MSC3231: Token authenticated registration (#3231)
MSC3231: Token authenticated registration (#3231)

* Proposal for token authenticated registration

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Hard-wrap lines

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Link to released version of spec

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Fix unstable prefix wording

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Tokens should only be invalidated after registration

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Change auth type to m.login.registration_token

This is consistent with the other UIAA auth types, and does not suggest
that other `m.login.*` types cannot be used for registration.

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Add proposal for checking the validity of a token

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Fix validity checking endpoint

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Limit allowed characters and length of token

This allows tokens to be used easily in query parameters

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Give reason for limiting token length and chars

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Note all stages must be complete for registration

Co-authored-by: Andrew Morgan <f7696b0e1a3fc72ac6ca6027b49b1f81449e2c40@users.noreply.github.com>

* Fix mistake in MSC number

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Validity checking should be rate limited

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Change v1 to r0

Signed-off-by: Callum Brown <30277750103c2cd3d9ca2faae7875553e95d86f7@calcuode.com>

* Include `.` and `~` in allowed characters for registration tokens

For consistency with the unreserved URL characters in RFC3986

https://www.ietf.org/rfc/rfc3986.html#section-2.3

Co-authored-by: Richard van der Hoff <6e2e234be92ed8dc85f875dbc2f9b6424da7a211@users.noreply.github.com>

Co-authored-by: Andrew Morgan <f7696b0e1a3fc72ac6ca6027b49b1f81449e2c40@users.noreply.github.com>
Co-authored-by: Richard van der Hoff <6e2e234be92ed8dc85f875dbc2f9b6424da7a211@users.noreply.github.com>
matrix-org/matrix-doc,matrix-org/matrix-doc,matrix-org/matrix-doc,matrix-org/matrix-doc