prosody-hg: plugins/mod_tokenauth.lua history

mod_tokenauth: Fix expiry lasting one second too much

Sat, 01 Feb 2025 20:45:28 +0100

mod_tokenauth: Fix expiry lasting one second too much

Because the code was using `< now` in a lot of places, things expiring at the current second
wouldn't be marked as expired. It isn't noticeable in real-world scenarios but I wanted to
create OAuth 2.0 tokens valid for 0 second in integration tests and it wasn't possible.

By using `<=` instead of `<`, we make sure tokens don't live a single millisecond more than
what they are supposed to.

mod_tokenauth: Ignore invalid grants in storage that have no id

Wed, 29 Nov 2023 17:51:34 +0000

mod_tokenauth: Ignore invalid grants in storage that have no id

mod_tokenauth: Include more details in debug logs

Sun, 12 Nov 2023 00:33:57 +0100

mod_tokenauth: Include more details in debug logs

Had a hard time following what was happening when it did not specify
which grant or token was being removed.

mod_tokenauth: Fix saving grants after clearing expired tokens

Sun, 05 Nov 2023 16:10:40 +0100

mod_tokenauth: Fix saving grants after clearing expired tokens

Previously the whole grant was deleted if it found one expired toke,
which was not indented.

mod_tokenauth: Set name/description on cleanup job

Sat, 21 Oct 2023 12:56:39 +0200

mod_tokenauth: Set name/description on cleanup job

mod_tokenauth: Save grant after removing expired tokens

Sat, 21 Oct 2023 12:33:55 +0200

mod_tokenauth: Save grant after removing expired tokens

Ensures the periodic cleanup really does remove expired tokens.

mod_tokenauth: Periodically clear out expired tokens and grants

Mon, 09 Oct 2023 20:31:35 +0200

mod_tokenauth: Periodically clear out expired tokens and grants

This should ensure expired grants eventually disappear.

mod_tokenauth: Delete grants without tokens after period

Mon, 16 Oct 2023 23:51:52 +0200

mod_tokenauth: Delete grants without tokens after period

Generally it is expected that a grant would have at least one token as
long as the grant is in active use.

Refresh tokens issued by mod_http_oauth2 have a lifetime of one week by
default, so the idea here is that if that refresh token expired and
another week goes by without the grant being used, then the whole grant
can be removed.

mod_tokenauth: Clear expired tokens on grant retrieval

Mon, 09 Oct 2023 20:28:37 +0200

mod_tokenauth: Clear expired tokens on grant retrieval

mod_tokenauth: Delete grants in the wrong formats on retrieval

Mon, 09 Oct 2023 20:26:30 +0200

mod_tokenauth: Delete grants in the wrong formats on retrieval

mod_tokenauth: Fix revoking a single token without revoking whole grant

Sun, 23 Jul 2023 02:54:49 +0200

mod_tokenauth: Fix revoking a single token without revoking whole grant

This appears to have been a copy-paste of the grant revocation function,
or maybe the other way around. Either way, it deleted the whole grant
instead of the individual token as might be expected.

plugins: Switch to :get_option_period() for time range options

Sun, 16 Jul 2023 20:49:33 +0200

plugins: Switch to :get_option_period() for time range options

Improves readability ("1 day" vs 86400) and centralizes validation.

mod_tokenauth: Support selection of _no_ role at all

Sun, 07 May 2023 20:34:07 +0200

mod_tokenauth: Support selection of _no_ role at all

If a grant does not have a role, we should not go and make one up.
While not very useful for XMPP if you can't even login, it may be useful
for OAuth2/OIDC.

mod_tokenauth: Return error instead of session for token without role

Sun, 07 May 2023 20:33:03 +0200

mod_tokenauth: Return error instead of session for token without role

Such a session triggers errors in module:may or other places since it is
generally expected that a session must have a role.

mod_tokenauth: Fix parsing binary part of tokens

Wed, 12 Apr 2023 11:43:32 +0200

mod_tokenauth: Fix parsing binary part of tokens

Fixes parsing of tokens that happen to have a `;` in their secret part,
otherwise it splits there and the later bit goes into the username and
hitting the "Invalid token in storage" condition.

mod_tokenauth: Only check if expiry of expiring tokens

Wed, 12 Apr 2023 10:21:32 +0200

mod_tokenauth: Only check if expiry of expiring tokens

Some tokens, e.g. OAuth2 refresh tokens, might not have their lifetime
explicitly bounded here, but rather be bounded by the lifetime of
something else, like the OAuth2 client.

Open question: Would it be better to enforce a lifetime on all tokens?

mod_tokenauth: Add API method to revoke a grant by id

Wed, 05 Apr 2023 15:33:56 +0100

mod_tokenauth: Add API method to revoke a grant by id

We probably want to refactor revoke_token() to use this one in the future.

mod_tokenauth: Add API to inspect individual grants or all of a user's grants

Wed, 29 Mar 2023 17:15:33 +0100

mod_tokenauth: Add API to inspect individual grants or all of a user's grants

mod_tokenauth: Move grant validation to a reusable function

Wed, 29 Mar 2023 17:14:45 +0100

mod_tokenauth: Move grant validation to a reusable function

mod_tokenauth: fix traceback if password has never been changed

Tue, 28 Mar 2023 21:25:54 +0200

mod_tokenauth: fix traceback if password has never been changed

By checking the password_updated_at for non-nilness before using it,
we avoid a nasty crash :-).

mod_tokenauth: Fire events on grant creation and revocation

Tue, 28 Mar 2023 10:43:09 +0100

mod_tokenauth: Fire events on grant creation and revocation

mod_tokenauth: Fix storage API mistake in revocation

Tue, 28 Mar 2023 00:30:18 +0200

mod_tokenauth: Fix storage API mistake in revocation

mod_tokenauth: Fix traceback when checking expiry of tokens with no expiry

Mon, 27 Mar 2023 20:51:07 +0100

mod_tokenauth: Fix traceback when checking expiry of tokens with no expiry

mod_tokenauth: Refactor API to separate tokens and grants

Mon, 27 Mar 2023 18:35:57 +0100

mod_tokenauth: Refactor API to separate tokens and grants

This is another iteration on top of the previous sub-tokens work. Essentially,
the concept of a "parent token" has been replaced with the concept of a
"grant" to which all tokens now belong. The grant does not have any tokens
when first created, but the create_token() call can add them.

mod_tokenauth: Support for creating sub-tokens

Sun, 26 Mar 2023 16:46:48 +0100

mod_tokenauth: Support for creating sub-tokens

Properties of sub-tokens:

- They share the same id as their parent token
- Sub-tokens may not have their own sub-tokens (but may have sibling tokens)
- They always have the same or shorter lifetime compared to their parent token
- Revoking a parent token revokes all sub-tokens
- Sub-tokens always have the same JID as the parent token
- They do not have their own 'accessed' property - accessing a sub-token
updates the parent token's accessed time

Although this is a generic API, it is designed to at least fill the needs of
OAuth2 refresh + access tokens (where the parent token is the refresh token
and the sub-tokens are access tokens).

mod_tokenauth: return error if storage of new token fails

Sun, 26 Mar 2023 15:53:27 +0100

mod_tokenauth: return error if storage of new token fails

mod_tokenauth: Track last access time (last time a token was used)

Fri, 24 Mar 2023 12:59:47 +0000

mod_tokenauth: Track last access time (last time a token was used)

plugins: Prefix module imports with prosody namespace

Fri, 24 Mar 2023 13:15:28 +0100

plugins: Prefix module imports with prosody namespace

mod_tokenauth: Fix traceback in get_token_session()

Tue, 21 Mar 2023 20:43:42 +0100

mod_tokenauth: Fix traceback in get_token_session()

Errors in sha256 becasue `token_secret` is nil since it was not passed
to _get_validated_token_info().

Looks like a simple oversight in ebe3b2f96cad

mod_tokenauth: Switch to new token format (invalidates existing tokens!)

Tue, 21 Mar 2023 14:33:29 +0000

mod_tokenauth: Switch to new token format (invalidates existing tokens!)

The new format has the following properties:

- 5 bytes longer than the previous format
- The token now has separate 'id' and 'secret' parts - the token itself is no
longer stored in the DB, and the secret part is hashed
- The only variable length field (JID) has been moved to the end
- The 'secret-token:' prefix (RFC 8959) is now included

Compatibility with the old token format was not maintained, and all previously
issued tokens are invalid after this commit (they will be removed from the DB
if used).

mod_tokenauth: Log error when token validation fails

Tue, 21 Mar 2023 14:04:39 +0000

mod_tokenauth: Log error when token validation fails

util.sasl.oauthbearer: Return username from callback instead using authzid (BC)

Thu, 16 Mar 2023 12:18:23 +0100

util.sasl.oauthbearer: Return username from callback instead using authzid (BC)

RFC 6120 states that
> If the initiating entity does not wish to act on behalf of another
> entity, it MUST NOT provide an authorization identity.

Thus it seems weird to require it here. We can instead expect an
username from the token data passed back from the profile.

This follows the practice of util.sasl.external where the profile
callback returns the selected username, making the authentication module
responsible for extracting the username from the token.

mod_tokenauth: Fix misplaced closing parenthesis

Thu, 02 Mar 2023 22:34:29 +0100

mod_tokenauth: Fix misplaced closing parenthesis

`type(x ~= y)` is always a string, thus truthy

mod_tokenauth: Gracefully handle missing tokens

Wed, 01 Mar 2023 18:43:54 +0000

mod_tokenauth: Gracefully handle missing tokens

mod_tokenauth: Add SASL handler backend that can accept and verify tokens

Wed, 01 Mar 2023 13:04:36 +0000

mod_tokenauth: Add SASL handler backend that can accept and verify tokens

This is designed for use by other modules that want to accept tokens issued
by mod_tokenauth, without duplicating all the necessary logic.

mod_tokenauth: Add some sanity checking of the new optional parameters

Wed, 01 Mar 2023 13:02:51 +0000

mod_tokenauth: Add some sanity checking of the new optional parameters

mod_tokenauth: Add 'purpose' constraint

Wed, 01 Mar 2023 13:01:21 +0000

mod_tokenauth: Add 'purpose' constraint

This allows tokens to be tied to specific purposes/protocols. For example, we
shouldn't (without specific consideration) allow an OAuth token to be dropped
into a slot expecting a FAST token.

While FAST doesn't currently use mod_tokenauth, it and others may do in the
future. It's better to be explicit about what kind of token code is issuing or
expecting.

mod_tokenauth: Allow attaching an arbitrary data table to a token

Thu, 13 Oct 2022 22:46:19 +0100

mod_tokenauth: Allow attaching an arbitrary data table to a token

mod_tokenauth: Remove expired tokens from storage

Thu, 06 Oct 2022 16:00:39 +0100

mod_tokenauth: Remove expired tokens from storage

mod_tokenauth: Invalidate tokens issued before most recent password change

Thu, 06 Oct 2022 15:59:07 +0100

mod_tokenauth: Invalidate tokens issued before most recent password change

This is a security improvement, to ensure that sessions authenticated using a
token (note: not currently possible in stock Prosody) are invalidated just
like password-authenticated sessions are.

mod_authz_internal, and more: New iteration of role API

Wed, 17 Aug 2022 16:38:53 +0100

mod_authz_internal, and more: New iteration of role API

These changes to the API (hopefully the last) introduce a cleaner separation
between the user's primary (default) role, and their secondary (optional)
roles.

To keep the code sane and reduce complexity, a data migration is needed for
people using stored roles in 0.12. This can be performed with

prosodyctl mod_authz_internal migrate

mod_tokenauth: New API that better fits how modules are using token auth

Wed, 20 Jul 2022 10:52:17 +0100

mod_tokenauth: New API that better fits how modules are using token auth

This also updates the module to the new role API, and improves support for
scope/role selection (currently treated as the same thing, which they almost
are).

mod_tokenauth: Track creation time of tokens

Fri, 28 Feb 2020 21:55:40 +0000

mod_tokenauth: Track creation time of tokens

mod_tokenauth: Handle tokens issued to bare hosts (eg components)

Fri, 28 Feb 2020 14:13:04 +0100

mod_tokenauth: Handle tokens issued to bare hosts (eg components)

mod_authtokens: Rename to mod_tokenauth for consistency with mod_saslauth

Wed, 26 Feb 2020 22:46:15 +0000

mod_authtokens: Rename to mod_tokenauth for consistency with mod_saslauth