87 lines
3.4 KiB
Lua
87 lines
3.4 KiB
Lua
-- mod_token_affiliation.lua
|
|
--
|
|
-- Grants owner affiliation (and thus moderator role) to MUC occupants whose
|
|
-- JWT contains moderator/affiliation claims, and member affiliation to all
|
|
-- other authenticated occupants.
|
|
--
|
|
-- JWT claims inspected (context.user.*):
|
|
-- affiliation == "owner" | "moderator" | "teacher" → owner
|
|
-- moderator == true | "true" → owner
|
|
-- Authenticated user with none of the above → member
|
|
--
|
|
-- The affiliation is written to the room's affiliation list inside
|
|
-- muc-occupant-pre-join (before the join completes), so the very first
|
|
-- presence broadcast already carries the correct affiliation and role.
|
|
-- No filtering or second hook required.
|
|
--
|
|
-- Originally imported from:
|
|
-- https://github.com/jitsi-contrib/prosody-plugins/tree/main/token_affiliation
|
|
|
|
local LOGLEVEL = module:get_option_string("token_affiliation_log_level", "debug")
|
|
|
|
local util = module:require 'util';
|
|
local is_admin = util.is_admin;
|
|
local is_healthcheck_room = util.is_healthcheck_room
|
|
|
|
module:log(LOGLEVEL, "loaded")
|
|
|
|
local function affiliation_from_token(session)
|
|
if not session or not session.auth_token then
|
|
return nil
|
|
end
|
|
|
|
local context_user = session.jitsi_meet_context_user
|
|
if context_user then
|
|
if context_user["affiliation"] == "owner"
|
|
or context_user["affiliation"] == "moderator"
|
|
or context_user["affiliation"] == "teacher"
|
|
or context_user["moderator"] == "true"
|
|
or context_user["moderator"] == true then
|
|
return "owner"
|
|
end
|
|
end
|
|
|
|
return "member"
|
|
end
|
|
|
|
-- Hook priority -3.5: runs after lobby-bypass plugins such as mod_token_lobby_bypass
|
|
-- (priority -3), so any affiliation they grant is visible here and can be upgraded
|
|
-- to the correct token-derived value. Runs before the lobby gate (-4) and
|
|
-- Prosody's built-in members_only check (-5).
|
|
module:hook("muc-occupant-pre-join", function(event)
|
|
local room, occupant, session = event.room, event.occupant, event.origin
|
|
|
|
if is_healthcheck_room(room.jid) or is_admin(occupant.bare_jid) then
|
|
module:log(LOGLEVEL, "skip, %s", occupant.jid)
|
|
return
|
|
end
|
|
|
|
-- When lobby is active (members-only) only proceed when the user already
|
|
-- has a non-none affiliation (admitted by moderator, or granted by a bypass
|
|
-- plugin that ran at priority -3) or is bypassing via the room password.
|
|
-- Otherwise let the lobby gate (-4) block this first join attempt.
|
|
if room:get_members_only() then
|
|
local existing = room:get_affiliation(occupant.bare_jid)
|
|
if not existing or existing == 'none' then
|
|
local join_el = event.stanza:get_child('x', 'http://jabber.org/protocol/muc')
|
|
local join_pwd = join_el and join_el:get_child_text('password', 'http://jabber.org/protocol/muc')
|
|
local bypassing_via_password = join_pwd and room:get_password() and join_pwd == room:get_password()
|
|
if not bypassing_via_password then
|
|
module:log(LOGLEVEL, "skip, lobby active for %s", occupant.bare_jid)
|
|
return
|
|
end
|
|
end
|
|
end
|
|
|
|
local affiliation = affiliation_from_token(session)
|
|
if not affiliation then
|
|
return
|
|
end
|
|
|
|
room:set_affiliation(true, occupant.bare_jid, affiliation)
|
|
if affiliation == "owner" then
|
|
occupant.role = "moderator"
|
|
end
|
|
module:log(LOGLEVEL, "set affiliation=%s for %s", affiliation, occupant.bare_jid)
|
|
end, -3.5)
|