2019-05-02 09:45:52 +00:00
|
|
|
#
|
2023-11-21 20:29:58 +00:00
|
|
|
# This file is licensed under the Affero General Public License (AGPL) version 3.
|
|
|
|
#
|
|
|
|
# Copyright (C) 2023 New Vector, Ltd
|
|
|
|
#
|
|
|
|
# This program is free software: you can redistribute it and/or modify
|
|
|
|
# it under the terms of the GNU Affero General Public License as
|
|
|
|
# published by the Free Software Foundation, either version 3 of the
|
|
|
|
# License, or (at your option) any later version.
|
|
|
|
#
|
|
|
|
# See the GNU Affero General Public License for more details:
|
|
|
|
# <https://www.gnu.org/licenses/agpl-3.0.html>.
|
|
|
|
#
|
|
|
|
# Originally licensed under the Apache License, Version 2.0:
|
|
|
|
# <http://www.apache.org/licenses/LICENSE-2.0>.
|
|
|
|
#
|
|
|
|
# [This file includes modifications made by New Vector Limited]
|
2019-05-02 09:45:52 +00:00
|
|
|
#
|
|
|
|
#
|
2019-08-13 11:49:28 +00:00
|
|
|
|
|
|
|
import re
|
2021-11-29 22:19:45 +00:00
|
|
|
from http import HTTPStatus
|
2021-06-07 14:12:34 +00:00
|
|
|
from typing import Iterable, Pattern
|
2019-08-13 11:49:28 +00:00
|
|
|
|
2021-03-12 16:37:57 +00:00
|
|
|
from synapse.api.auth import Auth
|
2019-05-02 09:45:52 +00:00
|
|
|
from synapse.api.errors import AuthError
|
2021-03-12 16:37:57 +00:00
|
|
|
from synapse.http.site import SynapseRequest
|
2022-08-22 13:17:59 +00:00
|
|
|
from synapse.types import Requester
|
2019-05-02 09:45:52 +00:00
|
|
|
|
|
|
|
|
2021-06-07 14:12:34 +00:00
|
|
|
def admin_patterns(path_regex: str, version: str = "v1") -> Iterable[Pattern]:
|
2020-01-22 13:36:43 +00:00
|
|
|
"""Returns the list of patterns for an admin endpoint
|
|
|
|
|
|
|
|
Args:
|
|
|
|
path_regex: The regex string to match. This should NOT have a ^
|
|
|
|
as this will be prefixed.
|
|
|
|
|
|
|
|
Returns:
|
|
|
|
A list of regex patterns.
|
|
|
|
"""
|
2020-09-17 11:04:15 +00:00
|
|
|
admin_prefix = "^/_synapse/admin/" + version
|
2020-01-22 13:36:43 +00:00
|
|
|
patterns = [re.compile(admin_prefix + path_regex)]
|
|
|
|
return patterns
|
|
|
|
|
|
|
|
|
2021-03-12 16:37:57 +00:00
|
|
|
async def assert_requester_is_admin(auth: Auth, request: SynapseRequest) -> None:
|
2019-05-02 09:45:52 +00:00
|
|
|
"""Verify that the requester is an admin user
|
|
|
|
|
|
|
|
Args:
|
2021-03-12 16:37:57 +00:00
|
|
|
auth: Auth singleton
|
2020-06-05 13:33:49 +00:00
|
|
|
request: incoming request
|
2019-05-02 09:45:52 +00:00
|
|
|
|
|
|
|
Raises:
|
2020-06-05 13:33:49 +00:00
|
|
|
AuthError if the requester is not a server admin
|
2019-05-02 09:45:52 +00:00
|
|
|
"""
|
2019-10-11 14:29:26 +00:00
|
|
|
requester = await auth.get_user_by_req(request)
|
2022-08-22 13:17:59 +00:00
|
|
|
await assert_user_is_admin(auth, requester)
|
2019-05-02 09:45:52 +00:00
|
|
|
|
|
|
|
|
2022-08-22 13:17:59 +00:00
|
|
|
async def assert_user_is_admin(auth: Auth, requester: Requester) -> None:
|
2019-05-02 09:45:52 +00:00
|
|
|
"""Verify that the given user is an admin user
|
|
|
|
|
|
|
|
Args:
|
2021-03-12 16:37:57 +00:00
|
|
|
auth: Auth singleton
|
2022-08-22 13:17:59 +00:00
|
|
|
requester: The user making the request, according to the access token.
|
2019-05-02 09:45:52 +00:00
|
|
|
|
|
|
|
Raises:
|
2020-06-05 13:33:49 +00:00
|
|
|
AuthError if the user is not a server admin
|
2019-05-02 09:45:52 +00:00
|
|
|
"""
|
2022-08-22 13:17:59 +00:00
|
|
|
is_admin = await auth.is_server_admin(requester)
|
2019-05-02 09:45:52 +00:00
|
|
|
if not is_admin:
|
2021-11-29 22:19:45 +00:00
|
|
|
raise AuthError(HTTPStatus.FORBIDDEN, "You are not a server admin")
|