File

mod_compliance_2023: Add 2023 Version of the compliance module, basis is the 2021 Version. diff --git a/mod_compliance_2023/README.md b/mod_compliance_2023/README.md new file mode 100644 --- /dev/null +++ b/mod_compliance_2023/README.md @@ -0,0 +1,22 @@ +--- +summary: XMPP Compliance Suites 2023 self-test +labels: +- Stage-Beta +rockspec: + dependencies: + - mod_cloud_notify + +... + +Compare the list of enabled modules with +[XEP-0479: XMPP Compliance Suites 2023] and produce basic report to the +Prosody log file. + +If installed with the Prosody plugin installer then all modules needed for a green checkmark should be included. (With prosody 0.12 only [mod_cloud_notify] is not included with prosody and we need the community module) + +# Compatibility + + Prosody-Version Status + --------------- ---------------------- + trunk Works as of 2024-12-21 + 0.12 Works diff --git a/mod_compliance_2023/mod_compliance_2023.lua b/mod_compliance_2023/mod_compliance_2023.lua new file mode 100644 --- /dev/null +++ b/mod_compliance_2023/mod_compliance_2023.lua @@ -0,0 +1,79 @@ +-- Copyright (c) 2021 Kim Alvefur +-- +-- This module is MIT licensed. + +local hostmanager = require "core.hostmanager"; + +local array = require "util.array"; +local set = require "util.set"; + +local modules_enabled = module:get_option_inherited_set("modules_enabled"); + +for host in pairs(hostmanager.get_children(module.host)) do + local component = module:context(host):get_option_string("component_module"); + if component then + modules_enabled:add(component); + modules_enabled:include(module:context(host):get_option_set("modules_enabled", {})); + end +end + +local function check(suggested, alternate, ...) + if set.intersection(modules_enabled, set.new({suggested; alternate; ...})):empty() then return suggested; end + return false; +end + +local compliance = { + array {"Server"; check("tls"); check("disco")}; + + array {"Advanced Server"; check("pep", "pep_simple")}; + + array {"Web"; check("bosh"); check("websocket")}; + + -- No Server requirements for Advanced Web + + array {"IM"; check("vcard_legacy", "vcard"); check("carbons"); check("http_file_share", "http_upload")}; + + array { + "Advanced IM"; + check("vcard_legacy", "vcard"); + check("blocklist"); + check("muc"); + check("private"); + check("smacks"); + check("mam"); + check("bookmarks"); + }; + + array {"Mobile"; check("smacks"); check("csi_simple", "csi_battery_saver")}; + + array {"Advanced Mobile"; check("cloud_notify")}; + + array {"A/V Calling"; check("turn_external", "external_services", "turncredentials", "extdisco")}; + +}; + +function check_compliance() + local compliant = true; + for _, suite in ipairs(compliance) do + local section = suite:pop(1); + if module:get_option_boolean("compliance_" .. section:lower():gsub("%A", "_"), true) then + local missing = set.new(suite:filter(function(m) return type(m) == "string" end):map(function(m) return "mod_" .. m end)); + if suite[1] then + if compliant then + compliant = false; + module:log("warn", "Missing some modules for XMPP Compliance 2023"); + end + module:log("info", "%s Compliance: %s", section, missing); + end + end + end + + if compliant then module:log("info", "XMPP Compliance 2023: Compliant ✔️"); end +end + +if prosody.start_time then + check_compliance() +else + module:hook_global("server-started", check_compliance); +end +

---
labels:
- 'Stage-Stable'
summary: 'Token based JSON registration & verification servlet.'
...

Introduction
------------

This module let's you activate a httpserver interface to handle data
from webforms with POST and Base64 encoded JSON.

Implementation Details
----------------------

Example Request format:

    POST /your_register_base_url HTTP/1.1
    Host: yourserveraddress.com:yourchoosenport
    Content-Type: application/encoded
    Content-Transfer-Encoding: base64

    eyJ1c2VybmFtZSI6InVzZXJuYW1lb2ZjaG9pY2UiLCJwYXNzd29yZCI6InRoZXVzZXJwYXNzd29yZCIsImlwIjoidGhlcmVtb3RlYWRkcm9mdGhldXNlciIsIm1haWwiOiJ1c2VybWFpbEB1c2VybWFpbGRvbWFpbi50bGQiLCJhdXRoX3Rva2VuIjoieW91cmF1dGh0b2tlbm9mY2hvaWNlIn0=

Where the encoded content is this (example) JSON Array:

``` {.json}
    {
      "username":"john.smith",
      "password":"secret-password",
      "ip":"192.168.0.0",
      "mail":"john.smith@mail.example.net",
      "auth_token":"yourauthtokenofchoice"
    }
```

Your form implementation needs to pass **all** parameters, the
auth\_token is needed to prevent misuses, if the request is successful
the server will answer with status code 200 and with the body of the
response containing the token which your web app can send via e-mail to
the user to complete the registration.

Else, it will reply with the following http error codes:

-   400 - if there's an error syntax;
-   401 - whenever an username is already pending registration or the
    auth token supplied is invalid;
-   403 - whenever registration is forbidden (blacklist, filtered mail
    etc.);
-   406 - if the username supplied fails nodeprepping;
-   409 - if the user already exists, or an user is associated already
    with the supplied e-mail;
-   503 - whenever a request is throttled.

The verification URL path to direct the users to will be:
**/your-base-path-of-choice/verify/** - on your Prosody's http server.

The module for now stores a hash of the user's mail address to help slow
down duplicated registrations.

It's strongly encouraged to have the web server communicate with the
servlet via https.

Usage
-----

Copy the module folder and all its contents (register\_json) into your
prosody modules' directory.Add the module your vhost of choice
modules\_enabled.

Hint: pairing with mod\_register\_redirect is helpful, to allow server
registrations only via your webform.


Required configuration:

```
    reg_servlet_auth_token = "your-secret-token"
```

Optional configuration directives:

```
    reg_servlet_base = "/base-path/" -- Base path of the plugin (default is register_account)
    reg_servlet_secure = true -- Have the plugin only process requests on https (default is true)
    reg_servlet_ttime = seconds -- Specifies the time (in seconds) between each request coming from the same remote address.
    reg_servlet_bl = { "1.2.3.4", "4.3.2.1" } -- The ip addresses in this list will be blacklisted and will not be able to submit registrations.
    reg_servlet_wl = { "1.2.3.4", "4.3.2.1" } -- The ip addresses in this list will be ignored by the throttling.
    reg_servlet_filtered_mails = { ".*banneddomain.tld", ".*deamailprovider.tld" } -- allows filtering of mail addresses via Lua patterns.
```

Compatibility
-------------

0.9