|
| 1 | +/* |
| 2 | +Copyright 2022 The Matrix.org Foundation C.I.C. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +import { Bridge } from "matrix-appservice-bridge"; |
| 18 | +import AccessControlUnit, { EntityAccess } from "../models/AccessControlUnit"; |
| 19 | +import PolicyList from "../models/PolicyList"; |
| 20 | +import { Permalinks } from "matrix-bot-sdk"; |
| 21 | + |
| 22 | +/** |
| 23 | + * Utility to manage which users have access to the application service, |
| 24 | + * meaning whether a user is able to provision a mjolnir or continue to use one. |
| 25 | + * Internally we use a policy list within matrix to determine who has access via the `AccessControlUnit`. |
| 26 | + */ |
| 27 | +export class AccessControl { |
| 28 | + |
| 29 | + private constructor( |
| 30 | + private readonly accessControlList: PolicyList, |
| 31 | + private readonly accessControlUnit: AccessControlUnit |
| 32 | + ) { |
| 33 | + } |
| 34 | + |
| 35 | + /** |
| 36 | + * Construct and initialize access control for the `MjolnirAppService`. |
| 37 | + * @param accessControlListId The room id of a policy list used to manage access to the appservice (who can provision & use mjolniren) |
| 38 | + * @param bridge The matrix-appservice-bridge, used to get the appservice bot. |
| 39 | + * @returns A new instance of `AccessControl` to be used by `MjolnirAppService`. |
| 40 | + */ |
| 41 | + public static async setupAccessControl( |
| 42 | + /** The room id for the access control list. */ |
| 43 | + accessControlListId: string, |
| 44 | + bridge: Bridge, |
| 45 | + ): Promise<AccessControl> { |
| 46 | + await bridge.getBot().getClient().joinRoom(accessControlListId); |
| 47 | + const accessControlList = new PolicyList( |
| 48 | + accessControlListId, |
| 49 | + Permalinks.forRoom(accessControlListId), |
| 50 | + bridge.getBot().getClient() |
| 51 | + ); |
| 52 | + const accessControlUnit = new AccessControlUnit([accessControlList]); |
| 53 | + await accessControlList.updateList(); |
| 54 | + return new AccessControl(accessControlList, accessControlUnit); |
| 55 | + } |
| 56 | + |
| 57 | + public handleEvent(roomId: string, event: any) { |
| 58 | + if (roomId === this.accessControlList.roomId) { |
| 59 | + this.accessControlList.updateForEvent(event); |
| 60 | + } |
| 61 | + } |
| 62 | + |
| 63 | + public getUserAccess(mxid: string): EntityAccess { |
| 64 | + return this.accessControlUnit.getAccessForUser(mxid, "CHECK_SERVER"); |
| 65 | + } |
| 66 | +} |
0 commit comments