1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
|
-- Prosody IM
-- Copyright (C) 2008-2010 Matthew Wild
-- Copyright (C) 2008-2010 Waqas Hussain
--
-- This project is MIT/X11 licensed. Please see the
-- COPYING file in the source package for more information.
--
local modulemanager = require "core.modulemanager";
local log = require "util.logger".init("usermanager");
local type = type;
local it = require "util.iterators";
local jid_bare = require "util.jid".bare;
local jid_split = require "util.jid".split;
local jid_prep = require "util.jid".prep;
local config = require "core.configmanager";
local sasl_new = require "util.sasl".new;
local storagemanager = require "core.storagemanager";
local set = require "util.set";
local prosody = _G.prosody;
local hosts = prosody.hosts;
local setmetatable = setmetatable;
local default_provider = "internal_hashed";
local _ENV = nil;
-- luacheck: std none
local function new_null_provider()
local function dummy() return nil, "method not implemented"; end;
local function dummy_get_sasl_handler() return sasl_new(nil, {}); end
return setmetatable({name = "null", get_sasl_handler = dummy_get_sasl_handler}, {
__index = function(self, method) return dummy; end --luacheck: ignore 212
});
end
local global_admins_config = config.get("*", "admins");
if type(global_admins_config) ~= "table" then
global_admins_config = nil; -- TODO: factor out moduleapi magic config handling and use it here
end
local global_admins = set.new(global_admins_config) / jid_prep;
local admin_role = { ["prosody:admin"] = true };
local global_authz_provider = {
get_user_roles = function (user) end; --luacheck: ignore 212/user
get_jid_roles = function (jid)
if global_admins:contains(jid) then
return admin_role;
end
end;
get_jids_with_role = function (role)
if role ~= "prosody:admin" then return {}; end
return it.to_array(global_admins);
end;
set_user_roles = function (user, roles) end; -- luacheck: ignore 212
set_jid_roles = function (jid, roles) end; -- luacheck: ignore 212
};
local provider_mt = { __index = new_null_provider() };
local function initialize_host(host)
local host_session = hosts[host];
local authz_provider_name = config.get(host, "authorization") or "internal";
local authz_mod = modulemanager.load(host, "authz_"..authz_provider_name);
host_session.authz = authz_mod or global_authz_provider;
if host_session.type ~= "local" then return; end
host_session.events.add_handler("item-added/auth-provider", function (event)
local provider = event.item;
local auth_provider = config.get(host, "authentication") or default_provider;
if config.get(host, "anonymous_login") then
log("error", "Deprecated config option 'anonymous_login'. Use authentication = 'anonymous' instead.");
auth_provider = "anonymous";
end -- COMPAT 0.7
if provider.name == auth_provider then
host_session.users = setmetatable(provider, provider_mt);
end
if host_session.users ~= nil and host_session.users.name ~= nil then
log("debug", "Host '%s' now set to use user provider '%s'", host, host_session.users.name);
end
end);
host_session.events.add_handler("item-removed/auth-provider", function (event)
local provider = event.item;
if host_session.users == provider then
host_session.users = new_null_provider();
end
end);
host_session.users = new_null_provider(); -- Start with the default usermanager provider
local auth_provider = config.get(host, "authentication") or default_provider;
if config.get(host, "anonymous_login") then auth_provider = "anonymous"; end -- COMPAT 0.7
if auth_provider ~= "null" then
modulemanager.load(host, "auth_"..auth_provider);
end
end;
prosody.events.add_handler("host-activated", initialize_host, 100);
local function test_password(username, host, password)
return hosts[host].users.test_password(username, password);
end
local function get_password(username, host)
return hosts[host].users.get_password(username);
end
local function set_password(username, password, host, resource)
local ok, err = hosts[host].users.set_password(username, password);
if ok then
prosody.events.fire_event("user-password-changed", { username = username, host = host, resource = resource });
end
return ok, err;
end
local function user_exists(username, host)
if hosts[host].sessions[username] then return true; end
return hosts[host].users.user_exists(username);
end
local function create_user(username, password, host)
return hosts[host].users.create_user(username, password);
end
local function delete_user(username, host)
local ok, err = hosts[host].users.delete_user(username);
if not ok then return nil, err; end
prosody.events.fire_event("user-deleted", { username = username, host = host });
return storagemanager.purge(username, host);
end
local function users(host)
return hosts[host].users.users();
end
local function get_sasl_handler(host, session)
return hosts[host].users.get_sasl_handler(session);
end
local function get_provider(host)
return hosts[host].users;
end
local function get_roles(jid, host)
if host and not hosts[host] then return false; end
if type(jid) ~= "string" then return false; end
jid = jid_bare(jid);
host = host or "*";
local actor_user, actor_host = jid_split(jid);
local roles;
local authz_provider = (host ~= "*" and hosts[host].authz) or global_authz_provider;
if actor_user and actor_host == host then -- Local user
roles = authz_provider.get_user_roles(actor_user);
else -- Remote user/JID
roles = authz_provider.get_jid_roles(jid);
end
return roles;
end
local function set_roles(jid, host, roles)
if host and not hosts[host] then return false; end
if type(jid) ~= "string" then return false; end
jid = jid_bare(jid);
host = host or "*";
local actor_user, actor_host = jid_split(jid);
local authz_provider = (host ~= "*" and hosts[host].authz) or global_authz_provider;
if actor_user and actor_host == host then -- Local user
local ok, err = authz_provider.set_user_roles(actor_user, roles);
if ok then
prosody.events.fire_event("user-roles-changed", {
username = actor_user, host = actor_host
});
end
return ok, err;
else -- Remote entity
return authz_provider.set_jid_roles(jid, roles)
end
end
local function is_admin(jid, host)
local roles = get_roles(jid, host);
return roles and roles["prosody:admin"];
end
local function get_users_with_role(role, host)
if not hosts[host] then return false; end
if type(role) ~= "string" then return false; end
return hosts[host].authz.get_users_with_role(role);
end
local function get_jids_with_role(role, host)
if host and not hosts[host] then return false; end
if type(role) ~= "string" then return false; end
host = host or "*";
local authz_provider = (host ~= "*" and hosts[host].authz) or global_authz_provider;
return authz_provider.get_jids_with_role(role);
end
return {
new_null_provider = new_null_provider;
initialize_host = initialize_host;
test_password = test_password;
get_password = get_password;
set_password = set_password;
user_exists = user_exists;
create_user = create_user;
delete_user = delete_user;
users = users;
get_sasl_handler = get_sasl_handler;
get_provider = get_provider;
get_roles = get_roles;
set_roles = set_roles;
is_admin = is_admin;
get_users_with_role = get_users_with_role;
get_jids_with_role = get_jids_with_role;
};
|
