# services/communication/synapse-guest-register-module-configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: synapse-guest-register-module
data:
  guest_register.py: |
    import secrets

    import synapse.api.auth
    from synapse.api.errors import Codes, SynapseError
    from synapse.http.server import DirectServeJsonResource
    from synapse.http.servlet import parse_json_object_from_request


    class GuestRegisterResource(DirectServeJsonResource):
        def __init__(self, hs, shared_secret: str, header_name: str):
            super().__init__(clock=hs.get_clock())
            self._hs = hs
            self._shared_secret = shared_secret
            self._header_name = header_name

        async def _async_render_POST(self, request):  # noqa: N802
            provided = request.requestHeaders.getRawHeaders(self._header_name)
            if not provided or not secrets.compare_digest(provided[0], self._shared_secret):
                raise SynapseError(403, "Forbidden", errcode=Codes.FORBIDDEN)

            body = parse_json_object_from_request(request)
            initial_device_display_name = body.get("initial_device_display_name")
            if not isinstance(initial_device_display_name, str):
                initial_device_display_name = None

            reg = self._hs.get_registration_handler()
            address = request.getClientAddress().host

            user_id = await reg.register_user(make_guest=True, address=address)

            device_id = synapse.api.auth.GUEST_DEVICE_ID
            device_id, access_token, valid_until_ms, refresh_token = await reg.register_device(
                user_id,
                device_id,
                initial_device_display_name,
                is_guest=True,
            )

            result = {
                "user_id": user_id,
                "device_id": device_id,
                "access_token": access_token,
                "home_server": self._hs.hostname,
            }

            if valid_until_ms is not None:
                result["expires_in_ms"] = valid_until_ms - self._hs.get_clock().time_msec()

            if refresh_token is not None:
                result["refresh_token"] = refresh_token

            return 200, result


    class GuestRegisterModule:
        def __init__(self, config, api):
            shared_secret = config["shared_secret"]
            header_name = config.get("header_name", "x-guest-register-secret")
            path = config.get("path", "/_matrix/client/v3/_guest_register")

            hs = api._hs  # noqa: SLF001
            api.register_web_resource(path, GuestRegisterResource(hs, shared_secret, header_name))