test_password(username, password); 97 return hosts[host].users.test_password(username, password);
111 135
112 local function get_provider(host) 136 local function get_provider(host)
113 return hosts[host].users; 137 return hosts[host].users;
114 end 138 end
115 139
116 local function is_admin(jid, host) 140 local function get_roles(jid, host)
117 if host and not hosts[host] then return false; end 141 if host and not hosts[host] then return false; end
118 if type(jid) ~= "string" then return false; end 142 if type(jid) ~= "string" then return false; end
119 143
120 jid = jid_bare(jid); 144 jid = jid_bare(jid);
121 host = host or "*"; 145 host = host or "*";
122 146
123 local host_admins = config.get(host, "admins"); 147 local actor_user, actor_host = jid_split(jid);
124 local global_admins = config.get("*", "admins"); 148 local roles;
125 149
126 if host_admins and host_admins ~= global_admins then 150 local authz_provider = (host ~= "*" and hosts[host].authz) or global_authz_provider;
127 if type(host_admins) == "table" then 151
128 for _,admin in ipairs(host_admins) do 152 if actor_user and actor_host == host then -- Local user
129 if jid_prep(admin) == jid then 153 roles = authz_provider.get_user_roles(actor_user);
130 return true; 154 else -- Remote user/JID
131 end 155 roles = authz_provider.get_jid_roles(jid);
132 end
133 elseif host_admins then
134 log("error", "Option 'admins' for host '%s' is not a list", host);
135 end
136 end 156 end
137 157
138 if global_admins then 158 return roles;
139 if type(global_admins) == "table" then 159 end
140 for _,admin in ipairs(global_admins) do
141 if jid_prep(admin) == jid then
142 return true;
143 end
144 end
145 elseif global_admins then
146 log("error", "Global option 'admins' is not a list");
147 end
148 end
149 160
150 -- Still not an admin, check with auth provider 161 local function is_admin(jid, host)
151 if host ~= "*" and hosts[host].users and hosts[host].users.is_admin then 162 local roles = get_roles(jid, host);
152 return hosts[host].users.is_admin(jid); 163 return roles and roles["prosody:admin"];
153 end
154 return false;
155 end 164 end
156 165
157 return { 166 return {
158 new_null_provider = new_null_provider; 167 new_null_provider = new_null_provider;
159 initialize_host = initialize_host; 168 initialize_host = initialize_host;
164 create_user = create_user; 173 create_user = create_user;
165 delete_user = delete_user; 174 delete_user = delete_user;
166 users = users; 175 users = users;
167 get_sasl_handler = get_sasl_handler; 176 get_sasl_handler = get_sasl_handler;
168 get_provider = get_provider; 177 get_provider = get_provider;
178 get_roles = get_roles;
169 is_admin = is_admin; 179 is_admin = is_admin;
170 }; 180 };