[Feature] XMPP javascript client plus ruby (vines) server #5073

zauberstuhl · 2014-07-14T20:00:33Z

Open :

~~mixed content; writing reverse proxy for rails application?!~~ using webserver as proxy solves it
login with user credentials from external (authentication works; something else broken?!)
pod federation (was not tested yet)
move vines configuration to diaspora.yml
make jsxc text translatable
history / offline messages (see Support offline messages XEP-0160 vines#19)
write huge amount of tests (see vines tests)

(to be extended)

I as a Pod Maintainer, what do I have to configure to make that work?

Apply the patch
If you are using ssl
- Apache: https://gist.github.com/Zauberstuhl/2d09330961614b12b642
- Nginx: https://gist.github.com/Zauberstuhl/ee95e1eacefa6ddbec6e (no tested)
- un-comment the bosh server variable "bosh_url" in diaspora.yml
Restart diaspora

That was the magic!

Your XMPP server sucks! I have my own already running!

Set "server" variable to false in diaspora.yml under chat section
Follow the web-server configuration above
Make sure the bosh url in diaspora.yml and of your xmpp server are the same
Restart diaspora

How can I add user/friends to my contact list?!

Diaspora has standards like XMPP presence:

both parties are not sharing with each other (equals XMPP 'none')
you are sharing with the contact but your contact doesn't (equals XMPP 'to')
the contact is sharing with you but you doesn't (equals XMPP 'from')
you and your contact are sharing with each other (equals XMPP 'both')

Jappix is only displaying "online" contacts and you can see the presence of the contact if you and your contact are sharing (XMPP 'both')!

Everything written under lib/vines* was forked from https://github.com/negativecode/vines
except for lib/vines/storage/diaspora.rb and some minor tweaks on the configuration process
We moved the xmpp server to a extra location.

jhass · 2014-07-14T21:12:52Z

Okay, my first issue with this: it's too big. I see two things to do to greatly reduce the size of the PR which means it'll be much much easier to review, it won't bloat the repo and codebase as much and it'll be much much easier to maintain.

First, make use of the vines gem. If that's for some reason impossible, make a fork of the gem and publish that. We can totally talk about adding a diaspora/vines repository for that.

The second thing is to make a Bower package for Jappix mini. That allows to pull it in as a gem via Rails assets. Here again we can totally talk about a diaspora/bower-jappix-mini repository.

jhass · 2014-07-14T21:14:33Z

config/diaspora.yml.example

+
+      ## You have a custom XMPP server running?
+      ## Then you can disable the internal server here:
+      server: true


Only add commented examples, defaults go into config/defaults.yml

zauberstuhl · 2014-07-14T21:21:22Z

@jhass agree. I already created and used https://rubygems.org/gems/diaspora-vines . I was not sure what the best way would be.. that was a 50:50 chance .. and I took the wrong.

Regarding bower, I was not aware of that. I will clean the PR up asap.

kpcyrd · 2014-07-15T05:22:30Z

mixed content; writing reverse proxy for rails application?!

This seems to be relevant to #4687

ominds · 2014-07-15T16:47:10Z

I had just prepared a dev environment and got myself qucik Ruby/ROR courses to implement chat. I was working on prosody with websocks (not BOSH), and was looking at using strophe.js to implement the chat.

With websocks, there shouldn't be a need for a reverse proxy, right? Or did I misunderstand what you meant by reverse proxy?

How can I help test this since my dev site is up and running? Mind you I'm a newbie with ROR and trying to get my feet wet and will definitely be asking dumb questions.

zauberstuhl · 2014-07-15T17:11:47Z

@ominds : No, that is a general problem (more a security aspect then a problem). If you load from a secure connection un-encrypted content (see mixed content).

ghost · 2014-07-15T18:35:44Z

@jhass : the problem with bower is : is css files are packaged in a bower package with all tha jappix files, how could I use the inheritance capacity of SCSS to make the UI consistent with the D* design, since the stylesheets aren't in the same directory ?

jhass · 2014-07-15T18:41:38Z

I'd rather like to see overrides (see CSS specificity), that'll be much easier to maintain.

ghost · 2014-07-15T18:49:22Z

I might be a possibility, but a CSS file standing anlone in the middle of others and related to no specific file other than this package's, it would be awkward, no ?

kpcyrd · 2014-07-15T19:01:24Z

@jhass do you think a proxy for mixed content would be merged? If so, I'd start working on this issue.

jhass · 2014-07-15T21:45:39Z

I don't know. I've no doubts about support for being able to use such a thing, but it should be entirely optional IMO.

zauberstuhl · 2014-07-15T22:40:34Z

I'll move the config/vines/ directory tomorrow

Vines is located here diaspora-vines (rubygems)
Jappix is located here bower-jappix-mini (rails-assets)

We should move that to an official repo later!

zauberstuhl · 2014-07-15T22:46:59Z

script/server

+if [ "$chat" = "true" ] && [ "$chat_server" = "true" ]
+then
+  xmpp="xmpp=1,"
+  if [ "$chat_bosh_url" = "" ]


and ssl is true

ominds · 2014-07-15T23:10:13Z

A quick q, during my checks on prosody I found two ways for communication. Via bosh and via websockets which is more efficient and solves the cross-domain issues. Is there some reason why bosh was chosen here?

Here's the draft spec, it's implemented by many XMPP servers

http://tools.ietf.org/html/draft-ietf-xmpp-websocket-07

Also, how are you handling the cross-domain issue. CORS?

zauberstuhl · 2014-07-15T23:40:05Z

@ominds do not mix "cross-domain" with "mixed-content" and with websockets it seams to be the same if you connect from a secure to an unsecure connection:

[Exception... "The operation is insecure." code: "18" nsresult: "0x80530012 (SecurityError)" location: "<unknown>"]

Which really makes sense cause it is a security aspect.
You can only pass that by using secure <-> secure (via proxy or separate certificate)!

ominds · 2014-07-16T00:00:58Z

@zauberstuhl I understand the difference. mixed-content happens when a secure page contains resources from insecure pages (images, etc). Cross domain is the restriction for communication between different domains via XHR calls.

I was just wondering why you went with BOSH rather than websockets which are both supported by most XMPP servers. Websockets being better in performance.

jhass · 2014-07-16T07:38:52Z

Vines is located here diaspora-vines (rubygems)

Please change the hompage link to your repo or diasporafoundation.org.

ghost · 2014-07-19T21:23:37Z

I have some concerns about the Jappix Mini code. I'd like to implements a few features and fix some issues on Jappix Mini but this would require to deeply modify the Jappix Mini Origina code.

I wanted to know any element could interfere with these plans ?

jhass · 2014-07-19T22:01:02Z

I'd still like to see that as a fork and maintained in a separate repository, maybe we can eventually even upstream some of these changes.

ghost · 2014-07-19T22:04:43Z

Sorry, I don't understand what you mean. A fork of what ? Jappi Mini ? Maintained in a searate repository from... ?

jhass · 2014-07-20T09:37:54Z

Yes, a fork of Jappix Mini, maintained in a separate repository from the one this PR goes to ;)

Probably also a separate bower package then to make clear to others that it's a modified version.

ghost · 2014-07-20T09:42:08Z

Oh yes ! Well Zauberstuhl did a bower package.
So this package, as soon as it is presented as a fork, does not interfere with deeply modify it ?
Great. I think we should specify the original license though ?

jhass · 2014-07-20T10:35:03Z

Yeah, keeping the license will cause the least headaches. I still would look into at least renaming that package though.

ghost · 2014-07-20T10:37:22Z

Into what ? bower-jappixmini-diaspora ?

jhass · 2014-07-20T11:18:11Z

For example, just making sure this is not simply a packaged upstream.

ghost · 2014-07-20T11:24:42Z

Ok, we are going to do it. Thanks for the advice.

ominds · 2014-08-01T19:38:26Z

I pulled this and started the server, it seems vines is started, but there's nothing in the UI for chat. Sorry if this is a newbie question but I'm very new to ROR. Is there something else I should be doing to see chat running?

zauberstuhl · 2014-08-03T10:25:09Z

@ominds you executed bundler after pulling?

On default none is permitted to chat with you. You have to set extra privilege for an aspect.

* create a new token on a new session * delete the current token on session exit

* add to contacts header for later modification * add to aspect creation box

* add jsxc helper file

If you try to connect from a secure connection to a insecure connection; Most modern browser block the request and flag it as mixed-content.

zauberstuhl · 2014-11-13T14:41:38Z

I cleaned up. I am not sure why

rspec ./spec/controllers/notifications_controller_spec.rb:125 # NotificationsController#read_all marks all notifications in the current filter as read

is still failing it works for me locally.

who-cares · 2014-11-15T02:33:17Z

Implementing OTR is best left to a browser extension or native client because if the javascript is served by the pod it is trivial to serve malicious js to extract your password/private key. You shouldn't give people a false sense of security. Maybe some sort of cryptocat integration could be investigated? [cryptocat itself used to have a web version that was vulnerable to this very attack which is why they moved to browser extensions and native apps].

jhass · 2014-11-15T15:58:19Z

Okay, let's break stuff.

I'm merging this now to open it to a wider test audience as well as to ease contribution and review of further development. I still consider this highly experimental and will revert the merge if there's any indication that it influences normal operation.

[Feature] XMPP javascript client plus ruby (vines) server

ghostnegotiator · 2014-11-15T16:47:53Z

Christmas came early!!!

jaywink · 2014-11-15T17:16:08Z

Great work @zauberstuhl and everybody involved!!

Flaburgan · 2014-11-15T17:31:47Z

Yeepee!! I think I'll wait ~one week before merging this in diaspora-fr, the database is too huge to be the first pod to add this. So other podmins running develop, please post your feedback!

Flaburgan · 2014-11-15T18:06:34Z

diaspora.yml indicates:

The internal xmpp server does not support https

and even if we implement it, we would ran into certificate issues.

The problem with mixed-content is described here:

https://github.com/Zauberstuhl/diaspora/issues/6

The url is not correct anymore.

zauberstuhl mentioned this pull request Jul 14, 2014

Diaspora api #4554

Closed

jhass reviewed Jul 14, 2014
View reviewed changes

zauberstuhl reviewed Jul 15, 2014
View reviewed changes

Lukas Matt and others added 20 commits November 13, 2014 11:15

Add vines, jsxc and devise token dependencies

78100c6

Include jsxc deps and initialize the client on login

50a7541

Set chat-flag for every aspect manually

38a238e

On default none is permitted to chat with you. You have to set extra privilege for an aspect.

Add jsxc to assets list

4d14e7d

Add toggle_chat_privilege to aspect controller

ae582e4

Implement token authentication

24e1732

* create a new token on a new session * delete the current token on session exit

Chat privilege checkbox

735b10c

* add to contacts header for later modification * add to aspect creation box

Modify diaspora config file and add defaults

94318ca

Add vines README file for cert instructions

b54fb64

Add locales for chat privilege function

556190b

Include the chat front-end if chat is enabled

ea11133

* add jsxc helper file

Update .gitignore for vines cert directory

c7d9d88

Add vines as foreman task

0956088

Start vines if chat and server is enabled

9f827b9

Print a warning unless they use a proxy

0308b70

If you try to connect from a secure connection to a insecure connection; Most modern browser block the request and flag it as mixed-content.

Test token authentication; should allow it

46097ba

Test jsxc helper spec; should respond with correct url

32dcf8c

Test chat privilege option; should replace text/icon on trigger

bb18c8e

Fixed privilege spec; use correct container for trigger event

2712b41

Swap aspect chat privilege title

e40cf25

jhass merged commit e40cf25 into diaspora:develop Nov 15, 2014

jhass added a commit that referenced this pull request Nov 15, 2014

Merge pull request #5073 from Zauberstuhl/xmpp_chat_feature

7f51d87

[Feature] XMPP javascript client plus ruby (vines) server

zauberstuhl mentioned this pull request Nov 15, 2014

Chat todos, notes and improvements #5398

Closed

9 tasks

[Feature] XMPP javascript client plus ruby (vines) server #5073

[Feature] XMPP javascript client plus ruby (vines) server #5073

Conversation

zauberstuhl commented Jul 14, 2014

jhass commented Jul 14, 2014

jhass Jul 14, 2014

Choose a reason for hiding this comment

zauberstuhl commented Jul 14, 2014

kpcyrd commented Jul 15, 2014

ominds commented Jul 15, 2014

zauberstuhl commented Jul 15, 2014

ghost commented Jul 15, 2014

jhass commented Jul 15, 2014

ghost commented Jul 15, 2014

kpcyrd commented Jul 15, 2014

jhass commented Jul 15, 2014

zauberstuhl commented Jul 15, 2014

zauberstuhl Jul 15, 2014

Choose a reason for hiding this comment

ominds commented Jul 15, 2014

zauberstuhl commented Jul 15, 2014

ominds commented Jul 16, 2014

jhass commented Jul 16, 2014

ghost commented Jul 19, 2014

jhass commented Jul 19, 2014

ghost commented Jul 19, 2014

jhass commented Jul 20, 2014

ghost commented Jul 20, 2014

jhass commented Jul 20, 2014

ghost commented Jul 20, 2014

jhass commented Jul 20, 2014

ghost commented Jul 20, 2014

ominds commented Aug 1, 2014

zauberstuhl commented Aug 3, 2014

zauberstuhl commented Nov 13, 2014

who-cares commented Nov 15, 2014

jhass commented Nov 15, 2014

ghostnegotiator commented Nov 15, 2014

jaywink commented Nov 15, 2014

Flaburgan commented Nov 15, 2014

Flaburgan commented Nov 15, 2014

The internal xmpp server does not support https

and even if we implement it, we would ran into certificate issues.

The problem with mixed-content is described here:

https://github.com/Zauberstuhl/diaspora/issues/6