From 223e8894596eb46aa46e5fc6a60f7c00f184ba72 Mon Sep 17 00:00:00 2001
From: Bardi Harborow <bardi@bardiharborow.com>
Date: Wed, 4 Nov 2026 21:24:13 +1100
Subject: [PATCH] fix: Return 405 when setting m.fully_read via account data

The spec requires servers to reject client writes to server-managed
account data types with 405 M_BAD_JSON. We returned 400.
---
 changelog.d/2451.bugfix.4.md   |  1 +
 src/api/client/account_data.rs | 11 +++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/2451.bugfix.4.md

diff --git a/changelog.d/2451.bugfix.4.md b/changelog.d/2451.bugfix.4.md
new file mode 100644
index 000000000..10f6a4da1
--- /dev/null
+++ b/changelog.d/2451.bugfix.4.md
@@ -0,0 +1 @@
+Setting `m.fully_read` via the account data endpoints now returns 405 `M_BAD_JSON` as required by the spec, instead of 400.
diff --git a/src/api/client/account_data.rs b/src/api/client/account_data.rs
index 60fec42ab..bc9dc4bab 100644
--- a/src/api/client/account_data.rs
+++ b/src/api/client/account_data.rs
@@ -117,10 +117,13 @@ async fn set_account_data(
 	data: &RawJsonValue,
 ) -> Result {
 	if event_type_s == "m.fully_read" {
-		return Err!(Request(BadJson(
-			"This endpoint cannot be used for marking a room as fully read (setting \
-			 m.fully_read)"
-		)));
+		return Err!(Request(
+			BadJson(
+				"This endpoint cannot be used for marking a room as fully read (setting \
+				 m.fully_read)"
+			),
+			METHOD_NOT_ALLOWED
+		));
 	}
 
 	let data: serde_json::Value = serde_json::from_str(data.get())