From 305faa2ab58cb2df4fba98a3204073a9bf19288f Mon Sep 17 00:00:00 2001
From: Andrew Ferrazzutti <andrewf@element.io>
Date: Thu, 27 Aug 2026 11:53:03 -0400
Subject: [PATCH] MSC3866: Apply missed filter on /users response (#20152)

For the Admin API /users endpoint, the response is meant to exclude the
approval flag when MSC3866 is enabled, but the filter that applies the
exclusion never actually got used. Fix things so that it does.
---
 changelog.d/20152.bugfix      |  1 +
 synapse/rest/admin/users.py   | 14 +++++++++-----
 tests/rest/admin/test_user.py |  4 ++++
 3 files changed, 14 insertions(+), 5 deletions(-)
 create mode 100644 changelog.d/20152.bugfix

diff --git a/changelog.d/20152.bugfix b/changelog.d/20152.bugfix
new file mode 100644
index 0000000000..4233499d33
--- /dev/null
+++ b/changelog.d/20152.bugfix
@@ -0,0 +1 @@
+When not using MSC3866, omit the approval flag from the response of `GET /_synapse/admin/v2/users`.
diff --git a/synapse/rest/admin/users.py b/synapse/rest/admin/users.py
index ddb4483789..43dab16598 100644
--- a/synapse/rest/admin/users.py
+++ b/synapse/rest/admin/users.py
@@ -49,6 +49,7 @@ from synapse.rest.admin._base import (
     assert_user_is_admin,
 )
 from synapse.rest.client._base import client_patterns
+from synapse.storage.databases.main import UserPaginateResponse
 from synapse.storage.databases.main.registration import ExternalIDReuseException
 from synapse.storage.databases.main.stats import UserSortOrder
 from synapse.types import JsonDict, JsonMapping, TaskStatus, UserID
@@ -181,13 +182,16 @@ class UsersRestServletV2(RestServlet):
         )
 
         # If support for MSC3866 is not enabled, don't show the approval flag.
-        filter = None
+        users_filter = None
         if not self._msc3866_enabled:
+            users_filter = attr.filters.exclude(
+                attr.fields(UserPaginateResponse).approved
+            )
 
-            def _filter(a: attr.Attribute) -> bool:
-                return a.name != "approved"
-
-        ret = {"users": [attr.asdict(u, filter=filter) for u in users], "total": total}
+        ret = {
+            "users": [attr.asdict(u, filter=users_filter) for u in users],
+            "total": total,
+        }
         if (start + limit) < total:
             ret["next_token"] = str(start + len(users))
 
diff --git a/tests/rest/admin/test_user.py b/tests/rest/admin/test_user.py
index e2e133a85e..84bb7e319b 100644
--- a/tests/rest/admin/test_user.py
+++ b/tests/rest/admin/test_user.py
@@ -1424,6 +1424,10 @@ class UsersListTestCase(unittest.HomeserverTestCase):
             self.assertIn("avatar_url", u)
             self.assertIn("creation_ts", u)
             self.assertIn("last_seen_ts", u)
+            if self.hs.config.experimental.msc3866.enabled:
+                self.assertIn("approved", u)
+            else:
+                self.assertNotIn("approved", u)
 
     def _create_users(self, number_users: int) -> None:
         """