element-hq / element-hq/synapse
Expand on_user_login callback parameters to include login IP and user-agent
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
Matrix Synapse currently provides the `on_user_login` callback in the Modules API:
[on_user_login](https://element-hq.github.io/synapse/latest/modules/account_validity_callbacks.html#on_user_login)
This callback is extremely helpful for building custom login‑related logic, but the parameters it exposes are very limited. At the moment, module developers cannot access important contextual information about the login event, such as:
- the **login IP address**
- the **user-agent / device information**
Adding these fields would significantly expand what developers can build. For example, it would enable modules to implement security notifications similar to Telegram’s login alerts:
- “Your account was just logged in from IP X.X.X.X using device Y.”
- “If this wasn’t you, please remove the device in Settings.”
This is valuable for account security, auditing, and user transparency. It also enables custom risk scoring, anomaly detection, and device‑based policy enforcement.
### **Requested enhancement**
Please extend the `on_user_login` callback signature to include additional parameters, such as:
- `login_ip: str`
- `user_agent: str`
Or alternatively, provide a structured `LoginContext` object containing these fields.
### **Why this matters**
- Enables security notifications and login anomaly detection
- Allows modules to implement device‑aware policies
- Improves user trust by providing visibility into account activity
- Aligns Synapse with modern security practices used by major messaging platforms
Thank you for considering this enhancement. It would greatly improve the flexibility and security capabilities of Synapse modules.
Contributor guide
Research direction
Start with the linked Modules API documentation for on_user_login and trace its callback entry point in Synapse. Determine how login IP and user-agent context should be represented and exposed, then update the callback contract and add coverage showing modules receive both values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100