prosody
012fa81d1f5d
plugins/mod_tokenauth.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

plugins/mod_tokenauth.lua @ 12913:012fa81d1f5d

mod_tokenauth: Add 'purpose' constraint This allows tokens to be tied to specific purposes/protocols. For example, we shouldn't (without specific consideration) allow an OAuth token to be dropped into a slot expecting a FAST token. While FAST doesn't currently use mod_tokenauth, it and others may do in the future. It's better to be explicit about what kind of token code is issuing or expecting.
author Matthew Wild <mwild1@gmail.com>
date Wed, 01 Mar 2023 13:01:21 +0000
parent 12772:daa654dbd8de
child 12914:2b4661bd39e2
comparison
equal deleted inserted replaced
12912:44a78985471f 12913:012fa81d1f5d
11 return prosody.hosts[host].authz.get_role_by_name(role); 11 return prosody.hosts[host].authz.get_role_by_name(role);
12 end 12 end
13 return usermanager.get_user_role(username, host); 13 return usermanager.get_user_role(username, host);
14 end 14 end
15 15
16 function create_jid_token(actor_jid, token_jid, token_role, token_ttl, token_data) 16 function create_jid_token(actor_jid, token_jid, token_role, token_ttl, token_data, token_purpose)
17 token_jid = jid.prep(token_jid); 17 token_jid = jid.prep(token_jid);
18 if not actor_jid or token_jid ~= actor_jid and not jid.compare(token_jid, actor_jid) then 18 if not actor_jid or token_jid ~= actor_jid and not jid.compare(token_jid, actor_jid) then
19 return nil, "not-authorized"; 19 return nil, "not-authorized";
20 end 20 end
21 21
28 local token_info = { 28 local token_info = {
29 owner = actor_jid; 29 owner = actor_jid;
30 created = os.time(); 30 created = os.time();
31 expires = token_ttl and (os.time() + token_ttl) or nil; 31 expires = token_ttl and (os.time() + token_ttl) or nil;
32 jid = token_jid; 32 jid = token_jid;
33 purpose = token_purpose;
33 34
34 resource = token_resource; 35 resource = token_resource;
35 role = token_role; 36 role = token_role;
36 data = token_data; 37 data = token_data;
37 }; 38 };