dandri/matrix-authentication-service
1
0
Fork 0
mirror of https://github.com/element-hq/matrix-authentication-service.git synced 2026-08-29 07:38:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

resolve comments related to deprecation and transitioning

Browse Source
This commit is contained in:
defaultdino
2026-05-13 13:17:51 +02:00
parent bed5611883
commit 3f57a9c8c7
6 changed files with 50 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/cli/src/util.rs
+9
View File
@@ -212,6 +212,14 @@ pub fn site_config_from_config(
user_session_inactivity_ttl: c.expire_user_sessions.then_some(c.ttl),
});
if account_config.registration_token_required {
tracing::warn!(
"`account.registration_token_required` is deprecated. use \
`account.password_registration_token_required` and per-provider \
`registration_token_required` instead"
)
}
Ok(SiteConfig {
access_token_ttl: experimental_config.access_token_ttl,
compat_token_ttl: experimental_config.compat_token_ttl,
@@ -224,6 +232,7 @@ pub fn site_config_from_config(
&& account_config.password_registration_enabled,
password_registration_email_required: account_config.password_registration_email_required,
password_registration_token_required: account_config.password_registration_token_required,
registration_token_required: account_config.registration_token_required,
email_change_allowed: account_config.email_change_allowed,
displayname_change_allowed: account_config.displayname_change_allowed,
password_change_allowed: password_config.enabled()
crates/config/src/sections/account.rs
+19 -15
View File
@@ -68,7 +68,16 @@ pub struct AccountConfig {
/// This has no effect if password login is disabled.
#[serde(default = "default_false", skip_serializing_if = "is_default_false")]
pub password_recovery_enabled: bool,
/// Whether registration tokens are required for password registrations.
/// Defaults to `false`.
///
/// When enabled, users must provide a valid registration token during
/// password registration. This has no effect if password registration
/// is disabled.
#[serde(default = "default_false", skip_serializing_if = "is_default_false")]
pub password_registration_token_required: bool,
/// Whether users are allowed to delete their own account. Defaults to
/// `true`.
#[serde(default = "default_true", skip_serializing_if = "is_default_true")]
@@ -80,18 +89,11 @@ pub struct AccountConfig {
#[serde(default = "default_false", skip_serializing_if = "is_default_false")]
pub login_with_email_allowed: bool,
/// Whether registration tokens are required for password registrations.
/// Defaults to `false`.
///
/// When enabled, users must provide a valid registration token during
/// password registration. This has no effect if password registration
/// is disabled.
#[serde(
default = "default_false",
skip_serializing_if = "is_default_false",
alias = "registration_token_required"
)]
pub password_registration_token_required: bool,
/// Whether registration tokens are required for password registrations
/// This is deprecated in favor of `password_registration_token_required`
#[serde(default = "default_false", skip_serializing_if = "is_default_false")]
pub registration_token_required: bool,
}
impl Default for AccountConfig {
@@ -103,9 +105,10 @@ impl Default for AccountConfig {
password_registration_email_required: default_true(),
password_change_allowed: default_true(),
password_recovery_enabled: default_false(),
password_registration_token_required: default_false(),
registration_token_required: default_false(),
account_deactivation_allowed: default_true(),
login_with_email_allowed: default_false(),
password_registration_token_required: default_false(),
}
}
}
@@ -118,9 +121,10 @@ impl AccountConfig {
&& is_default_true(&self.displayname_change_allowed)
&& is_default_true(&self.password_change_allowed)
&& is_default_false(&self.password_recovery_enabled)
&& is_default_false(&self.password_registration_token_required)
&& is_default_false(&self.registration_token_required)
&& is_default_true(&self.account_deactivation_allowed)
&& is_default_false(&self.login_with_email_allowed)
&& is_default_false(&self.password_registration_token_required)
}
}
crates/data-model/src/site_config.rs
+4
View File
@@ -79,6 +79,10 @@ pub struct SiteConfig {
/// Whether registration tokens are required for password registrations.
pub password_registration_token_required: bool,
/// Whether registration tokens are required globally for password registrations
/// Deprecated in favor of `password_registration_token_required`
pub registration_token_required: bool,
/// Whether users can change their email.
pub email_change_allowed: bool,
crates/handlers/src/admin/v1/site_config.rs
+10 -1
View File
@@ -25,9 +25,14 @@ pub struct SiteConfig {
/// Whether a valid email address is required for password registrations.
pub password_registration_email_required: bool,
/// Whether registration tokens are required for password registrations.
pub password_registration_token_required: bool,
/// Whether registration tokens are required for password registrations.
/// Deprecated in favor of `password_registration_token_required`
#[deprecated = "use `password_registration_token_required` instead"]
#[allow(deprecated)]
pub registration_token_required: bool,
/// Whether users can change their email.
pub email_change_allowed: bool,
@@ -52,6 +57,7 @@ pub struct SiteConfig {
pub minimum_password_complexity: u8,
}
#[allow(deprecated)]
pub fn doc(operation: TransformOperation) -> TransformOperation {
operation
.id("siteConfig")
@@ -64,6 +70,7 @@ pub fn doc(operation: TransformOperation) -> TransformOperation {
password_registration_enabled: true,
password_registration_email_required: true,
password_registration_token_required: true,
registration_token_required: true,
email_change_allowed: true,
displayname_change_allowed: true,
password_change_allowed: true,
@@ -76,6 +83,7 @@ pub fn doc(operation: TransformOperation) -> TransformOperation {
}
#[tracing::instrument(name = "handler.admin.v1.site_config", skip_all)]
#[allow(deprecated)]
pub async fn handler(
_: CallContext,
State(site_config): State<mas_data_model::SiteConfig>,
@@ -86,6 +94,7 @@ pub async fn handler(
password_registration_enabled: site_config.password_registration_enabled,
password_registration_email_required: site_config.password_registration_email_required,
password_registration_token_required: site_config.password_registration_token_required,
registration_token_required: site_config.password_registration_token_required,
email_change_allowed: site_config.email_change_allowed,
displayname_change_allowed: site_config.displayname_change_allowed,
password_change_allowed: site_config.password_change_allowed,
crates/handlers/src/views/register/steps/finish.rs
+3 -13
View File
@@ -120,17 +120,7 @@ pub(crate) async fn get(
)));
}
let token_required = if registration
.upstream_oauth_authorization_session_id
.is_some()
{
// load provider to let OAuth registrations check its
// per provider `registration_token_required` flag
let session_id = registration
.upstream_oauth_authorization_session_id
.context("Missing upstream OAuth session ID")
.map_err(InternalError::from_anyhow)?;
let token_required = if let Some(session_id) = registration.upstream_oauth_authorization_session_id {
let session = repo
.upstream_oauth_session()
.lookup(session_id)
@@ -145,9 +135,9 @@ pub(crate) async fn get(
.context("Could not load the upstream OAuth provider")
.map_err(InternalError::from_anyhow)?;
provider.registration_token_required
provider.registration_token_required || site_config.registration_token_required
} else {
site_config.password_registration_token_required
site_config.password_registration_token_required || site_config.registration_token_required
};
let registration_token = if token_required {
crates/storage-pg/migrations/20260403144138_upstream_oauth2_providers_registration_token_required.sql
+5
View File
@@ -1,3 +1,8 @@
-- Copyright 2026 Element Creations Ltd.
--
-- SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
-- Please see LICENSE files in the repository root for full details.
-- Adds a `registration_token_required` column to the UpstreamOauthProvider table
ALTER TABLE upstream_oauth_providers