Upgrade/mas v1.2.0

.github/workflows/build.yaml

@@ -3,13 +3,19 @@
 # SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
 # Please see LICENSE files in the repository root for full details.
 
+
+#:tchap:
+# the only job used by tchap are `compute-version` and `build-image`
+#:tchap:
+
 name: Build
 
 on:
   push:
     branches:
-      - main
+      - main_tchap
       - "release/**"
+      - "test/**"
     tags:
       - "v*"
 
@@ -27,8 +33,8 @@ env:
   CARGO_NET_GIT_FETCH_WITH_CLI: "true"
   SCCACHE_GHA_ENABLED: "true"
   RUSTC_WRAPPER: "sccache"
-  IMAGE: ghcr.io/element-hq/matrix-authentication-service
-  BUILDCACHE: ghcr.io/element-hq/matrix-authentication-service/buildcache
+  IMAGE: ghcr.io/tchapgouv/matrix-authentication-service
+  BUILDCACHE: ghcr.io/tchapgouv/matrix-authentication-service/buildcache
   DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
 
 jobs:
@@ -300,7 +306,7 @@ jobs:
         # Only sign on tags and on commits on main branch
         if: |
           github.event_name != 'pull_request'
-          && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
+          && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main_tchap')
 
         env:
           REGULAR_DIGEST: ${{ steps.output.outputs.metadata && fromJSON(steps.output.outputs.metadata).regular.digest }}
@@ -364,7 +370,7 @@ jobs:
 
   unstable:
     name: Update the unstable release
-    if: github.ref == 'refs/heads/main'
+    if: github.ref == 'refs/heads/main_tchap'
     runs-on: ubuntu-24.04
 
     needs:

Cargo.toml

@@ -63,6 +63,7 @@ mas-templates = { path = "./crates/templates/", version = "=1.2.0" }
 mas-tower = { path = "./crates/tower/", version = "=1.2.0" }
 oauth2-types = { path = "./crates/oauth2-types/", version = "=1.2.0" }
 syn2mas = { path = "./crates/syn2mas", version = "=1.2.0" }
+tchap = { path = "./crates/tchap", version = "=0.1.0" }
 
 # OpenAPI schema generation and validation
 [workspace.dependencies.aide]

Dockerfile

@@ -9,6 +9,10 @@
 # implicit BUILDARG: BUILDPLATFORM being the host platform and TARGETPLATFORM
 # being the platform being built.
 
+#:tchap:
+# tchap files are added to this image (templates, translations, css)
+#:tchap:
+
 # The Debian version and version name must be in sync
 ARG DEBIAN_VERSION=12
 ARG DEBIAN_VERSION_NAME=bookworm
@@ -32,7 +36,9 @@ RUN --network=default \
 COPY ./frontend/ /app/frontend/
 COPY ./templates/ /app/templates/
 RUN --network=none \
-  npm run build
+  #:tchap:
+  npm run build-tchap
+  #:tchap:
 
 # Move the built files
 RUN --network=none \
@@ -141,6 +147,12 @@ COPY --from=policy /app/policies/policy.wasm /share/policy.wasm
 COPY ./templates/ /share/templates
 COPY ./translations/ /share/translations
 
+#:tchap:
+COPY ./tchap/resources/templates/ /share/templates/
+COPY ./tchap/resources/translations/ /share/translations/
+#:tchap:
+
+
 ##################################
 ## Runtime stage, debug variant ##
 ##################################

crates/cli/src/app_state.rs

@@ -9,7 +9,14 @@ use std::{convert::Infallible, net::IpAddr, sync::Arc};
 use axum::extract::{FromRef, FromRequestParts};
 use ipnetwork::IpNetwork;
 use mas_context::LogContext;
-use mas_data_model::{BoxClock, BoxRng, SiteConfig, SystemClock};
+use mas_data_model::{
+    BoxClock,
+    BoxRng,
+    SiteConfig,
+    SystemClock,
+    //:tchap:
+    TchapConfig, //:tchap:end
+};
 use mas_handlers::{
     ActivityTracker, BoundActivityTracker, CookieManager, ErrorWrapper, GraphQLSchema, Limiter,
     MetadataCache, RequesterFingerprint, passwords::PasswordManager,
@@ -47,6 +54,9 @@ pub struct AppState {
     pub activity_tracker: ActivityTracker,
     pub trusted_proxies: Vec<IpNetwork>,
     pub limiter: Limiter,
+    //:tchap:
+    pub tchap_config: TchapConfig,
+    //:tchap: end
 }
 
 impl AppState {
@@ -214,6 +224,14 @@ impl FromRef<AppState> for Arc<dyn HomeserverConnection> {
     }
 }
 
+//:tchap:
+impl FromRef<AppState> for TchapConfig {
+    fn from_ref(input: &AppState) -> Self {
+        input.tchap_config.clone()
+    }
+}
+//:tchap:end
+
 impl FromRequestParts<AppState> for BoxClock {
     type Rejection = Infallible;
 

crates/cli/src/commands/server.rs

@@ -11,10 +11,24 @@ use clap::Parser;
 use figment::Figment;
 use itertools::Itertools;
 use mas_config::{
-    AppConfig, ClientsConfig, ConfigurationSection, ConfigurationSectionExt, UpstreamOAuth2Config,
+    AppConfig,
+    ClientsConfig,
+    ConfigurationSection,
+    ConfigurationSectionExt,
+    //:tchap:
+    TchapAppConfig,
+    // :tchap: end
+    UpstreamOAuth2Config,
 };
 use mas_context::LogContext;
-use mas_data_model::SystemClock;
+use mas_data_model::{
+    //:tchap:
+    EmailLookupFallbackRule,
+    //:tchap:end
+    SystemClock,
+    //:tchap:
+    TchapConfig, // :tchap: end
+};
 use mas_handlers::{ActivityTracker, CookieManager, Limiter, MetadataCache};
 use mas_listener::server::Server;
 use mas_router::UrlBuilder;
@@ -59,6 +73,10 @@ impl Options {
         let span = info_span!("cli.run.init").entered();
         let mut shutdown = LifecycleManager::new()?;
         let config = AppConfig::extract(figment).map_err(anyhow::Error::from_boxed)?;
+        //:tchap:
+        let tchap_app_config =
+            TchapAppConfig::extract(figment).map_err(anyhow::Error::from_boxed)?;
+        //:tchap: end
 
         info!(version = crate::VERSION, "Starting up");
 
@@ -159,6 +177,10 @@ impl Options {
             &config.captcha,
         )?;
 
+        //:tchap:
+        let tchap_config = tchap_config_from_tchap_app_config(&tchap_app_config);
+        //:tchap: end
+
         // Load and compile the templates
         let templates =
             templates_from_config(&config.templates, &site_config, &url_builder).await?;
@@ -246,6 +268,9 @@ impl Options {
                 activity_tracker,
                 trusted_proxies,
                 limiter,
+                //:tchap:
+                tchap_config,
+                //:tchap:end
             };
             s.init_metrics();
             s.init_metadata_cache();
@@ -334,3 +359,19 @@ impl Options {
         Ok(exit_code)
     }
 }
+
+//:tchap:
+fn tchap_config_from_tchap_app_config(tchap_app_config: &TchapAppConfig) -> TchapConfig {
+    TchapConfig {
+        identity_server_url: tchap_app_config.identity_server_url.clone(),
+        email_lookup_fallback_rules: tchap_app_config
+            .email_lookup_fallback_rules
+            .iter()
+            .map(|rule| EmailLookupFallbackRule {
+                match_with: rule.match_with.clone(),
+                search: rule.search.clone(),
+            })
+            .collect(),
+    }
+}
+//:tchap: end

crates/config/src/sections/mod.rs

@@ -21,6 +21,9 @@ mod passwords;
 mod policy;
 mod rate_limiting;
 mod secrets;
+//:tchap:
+mod tchap;
+//:tchap:end
 mod telemetry;
 mod templates;
 mod upstream_oauth2;
@@ -44,6 +47,9 @@ pub use self::{
     policy::PolicyConfig,
     rate_limiting::RateLimitingConfig,
     secrets::SecretsConfig,
+    //:tchap:
+    tchap::TchapAppConfig,
+    //:tchap:end
     telemetry::{
         MetricsConfig, MetricsExporterKind, Propagator, TelemetryConfig, TracingConfig,
         TracingExporterKind,

crates/config/src/sections/tchap.rs

@@ -0,0 +1,119 @@
+//
+// MIT License
+//
+// Copyright (c) 2025, Direction interministérielle du numérique - Gouvernement
+// Français
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to
+// deal in the Software without restriction, including without limitation the
+// rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+// sell copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+
+use schemars::JsonSchema;
+use serde::{Deserialize, Serialize};
+use serde_with::serde_as;
+use url::Url;
+
+use super::ConfigurationSection;
+
+fn default_identity_server_url() -> Url {
+    Url::parse("http://localhost:8090/").unwrap()
+}
+
+/// Tchap specific configuration
+#[serde_as]
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+pub struct TchapAppConfig {
+    /// Identity Server Url
+    #[serde(default = "default_identity_server_url")]
+    pub identity_server_url: Url,
+
+    /// Fallback Rules to use when linking an upstream account
+    #[serde(default)]
+    pub email_lookup_fallback_rules: Vec<EmailLookupFallbackRule>,
+}
+
+/// When linking the localpart, the email can be used to find the correct
+/// localpart. By using the fallback rule, we can search for a Matrix account
+/// with the `search` email pattern for an upstream account matching with the
+/// `match_with` pattern
+#[derive(Serialize, Deserialize, PartialEq, Eq, Clone, Debug, Default, JsonSchema)]
+pub struct EmailLookupFallbackRule {
+    /// The upstream email pattern to match with when linking the localpart by
+    /// email
+    pub match_with: String,
+    /// The email pattern to use for the search when linking the localpart by
+    /// email
+    pub search: String,
+}
+
+impl ConfigurationSection for TchapAppConfig {
+    const PATH: Option<&'static str> = Some("tchap");
+
+    // NOTE: implement this function to perform validation on config
+    fn validate(
+        &self,
+        _figment: &figment::Figment,
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync + 'static>> {
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use figment::{
+        Figment, Jail,
+        providers::{Format, Yaml},
+    };
+
+    use super::*;
+
+    #[test]
+    fn load_config() {
+        Jail::expect_with(|jail| {
+            jail.create_file(
+                "config.yaml",
+                r"
+                    tchap:
+                      identity_server_url: http://localhost:8091
+                      email_lookup_fallback_rules:
+                        - match_with : '@upstream.domain.tld'
+                          search: '@matrix.domain.tld'
+                ",
+            )?;
+
+            let config = Figment::new()
+                .merge(Yaml::file("config.yaml"))
+                .extract_inner::<TchapAppConfig>("tchap")?;
+
+            assert_eq!(
+                &config.identity_server_url.as_str().to_owned(),
+                "http://localhost:8091/"
+            );
+
+            assert_eq!(
+                config.email_lookup_fallback_rules,
+                vec![EmailLookupFallbackRule {
+                    match_with: "@upstream.domain.tld".to_string(),
+                    search: "@matrix.domain.tld".to_string(),
+                }]
+            );
+
+            Ok(())
+        });
+    }
+}