Merge branch 'master' into matthew/peeking

clientapi/routing/memberships.go

@@ -19,7 +19,6 @@ import (
 	"net/http"
 
 	"github.com/matrix-org/dendrite/clientapi/jsonerror"
-	currentstateAPI "github.com/matrix-org/dendrite/currentstateserver/api"
 	"github.com/matrix-org/dendrite/internal/config"
 	"github.com/matrix-org/dendrite/roomserver/api"
 	userapi "github.com/matrix-org/dendrite/userapi/api"
@@ -94,10 +93,10 @@ func GetMemberships(
 func GetJoinedRooms(
 	req *http.Request,
 	device *userapi.Device,
-	stateAPI currentstateAPI.CurrentStateInternalAPI,
+	rsAPI api.RoomserverInternalAPI,
 ) util.JSONResponse {
-	var res currentstateAPI.QueryRoomsForUserResponse
-	err := stateAPI.QueryRoomsForUser(req.Context(), &currentstateAPI.QueryRoomsForUserRequest{
+	var res api.QueryRoomsForUserResponse
+	err := rsAPI.QueryRoomsForUser(req.Context(), &api.QueryRoomsForUserRequest{
 		UserID:         device.UserID,
 		WantMembership: "join",
 	}, &res)

clientapi/routing/password.go

@@ -0,0 +1,127 @@
+package routing
+
+import (
+	"net/http"
+
+	"github.com/matrix-org/dendrite/clientapi/auth"
+	"github.com/matrix-org/dendrite/clientapi/auth/authtypes"
+	"github.com/matrix-org/dendrite/clientapi/httputil"
+	"github.com/matrix-org/dendrite/clientapi/jsonerror"
+	"github.com/matrix-org/dendrite/internal/config"
+	"github.com/matrix-org/dendrite/userapi/api"
+	userapi "github.com/matrix-org/dendrite/userapi/api"
+	"github.com/matrix-org/dendrite/userapi/storage/accounts"
+	"github.com/matrix-org/gomatrixserverlib"
+	"github.com/matrix-org/util"
+)
+
+type newPasswordRequest struct {
+	NewPassword   string          `json:"new_password"`
+	LogoutDevices bool            `json:"logout_devices"`
+	Auth          newPasswordAuth `json:"auth"`
+}
+
+type newPasswordAuth struct {
+	Type    string `json:"type"`
+	Session string `json:"session"`
+	auth.PasswordRequest
+}
+
+func Password(
+	req *http.Request,
+	userAPI userapi.UserInternalAPI,
+	accountDB accounts.Database,
+	device *api.Device,
+	cfg *config.ClientAPI,
+) util.JSONResponse {
+	// Check that the existing password is right.
+	var r newPasswordRequest
+	r.LogoutDevices = true
+
+	// Unmarshal the request.
+	resErr := httputil.UnmarshalJSONRequest(req, &r)
+	if resErr != nil {
+		return *resErr
+	}
+
+	// Retrieve or generate the sessionID
+	sessionID := r.Auth.Session
+	if sessionID == "" {
+		// Generate a new, random session ID
+		sessionID = util.RandomString(sessionIDLength)
+	}
+
+	// Require password auth to change the password.
+	if r.Auth.Type != authtypes.LoginTypePassword {
+		return util.JSONResponse{
+			Code: http.StatusUnauthorized,
+			JSON: newUserInteractiveResponse(
+				sessionID,
+				[]authtypes.Flow{
+					{
+						Stages: []authtypes.LoginType{authtypes.LoginTypePassword},
+					},
+				},
+				nil,
+			),
+		}
+	}
+
+	// Check if the existing password is correct.
+	typePassword := auth.LoginTypePassword{
+		GetAccountByPassword: accountDB.GetAccountByPassword,
+		Config:               cfg,
+	}
+	if _, authErr := typePassword.Login(req.Context(), &r.Auth.PasswordRequest); authErr != nil {
+		return *authErr
+	}
+	AddCompletedSessionStage(sessionID, authtypes.LoginTypePassword)
+
+	// Check the new password strength.
+	if resErr = validatePassword(r.NewPassword); resErr != nil {
+		return *resErr
+	}
+
+	// Get the local part.
+	localpart, _, err := gomatrixserverlib.SplitID('@', device.UserID)
+	if err != nil {
+		util.GetLogger(req.Context()).WithError(err).Error("gomatrixserverlib.SplitID failed")
+		return jsonerror.InternalServerError()
+	}
+
+	// Ask the user API to perform the password change.
+	passwordReq := &userapi.PerformPasswordUpdateRequest{
+		Localpart: localpart,
+		Password:  r.NewPassword,
+	}
+	passwordRes := &userapi.PerformPasswordUpdateResponse{}
+	if err := userAPI.PerformPasswordUpdate(req.Context(), passwordReq, passwordRes); err != nil {
+		util.GetLogger(req.Context()).WithError(err).Error("PerformPasswordUpdate failed")
+		return jsonerror.InternalServerError()
+	}
+	if !passwordRes.PasswordUpdated {
+		util.GetLogger(req.Context()).Error("Expected password to have been updated but wasn't")
+		return jsonerror.InternalServerError()
+	}
+
+	// If the request asks us to log out all other devices then
+	// ask the user API to do that.
+	if r.LogoutDevices {
+		logoutReq := &userapi.PerformDeviceDeletionRequest{
+			UserID:         device.UserID,
+			DeviceIDs:      nil,
+			ExceptDeviceID: device.ID,
+		}
+		logoutRes := &userapi.PerformDeviceDeletionResponse{}
+		if err := userAPI.PerformDeviceDeletion(req.Context(), logoutReq, logoutRes); err != nil {
+			util.GetLogger(req.Context()).WithError(err).Error("PerformDeviceDeletion failed")
+			return jsonerror.InternalServerError()
+		}
+	}
+
+	// Return a success code.
+	return util.JSONResponse{
+		Code: http.StatusOK,
+		JSON: struct{}{},
+	}
+}

clientapi/routing/profile.go

@@ -140,8 +140,8 @@ func SetAvatarURL(
 		return jsonerror.InternalServerError()
 	}
 
-	var res currentstateAPI.QueryRoomsForUserResponse
-	err = stateAPI.QueryRoomsForUser(req.Context(), &currentstateAPI.QueryRoomsForUserRequest{
+	var res api.QueryRoomsForUserResponse
+	err = rsAPI.QueryRoomsForUser(req.Context(), &api.QueryRoomsForUserRequest{
 		UserID:         device.UserID,
 		WantMembership: "join",
 	}, &res)
@@ -258,8 +258,8 @@ func SetDisplayName(
 		return jsonerror.InternalServerError()
 	}
 
-	var res currentstateAPI.QueryRoomsForUserResponse
-	err = stateAPI.QueryRoomsForUser(req.Context(), &currentstateAPI.QueryRoomsForUserRequest{
+	var res api.QueryRoomsForUserResponse
+	err = rsAPI.QueryRoomsForUser(req.Context(), &api.QueryRoomsForUserRequest{
 		UserID:         device.UserID,
 		WantMembership: "join",
 	}, &res)

clientapi/routing/routing.go

@@ -118,7 +118,7 @@ func Setup(
 	).Methods(http.MethodPost, http.MethodOptions)
 	r0mux.Handle("/joined_rooms",
 		httputil.MakeAuthAPI("joined_rooms", userAPI, func(req *http.Request, device *userapi.Device) util.JSONResponse {
-			return GetJoinedRooms(req, device, stateAPI)
+			return GetJoinedRooms(req, device, rsAPI)
 		}),
 	).Methods(http.MethodGet, http.MethodOptions)
 	r0mux.Handle("/rooms/{roomID}/join",
@@ -428,6 +428,15 @@ func Setup(
 		}),
 	).Methods(http.MethodGet, http.MethodOptions)
 
+	r0mux.Handle("/account/password",
+		httputil.MakeAuthAPI("password", userAPI, func(req *http.Request, device *userapi.Device) util.JSONResponse {
+			if r := rateLimits.rateLimit(req); r != nil {
+				return *r
+			}
+			return Password(req, userAPI, accountDB, device, cfg)
+		}),
+	).Methods(http.MethodPost, http.MethodOptions)
+
 	// Stub endpoints required by Riot
 
 	r0mux.Handle("/login",