618 lines
21 KiB
Python
618 lines
21 KiB
Python
# -*- coding: utf-8 -*-
|
|
# Copyright 2018 New Vector Ltd
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
import hashlib
|
|
import hmac
|
|
import json
|
|
|
|
from mock import Mock
|
|
|
|
import synapse.rest.admin
|
|
from synapse.api.constants import UserTypes
|
|
from synapse.rest.client.v1 import events, login, room
|
|
from synapse.rest.client.v2_alpha import groups
|
|
|
|
from tests import unittest
|
|
|
|
|
|
class VersionTestCase(unittest.HomeserverTestCase):
|
|
|
|
servlets = [
|
|
synapse.rest.admin.register_servlets_for_client_rest_resource,
|
|
login.register_servlets,
|
|
]
|
|
|
|
url = '/_matrix/client/r0/admin/server_version'
|
|
|
|
def test_version_string(self):
|
|
self.register_user("admin", "pass", admin=True)
|
|
self.admin_token = self.login("admin", "pass")
|
|
|
|
request, channel = self.make_request("GET", self.url,
|
|
access_token=self.admin_token)
|
|
self.render(request)
|
|
|
|
self.assertEqual(200, int(channel.result["code"]),
|
|
msg=channel.result["body"])
|
|
self.assertEqual({'server_version', 'python_version'},
|
|
set(channel.json_body.keys()))
|
|
|
|
def test_inaccessible_to_non_admins(self):
|
|
self.register_user("unprivileged-user", "pass", admin=False)
|
|
user_token = self.login("unprivileged-user", "pass")
|
|
|
|
request, channel = self.make_request("GET", self.url,
|
|
access_token=user_token)
|
|
self.render(request)
|
|
|
|
self.assertEqual(403, int(channel.result['code']),
|
|
msg=channel.result['body'])
|
|
|
|
|
|
class UserRegisterTestCase(unittest.HomeserverTestCase):
|
|
|
|
servlets = [synapse.rest.admin.register_servlets_for_client_rest_resource]
|
|
|
|
def make_homeserver(self, reactor, clock):
|
|
|
|
self.url = "/_matrix/client/r0/admin/register"
|
|
|
|
self.registration_handler = Mock()
|
|
self.identity_handler = Mock()
|
|
self.login_handler = Mock()
|
|
self.device_handler = Mock()
|
|
self.device_handler.check_device_registered = Mock(return_value="FAKE")
|
|
|
|
self.datastore = Mock(return_value=Mock())
|
|
self.datastore.get_current_state_deltas = Mock(return_value=[])
|
|
|
|
self.secrets = Mock()
|
|
|
|
self.hs = self.setup_test_homeserver()
|
|
|
|
self.hs.config.registration_shared_secret = u"shared"
|
|
|
|
self.hs.get_media_repository = Mock()
|
|
self.hs.get_deactivate_account_handler = Mock()
|
|
|
|
return self.hs
|
|
|
|
def test_disabled(self):
|
|
"""
|
|
If there is no shared secret, registration through this method will be
|
|
prevented.
|
|
"""
|
|
self.hs.config.registration_shared_secret = None
|
|
|
|
request, channel = self.make_request("POST", self.url, b'{}')
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual(
|
|
'Shared secret registration is not enabled', channel.json_body["error"]
|
|
)
|
|
|
|
def test_get_nonce(self):
|
|
"""
|
|
Calling GET on the endpoint will return a randomised nonce, using the
|
|
homeserver's secrets provider.
|
|
"""
|
|
secrets = Mock()
|
|
secrets.token_hex = Mock(return_value="abcd")
|
|
|
|
self.hs.get_secrets = Mock(return_value=secrets)
|
|
|
|
request, channel = self.make_request("GET", self.url)
|
|
self.render(request)
|
|
|
|
self.assertEqual(channel.json_body, {"nonce": "abcd"})
|
|
|
|
def test_expired_nonce(self):
|
|
"""
|
|
Calling GET on the endpoint will return a randomised nonce, which will
|
|
only last for SALT_TIMEOUT (60s).
|
|
"""
|
|
request, channel = self.make_request("GET", self.url)
|
|
self.render(request)
|
|
nonce = channel.json_body["nonce"]
|
|
|
|
# 59 seconds
|
|
self.reactor.advance(59)
|
|
|
|
body = json.dumps({"nonce": nonce})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('username must be specified', channel.json_body["error"])
|
|
|
|
# 61 seconds
|
|
self.reactor.advance(2)
|
|
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('unrecognised nonce', channel.json_body["error"])
|
|
|
|
def test_register_incorrect_nonce(self):
|
|
"""
|
|
Only the provided nonce can be used, as it's checked in the MAC.
|
|
"""
|
|
request, channel = self.make_request("GET", self.url)
|
|
self.render(request)
|
|
nonce = channel.json_body["nonce"]
|
|
|
|
want_mac = hmac.new(key=b"shared", digestmod=hashlib.sha1)
|
|
want_mac.update(b"notthenonce\x00bob\x00abc123\x00admin")
|
|
want_mac = want_mac.hexdigest()
|
|
|
|
body = json.dumps(
|
|
{
|
|
"nonce": nonce,
|
|
"username": "bob",
|
|
"password": "abc123",
|
|
"admin": True,
|
|
"mac": want_mac,
|
|
}
|
|
)
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(403, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual("HMAC incorrect", channel.json_body["error"])
|
|
|
|
def test_register_correct_nonce(self):
|
|
"""
|
|
When the correct nonce is provided, and the right key is provided, the
|
|
user is registered.
|
|
"""
|
|
request, channel = self.make_request("GET", self.url)
|
|
self.render(request)
|
|
nonce = channel.json_body["nonce"]
|
|
|
|
want_mac = hmac.new(key=b"shared", digestmod=hashlib.sha1)
|
|
want_mac.update(
|
|
nonce.encode('ascii') + b"\x00bob\x00abc123\x00admin\x00support"
|
|
)
|
|
want_mac = want_mac.hexdigest()
|
|
|
|
body = json.dumps(
|
|
{
|
|
"nonce": nonce,
|
|
"username": "bob",
|
|
"password": "abc123",
|
|
"admin": True,
|
|
"user_type": UserTypes.SUPPORT,
|
|
"mac": want_mac,
|
|
}
|
|
)
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual("@bob:test", channel.json_body["user_id"])
|
|
|
|
def test_nonce_reuse(self):
|
|
"""
|
|
A valid unrecognised nonce.
|
|
"""
|
|
request, channel = self.make_request("GET", self.url)
|
|
self.render(request)
|
|
nonce = channel.json_body["nonce"]
|
|
|
|
want_mac = hmac.new(key=b"shared", digestmod=hashlib.sha1)
|
|
want_mac.update(
|
|
nonce.encode('ascii') + b"\x00bob\x00abc123\x00admin"
|
|
)
|
|
want_mac = want_mac.hexdigest()
|
|
|
|
body = json.dumps(
|
|
{
|
|
"nonce": nonce,
|
|
"username": "bob",
|
|
"password": "abc123",
|
|
"admin": True,
|
|
"mac": want_mac,
|
|
}
|
|
)
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual("@bob:test", channel.json_body["user_id"])
|
|
|
|
# Now, try and reuse it
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('unrecognised nonce', channel.json_body["error"])
|
|
|
|
def test_missing_parts(self):
|
|
"""
|
|
Synapse will complain if you don't give nonce, username, password, and
|
|
mac. Admin and user_types are optional. Additional checks are done for length
|
|
and type.
|
|
"""
|
|
|
|
def nonce():
|
|
request, channel = self.make_request("GET", self.url)
|
|
self.render(request)
|
|
return channel.json_body["nonce"]
|
|
|
|
#
|
|
# Nonce check
|
|
#
|
|
|
|
# Must be present
|
|
body = json.dumps({})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('nonce must be specified', channel.json_body["error"])
|
|
|
|
#
|
|
# Username checks
|
|
#
|
|
|
|
# Must be present
|
|
body = json.dumps({"nonce": nonce()})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('username must be specified', channel.json_body["error"])
|
|
|
|
# Must be a string
|
|
body = json.dumps({"nonce": nonce(), "username": 1234})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('Invalid username', channel.json_body["error"])
|
|
|
|
# Must not have null bytes
|
|
body = json.dumps({"nonce": nonce(), "username": u"abcd\u0000"})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('Invalid username', channel.json_body["error"])
|
|
|
|
# Must not have null bytes
|
|
body = json.dumps({"nonce": nonce(), "username": "a" * 1000})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('Invalid username', channel.json_body["error"])
|
|
|
|
#
|
|
# Password checks
|
|
#
|
|
|
|
# Must be present
|
|
body = json.dumps({"nonce": nonce(), "username": "a"})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('password must be specified', channel.json_body["error"])
|
|
|
|
# Must be a string
|
|
body = json.dumps({"nonce": nonce(), "username": "a", "password": 1234})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('Invalid password', channel.json_body["error"])
|
|
|
|
# Must not have null bytes
|
|
body = json.dumps(
|
|
{"nonce": nonce(), "username": "a", "password": u"abcd\u0000"}
|
|
)
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('Invalid password', channel.json_body["error"])
|
|
|
|
# Super long
|
|
body = json.dumps({"nonce": nonce(), "username": "a", "password": "A" * 1000})
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('Invalid password', channel.json_body["error"])
|
|
|
|
#
|
|
# user_type check
|
|
#
|
|
|
|
# Invalid user_type
|
|
body = json.dumps({
|
|
"nonce": nonce(),
|
|
"username": "a",
|
|
"password": "1234",
|
|
"user_type": "invalid"}
|
|
)
|
|
request, channel = self.make_request("POST", self.url, body.encode('utf8'))
|
|
self.render(request)
|
|
|
|
self.assertEqual(400, int(channel.result["code"]), msg=channel.result["body"])
|
|
self.assertEqual('Invalid user type', channel.json_body["error"])
|
|
|
|
|
|
class ShutdownRoomTestCase(unittest.HomeserverTestCase):
|
|
servlets = [
|
|
synapse.rest.admin.register_servlets_for_client_rest_resource,
|
|
login.register_servlets,
|
|
events.register_servlets,
|
|
room.register_servlets,
|
|
room.register_deprecated_servlets,
|
|
]
|
|
|
|
def prepare(self, reactor, clock, hs):
|
|
self.event_creation_handler = hs.get_event_creation_handler()
|
|
hs.config.user_consent_version = "1"
|
|
|
|
consent_uri_builder = Mock()
|
|
consent_uri_builder.build_user_consent_uri.return_value = (
|
|
"http://example.com"
|
|
)
|
|
self.event_creation_handler._consent_uri_builder = consent_uri_builder
|
|
|
|
self.store = hs.get_datastore()
|
|
|
|
self.admin_user = self.register_user("admin", "pass", admin=True)
|
|
self.admin_user_tok = self.login("admin", "pass")
|
|
|
|
self.other_user = self.register_user("user", "pass")
|
|
self.other_user_token = self.login("user", "pass")
|
|
|
|
# Mark the admin user as having consented
|
|
self.get_success(
|
|
self.store.user_set_consent_version(self.admin_user, "1"),
|
|
)
|
|
|
|
def test_shutdown_room_consent(self):
|
|
"""Test that we can shutdown rooms with local users who have not
|
|
yet accepted the privacy policy. This used to fail when we tried to
|
|
force part the user from the old room.
|
|
"""
|
|
self.event_creation_handler._block_events_without_consent_error = None
|
|
|
|
room_id = self.helper.create_room_as(self.other_user, tok=self.other_user_token)
|
|
|
|
# Assert one user in room
|
|
users_in_room = self.get_success(
|
|
self.store.get_users_in_room(room_id),
|
|
)
|
|
self.assertEqual([self.other_user], users_in_room)
|
|
|
|
# Enable require consent to send events
|
|
self.event_creation_handler._block_events_without_consent_error = "Error"
|
|
|
|
# Assert that the user is getting consent error
|
|
self.helper.send(
|
|
room_id,
|
|
body="foo", tok=self.other_user_token, expect_code=403,
|
|
)
|
|
|
|
# Test that the admin can still send shutdown
|
|
url = "admin/shutdown_room/" + room_id
|
|
request, channel = self.make_request(
|
|
"POST",
|
|
url.encode('ascii'),
|
|
json.dumps({"new_room_user_id": self.admin_user}),
|
|
access_token=self.admin_user_tok,
|
|
)
|
|
self.render(request)
|
|
|
|
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
|
|
|
# Assert there is now no longer anyone in the room
|
|
users_in_room = self.get_success(
|
|
self.store.get_users_in_room(room_id),
|
|
)
|
|
self.assertEqual([], users_in_room)
|
|
|
|
@unittest.DEBUG
|
|
def test_shutdown_room_block_peek(self):
|
|
"""Test that a world_readable room can no longer be peeked into after
|
|
it has been shut down.
|
|
"""
|
|
|
|
self.event_creation_handler._block_events_without_consent_error = None
|
|
|
|
room_id = self.helper.create_room_as(self.other_user, tok=self.other_user_token)
|
|
|
|
# Enable world readable
|
|
url = "rooms/%s/state/m.room.history_visibility" % (room_id,)
|
|
request, channel = self.make_request(
|
|
"PUT",
|
|
url.encode('ascii'),
|
|
json.dumps({"history_visibility": "world_readable"}),
|
|
access_token=self.other_user_token,
|
|
)
|
|
self.render(request)
|
|
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
|
|
|
# Test that the admin can still send shutdown
|
|
url = "admin/shutdown_room/" + room_id
|
|
request, channel = self.make_request(
|
|
"POST",
|
|
url.encode('ascii'),
|
|
json.dumps({"new_room_user_id": self.admin_user}),
|
|
access_token=self.admin_user_tok,
|
|
)
|
|
self.render(request)
|
|
|
|
self.assertEqual(200, int(channel.result["code"]), msg=channel.result["body"])
|
|
|
|
# Assert we can no longer peek into the room
|
|
self._assert_peek(room_id, expect_code=403)
|
|
|
|
def _assert_peek(self, room_id, expect_code):
|
|
"""Assert that the admin user can (or cannot) peek into the room.
|
|
"""
|
|
|
|
url = "rooms/%s/initialSync" % (room_id,)
|
|
request, channel = self.make_request(
|
|
"GET",
|
|
url.encode('ascii'),
|
|
access_token=self.admin_user_tok,
|
|
)
|
|
self.render(request)
|
|
self.assertEqual(
|
|
expect_code, int(channel.result["code"]), msg=channel.result["body"],
|
|
)
|
|
|
|
url = "events?timeout=0&room_id=" + room_id
|
|
request, channel = self.make_request(
|
|
"GET",
|
|
url.encode('ascii'),
|
|
access_token=self.admin_user_tok,
|
|
)
|
|
self.render(request)
|
|
self.assertEqual(
|
|
expect_code, int(channel.result["code"]), msg=channel.result["body"],
|
|
)
|
|
|
|
|
|
class DeleteGroupTestCase(unittest.HomeserverTestCase):
|
|
servlets = [
|
|
synapse.rest.admin.register_servlets_for_client_rest_resource,
|
|
login.register_servlets,
|
|
groups.register_servlets,
|
|
]
|
|
|
|
def prepare(self, reactor, clock, hs):
|
|
self.store = hs.get_datastore()
|
|
|
|
self.admin_user = self.register_user("admin", "pass", admin=True)
|
|
self.admin_user_tok = self.login("admin", "pass")
|
|
|
|
self.other_user = self.register_user("user", "pass")
|
|
self.other_user_token = self.login("user", "pass")
|
|
|
|
def test_delete_group(self):
|
|
# Create a new group
|
|
request, channel = self.make_request(
|
|
"POST",
|
|
"/create_group".encode('ascii'),
|
|
access_token=self.admin_user_tok,
|
|
content={
|
|
"localpart": "test",
|
|
}
|
|
)
|
|
|
|
self.render(request)
|
|
self.assertEqual(
|
|
200, int(channel.result["code"]), msg=channel.result["body"],
|
|
)
|
|
|
|
group_id = channel.json_body["group_id"]
|
|
|
|
self._check_group(group_id, expect_code=200)
|
|
|
|
# Invite/join another user
|
|
|
|
url = "/groups/%s/admin/users/invite/%s" % (group_id, self.other_user)
|
|
request, channel = self.make_request(
|
|
"PUT",
|
|
url.encode('ascii'),
|
|
access_token=self.admin_user_tok,
|
|
content={}
|
|
)
|
|
self.render(request)
|
|
self.assertEqual(
|
|
200, int(channel.result["code"]), msg=channel.result["body"],
|
|
)
|
|
|
|
url = "/groups/%s/self/accept_invite" % (group_id,)
|
|
request, channel = self.make_request(
|
|
"PUT",
|
|
url.encode('ascii'),
|
|
access_token=self.other_user_token,
|
|
content={}
|
|
)
|
|
self.render(request)
|
|
self.assertEqual(
|
|
200, int(channel.result["code"]), msg=channel.result["body"],
|
|
)
|
|
|
|
# Check other user knows they're in the group
|
|
self.assertIn(group_id, self._get_groups_user_is_in(self.admin_user_tok))
|
|
self.assertIn(group_id, self._get_groups_user_is_in(self.other_user_token))
|
|
|
|
# Now delete the group
|
|
url = "/admin/delete_group/" + group_id
|
|
request, channel = self.make_request(
|
|
"POST",
|
|
url.encode('ascii'),
|
|
access_token=self.admin_user_tok,
|
|
content={
|
|
"localpart": "test",
|
|
}
|
|
)
|
|
|
|
self.render(request)
|
|
self.assertEqual(
|
|
200, int(channel.result["code"]), msg=channel.result["body"],
|
|
)
|
|
|
|
# Check group returns 404
|
|
self._check_group(group_id, expect_code=404)
|
|
|
|
# Check users don't think they're in the group
|
|
self.assertNotIn(group_id, self._get_groups_user_is_in(self.admin_user_tok))
|
|
self.assertNotIn(group_id, self._get_groups_user_is_in(self.other_user_token))
|
|
|
|
def _check_group(self, group_id, expect_code):
|
|
"""Assert that trying to fetch the given group results in the given
|
|
HTTP status code
|
|
"""
|
|
|
|
url = "/groups/%s/profile" % (group_id,)
|
|
request, channel = self.make_request(
|
|
"GET",
|
|
url.encode('ascii'),
|
|
access_token=self.admin_user_tok,
|
|
)
|
|
|
|
self.render(request)
|
|
self.assertEqual(
|
|
expect_code, int(channel.result["code"]), msg=channel.result["body"],
|
|
)
|
|
|
|
def _get_groups_user_is_in(self, access_token):
|
|
"""Returns the list of groups the user is in (given their access token)
|
|
"""
|
|
request, channel = self.make_request(
|
|
"GET",
|
|
"/joined_groups".encode('ascii'),
|
|
access_token=access_token,
|
|
)
|
|
|
|
self.render(request)
|
|
self.assertEqual(
|
|
200, int(channel.result["code"]), msg=channel.result["body"],
|
|
)
|
|
|
|
return channel.json_body["groups"]
|