Mirrors
/
synapse-old
mirror of https://github.com/matrix-org/synapse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
synapse-old/synapse/rest/client/v2_alpha/auth.py

252 lines
8.3 KiB
Python
Raw Normal View History

Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
# -*- coding: utf-8 -*-
copyrights
2016-01-06 21:26:29 -07:00
# Copyright 2015, 2016 OpenMarket Ltd
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
run isort
2018-07-09 00:09:20 -06:00
import logging
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
from twisted.internet import defer
from synapse.api.constants import LoginType
from synapse.api.errors import SynapseError
Drop support for v2_alpha API prefix (#5190)
2019-05-15 10:37:46 -06:00
from synapse.api.urls import CLIENT_API_PREFIX
Catch the exceptions thrown by twisted when you write to a closed connection
2016-02-12 06:46:59 -07:00
from synapse.http.server import finish_request
Fix fallback auth on Python 3 (#4197)
2018-11-19 11:27:33 -07:00
from synapse.http.servlet import RestServlet, parse_string
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
Unify v1 and v2 REST client APIs (#5226)
2019-06-03 05:28:59 -06:00
from ._base import client_patterns
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
logger = logging.getLogger(__name__)
RECAPTCHA_TEMPLATE = """
<html>
<head>
<title>Authentication</title>
<meta name='viewport' content='width=device-width, initial-scale=1,
user-scalable=no, minimum-scale=1.0, maximum-scale=1.0'>
switch from google.com to recaptcha.net for reCAPTCHA (#4731) * add trivial clarification about jemalloc * switch from google.com to recaptcha.net because https://developers.google.com/recaptcha/docs/faq#can-i-use-recaptcha-globally
2019-02-25 12:15:36 -07:00
<script src="https://www.recaptcha.net/recaptcha/api.js"
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
async defer></script>
<script src="//code.jquery.com/jquery-1.11.2.min.js"></script>
<link rel="stylesheet" href="/_matrix/static/client/register/style.css">
<script>
function captchaDone() {
$('#registrationForm').submit();
}
</script>
</head>
<body>
<form id="registrationForm" method="post" action="%(myurl)s">
<div>
<p>
Hello! We need to prevent computer programs and other automated
things from creating accounts on this server.
</p>
<p>
Please verify that you're not a robot.
</p>
<input type="hidden" name="session" value="%(session)s" />
<div class="g-recaptcha"
data-sitekey="%(sitekey)s"
data-callback="captchaDone">
</div>
<noscript>
<input type="submit" value="All Done" />
</noscript>
</div>
</div>
</form>
</body>
</html>
"""
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
TERMS_TEMPLATE = """
<html>
<head>
<title>Authentication</title>
<meta name='viewport' content='width=device-width, initial-scale=1,
user-scalable=no, minimum-scale=1.0, maximum-scale=1.0'>
<link rel="stylesheet" href="/_matrix/static/client/register/style.css">
</head>
<body>
<form id="registrationForm" method="post" action="%(myurl)s">
<div>
<p>
Please click the button below if you agree to the
<a href="%(terms_url)s">privacy policy of this homeserver.</a>
</p>
<input type="hidden" name="session" value="%(session)s" />
<input type="submit" value="Agree" />
</div>
</form>
</body>
</html>
"""
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
SUCCESS_TEMPLATE = """
<html>
<head>
<title>Success!</title>
<meta name='viewport' content='width=device-width, initial-scale=1,
user-scalable=no, minimum-scale=1.0, maximum-scale=1.0'>
<link rel="stylesheet" href="/_matrix/static/client/register/style.css">
<script>
window.postmessage for Interactive Auth fallback If you're a webapp running the fallback in an iframe, you can't set set a window.onAuthDone function. Let's post a message back to window.opener instead.
2016-10-06 11:16:59 -06:00
if (window.onAuthDone) {
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
window.onAuthDone();
window.postmessage for Interactive Auth fallback If you're a webapp running the fallback in an iframe, you can't set set a window.onAuthDone function. Let's post a message back to window.opener instead.
2016-10-06 11:16:59 -06:00
} else if (window.opener && window.opener.postMessage) {
window.opener.postMessage("authDone", "*");
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
}
</script>
</head>
<body>
<div>
<p>Thank you</p>
<p>You may now close this window and return to the application</p>
</div>
</body>
</html>
"""
pep8
2015-04-02 10:06:17 -06:00
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
class AuthRestServlet(RestServlet):
"""
Handles Client / Server API authentication in any situations where it
cannot be handled in the normal flow (with requests to the same endpoint).
Current use is for web fallback auth.
"""
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
Unify v1 and v2 REST client APIs (#5226)
2019-06-03 05:28:59 -06:00
PATTERNS = client_patterns(r"/auth/(?P<stagetype>[\w\.]*)/fallback/web")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
def __init__(self, hs):
super(AuthRestServlet, self).__init__()
self.hs = hs
self.auth = hs.get_auth()
Split out the auth handler
2016-06-02 06:31:45 -06:00
self.auth_handler = hs.get_auth_handler()
Fix registration on workers (#4682) * Move RegistrationHandler init to HomeServer * Move post registration actions to RegistrationHandler * Add post regisration replication endpoint * Newsfile
2019-02-20 00:47:31 -07:00
self.registration_handler = hs.get_registration_handler()
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
def on_GET(self, request, stagetype):
Fix fallback auth on Python 3 (#4197)
2018-11-19 11:27:33 -07:00
session = parse_string(request, "session")
if not session:
raise SynapseError(400, "No session supplied")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
Fix fallback auth on Python 3 (#4197)
2018-11-19 11:27:33 -07:00
if stagetype == LoginType.RECAPTCHA:
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
html = RECAPTCHA_TEMPLATE % {
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
"session": session,
"myurl": "%s/r0/auth/%s/fallback/web"
% (CLIENT_API_PREFIX, LoginType.RECAPTCHA),
"sitekey": self.hs.config.recaptcha_public_key,
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
}
html_bytes = html.encode("utf8")
request.setResponseCode(200)
request.setHeader(b"Content-Type", b"text/html; charset=utf-8")
request.setHeader(b"Content-Length", b"%d" % (len(html_bytes),))
request.write(html_bytes)
Incorporate Dave's work for GDPR login flows As per https://github.com/vector-im/riot-web/issues/7168#issuecomment-419996117
2018-09-27 14:53:58 -06:00
finish_request(request)
Fix fallback auth on Python 3 (#4197)
2018-11-19 11:27:33 -07:00
return None
Incorporate Dave's work for GDPR login flows As per https://github.com/vector-im/riot-web/issues/7168#issuecomment-419996117
2018-09-27 14:53:58 -06:00
elif stagetype == LoginType.TERMS:
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
html = TERMS_TEMPLATE % {
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
"session": session,
"terms_url": "%s_matrix/consent?v=%s"
% (self.hs.config.public_baseurl, self.hs.config.user_consent_version),
"myurl": "%s/r0/auth/%s/fallback/web"
% (CLIENT_API_PREFIX, LoginType.TERMS),
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
}
Incorporate Dave's work for GDPR login flows As per https://github.com/vector-im/riot-web/issues/7168#issuecomment-419996117
2018-09-27 14:53:58 -06:00
html_bytes = html.encode("utf8")
request.setResponseCode(200)
request.setHeader(b"Content-Type", b"text/html; charset=utf-8")
request.setHeader(b"Content-Length", b"%d" % (len(html_bytes),))
request.write(html_bytes)
Catch the exceptions thrown by twisted when you write to a closed connection
2016-02-12 06:46:59 -07:00
finish_request(request)
Fix fallback auth on Python 3 (#4197)
2018-11-19 11:27:33 -07:00
return None
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
else:
raise SynapseError(404, "Unknown auth stage type")
@defer.inlineCallbacks
def on_POST(self, request, stagetype):
Fix fallback auth on Python 3 (#4197)
2018-11-19 11:27:33 -07:00
session = parse_string(request, "session")
if not session:
raise SynapseError(400, "No session supplied")
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
if stagetype == LoginType.RECAPTCHA:
Fix fallback auth on Python 3 (#4197)
2018-11-19 11:27:33 -07:00
response = parse_string(request, "g-recaptcha-response")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
Fix fallback auth on Python 3 (#4197)
2018-11-19 11:27:33 -07:00
if not response:
raise SynapseError(400, "No captcha response supplied")
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
authdict = {"response": response, "session": session}
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
success = yield self.auth_handler.add_oob_auth(
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
LoginType.RECAPTCHA, authdict, self.hs.get_ip_from_request(request)
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
)
if success:
html = SUCCESS_TEMPLATE
else:
html = RECAPTCHA_TEMPLATE % {
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
"session": session,
"myurl": "%s/r0/auth/%s/fallback/web"
% (CLIENT_API_PREFIX, LoginType.RECAPTCHA),
"sitekey": self.hs.config.recaptcha_public_key,
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
}
html_bytes = html.encode("utf8")
request.setResponseCode(200)
request.setHeader(b"Content-Type", b"text/html; charset=utf-8")
request.setHeader(b"Content-Length", b"%d" % (len(html_bytes),))
request.write(html_bytes)
Catch the exceptions thrown by twisted when you write to a closed connection
2016-02-12 06:46:59 -07:00
finish_request(request)
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
Replace returnValue with return (#5736)
2019-07-23 07:00:55 -06:00
return None
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
elif stagetype == LoginType.TERMS:
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
if ("session" not in request.args or len(request.args["session"])) == 0:
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
raise SynapseError(400, "No session supplied")
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
session = request.args["session"][0]
authdict = {"session": session}
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
success = yield self.auth_handler.add_oob_auth(
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
LoginType.TERMS, authdict, self.hs.get_ip_from_request(request)
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
)
if success:
html = SUCCESS_TEMPLATE
else:
html = TERMS_TEMPLATE % {
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
"session": session,
"terms_url": "%s_matrix/consent?v=%s"
% (
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
self.hs.config.public_baseurl,
Include a version query string arg for the consent route
2018-10-31 13:19:28 -06:00
self.hs.config.user_consent_version,
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
),
Run Black. (#5482)
2019-06-20 03:32:02 -06:00
"myurl": "%s/r0/auth/%s/fallback/web"
% (CLIENT_API_PREFIX, LoginType.TERMS),
Flesh out the fallback auth for terms
2018-10-03 15:54:19 -06:00
}
html_bytes = html.encode("utf8")
request.setResponseCode(200)
request.setHeader(b"Content-Type", b"text/html; charset=utf-8")
request.setHeader(b"Content-Length", b"%d" % (len(html_bytes),))
request.write(html_bytes)
finish_request(request)
Replace returnValue with return (#5736)
2019-07-23 07:00:55 -06:00
return None
Completely replace fallback auth for C/S V2: * Now only the auth part goes to fallback, not the whole operation * Auth fallback is a normal API endpoint, not a static page * Params like the recaptcha pubkey can just live in the config Involves a little engineering on JsonResource so its servlets aren't always forced to return JSON. I should document this more, in fact I'll do that now.
2015-04-01 08:05:30 -06:00
else:
raise SynapseError(404, "Unknown auth stage type")
def on_OPTIONS(self, _):
return 200, {}
def register_servlets(hs, http_server):
AuthRestServlet(hs).register(http_server)