dendrite/userapi
Jason Robinson 597350a67f
Ensure appservices can auth as users in their namespaces (#1672)
* Ensure appservices can auth as users in their namespaces

Currently in Dendrite appservices can only auth as a user if the user was created by said appservice. This does not align with the appservices spec which specifically says:

> The application service may specify the virtual user to act as through use of a user_id query string parameter on the request. The user specified in the query string must be covered by one of the application service’s user namespaces.

https://matrix.org/docs/spec/application_service/r0.1.2#identity-assertion

In the case that a user has been created for example via manual registration but belongs to an appservice namespace, the current functionality does not allow appservices to auth as them. This PR fixes that by replacing the appservice ID check with a check against the appservice namespace.

This also matches Synapse functionality, which I confirmed to allow appservices to auth as a user in their namespace, irregardless of how the user was registered.

* Also allow appservice itself to auth with user_id

Appservice user_id + access token check needs to work both when user_id is the appservice and when appservice has the user in their user namespace.

Signed-off-by: Jason Robinson <mail@jasonrobinson.me>
2021-01-04 10:43:23 +00:00
..
api Update last seen on sync requests (#1593) 2020-11-20 11:29:02 +00:00
internal Ensure appservices can auth as users in their namespaces (#1672) 2021-01-04 10:43:23 +00:00
inthttp Update last seen on sync requests (#1593) 2020-11-20 11:29:02 +00:00
storage fix imports (#1665) 2020-12-21 14:27:01 +00:00
userapi.go Top-level setup package (#1605) 2020-12-02 17:41:00 +00:00
userapi_test.go Top-level setup package (#1605) 2020-12-02 17:41:00 +00:00