mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-04 05:37:39 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

mod_tokenauth: Fix revoking a single token without revoking whole grant

Browse source 
This appears to have been a copy-paste of the grant revocation function,
or maybe the other way around. Either way, it deleted the whole grant
instead of the individual token as might be expected.
This commit is contained in:
Kim Alvefur 2023-07-23 02:54:49 +02:00
parent a1f053229c
commit d2cfe2fed7
1 changed files with 18 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

22
plugins/mod_tokenauth.lua
View file

@ -265,19 +265,33 @@ function get_token_session(token, resource)
end
function revoke_token(token)
local token_id, token_user, token_host = parse_token(token);
if not token_id then
local grant_id, token_user, token_host, token_secret = parse_token(token);
if not grant_id then
module:log("warn", "Failed to verify access token: %s", token_user);
return nil, "invalid-token-format";
end
if token_host ~= module.host then
return nil, "invalid-host";
end
local ok, err = token_store:set_key(token_user, token_id, nil);
local grant, err = _get_validated_grant_info(token_user, grant_id);
if not grant then return grant, err; end
local secret_hash = "sha256:"..hashes.sha256(token_secret, true);
local token_info = grant.tokens[secret_hash];
if not grant or not token_info then
return nil, "item-not-found";
end
grant.tokens[secret_hash] = nil;
local ok, err = token_store:set_key(token_user, grant_id, grant);
if not ok then
return nil, err;
end
module:fire_event("token-grant-revoked", { id = token_id, username = token_user, host = token_host });
module:fire_event("token-revoked", {
grant_id = grant_id;
grant = grant;
info = token_info;
username = token_user;
host = token_host;
});
return true;
end