Violations from the `authorization_grant` policy for `urn:synapse:admin:*` and `urn:mas:admin` now carry the `admin-scope-not-allowed` code, and `client-not-allowed` is reserved for policies which reject the client itself (used by the Pro policies). The policy violation pages render a specific reason for each code under a shared headline, instead of the generic explanation.
Fixes#5995
Macros close over the context of the template that imports them, at import time. Importing the CAPTCHA component from a child template ran before `base.html` defined `_`, so the noscript translation inside the macro failed with an undefined-not-callable error. Import it from `base.html` like every other component.
A POST is what lets the username typed on the page travel with the
request. It also lets the whole registration form become a single
component later on.
The registration page is about to start these flows from a form POST, so
minting the session, the cookie and the authorization URL has to be
callable from outside the `/upstream/authorize/:id` handler.
The helper parses the mount node's dataset, waits for the i18n setup
before the first render, and swaps the page to a server-rendered error
notice when booting fails. This fixes the account app staying on its
loading screen forever when fetching the locale data fails, and gives
upcoming server-rendered pages with React islands a common entry point.
Waiting on the setup requires `setupI18n` to return the initialisation
promise, so it now does.
The strength meter, the improvement hints and the too-weak error move to
a `PasswordComplexityFeedback` component backed by a
`usePasswordComplexity` hook, so that forms which lay out their password
fields differently can reuse them. `PasswordCreationDoubleInput` takes
the minimum complexity as a plain number instead of a `SiteConfig`
fragment; its two callers already query `siteConfig`, so they pass the
field directly.
Add a dedicated `device_code_link` rate limiter for verification of the user code from the device code grant. This applies _per source IP_ rather than globally.
This is to help mitigate the User Code Brute Forcing attack as described by [RFC 8628 section 5.1](https://datatracker.ietf.org/doc/html/rfc8628#section-5.1).
Use Crockford Base32 alphabet with O/0 and I/L/1 folding. Also help the browser to prompt for correct input.
The current alphabet gave 29.7 bits of entropy (it was random 0-9a-zA-Z which was then mapped to 0-9A-Z) whereas the new encoding is 30 bits.
Paul Chobert