init

ansible/roles/prosody/files/mod_sasl_oauthbearer_only_bosh.lua

@@ -0,0 +1,35 @@
+-- Strip PLAIN from SASL mechanisms for BOSH and WebSocket connections.
+-- Direct c2s connections keep PLAIN for native XMPP client auth.
+
+module:hook("stream-features", function(event)
+    local origin, features = event.origin, event.features;
+
+    local is_bosh = origin.bosh_version ~= nil;
+    local is_websocket = origin.websocket_request ~= nil;
+
+    if not (is_bosh or is_websocket) then
+        return;
+    end
+
+    for i, child in ipairs(features.tags) do
+        if child.name == "mechanisms" then
+            local dominated = {};
+            for j, mech in ipairs(child.tags) do
+                if mech:get_text() == "PLAIN" then
+                    table.insert(dominated, j);
+                end
+            end
+            for k = #dominated, 1, -1 do
+                local idx = dominated[k];
+                table.remove(child.tags, idx);
+                for m = #child, 1, -1 do
+                    if type(child[m]) == "table" and child[m].name == "mechanism" and child[m]:get_text() == "PLAIN" then
+                        table.remove(child, m);
+                        break;
+                    end
+                end
+            end
+            break;
+        end
+    end
+end, -1);