From c8087f4f2065052ac81f680cb72f7a9b3ea6e5f6 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 31 Aug 2026 08:58:41 +0300 Subject: [PATCH] Keep Beeper Line ghost namespaces in sync --- group_vars/matrix_servers | 2 +- .../defaults/main.yml | 7 +++++-- .../molecule/default/molecule.yml | 2 ++ .../molecule/default/verify.yml | 21 +++++++++++-------- .../tasks/validate_config.yml | 4 +++- .../templates/config.yaml.j2 | 2 +- 6 files changed, 24 insertions(+), 14 deletions(-) diff --git a/group_vars/matrix_servers b/group_vars/matrix_servers index 9f1c73173..2a1e9b3a0 100755 --- a/group_vars/matrix_servers +++ b/group_vars/matrix_servers @@ -5368,7 +5368,7 @@ matrix_ketesa_config_asManagedUsers_auto: | + ([ '^@'+(matrix_bridge_beeper_line_appservice_bot_username | default('') | regex_escape)+':'+(matrix_domain | regex_escape)+'$', - '^@line_[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$', + '^@'+(matrix_bridge_beeper_line_appservice_username_prefix | default('') | regex_escape)+'[a-zA-Z0-9]+:'+(matrix_domain | regex_escape)+'$', ] if matrix_bridge_beeper_line_enabled else []) + ([ diff --git a/roles/custom/matrix-bridge-beeper-line/defaults/main.yml b/roles/custom/matrix-bridge-beeper-line/defaults/main.yml index 9b3452de0..7d07a77a8 100644 --- a/roles/custom/matrix-bridge-beeper-line/defaults/main.yml +++ b/roles/custom/matrix-bridge-beeper-line/defaults/main.yml @@ -165,7 +165,10 @@ matrix_bridge_beeper_line_bridge_encryption_appservice: false matrix_bridge_beeper_line_bridge_encryption_key_sharing_allow: "{{ matrix_bridge_beeper_line_bridge_encryption_allow }}" matrix_bridge_beeper_line_bridge_encryption_pickle_key: mautrix.bridge.e2ee -matrix_bridge_beeper_line_appservice_username_template: "{% raw %}line_{{.}}{% endraw %}" +# Prefix of the localparts generated for LINE ghost users. +# The bridge username template, appservice registration namespace, and Ketesa managed-user +# allowlist are all derived from this value. +matrix_bridge_beeper_line_appservice_username_prefix: line_ # Shared secret for authentication of provisioning API requests. # If set to "disable", the provisioning API will be disabled. @@ -210,7 +213,7 @@ matrix_bridge_beeper_line_registration_yaml: | rate_limited: false namespaces: users: - - regex: '^@line_.+:{{ matrix_bridge_beeper_line_homeserver_domain | regex_escape }}$' + - regex: '^@{{ matrix_bridge_beeper_line_appservice_username_prefix | regex_escape }}.+:{{ matrix_bridge_beeper_line_homeserver_domain | regex_escape }}$' exclusive: true - exclusive: true regex: '^@{{ matrix_bridge_beeper_line_appservice_bot_username | regex_escape }}:{{ matrix_bridge_beeper_line_homeserver_domain | regex_escape }}$' diff --git a/roles/custom/matrix-bridge-beeper-line/molecule/default/molecule.yml b/roles/custom/matrix-bridge-beeper-line/molecule/default/molecule.yml index a0f5aaa9a..4d2e7eb0f 100644 --- a/roles/custom/matrix-bridge-beeper-line/molecule/default/molecule.yml +++ b/roles/custom/matrix-bridge-beeper-line/molecule/default/molecule.yml @@ -47,6 +47,8 @@ provisioner: matrix_bridge_beeper_line_appservice_bot_username: molecule-linebot matrix_bridge_beeper_line_appservice_bot_displayname: Molecule LINE Bot matrix_bridge_beeper_line_appservice_bot_avatar: mxc://molecule.local/lineAvatarFixture + # The dot proves every consumer escapes the shared non-default prefix as a regex. + matrix_bridge_beeper_line_appservice_username_prefix: molecule.line_ # Each value differs from the role default so parsed checks distinguish role output # from component defaults. matrix_bridge_beeper_line_command_prefix: "!molecule-line" diff --git a/roles/custom/matrix-bridge-beeper-line/molecule/default/verify.yml b/roles/custom/matrix-bridge-beeper-line/molecule/default/verify.yml index d07cfb08f..9e1236a80 100644 --- a/roles/custom/matrix-bridge-beeper-line/molecule/default/verify.yml +++ b/roles/custom/matrix-bridge-beeper-line/molecule/default/verify.yml @@ -179,6 +179,7 @@ - beeper_line_config.appservice.bot.avatar == matrix_bridge_beeper_line_appservice_bot_avatar - beeper_line_config.appservice.as_token == matrix_bridge_beeper_line_appservice_token - beeper_line_config.appservice.hs_token == matrix_bridge_beeper_line_homeserver_token + - beeper_line_config.appservice.username_template == matrix_bridge_beeper_line_appservice_username_prefix + '{' + '{.}' + '}' fail_msg: "The rendered configuration does not carry the scenario's appservice identity" success_msg: "The rendered configuration carries the scenario's appservice identity" @@ -233,21 +234,23 @@ fail_msg: "The registration does not carry the configured handshake values" success_msg: "The registration carries the configured handshake values" - - name: Assert the registration namespaces cover only LINE ghosts and the bridge bot + - name: Assert the registration namespaces use the shared LINE ghost prefix and cover the bridge bot ansible.builtin.assert: that: - - beeper_line_ghost_regex | length > 0 - - beeper_line_bot_regex | length > 0 + - beeper_line_registration.namespaces.users | length == 2 + - beeper_line_ghost_regex == beeper_line_expected_ghost_regex + - beeper_line_bot_regex == beeper_line_expected_bot_regex - beeper_line_ghost_mxid is match(beeper_line_ghost_regex) - beeper_line_wrong_ghost_mxid is not match(beeper_line_ghost_regex) - beeper_line_bot_mxid is match(beeper_line_bot_regex) - fail_msg: "The registration namespaces do not cover only LINE ghosts and the bot" - success_msg: "The registration namespaces cover only LINE ghosts and the bot" + fail_msg: "The registration namespaces do not use the shared LINE ghost prefix or cover the bot" + success_msg: "The registration namespaces use the shared LINE ghost prefix and cover the bot" vars: - beeper_line_user_regexes: "{{ beeper_line_registration.namespaces.users | map(attribute='regex') | list }}" - beeper_line_ghost_regex: "{{ beeper_line_user_regexes | select('search', 'line_') | first | default('') }}" - beeper_line_bot_regex: "{{ beeper_line_user_regexes | reject('search', 'line_') | first | default('') }}" - beeper_line_ghost_mxid: "@line_moleculefixture:{{ matrix_bridge_beeper_line_homeserver_domain }}" + beeper_line_ghost_regex: "{{ beeper_line_registration.namespaces.users[0].regex }}" + beeper_line_bot_regex: "{{ beeper_line_registration.namespaces.users[1].regex }}" + beeper_line_expected_ghost_regex: '^@{{ matrix_bridge_beeper_line_appservice_username_prefix | regex_escape }}.+:{{ matrix_bridge_beeper_line_homeserver_domain | regex_escape }}$' + beeper_line_expected_bot_regex: '^@{{ matrix_bridge_beeper_line_appservice_bot_username | regex_escape }}:{{ matrix_bridge_beeper_line_homeserver_domain | regex_escape }}$' + beeper_line_ghost_mxid: "@{{ matrix_bridge_beeper_line_appservice_username_prefix }}moleculefixture:{{ matrix_bridge_beeper_line_homeserver_domain }}" beeper_line_wrong_ghost_mxid: "@twitter_moleculefixture:{{ matrix_bridge_beeper_line_homeserver_domain }}" beeper_line_bot_mxid: "@{{ matrix_bridge_beeper_line_appservice_bot_username }}:{{ matrix_bridge_beeper_line_homeserver_domain }}" diff --git a/roles/custom/matrix-bridge-beeper-line/tasks/validate_config.yml b/roles/custom/matrix-bridge-beeper-line/tasks/validate_config.yml index d429da390..b522187ed 100644 --- a/roles/custom/matrix-bridge-beeper-line/tasks/validate_config.yml +++ b/roles/custom/matrix-bridge-beeper-line/tasks/validate_config.yml @@ -11,7 +11,8 @@ Your configuration contains a variable, which now has a different name. Please rename the variable (`{{ item.old }}` -> `{{ item.new }}`) on your configuration file (vars.yml). when: "lookup('ansible.builtin.varnames', ('^' + item.old + '$'), wantlist=True) | length > 0" - with_items: [] + with_items: + - {'old': 'matrix_bridge_beeper_line_appservice_username_template', 'new': 'matrix_bridge_beeper_line_appservice_username_prefix'} - name: Fail if required beeper-line settings not defined ansible.builtin.fail: @@ -22,5 +23,6 @@ - {'name': 'matrix_bridge_beeper_line_appservice_token', when: true} - {'name': 'matrix_bridge_beeper_line_homeserver_address', when: true} - {'name': 'matrix_bridge_beeper_line_homeserver_token', when: true} + - {'name': 'matrix_bridge_beeper_line_appservice_username_prefix', when: true} - {'name': 'matrix_bridge_beeper_line_database_hostname', when: "{{ matrix_bridge_beeper_line_database_engine == 'postgres' }}"} - {'name': 'matrix_bridge_beeper_line_container_network', when: true} diff --git a/roles/custom/matrix-bridge-beeper-line/templates/config.yaml.j2 b/roles/custom/matrix-bridge-beeper-line/templates/config.yaml.j2 index 85d52296c..a7ea76d2f 100644 --- a/roles/custom/matrix-bridge-beeper-line/templates/config.yaml.j2 +++ b/roles/custom/matrix-bridge-beeper-line/templates/config.yaml.j2 @@ -250,7 +250,7 @@ appservice: # Localpart template of MXIDs for remote users. # {% raw %}{{.}}{% endraw %} is replaced with the internal ID of the user. - username_template: {{ matrix_bridge_beeper_line_appservice_username_template | to_json }} + username_template: {{ (matrix_bridge_beeper_line_appservice_username_prefix + '{{.}}') | to_json }} # Config options that affect the Matrix connector of the bridge. matrix: