Software `/` code `/` prosody

Annotate

plugins/mod_authz_internal.lua @ 12730:427dd01f0864

mod_authz_internal: Allow configuring role of local-server/parent-host users 'host_user_role' is the default role of users who have JIDs on the "parent" host (i.e. jabber.org users on conference.jabber.org). Defaults to 'prosody:user'. 'server_user_roles' is the default role of users who have JIDs on any active host on the current Prosody instance. Default to nil (no role). This finally allows better permissions splitting between host and server users, which has previously been done (e.g. in MUC) with options like 'restrict_room_creation' and 'muc_room_allow_persistent'. Using roles makes these permissions a lot more flexible, and easier for developers to integrate.

author	Matthew Wild <mwild1@gmail.com>
date	Thu, 29 Sep 2022 12:10:14 +0100
parent	12663:cf88f6b03942
child	12733:2167e1639aab

rev	line source
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	1 local array = require "util.array";
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	2 local it = require "util.iterators";
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	3 local set = require "util.set";
12730 427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	4 local jid_split, jid_bare, jid_host = import("util.jid", "split", "bare", "host");
10659 8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	5 local normalize = require "util.jid".prep;
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	6 local roles = require "util.roles";
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	7
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	8 local config_global_admin_jids = module:context("*"):get_option_set("admins", {}) / normalize;
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	9 local config_admin_jids = module:get_option_inherited_set("admins", {}) / normalize;
10659 8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	10 local host = module.host;
12730 427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	11 local host_suffix = host:gsub("^[^%.]+%.", "");
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	12
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	13 local hosts = prosody.hosts;
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	14 local is_component = hosts[host].type == "component";
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	15 local host_user_role, server_user_role;
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	16 if is_component then
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	17 host_user_role = module:get_option_string("host_user_role", "prosody:user");
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	18 server_user_role = module:get_option_string("server_user_role");
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	19 end
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	20
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	21 local role_store = module:open_store("account_roles");
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	22 local role_map_store = module:open_store("account_roles", "map");
10659 8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	23
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	24 local role_registry = {};
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	25
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	26 function register_role(role)
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	27 if role_registry[role.name] ~= nil then
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	28 return error("A role '"..role.name.."' is already registered");
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	29 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	30 if not roles.is_role(role) then
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	31 -- Convert table syntax to real role object
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	32 for i, inherited_role in ipairs(role.inherits or {}) do
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	33 if type(inherited_role) == "string" then
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	34 role.inherits[i] = assert(role_registry[inherited_role], "The named role '"..inherited_role.."' is not registered");
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	35 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	36 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	37 if not role.permissions then role.permissions = {}; end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	38 for _, allow_permission in ipairs(role.allow or {}) do
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	39 role.permissions[allow_permission] = true;
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	40 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	41 for _, deny_permission in ipairs(role.deny or {}) do
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	42 role.permissions[deny_permission] = false;
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	43 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	44 role = roles.new(role);
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	45 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	46 role_registry[role.name] = role;
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	47 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	48
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	49 -- Default roles
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	50 register_role {
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	51 name = "prosody:restricted";
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	52 priority = 15;
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	53 };
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	54
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	55 register_role {
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	56 name = "prosody:user";
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	57 priority = 25;
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	58 inherits = { "prosody:restricted" };
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	59 };
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	60
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	61 register_role {
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	62 name = "prosody:admin";
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	63 priority = 50;
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	64 inherits = { "prosody:user" };
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	65 };
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	66
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	67 register_role {
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	68 name = "prosody:operator";
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	69 priority = 75;
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	70 inherits = { "prosody:admin" };
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	71 };
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	72
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	73
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	74 -- Process custom roles from config
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	75
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	76 local custom_roles = module:get_option("custom_roles", {});
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	77 for n, role_config in ipairs(custom_roles) do
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	78 local ok, err = pcall(register_role, role_config);
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	79 if not ok then
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	80 module:log("error", "Error registering custom role %s: %s", role_config.name or tostring(n), err);
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	81 end
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	82 end
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	83
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	84 -- Process custom permissions from config
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	85
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	86 local config_add_perms = module:get_option("add_permissions", {});
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	87 local config_remove_perms = module:get_option("remove_permissions", {});
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	88
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	89 for role_name, added_permissions in pairs(config_add_perms) do
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	90 if not role_registry[role_name] then
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	91 module:log("error", "Cannot add permissions to unknown role '%s'", role_name);
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	92 else
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	93 for _, permission in ipairs(added_permissions) do
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	94 role_registry[role_name]:set_permission(permission, true, true);
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	95 end
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	96 end
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	97 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	98
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	99 for role_name, removed_permissions in pairs(config_remove_perms) do
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	100 if not role_registry[role_name] then
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	101 module:log("error", "Cannot remove permissions from unknown role '%s'", role_name);
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	102 else
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	103 for _, permission in ipairs(removed_permissions) do
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	104 role_registry[role_name]:set_permission(permission, false, true);
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	105 end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	106 end
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	107 end
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	108
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	109 -- Public API
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	110
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	111 -- Get the primary role of a user
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	112 function get_user_role(user)
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	113 local bare_jid = user.."@"..host;
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	114
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	115 -- Check config first
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	116 if config_global_admin_jids:contains(bare_jid) then
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	117 return role_registry["prosody:operator"];
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	118 elseif config_admin_jids:contains(bare_jid) then
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	119 return role_registry["prosody:admin"];
10659 8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	120 end
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	121
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	122 -- Check storage
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	123 local stored_roles, err = role_store:get(user);
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	124 if not stored_roles then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	125 if err then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	126 -- Unable to fetch role, fail
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	127 return nil, err;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	128 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	129 -- No role set, use default role
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	130 return role_registry["prosody:user"];
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	131 end
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	132 if stored_roles._default == nil then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	133 -- No primary role explicitly set, return default
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	134 return role_registry["prosody:user"];
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	135 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	136 local primary_stored_role = role_registry[stored_roles._default];
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	137 if not primary_stored_role then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	138 return nil, "unknown-role";
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	139 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	140 return primary_stored_role;
10659 8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	141 end
8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	142
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	143 -- Set the primary role of a user
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	144 function set_user_role(user, role_name)
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	145 local role = role_registry[role_name];
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	146 if not role then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	147 return error("Cannot assign default user an unknown role: "..tostring(role_name));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	148 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	149 local keys_update = {
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	150 _default = role_name;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	151 -- Primary role cannot be secondary role
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	152 [role_name] = role_map_store.remove;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	153 };
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	154 if role_name == "prosody:user" then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	155 -- Don't store default
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	156 keys_update._default = role_map_store.remove;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	157 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	158 local ok, err = role_map_store:set_keys(user, keys_update);
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	159 if not ok then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	160 return nil, err;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	161 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	162 return role;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	163 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	164
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	165 function add_user_secondary_role(user, role_name)
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	166 if not role_registry[role_name] then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	167 return error("Cannot assign default user an unknown role: "..tostring(role_name));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	168 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	169 role_map_store:set(user, role_name, true);
11472 c32753ceb0f0 mod_authz_internal: add support for setting roles of a local user Jonas Schäfer <jonas@wielicki.name> parents: 10659 diff changeset	170 end
c32753ceb0f0 mod_authz_internal: add support for setting roles of a local user Jonas Schäfer <jonas@wielicki.name> parents: 10659 diff changeset	171
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	172 function remove_user_secondary_role(user, role_name)
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	173 role_map_store:set(user, role_name, nil);
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	174 end
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	175
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	176 function get_user_secondary_roles(user)
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	177 local stored_roles, err = role_store:get(user);
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	178 if not stored_roles then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	179 if err then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	180 -- Unable to fetch role, fail
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	181 return nil, err;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	182 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	183 -- No role set
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	184 return {};
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	185 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	186 stored_roles._default = nil;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	187 for role_name in pairs(stored_roles) do
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	188 stored_roles[role_name] = role_registry[role_name];
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	189 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	190 return stored_roles;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	191 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	192
12663 cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	193 function user_can_assume_role(user, role_name)
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	194 local primary_role = get_user_role(user);
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	195 if primary_role and primary_role.role_name == role_name then
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	196 return true;
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	197 end
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	198 local secondary_roles = get_user_secondary_roles(user);
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	199 if secondary_roles and secondary_roles[role_name] then
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	200 return true;
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	201 end
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	202 return false;
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	203 end
cf88f6b03942 mod_authz_internal: Expose convenience method to test if user can assume role Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	204
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	205 -- This function is expensive
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	206 function get_users_with_role(role_name)
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	207 local function role_filter(username, default_role) --luacheck: ignore 212/username
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	208 return default_role == role_name;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	209 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	210 local primary_role_users = set.new(it.to_array(it.filter(role_filter, pairs(role_map_store:get_all("_default") or {}))));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	211 local secondary_role_users = set.new(it.to_array(it.keys(role_map_store:get_all(role_name) or {})));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	212
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	213 local config_set;
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	214 if role_name == "prosody:admin" then
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	215 config_set = config_admin_jids;
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	216 elseif role_name == "prosody:operator" then
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	217 config_set = config_global_admin_jids;
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	218 end
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	219 if config_set then
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	220 local config_admin_users = config_set / function (admin_jid)
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	221 local j_node, j_host = jid_split(admin_jid);
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	222 if j_host == host then
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	223 return j_node;
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	224 end
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	225 end;
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	226 return it.to_array(config_admin_users + primary_role_users + secondary_role_users);
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	227 end
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	228 return it.to_array(primary_role_users + secondary_role_users);
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	229 end
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	230
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	231 function get_jid_role(jid)
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	232 local bare_jid = jid_bare(jid);
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	233 if config_global_admin_jids:contains(bare_jid) then
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	234 return role_registry["prosody:operator"];
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	235 elseif config_admin_jids:contains(bare_jid) then
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	236 return role_registry["prosody:admin"];
12730 427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	237 elseif is_component then
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	238 local user_host = jid_host(bare_jid);
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	239 if host_user_role and user_host == host_suffix then
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	240 return role_registry[host_user_role];
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	241 elseif server_user_role and hosts[user_host] then
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	242 return role_registry[server_user_role];
427dd01f0864 mod_authz_internal: Allow configuring role of local-server/parent-host users Matthew Wild <mwild1@gmail.com> parents: 12663 diff changeset	243 end
10659 8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	244 end
8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	245 return nil;
8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	246 end
8f95308c3c45 usermanager, mod_authz_: Merge mod_authz_config and mod_authz_internal into the latter Matthew Wild <mwild1@gmail.com>* parents: diff changeset	247
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	248 function set_jid_role(jid, role_name) -- luacheck: ignore 212
11472 c32753ceb0f0 mod_authz_internal: add support for setting roles of a local user Jonas Schäfer <jonas@wielicki.name> parents: 10659 diff changeset	249 return false;
c32753ceb0f0 mod_authz_internal: add support for setting roles of a local user Jonas Schäfer <jonas@wielicki.name> parents: 10659 diff changeset	250 end
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	251
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	252 function get_jids_with_role(role_name)
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	253 -- Fetch role users from storage
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	254 local storage_role_jids = array.map(get_users_with_role(role_name), function (username)
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	255 return username.."@"..host;
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	256 end);
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	257 if role_name == "prosody:admin" then
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	258 return it.to_array(config_admin_jids + set.new(storage_role_jids));
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	259 elseif role_name == "prosody:operator" then
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	260 return it.to_array(config_global_admin_jids + set.new(storage_role_jids));
11745 3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	261 end
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	262 return storage_role_jids;
3a2d58a39872 usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given role Matthew Wild <mwild1@gmail.com> parents: 11474 diff changeset	263 end
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	264
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	265 function add_default_permission(role_name, action, policy)
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	266 local role = role_registry[role_name];
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	267 if not role then
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	268 module:log("warn", "Attempt to add default permission for unknown role: %s", role_name);
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	269 return nil, "no-such-role";
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	270 end
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	271 if policy == nil then policy = true; end
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	272 module:log("debug", "Adding policy %s for permission %s on role %s", policy, action, role_name);
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	273 return role:set_permission(action, policy);
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	274 end
9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	275
12648 f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	276 function get_role_by_name(role_name)
f299e570a0fe mod_authz_internal: Use util.roles, some API changes and config support Matthew Wild <mwild1@gmail.com> parents: 12642 diff changeset	277 return assert(role_registry[role_name], role_name);
12642 9061f9621330 Switch to a new role-based authorization framework, removing is_admin() Matthew Wild <mwild1@gmail.com> parents: 11745 diff changeset	278 end
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	279
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	280 -- COMPAT: Migrate from 0.12 role storage
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	281 local function do_migration(migrate_host)
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	282 local old_role_store = assert(module:context(migrate_host):open_store("roles"));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	283 local new_role_store = assert(module:context(migrate_host):open_store("account_roles"));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	284
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	285 local migrated, failed, skipped = 0, 0, 0;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	286 -- Iterate all users
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	287 for username in assert(old_role_store:users()) do
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	288 local old_roles = it.to_array(it.filter(function (k) return k:sub(1,1) ~= "_"; end, it.keys(old_role_store:get(username))));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	289 if #old_roles == 1 then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	290 local ok, err = new_role_store:set(username, {
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	291 _default = old_roles[1];
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	292 });
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	293 if ok then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	294 migrated = migrated + 1;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	295 else
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	296 failed = failed + 1;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	297 print("EE: Failed to store new role info for '"..username.."': "..err);
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	298 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	299 else
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	300 print("WW: User '"..username.."' has multiple roles and cannot be automatically migrated");
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	301 skipped = skipped + 1;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	302 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	303 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	304 return migrated, failed, skipped;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	305 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	306
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	307 function module.command(arg)
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	308 if arg[1] == "migrate" then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	309 table.remove(arg, 1);
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	310 local migrate_host = arg[1];
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	311 if not migrate_host or not prosody.hosts[migrate_host] then
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	312 print("EE: Please supply a valid host to migrate to the new role storage");
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	313 return 1;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	314 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	315
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	316 -- Initialize storage layer
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	317 require "core.storagemanager".initialize_host(migrate_host);
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	318
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	319 print("II: Migrating roles...");
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	320 local migrated, failed, skipped = do_migration(migrate_host);
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	321 print(("II: %d migrated, %d failed, %d skipped"):format(migrated, failed, skipped));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	322 return (failed + skipped == 0) and 0 or 1;
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	323 else
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	324 print("EE: Unknown command: "..(arg[1] or "<none given>"));
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	325 print(" Hint: try 'migrate'?");
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	326 end
07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12648 diff changeset	327 end

prosody

427dd01f0864

plugins/mod_authz_internal.lua

Software / code / prosody

Annotate

plugins/mod_authz_internal.lua @ 12730:427dd01f0864

Software `/` code `/` prosody