Software /
code /
prosody-modules
File
mod_muc_local_only/mod_muc_local_only.lua @ 5447:aa4828f040c5
mod_http_oauth2: Enforce client scope restrictions in authorization
When registering a client, a scope field can be included as a promise to
only ever use those. Here we enforce that promise, if given, ensuring a
client can't request or be granted a scope it didn't provide in its
registration. While currently there is no restrictions at registration
time, this could be changed in the future in various ways.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Thu, 11 May 2023 19:33:44 +0200 |
parent | 4019:221b6bee26e2 |
line wrap: on
line source
local jid = require "util.jid"; local st = require "util.stanza"; local local_rooms = module:get_option_inherited_set("muc_local_only", {}); module:hook("muc-occupant-pre-join", function (event) local room = event.room; if not local_rooms:contains(room.jid) then return; -- Not a protected room, ignore end local user_jid = event.occupant.bare_jid; local user_host = jid.host(user_jid); if not prosody.hosts[user_host] then local error_reply = st.error_reply(event.stanza, "cancel", "forbidden", "This group is only available to local users", room.jid); event.origin.send(error_reply); return true; end room:set_affiliation(true, user_jid, "member", "Granting access to local user"); end);