Add a config option to specify which homeservers can access Sydent

[H-Shay]

This PR adds a config option homeserver_allow_list which enables a user to specify a list of homeservers which Sydent will work with. The option defaults to allow all homeservers if not set. It works by disabling registration unless the homeserver associated with the registration request is in the homeserver_allow_list. The thinking behind this is that without registration an access token cannot be granted - and access tokens are necessary for most functions of Sydent. Fixes #565.

[richvdh]

Doesn't this rely on us turning off the v1 api (#338), which doesn't require an access token?

[erikjohnston]

Doesn't this rely on us turning off the v1 api (#338), which doesn't require an access token?

There's already a config for turning that off, which I believe we can use in the use case where we're interested in restricting by HS. Though we might want to error if you enable this option without disabling v1?

[richvdh]

Doesn't this rely on us turning off the v1 api (#338), which doesn't require an access token?

There's already a config for turning that off,

Ah, I didn't know about that. Might be good to link it from #338.

[H-Shay]

So the only config option I found referring to turning off the V1 API was this:

sydent/sydent/config/__init__.py

Lines 54 to 55 in c9980a9

	# Whether clients and homeservers can register an association using v1 endpoints.
	"enable_v1_associations": "true",

but it only governs one endpoint it seems (albeit an important one):

sydent/sydent/http/httpserver.py

Lines 129 to 130 in c9980a9

	if self.sydent.config.general.enable_v1_associations:
	threepid_v1.putChild(b"bind", ThreePidBindServlet(sydent))

Is this Good Enough:tm: or should I add a config option to turn off the rest of the VI API endpoints?

[erikjohnston]

Is this Good Enough or should I add a config option to turn off the rest of the VI API endpoints?

Oh, hmm. Yeah, we probably want to be able to disable all of it. Or maybe we can make specifying the homeserver config automagically disable API access if you're not authorized (i.e. disabling v1 API), but I'm not sure I like that.

[H-Shay]

Merged #566 into main.