dataforge/fn_registry
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

feat(matrix): MAS migration helpers + 2 flows + 15 issues + capability group

Browse Source 
Helper functions (matrix-mas capability group):
- mas_client_register_bash_infra: register/sync OAuth clients via mas-cli
- mas_syn2mas_migration_bash_infra: dry-run + apply user migration to MAS
- synapse_msc3861_enable_go_infra: edit homeserver.yaml MSC3861 block (with diff)
- wellknown_oidc_patch_go_infra: patch well-known JSON with msc2965.authentication
- synapse_login_flows_check_go_infra: health-check post-migration login flows

Flows + issues for custom Matrix clients (PC + Android):
- 0010 matrix-client-pc: Wails + React+Mantine (issues 0147-0153)
- 0011 matrix-client-android: Kotlin + Compose (issues 0154-0161)
- 0162 enable MAS as auth provider (Synapse delegate) — EXECUTED on VPS
- 0163 custom admin panel propio (sustituye synapse-admin)

Production state (organic-machine.com):
- Synapse migrated SQLite -> Postgres
- MSC3861 active, password_config disabled
- 21 users + 41 access_tokens migrated via syn2mas
- 4 MAS clients registered (element, matrix_pc, matrix_android, admin_panel)
- synapse-admin container removed + Coolify route deleted
- well-known patched with org.matrix.msc2965.authentication

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
egutierrez
2026-05-24 22:53:33 +02:00
parent 3a8b4c2179
commit daef7ea190
35 changed files with 4491 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/capabilities/matrix-mas.md
+80
View File
@@ -0,0 +1,80 @@
---
group: matrix-mas
description: "Migración y operación de Synapse con Matrix Authentication Service (MAS). Cubre habilitación de MSC3861, verificación de login flows, parche .well-known OIDC, registro de clientes MAS y migración syn2mas."
tags: [matrix, mas, synapse, migration]
functions:
- synapse_login_flows_check_go_infra
- synapse_msc3861_enable_go_infra
- wellknown_oidc_patch_go_infra
- mas_client_register_bash_infra
- mas_syn2mas_migration_bash_infra
---
## Funciones
| ID | Firma corta | Qué hace |
|---|---|---|
| `synapse_login_flows_check_go_infra` | `SynapseLoginFlowsCheck(cfg) (result, error)` | Polling de `/_matrix/client/v3/login` hasta confirmar SSO/MAS activo y password desactivado |
| `synapse_msc3861_enable_go_infra` | `SynapseMsc3861Enable(cfg) (result, error)` | Habilita MSC3861 en `homeserver.yaml` vía SSH y reinicia Synapse |
| `wellknown_oidc_patch_go_infra` | `WellknownOidcPatch(cfg) (result, error)` | Parchea `.well-known/matrix/client` para añadir el bloque `m.authentication` de MAS |
| `mas_client_register_bash_infra` | `mas_client_register(ssh_host, container, config_file, dry_run)` | Registra un cliente OAuth2 en MAS vía `mas-cli manage register-client` |
| `mas_syn2mas_migration_bash_infra` | `mas_syn2mas_migration --ssh-host ... --mas-container ... --synapse-config-path ...` | Ejecuta la migración syn2mas de usuarios y sesiones de Synapse a MAS |
## Ejemplo canónico — verificar post-migración (issue 0162, paso 6)
```go
// 1. Habilitar MSC3861 en homeserver.yaml y reiniciar Synapse
resCfg := SynapseMsc3861Config{
SSHHost: "organic-machine",
HomserverPath: "/etc/synapse/homeserver.yaml",
RestartCommand: "systemctl restart matrix-synapse",
}
_, err := SynapseMsc3861Enable(resCfg)
if err != nil {
log.Fatalf("enable MSC3861: %v", err)
}
// 2. Parchar .well-known con bloque m.authentication
patchCfg := WellknownOidcPatchConfig{
WellknownPath: "/var/www/.well-known/matrix/client",
IssuerURL: "https://mas.organic-machine.com/",
}
_, err = WellknownOidcPatch(patchCfg)
if err != nil {
log.Fatalf("well-known patch: %v", err)
}
// 3. Verificar que login flows ya no exponen m.login.password
checkCfg := SynapseLoginFlowsCheckConfig{
HomeserverURL: "https://matrix-af2f3d.organic-machine.com",
ExpectedSsoIdpID: "oidc-mas",
MaxRetries: 10,
RetryDelaySeconds: 3,
}
res, err := SynapseLoginFlowsCheck(checkCfg)
if err != nil {
log.Fatalf("login flows check: %v\nlast response: %s", err, res.LastResponseJSON)
}
fmt.Printf("MAS confirmed after %d attempt(s). SSO: %v, Password: %v\n",
res.AttemptsUsed, res.SsoPresent, res.PasswordEnabled)
```
## Fronteras
- Este grupo cubre la **migración y validación** de Synapse→MAS. No cubre la configuración inicial de MAS ni la gestión de usuarios post-migración.
- Las funciones bash (`mas_client_register`, `mas_syn2mas_migration`) operan vía SSH sobre el host remoto — requieren acceso SSH configurado en `~/.ssh/config`.
- Las funciones Go (`synapse_login_flows_check`, `synapse_msc3861_enable`, `wellknown_oidc_patch`) pueden correr localmente o en pipelines CI.
## Prerequisitos
- Acceso SSH al host donde corre Synapse (alias en `~/.ssh/config`).
- MAS desplegado y accesible antes de ejecutar la migración.
- `ExpectedSsoIdpID` verificado contra `mas/config.yaml` → `clients[].id` del homeserver Synapse.
## Orden recomendado (issue 0162)
1. `mas_client_register` — registrar Synapse como cliente OAuth2 en MAS.
2. `synapse_msc3861_enable` — habilitar MSC3861 + reiniciar.
3. `wellknown_oidc_patch` — actualizar `.well-known`.
4. `synapse_login_flows_check` — confirmar convergencia post-restart.
5. `mas_syn2mas_migration` — migrar usuarios y sesiones existentes.