Riot is unable to deactivate and erase users with Synapse v1.13.0rc1

[anoadragon453]

Unfortunately a change in Synapse that now blocks User-Interactive Authentication session parameters changing within a session breaks deactivating and erasing a user in Riot: matrix-org/synapse#7471

I'm not sure whether this is a Synapse or Riot bug. The spec isn't entirely clear about whether a session can change mid-way through. Although I understand that it's important to consider that there may be other clients out there (and other parts of Riot) that this will break.

Fixing this in the Riot side is probably as easy as just starting a new UIA session when the "erase" checkbox is toggled.

[turt2live]

possibly related: #8458

We start a session to figure out what the server supports so we can display the right UI (as a wizard-style setup here is not ideal). Starting a new session is probably what we're going to have to do, though it's super risky from our side (as the server could change its flows).

The spec definitely needs clarification here, and might need a few MSCs to better handle the situation.

[turt2live]

@vector-im/design will have to consider the various flows here, as checking or unchecking the box will cause us to flip flop mid-session. Should we throw away the auth attempt? Disable the checkbox after some heuristic? etc

[turt2live]

Right, so in discussion with the backend team: riot is indeed non-compliant because the spec clearly says the same request is supposed to be submitted (see Synapse issue for details on where we change the request).

However, we don't appear to be in a position to do an emergency release at the moment, and this requires a non-trivial amount of design work (probably). Having the exemption for all UIA endpoints, as done for /register already, would be appreciated so we can fix this with a bit more than zero notice.

[turt2live]

and of course things move quickly - we might not need design's involvement as urgently and can keep this on the backburner for now. We can work around it in riot and release eventually (when we're safe and able to), and work on the spec/design sides as a tangent.

I've opened #13646 to track the longer tail of work on this. Also I'm pushing this down in the priority queue a bit as it's not as urgent as when opened.