element-hq / element-hq/dendrite
When registering using the User-Interactive Authentication API and without providing a username, the numeric user id generated by dendrite is rejected as reserved
- Dominant language
- Go
- Stars
- 965
- Forks
- 101
- PR merge metrics
- No merged PRs in 30d
Description
*This issue was originally created by [**@CicadaCinema**](https://github.com/CicadaCinema) at .*
### Background information
- **Dendrite version or git SHA**: v0.13.0
- **SQLite3 or Postgres?**: Postgres
- **Running in Docker?**: No
- **`go version`**: go1.18.1 linux/arm64
- **Client used (if applicable)**: N/A
### Description
https://github.com/matrix-org/dendrite/pull/470 introduced a feature to automatically generate a user id when the user does not provide a username. But when following the User-Interactive Authentication API flow, this is generated in the first request to `/register` (the one with no `auth` parameter). So when the client hits `/register` again, the previously-generated numeric id is rejected as being reserved.
Affected users are those which do not provide an `auth` parameter on the first call to `/register`, as well as not providing a username.
### Steps to reproduce
```python
>>> initial_resp = requests.post(url+"/_matrix/client/v3/register", json={"password": ""})
>>> initial_resp.status_code
401
>>> initial_resp.text
'{"flows":[{"stages":["m.login.dummy"]}],"completed":[],"params":{},"session":""}'
>>> subsequent_resp = requests.post(url+"/_matrix/client/v3/register", json={"password": "", "auth":{"session":"", "type": "m.login.dummy"}})
>>> subsequent_resp.status_code
400
>>> subsequent_resp.text
'{"errcode":"M_INVALID_USERNAME","error":"Numeric user IDs are reserved"}'
```
### Non-reproduction
Clients providing an `auth` parameter can complete registration in one request and are unaffected:
```python
>>> resp = requests.post(url+"/_matrix/client/v3/register", json={"password": "", "auth":{"type":"m.login.dummy"}})
>>> resp.status_code
200
>>> resp.text
'{"user_id":"@3:","access_token":"","device_id":""}'
```
Contributor guide
Assessment
This issue has not been assessed yet.