Deniel9204/continuwuity
1
0
Fork 0
forked from continuwuation/continuwuity
Code Pull requests Activity
continuwuity/changelog.d/2015.bugfix.md
Deniel9204 25264308ab fix: Use the requested device ID when an appservice creates a device 
The appservice branch of update_device_route (MSC4190 device creation)
generated a random device ID instead of using the one from the request
path, and dropped the requested display name. The PUT returned 200, but
the device the appservice asked for never existed, so every subsequent
request masquerading as that device failed with M_FORBIDDEN and one
orphaned random-ID device was left behind per attempt.

This made encrypted mautrix (bridgev2) bridges unable to start on
OIDC-enabled servers, where MSC4190 is the only available device
creation mechanism: /keys/upload failed on first start and /keys/query
on every restart. Combined with the pre-1f5e178c3f behaviour (400
"Token conflicts with an existing appservice token"), MSC4190 device
creation has never worked end-to-end in any release.

Create the device under the requested ID and forward the requested
display name.
2026-07-21 08:21:09 +02:00

291 B
Raw Permalink Blame History

Fixed MSC4190 appservice device creation registering a random device ID instead of the requested one (and dropping the requested display name), which prevented encrypted mautrix bridges from starting on OIDC-enabled servers and leaked an orphan device on the bridge bot per startup attempt.