-- Strip PLAIN from SASL mechanisms for BOSH and WebSocket connections.
-- Direct c2s connections keep PLAIN for native XMPP client auth.

module:hook("stream-features", function(event)
    local origin, features = event.origin, event.features;

    local is_bosh = origin.bosh_version ~= nil;
    local is_websocket = origin.websocket_request ~= nil;

    if not (is_bosh or is_websocket) then
        return;
    end

    for i, child in ipairs(features.tags) do
        if child.name == "mechanisms" then
            local dominated = {};
            for j, mech in ipairs(child.tags) do
                if mech:get_text() == "PLAIN" then
                    table.insert(dominated, j);
                end
            end
            for k = #dominated, 1, -1 do
                local idx = dominated[k];
                table.remove(child.tags, idx);
                for m = #child, 1, -1 do
                    if type(child[m]) == "table" and child[m].name == "mechanism" and child[m]:get_text() == "PLAIN" then
                        table.remove(child, m);
                        break;
                    end
                end
            end
            break;
        end
    end
end, -1);