# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1779384751 -3600
# Node ID 981c14bb8975e0a47f8a846bca6b81698f246528
# Parent  19bee2a6436a18a0af40a55d8b0ec4d052351a2e
mod_restrict_federation: Allow some ad-hoc commands used by push services

This fixes push registration for Siskin, Conversations and Snikket Android+iOS
when used by restricted accounts.

diff -r 19bee2a6436a -r 981c14bb8975 mod_restrict_federation/mod_restrict_federation.lua
--- a/mod_restrict_federation/mod_restrict_federation.lua	Tue May 19 13:31:35 2026 -0500
+++ b/mod_restrict_federation/mod_restrict_federation.lua	Thu May 21 18:32:31 2026 +0100
@@ -17,6 +17,22 @@
 		return;
 	end
 
+	if stanza.name == "iq" then
+		if stanza.attr.type == "result" or stanza.attr.type == "error" then
+			-- Allow responses to iqs
+			return;
+		end
+		local payload = stanza.tags[1];
+		-- Allow push notification registration
+		if payload.name == "command" and payload.attr.xmlns == "http://jabber.org/protocol/commands" then
+			-- This should allow Tigase and p2 ad-hoc commands to pass through to push gateways
+			if node:match("^register%-") or node:match("^unregister%-") then
+				return;
+			end
+		end
+	end
+
+
 	-- Block
 	module:log("debug", "Forbidding outgoing %s stanza from <%s> to <%s>", stanza.name, stanza.attr.from, stanza.attr.to);
 	local err_reply = st.error_reply(event.stanza, "auth", "policy-violation", "Communication with remote domains is not permitted");
@@ -33,6 +49,13 @@
 		return;
 	end
 
+	if stanza.name == "iq" then
+		if stanza.attr.type == "result" or stanza.attr.type == "error" then
+			-- Allow responses to iqs
+			return;
+		end
+	end
+
 	local recipient_username = jid_node(stanza.attr.to);
 	if not recipient_username then
 		return;