synapse/changelog.d/12986.misc at c99b511db950bff5129e717a225de78b95b9b5ad - mirrors/synapse - Sadium Git

mirrors/synapse

mirror of https://github.com/element-hq/synapse.git synced 2024-11-29 07:28:55 +03:00

Quentin Gliech fe1daad672

Move the "email unsubscribe" resource, refactor the macaroon generator & simplify the access token verification logic. (#12986 )

This simplifies the access token verification logic by removing the `rights`
parameter which was only ever used for the unsubscribe link in email
notifications. The latter has been moved under the `/_synapse` namespace,
since it is not a standard API.

This also makes the email verification link more secure, by embedding the
app_id and pushkey in the macaroon and verifying it. This prevents the user
from tampering the query parameters of that unsubscribe link.

Macaroon generation is refactored:

- Centralised all macaroon generation and verification logic to the
  `MacaroonGenerator`
- Moved to `synapse.utils`
- Changed the constructor to require only a `Clock`, hostname, and a secret key
  (instead of a full `Homeserver`).
- Added tests for all methods.

2022-06-14 09:12:08 -04:00

1 line

124 B

Text

Raw Blame History

Refactor macaroon tokens generation and move the unsubscribe link in notification emails to `/_synapse/client/unsubscribe`.