Add a module type for account validity

synapse/api/auth.py

@@ -224,12 +224,22 @@ async def get_user_by_req(
  shadow_banned = user_info.shadow_banned
 
  # Deny the request if the user account has expired.
- if self._account_validity_enabled and not allow_expired:
- if await self.store.is_account_expired(
- user_info.user_id, self.clock.time_msec()
+ if not allow_expired:
+ if await self.hs.get_account_validity().user_expired(
+ user_info.user_id
+ ) or (
+ self._account_validity_enabled
+ and await self.store.is_account_expired(
+ user_info.user_id, self.clock.time_msec()
+ )
  ):
+ # Raise the error if either an account validity module has determined
+ # the account has expired, or the legacy account validity
+ # implementation is enabled and determined the account has expired
  raise AuthError(
- 403, "User account has expired", errcode=Codes.EXPIRED_ACCOUNT
+ 403,
+ "User account has expired",
+ errcode=Codes.EXPIRED_ACCOUNT,
  )
 
  device_id = user_info.device_id

synapse/handlers/account_validity.py

@@ -19,7 +19,7 @@
 from email.mime.text import MIMEText
 from typing import TYPE_CHECKING, List, Optional, Tuple
 
-from synapse.api.errors import StoreError, SynapseError
+from synapse.api.errors import AuthError, StoreError, SynapseError
 from synapse.logging.context import make_deferred_yieldable
 from synapse.metrics.background_process_metrics import wrap_as_background_process
 from synapse.types import UserID
@@ -39,6 +39,8 @@ def __init__(self, hs: "HomeServer"):
  self.sendmail = self.hs.get_sendmail()
  self.clock = self.hs.get_clock()
 
+ self._new_account_validity = hs.get_account_validity()
+
  self._account_validity_enabled = (
  hs.config.account_validity.account_validity_enabled
  )
@@ -109,6 +111,19 @@ async def send_renewal_email_to_user(self, user_id: str) -> None:
  Raises:
  SynapseError if the user is not set to renew.
  """
+ # If a module supports sending a renewal email from here, do that, otherwise do
+ # the legacy dance.
+ try:
+ await self._new_account_validity.on_legacy_send_mail(user_id)
+ return
+ except NotImplementedError:
+ pass
+
+ if not self._account_validity_renew_by_email_enabled:
+ raise AuthError(
+ 403, "Account renewal via email is disabled on this server."
+ )
+
  expiration_ts = await self.store.get_expiration_ts_for_user(user_id)
 
  # If this user isn't set to be expired, raise an error.
@@ -253,6 +268,13 @@ async def renew_account(self, renewal_token: str) -> Tuple[bool, bool, int]:
  * An int representing the user's expiry timestamp as milliseconds since the
  epoch, or 0 if the token was invalid.
  """
+ # If a module supports triggering a renew from here, do that, otherwise do the
+ # legacy dance.
+ try:
+ return await self._new_account_validity.on_legacy_renew(renewal_token)
+ except NotImplementedError:
+ pass
+
  try:
  (
  user_id,

synapse/handlers/register.py

@@ -66,6 +66,7 @@ def __init__(self, hs: "HomeServer"):
  self.identity_handler = self.hs.get_identity_handler()
  self.ratelimiter = hs.get_registration_ratelimiter()
  self.macaroon_gen = hs.get_macaroon_generator()
+ self._account_validity = hs.get_account_validity()
  self._server_notices_mxid = hs.config.server_notices_mxid
  self._server_name = hs.hostname
 
@@ -657,6 +658,10 @@ async def register_with_store(
  shadow_banned=shadow_banned,
  )
 
+ # Only call the account validity module(s) on the main process, to avoid
+ # repeating e.g. database writes on all of the workers.
+ await self._account_validity.on_user_registration(user_id)
+
  async def register_device(
  self,
  user_id: str,

synapse/rest/client/v2_alpha/account_validity.py

@@ -14,7 +14,7 @@
 
 import logging
 
-from synapse.api.errors import AuthError, SynapseError
+from synapse.api.errors import SynapseError
 from synapse.http.server import respond_with_html
 from synapse.http.servlet import RestServlet
 
@@ -85,18 +85,14 @@ def __init__(self, hs):
  super().__init__()
 
  self.hs = hs
+ self.account_validity = hs.get_account_validity()
  self.account_activity_handler = hs.get_account_validity_handler()
  self.auth = hs.get_auth()
  self.account_validity_renew_by_email_enabled = (
  hs.config.account_validity.account_validity_renew_by_email_enabled
  )
 
  async def on_POST(self, request):
- if not self.account_validity_renew_by_email_enabled:
- raise AuthError(
- 403, "Account renewal via email is disabled on this server."
- )
-
  requester = await self.auth.get_user_by_req(request, allow_expired=True)
  user_id = requester.user.to_string()
  await self.account_activity_handler.send_renewal_email_to_user(user_id)