fix: Create appservice devices under the requested device ID (MSC4190) #2028
Merged
ginger
merged 1 commit from 2026-07-21 13:10:10 +00:00
Deniel9204/continuwuity:fix/2015-msc4190 into main
1 commit
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| 25264308ab |
fix: Use the requested device ID when an appservice creates a device
Some checks failed
Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 2s
Documentation / Build and Deploy Documentation (pull_request) Has been skipped
Checks / Prek / Check changed files (pull_request) Successful in 5s
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 5s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 1m6s
Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 6m26s
Checks / Prek / Check changed files (push) Successful in 4s
Documentation / Build and Deploy Documentation (push) Successful in 1m6s
Checks / Prek / Pre-commit & Formatting (push) Successful in 1m16s
Checks / Prek / Clippy and Cargo Tests (push) Failing after 6m10s
Release Docker Image / Build linux-amd64 (release) (push) Successful in 12m17s
Release Docker Image / Build linux-arm64 (max-perf) (push) Has been skipped
Release Docker Image / Build linux-arm64 (release) (push) Successful in 11m48s
Release Docker Image / Create Multi-arch Release Manifest (push) Successful in 15s
Release Docker Image / Create Max-Perf Manifest (push) Has been cancelled
Release Docker Image / Release Binaries (push) Has been cancelled
Release Docker Image / Mirror Images (push) Has been cancelled
Release Docker Image / Build linux-amd64 (max-perf) (push) Has been cancelled
The appservice branch of update_device_route (MSC4190 device creation) generated a random device ID instead of using the one from the request path, and dropped the requested display name. The PUT returned 200, but the device the appservice asked for never existed, so every subsequent request masquerading as that device failed with M_FORBIDDEN and one orphaned random-ID device was left behind per attempt. This made encrypted mautrix (bridgev2) bridges unable to start on OIDC-enabled servers, where MSC4190 is the only available device creation mechanism: /keys/upload failed on first start and /keys/query on every restart. Combined with the pre-1f5e178c3f behaviour (400 "Token conflicts with an existing appservice token"), MSC4190 device creation has never worked end-to-end in any release. Create the device under the requested ID and forward the requested display name. |
