synapse/api/auth.py
def validate_macaroon(self, macaroon, type_string, verify_expiry, user_id):
        """
        validate that a Macaroon is understood by and was signed by this server.

        Args:
            macaroon(pymacaroons.Macaroon): The macaroon to validate
            type_string(str): The kind of token required (e.g. "access",
                              "delete_pusher")
            verify_expiry(bool): Whether to verify whether the macaroon has expired.
            user_id (str): The user_id required
        """
        v = pymacaroons.Verifier()

        # the verifier runs a test for every caveat on the macaroon, to check
        # that it is met for the current request. Each caveat must match at
        # least one of the predicates specified by satisfy_exact or
        # specify_general.
        v.satisfy_exact("gen = 1")
        v.satisfy_exact("type = " + type_string)
        v.satisfy_exact("user_id = %s" % user_id)
        v.satisfy_exact("guest = true")

        # verify_expiry should really always be True, but there exist access
        # tokens in the wild which expire when they should not, so we can't
        # enforce expiry yet (so we have to allow any caveat starting with
        # 'time < ' in access tokens).
        #
        # On the other hand, short-term login tokens (as used by CAS login, for
        # example) have an expiry time which we do want to enforce.

        if verify_expiry:
            v.satisfy_general(self._verify_expiry)
        else:
            v.satisfy_general(lambda c: c.startswith("time < "))

        # access_tokens include a nonce for uniqueness: any value is acceptable
        v.satisfy_general(lambda c: c.startswith("nonce = "))

        v.verify(macaroon, self.hs.config.macaroon_secret_key)

        validate that a Macaroon is understood by and was signed by this server.

        Args:
            macaroon(pymacaroons.Macaroon): The macaroon to validate
            type_string(str): The kind of token required (e.g. "access",
                              "delete_pusher")
            verify_expiry(bool): Whether to verify whether the macaroon has expired.
            user_id (str): The user_id required
        
validate that a Macaroon is understood by and was signed by this server.
validate that a Macaroon is understood by and was signed by this server .
def validate_macaroon(self, macaroon, type_string, verify_expiry, user_id):
        v = pymacaroons.Verifier()
        v.satisfy_exact("gen = 1")
        v.satisfy_exact("type = " + type_string)
        v.satisfy_exact("user_id = %s" % user_id)
        v.satisfy_exact("guest = true")
         On the other hand, short-term login tokens (as used by CAS login, for
         example) have an expiry time which we do want to enforce.
        if verify_expiry:
            v.satisfy_general(self._verify_expiry)
        else:
            v.satisfy_general(lambda c: c.startswith("time < "))
         access_tokens include a nonce for uniqueness: any value is acceptable
        v.satisfy_general(lambda c: c.startswith("nonce = "))
        v.verify(macaroon, self.hs.config.macaroon_secret_key)
def validate_macaroon ( self , macaroon , type_string , verify_expiry , user_id ) : v = pymacaroons . Verifier ( ) v . satisfy_exact ( "gen = 1" ) v . satisfy_exact ( "type = " + type_string ) v . satisfy_exact ( "user_id = %s" % user_id ) v . satisfy_exact ( "guest = true" ) if verify_expiry : v . satisfy_general ( self . _verify_expiry ) else : v . satisfy_general ( lambda c : c . startswith ( "time < " ) ) v . satisfy_general ( lambda c : c . startswith ( "nonce = " ) ) v . verify ( macaroon , self . hs . config . macaroon_secret_key )
validate that a Macaroon is understood by and was signed by this server.
validate that a Macaroon is understood by and was signed by this server .
"""
        validate that a Macaroon is understood by and was signed by this server.

        Args:
            macaroon(pymacaroons.Macaroon): The macaroon to validate
            type_string(str): The kind of token required (e.g. "access",
                              "delete_pusher")
            verify_expiry(bool): Whether to verify whether the macaroon has expired.
            user_id (str): The user_id required
        """ # the verifier runs a test for every caveat on the macaroon, to check # that it is met for the current request. Each caveat must match at # least one of the predicates specified by satisfy_exact or # specify_general. # verify_expiry should really always be True, but there exist access # tokens in the wild which expire when they should not, so we can't # enforce expiry yet (so we have to allow any caveat starting with # 'time < ' in access tokens). # # On the other hand, short-term login tokens (as used by CAS login, for # example) have an expiry time which we do want to enforce. # access_tokens include a nonce for uniqueness: any value is acceptable
self
macaroon
The macaroon to validate
The macaroon to validate
type_string
The kind of token required
The kind of token required
verify_expiry
Whether to verify whether the macaroon has expired.
Whether to verify whether the macaroon has expired .
user_id
The user_id required
The user_id required