Mercurial > prosody-modules
view mod_measure_process/mod_measure_process.lua @ 5682:527c747711f3
mod_http_oauth2: Limit revocation to clients own tokens in strict mode
RFC 7009 section 2.1 states:
> The authorization server first validates the client credentials (in
> case of a confidential client) and then verifies whether the token was
> issued to the client making the revocation request. If this
> validation fails, the request is refused and the client is informed of
> the error by the authorization server as described below.
The first part was already covered (in strict mode). This adds the later
part using the hash of client_id recorded in 0860497152af
It still seems weird to me that revoking a leaked token should not be
allowed whoever might have discovered it, as that seems the responsible
thing to do.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 29 Oct 2023 11:30:49 +0100 |
parents | c26f515751af |
children |
line wrap: on
line source
module:set_global() local get_cpu_time = os.clock local custom_metric = require "core.statsmanager".metric local cpu_time = custom_metric( "counter", "process_cpu", "seconds", "CPU time used by Prosody as reported by clock(3)." ):with_labels() local lfs = require "lfs" module:hook("stats-update", function () cpu_time:set(get_cpu_time()) end); if lfs.attributes("/proc/self/statm", "mode") == "file" then local pagesize = module:get_option_number("memory_pagesize", 4096); -- getconf PAGESIZE local vsz = custom_metric( "gauge", "process_virtual_memory", "bytes", "Virtual memory size in bytes." ):with_labels() local rss = custom_metric( "gauge", "process_resident_memory", "bytes", "Resident memory size in bytes." ):with_labels() module:hook("stats-update", function () local statm, err = io.open("/proc/self/statm"); if not statm then module:log("error", tostring(err)); return; end -- virtual memory (caches, opened librarys, everything) vsz:set(statm:read("*n") * pagesize); -- resident set size (actually used memory) rss:set(statm:read("*n") * pagesize); statm:close(); end); end if lfs.attributes("/proc/self/fd", "mode") == "directory" then local open_fds = custom_metric( "gauge", "process_open_fds", "", "Number of open file descriptors." ):with_labels() local has_posix, posix = pcall(require, "util.pposix") local max_fds if has_posix then max_fds = custom_metric( "gauge", "process_max_fds", "", "Maximum number of open file descriptors" ):with_labels() else module:log("warn", "not reporting maximum number of file descriptors because mod_posix is not available") end local function limit2num(limit) if limit == "unlimited" then return math.huge end return limit end module:hook("stats-update", function () local count = 0 for _ in lfs.dir("/proc/self/fd") do count = count + 1 end open_fds:set(count) if has_posix then local ok, soft, hard = posix.getrlimit("NOFILE") if ok then max_fds:set(limit2num(soft or hard)); end end end); end