prosody-modules: mod_restrict_xmpp/mod_restrict

annotate mod_restrict_xmpp/mod_restrict_xmpp.lua @ 5424:b45d9a81b3da

mod_http_oauth2: Revert role selector, going to try something else Back out f2c7bb3af600 Allowing only a single role to be encoded into the grant takes away the possibility of having multiple roles in the grant, one of which is selected when issuing an access token. It also takes away the ability to have zero roles granted, which could be useful e.g. when you only need OIDC scopes.

author	Kim Alvefur <zash@zash.se>
date	Sun, 07 May 2023 19:40:57 +0200
parents	a1f49586d28a
children	825c6fb76c48

rev	line source
5009 459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	1 local array = require "util.array";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	2 local it = require "util.iterators";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	3 local set = require "util.set";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	4 local st = require "util.stanza";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	5
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	6 module:default_permission("prosody:user", "xmpp:federate");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	7 module:hook("route/remote", function (event)
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	8 if not module:may("xmpp:federate", event) then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	9 if event.stanza.attr.type ~= "result" and event.stanza.attr.type ~= "error" then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	10 module:log("warn", "Access denied: xmpp:federate for %s -> %s", event.stanza.attr.from, event.stanza.attr.to);
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	11 local reply = st.error_reply(event.stanza, "auth", "forbidden");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	12 event.origin.send(reply);
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	13 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	14 return true;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	15 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	16 end);
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	17
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	18 local iq_namespaces = {
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	19 ["jabber:iq:roster"] = "contacts";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	20 ["jabber:iq:private"] = "storage";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	21
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	22 ["vcard-temp"] = "profile";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	23 ["urn:xmpp:mam:0"] = "history";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	24 ["urn:xmpp:mam:1"] = "history";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	25 ["urn:xmpp:mam:2"] = "history";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	26
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	27 ["urn:xmpp:carbons:0"] = "carbons";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	28 ["urn:xmpp:carbons:1"] = "carbons";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	29 ["urn:xmpp:carbons:2"] = "carbons";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	30
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	31 ["urn:xmpp:blocking"] = "blocklist";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	32
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	33 ["http://jabber.org/protocol/pubsub"] = "pep";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	34 ["http://jabber.org/protocol/disco#info"] = "disco";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	35 };
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	36
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	37 local legacy_storage_nodes = {
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	38 ["storage:bookmarks"] = "bookmarks";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	39 ["storage:rosternotes"] = "contacts";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	40 ["roster:delimiter"] = "contacts";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	41 ["storage:metacontacts"] = "contacts";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	42 };
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	43
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	44 local pep_nodes = {
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	45 ["storage:bookmarks"] = "bookmarks";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	46 ["urn:xmpp:bookmarks:1"] = "bookmarks";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	47
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	48 ["urn:xmpp:avatar:data"] = "profile";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	49 ["urn:xmpp:avatar:metadata"] = "profile";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	50 ["http://jabber.org/protocol/nick"] = "profile";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	51
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	52 ["eu.siacs.conversations.axolotl.devicelist"] = "omemo";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	53 ["urn:xmpp:omemo:1:devices"] = "omemo";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	54 ["urn:xmpp:omemo:1:bundles"] = "omemo";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	55 ["urn:xmpp:omemo:2:devices"] = "omemo";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	56 ["urn:xmpp:omemo:2:bundles"] = "omemo";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	57 };
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	58
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	59 module:hook("pre-iq/bare", function (event)
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	60 if not event.to_self then return; end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	61 local origin, stanza = event.origin, event.stanza;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	62
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	63 local typ = stanza.attr.type;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	64 if typ ~= "set" and typ ~= "get" then return; end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	65 local action = typ == "get" and "read" or "write";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	66
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	67 local payload = stanza.tags[1];
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	68 local ns = payload and payload.attr.xmlns;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	69 local proto = iq_namespaces[ns];
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	70 if proto == "pep" then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	71 local pubsub = payload:get_child("pubsub", "http://jabber.org/protocol/pubsub");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	72 local node = pubsub and #pubsub.tags == 1 and pubsub.tags[1].attr.node or nil;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	73 proto = pep_nodes[node] or "pep";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	74 if proto == "pep" and node and node:match("^eu%.siacs%.conversations%.axolotl%.bundles%.%d+$") then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	75 proto = "omemo"; -- COMPAT w/ original OMEMO
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	76 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	77 elseif proto == "storage" then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	78 local data = payload.tags[1];
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	79 proto = data and legacy_storage_nodes[data.attr.xmlns] or "legacy-storage";
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	80 elseif proto == "carbons" then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	81 -- This allows access to live messages
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	82 proto, action = "messages", "read";
5010 a1f49586d28a mod_restrict_xmpp: Treat archive query as a read despite using iq-set Kim Alvefur <zash@zash.se> parents: 5009 diff changeset	83 elseif proto == "history" then
a1f49586d28a mod_restrict_xmpp: Treat archive query as a read despite using iq-set Kim Alvefur <zash@zash.se> parents: 5009 diff changeset	84 action = "read";
5009 459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	85 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	86 local permission_name = "xmpp:account:"..(proto and (proto..":") or "")..action;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	87 if not module:may(permission_name, event) then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	88 module:log("warn", "Access denied: %s ({%s}%s) for %s", permission_name, ns, payload.name, origin.full_jid or origin.id);
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	89 origin.send(st.error_reply(stanza, "auth", "forbidden", "You do not have permission to make this request ("..permission_name..")"));
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	90 return true;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	91 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	92 end);
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	93
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	94 --module:default_permission("prosody:restricted", "xmpp:account:read");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	95 --module:default_permission("prosody:restricted", "xmpp:account:write");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	96 module:default_permission("prosody:restricted", "xmpp:account:messages:read");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	97 module:default_permission("prosody:restricted", "xmpp:account:messages:write");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	98 for _, property_list in ipairs({ iq_namespaces, legacy_storage_nodes, pep_nodes }) do
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	99 for account_property in set.new(array.collect(it.values(property_list))) do
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	100 module:default_permission("prosody:restricted", "xmpp:account:"..account_property..":read");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	101 module:default_permission("prosody:restricted", "xmpp:account:"..account_property..":write");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	102 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	103 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	104
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	105 module:default_permission("prosody:restricted", "xmpp:account:presence:write");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	106 module:hook("pre-presence/bare", function (event)
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	107 if not event.to_self then return; end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	108 local stanza = event.stanza;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	109 if not module:may("xmpp:account:presence:write", event) then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	110 module:log("warn", "Access denied: xmpp:account:presence:write for %s", event.origin.full_jid or event.origin.id);
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	111 event.origin.send(st.error_reply(stanza, "auth", "forbidden", "You do not have permission to send account presence"));
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	112 return true;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	113 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	114 local priority = stanza:get_child_text("priority");
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	115 if priority ~= "-1" then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	116 if not module:may("xmpp:account:messages:read", event) then
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	117 module:log("warn", "Access denied: xmpp:account:messages:read for %s", event.origin.full_jid or event.origin.id);
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	118 event.origin.send(st.error_reply(stanza, "auth", "forbidden", "You do not have permission to receive messages (use presence priority -1)"));
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	119 return true;
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	120 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	121 end
459a4001c1d9 mod_restrict_xmpp: XMPP-layer access control using Prosody's permissions API Matthew Wild <mwild1@gmail.com> parents: diff changeset	122 end);

Mercurial > prosody-modules

annotate mod_restrict_xmpp/mod_restrict_xmpp.lua @ 5424:b45d9a81b3da