element-hq / element-hq/synapse
`POST /_synapse/mas/delete_user` always triggers deactivations as self-deactivations, despite MAS Admin API being used
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
As at v1.151.0
`MasDeleteUserResource` has:
```python
await self.deactivate_account_handler.deactivate_account(
user_id=user_id.to_string(),
erase_data=body.erase,
requester=create_requester(user_id=user_id), # <---
)
```
The marked line makes the deactivation trigger as a self-deactivation, even though it could have been requested by an administrator in MAS.
We should also set `by_admin` properly.
Contributor guide
Research direction
Start at the MasDeleteUserResource implementation for POST /_synapse/mas/delete_user and trace the deactivate_account call, especially create_requester and the by_admin value. Confirm how administrator versus self-deactivation requests are represented, then update the request metadata so MAS administrator actions are marked by_admin and verify the resulting deactivation behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100