Deploying MAS on matrix.org violated the specs about deleting a device

[squatica]

Describe the bug

• migration to MAS was announced on April 2 https://matrix.org/blog/2025/04/matrix-auth-service/
• MSC3861: Next-generation auth for Matrix, based on OAuth 2.0/OIDC was merged on April 5
• MAS was deployed on matrix.org on April 7 https://matrix.org/blog/2025/04/morg-now-running-mas/
• since then, this route (and possibly others?) is returning 404 https://spec.matrix.org/v1.14/client-server-api/#delete_matrixclientv3devicesdeviceid which means matrix.org server is in violation of the specs
• issue tracked in FluffyChat "Unrecognized Request" when trying to delete a device krille-chan/fluffychat#1822
• also broken in Cinny Unable to delete device cinnyapp/cinny#2376

To Reproduce
Steps to reproduce the behavior:

1. login to any webclient but don't verify the session
2. close the browser, clean the cookies, basically lose that session
3. all your other client apps will start showing a warning about a new unverified device
4. attempting to dismiss that warning by deleting the device from the client app fails, because the api returns 404

Expected behavior

• Matrix.org server should be following the matrix specs.
• shouldn't there be more time between merging an MSC and deploying it on matrix.org ?

[richvdh]

I think this is a Synapse bug rather than a MAS one, but I'll leave that for the relevant teams to judge. But to address one specific point:

shouldn't there be more time between merging an MSC and deploying it on matrix.org ?

MSCs are supposed to be additive; they should not break backwards compatibility. Even if an MSC removes an endpoint from future spec versions, that doesn't mean support for that endpoint can be removed from servers that claim to support older spec versions. So, no, we don't need a delay between merging an MSC and deploying it on matrix.org.

The problem here is that matrix.org has made changes outside the spec process.

[hughns]

Thank you for reporting this.

element-hq/synapse#18923 now exists to track this in Synapse.

This repo isn't for the matrix.org homeserver so I am closing this issue. (I don't know of an alternative public repo where it should be filed)