|
|
|
@ -1,4 +1,4 @@
|
|
|
|
# MSC3866: `M_USER_NOT_APPROVED` error code
|
|
|
|
# MSC3866: `M_USER_AWAITING_APPROVAL` error code
|
|
|
|
|
|
|
|
|
|
|
|
Over the past few years, there has been some demand for the ability to let
|
|
|
|
Over the past few years, there has been some demand for the ability to let
|
|
|
|
administrators of homeservers approve any new user created on their homeserver
|
|
|
|
administrators of homeservers approve any new user created on their homeserver
|
|
|
|
@ -9,9 +9,9 @@ additional details such as an email address.
|
|
|
|
|
|
|
|
|
|
|
|
## Proposal
|
|
|
|
## Proposal
|
|
|
|
|
|
|
|
|
|
|
|
This document proposes the addition of a new `M_USER_NOT_APPROVED` error code to
|
|
|
|
This document proposes the addition of a new `M_USER_AWAITING_APPROVAL` error
|
|
|
|
the Matrix specification. This error code can be returned in two scenarios:
|
|
|
|
code to the Matrix specification. This error code can be returned in two
|
|
|
|
registration and login.
|
|
|
|
scenarios: registration and login.
|
|
|
|
|
|
|
|
|
|
|
|
This proposal does not describe a way for the homeserver to alert an
|
|
|
|
This proposal does not describe a way for the homeserver to alert an
|
|
|
|
administrator about new accounts that are waiting to be reviewed, or a way for
|
|
|
|
administrator about new accounts that are waiting to be reviewed, or a way for
|
|
|
|
@ -25,11 +25,11 @@ admin room).
|
|
|
|
When a user successfully registers on a homeserver that is configured so that
|
|
|
|
When a user successfully registers on a homeserver that is configured so that
|
|
|
|
new accounts must be approved by an administrator, the final `POST
|
|
|
|
new accounts must be approved by an administrator, the final `POST
|
|
|
|
/_matrix/client/v3/register` request is responded to with a `403 Forbidden`
|
|
|
|
/_matrix/client/v3/register` request is responded to with a `403 Forbidden`
|
|
|
|
response that includes the `M_USER_NOT_APPROVED` error code. For example:
|
|
|
|
response that includes the `M_USER_AWAITING_APPROVAL` error code. For example:
|
|
|
|
|
|
|
|
|
|
|
|
```json
|
|
|
|
```json
|
|
|
|
{
|
|
|
|
{
|
|
|
|
"errcode": "M_USER_NOT_APPROVED",
|
|
|
|
"errcode": "M_USER_AWAITING_APPROVAL",
|
|
|
|
"error": "This account needs to be approved by an administrator before it can be used."
|
|
|
|
"error": "This account needs to be approved by an administrator before it can be used."
|
|
|
|
}
|
|
|
|
}
|
|
|
|
```
|
|
|
|
```
|
|
|
|
@ -38,12 +38,12 @@ response that includes the `M_USER_NOT_APPROVED` error code. For example:
|
|
|
|
|
|
|
|
|
|
|
|
When a user whose account is still pending approval by a server administrator
|
|
|
|
When a user whose account is still pending approval by a server administrator
|
|
|
|
attempts to log in, `POST /_matrix/client/v3/login` requests are responded to
|
|
|
|
attempts to log in, `POST /_matrix/client/v3/login` requests are responded to
|
|
|
|
with a `403 Forbidden` response that includes the `M_USER_NOT_APPROVED` error
|
|
|
|
with a `403 Forbidden` response that includes the `M_USER_AWAITING_APPROVAL`
|
|
|
|
code. For example:
|
|
|
|
error code. For example:
|
|
|
|
|
|
|
|
|
|
|
|
```json
|
|
|
|
```json
|
|
|
|
{
|
|
|
|
{
|
|
|
|
"errcode": "M_USER_NOT_APPROVED",
|
|
|
|
"errcode": "M_USER_AWAITING_APPROVAL",
|
|
|
|
"error": "This account is pending approval by a server administrator. Please try again later."
|
|
|
|
"error": "This account is pending approval by a server administrator. Please try again later."
|
|
|
|
}
|
|
|
|
}
|
|
|
|
```
|
|
|
|
```
|
|
|
|
@ -77,14 +77,15 @@ of User-Interactive Authentication.
|
|
|
|
|
|
|
|
|
|
|
|
## Security considerations
|
|
|
|
## Security considerations
|
|
|
|
|
|
|
|
|
|
|
|
It shouldn't be necessary to implement the `M_USER_NOT_APPROVED` error code on
|
|
|
|
It shouldn't be necessary to implement the `M_USER_AWAITING_APPROVAL` error code
|
|
|
|
other endpoints than `/register` and `/login`. This is because other endpoints
|
|
|
|
on other endpoints than `/register` and `/login`. This is because other
|
|
|
|
are either unauthenticated (in which case we don't care about whether the user
|
|
|
|
endpoints are either unauthenticated (in which case we don't care about whether
|
|
|
|
is approved) or authenticated via an access token (in which case the fact that
|
|
|
|
the user is approved) or authenticated via an access token (in which case the
|
|
|
|
the user has an access token either means they've managed to log in (meaning
|
|
|
|
fact that the user has an access token either means they've managed to log in
|
|
|
|
they've been approved) or a server administrator generated one for them).
|
|
|
|
(meaning they've been approved) or a server administrator generated one for
|
|
|
|
|
|
|
|
them).
|
|
|
|
|
|
|
|
|
|
|
|
## Unstable prefix
|
|
|
|
## Unstable prefix
|
|
|
|
|
|
|
|
|
|
|
|
During development, `ORG_MATRIX_MSC3866_USER_NOT_APPROVED` must be used instead
|
|
|
|
During development, `ORG_MATRIX_MSC3866_USER_AWAITING_APPROVAL` must be used
|
|
|
|
of `M_USER_NOT_APPROVED`.
|
|
|
|
instead of `M_USER_AWAITING_APPROVAL`.
|
|
|
|
|