Commit Graph

54 Commits

Author SHA1 Message Date
Kim Alvefur
e39b6ca8bb Fix revokation of token on logout
In OAuth 2.0, you don't authenticate with the revocation endpoint using
the token you are revoking, but rather the OAuth client credentials.
2023-10-07 17:39:37 +02:00
Kim Alvefur
2cdcf7f282 Update for role changes in Prosody
See https://hg.prosody.im/trunk/rev/082c7d856e61
2023-10-07 12:59:43 +02:00
Kim Alvefur
ad9af20f12 Workaround for Flask context change 2023-10-04 23:27:05 +02:00
Jonas Schäfer
fcfcdbeb23 Follow new role scheme in Prosody
Prosody changed its role scheme to only support a single primary role
for each user. In addition, the names of the built-in roles have been
changed. We thus follow those changes to be compatible with the most
recent trunk.

One open question is whether we should switch admin -> operator here,
too (operator being a server-wide admin), but so far there's no need
to.
2023-03-29 18:42:53 +02:00
Jonas Schäfer
2762304ae8 Make AdminUserInfo compatible with new API
The mod_http_admin_api changed recently [1], so we need to follow
suit.

Fixes #149.

   [1]: https://hg.prosody.im/prosody-modules/rev/d68348323406
2023-03-28 22:21:07 +02:00
Kim Alvefur
8f1f80b7d7 Update to match new Prosody scope naming scheme
Ref https://hg.prosody.im/prosody-modules/rev/5ab134b7e510

Thanks Jonas
2023-03-28 21:14:20 +02:00
Jonas Schäfer
68f72743c5 Bump quart to version 0.17
This is needed because jinja2 had an update which caused the portal to
not work at all:

```
ImportError: cannot import name 'escape' from 'jinja2'
```

Quart needed updating for that.

This update required a lot of typefixes. Apparently, the "canned"
responses (like redirect) are now plain werkzeug responses, while
quart.Response does not inherit from werkzeug.Response (otherwise, we
could've changed the type annotations to werkzeug.Response everywhere,
but that doesn't work because a quart.Response is not a
werkzeug.Response).

P.S.: This time, I *did* check that avatar uploads don't break (see
b007afc).
2022-05-30 17:37:54 +02:00
Matthew Wild
05caf38d37 Use PUT method instead of POST, as expected by API 2022-01-17 16:33:46 +01:00
Matthew Wild
390ecded42 Include PEP data in export/import 2022-01-17 16:33:29 +01:00
Matthew Wild
3cb8185b1a prosodyclient: Add API to import XEP-0227 account data 2022-01-17 16:23:58 +01:00
Matthew Wild
481379d03f Switch to HTTP 204 to indicate no data to export
This is more robust, as it indicates the request was successfully
authenticated and processed, but that there is no data to export. This is
different from the URL not existing (which would also happen if the module was
unavailable, which should be a notable error instead).
2022-01-17 16:23:57 +01:00
Matthew Wild
e18f727db0 prosodyclient: Add support for exporting a user's account data 2022-01-17 16:23:55 +01:00
Jonas Schäfer
8a293985ca Implement system status panel
This offers system metrics and a way to send a broadcast
message to all online or registered users.

Requires prosody-modules cade5dac1003.
2021-05-27 17:21:58 +02:00
Jonas Schäfer
13b2a76c3d Fix mypy errors introduced in b007afc901 2021-05-27 16:33:46 +02:00
Jonas Schäfer
b007afc901 Revert "Upgrade to quart 0.15"
This reverts commit 486596f89f.
It was discovered that multipart/form-data forms do not work
correctly with Quart 0.15. The upgrade to Quart 0.15 was rushed
and not tested correctly, which I apologize for.

See-Also: https://github.com/pgjones/quart/issues/126
2021-05-22 11:11:16 +02:00
Jonas Schäfer
c58ce8450f Fix type annotations after bumping dependencies 2021-05-18 14:33:06 +02:00
Jonas Schäfer
03573d1f05 Explicitly pass mod_rest JSON as JSON
Otherwise, it can get passed as x-www-form-urlencoded, which
Prosody understandably does not quite like.
2021-05-18 12:35:46 +02:00
Jonas Schäfer
486596f89f Upgrade to quart 0.15 2021-05-18 12:35:31 +02:00
Jonas Schäfer
ea7ed7c030 Add support for roles
Requires patches to prosody trunk which have been submitted
already (2021-03-22) which introduce the set_roles function on
usermanager.

Fixes #42.
2021-03-25 17:31:56 +01:00
Jonas Schäfer
cca899bd8c Create "Edit user" form
This aggregates the user actions behind a single "edit" button on
the list view, making it less crammed. It also offers the
functionality of actually editing the user, mind.

Also in preparation for #42.

Requires https://hg.prosody.im/prosody-modules/rev/5bc706c2db8f.
2021-03-25 17:31:49 +01:00
Kim Alvefur
329916e200 Update for switch to datamapper in mod_rest
mod_rest after the switch to the new util.datamapper in
https://hg.prosody.im/prosody-modules/rev/073f5397c1d2 does not accept
boolean True as value for the xep-0092 'version' field. An empty object
is equivalent and compatible with both previous and future versions.
2021-03-23 21:38:34 +01:00
Jonas Schäfer
025172592f Improve error handling in Prosody version retrieval 2021-03-09 22:20:37 +01:00
Kim Alvefur
6de1e5313f Add support for displaying prosody version
This only works for authenticated users even in debug mode because
it requires a session with prosody to send the request.

Fixes #66.
2021-03-09 22:08:58 +01:00
Jonas Schäfer
6dbe2c2d5e Fix missing type annotation 2021-02-23 21:18:14 +01:00
Jonas Schäfer
e410aedfef Improve logging of rejected IQ calls 2021-02-23 20:21:44 +01:00
Jonas Schäfer
1713da61e7 Fix password change
This fixes a regression introduced in e476d9b7 which caused the
token to be incorrectly used when authenticating with mod_rest for
sending the password change IQ stanza.
2021-02-23 20:20:47 +01:00
Jonas Schäfer
b04c4fa42d Force setting the SNIKKET_DOMAIN as HTTP Host when talking to prosody
This is required if the portal is talking to a Prosody with
multiple HTTP domains and it doesn’t have http_default_host set...
In a true snikket, this doesn’t happen, but we all know...
2021-01-31 15:29:21 +01:00
Jonas Schäfer
5f1d3ba307 Implement password reset flow 2021-01-30 10:49:28 +01:00
Matthew Wild
a6aef681a7 Add support for 'roster' invite type 2021-01-28 11:00:05 +00:00
Jonas Schäfer
df75fbaa1b Add support for circles with MUCs 2021-01-26 16:12:07 +01:00
Jonas Schäfer
c1132ae975 Implement invite flow in the web portal
This allows us to translate the pages using the same tooling and
to have consistent theming.
2021-01-25 17:10:42 +01:00
Jonas Schäfer
fe43479b19 Password reset link support
This also includes a restructure of the admin API usage because it
was restructured upstream :).
2021-01-23 14:07:30 +01:00
Jonas Schäfer
2f7b99c3cc Implement token revocation
Fixes #18.
2021-01-21 19:30:19 +01:00
Jonas Schäfer
2eed571fbb Fix type annotation 2021-01-21 18:42:59 +01:00
Jonas Schäfer
e18b733017 Add more features to circle editor
- Manage members
- Update name

(Normally, I’d fix this up into the initial implementation
commit, but things happened in between and the rebase would be
painful.)
2021-01-21 18:09:57 +01:00
Jonas Schäfer
b6188ed29f Add button to export debug info of a user 2021-01-21 18:09:57 +01:00
Jonas Schäfer
065c065b3b Determine the profile visiblity more conservatively
This will ensure that the user is not incorrectly shown a lower
visibility level than parts of their profile have.
2021-01-21 16:55:11 +01:00
Jonas Schäfer
17efe53106 Implement group support (we call ’em circles) 2021-01-21 16:55:10 +01:00
Jonas Schäfer
427f73811c Add support for modifying profile access model
Fixes #17.
2021-01-17 20:12:01 +01:00
Jonas Schäfer
fadbdaf204 Restore compatibility with Python 3.7 2021-01-17 20:11:26 +01:00
Jonas Schäfer
fa700bba07 Massive code cleanup
- Avoid fighting import cycles using a factory function
- Collapse useless subpackages into simple modules
- Move flask plugins / infrastructure in own module
- Refactor how blueprints are used to localize information about
  URL routing to app factory
2021-01-17 20:11:25 +01:00
Jonas Schäfer
e476d9b7c2 Implement admin dashboard
Fixes #23.
2021-01-17 20:10:04 +01:00
Jonas Schäfer
9e3fcbaf67 Prepare for fully typechecked codebase 2021-01-16 16:05:54 +01:00
Jonas Schäfer
d3777d3b07 Make flake8 happy 2021-01-16 15:22:46 +01:00
Jonas Schäfer
909a8ef2a7 Update logout comment with relevant feature request 2020-04-30 16:14:14 +02:00
Jonas Schäfer
22a371444d Remove compatibility hacks after bugs got fixed
See-Also: https://issues.prosody.im/1500
See-Also: https://issues.prosody.im/1501
2020-04-30 16:14:14 +02:00
Jonas Schäfer
12276337c1 Partially log requests sent to the API
Payloads containing sensitive content (such as passwords and
tokens) should be hidden.
2020-04-30 16:14:14 +02:00
Jonas Schäfer
880b4c22d0 Get rid of debug prints 2020-04-30 16:14:14 +02:00
Jonas Schäfer
04d9f9fd9b Properly handle the various login error conditions
Note that this includes setting content types on the sessions,
which is why this spills over into the XML IQ function.
2020-04-30 16:14:14 +02:00
Jonas Schäfer
71733adc90 Fix various edge cases around stale sessions
If a session cookie is set, but prosody doesn’t know about the
session anymore, we could get into fun states. This patch fixes
them by requiring the session to be tested with a ping request
on each HTTP request.
2020-03-07 13:11:45 +01:00