Rename *.fix -> *.bugfix

changelog.d/17661.bugfix

@@ -0,0 +1 @@
+Make sure we advertise registration as disabled when MSC3861 is enabled.

synapse/rest/client/register.py

@@ -905,6 +905,14 @@ class RegisterAppServiceOnlyRestServlet(RestServlet):
 
         await self.ratelimiter.ratelimit(None, client_addr, update=False)
 
+        # Allow only ASes to use this API.
+        if body.get("type") != APP_SERVICE_REGISTRATION_TYPE:
+            raise SynapseError(
+                403,
+                "Registration has been disabled. Only m.login.application_service registrations are allowed.",
+                errcode=Codes.FORBIDDEN,
+            )
+
         kind = parse_string(request, "kind", default="user")
 
         if kind == "guest":
@@ -920,10 +928,6 @@ class RegisterAppServiceOnlyRestServlet(RestServlet):
         if not isinstance(desired_username, str) or len(desired_username) > 512:
             raise SynapseError(400, "Invalid username")
 
-        # Allow only ASes to use this API.
-        if body.get("type") != APP_SERVICE_REGISTRATION_TYPE:
-            raise SynapseError(403, "Non-application service registration type")
-
         if not self.auth.has_access_token(request):
             raise SynapseError(
                 400,

tests/handlers/test_oauth_delegation.py

@@ -569,6 +569,16 @@ class MSC3861OAuthDelegation(HomeserverTestCase):
             channel.json_body["errcode"], Codes.UNRECOGNIZED, channel.json_body
         )
 
+    def expect_forbidden(
+        self, method: str, path: str, content: Union[bytes, str, JsonDict] = ""
+    ) -> None:
+        channel = self.make_request(method, path, content)
+
+        self.assertEqual(channel.code, 403, channel.json_body)
+        self.assertEqual(
+            channel.json_body["errcode"], Codes.FORBIDDEN, channel.json_body
+        )
+
     def test_uia_endpoints(self) -> None:
         """Test that endpoints that were removed in MSC2964 are no longer available."""
 
@@ -627,7 +637,11 @@ class MSC3861OAuthDelegation(HomeserverTestCase):
             "GET", "/_matrix/client/v1/register/m.login.registration_token/validity"
         )
         # This is still available for AS registrations
-        # self.expect_unrecognized("POST", "/_matrix/client/v3/register")
+        self.expect_forbidden(
+            "POST",
+            "/_matrix/client/v3/register",
+            {"username": "alice", "password": "hunter2"},
+        )
         self.expect_unrecognized("GET", "/_matrix/client/v3/register/available")
         self.expect_unrecognized(
             "POST", "/_matrix/client/v3/register/email/requestToken"