element-hq / element-hq/synapse

`POST /_synapse/mas/delete_user` always triggers deactivations as self-deactivations, despite MAS Admin API being used

Open Beginner friendly
#19,721 2 comments 0 reactions 0 assignees View on GitHub
A-Account-Deactivation A-NextGen-Auth T-Defect
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

As at v1.151.0

`MasDeleteUserResource` has:
```python
await self.deactivate_account_handler.deactivate_account(
user_id=user_id.to_string(),
erase_data=body.erase,
requester=create_requester(user_id=user_id), # <---
)
```

The marked line makes the deactivation trigger as a self-deactivation, even though it could have been requested by an administrator in MAS.

We should also set `by_admin` properly.

Contributor guide

Open the contributing guide

Research direction

Start at the MasDeleteUserResource implementation for POST /_synapse/mas/delete_user and trace the deactivate_account call, especially create_requester and the by_admin value. Confirm how administrator versus self-deactivation requests are represented, then update the request metadata so MAS administrator actions are marked by_admin and verify the resulting deactivation behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.