magmaus3/continuwuity
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

always disable fed, evict admins, and forget the room when banning a room

Browse source 
Signed-off-by: June Clementine Strawberry <june@3.dog>
This commit is contained in:
June Clementine Strawberry 2025-03-08 15:48:23 -05:00
parent ef96e7afac
commit 5efe804a20
No known key found for this signature in database
4 changed files with 109 additions and 259 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.github/workflows/ci.yml vendored
View file

@ -199,7 +199,6 @@ jobs:
echo '```' >> $GITHUB_STEP_SUMMARY echo '```' >> $GITHUB_STEP_SUMMARY
tail -n 100 test_output.log | sed 's/\x1b\[[0-9;]*m//g' >> $GITHUB_STEP_SUMMARY tail -n 100 test_output.log | sed 's/\x1b\[[0-9;]*m//g' >> $GITHUB_STEP_SUMMARY
echo '```' >> $GITHUB_STEP_SUMMARY echo '```' >> $GITHUB_STEP_SUMMARY
fi
echo '# Complement diff results (last 100 lines)' >> $GITHUB_STEP_SUMMARY echo '# Complement diff results (last 100 lines)' >> $GITHUB_STEP_SUMMARY
echo '```diff' >> $GITHUB_STEP_SUMMARY echo '```diff' >> $GITHUB_STEP_SUMMARY
@ -210,6 +209,7 @@ jobs:
echo '```diff' >> $GITHUB_STEP_SUMMARY echo '```diff' >> $GITHUB_STEP_SUMMARY
tail -n 100 complement_test_logs_gotestfmt.log | sed 's/\x1b\[[0-9;]*m//g' >> $GITHUB_STEP_SUMMARY tail -n 100 complement_test_logs_gotestfmt.log | sed 's/\x1b\[[0-9;]*m//g' >> $GITHUB_STEP_SUMMARY
echo '```' >> $GITHUB_STEP_SUMMARY echo '```' >> $GITHUB_STEP_SUMMARY
fi
build: build:
name: Build name: Build

18
bin/complement
View file

@ -15,7 +15,7 @@ LOG_FILE="${2:-complement_test_logs.jsonl}"
# A `.jsonl` file to write test results to # A `.jsonl` file to write test results to
RESULTS_FILE="${3:-complement_test_results.jsonl}" RESULTS_FILE="${3:-complement_test_results.jsonl}"
COMPLEMENT_OCI_IMAGE="${COMPLEMENT_OCI_IMAGE:-complement-conduwuit:main}" COMPLEMENT_BASE_IMAGE="${COMPLEMENT_BASE_IMAGE:-complement-conduwuit:main}"
# Complement tests that are skipped due to flakiness/reliability issues or we don't implement such features and won't for a long time # Complement tests that are skipped due to flakiness/reliability issues or we don't implement such features and won't for a long time
#SKIPPED_COMPLEMENT_TESTS='-skip=TestPartialStateJoin.*' #SKIPPED_COMPLEMENT_TESTS='-skip=TestPartialStateJoin.*'
@ -62,12 +62,13 @@ echo "\$LOG_FILE: $LOG_FILE"
echo "" echo ""
# It's okay (likely, even) that `go test` exits nonzero # It's okay (likely, even) that `go test` exits nonzero
# `COMPLEMENT_ENABLE_DIRTY_RUNS=1` reuses the same complement container for faster complement, at the possible expense of test environment pollution
set +o pipefail set +o pipefail
env \ env \
-C "$COMPLEMENT_SRC" \ -C "$COMPLEMENT_SRC" \
COMPLEMENT_BASE_IMAGE="$COMPLEMENT_OCI_IMAGE" \ COMPLEMENT_BASE_IMAGE="$COMPLEMENT_BASE_IMAGE" \
COMPLEMENT_ENABLE_DIRTY_RUNS=1 \ # reuses the same complement container for faster complement, at the possible expense of test environment pollution COMPLEMENT_ENABLE_DIRTY_RUNS=1 \
go test -tags="conduwuit_blacklist" -v -timeout 1h -json ./tests/... | tee "$LOG_FILE" go test -tags="conduwuit_blacklist" -timeout 1h -json ./tests/... | tee "$LOG_FILE"
set -o pipefail set -o pipefail
# Post-process the results into an easy-to-compare format, sorted by Test name for reproducible results # Post-process the results into an easy-to-compare format, sorted by Test name for reproducible results
@ -78,12 +79,17 @@ cat "$LOG_FILE" | jq -s -c 'sort_by(.Test)[]' | jq -c '
) | {Action: .Action, Test: .Test} ) | {Action: .Action, Test: .Test}
' > "$RESULTS_FILE" ' > "$RESULTS_FILE"
grep '^{"Time":' "$LOG_FILE" | gotestfmt > "${LOG_FILE}_gotestfmt.log" if command -v gotestfmt &> /dev/null; then
echo "using gotestfmt on $LOG_FILE"
grep '^{"Time":' "$LOG_FILE" | gotestfmt > "complement_test_logs_gotestfmt.log"
fi
echo "" echo ""
echo "" echo ""
echo "complement logs saved at $LOG_FILE" echo "complement logs saved at $LOG_FILE"
echo "complement results saved at $RESULTS_FILE" echo "complement results saved at $RESULTS_FILE"
echo "complement logs in gotestfmt pretty format outputted at ${LOG_FILE}_gotestfmt.log (use an editor/terminal that interprets ANSI colours)" if command -v gotestfmt &> /dev/null; then
echo "complement logs in gotestfmt pretty format outputted at complement_test_logs_gotestfmt.log (use an editor/terminal/pager that interprets ANSI colours and UTF-8 emojis)"
fi
echo "" echo ""
echo "" echo ""

2
nix/pkgs/main/default.nix
View file

@ -155,9 +155,9 @@ commonAttrs = {
# Keep sorted # Keep sorted
include = [ include = [
".cargo"
"Cargo.lock" "Cargo.lock"
"Cargo.toml" "Cargo.toml"
"deps"
"src" "src"
]; ];
}; };

248
src/admin/room/moderation.rs
View file

@ -1,7 +1,7 @@
use api::client::leave_room; use api::client::leave_room;
use clap::Subcommand; use clap::Subcommand;
use conduwuit::{ use conduwuit::{
Result, debug, error, info, Result, debug,
utils::{IterStream, ReadyExt}, utils::{IterStream, ReadyExt},
warn, warn,
}; };
@ -17,51 +17,23 @@ use crate::{admin_command, admin_command_dispatch, get_room_info};
#[derive(Debug, Subcommand)] #[derive(Debug, Subcommand)]
pub(crate) enum RoomModerationCommand { pub(crate) enum RoomModerationCommand {
/// - Bans a room from local users joining and evicts all our local users /// - Bans a room from local users joining and evicts all our local users
/// (including server
/// admins)
/// from the room. Also blocks any invites (local and remote) for the /// from the room. Also blocks any invites (local and remote) for the
/// banned room. /// banned room, and disables federation entirely with it.
///
/// Server admins (users in the conduwuit admin room) will not be evicted
/// and server admins can still join the room. To evict admins too, use
/// --force (also ignores errors) To disable incoming federation of the
/// room, use --disable-federation
BanRoom { BanRoom {
#[arg(short, long)]
/// Evicts admins out of the room and ignores any potential errors when
/// making our local users leave the room
force: bool,
#[arg(long)]
/// Disables incoming federation of the room after banning and evicting
/// users
disable_federation: bool,
/// The room in the format of `!roomid:example.com` or a room alias in /// The room in the format of `!roomid:example.com` or a room alias in
/// the format of `#roomalias:example.com` /// the format of `#roomalias:example.com`
room: Box<RoomOrAliasId>, room: Box<RoomOrAliasId>,
}, },
/// - Bans a list of rooms (room IDs and room aliases) from a newline /// - Bans a list of rooms (room IDs and room aliases) from a newline
/// delimited codeblock similar to `user deactivate-all` /// delimited codeblock similar to `user deactivate-all`. Applies the same
BanListOfRooms { /// steps as ban-room
#[arg(short, long)] BanListOfRooms,
/// Evicts admins out of the room and ignores any potential errors when
/// making our local users leave the room
force: bool,
#[arg(long)]
/// Disables incoming federation of the room after banning and evicting
/// users
disable_federation: bool,
},
/// - Unbans a room to allow local users to join again /// - Unbans a room to allow local users to join again
///
/// To re-enable incoming federation of the room, use --enable-federation
UnbanRoom { UnbanRoom {
#[arg(long)]
/// Enables incoming federation of the room after unbanning
enable_federation: bool,
/// The room in the format of `!roomid:example.com` or a room alias in /// The room in the format of `!roomid:example.com` or a room alias in
/// the format of `#roomalias:example.com` /// the format of `#roomalias:example.com`
room: Box<RoomOrAliasId>, room: Box<RoomOrAliasId>,
@ -77,12 +49,7 @@ pub(crate) enum RoomModerationCommand {
} }
#[admin_command] #[admin_command]
async fn ban_room( async fn ban_room(&self, room: Box<RoomOrAliasId>) -> Result<RoomMessageEventContent> {
&self,
force: bool,
disable_federation: bool,
room: Box<RoomOrAliasId>,
) -> Result<RoomMessageEventContent> {
debug!("Got room alias or ID: {}", room); debug!("Got room alias or ID: {}", room);
let admin_room_alias = &self.services.globals.admin_alias; let admin_room_alias = &self.services.globals.admin_alias;
@ -175,98 +142,56 @@ async fn ban_room(
)); ));
}; };
debug!("Making all users leave the room {}", &room); debug!("Making all users leave the room {room_id} and forgetting it");
if force {
let mut users = self let mut users = self
.services .services
.rooms .rooms
.state_cache .state_cache
.room_members(&room_id) .room_members(&room_id)
.map(ToOwned::to_owned)
.ready_filter(|user| self.services.globals.user_is_local(user)) .ready_filter(|user| self.services.globals.user_is_local(user))
.boxed(); .boxed();
while let Some(local_user) = users.next().await { while let Some(ref user_id) = users.next().await {
debug!( debug!(
"Attempting leave for user {local_user} in room {room_id} (forced, ignoring all \ "Attempting leave for user {user_id} in room {room_id} (ignoring all errors, \
errors, evicting admins too)", evicting admins too)",
); );
if let Err(e) = leave_room(self.services, local_user, &room_id, None).await { if let Err(e) = leave_room(self.services, user_id, &room_id, None).await {
warn!(%e, "Failed to leave room"); warn!("Failed to leave room: {e}");
}
}
} else {
let mut users = self
.services
.rooms
.state_cache
.room_members(&room_id)
.ready_filter(|user| self.services.globals.user_is_local(user))
.boxed();
while let Some(local_user) = users.next().await {
if self.services.users.is_admin(local_user).await {
continue;
} }
debug!("Attempting leave for user {} in room {}", &local_user, &room_id); self.services.rooms.state_cache.forget(&room_id, user_id);
if let Err(e) = leave_room(self.services, local_user, &room_id, None).await {
error!(
"Error attempting to make local user {} leave room {} during room banning: \
{}",
&local_user, &room_id, e
);
return Ok(RoomMessageEventContent::text_plain(format!(
"Error attempting to make local user {} leave room {} during room banning \
(room is still banned but not removing any more users): {}\nIf you would \
like to ignore errors, use --force",
&local_user, &room_id, e
)));
}
}
} }
// remove any local aliases, ignore errors self.services
for local_alias in &self
.services
.rooms .rooms
.alias .alias
.local_aliases_for_room(&room_id) .local_aliases_for_room(&room_id)
.map(ToOwned::to_owned) .map(ToOwned::to_owned)
.collect::<Vec<_>>() .for_each(|local_alias| async move {
.await self.services
{
_ = self
.services
.rooms .rooms
.alias .alias
.remove_alias(local_alias, &self.services.globals.server_user) .remove_alias(&local_alias, &self.services.globals.server_user)
.await
.ok();
})
.await; .await;
}
// unpublish from room directory, ignore errors // unpublish from room directory
self.services.rooms.directory.set_not_public(&room_id); self.services.rooms.directory.set_not_public(&room_id);
if disable_federation {
self.services.rooms.metadata.disable_room(&room_id, true); self.services.rooms.metadata.disable_room(&room_id, true);
return Ok(RoomMessageEventContent::text_plain(
"Room banned, removed all our local users, and disabled incoming federation with \
room.",
));
}
Ok(RoomMessageEventContent::text_plain( Ok(RoomMessageEventContent::text_plain(
"Room banned and removed all our local users, use `!admin federation disable-room` to \ "Room banned, removed all our local users, and disabled incoming federation with room.",
stop receiving new inbound federation events as well if needed.",
)) ))
} }
#[admin_command] #[admin_command]
async fn ban_list_of_rooms( async fn ban_list_of_rooms(&self) -> Result<RoomMessageEventContent> {
&self,
force: bool,
disable_federation: bool,
) -> Result<RoomMessageEventContent> {
if self.body.len() < 2 if self.body.len() < 2
|| !self.body[0].trim().starts_with("```") || !self.body[0].trim().starts_with("```")
|| self.body.last().unwrap_or(&"").trim() != "```" || self.body.last().unwrap_or(&"").trim() != "```"
@ -293,7 +218,7 @@ async fn ban_list_of_rooms(
if let Ok(admin_room_id) = self.services.admin.get_admin_room().await { if let Ok(admin_room_id) = self.services.admin.get_admin_room().await {
if room.to_owned().eq(&admin_room_id) || room.to_owned().eq(admin_room_alias) if room.to_owned().eq(&admin_room_id) || room.to_owned().eq(admin_room_alias)
{ {
info!("User specified admin room in bulk ban list, ignoring"); warn!("User specified admin room in bulk ban list, ignoring");
continue; continue;
} }
} }
@ -302,19 +227,12 @@ async fn ban_list_of_rooms(
let room_id = match RoomId::parse(room_alias_or_id) { let room_id = match RoomId::parse(room_alias_or_id) {
| Ok(room_id) => room_id, | Ok(room_id) => room_id,
| Err(e) => { | Err(e) => {
if force { // ignore rooms we failed to parse
// ignore rooms we failed to parse if we're force banning
warn!( warn!(
"Error parsing room \"{room}\" during bulk room banning, \ "Error parsing room \"{room}\" during bulk room banning, \
ignoring error and logging here: {e}" ignoring error and logging here: {e}"
); );
continue; continue;
}
return Ok(RoomMessageEventContent::text_plain(format!(
"{room} is not a valid room ID or room alias, please fix the \
list and try again: {e}"
)));
}, },
}; };
@ -355,21 +273,11 @@ async fn ban_list_of_rooms(
room_id room_id
}, },
| Err(e) => { | Err(e) => {
// don't fail if force blocking
if force {
warn!( warn!(
"Failed to resolve room alias {room} to a \ "Failed to resolve room alias {room} to a room \
room ID: {e}" ID: {e}"
); );
continue; continue;
}
return Ok(RoomMessageEventContent::text_plain(
format!(
"Failed to resolve room alias {room} to a \
room ID: {e}"
),
));
}, },
} }
}, },
@ -378,37 +286,21 @@ async fn ban_list_of_rooms(
room_ids.push(room_id); room_ids.push(room_id);
}, },
| Err(e) => { | Err(e) => {
if force { warn!(
// ignore rooms we failed to parse if we're force deleting
error!(
"Error parsing room \"{room}\" during bulk room banning, \ "Error parsing room \"{room}\" during bulk room banning, \
ignoring error and logging here: {e}" ignoring error and logging here: {e}"
); );
continue; continue;
}
return Ok(RoomMessageEventContent::text_plain(format!(
"{room} is not a valid room ID or room alias, please fix the \
list and try again: {e}"
)));
}, },
} }
} }
}, },
| Err(e) => { | Err(e) => {
if force { warn!(
// ignore rooms we failed to parse if we're force deleting "Error parsing room \"{room}\" during bulk room banning, ignoring error and \
error!( logging here: {e}"
"Error parsing room \"{room}\" during bulk room banning, ignoring error \
and logging here: {e}"
); );
continue; continue;
}
return Ok(RoomMessageEventContent::text_plain(format!(
"{room} is not a valid room ID or room alias, please fix the list and try \
again: {e}"
)));
}, },
} }
} }
@ -419,56 +311,27 @@ async fn ban_list_of_rooms(
debug!("Banned {room_id} successfully"); debug!("Banned {room_id} successfully");
room_ban_count = room_ban_count.saturating_add(1); room_ban_count = room_ban_count.saturating_add(1);
debug!("Making all users leave the room {}", &room_id); debug!("Making all users leave the room {room_id} and forgetting it");
if force {
let mut users = self let mut users = self
.services .services
.rooms .rooms
.state_cache .state_cache
.room_members(&room_id) .room_members(&room_id)
.map(ToOwned::to_owned)
.ready_filter(|user| self.services.globals.user_is_local(user)) .ready_filter(|user| self.services.globals.user_is_local(user))
.boxed(); .boxed();
while let Some(local_user) = users.next().await { while let Some(ref user_id) = users.next().await {
debug!( debug!(
"Attempting leave for user {local_user} in room {room_id} (forced, ignoring \ "Attempting leave for user {user_id} in room {room_id} (ignoring all errors, \
all errors, evicting admins too)", evicting admins too)",
); );
if let Err(e) = leave_room(self.services, local_user, &room_id, None).await { if let Err(e) = leave_room(self.services, user_id, &room_id, None).await {
warn!(%e, "Failed to leave room"); warn!("Failed to leave room: {e}");
}
}
} else {
let mut users = self
.services
.rooms
.state_cache
.room_members(&room_id)
.ready_filter(|user| self.services.globals.user_is_local(user))
.boxed();
while let Some(local_user) = users.next().await {
if self.services.users.is_admin(local_user).await {
continue;
} }
debug!("Attempting leave for user {local_user} in room {room_id}"); self.services.rooms.state_cache.forget(&room_id, user_id);
if let Err(e) = leave_room(self.services, local_user, &room_id, None).await {
error!(
"Error attempting to make local user {local_user} leave room {room_id} \
during bulk room banning: {e}",
);
return Ok(RoomMessageEventContent::text_plain(format!(
"Error attempting to make local user {} leave room {} during room \
banning (room is still banned but not removing any more users and not \
banning any more rooms): {}\nIf you would like to ignore errors, use \
--force",
&local_user, &room_id, e
)));
}
}
} }
// remove any local aliases, ignore errors // remove any local aliases, ignore errors
@ -490,29 +353,17 @@ async fn ban_list_of_rooms(
// unpublish from room directory, ignore errors // unpublish from room directory, ignore errors
self.services.rooms.directory.set_not_public(&room_id); self.services.rooms.directory.set_not_public(&room_id);
if disable_federation {
self.services.rooms.metadata.disable_room(&room_id, true); self.services.rooms.metadata.disable_room(&room_id, true);
} }
}
if disable_federation {
Ok(RoomMessageEventContent::text_plain(format!( Ok(RoomMessageEventContent::text_plain(format!(
"Finished bulk room ban, banned {room_ban_count} total rooms, evicted all users, \ "Finished bulk room ban, banned {room_ban_count} total rooms, evicted all users, and \
and disabled incoming federation with the room." disabled incoming federation with the room."
))) )))
} else {
Ok(RoomMessageEventContent::text_plain(format!(
"Finished bulk room ban, banned {room_ban_count} total rooms and evicted all users."
)))
}
} }
#[admin_command] #[admin_command]
async fn unban_room( async fn unban_room(&self, room: Box<RoomOrAliasId>) -> Result<RoomMessageEventContent> {
&self,
enable_federation: bool,
room: Box<RoomOrAliasId>,
) -> Result<RoomMessageEventContent> {
let room_id = if room.is_room_id() { let room_id = if room.is_room_id() {
let room_id = match RoomId::parse(&room) { let room_id = match RoomId::parse(&room) {
| Ok(room_id) => room_id, | Ok(room_id) => room_id,
@ -595,15 +446,8 @@ async fn unban_room(
)); ));
}; };
if enable_federation {
self.services.rooms.metadata.disable_room(&room_id, false); self.services.rooms.metadata.disable_room(&room_id, false);
return Ok(RoomMessageEventContent::text_plain("Room unbanned.")); Ok(RoomMessageEventContent::text_plain("Room unbanned and federation re-enabled."))
}
Ok(RoomMessageEventContent::text_plain(
"Room unbanned, you may need to re-enable federation with the room using enable-room if \
this is a remote room to make it fully functional.",
))
} }
#[admin_command] #[admin_command]