element-hq / element-hq/synapse
`is_user_admin` Module API returns wrong result when the experimental MSC3861 implementation is enabled
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
When the experimental MSC3861 implementation is enabled through the `experimental_features.msc3891` option, user authentication is delegated to an external auth provider.
The `is_user_admin` module API method is used by Synapse modules to determine whether the user making a request is a Synapse Admin or not. Currently, this method only checks the local DB to see if a user is an admin:
https://github.com/element-hq/synapse/blob/568051c0f07393b786b9d813a1db53dd332c9fc2/synapse/module_api/__init__.py#L641-L652
If MSC3861 support is enabled, users who are admins will have their requests rejected by Synapse modules which use this method to gate access to endpoints.
Experimental MSC3861 support was implemented in Synapse in https://github.com/matrix-org/synapse/pull/15582.
Contributor guide
Assessment
This issue has not been assessed yet.