poljar
Persistent session
I saw that I with had to perform single-sign-on on every restart of weechat. Since the device id is already persisted I guess the same could be done for the access token?
https://github.com/poljar/weechat-matrix/blob/79805d02c4fae473dac41e377b9c97c74e4cff92/matrix/server.py#L1345
This would also allow to store an access token instead of a password, which would make revocation easier.
The problem with this is that we don't really have a secure place where to store the access token, /secure isn't programmatically available to us.
Users of course can store stuff in /secure manually and that's where passwords end up being.
But are passwords are not stored in plain text as well? Just storing an access token seems safer as it can be revoked.
They are not stored in plaintext, well not quite correct, you have the choice to store them in plaintext or you can store them encrypted using /secure. Take a look at the docs over here: https://weechat.org/files/doc/stable/weechat_user.en.html#secured_data
Things that we should consider for the Rust rewrite, if we're using SSO:
- Try to use the OS keystore and store the access token there
- If there isn't a keystore, store it in plaintext somewhere
What if the access token is provided by the user. There could be a script written that does the SSO once and prints the access token. This also has the advantage that it can be executed on a machine different from where weechat is running.