Quentin Gliech
d748f18be6
Replace most remaining #[instrument(err)] annotations
2025-04-18 09:59:29 +02:00
Quentin Gliech
5a97ec5cca
Merge branch 'main' into quenting/dynamic-policy-data
2025-03-03 14:25:05 +01:00
Quentin Gliech
70b561291e
Show proper error messages when registering with a banned/not-allowed username
2025-03-03 10:45:30 +01:00
Quentin Gliech
756922342a
policy: allow dynamically setting policy data
2025-02-25 16:21:54 +01:00
Quentin Gliech
3d2b67a0b2
Upgrade to Rust 1.85 and edition 2024
2025-02-21 16:15:02 +01:00
Quentin Gliech
0027980cf4
Add translatable errors for the email policy constraints
2025-02-17 15:53:57 +01:00
Quentin Gliech
0eb6638e41
Expose the user agent string to the policy execution context
2025-02-17 11:51:26 +01:00
Quentin Gliech
aa6436aa1a
Allow banning registrations by IP address
2025-02-17 10:18:11 +01:00
Quentin Gliech
67468ca0bc
Remove the unused password input schema
2025-02-17 10:17:30 +01:00
Quentin Gliech
d6b3e6ccaa
Pass an input object to the policy evaluation instead of multiple arguments
2025-02-14 17:15:26 +01:00
Quentin Gliech
d16049524b
Propagate more specific error messages from the policy on registration
...
This makes some policy errors translatable
2025-01-06 10:15:08 +01:00
Quentin Gliech
2820794c8d
Allow longer & shorter usernames, complying with the MXID length spec
2025-01-06 10:15:08 +01:00
Quentin Gliech
87f34522c8
Output the registered client metadata in the registration endpoint
...
Fixes #2848
2024-09-20 20:39:04 +02:00
Quentin Gliech
ed4b6c42a7
Remove (C)
2024-09-10 14:28:55 +02:00
Quentin Gliech
f6bb100c0a
License headers change
2024-09-05 13:25:42 +02:00
reivilibre and Quentin Gliech
1afd2a2906
Remove OPA-based password policy enforcement ( #2875 )
...
Co-authored-by: Quentin Gliech <quenting@element.io >
2024-07-16 14:33:04 +01:00
Quentin Gliech
4bc425b415
Use re-exported wasmtime to avoid dependencies conflicts
2024-07-01 10:20:33 +02:00
Quentin Gliech
9e2530861f
Disable wasmtime cache, enable parallel compilation, add deny exception
2024-05-02 10:35:59 +02:00
Quentin Gliech
1c62543220
Make the device code grants go through the policy engine
2024-02-02 18:01:51 +01:00
Quentin Gliech
a0f5f3c642
Enable clippy lints on a workspace level
...
This enables a lot more lints than before in some crates, so this fixed a lot of warnings as well.
2023-12-05 17:20:42 +01:00
Quentin Gliech
542d0a6073
Implement the client credentials grant
2023-09-06 09:35:34 +02:00
Quentin Gliech
8658a3400d
policy: prepare for the client credentials grant
2023-09-06 09:35:34 +02:00
Quentin Gliech
23571e87ea
Run the registration policy on upstream OAuth registration
2023-08-30 19:39:39 +02:00
Quentin Gliech
7fcd022eea
Make sure we validate passwords & emails by the policy at all stages
...
Also refactors the way we get the policy engines in requests
2023-08-30 19:39:39 +02:00
Quentin Gliech
23151ef092
policies: split the email & password policies and add jsonschema validation of the input
2023-08-30 19:39:39 +02:00
Quentin Gliech
39c126318f
Fix the authorization grant template
...
It previously relied on the client being in the authorization grant,
which is not the case anymore. This commit also adds a test to ensure
we're not breaking this template in the future.
2023-01-31 16:50:48 +01:00
Quentin Gliech
a7883618be
Better tracing spans
2023-01-04 16:30:38 +01:00
Quentin Gliech
13b1ac7c83
policy: define custom errors and ditch anyhow
2022-12-08 15:29:15 +01:00
Quentin Gliech
12ce2a3d04
data-model: simplify the authorization grants and sessions
2022-12-08 15:29:15 +01:00
Quentin Gliech
feebbd0e97
data-model: simplify users and sessions
2022-12-08 15:29:15 +01:00
Quentin Gliech
834214bcac
Do not embed the WASM-compiled policies in the binary
2022-11-18 22:37:55 +01:00
Quentin Gliech
a414936484
Trace AWS operations & share TLS connector with mas-http
2022-11-03 18:08:20 +01:00
Quentin Gliech
041eb7013c
Disable wasmtime cache in Docker builds
2022-11-03 15:19:49 +01:00
Kévin Commaille
e202c3dd6d
Allow to validate client metadata
...
According to OpenID Connect Dynamic Client Registration Spec 1.0.
Introduce VerifiedClientMetadata.
2022-08-19 13:58:43 +02:00
Quentin Gliech
fbe12a67f2
Add the evaluation context policy generic parameter
2022-08-19 12:37:10 +02:00
Quentin Gliech
c1ed726dc8
Enable the clippy::str_to_string lint
2022-08-08 10:06:20 +02:00
Quentin Gliech
2e2c3d54a6
Test HTTP handlers
2022-08-05 09:48:02 +02:00
Quentin Gliech and Hugh Nimmo-Smith
ba6a382f2c
Authorization grant policy ( #288 )
...
Co-authored-by: Hugh Nimmo-Smith <hughns@matrix.org >
2022-07-21 16:18:59 +00:00
Quentin Gliech
581e011c7b
Fix policy test
2022-06-04 12:47:36 +02:00
Quentin Gliech
5a4a4ed21e
Fix policies test
2022-06-03 17:03:25 +02:00
Quentin Gliech
e694932daf
Handle password strength verification through OPA
2022-06-03 16:14:26 +02:00
Quentin Gliech
eb22c33a7d
Remove the login policy (since it is not implemented yet)
2022-06-03 13:37:20 +02:00
Quentin Gliech
7c8893e596
Switch the policies to a violation list based approach
...
This allows policies to give proper feedback on form fields
2022-06-03 13:37:20 +02:00
Quentin Gliech
071055ad18
Embed the default policy in the binary
2022-06-03 13:37:20 +02:00
Quentin Gliech
9ebff410d1
Generate spans for policy evaluations
2022-06-03 13:37:20 +02:00
Quentin Gliech
aab1f49374
Support for applying OPA policies during client registration
2022-06-03 13:37:20 +02:00
Quentin Gliech