Mercurial > prosody-modules
annotate mod_restrict_xmpp/mod_restrict_xmpp.lua @ 6258:06fbbd45ba75
mod_cloud_notify: Readme: fix links and labels that were removed in the last commit
diff --git a/mod_cloud_notify/README.md b/mod_cloud_notify/README.md
--- a/mod_cloud_notify/README.md
+++ b/mod_cloud_notify/README.md
@@ -1,3 +1,9 @@
+----
+-labels:
+-- 'Stage-Beta'
+-summary: 'XEP-0357: Cloud push notifications'
+----
+
# Introduction
This module enables support for sending "push notifications" to clients
@@ -32,15 +38,15 @@ notification to your device. When your d
it will display it or wake up the app so it can connect to XMPP and
receive any pending messages.
-This protocol is described for developers in \[XEP-0357: Push
-Notifications\].
+This protocol is described for developers in [XEP-0357: Push
+Notifications].
-For this module to work reliably, you must have \[mod_smacks\],
-\[mod_mam\] and \[mod_carbons\] also enabled on your server.
+For this module to work reliably, you must have [mod_smacks],
+[mod_mam] and [mod_carbons] also enabled on your server.
Some clients, notably Siskin and Snikket iOS need some additional
extensions that are not currently defined in a standard XEP. To support
-these clients, see \[mod_cloud_notify_extensions\].
+these clients, see [mod_cloud_notify_extensions].
# Configuration
@@ -58,18 +64,18 @@ these clients, see \[mod_cloud_notify_ex
# Internal design notes
App servers are notified about offline messages, messages stored by
-\[mod_mam\] or messages waiting in the smacks queue. The business rules
+[mod_mam] or messages waiting in the smacks queue. The business rules
outlined
[here](//mail.jabber.org/pipermail/standards/2016-February/030925.html)
are all honored[^2].
-To cooperate with \[mod_smacks\] this module consumes some events:
+To cooperate with [mod_smacks] this module consumes some events:
`smacks-ack-delayed`, `smacks-hibernation-start` and
`smacks-hibernation-end`. These events allow this module to send out
notifications for messages received while the session is hibernated by
-\[mod_smacks\] or even when smacks acknowledgements for messages are
+[mod_smacks] or even when smacks acknowledgements for messages are
delayed by a certain amount of seconds configurable with the
-\[mod_smacks\] setting `smacks_max_ack_delay`.
+[mod_smacks] setting `smacks_max_ack_delay`.
The `smacks_max_ack_delay` setting allows to send out notifications to
clients which aren't already in smacks hibernation state (because the
| author | Menel <menel@snikket.de> |
|---|---|
| date | Fri, 13 Jun 2025 10:44:37 +0200 |
| parents | bb4335c8f500 |
| children |
| rev | line source |
|---|---|
|
5009
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
1 local array = require "util.array"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
2 local it = require "util.iterators"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
3 local set = require "util.set"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
4 local st = require "util.stanza"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
5 |
|
5582
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
6 local normal_user_role = "prosody:registered"; |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
7 local limited_user_role = "prosody:guest"; |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
8 |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
9 local features = require "core.features"; |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
10 |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
11 -- COMPAT |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
12 if not features.available:contains("split-user-roles") then |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
13 normal_user_role = "prosody:user"; |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
14 limited_user_role = "prosody:restricted"; |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
15 end |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
16 |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
17 module:default_permission(normal_user_role, "xmpp:federate"); |
|
5009
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
18 module:hook("route/remote", function (event) |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
19 if not module:may("xmpp:federate", event) then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
20 if event.stanza.attr.type ~= "result" and event.stanza.attr.type ~= "error" then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
21 module:log("warn", "Access denied: xmpp:federate for %s -> %s", event.stanza.attr.from, event.stanza.attr.to); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
22 local reply = st.error_reply(event.stanza, "auth", "forbidden"); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
23 event.origin.send(reply); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
24 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
25 return true; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
26 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
27 end); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
28 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
29 local iq_namespaces = { |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
30 ["jabber:iq:roster"] = "contacts"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
31 ["jabber:iq:private"] = "storage"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
32 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
33 ["vcard-temp"] = "profile"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
34 ["urn:xmpp:mam:0"] = "history"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
35 ["urn:xmpp:mam:1"] = "history"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
36 ["urn:xmpp:mam:2"] = "history"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
37 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
38 ["urn:xmpp:carbons:0"] = "carbons"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
39 ["urn:xmpp:carbons:1"] = "carbons"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
40 ["urn:xmpp:carbons:2"] = "carbons"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
41 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
42 ["urn:xmpp:blocking"] = "blocklist"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
43 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
44 ["http://jabber.org/protocol/pubsub"] = "pep"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
45 ["http://jabber.org/protocol/disco#info"] = "disco"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
46 }; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
47 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
48 local legacy_storage_nodes = { |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
49 ["storage:bookmarks"] = "bookmarks"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
50 ["storage:rosternotes"] = "contacts"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
51 ["roster:delimiter"] = "contacts"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
52 ["storage:metacontacts"] = "contacts"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
53 }; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
54 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
55 local pep_nodes = { |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
56 ["storage:bookmarks"] = "bookmarks"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
57 ["urn:xmpp:bookmarks:1"] = "bookmarks"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
58 |
|
5754
1d0a0d3f9593
mod_restrict_xmpp: Add vcard4 PEP node to profile permission
Kim Alvefur <zash@zash.se>
parents:
5747
diff
changeset
|
59 ["urn:xmpp:vcard4"] = "profile"; |
|
5009
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
60 ["urn:xmpp:avatar:data"] = "profile"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
61 ["urn:xmpp:avatar:metadata"] = "profile"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
62 ["http://jabber.org/protocol/nick"] = "profile"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
63 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
64 ["eu.siacs.conversations.axolotl.devicelist"] = "omemo"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
65 ["urn:xmpp:omemo:1:devices"] = "omemo"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
66 ["urn:xmpp:omemo:1:bundles"] = "omemo"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
67 ["urn:xmpp:omemo:2:devices"] = "omemo"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
68 ["urn:xmpp:omemo:2:bundles"] = "omemo"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
69 }; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
70 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
71 module:hook("pre-iq/bare", function (event) |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
72 if not event.to_self then return; end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
73 local origin, stanza = event.origin, event.stanza; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
74 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
75 local typ = stanza.attr.type; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
76 if typ ~= "set" and typ ~= "get" then return; end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
77 local action = typ == "get" and "read" or "write"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
78 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
79 local payload = stanza.tags[1]; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
80 local ns = payload and payload.attr.xmlns; |
|
5769
bb4335c8f500
mod_restrict_xmpp: Allow all XEP-0199 pings to self
Kim Alvefur <zash@zash.se>
parents:
5754
diff
changeset
|
81 if ns == "urn:xmpp:ping" then return end |
|
5009
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
82 local proto = iq_namespaces[ns]; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
83 if proto == "pep" then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
84 local pubsub = payload:get_child("pubsub", "http://jabber.org/protocol/pubsub"); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
85 local node = pubsub and #pubsub.tags == 1 and pubsub.tags[1].attr.node or nil; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
86 proto = pep_nodes[node] or "pep"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
87 if proto == "pep" and node and node:match("^eu%.siacs%.conversations%.axolotl%.bundles%.%d+$") then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
88 proto = "omemo"; -- COMPAT w/ original OMEMO |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
89 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
90 elseif proto == "storage" then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
91 local data = payload.tags[1]; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
92 proto = data and legacy_storage_nodes[data.attr.xmlns] or "legacy-storage"; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
93 elseif proto == "carbons" then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
94 -- This allows access to live messages |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
95 proto, action = "messages", "read"; |
|
5010
a1f49586d28a
mod_restrict_xmpp: Treat archive query as a read despite using iq-set
Kim Alvefur <zash@zash.se>
parents:
5009
diff
changeset
|
96 elseif proto == "history" then |
|
a1f49586d28a
mod_restrict_xmpp: Treat archive query as a read despite using iq-set
Kim Alvefur <zash@zash.se>
parents:
5009
diff
changeset
|
97 action = "read"; |
|
5009
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
98 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
99 local permission_name = "xmpp:account:"..(proto and (proto..":") or "")..action; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
100 if not module:may(permission_name, event) then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
101 module:log("warn", "Access denied: %s ({%s}%s) for %s", permission_name, ns, payload.name, origin.full_jid or origin.id); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
102 origin.send(st.error_reply(stanza, "auth", "forbidden", "You do not have permission to make this request ("..permission_name..")")); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
103 return true; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
104 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
105 end); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
106 |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
107 --module:default_permission("prosody:restricted", "xmpp:account:read"); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
108 --module:default_permission("prosody:restricted", "xmpp:account:write"); |
|
5582
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
109 module:default_permission(limited_user_role, "xmpp:account:messages:read"); |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
110 module:default_permission(limited_user_role, "xmpp:account:messages:write"); |
|
5009
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
111 for _, property_list in ipairs({ iq_namespaces, legacy_storage_nodes, pep_nodes }) do |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
112 for account_property in set.new(array.collect(it.values(property_list))) do |
|
5582
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
113 module:default_permission(limited_user_role, "xmpp:account:"..account_property..":read"); |
|
825c6fb76c48
Multiple modules: Update for split prosody:user role (prosody 082c7d856e61)
Matthew Wild <mwild1@gmail.com>
parents:
5010
diff
changeset
|
114 module:default_permission(limited_user_role, "xmpp:account:"..account_property..":write"); |
|
5009
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
115 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
116 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
117 |
|
5747
111e970213a0
mod_restrict_xmpp: Fix remaining hard-coded role name
Matthew Wild <mwild1@gmail.com>
parents:
5582
diff
changeset
|
118 module:default_permission(limited_user_role, "xmpp:account:presence:write"); |
|
5009
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
119 module:hook("pre-presence/bare", function (event) |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
120 if not event.to_self then return; end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
121 local stanza = event.stanza; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
122 if not module:may("xmpp:account:presence:write", event) then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
123 module:log("warn", "Access denied: xmpp:account:presence:write for %s", event.origin.full_jid or event.origin.id); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
124 event.origin.send(st.error_reply(stanza, "auth", "forbidden", "You do not have permission to send account presence")); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
125 return true; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
126 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
127 local priority = stanza:get_child_text("priority"); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
128 if priority ~= "-1" then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
129 if not module:may("xmpp:account:messages:read", event) then |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
130 module:log("warn", "Access denied: xmpp:account:messages:read for %s", event.origin.full_jid or event.origin.id); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
131 event.origin.send(st.error_reply(stanza, "auth", "forbidden", "You do not have permission to receive messages (use presence priority -1)")); |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
132 return true; |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
133 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
134 end |
|
459a4001c1d9
mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
135 end); |
