prosody-hg: plugins/mod_authz_internal.lua history

mod_authz_internal: Improve error message when invalid role specified

Fri, 04 Apr 2025 16:49:55 +0100

mod_authz_internal: Improve error message when invalid role specified

mod_authz_internal: Fix error messages

Thu, 13 Feb 2025 15:31:14 +0000

mod_authz_internal: Fix error messages

mod_authz_internal: Fix return values of secondary role management methods

Thu, 13 Feb 2025 15:30:23 +0000

mod_authz_internal: Fix return values of secondary role management methods

usermanager expects (role, err) and (ok, err)

mod_authz_internal: Make host considered the parent configurable

Mon, 13 Jan 2025 11:50:03 +0100

mod_authz_internal: Make host considered the parent configurable

This bestows the role specified by the 'host_user_role' setting onto
users of that host. For simplicity, only a single host can be specified.

Making it configurable allows for setups where VirtualHost and related
Components may be siblings instead of having a subdomain relationship.

For setups with many VirtualHosts sharing a single Component, the
'server_user_role' setting is more appropriate. Even more complicated
setups would have to resort to mod_firewall or similar.

mod_authz_internal: Make 'prosody:guest' default role for all unknown JIDs

Tue, 07 Jan 2025 14:41:32 +0000

mod_authz_internal: Make 'prosody:guest' default role for all unknown JIDs

This fixes an issue where e.g. remote users or even other users on the server
were unable to list MUC rooms.

We want to define a permission to list MUC rooms, but we want it to be
available to everyone by default (the traditional behaviour).

prosody:guest is the lowest role we have. I ran a quick check and it isn't
really used for anything right now that would be concerning.

It was originally designed for anonymous logins. I think it's safe to treat
remote JIDs as equivalent, since we have no trust relationship with anonymous
users either.

mod_authz_internal: Hint at roles for external JIDs being read-only

Fri, 01 Nov 2024 13:08:35 +0100

mod_authz_internal: Hint at roles for external JIDs being read-only

Roles for JIDs outside the current host are derived from configuration
only with this module.

plugins: Use get_option_array for some list shaped options

Fri, 21 Jul 2023 22:48:54 +0200

plugins: Use get_option_array for some list shaped options

Passing something from module:get_option() to ipairs() suggests that the
option is a list of some sort.

core, plugins: Split prosody:user role into prosody:{guest,registered,member}

Thu, 29 Jun 2023 15:36:13 +0100

core, plugins: Split prosody:user role into prosody:{guest,registered,member}

This gives us more granular control over different types of user account.
Accounts registered by IBR get assigned prosody:registered by default, while
accounts provisioned by an admin (e.g. via prosodyctl shell) will receive
prosody:member by default.

plugins: Prefix module imports with prosody namespace

Fri, 24 Mar 2023 13:15:28 +0100

plugins: Prefix module imports with prosody namespace

mod_authz_internal: Fix wrong role name field in user_can_assume_role()

Thu, 09 Mar 2023 16:02:55 +0100

mod_authz_internal: Fix wrong role name field in user_can_assume_role()

Made it reject the primary role since it compares against a non-existent
field, i.e. nil.

authz: Add method for retrieving all roles

Sat, 04 Mar 2023 18:40:43 +0100

authz: Add method for retrieving all roles

Some of the OAuth stuff highlights a small need to retrieve a list of
roles somehow. Handy if you ever need a role selector in adhoc or
something.

Unless there's some O(n) thing we were avoiding?

mod_authz_internal: Fix warning due to global use

Tue, 04 Oct 2022 12:04:43 +0200

mod_authz_internal: Fix warning due to global use

Thanks Menel and Martin

mod_authz_internal: Allow specifying default role for public (remote) users

Thu, 29 Sep 2022 12:46:02 +0100

mod_authz_internal: Allow specifying default role for public (remote) users

mod_authz_internal: Allow configuring role of local-server/parent-host users

Thu, 29 Sep 2022 12:10:14 +0100

mod_authz_internal: Allow configuring role of local-server/parent-host users

'host_user_role' is the default role of users who have JIDs on the "parent"
host (i.e. jabber.org users on conference.jabber.org). Defaults to
'prosody:user'.

'server_user_roles' is the default role of users who have JIDs on any active
host on the current Prosody instance. Default to nil (no role).

This finally allows better permissions splitting between host and server
users, which has previously been done (e.g. in MUC) with options like
'restrict_room_creation' and 'muc_room_allow_persistent'. Using roles makes
these permissions a lot more flexible, and easier for developers to integrate.

mod_authz_internal: Expose convenience method to test if user can assume role

Thu, 18 Aug 2022 10:37:59 +0100

mod_authz_internal: Expose convenience method to test if user can assume role

mod_authz_internal, and more: New iteration of role API

Wed, 17 Aug 2022 16:38:53 +0100

mod_authz_internal, and more: New iteration of role API

These changes to the API (hopefully the last) introduce a cleaner separation
between the user's primary (default) role, and their secondary (optional)
roles.

To keep the code sane and reduce complexity, a data migration is needed for
people using stored roles in 0.12. This can be performed with

prosodyctl mod_authz_internal migrate

mod_authz_internal: Use util.roles, some API changes and config support

Tue, 19 Jul 2022 18:02:02 +0100

mod_authz_internal: Use util.roles, some API changes and config support

This commit was too awkward to split (hg record didn't like it), so:

- Switch to the new util.roles lib to provide a consistent representation of
a role object.

- Change API method from get_role_info() to get_role_by_name() (touches
sessionmanager and usermanager)

- Change get_roles() to get_user_roles(), take a username instead of a JID
This is more consistent with all other usermanager API methods.

- Support configuration of custom roles and permissions via the config file
(to be documented).

Switch to a new role-based authorization framework, removing is_admin()

Wed, 15 Jun 2022 12:15:01 +0100

Switch to a new role-based authorization framework, removing is_admin()

We began moving away from simple "is this user an admin?" permission checks
before 0.12, with the introduction of mod_authz_internal and the ability to
dynamically change the roles of individual users.

The approach in 0.12 still had various limitations however, and apart from
the introduction of roles other than "admin" and the ability to pull that info
from storage, not much actually changed.

This new framework shakes things up a lot, though aims to maintain the same
functionality and behaviour on the surface for a default Prosody
configuration. That is, if you don't take advantage of any of the new
features, you shouldn't notice any change.

The biggest change visible to developers is that usermanager.is_admin() (and
the auth provider is_admin() method) have been removed. Gone. Completely.

Permission checks should now be performed using a new module API method:

module:may(action_name, context)

This method accepts an action name, followed by either a JID (string) or
(preferably) a table containing 'origin'/'session' and 'stanza' fields (e.g.
the standard object passed to most events). It will return true if the action
should be permitted, or false/nil otherwise.

Modules should no longer perform permission checks based on the role name.
E.g. a lot of code previously checked if the user's role was prosody:admin
before permitting some action. Since many roles might now exist with similar
permissions, and the permissions of prosody:admin may be redefined
dynamically, it is no longer suitable to use this method for permission
checks. Use module:may().

If you start an action name with ':' (recommended) then the current module's
name will automatically be used as a prefix.

To define a new permission, use the new module API:

module:default_permission(role_name, action_name)
module:default_permissions(role_name, { action_name[, action_name...] })

This grants the specified role permission to execute the named action(s) by
default. This may be overridden via other mechanisms external to your module.

The built-in roles that developers should use are:

- prosody:user (normal user)
- prosody:admin (host admin)
- prosody:operator (global admin)

The new prosody:operator role is intended for server-wide actions (such as
shutting down Prosody).

Finally, all usage of is_admin() in modules has been fixed by this commit.
Some of these changes were trickier than others, but no change is expected to
break existing deployments.

EXCEPT: mod_auth_ldap no longer supports the ldap_admin_filter option. It's
very possible nobody is using this, but if someone is then we can later update
it to pull roles from LDAP somehow.

usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role

Thu, 26 Aug 2021 16:35:43 +0100

usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role

mod_authz_internal: Ignore unused argument for now [luachec]

Mon, 22 Mar 2021 22:01:49 +0100

mod_authz_internal: Ignore unused argument for now [luachec]

mod_authz_internal: add support for setting roles of a local user

Mon, 22 Mar 2021 21:24:43 +0100

mod_authz_internal: add support for setting roles of a local user

usermanager, mod_authz_*: Merge mod_authz_config and mod_authz_internal into the latter

Sun, 23 Feb 2020 12:38:43 +0000

usermanager, mod_authz_*: Merge mod_authz_config and mod_authz_internal into the latter

usermanager, mod_authz_internal: Move admin-checking functionality into a module. Fixes #517 (ish).

Mon, 27 Jan 2020 21:54:59 +0000

usermanager, mod_authz_internal: Move admin-checking functionality into a module. Fixes #517 (ish).

Note: Removes the ability for mod_auth_* providers to determine user admin status. Such
modules will need to have their is_admin methods ported to be a mod_authz_* provider.