Use custom stage UIA error for MAS cross-signing reset

Rather than 501 M_UNRECOGNISED
element-hq · Aug 9, 2024 · a4bc30b · a4bc30b
1 parent 46de0ee
commit a4bc30b
Show file tree

Hide file tree

Showing 4 changed files with 39 additions and 11 deletions.
diff --git a/changelog.d/17509.feature b/changelog.d/17509.feature
@@ -0,0 +1 @@
+Improve cross-signing upload when using [MSC3861](https://github.com/matrix-org/matrix-spec-proposals/pull/3861) to use a custom UIA flow stage, with web fallback support.
diff --git a/synapse/rest/client/auth.py b/synapse/rest/client/auth.py
@@ -27,7 +27,7 @@
 from synapse.api.constants import LoginType
 from synapse.api.errors import LoginError, SynapseError
 from synapse.api.urls import CLIENT_API_PREFIX
-from synapse.http.server import HttpServer, respond_with_html
+from synapse.http.server import HttpServer, respond_with_html, respond_with_redirect
 from synapse.http.servlet import RestServlet, parse_string
 from synapse.http.site import SynapseRequest
 
@@ -66,6 +66,17 @@ async def on_GET(self, request: SynapseRequest, stagetype: str) -> None:
         if not session:
             raise SynapseError(400, "No session supplied")
 
+        if (
+            self.hs.config.experimental.msc3861.enabled
+            and stagetype == "org.matrix.cross_signing_reset"
+        ):
+            config = self.hs.config.experimental.msc3861
+            if config.account_management_url is not None:
+                url = f"{config.account_management_url}?action=org.matrix.cross_signing_reset"
+            else:
+                url = config.issuer
+            respond_with_redirect(request, str.encode(url))
+
         if stagetype == LoginType.RECAPTCHA:
             html = self.recaptcha_template.render(
                 session=session,

diff --git a/synapse/rest/client/keys.py b/synapse/rest/client/keys.py
@@ -23,10 +23,13 @@
 import logging
 import re
 from collections import Counter
-from http import HTTPStatus
 from typing import TYPE_CHECKING, Any, Dict, Optional, Tuple
 
-from synapse.api.errors import Codes, InvalidAPICallError, SynapseError
+from synapse.api.errors import (
+    InteractiveAuthIncompleteError,
+    InvalidAPICallError,
+    SynapseError,
+)
 from synapse.http.server import HttpServer
 from synapse.http.servlet import (
     RestServlet,
@@ -409,11 +412,24 @@ async def on_POST(self, request: SynapseRequest) -> Tuple[int, JsonDict]:
                     else:
                         url = config.issuer
 
-                    raise SynapseError(
-                        HTTPStatus.NOT_IMPLEMENTED,
-                        "To reset your end-to-end encryption cross-signing identity, "
-                        f"you first need to approve it at {url} and then try again.",
-                        Codes.UNRECOGNIZED,
+                    # We use a dummy session ID as this isn't really a UIA flow, but we
+                    # reuse the same API shape for better client compatibility.
+                    raise InteractiveAuthIncompleteError(
+                        "dummy",
+                        {
+                            "session": "dummy",
+                            "flows": [
+                                {"stages": ["org.matrix.cross_signing_reset"]},
+                            ],
+                            "params": {
+                                "org.matrix.cross_signing_reset": {
+                                    "url": url,
+                                },
+                            },
+                            "msg": "To reset your end-to-end encryption cross-signing "
+                            f"identity, you first need to approve it at {url} and "
+                            "then try again.",
+                        },
                     )
             else:
                 # Without MSC3861, we require UIA.

diff --git a/tests/rest/client/test_keys.py b/tests/rest/client/test_keys.py
@@ -316,7 +316,7 @@ async def mocked_get_user_by_access_token(
                 },
             )
             self.assertEqual(
-                channel.code, HTTPStatus.NOT_IMPLEMENTED, channel.json_body
+                channel.code, HTTPStatus.UNAUTHORIZED, channel.json_body
             )
 
         # Pretend that MAS did UIA and allowed us to replace the master key.
@@ -350,7 +350,7 @@ async def mocked_get_user_by_access_token(
                 },
             )
             self.assertEqual(
-                channel.code, HTTPStatus.NOT_IMPLEMENTED, channel.json_body
+                channel.code, HTTPStatus.UNAUTHORIZED, channel.json_body
             )
 
         # Pretend that MAS did UIA and allowed us to replace the master key.
@@ -377,5 +377,5 @@ async def mocked_get_user_by_access_token(
                 },
             )
             self.assertEqual(
-                channel.code, HTTPStatus.NOT_IMPLEMENTED, channel.json_body
+                channel.code, HTTPStatus.UNAUTHORIZED, channel.json_body
             )