user_password_login (compatibility) does not support fully qualified Matrix user IDs

[spantaleev]

The issue appears to be with this code: https://github.com/element-hq/matrix-authentication-service/blob/main/crates/handlers/src/compat/login.rs#L378-L395

As described in the spec for m.id.user, the user identifier (in the username variable) can either be the fully qualified Matrix user ID, or just the localpart of the user ID.

The code passes username directly to the repository's find_by_username which does a lookup against the database. The database only contains the localpart of user IDs, so matching only works with that.

When the user_password_login function is invoked with a username which is a fully qualified Matrix user ID, it will fail to find the user and will report it as missing.

I'm hitting this bug with anoadragon453/matrix-reminder-bot (built on matrix-nio), which:

• insists on dealing with fully-qualified user IDs (trying to configure matrix.user_id with a localpart user ID makes it raise this error: matrix_reminder_bot.errors.ConfigError: matrix.user_id must be in the form @name:domain)
• passes the fully-qualified user ID to the /_matrix/client/v3/login endpoint

Here's an example curl request that would trigger this issue:

curl -X POST \
http://matrix-authentication-service:8080/_matrix/client/v3/login \
-H "Content-Type: application/json" \
-d '{"type": "m.login.password", "identifier": {"type": "m.id.user", "user": "@bot.matrix-reminder-bot:example.com"}, "password": "...", "device_id": "REMINDER", "initial_device_display_name": "Reminder Bot"}'

Matrix Authentication Service would respond to this request with a generic response:

{"errcode": "M_FORBIDDEN", "error": "Invalid username/password"}

.. while actually logging the real issue:

ERROR http.server.request{otel.kind="server" otel.name="POST /_matrix/client/:version/login" network.protocol.name="http" network.protocol.version="1.1" http.request.method="POST" url.path="/_matrix/client/v3/login" url.scheme="http" http.route="/auth/_matrix/client/:version/login" user_agent.original="Python/3.12 aiohttp/3.10.10"}:handlers.compat.login.post: mas_handlers::compat::login: crates/handlers/src/compat/login.rs:219: error=user not found

matrix-reminder-bot (or rather, matrix-nio) would then be extra unhelpful and choke on the HTTP response:

nio.responses [WARNING] Error validating response: 'user_id' is a required property

If identifier.user in the JSON payload is adjusted to be a localpart user ID, Matrix Authentication Service successfully authentications the user.