Mercurial > prosody-hg
view plugins/mod_http_openmetrics.lua @ 12659:c0eea4f6c739
usermanager: Add back temporary is_admin to warn about deprecated API usage
Goal: Introduce role-auth with minimal disruption
is_admin() is unsafe in a system with per-session permissions, so it has been
deprecated.
Roll-out approach:
1) First, log a warning when is_admin() is used. It should continue to
function normally, backed by the new role API. Nothing is really using
per-session authz yet, so there is minimal security concern.
The 'strict_deprecate_is_admin' global setting can be set to 'true' to
force a hard failure of is_admin() attempts (it will log an error and
always return false).
2) In some time (at least 1 week), but possibly longer depending on the number
of affected deployments: switch 'strict_deprecate_is_admin' to 'true' by
default. It can still be disabled for systems that need it.
3) Further in the future, before the next release, the option will be removed
and is_admin() will be permanently disabled.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Mon, 15 Aug 2022 15:25:07 +0100 |
| parents | b4f77a7bf8ab |
| children | 74b9e05af71e |
line wrap: on
line source
-- Export statistics in OpenMetrics format -- -- Copyright (C) 2014 Daurnimator -- Copyright (C) 2018 Emmanuel Gil Peyrot <linkmauve@linkmauve.fr> -- Copyright (C) 2021 Jonas Schäfer <jonas@zombofant.net> -- -- This module is MIT/X11 licensed. module:set_global(); local statsman = require "core.statsmanager"; local ip = require "util.ip"; local get_metric_registry = statsman.get_metric_registry; local collect = statsman.collect; local get_metrics; local permitted_ips = module:get_option_set("openmetrics_allow_ips", { "::1", "127.0.0.1" }); local permitted_cidr = module:get_option_string("openmetrics_allow_cidr"); local function is_permitted(request) local ip_raw = request.ip; if permitted_ips:contains(ip_raw) or (permitted_cidr and ip.match(ip.new_ip(ip_raw), ip.parse_cidr(permitted_cidr))) then return true; end return false; end function get_metrics(event) if not is_permitted(event.request) then return 403; -- Forbidden end local response = event.response; response.headers.content_type = "application/openmetrics-text; version=0.0.4"; if collect then -- Ensure to get up-to-date samples when running in manual mode collect() end local registry = get_metric_registry() if registry == nil then response.headers.content_type = "text/plain; charset=utf-8" response.status_code = 404 return "No statistics provider configured\n" end return registry:render(); end module:depends "http"; module:provides("http", { default_path = "metrics"; route = { GET = get_metrics; }; });
