Xmpp 是否为用户管理真实的外部webapp并禁用？

我有一个网络应用程序，这是一个游戏，只有在一定的分数后，人们才能成为朋友，并应自动添加到彼此的好友列表

想弄清楚如何像这样处理Ejabberd的名册

• 防止任何用户自己添加任何其他人
• 仅允许webapp处理对名册的修改（buddylist）

使用像strophe这样的客户端JS库是不安全的，我需要服务器端方法将用户添加到其他用户中。有没有关于如何处理Ejabberd的想法

编辑：

---

好的，似乎ejabbard的mod_rest让rest完全访问（所有？）ejabbard方法

好的，所以在我走上正确的轨道后，我设法在一个小时内解决了这个问题

• 安装ejabberd
• 安装模架
• 安装mod_admin_extra

命令：

ejabberdctl help process_rosteritems

:

Command Name: process_rosteritems

  Arguments: action::string
             subs::string
             asks::string
             users::string
             contacts::string

  Returns: res::rescode

  Tags: roster 

  Description: List or delete rosteritems that match filtering options 

Explanation of each argument:
 - action: what to do with each rosteritem that matches all the filtering options
 - subs: subscription type
 - asks: pending subscription
 - users: the JIDs of the local user
 - contacts: the JIDs of the contact in the roster

Allowed values in the arguments:
 ACTION = list | delete
 SUBS = SUB[:SUB]* | any
 SUB = none | from | to | both
 ASKS = ASK[:ASK]* | any
 ASK = none | out | in
 USERS = JID[:JID]* | any
 CONTACTS = JID[:JID]* | any
 JID = characters valid in a JID, and can use the globs: *, ?, ! and [...]

This example will list roster items with subscription 'none', 'from' or 'to' that have any ask property, of local users which JID is in the virtual host 'example.org' 
and that the contact JID is either a bare server name (without user part) or that has a user part and the server part contains the word 'icq':
 list none:from:to any *@example.org *:*@*icq*