|
| 1 | +#!/usr/bin/env python3 |
| 2 | +"""Create a bounded Synapse registration token without exposing admin credentials.""" |
| 3 | + |
| 4 | +from __future__ import annotations |
| 5 | + |
| 6 | +import argparse |
| 7 | +import json |
| 8 | +import os |
| 9 | +import time |
| 10 | +import urllib.error |
| 11 | +import urllib.parse |
| 12 | +import urllib.request |
| 13 | + |
| 14 | + |
| 15 | +BASE_URL = "http://127.0.0.1:8008" |
| 16 | + |
| 17 | + |
| 18 | +def request_json( |
| 19 | + method: str, |
| 20 | + path: str, |
| 21 | + body: dict[str, object], |
| 22 | + access_token: str | None = None, |
| 23 | +) -> dict[str, object]: |
| 24 | + headers = {"Content-Type": "application/json"} |
| 25 | + if access_token: |
| 26 | + headers["Authorization"] = f"Bearer {access_token}" |
| 27 | + request = urllib.request.Request( |
| 28 | + f"{BASE_URL}{path}", |
| 29 | + data=json.dumps(body).encode("utf-8"), |
| 30 | + headers=headers, |
| 31 | + method=method, |
| 32 | + ) |
| 33 | + try: |
| 34 | + with urllib.request.urlopen(request, timeout=15) as response: |
| 35 | + return json.load(response) |
| 36 | + except urllib.error.HTTPError as error: |
| 37 | + raise SystemExit(f"Mesh account service returned HTTP {error.code}") from None |
| 38 | + except urllib.error.URLError: |
| 39 | + raise SystemExit("Mesh account service is not reachable on the local control port") from None |
| 40 | + |
| 41 | + |
| 42 | +def main() -> None: |
| 43 | + parser = argparse.ArgumentParser() |
| 44 | + parser.add_argument("--days", type=int, default=7) |
| 45 | + parser.add_argument("--uses", type=int, default=1) |
| 46 | + args = parser.parse_args() |
| 47 | + if not 1 <= args.days <= 30: |
| 48 | + raise SystemExit("--days must be between 1 and 30") |
| 49 | + if not 1 <= args.uses <= 25: |
| 50 | + raise SystemExit("--uses must be between 1 and 25") |
| 51 | + |
| 52 | + server_name = os.environ.get("MESH_SERVER_NAME", "").strip() |
| 53 | + admin_password = os.environ.get("MESH_ADMIN_PASSWORD", "") |
| 54 | + if not server_name or not admin_password: |
| 55 | + raise SystemExit("operator identity is not available") |
| 56 | + |
| 57 | + login = request_json( |
| 58 | + "POST", |
| 59 | + "/_matrix/client/v3/login", |
| 60 | + { |
| 61 | + "type": "m.login.password", |
| 62 | + "identifier": { |
| 63 | + "type": "m.id.user", |
| 64 | + "user": f"@dhawal:{server_name}", |
| 65 | + }, |
| 66 | + "password": admin_password, |
| 67 | + "initial_device_display_name": "Mesh invitation operator", |
| 68 | + }, |
| 69 | + ) |
| 70 | + access_token = str(login.get("access_token", "")) |
| 71 | + if not access_token: |
| 72 | + raise SystemExit("operator sign-in returned no access token") |
| 73 | + |
| 74 | + try: |
| 75 | + created = request_json( |
| 76 | + "POST", |
| 77 | + "/_synapse/admin/v1/registration_tokens/new", |
| 78 | + { |
| 79 | + "length": 32, |
| 80 | + "uses_allowed": args.uses, |
| 81 | + "expiry_time": int((time.time() + args.days * 86400) * 1000), |
| 82 | + }, |
| 83 | + access_token, |
| 84 | + ) |
| 85 | + finally: |
| 86 | + try: |
| 87 | + request_json("POST", "/_matrix/client/v3/logout", {}, access_token) |
| 88 | + except SystemExit: |
| 89 | + pass |
| 90 | + |
| 91 | + token = str(created.get("token", "")) |
| 92 | + if not token: |
| 93 | + raise SystemExit("account service returned no invitation code") |
| 94 | + |
| 95 | + query = {"registration_token": token} |
| 96 | + invite_url = f"https://{server_name}/invite?{urllib.parse.urlencode(query)}" |
| 97 | + |
| 98 | + print(f"Invitation code: {token}") |
| 99 | + print(f"Invitation link: {invite_url}") |
| 100 | + print(f"Valid for {args.days} day(s), with {args.uses} allowed use(s).") |
| 101 | + |
| 102 | + |
| 103 | +if __name__ == "__main__": |
| 104 | + main() |
0 commit comments