element-hq / element-hq/synapse

`is_user_admin` Module API returns wrong result when the experimental MSC3861 implementation is enabled

Open
#17,485 0 comments 0 reactions 0 assignees View on GitHub
A-Admin-API A-Modules O-Occasional S-Major T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

When the experimental MSC3861 implementation is enabled through the `experimental_features.msc3891` option, user authentication is delegated to an external auth provider.

The `is_user_admin` module API method is used by Synapse modules to determine whether the user making a request is a Synapse Admin or not. Currently, this method only checks the local DB to see if a user is an admin:

https://github.com/element-hq/synapse/blob/568051c0f07393b786b9d813a1db53dd332c9fc2/synapse/module_api/__init__.py#L641-L652

If MSC3861 support is enabled, users who are admins will have their requests rejected by Synapse modules which use this method to gate access to endpoints.

Experimental MSC3861 support was implemented in Synapse in https://github.com/matrix-org/synapse/pull/15582.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.