feat: Add support for importing profile data from claims

src/api/client/capabilities.rs

@@ -7,10 +7,11 @@ use ruma::{
 	api::client::discovery::get_capabilities::{
 		self,
 		v3::{
-			Capabilities, GetLoginTokenCapability, RoomVersionStability, RoomVersionsCapability,
-			ThirdPartyIdChangesCapability,
+			Capabilities, GetLoginTokenCapability, ProfileFieldsCapability, RoomVersionStability,
+			RoomVersionsCapability, ThirdPartyIdChangesCapability,
 		},
 	},
+	assign,
 };
 
 use crate::Ruma;
@@ -50,5 +51,9 @@ pub(crate) async fn get_capabilities_route(
 		capabilities.account_moderation.suspend = true;
 	}
 
+	capabilities.profile_fields = Some(
+		assign!(ProfileFieldsCapability::new(true), { disallowed: Some(services.oidc.restricted_profile_fields()) }),
+	);
+
 	Ok(get_capabilities::v3::Response::new(capabilities))
 }

src/api/client/profile.rs

@@ -63,6 +63,16 @@ pub(crate) async fn set_profile_field_route(
 		return Err!(Request(InvalidParam("You may not change a remote user's profile data.")));
 	}
 
+	if services
+		.oidc
+		.restricted_profile_fields()
+		.contains(&body.value.field_name())
+	{
+		return Err!(Request(Forbidden(
+			"This profile field is controlled by your identity provider."
+		)));
+	}
+
 	services
 		.users
 		.set_profile_field(
@@ -93,6 +103,16 @@ pub(crate) async fn delete_profile_field_route(
 		return Err!(Request(InvalidParam("You may not change a remote user's profile data.")));
 	}
 
+	if services
+		.oidc
+		.restricted_profile_fields()
+		.contains(&body.field)
+	{
+		return Err!(Request(Forbidden(
+			"This profile field is controlled by your identity provider."
+		)));
+	}
+
 	services
 		.users
 		.set_profile_field(