Repository: matrix-org/synapse

Issue:
Synapse accepts "user" instead of "username" in application service /register 
### Description

When an AS registers a user in Synapse, it seems happy to accept `"user"` instead of the specced `"username"` in the request body.

This is related to matrix-org/sytest#1017.

### Steps to reproduce

Up until matrix-org/sytest@ab7b8f00d0781bfef240b6b6b420291e7f13aa4d, Sytest was testing this way and the tests passed.

### Version information

- **Version**: Seemingly all versions



Discussion:
This may be related to old client behaviour, in which case changing it would be **hard**.
possibly, but it would have to be very old clients, and tbh we should be doing a better job at deprecating and sunsetting these things.
I'm assuming that this accepts both since sytest still passes? So this is really a matter of deprecating the old `user` field?
@clokep Yep. We need to do a similar thing to https://github.com/matrix-org/synapse/pull/9559 / https://github.com/matrix-org/synapse/pull/9548 here. Create a deprecation notice in the changelog and then remove the old support once enough time has passed.

Someone needs to do the investigation on whether anyone is still using `user` as well ~~(a good way to do so is via grepping matrix.org logs)~~. Nevermind, this is in the body of the request, which is not logged.
Note that #927 seems to have added a fallback to "username". I think this is really Synapse accepts "user" in addition to "username" FWIW (at least since #927).
@Half-Shot / @tulir Any idea if we can deprecate and remove this (similar to the legacy AS paths)?
And for all avoidance of doubt that this is really old:

* Added in https://github.com/matrix-org/matrix-spec/commit/8e75c5ed67e8acce5448a8f37858f011d167d56e
* Removed in https://github.com/matrix-org/matrix-spec/commit/9cb626982a4e88e8d365ea1f8a58c2c502a4362e

So this was way before r0.1.0 of the appservice spec.

I'm going to do a PR to deprecate this and we can remove it in the future.
This is deprecated and can be removed in v1.88.0. Since this was never specced I think we can just remove it.

Resolving patch:
diff --git a/synapse/rest/client/register.py b/synapse/rest/client/register.py
--- a/synapse/rest/client/register.py
+++ b/synapse/rest/client/register.py
@@ -462,9 +462,9 @@ async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
         # the auth layer will store these in sessions.
         desired_username = None
         if "username" in body:
-            if not isinstance(body["username"], str) or len(body["username"]) > 512:
-                raise SynapseError(400, "Invalid username")
             desired_username = body["username"]
+            if not isinstance(desired_username, str) or len(desired_username) > 512:
+                raise SynapseError(400, "Invalid username")
 
         # fork off as soon as possible for ASes which have completely
         # different registration flows to normal users
@@ -477,11 +477,6 @@ async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
                     "Appservice token must be provided when using a type of m.login.application_service",
                 )
 
-            # Set the desired user according to the AS API (which uses the
-            # 'user' key not 'username'). Since this is a new addition, we'll
-            # fallback to 'username' if they gave one.
-            desired_username = body.get("user", desired_username)
-
             # XXX we should check that desired_username is valid. Currently
             # we give appservices carte blanche for any insanity in mxids,
             # because the IRC bridges rely on being able to register stupid
@@ -489,7 +484,8 @@ async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
 
             access_token = self.auth.get_access_token_from_request(request)
 
-            if not isinstance(desired_username, str):
+            # Desired username is either a string or None.
+            if desired_username is None:
                 raise SynapseError(400, "Desired Username is missing or not a string")
 
             result = await self._do_appservice_registration(


Test patch: