Don't push if an user account has expired

changelog.d/58.misc

@@ -0,0 +1 @@
+Don't push if an user account has expired.

synapse/api/auth.py

@@ -33,6 +33,7 @@
 )
 from synapse.api.room_versions import KNOWN_ROOM_VERSIONS
 from synapse.events import EventBase
+from synapse.handlers.account_validity import is_account_expired
 from synapse.logging import opentracing as opentracing
 from synapse.types import StateMap, UserID
 from synapse.util.caches import register_cache
@@ -222,11 +223,10 @@ def get_user_by_req(
             # Deny the request if the user account has expired.
             if self._account_validity.enabled and not allow_expired:
                 user_id = user.to_string()
-                expiration_ts = yield self.store.get_expiration_ts_for_user(user_id)
-                if (
-                    expiration_ts is not None
-                    and self.clock.time_msec() >= expiration_ts
-                ):
+                expired = yield is_account_expired(
+                    user_id, self.store, self.clock.time_msec()
+                )
+                if expired:
                     raise AuthError(
                         403, "User account has expired", errcode=Codes.EXPIRED_ACCOUNT
                     )

synapse/handlers/account_validity.py

@@ -299,3 +299,22 @@ def _mark_expired_users_as_inactive(self):
 
         # Mark each as non-active
         yield self.profile_handler.set_active(active_expired_users, False, True)
+
+
+@defer.inlineCallbacks
+def is_account_expired(user_id: str, store, current_ts: int):
+    """
+    Returns whether an user account is expired.
+
+    Args:
+        user_id: The user's ID
+        store: Homeserver datastore
+        current_ts: The current timestamp
+
+    Returns:
+        Deferred[bool]: whether the user account has expired
+    """
+    expiration_ts = yield store.get_expiration_ts_for_user(user_id)
+    if expiration_ts is not None and current_ts >= expiration_ts:
+        return True
+    return False

synapse/push/pusherpool.py

@@ -21,6 +21,7 @@
 
 from twisted.internet import defer
 
+from synapse.handlers.account_validity import is_account_expired
 from synapse.metrics.background_process_metrics import run_as_background_process
 from synapse.push import PusherConfigException
 from synapse.push.emailpusher import EmailPusher
@@ -66,6 +67,8 @@ def __init__(self, hs: "HomeServer"):
         self._pusher_shard_config = hs.config.push.pusher_shard_config
         self._instance_name = hs.get_instance_name()
 
+        self._account_validity = hs.config.account_validity
+
         # map from user id to app_id:pushkey to pusher
         self.pushers = {}  # type: Dict[str, Dict[str, Union[HttpPusher, EmailPusher]]]
 
@@ -196,6 +199,14 @@ def on_new_notifications(self, min_stream_id, max_stream_id):
 
             for u in users_affected:
                 if u in self.pushers:
+                    # Don't push if the user account has expired
+                    if self._account_validity.enabled:
+                        expired = yield is_account_expired(
+                            u, self.store, self.clock.time_msec()
+                        )
+                        if expired:
+                            continue
+
                     for p in self.pushers[u].values():
                         p.on_new_notifications(min_stream_id, max_stream_id)
 
@@ -217,6 +228,14 @@ def on_new_receipts(self, min_stream_id, max_stream_id, affected_room_ids):
 
             for u in users_affected:
                 if u in self.pushers:
+                    # Don't push if the user account has expired
+                    if self._account_validity.enabled:
+                        expired = yield is_account_expired(
+                            u, self.store, self.clock.time_msec()
+                        )
+                        if expired:
+                            continue
+
                     for p in self.pushers[u].values():
                         p.on_new_receipts(min_stream_id, max_stream_id)