user_directory_search_enabled is not spec compliant

[Johennes]

Description

As discussed in matrix-org/matrix-spec-proposals#4170 (comment), when the user_directory_search_enabled config setting is disabled, Synapse responds with HTTP 200 and an empty results array on all requests to POST /_matrix/client/v3/user_directory/search. I believe this is incompatible with the spec which requires that at least users from shared and public rooms are searchable:

Performs a search for users. The homeserver may determine which subset of users are searched, however the homeserver MUST at a minimum consider the users the requesting user shares a room with and those who reside in public rooms (known to the homeserver). The search MUST consider local users to the homeserver, and SHOULD query remote users as part of the search.

Excluding these users from search results also doesn't seem to have any benefit because the requester has access to the returned information anyway through room membership.

Steps to reproduce

–

Homeserver

–

Synapse Version

–

Installation Method

I don't know

Database

–

Workers

I don't know

Platform

–

Configuration

–

Relevant log output

–

Anything else that would be useful to know?

No response

[reivilibre]

Correct. I guess the answer is; don't use that flag if spec compliance is important to you.

Since that flag disables the user search mechanism entirely, we actually can't return any answers if you do so. So either we need to change the spec or remove the flag.

But the flag is, as far as I know, mostly a performance optimisation for servers that don't want to waste the database resources to build a user index if the needed application doesn't use it.

[Johennes]

Ok, thanks. I suppose that's fine then, especially when the flag is off by default

@richvdh you suggested to report this. Any objections to closing?

[richvdh]

Given that the spec is very clear that the server MUST do these things, it still seems wrong for Synapse to not do them. To be honest, I don't think Synapse should be in the business of having config options that make it non-spec-compliant; if it does have such options, they should be clearly documented as such.

I'd be equally happy with a change to the spec, but it's for the Synapse team to push that, imho.

[Johennes]

I have attempted to add a disclaimer in the docs with #18548.