«Deactivate account» should self-demote and leave the user from all rooms

[ghost]

And the server should probably synthesize a leave event any time it is made to believe a deactivated (disabled) account is still in the room, due to federation shenanigans.

[brycied00d]

This would help to resolve #1853.

[4nd3r]

i made script which "removes" users from rooms when they are not found in ldap.
run as root. tested on debian stretch. postgres username and dbname is "synapse".
script expects that file /root/.pgpass exists and ldap-utils are configured (/etc/ldap/ldap.conf).
curl and jq are also needed.
by default script does nothing (dry run). add --doit to do it for real.
no warranties, no support, use at your own risk.

#!/bin/sh -e

if [ "$2" != '--doit' ]
then echo 'DRY RUN!'
fi

psql -qtA -h localhost -U synapse -c \
'select name from users where password_hash is null and appservice_id is null;' \
| sed -nr 's/@(.+):.+/\1/p' \
| while read -r uid
do
    if ldapsearch -x "uid=$uid" dn | grep -q ^dn:
    then continue
    fi

    token="$( psql -qtA -h localhost -U synapse -c \
        "select token from access_tokens where user_id like '@$uid:%' limit 1;" )"

    if [ -z "$token" ]
    then
        echo "user $uid has no token"
        continue
    fi

    rooms="$( curl -s -o /dev/null \
        "http://localhost:8008/_matrix/client/r0/joined_rooms?access_token=$token" \
        | jq -r '.joined_rooms[]' )"

    if [ -z "$rooms" ]
    then
        sleep 1
        continue
    fi

    echo "user $uid"

    echo "$rooms" | while read -r room
    do
        echo "leave $room"
        if [ "$2" = '--doit' ]
        then
            curl -s -o /dev/null -X POST \
                "http://localhost:8008/_matrix/client/r0/rooms/$room/leave?access_token=$token"
            sleep 1
        fi
    done
done

[richvdh]

seems to have been fixed in #3201