element-hq / element-hq/synapse
Admin API cannot create deactivated users
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#12057](https://github.com/matrix-org/synapse/issues/12057).
---
### Description
When using [Admin API to create new users](https://matrix-org.github.io/synapse/develop/admin_api/user_admin_api.html#create-or-modify-account), the `deactivated` body attribute is ignored. According to the docs, "**If unspecified**, deactivation state will be left unchanged on existing accounts **and set to false for new accounts**". It seems like it's set to false for new accounts regardless of what the attribute is set to.
### Steps to reproduce
- Create a new user with the admin API:
```
PUT /_synapse/admin/v2/users/@jsmith:server {
displayname: 'Jacob Smith',
password: 'hello.code.reviewer',
deactivated: true
}
```
- The response indicates that the user is not deactivated, contrary to what was requested:
```
{
name: '@jsmith:server',
is_guest: 0,
admin: 0,
consent_version: null,
consent_server_notice_sent: null,
appservice_id: null,
creation_ts: 1645530918,
user_type: null,
deactivated: 0,
shadow_banned: 0,
displayname: 'Jacob Smith',
avatar_url: null,
threepids: [],
external_ids: []
}
```
- The user can login, even though they shouldn't be able to.
It'd be fair if that option was unsupported during user creation, but the docs don't indicate that it is. It should either work as expected, or be documented (and preferably return a 400 when used) not to.
### Version information
Synapse 1.51.0 running under docker with [homerunner](https://github.com/matrix-org/complement/tree/main/cmd/homerunner).
Contributor guide
Research direction
Start with the Admin API endpoint documented under “Create or modify account” and reproduce the PUT request with deactivated: true. Confirm that the response and subsequent login still show an active user; done means the requested deactivation is applied on creation, or the API rejects the unsupported attribute with a 400 and the documentation explains it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100