drwily/gogobee
1
0
Fork 0
mirror of https://github.com/prosolis/gogobee.git synced 2026-07-15 00:32:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add appservice auth mode behind AUTH_MODE; land device grant

Browse Source 
Two things, entangled in the working tree because 20d1f92 was mislabeled
(its message claimed "device grant" but it only deleted registration.yaml.example
and left the failed appservice+/sync hybrid in client.go):

1. Land the MAS OAuth 2.0 device grant that was running in prod but never
   committed: masauth.go + client.go rewrite. Bot stays a normal user so /sync
   works; refresh token persisted in data/mas_auth.json.

2. Add "appservice" as an alternate transport behind AUTH_MODE (default
   "masdevice" = unchanged device-grant path, instant rollback):
   - internal/bot/session.go: Session abstraction unifying both transports
     (OnEventType/Run/Stop); NewSession dispatches on AuthMode.
   - internal/bot/appservice.go: as_token auth (MAS-durable, no login/MFA/expiry),
     cryptohelper MSC4190 device creation, crypto machine fed from Synapse
     transaction pushes (to-device/device-lists/OTK) instead of /sync, inbound
     decrypt+redispatch, and lazy per-room StateStore backfill (encryption +
     members) so replies in encrypted rooms encrypt to the right recipients.
   - main.go: NewSession/sess.OnEventType/sess.Run in place of the /sync loop.
   - .env.example: AUTH_MODE, AS_REGISTRATION, AS_LISTEN_HOST/PORT, HOMESERVER_DOMAIN.

The appservice path fixes the earlier hybrid's fatal flaw (Synapse forbids AS
users from /sync) by using the transaction/push model. Bot-side only; Synapse
registration + experimental_features (msc2409/msc3202/msc4190) and E2EE cutover
are the next steps. Build + vet green (CGO=1 -tags goolm).
This commit is contained in:
prosolis
2026-07-03 17:11:58 -07:00
parent 20d1f92f97
commit 6387380d0a
9 changed files with 889 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
README.md
View File

@@ -91,14 +91,14 @@ Everything is configured through environment variables or a `.env` file.
|----------|-------------|
| `HOMESERVER_URL` | Matrix homeserver URL, e.g. `https://matrix.org` |
| `BOT_USER_ID` | Bot's Matrix user ID, e.g. `@gogobee:matrix.org` |
| `AS_TOKEN` | Appservice `as_token` from `registration.yaml` (see below) |
GogoBee authenticates as a Matrix **application service** rather than with a
password. The `as_token` is a homeserver-level credential that never expires and
is unaffected by Matrix Authentication Service (MAS) removing password login and
UIA. Device E2EE keys are created via MSC4190. See
[`registration.yaml.example`](registration.yaml.example) for the homeserver-side
setup (register the appservice, enable `msc4190_enabled`, then set `AS_TOKEN`).
GogoBee authenticates via the **Matrix Authentication Service (MAS) OAuth 2.0
device grant** — no password or token in the environment. On first run it prints
a verification URL and user code; approve it once in a browser while logged in
as `BOT_USER_ID`. The bot then stores a refresh token in `DATA_DIR/mas_auth.json`
and refreshes its access token silently for the life of the deployment. Delete
`data/mas_auth.json` to force re-authorization. Requires a homeserver with MAS
enabled (advertised via the `org.matrix.msc2965.authentication` well-known).
### Core (optional)