124 Commits (4953cd71dfbb1925dc4a477efd2ed48c2dfd70d6)

Author	SHA1	Message	Date
David Robertson	6e6edea6c1	Properly typecheck tests.api (#14983)	3 years ago
Andrew Morgan	8d90e5f200	Add type hints to `TestRatelimiter` (#14885)	3 years ago
Sean Quah	e980982b59	Do not reject `/sync` requests with unrecognised filter fields (#14369) ... For forward compatibility, Synapse needs to ignore fields it does not recognise instead of raising an error. Fixes #14365. Signed-off-by: Sean Quah <seanq@matrix.org>	4 years ago
Patrick Cloke	4283bd1cf9	Support filtering the /messages API by relation type (MSC3874). (#14148) ... Gated behind an experimental configuration flag.	4 years ago
Quentin Gliech	3dd175b628	`synapse.api.auth.Auth` cleanup: make permission-related methods use `Requester` instead of the `UserID` (#13024) ... Part of #13019 This changes all the permission-related methods to rely on the Requester instead of the UserID. This is a first step towards enabling scoped access tokens at some point, since I expect the Requester to have scope-related informations in it. It also changes methods which figure out the user/device/appservice out of the access token to return a Requester instead of something else. This avoids having store-related objects in the methods signatures.	4 years ago
David Robertson	599c403d99	Allow rate limiters to passively record actions they cannot limit (#13253) ... Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com>	4 years ago
reivilibre	0dbdc39940	Fix a long-standing bug which meant that rate limiting was not restrictive enough in some cases. (#13018)	4 years ago
Quentin Gliech	fe1daad672	Move the "email unsubscribe" resource, refactor the macaroon generator & simplify the access token verification logic. (#12986) ... This simplifies the access token verification logic by removing the `rights` parameter which was only ever used for the unsubscribe link in email notifications. The latter has been moved under the `/_synapse` namespace, since it is not a standard API. This also makes the email verification link more secure, by embedding the app_id and pushkey in the macaroon and verifying it. This prevents the user from tampering the query parameters of that unsubscribe link. Macaroon generation is refactored: - Centralised all macaroon generation and verification logic to the `MacaroonGenerator` - Moved to `synapse.utils` - Changed the constructor to require only a `Clock`, hostname, and a secret key (instead of a full `Homeserver`). - Added tests for all methods.	4 years ago
Quentin Gliech	92103cb2c8	Decouple `synapse.api.auth_blocking.AuthBlocking` from `synapse.api.auth.Auth`. (#13021)	4 years ago
Patrick Cloke	7bc08f3201	Remove remaining bits of groups code. (#12936) ... * Update worker docs to remove group endpoints. * Removes an unused parameter to `ApplicationService`. * Break dependency between media repo and groups. * Avoid copying `m.room.related_groups` state events during room upgrades.	4 years ago
Patrick Cloke	c52abc1cfd	Additional constants for EDU types. (#12884) ... Instead of hard-coding strings in many places.	4 years ago
Patrick Cloke	7fbf42499d	Use `getClientAddress` instead of `getClientIP`. (#12599) ... getClientIP was deprecated in Twisted 18.4.0, which also added getClientAddress. The Synapse minimum version for Twisted is currently 18.9.0, so all supported versions have the new API.	4 years ago
Patrick Cloke	86cf6a3a17	Remove references to unstable identifiers from MSC3440. (#12382) ... Removes references to unstable thread relation, unstable identifiers for filtering parameters, and the experimental config flag.	4 years ago
Richard van der Hoff	6c0b44a3d7	Fix `PushRuleEvaluator` and `Filter` to work on frozendicts (#12100) ... * Fix `PushRuleEvaluator` to work on frozendicts frozendicts do not (necessarily) inherit from dict, so this needs to handle them correctly. * Fix event filtering for frozen events Looks like this one was introduced by #11194.	4 years ago
Patrick Cloke	02d708568b	Replace assertEquals and friends with non-deprecated versions. (#12092)	4 years ago
Richard van der Hoff	e24ff8ebe3	Remove `HomeServer.get_datastore()` (#12031) ... The presence of this method was confusing, and mostly present for backwards compatibility. Let's get rid of it. Part of #11733	4 years ago
Jason Robinson	2560b1b6b2	Allow tracking puppeted users for MAU (#11561) ... Currently when puppeting another user, the user doing the puppeting is tracked for client IPs and MAU (if configured). When tracking MAU is important, it becomes necessary to be possible to also track the client IPs and MAU of puppeted users. As an example a client that manages user creation and creation of tokens via the Synapse admin API, passing those tokens for the client to use. This PR adds optional configuration to enable tracking of puppeted users into monthly active users. The default behaviour stays the same. Signed-off-by: Jason Robinson <jasonr@matrix.org>	4 years ago
reivilibre	17886d2603	Add experimental support for MSC3202: allowing application services to masquerade as specific devices. (#11538)	5 years ago
Patrick Cloke	a19d01c3d9	Support filtering by relations per MSC3440 (#11236) ... Adds experimental support for `relation_types` and `relation_senders` fields for filters.	5 years ago
Patrick Cloke	94b620a5ed	Use direct references for configuration variables (part 6). (#10916)	5 years ago
Jason Robinson	fa74536384	Fix AuthBlocking check when requester is appservice (#10881) ... If the MAU count had been reached, Synapse incorrectly blocked appservice users even though they've been explicitly configured not to be tracked (the default). This was due to bypassing the relevant if as it was chained behind another earlier hit if as an elif. Signed-off-by: Jason Robinson <jasonr@matrix.org>	5 years ago
Patrick Cloke	47854c71e9	Use direct references for configuration variables (part 4). (#10893)	5 years ago
Quentin Gliech	bd4919fb72	MSC2918 Refresh tokens implementation (#9450) ... This implements refresh tokens, as defined by MSC2918 This MSC has been implemented client side in Hydrogen Web: vector-im/hydrogen-web#235 The basics of the MSC works: requesting refresh tokens on login, having the access tokens expire, and using the refresh token to get a new one. Signed-off-by: Quentin Gliech <quentingliech@gmail.com>	5 years ago
Brendan Abolivier	a683028d81	Correctly ratelimit invites when creating a room (#9968) ... * Correctly ratelimit invites when creating a room Also allow ratelimiting for more than one action at a time.	5 years ago
Richard van der Hoff	7562d887e1	Change the format of access tokens away from macaroons (#5588)	5 years ago
Jonathan de Jong	4b965c862d	Remove redundant "coding: utf-8" lines (#9786) ... Part of #9744 Removes all redundant `# -*- coding: utf-8 -*-` lines from files, as python 3 automatically reads source code as utf-8 now. `Signed-off-by: Jonathan de Jong <jonathan@automatia.nl>`	5 years ago
Patrick Cloke	0b3112123d	Use mock from the stdlib. (#9772)	5 years ago
Erik Johnston	963f4309fe	Make RateLimiter class check for ratelimit overrides (#9711) ... This should fix a class of bug where we forget to check if e.g. the appservice shouldn't be ratelimited. We also check the `ratelimit_override` table to check if the user has ratelimiting disabled. That table is really only meant to override the event sender ratelimiting, so we don't use any values from it (as they might not make sense for different rate limits), but we do infer that if ratelimiting is disabled for the user we should disabled all ratelimits. Fixes #9663	5 years ago
Eric Eastwood	0a00b7ff14	Update black, and run auto formatting over the codebase (#9381) ... - Update black version to the latest - Run black auto formatting over the codebase - Run autoformatting according to [`docs/code_style.md `](80d6dc9783/docs/code_style.md) - Update `code_style.md` docs around installing black to use the correct version	5 years ago
Patrick Cloke	74af356baf	Convert additional test-cases to homeserver test case. (#9396) ... And convert some inlineDeferreds to async-friendly functions.	5 years ago
Richard van der Hoff	90cf1eec44	Remove redundant mocking	6 years ago
Patrick Cloke	30fba62108	Apply an IP range blacklist to push and key revocation requests. (#8821) ... Replaces the `federation_ip_range_blacklist` configuration setting with an `ip_range_blacklist` setting with wider scope. It now applies to: * Federation * Identity servers * Push notifications * Checking key validitity for third-party invite events The old `federation_ip_range_blacklist` setting is still honored if present, but with reduced scope (it only applies to federation and identity servers).	6 years ago
Erik Johnston	f737368a26	Add admin API for logging in as a user (#8617)	6 years ago
Erik Johnston	f21e24ffc2	Add ability for access tokens to belong to one user but grant access to another user. (#8616) ... We do it this way round so that only the "owner" can delete the access token (i.e. `/logout/all` by the "owner" also deletes that token, but `/logout/all` by the "target user" doesn't). A future PR will add an API for creating such a token. When the target user and authenticated entity are different the `Processed request` log line will be logged with a: `{@admin:server as @bob:server} ...`. I'm not convinced by that format (especially since it adds spaces in there, making it harder to use `cut -d ' '` to chop off the start of log lines). Suggestions welcome.	6 years ago
Patrick Cloke	c9c0ad5e20	Remove the deprecated Handlers object (#8494) ... All handlers now available via get_*_handler() methods on the HomeServer.	6 years ago
Patrick Cloke	c619253db8	Stop sub-classing object (#8249)	6 years ago
Patrick Cloke	e00816ad98	Do not yield on awaitables in tests. (#8193)	6 years ago
Will Hunt	2df82ae451	Do not apply ratelimiting on joins to appservices (#8139) ... Add new method ratelimiter.can_requester_do_action and ensure that appservices are exempt from being ratelimited. Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Erik Johnston <erik@matrix.org>	6 years ago
Will Hunt	cbbf9126cb	Do not apply ratelimiting on joins to appservices (#8139) ... Add new method ratelimiter.can_requester_do_action and ensure that appservices are exempt from being ratelimited. Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Erik Johnston <erik@matrix.org>	6 years ago
Patrick Cloke	d4a7829b12	Convert synapse.api to async/await (#8031)	6 years ago
Andrew Morgan	f4e6495b5d	Performance improvements and refactor of Ratelimiter (#7595) ... While working on https://github.com/matrix-org/synapse/issues/5665 I found myself digging into the `Ratelimiter` class and seeing that it was both: * Rather undocumented, and * causing a *lot* of config checks This PR attempts to refactor and comment the `Ratelimiter` class, as well as encourage config file accesses to only be done at instantiation. Best to be reviewed commit-by-commit.	6 years ago
Andrew Morgan	aee9130a83	Stop Auth methods from polling the config on every req. (#7420)	6 years ago
Patrick Cloke	eed7c5b89e	Convert auth handler to async/await (#7261)	6 years ago
Richard van der Hoff	799001f2c0	Add a `make_event_from_dict` method (#6858) ... ... and use it in places where it's trivial to do so. This will make it easier to pass room versions into the FrozenEvent constructors.	6 years ago
Brendan Abolivier	8822b33111	Update copyrights	7 years ago
Brendan Abolivier	988d8d6507	Incorporate review	7 years ago
Brendan Abolivier	c6dbca2422	Incorporate review	7 years ago
Brendan Abolivier	dcc069a2e2	Lint	7 years ago
Brendan Abolivier	e7943f660a	Add unit tests	7 years ago
Jason Robinson	6d847d8ce6	Ensure support users can be registered even if MAU limit is reached ... This allows support users to be created even on MAU limits via the admin API. Support users are excluded from MAU after creation, so it makes sense to exclude them in creation - except if the whole host is in disabled state. Signed-off-by: Jason Robinson <jasonr@matrix.org>	7 years ago