From 7ab415c4b657818d65232d7f3404515d7d9a0155 Mon Sep 17 00:00:00 2001
From: Ginger <ginger@gingershaped.computer>
Date: Mon, 28 Sep 2026 12:28:59 -0400
Subject: [PATCH] fix: Make `require_auth_for_profile_requests` work again

---
 src/api/client/profile.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/api/client/profile.rs b/src/api/client/profile.rs
index 5739f3781..4f2d6bedc 100644
--- a/src/api/client/profile.rs
+++ b/src/api/client/profile.rs
@@ -29,6 +29,12 @@ pub(crate) async fn get_profile_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile::v3::Request>,
 ) -> Result<get_profile::v3::Response> {
+	if services.config.require_auth_for_profile_requests && body.identity.is_none() {
+		return Err!(Request(Unauthorized(
+			"This server requires authentication to access user profiles."
+		)));
+	}
+
 	let Some(profile) = fetch_full_profile(&services, &body.user_id).await else {
 		return Err!(Request(NotFound("This user's profile could not be fetched.")));
 	};
@@ -40,6 +46,12 @@ pub(crate) async fn get_profile_field_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile_field::v3::Request>,
 ) -> Result<get_profile_field::v3::Response> {
+	if services.config.require_auth_for_profile_requests && body.identity.is_none() {
+		return Err!(Request(Unauthorized(
+			"This server requires authentication to access user profiles."
+		)));
+	}
+
 	let value = fetch_profile_field(&services, &body.user_id, body.field.clone()).await?;
 
 	Ok(assign!(get_profile_field::v3::Response::default(), { value }))