@@ -303,4 +192,2 @@
 }
 
-#[admin_command]
-pub(super) async fn issue_password_reset_link(&self, username: String) -> Result {

@@ -67,6 +96,7 @@ impl IntoResponse for WebError {
 			context: TemplateContext {
 				// Statically set false to prevent error pages from being indexed.
 				allow_indexing: false,
+				csp_nonce: String::new(),

@@ -0,0 +23,4 @@
+            <form method="get" action="validate">
+                <input type="hidden" name="session_id" value="{{ session_id }}">
+                <input type="hidden" name="client_secret" value="{{ client_secret }}">
+                <button type="submit">Continue</button>

@@ -0,0 +21,4 @@
+    <form method="get" action="validate">
+        <input type="hidden" name="session_id" value="{{ session_id }}">
+        <input type="hidden" name="client_secret" value="{{ client_secret }}">
+        <button type="submit">Continue</button>

@@ -2354,0 +2367,4 @@
+	/// The language code to provide to clients along with the policy documents.
+	///
+	/// default: "en"
+	pub language: String,

@@ -31,3 +31,3 @@
 
 	self.write_str(&format!(
-		"New registration token issued: `{token}`. {}.",
+		"New registration token issued: `{token}` . {}.",

@@ -90,0 +57,4 @@
+		.await?;
+
+	let password = HashedPassword::new(
+		&password.unwrap_or_else(|| utils::random_string(AUTO_GEN_PASSWORD_LENGTH)),

@@ -288,0 +262,4 @@
+
+	let sender_user = identity.expect_sender_user()?;
+
+	if !services.config.allow_deactivation {

@@ -288,0 +263,4 @@
+	let sender_user = identity.expect_sender_user()?;
+
+	if !services.config.allow_deactivation {
+		return Err!(Request(Unauthorized(

@@ -0,0 +145,4 @@
+		})?;
+
+		let client_id = base64::prelude::BASE64_STANDARD
+			.encode(sha256::hash(serde_json::to_string(metadata).unwrap().as_bytes()));

@@ -0,0 +384,4 @@
+			.await
+			// This can only panic if the authorizing user suffered a spontaneous existence
+			// failure during authentication, which should(?) be impossible(?)
+			.expect("failed to create device");

@@ -437,0 +588,4 @@
+					// We already checked that the stage type is one that exists in the flow,
+					// so we can only get here if we ourselves served a flow with a stage that we
+					// don't understand.
+					panic!("tried to check an unsupported stage type: {unknown:?}");

@@ -215,0 +412,4 @@
+					if let Err(e) = user_id.validate_strict() {
+						// Unless we are in emergency mode, we should follow synapse's behaviour
+						// on not allowing things like spaces and UTF-8 characters in
+						// usernames