This repository has been archived by the owner on Apr 26, 2024. It is now read-only.
Add an admin endpoint to allow authorizing server to signal token revocations #16125
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
H-Shay
commented
Aug 20, 2023
synapse/rest/admin/devices.py
Outdated
| # device_id -> introspection_token | ||
| # TODO: is there a way to check if the deletion request has come from MAS/OIDC | ||
| # authorizing server and only invalidate if that's the case? | ||
| if self.config.experimental.msc3861.enabled: |
There was a problem hiding this comment.
I am assuming this is the endpoint that MAS uses to delete devices?
There was a problem hiding this comment.
Thinking about it: we should put this somewhere where all device deletion requests hit it. That way any log out / device deletion correctly ensures the device isn't usable?
There was a problem hiding this comment.
Hilariously I started with it there and then convinced myself that was overly broad - I've moved it back now.
erikjohnston
added
the
X-Release-Blocker
synapse/util/caches/expiringcache.py
Outdated
| @@ -140,6 +140,21 @@ def pop(self, key: KT, default: T = SENTINEL) -> Union[VT, T]: | |||
|
|
|||
| return value.value | |||
|
|
|||
| def invalidate(self, keys: List[KT]) -> None: | |||
There was a problem hiding this comment.
invalidate on the other caches just invalidates a single key. Let's do the same thing here to avoid confusion
clokep
reviewed
Aug 22, 2023
erikjohnston
approved these changes
Aug 22, 2023
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As the title states - the endpoint removes the introspection token corresponding to the token id presented to the endpoint from the token cache.
This branch is based on the branch at #16117 and is a follow-up to that PR.