forked-synapse/synapse/handlers
Quentin Gliech fe1daad672
Move the "email unsubscribe" resource, refactor the macaroon generator & simplify the access token verification logic. (#12986)
This simplifies the access token verification logic by removing the `rights`
parameter which was only ever used for the unsubscribe link in email
notifications. The latter has been moved under the `/_synapse` namespace,
since it is not a standard API.

This also makes the email verification link more secure, by embedding the
app_id and pushkey in the macaroon and verifying it. This prevents the user
from tampering the query parameters of that unsubscribe link.

Macaroon generation is refactored:

- Centralised all macaroon generation and verification logic to the
  `MacaroonGenerator`
- Moved to `synapse.utils`
- Changed the constructor to require only a `Clock`, hostname, and a secret key
  (instead of a full `Homeserver`).
- Added tests for all methods.
2022-06-14 09:12:08 -04:00
..
ui_auth Fix typo in some instances of enable_registration_token_3pid_bypass. (#12639) 2022-05-05 07:11:52 -04:00
__init__.py Remove redundant "coding: utf-8" lines (#9786) 2021-04-14 15:34:27 +01:00
account_data.py Add StreamKeyType class and replace string literals with constants (#12567) 2022-05-16 15:35:31 +00:00
account_validity.py Implement cancellation support/protection for module callbacks (#12568) 2022-05-09 12:31:14 +01:00
account.py Optionally include account validity in MSC3720 account status responses (#12266) 2022-03-24 11:19:41 +01:00
admin.py Rename storage classes (#12913) 2022-05-31 12:17:50 +00:00
appservice.py Additional constants for EDU types. (#12884) 2022-05-27 07:14:36 -04:00
auth.py Move the "email unsubscribe" resource, refactor the macaroon generator & simplify the access token verification logic. (#12986) 2022-06-14 09:12:08 -04:00
cas.py Remove HomeServer.get_datastore() (#12031) 2022-02-23 11:04:02 +00:00
deactivate_account.py Add third_party module callbacks to check if a user can delete a room and deactivate a user (#12028) 2022-03-09 18:23:57 +00:00
device.py Consolidate the logic of delete_device/delete_devices. (#12970) 2022-06-07 07:43:35 -04:00
devicemessage.py Additional constants for EDU types. (#12884) 2022-05-27 07:14:36 -04:00
directory.py Uniformize spam-checker API, part 4: port other spam-checker callbacks to return Union[Allow, Codes]. (#12857) 2022-06-13 18:16:16 +00:00
e2e_keys.py Additional constants for EDU types. (#12884) 2022-05-27 07:14:36 -04:00
e2e_room_keys.py Refactor and convert Linearizer to async (#12357) 2022-04-05 15:43:52 +01:00
event_auth.py Remove redundant room_version param from check_auth_rules_from_context 2022-06-12 23:13:10 +01:00
events.py Rename storage classes (#12913) 2022-05-31 12:17:50 +00:00
federation_event.py Merge branch 'rav/simplify_event_auth_interface' into develop 2022-06-13 11:34:59 +01:00
federation.py Uniformize spam-checker API, part 4: port other spam-checker callbacks to return Union[Allow, Codes]. (#12857) 2022-06-13 18:16:16 +00:00
identity.py Use getClientAddress instead of getClientIP. (#12599) 2022-05-04 14:11:21 -04:00
initial_sync.py Reduce the amount of state we pull from the DB (#12811) 2022-06-06 09:24:12 +01:00
message.py Decouple synapse.api.auth_blocking.AuthBlocking from synapse.api.auth.Auth. (#13021) 2022-06-14 09:51:15 +01:00
oidc.py Move the "email unsubscribe" resource, refactor the macaroon generator & simplify the access token verification logic. (#12986) 2022-06-14 09:12:08 -04:00
pagination.py Rename storage classes (#12913) 2022-05-31 12:17:50 +00:00
password_policy.py Use direct references for some configuration variables (part 3) (#10885) 2021-09-23 07:13:34 -04:00
presence.py Wait for lazy join to complete when getting current state (#12872) 2022-06-01 16:02:53 +01:00
profile.py Remove remaining pieces of groups code. (#12966) 2022-06-06 13:20:05 -04:00
push_rules.py Add a module API to allow modules to edit push rule actions (#12406) 2022-04-27 13:55:33 +00:00
read_marker.py Refactor and convert Linearizer to async (#12357) 2022-04-05 15:43:52 +01:00
receipts.py Additional constants for EDU types. (#12884) 2022-05-27 07:14:36 -04:00
register.py Decouple synapse.api.auth_blocking.AuthBlocking from synapse.api.auth.Auth. (#13021) 2022-06-14 09:51:15 +01:00
relations.py Implement MSC3816, consider the root event for thread participation. (#12766) 2022-06-06 07:18:04 -04:00
room_batch.py Rename storage classes (#12913) 2022-05-31 12:17:50 +00:00
room_list.py Wait for lazy join to complete when getting current state (#12872) 2022-06-01 16:02:53 +01:00
room_member_worker.py Implement knock feature (#6739) 2021-06-09 19:39:51 +01:00
room_member.py Uniformize spam-checker API, part 4: port other spam-checker callbacks to return Union[Allow, Codes]. (#12857) 2022-06-13 18:16:16 +00:00
room_summary.py Wait for lazy join to complete when getting current state (#12872) 2022-06-01 16:02:53 +01:00
room.py Decouple synapse.api.auth_blocking.AuthBlocking from synapse.api.auth.Auth. (#13021) 2022-06-14 09:51:15 +01:00
saml.py Remove HomeServer.get_datastore() (#12031) 2022-02-23 11:04:02 +00:00
search.py Reduce the amount of state we pull from the DB (#12811) 2022-06-06 09:24:12 +01:00
send_email.py Remove unnecessary ignores due to Twisted upgrade. (#11939) 2022-02-08 09:15:59 -05:00
set_password.py Remove HomeServer.get_datastore() (#12031) 2022-02-23 11:04:02 +00:00
sso.py Use getClientAddress instead of getClientIP. (#12599) 2022-05-04 14:11:21 -04:00
state_deltas.py Remove HomeServer.get_datastore() (#12031) 2022-02-23 11:04:02 +00:00
stats.py Wait for lazy join to complete when getting current state (#12872) 2022-06-01 16:02:53 +01:00
sync.py Decouple synapse.api.auth_blocking.AuthBlocking from synapse.api.auth.Auth. (#13021) 2022-06-14 09:51:15 +01:00
typing.py Reduce state pulled from DB due to sending typing and receipts over federation (#12964) 2022-06-06 16:46:11 +01:00
user_directory.py Wait for lazy join to complete when getting current state (#12872) 2022-06-01 16:02:53 +01:00