Revert "async/await check_password"

This reverts commit 8e4718ae

.gitignore

@@ -0,0 +1,204 @@
+# Created by .ignore support plugin (hsz.mobi)
+### JetBrains template
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and WebStorm
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
+
+# User-specific stuff
+.idea/**/workspace.xml
+.idea/**/tasks.xml
+.idea/**/usage.statistics.xml
+.idea/**/dictionaries
+.idea/**/shelf
+
+# Generated files
+.idea/**/contentModel.xml
+
+# Sensitive or high-churn files
+.idea/**/dataSources/
+.idea/**/dataSources.ids
+.idea/**/dataSources.local.xml
+.idea/**/sqlDataSources.xml
+.idea/**/dynamic.xml
+.idea/**/uiDesigner.xml
+.idea/**/dbnavigator.xml
+
+# Gradle
+.idea/**/gradle.xml
+.idea/**/libraries
+
+# Gradle and Maven with auto-import
+# When using Gradle or Maven with auto-import, you should exclude module files,
+# since they will be recreated, and may cause churn.  Uncomment if using
+# auto-import.
+# .idea/artifacts
+# .idea/compiler.xml
+# .idea/modules.xml
+# .idea/*.iml
+# .idea/modules
+*.iml
+# *.ipr
+
+# CMake
+cmake-build-*/
+
+# Mongo Explorer plugin
+.idea/**/mongoSettings.xml
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Cursive Clojure plugin
+.idea/replstate.xml
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# Editor-based Rest Client
+.idea/httpRequests
+
+# Android studio 3.1+ serialized cache file
+.idea/caches/build_file_checksums.ser
+
+### Python template
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+pip-wheel-metadata/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#  Usually these files are written by a python script from a template
+#  before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+.python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+#Pipfile.lock
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+

README.md

@@ -6,14 +6,14 @@
 - [Support](#support)
 
 ## Overview
-This synapse's password provider allows you to validate a password for a given username and return a user profile using
+This synapse's password provider allows you to validate a password for a given username and return a user profile using an existing backend, like:
-an existing backend, like:
+
 - Forums (phpBB, Discourse, etc.)
 - Custom Identity stores (Keycloak, ...)
 - CRMs (Wordpress, ...)
 - self-hosted clouds (Nextcloud, ownCloud, ...)
 
-It is mainly used with [mxisd](https://github.com/kamax-matrix/mxisd), the Federated Matrix Identity Server, to provide
+It is mainly used with [ma1sd](https://github.com/ma1uta/ma1sd), the Federated Matrix Identity Server, to provide
 missing features and offer a fully integrated solution (directory, authentication, search).
 
 **NOTE:** This module doesn't provide direct integration with any backend. If you do not use mxisd, you will need to write
@@ -21,22 +21,12 @@ your own backend, following the [Integration section](#integrate). This module s
 and profile information into actionables in synapse, and adapt your user profile with what is given.
 
 ## Install
-### From Synapse v0.34.0/py3
+Copy in whichever directory python can pick it up as a module.
-Copy in whichever directory python3.x can pick it up as a module.  
 
-If you installed synapse using the Matrix debian repos:
 ```
-sudo curl https://raw.githubusercontent.com/kamax-matrix/matrix-synapse-rest-auth/master/rest_auth_provider.py -o /opt/venvs/matrix-synapse/lib/python3.5/site-packages/rest_auth_provider.py
+sudo pip install git+https://github.com/ma1uta/matrix-synapse-rest-password-provider
 ```
-If the command fail, double check that the python version still matches. If not, please let us know by opening an issue.
 
-### Before Synapse v0.34.0/py3 or any py2-based release
-Copy in whichever directory python2.x can pick it up as a module.  
-
-If you installed synapse using the Matrix debian repos:
-```
-sudo curl https://raw.githubusercontent.com/kamax-matrix/matrix-synapse-rest-auth/master/rest_auth_provider.py -o /usr/lib/python2.7/dist-packages/rest_auth_provider.py
-```
 If the command fail, double check that the python version still matches. If not, please let us know by opening an issue.
 
 ## Configure
@@ -87,14 +77,16 @@ If you would like to change the behaviour, you can use the following configurati
 ```
 
 3PIDs received from the backend are merged with the ones already linked to the account.
-If you would like to change this behaviour, you can use the following configuration item:
+If you would like to change this behaviour, you can use the following configuration items:
 ```yaml
     config:
       policy:
         all:
           threepid:
             update: false
+            replace: false
 ```
+If update is set to `false`, the 3PIDs will not be changed at all. If replace is set to `true`, all 3PIDs not available in the backend anymore will be deleted from synapse.
 
 ## Integrate
 To use this module with your back-end, you will need to implement a single REST endpoint:
@@ -145,6 +137,3 @@ If the credentials are refused, the following JSON answer will be provided:
   }
 }
 ```
-
-## Support
-For community support, visit our Matrix room [#matrix-synapse-rest-auth:kamax.io](https://matrix.to/#/#matrix-synapse-rest-auth:kamax.io)

rest_auth_provider.py

@@ -1,9 +1,9 @@
 # -*- coding: utf-8 -*-
 #
 # REST endpoint Authentication module for Matrix synapse
-# Copyright (C) 2017 Maxime Dor
+# Copyright (C) 2017 Kamax Sarl
 #
-# https://max.kamax.io/
+# https://www.kamax.io/
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
@@ -23,9 +23,11 @@ import logging
 from twisted.internet import defer
 import requests
 import json
+import time
 
 logger = logging.getLogger(__name__)
 
+
 class RestAuthProvider(object):
 
     def __init__(self, config, account_handler):
@@ -79,7 +81,12 @@ class RestAuthProvider(object):
             logger.info("Handling profile data")
             profile = auth["profile"]
 
-            store = yield self.account_handler.hs.get_profile_handler().store
+            # fixme: temporary fix
+            try:
+                store = yield self.account_handler._hs.get_profile_handler().store  # for synapse >= 1.9.0
+            except AttributeError:
+                store = yield self.account_handler.hs.get_profile_handler().store   # for synapse < 1.9.0
+
             if "display_name" in profile and ((registration and self.config.setNameOnRegister) or (self.config.setNameOnLogin)):
                 display_name = profile["display_name"]
                 logger.info("Setting display name to '%s' based on profile data", display_name)
@@ -90,12 +97,15 @@ class RestAuthProvider(object):
             if (self.config.updateThreepid):
                 if "three_pids" in profile:
                     logger.info("Handling 3PIDs")
+
+                    external_3pids = []
                     for threepid in profile["three_pids"]:
                         medium = threepid["medium"].lower()
                         address = threepid["address"].lower()
+                        external_3pids.append({"medium": medium, "address": address})
                         logger.info("Looking for 3PID %s:%s in user profile", medium, address)
 
-                        validated_at = self.account_handler.hs.get_clock().time_msec()
+                        validated_at = time_msec()
                         if not (yield store.get_user_id_by_threepid(medium, address)):
                             logger.info("3PID is not present, adding")
                             yield store.user_add_threepid(
@@ -107,6 +117,19 @@ class RestAuthProvider(object):
                             )
                         else:
                             logger.info("3PID is present, skipping")
+
+                    if (self.config.replaceThreepid):
+                        for threepid in (yield store.user_get_threepids(user_id)):
+                            medium = threepid["medium"].lower()
+                            address = threepid["address"].lower()
+                            if {"medium": medium, "address": address} not in external_3pids:
+                                logger.info("3PID is not present in external datastore, deleting")
+                                yield store.user_delete_threepid(
+                                    user_id,
+                                    medium,
+                                    address
+                                )
+
             else:
                 logger.info("3PIDs were not updated due to policy")
         else:
@@ -125,6 +148,7 @@ class RestAuthProvider(object):
             setNameOnRegister = True
             setNameOnLogin = False
             updateThreepid = True
+            replaceThreepid = False
 
         rest_config = _RestConfig()
         rest_config.endpoint = config["endpoint"]
@@ -165,8 +189,18 @@ class RestAuthProvider(object):
             # we don't care
             pass
 
+        try:
+            rest_config.replaceThreepid = config['policy']['all']['threepid']['replace']
+        except TypeError:
+            # we don't care
+            pass
+        except KeyError:
+            # we don't care
+            pass
+
         return rest_config
 
+
 def _require_keys(config, required):
     missing = [key for key in required if key not in config]
     if missing:
@@ -176,3 +210,8 @@ def _require_keys(config, required):
             )
         )
 
+
+def time_msec():
+    """Get the current timestamp in milliseconds
+    """
+    return int(time.time() * 1000)

setup.py

@@ -0,0 +1,12 @@
+from setuptools import setup
+
+setup(
+    name="rest_auth_provider",
+    version="0.0.1",
+    py_modules=['rest_auth_provider'],
+    description="Password Provider for Synapse fetching data from a REST endpoint",
+    include_package_data=True,
+    zip_safe=True,
+    install_requires=[],
+)
+