From cfbe590f1c7e8c4cad4cabfec493edcb63fa80d1 Mon Sep 17 00:00:00 2001 From: Ginger Date: Sat, 11 Jul 2026 10:13:00 -0400 Subject: [PATCH] fix: Do not require an access token on 3pid token request route --- src/api/client/account/threepid.rs | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/api/client/account/threepid.rs b/src/api/client/account/threepid.rs index 3be31263b..93531eb02 100644 --- a/src/api/client/account/threepid.rs +++ b/src/api/client/account/threepid.rs @@ -57,13 +57,11 @@ pub(crate) async fn request_3pid_management_token_via_email_route( State(services): State, body: Ruma, ) -> Result { - // Authentication for this endpoint is technically optional, - // but we require the user to be logged in let sender_user = body .identity .as_ref() .map(ClientIdentity::expect_sender_user) - .ok_or_else(|| err!(Request(MissingToken("Missing access token."))))??; + .transpose()?; if !services.threepid.email_requirement().may_change() { return Err!(Request(Forbidden("You may not change your email address."))); @@ -88,7 +86,7 @@ pub(crate) async fn request_3pid_management_token_via_email_route( Mailbox::new(None, email), |verification_link| messages::ChangeEmail { server_name: services.config.server_name.as_str(), - user_id: Some(sender_user), + user_id: sender_user, verification_link, }, &body.client_secret,