IS interactions proxied through the HS also need terms agreement

[jryans]

There are several places where we send data to the IS via the HS, such as:

• Adding 3PIDs at registration
• Adding 3PIDs in settings

These currently don't trigger terms on use in Riot because they don't happen directly with the IS and the HS is not aware of terms yet... In any case, we need to get user agreement for these flows as well.

[jryans]

See also matrix-org/synapse#5786

[turt2live]

Do they? Wouldn't the homeserver ToS take care of this?

[jryans]

Hmm, it seems at the very least unclear and confusing... I don't think we want to force HS admins to participate in a formal data processing arrangement with the ISes, so it would seem we'd need to get user consent for any operation that can flow to the IS.

[lampholder]

Very quickly thinking about this:

It's right that (at the present time) we don't want the HS admin to have a formal DPA with the IS provider. The relationship should be:

• between the user and the homeserver
• between the user and the identity server

When the user makes a request to the identity server that is proxied via the homeserver (there are a few of these) then:

• the data being shared with the homeserver should be covered by the homeserver's relationship with the user
• the client arranges an IS access token directly with the identity server and agrees to terms with the IS as needed
• the client passes this IS access token to the homeserver for interacting with the identity server on the user's behalf
• the homeserver should use this token to check that the user has read and agreed to the terms of service before it sends any personal data (in the same way that the client does)
• if the homeserver discovers that the user has not agreed to the terms of serivce, it should reject the request

[jryans]

After another look at the MSC, the client is meant to send the is_token to the HS for requests that the HS proxies to the IS, so this implies the client will contact the IS directly to work out a valid token first, and then pass that to the HS.

I have edited @lampholder's bullets above to match.

[jryans]

It seems clear how to proceed, so I have removed the blocked label.

[jryans]

Based on discussion in the Synapse issue, it looks like the APIs to consider here are:

• /account/3pid/email/requestToken
• /account/3pid/msisdn/requestToken
• /rooms/{roomId}/invite for 3PID invites