overmind
/
matrix-docker-ansible-deploy
mirror da https://github.com/spantaleev/matrix-docker-ansible-deploy
1
0
Forka 0
Codice Problemi 0 Rilasci 0 Wiki Attività
Matrix Docker Ansible eploy
Non puoi selezionare più di 25 argomenti Gli argomenti devono iniziare con una lettera o un numero, possono includere trattini ('-') e possono essere lunghi fino a 35 caratteri.
12005 Commit
5 Rami (Branch)
1.4 GiB
 
 
 
Albero (Tree): 6e9fcfc9d6
Rami (Branch) Tag
${ item.name }
Crea branch ${ searchTerm }
da '6e9fcfc9d6'
${ noResults }
matrix-docker-ansible-deploy/roles/custom/matrix-livekit-jwt-service/molecule/default/tasks/verify-token.yml

118 righe
5.9 KiB
Originale Blame Cronologia 

  1. # SPDX-FileCopyrightText: 2026 Slavi Pantaleev

  2. #

  3. # SPDX-License-Identifier: AGPL-3.0-or-later

  4. 

  5. ---

  6. - name: Request a real LiveKit JWT

  7.   ansible.builtin.command:

  8.     argv:

  9.       - docker

  10.       - run

  11.       - --rm

  12.       - --network={{ matrix_livekit_jwt_service_container_network }}

  13.       - "{{ molecule_shared_image_curl }}"

  14.       - --silent

  15.       - --show-error

  16.       - --header

  17.       - "Content-Type: application/json"

  18.       - --data-binary

  19.       - "{{ matrix_livekit_jwt_service_case_request | to_json }}"

  20.       - --write-out

  21.       - "\nHTTP_STATUS=%{http_code}"

  22.       - http://matrix-livekit-jwt-service:8097/get_token

  23.   register: matrix_livekit_jwt_service_token_response

  24.   changed_when: false

  25.   failed_when: false

  26.   vars:

  27.     matrix_livekit_jwt_service_case_request: >-

  28.       {{ matrix_livekit_jwt_service_valid_request | combine({

  29.         'slot_id': matrix_livekit_jwt_service_token_case.slot,

  30.         'openid_token': {'access_token': matrix_livekit_jwt_service_token_case.token, 'matrix_server_name': matrix_livekit_jwt_service_token_case.server},

  31.         'member': {'claimed_user_id': matrix_livekit_jwt_service_token_case.user}

  32.       }, recursive=True) }}

  33. 

  34. - name: Parse the successful token response

  35.   ansible.builtin.set_fact:

  36.     matrix_livekit_jwt_service_token_document: >-

  37.       {{ matrix_livekit_jwt_service_token_response.stdout | regex_replace('(?s)\s*HTTP_STATUS=[0-9]+\s*$', '') | from_json }}

  38. 

  39. - name: Assert the live service returns a JWT for the configured SFU URL

  40.   ansible.builtin.assert:

  41.     that:

  42.       - matrix_livekit_jwt_service_token_response.rc == 0

  43.       - matrix_livekit_jwt_service_token_response.stdout_lines[-1] == 'HTTP_STATUS=200'

  44.       - matrix_livekit_jwt_service_token_document.keys() | sort == ['jwt', 'url']

  45.       - matrix_livekit_jwt_service_token_document.url == matrix_livekit_jwt_service_environment_variable_livekit_url

  46.       - matrix_livekit_jwt_service_token_document.jwt.split('.') | length == 3

  47.     fail_msg: "The {{ matrix_livekit_jwt_service_token_case.name }} exchange did not return a JWT and configured SFU URL"

  48.     success_msg: "The {{ matrix_livekit_jwt_service_token_case.name }} exchange returns a real JWT for the configured SFU"

  49. 

  50. - name: Decode and authenticate the returned LiveKit JWT

  51.   ansible.builtin.command:

  52.     argv:

  53.       - python3

  54.       - -c

  55.       - >-

  56.         import base64, hashlib, hmac, json, sys;

  57.         parts = sys.argv[1].split('.');

  58.         decode = lambda value: json.loads(base64.urlsafe_b64decode(value + '=' * (-len(value) % 4)));

  59.         signature = base64.urlsafe_b64decode(parts[2] + '=' * (-len(parts[2]) % 4));

  60.         expected = hmac.new(sys.argv[2].encode(), (parts[0] + '.' + parts[1]).encode(), hashlib.sha256).digest();

  61.         print(json.dumps({'header': decode(parts[0]), 'claims': decode(parts[1]), 'signature_valid': hmac.compare_digest(signature, expected)}))

  62.       - "{{ matrix_livekit_jwt_service_token_document.jwt }}"

  63.       - "{{ matrix_livekit_jwt_service_environment_variable_livekit_secret }}"

  64.   register: matrix_livekit_jwt_service_jwt_decode

  65.   changed_when: false

  66.   no_log: true

  67. 

  68. - name: Assert the JWT signature, identity, room and grants

  69.   ansible.builtin.assert:

  70.     that:

  71.       - matrix_livekit_jwt_service_jwt.signature_valid is sameas true

  72.       - matrix_livekit_jwt_service_jwt.header.alg == 'HS256'

  73.       - matrix_livekit_jwt_service_jwt.claims.iss == matrix_livekit_jwt_service_environment_variable_livekit_key

  74.       - matrix_livekit_jwt_service_jwt.claims.sub == matrix_livekit_jwt_service_token_case.identity

  75.       - matrix_livekit_jwt_service_jwt.claims.video.room == matrix_livekit_jwt_service_token_case.room

  76.       - matrix_livekit_jwt_service_jwt.claims.video.roomJoin is sameas true

  77.       - matrix_livekit_jwt_service_jwt.claims.video.roomCreate | default(false) is sameas false

  78.       - matrix_livekit_jwt_service_jwt.claims.video.canPublish is sameas matrix_livekit_jwt_service_token_case.can_publish

  79.       - matrix_livekit_jwt_service_jwt.claims.video.canSubscribe is sameas true

  80.       - matrix_livekit_jwt_service_jwt.claims.video.canUpdateOwnMetadata is sameas true

  81.       - matrix_livekit_jwt_service_jwt.claims.exp | int - matrix_livekit_jwt_service_jwt.claims.nbf | int == 3600

  82.     fail_msg: "The returned JWT lost its authenticated MSC4195 identity, room or {{ matrix_livekit_jwt_service_token_case.name }} join grant"

  83.     success_msg: "The returned JWT has a valid signature and {{ matrix_livekit_jwt_service_token_case.name }} MSC4195 grant"

  84.   vars:

  85.     matrix_livekit_jwt_service_jwt: "{{ matrix_livekit_jwt_service_jwt_decode.stdout | from_json }}"

  86. 

  87. - name: Inspect the requested room on the real SFU

  88.   ansible.builtin.command:

  89.     argv:

  90.       - docker

  91.       - run

  92.       - --rm

  93.       - --network={{ matrix_livekit_jwt_service_container_network }}

  94.       - "{{ molecule_shared_image_curl }}"

  95.       - --silent

  96.       - --show-error

  97.       - --fail

  98.       - --header

  99.       - "Authorization: Bearer {{ matrix_livekit_jwt_service_room_list_token.stdout }}"

  100.       - --header

  101.       - "Content-Type: application/json"

  102.       - --data-binary

  103.       - "{{ {'names': [matrix_livekit_jwt_service_token_case.room]} | to_json }}"

  104.       - http://matrix-livekit-sfu-fixture:7880/twirp/livekit.RoomService/ListRooms

  105.   register: matrix_livekit_jwt_service_sfu_rooms

  106.   changed_when: false

  107.   no_log: true

  108. 

  109. - name: Assert only a trusted user triggers SFU room creation

  110.   ansible.builtin.assert:

  111.     that:

  112.       - matrix_livekit_jwt_service_rooms | map(attribute='name') | list == matrix_livekit_jwt_service_expected_rooms

  113.     fail_msg: "The {{ matrix_livekit_jwt_service_token_case.name }} user triggered an unexpected SFU room-creation result"

  114.     success_msg: "The real SFU enforces the expected room-creation behavior for the {{ matrix_livekit_jwt_service_token_case.name }} user"

  115.   vars:

  116.     matrix_livekit_jwt_service_rooms: "{{ (matrix_livekit_jwt_service_sfu_rooms.stdout | from_json).rooms | default([]) }}"

  117.     matrix_livekit_jwt_service_expected_rooms: "{{ [matrix_livekit_jwt_service_token_case.room] if matrix_livekit_jwt_service_token_case.can_publish else [] }}"