Tweak AS registration check and AS component HTTP clients #1785
Conversation
neilalexander
changed the title
| @@ -33,7 +34,7 @@ const userIDExistsPath = "/users/" | |||
|
|
|||
| // AppServiceQueryAPI is an implementation of api.AppServiceQueryAPI | |||
| type AppServiceQueryAPI struct { | |||
| HTTPClient *http.Client | |||
| HTTPClient *gomatrixserverlib.Client | |||
There was a problem hiding this comment.
Why are we using this client instead of a normal one? GMSL.Client is for federation traffic only I thought? ASes do not get sent signed traffic.
There was a problem hiding this comment.
gomatrixserverlib.Client is for normal requests (like what the media API uses to fetch media), gomatrixserverlib.FederationClient is for signed requests.
There was a problem hiding this comment.
What's the difference between GMSL.Client and net/http.Client?
There was a problem hiding this comment.
Not much, mostly just that gomatrixserverlib.Client has all of the correct wiring already to give it a timeout and/or disable TLS validation without needing to reinvent the wheel again in the AS code.
clientapi/routing/register.go
Outdated
|
|
||
| if resErr = validateUsername(r.Username); resErr != nil { | ||
| return *resErr | ||
| if r.Auth.Type == authtypes.LoginTypeApplicationService || accessTokenErr == nil { |
There was a problem hiding this comment.
I'd prefer it if we only look at the access token if the login type is set to AS?
There was a problem hiding this comment.
It turns out that this isn't always the case. It's another one of those "spec is vague" things but Synapse also treats all calls to /register with an access_token as if they are coming from an AS.
There was a problem hiding this comment.
Decided with @Half-Shot to instead enforce authtypes.LoginTypeApplicationService only.
|
I need to fix the sytests again to send |
|
This tweaks the check for AS registration vs normal registration, since it seems that AS users are incorrectly being subjected to normal username checks (e.g. not being allowed to have usernames prefixed with
_).This also makes the following changes to the appservice component:
DisableTLSValidationoption has been added to the appservice config section for appservice traffic only