From bad102a762810e0b603ab48abf77a59edfddfb8e Mon Sep 17 00:00:00 2001
From: Tulir Asokan <tulir@maunium.net>
Date: Sun, 12 Feb 2023 15:00:20 +0200
Subject: [PATCH] Allow appservices to batch send as any local user

---
 synapse/api/auth.py            | 5 +++--
 synapse/handlers/room_batch.py | 5 ++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/synapse/api/auth.py b/synapse/api/auth.py
index 3d7f986ac..c21b755b7 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -261,7 +261,7 @@ class Auth:
             raise MissingClientTokenError()
 
     async def validate_appservice_can_control_user_id(
-        self, app_service: ApplicationService, user_id: str
+        self, app_service: ApplicationService, user_id: str, allow_any: bool = False
     ) -> None:
         """Validates that the app service is allowed to control
         the given user.
@@ -269,6 +269,7 @@ class Auth:
         Args:
             app_service: The app service that controls the user
             user_id: The author MXID that the app service is controlling
+            allow_any: Allow the appservice to control any local user
 
         Raises:
             AuthError: If the application service is not allowed to control the user
@@ -280,7 +281,7 @@ class Auth:
         if app_service.sender == user_id:
             pass
         # Check to make sure the app service is allowed to control the user
-        elif not app_service.is_interested_in_user(user_id):
+        elif not app_service.is_interested_in_user(user_id) and not allow_any:
             raise AuthError(
                 403,
                 "Application service cannot masquerade as this user (%s)." % user_id,
diff --git a/synapse/handlers/room_batch.py b/synapse/handlers/room_batch.py
index c73d2adaa..f2cbb0d6c 100644
--- a/synapse/handlers/room_batch.py
+++ b/synapse/handlers/room_batch.py
@@ -21,6 +21,7 @@ class RoomBatchHandler:
         self.event_creation_handler = hs.get_event_creation_handler()
         self.room_member_handler = hs.get_room_member_handler()
         self.auth = hs.get_auth()
+        self.allow_send_any = self.hs.config.meow.appservice_batch_send_any
 
     async def inherit_depth_from_prev_ids(self, prev_event_ids: List[str]) -> int:
         """Finds the depth which would sort it after the most-recent
@@ -118,7 +119,9 @@ class RoomBatchHandler:
             Requester object
         """
 
-        await self.auth.validate_appservice_can_control_user_id(app_service, user_id)
+        await self.auth.validate_appservice_can_control_user_id(
+            app_service, user_id, allow_any=self.allow_send_any
+        )
 
         return create_requester(user_id, app_service=app_service)