dandri/matrix-authentication-service
1
0
Fork 0
mirror of https://github.com/element-hq/matrix-authentication-service.git synced 2026-09-26 00:14:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update policies

Browse Source
This commit is contained in:
Eric Eastwood
2026-05-08 13:45:37 -05:00
parent ce3cfe73d9
commit 984f836fde
2 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
policies/authorization_grant/authorization_grant.rego
+17
View File
@@ -167,9 +167,26 @@ violation contains {
# Only apply if it's a user logging in (who therefore has countable sessions)
input.session_counts != null
# Only apply limits to accounts under the threshold (if configured)
passes_session_threshold
# For OAuth 2 login, a violation occurs when the soft limit has already been
# reached or exceeded.
# We use the soft limit because the user will be able to interactively remove
# sessions to return under the limit.
data.session_limit.soft_limit <= input.session_counts.total
}
# The session limits only apply to accounts within the `max_session_threshold`.
#
# True if the `max_session_threshold` isn't configured or <= `max_session_threshold`.
passes_session_threshold if {
# If no `session_limit` configured, automatically passes
not data.session_limit
} else if {
# If no `max_session_threshold` configured, automatically passes
not data.session_limit.max_session_threshold
} else if {
# Otherwise, check whether the total number of sessions is under the threshold
input.session_counts.total <= data.session_limit.max_session_threshold
}
policies/compat_login/compat_login.rego
+20
View File
@@ -42,6 +42,9 @@ violation contains {
# (As then this login is not actually increasing the number of devices)
not input.session_replaced
# Only apply limits to accounts under the threshold (if configured)
passes_session_threshold
# For web-based 'compat SSO' login, a violation occurs when the soft limit has already been
# reached or exceeded.
# We use the soft limit because the user will be able to interactively remove
@@ -66,6 +69,9 @@ violation contains {
# (As then this login is not actually increasing the number of devices)
not input.session_replaced
# Only apply limits to accounts under the threshold (if configured)
passes_session_threshold
# For `m.login.password` login, a violation occurs when the hard limit has already been
# reached or exceeded.
# We don't use the soft limit because the user won't be able to interactively remove
@@ -78,3 +84,17 @@ is_interactive if {
# `m.login.password` and `m.login.token` (including the finalisation of an SSO login) are not
input.login.type == "m.login.sso"
}
# The session limits only apply to accounts within the `max_session_threshold`.
#
# True if the `max_session_threshold` isn't configured or <= `max_session_threshold`.
passes_session_threshold if {
# If no `session_limit` configured, automatically passes
not data.session_limit
} else if {
# If no `max_session_threshold` configured, automatically passes
not data.session_limit.max_session_threshold
} else if {
# Otherwise, check whether the total number of sessions is under the threshold
input.session_counts.total <= data.session_limit.max_session_threshold
}