Devon HudsonandClaude Opus 5.5
ba7438322b
Mints a single-use, passwordless registration token for each guest, pinned to their address and username and expiring after `guest_invites.invite_lifetime`, and schedules their invite emails. The links are only ever mailed to the guests, so the response carries a count rather than the tokens. Everything is validated before anything is minted, and the batch is committed as a whole, so a rejected request sends no email at all. Each invite goes through the registration policy as `POST /register` will check it, so an invite the guest form would refuse is a 400 naming the invite and every violation. The policy sees an empty requester, as the request comes from the inviter's homeserver rather than the guest. A username that is already taken is refused up front, rather than emailed out as a link nobody can register with. Addresses are deduplicated ignoring case before the usernames are checked, keeping the first entry, so a repeated address never counts as a username given twice. The caller sends the room name and the inviter on the inviter's behalf, so the endpoint doesn't trust them. The room name and the inviter's display name are stripped of control characters, including the bidirectional controls `char::is_control` misses, and truncated before they are stored in the job payload. The inviter's Matrix ID is never truncated, so it can't show a server it isn't from: it is kept whole if it is valid under the historical grammar, and left out otherwise. The room ID is checked as `/open-room` checks it, and is only recorded on the span once it is valid. The endpoint answers 404 while guest invites are disabled. The check is in the handler, as the admin router doesn't see the configuration. `guest_invites.enabled` turns it on, and requires `client_room_url`. `/open-room` keeps using `client_room_url` while the endpoint is disabled, so that links already sent keep working. `invite_lifetime` is a positive number of seconds that fits in a `u32`, so MAS refuses a zero or negative lifetime at startup, and adding it to the current time can't overflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Matrix Authentication Service
MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. You can directly run and manage the source code in this repository, available under an AGPL license (or alternatively under a commercial license from Element). Support is not provided by Element unless you have a subscription.
It has been created to support the migration of Matrix to a next-generation of auth APIs per MSC3861.
See the Documentation for information on installation and use.
You can learn more about Matrix and next-generation auth at areweoidcyet.com.
🚀 Getting started
This component is developed and maintained by Element. It gets shipped as part of the Element Server Suite (ESS) which provides the official means of deployment.
ESS is a Matrix distribution from Element with focus on quality and ease of use. It ships a full Matrix stack tailored to the respective use case.
There are three editions of ESS:
- ESS Community - the free Matrix distribution from Element tailored to small-/mid-scale, non-commercial community use cases
- ESS Pro - the commercial Matrix distribution from Element for professional use
- ESS TI-M - a special version of ESS Pro focused on the requirements of TI-Messenger Pro and ePA as specified by the German National Digital Health Agency Gematik
💬 Community room
Developers and users of Matrix Authentication Service can chat in the #matrix-auth:matrix.org room on Matrix.
🛠️ Standalone installation and configuration
The best way to get a modern Element Matrix stack is through the Element Server Suite, which includes MAS.
The MAS documentation describes how to install and configure MAS. We recommend using the Docker image or the pre-built binaries.
📖 Translations
Matrix Authentication Service is available in multiple languages. Anyone can contribute to translations through Localazy.
🏗️ Contributing
See the contribution guidelines for information on how to contribute to this project.
⚖️ Copyright & License
Copyright 2021-2024 The Matrix.org Foundation C.I.C.
Copyright 2024, 2025 New Vector Ltd.
Copyright 2025, 2026 Element Creations Ltd.
This software is dual-licensed by Element Creations Ltd (Element). It can be used either:
(1) for free under the terms of the GNU Affero General Public License (as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version); OR
(2) under the terms of a paid-for Element Commercial License agreement between you and Element (the terms of which may vary depending on what you and Element have agreed to). Unless required by applicable law or agreed to in writing, software distributed under the Licenses is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the Licenses for the specific language governing permissions and limitations under the Licenses.