It's not clear whether /versions should fail if auth is invalid

[Kladki]

Link to problem area:

https://spec.matrix.org/v1.10/client-server-api/#get_matrixclientversions

Issue:

As of v1.10, the /versions endpoint has become the first to optionally accept authentication. However, it is not specified whether if authentication is provided and is invalid whether the server should return an error, or just perform like there was no authentication provided in the first place.

[richvdh]

@Kladki could you look at the changelog to see which MSC proposed this change, to see if there is more detail there?

[Kladki]

[MSC4026](matrix-org/matrix-spec-proposals#4026) introduced this change. Looking at the proposal itself and the surrounding discussion, I do not see what to do in this scenario mentioned anywhere.

[richvdh]

Mhmm. Seems like we need another MSC!

[Kladki]

There is also a similar issue with appservices, where in Conduit it also rejects the call to /versions if the user (either from the `user_id` query param or `sender_localpart` from the registration) does not exist, while Synapse again behaves as if no auth was provided. Should this also be part of the MSC, or should it be separate?