view mod_audit_status/mod_audit_status.lua @ 5682:527c747711f3

mod_http_oauth2: Limit revocation to clients own tokens in strict mode RFC 7009 section 2.1 states: > The authorization server first validates the client credentials (in > case of a confidential client) and then verifies whether the token was > issued to the client making the revocation request. If this > validation fails, the request is refused and the client is informed of > the error by the authorization server as described below. The first part was already covered (in strict mode). This adds the later part using the hash of client_id recorded in 0860497152af It still seems weird to me that revoking a leaked token should not be allowed whoever might have discovered it, as that seems the responsible thing to do.
author Kim Alvefur <zash@zash.se>
date Sun, 29 Oct 2023 11:30:49 +0100
parents 14b6397cd6de
children 9944c6c3e914
line wrap: on
line source

module:depends("audit");

local st = require "util.stanza";

-- Suppress warnings about module:audit()
-- luacheck: ignore 143/module

local heartbeat_interval = module:get_option_number("audit_status_heartbeat_interval", 60);

local store = module:open_store(nil, "keyval+");

module:hook_global("server-started", function ()
	local recorded_status = store:get();
	if recorded_status and recorded_status.status == "started" then
		module:audit(nil, "server-crashed", { timestamp = recorded_status.heartbeat });
	end
	module:audit(nil, "server-started");
	store:set_key(nil, "status", "started");
end);

module:hook_global("server-stopped", function ()
	module:audit(nil, "server-stopped", {
		custom = {
			prosody.shutdown_reason and st.stanza("note"):text(prosody.shutdown_reason);
		};
	});
	store:set_key(nil, "status", "stopped");
end);

if heartbeat_interval then
	module:add_timer(0, function ()
		store:set_key(nil, "heartbeat", os.time());
		return heartbeat_interval;
	end);
end