synapse.api.auth module

class synapse.api.auth.Auth(hs)

Bases: object

FIXME: This class contains a mix of functions for authenticating users of our client-server API and authenticating events added to room graphs.

can_federate(event, auth_events)
check_auth_blocking(user_id=None, threepid=None, user_type=None)

Checks if the user should be rejected for some external reason, such as monthly active user limiting or global disable flag

Parameters
  • user_id (str|None) – If present, checks for presence against existing MAU cohort

  • threepid (dict|None) – If present, checks for presence against configured reserved threepid. Used in cases where the user is trying register with a MAU blocked server, normally they would be rejected but their threepid is on the reserved list. user_id and threepid should never be set at the same time.

  • user_type (str|None) – If present, is used to decide whether to check against certain blocking reasons like MAU.

check_can_change_room_list(room_id, user)

Check if the user is allowed to edit the room’s entry in the published room list.

Parameters
  • room_id (str) –

  • user (UserID) –

check_from_context(room_version, event, context, do_sig_check=True)
check_host_in_room(room_id, host)
check_in_room_or_world_readable(room_id, user_id)

Checks that the user is or was in the room or the room is world readable. If it isn’t then an exception is raised.

Returns

Resolves to the current membership of

the user in the room and the membership event ID of the user. If the user is not in the room and never has been, then (Membership.JOIN, None) is returned.

Return type

Deferred[tuple[str, str|None]]

check_joined_room(room_id, user_id, current_state=None)

Check if the user is currently joined in the room :param room_id: The room to check. :type room_id: str :param user_id: The user to check. :type user_id: str :param current_state: Optional map of the current state of the room.

If provided then that map is used to check whether they are a member of the room. Otherwise the current membership is loaded from the database.

Raises

AuthError if the user is not in the room.

Returns

A deferred membership event for the user if the user is in the room.

check_user_was_in_room(room_id, user_id)

Check if the user was in the room at some point. :param room_id: The room to check. :type room_id: str :param user_id: The user to check. :type user_id: str

Raises

AuthError if the user was never in the room.

Returns

A deferred membership event for the user if the user was in the room. This will be the join event if they are currently joined to the room. This will be the leave event if they have left the room.

compute_auth_events(event, current_state_ids: Dict[Tuple[str, str], str], for_verification: bool = False)

Given an event and current state return the list of event IDs used to auth an event.

If for_verification is False then only return auth events that should be added to the event’s auth_events.

Returns

List of event IDs.

Return type

defer.Deferred(list[str])

static get_access_token_from_request(request)

Extracts the access_token from the request.

Parameters

request – The http request.

Returns

The access_token

Return type

unicode

Raises

MissingClientTokenError – If there isn’t a single access_token in the request

get_appservice_by_req(request)
get_public_keys(invite_event)
get_user_by_access_token(token, rights='access')

Validate access token and get user_id from it

Parameters
  • token (str) – The access token to get the user by.

  • rights (str) – The operation being performed; the access token must allow this.

Returns

dict that includes:

user (UserID) is_guest (bool) token_id (int|None): access token id. May be None if guest device_id (str|None): device corresponding to access token

Return type

Deferred[dict]

Raises

InvalidClientCredentialsError if no user by that token exists or the token – is invalid.

get_user_by_req(request, allow_guest=False, rights='access', allow_expired=False)

Get a registered user’s ID.

Parameters
  • - An HTTP request with an access_token query parameter. (request) –

  • - Whether to allow the request through even if the account is (allow_expired) – expired. If true, Synapse will still require an access token to be provided but won’t check if the account it belongs to has expired. This works thanks to /login delivering access tokens regardless of accounts’ expiration.

Returns

resolves to a synapse.types.Requester object

Return type

defer.Deferred

Raises
  • InvalidClientCredentialsError if no user by that token exists or the token – is invalid.

  • AuthError if access is denied for the user in the access token

get_user_id_from_macaroon(macaroon)

Retrieve the user_id given by the caveats on the macaroon.

Does not validate the macaroon.

Parameters

macaroon (pymacaroons.Macaroon) – The macaroon to validate

Returns

(str) user id

Raises

InvalidClientCredentialsError if there is no user_id caveat in the – macaroon

static has_access_token(request)

Checks if the request has an access_token.

Returns

False if no access_token was given, True otherwise.

Return type

bool

is_server_admin(user)

Check if the given user is a local server admin.

Parameters

user (UserID) – user to check

Returns

True if the user is an admin

Return type

bool

validate_macaroon(macaroon, type_string, user_id)

validate that a Macaroon is understood by and was signed by this server.

Parameters
  • macaroon (pymacaroons.Macaroon) – The macaroon to validate

  • type_string (str) – The kind of token required (e.g. “access”, “delete_pusher”)

  • user_id (str) – The user_id required