Registrations are poorly specified

[joepie91]

Currently, the documentation for the /register endpoint is pretty sparse about guest registrations. Specifically, I've found the following things to be missing so far:

1. Are homeservers permitted to reject guest registrations? If yes, what is the correct error and status code?
2. /register docs claim that password is required #719 claims that passwords are optional for guest accounts. But are they permitted for a guest account?
3. Relatedly: are passwords required for normal user accounts, or can those omit them too?
4. Again relatedly: are guests permitted to choose a username?
5. ... and are regular users permitted to omit it?

I guess that all of these points, except for the first one, can be summarized as it being unclear how the required-ness of fields is affected by the guest-ness of an account.

[uhoreg]

Anecdotally, synapse seems to just return a 403 when guest registration is disabled. (It also returns a 403 when a user tries to register with normal registration is disabled.)

[joepie91]

What error code would it return in both cases, though? As I understand it, Matrix error codes are prioritized over HTTP status codes to infer meaning from a response.

[uhoreg]

In this case, Synapse seems to return M_UNKNOWN, which is kind of useless.

[joepie91]

Right. In that case, it should be safe to return an M_FORBIDDEN (with status code 403), right? As that's how a 403 M_UNKNOWN would be interpreted anyway, if I recall correctly, and it'd be a bit more correct.