Dedicated MAS API #18520

sandhose · 2025-06-06T08:45:10Z

This introduces a dedicated API for MAS to consume. Companion PR on the MAS side: element-hq/matrix-authentication-service#4801

This has a few advantages over the previous admin API:

it works on workers (this will be documented once we stabilise MSC3861 as a whole)
it is more efficient because more focused
it propagates trace contexts from MAS
it is only accessible to MAS (through the shared secret) and will let us remove the weird hack that made this token 'admin' with a ghost '@__oidc_admin:' user

The next MAS version should support it, but will be opt-in. The version after that should use this new API by default

MadLittleMods

Haven't verified the MAS side and whether these are useful.

Appears sane though. Just a bunch of user utilities available as MAS-only endpoints that can be served by workers (I assume).

MadLittleMods · 2025-07-18T23:01:41Z

synapse/api/auth/msc3861_delegated.py

            # XXX: This is a temporary solution so that the admin API can be called by
            # the OIDC provider. This will be removed once we have OIDC client
            # credentials grant support in matrix-authentication-service.


Has this plan changed? It looks like the new approach uses a shared secret

This will likely get refactored as part of stabilising MAS support, getting it out of experimental features. The plan is to keep using a shared secret both ways as it simplifies configuration and avoids weird roundtrips

synapse/rest/synapse/mas/_base.py

MadLittleMods · 2025-07-18T23:21:10Z

synapse/rest/synapse/mas/devices.py

+
+        self.device_handler = hs.get_device_handler()
+
+    class PostBody(BaseModel):


Suggested change

class PostBody(BaseModel):

class PostBody(RequestBodyModel):

(applies elsewhere)

Have done that in c1f666e (except for the query user response as it's a response, not a request 🤷)

(except for the query user response as it's a response, not a request 🤷)

We can still use ParseModel for anything else.

For the query user response case, I'm not sure Pydantic is thing to use since we're not parsing anything. And since we convert it to a dict anyway, perhaps it should be a TypedDict 🤷

You're right, have done that in 7e8c19e

synapse/rest/synapse/mas/devices.py

synapse/rest/synapse/mas/users.py

MadLittleMods · 2025-07-18T23:33:38Z

synapse/rest/synapse/mas/users.py

+                    user_id=user_id.to_string()
+                )
+                current_email_list = {
+                    t.address for t in current_threepid_list if t.medium == "email"


"email" could be a constant

There is no global constant to grab, so I made it a local one in f91a698

Better than before but ideally, we'd probably share this everywhere. We could add it to synapse/api/constants.py

Doesn't have to be a thing to change in this PR

tests/rest/synapse/mas/test_devices.py

tests/rest/synapse/mas/test_users.py

Co-Authored-By: Eric Eastwood <erice@element.io>

Also add a doc comment explaining what the method does.

Co-authored-by: Eric Eastwood <erice@element.io>

…ith olddeps

sandhose · 2025-07-21T15:01:43Z

@MadLittleMods thanks for the review! I think I fixed everything you've raised, plus fixed the test suite not running on olddeps

MadLittleMods · 2025-07-21T15:10:31Z

synapse/rest/synapse/mas/_base.py

+        # Importing this module requires authlib, which is an optional
+        # dependency but required if msc3861 is enabled
+        from synapse.api.auth.msc3861_delegated import MSC3861DelegatedAuth


Looks good. This is backed up by

synapse/synapse/config/experimental.py

Lines 116 to 122 in 875269e

# Only allow enabling MSC3861 if authlib is installed

if value and not HAS_AUTHLIB:

raise ConfigError(

"MSC3861 is enabled but authlib is not installed. "

"Please install authlib to use MSC3861.",

("experimental", "msc3861", "enabled"),

)

synapse/rest/synapse/mas/users.py

Co-authored-by: Eric Eastwood <erice@element.io>

sandhose force-pushed the quenting/dedicated-mas-api branch from 38c521d to bd442af Compare July 16, 2025 15:39

github-actions bot deployed to PR Documentation Preview July 16, 2025 15:40 Active

github-actions bot deployed to PR Documentation Preview July 17, 2025 17:25 Active

sandhose force-pushed the quenting/dedicated-mas-api branch from 8c26530 to 46a4f9d Compare July 18, 2025 14:18

sandhose mentioned this pull request Jul 18, 2025

Use the new dedicated Synapse API element-hq/matrix-authentication-service#4801

Merged

sandhose added 4 commits July 18, 2025 21:23

Dedicated API for MAS -> Synapse communication

d32c32b

Tests for the dedicated MAS users APIs

23e7b88

Tests for the dedicated MAS devices APIs

9ba9989

Newsfile

25fade5

sandhose force-pushed the quenting/dedicated-mas-api branch from 46a4f9d to 25fade5 Compare July 18, 2025 19:24

sandhose changed the title ~~WIP: dedicated MAS API~~ Dedicated MAS API Jul 18, 2025

sandhose marked this pull request as ready for review July 18, 2025 19:28

sandhose requested a review from a team as a code owner July 18, 2025 19:28

Add doc comments for all new endpoints

cfb1ff4

MadLittleMods approved these changes Jul 18, 2025

View reviewed changes

sandhose and others added 7 commits July 21, 2025 09:39

Fix starting up & tests if authlib is not installed

86e8435

Change test order for consistency

ae7c6ff

Fix test comment accuracy

f1647b7

Rename endpoint create_device -> upsert_device

eb5e7a6

Put 'email' in a constant

f91a698

Rename variable for clarity

47c0161

Co-Authored-By: Eric Eastwood <erice@element.io>

Expand on why we log early

31b32b3

sandhose force-pushed the quenting/dedicated-mas-api branch from 6567a84 to 31b32b3 Compare July 21, 2025 08:05

sandhose and others added 6 commits July 21, 2025 10:06

Use RequestBodyModel instead of BaseModel

c1f666e

Rename assert_mas_request -> assert_request_is_from_mas

48d7d7b

Also add a doc comment explaining what the method does.

Fix typo in tests

2eb98c0

Co-authored-by: Eric Eastwood <erice@element.io>

Skip MAS API tests if authlib is not available

cc6da94

Remove broken test case

02bf776

Import the MemoryReactor from the right place to keep compatibility w…

1fa7898

…ith olddeps

sandhose requested a review from MadLittleMods July 21, 2025 15:01

MadLittleMods reviewed Jul 21, 2025

View reviewed changes

MadLittleMods approved these changes Jul 21, 2025

View reviewed changes

Use a TypedDict instead of a BaseModel for MasQueryUserResource.Response

7e8c19e

sandhose enabled auto-merge (squash) July 21, 2025 15:33

MadLittleMods reviewed Jul 21, 2025

View reviewed changes

synapse/rest/synapse/mas/users.py Outdated Show resolved Hide resolved

Use keyword args with the TypedDict

f8b4656

Co-authored-by: Eric Eastwood <erice@element.io>

sandhose merged commit 8a4e2e8 into develop Jul 21, 2025
44 checks passed

sandhose deleted the quenting/dedicated-mas-api branch July 21, 2025 16:17

MadLittleMods mentioned this pull request Jul 23, 2025

Fix deactivation running off the main process #18716

Open


		self.device_handler = hs.get_device_handler()

		class PostBody(BaseModel):

	# Only allow enabling MSC3861 if authlib is installed
	if value and not HAS_AUTHLIB:
	raise ConfigError(
	"MSC3861 is enabled but authlib is not installed. "
	"Please install authlib to use MSC3861.",
	("experimental", "msc3861", "enabled"),
	)

Dedicated MAS API #18520

Dedicated MAS API #18520

Uh oh!

Conversation

sandhose commented Jun 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MadLittleMods left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MadLittleMods Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sandhose commented Jul 21, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sandhose commented Jun 6, 2025 •

edited

Loading

MadLittleMods Jul 21, 2025 •

edited

Loading