From 98e2bedaaf080eaaa9867dab0371d2c9adb3da97 Mon Sep 17 00:00:00 2001
From: Matthias Ahouansou <matthias@ahouansou.cz>
Date: Thu, 22 Jan 2026 14:05:13 +0000
Subject: [PATCH] fix: don't perform identity assertion on appservice-only
 endpoints

This for example, allows appservices to ping before creating any users
---
 src/api/ruma_wrapper/axum.rs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/api/ruma_wrapper/axum.rs b/src/api/ruma_wrapper/axum.rs
index 04456543..8b88b6f0 100644
--- a/src/api/ruma_wrapper/axum.rs
+++ b/src/api/ruma_wrapper/axum.rs
@@ -126,10 +126,7 @@ where
                         ));
                     }
                 }
-                (
-                    AuthScheme::AccessToken | AuthScheme::AppserviceToken,
-                    Token::Appservice(info),
-                ) => {
+                (AuthScheme::AccessToken, Token::Appservice(info)) => {
                     let user_id = query_params
                         .user_id
                         .map_or_else(
@@ -163,6 +160,7 @@ where
                 }
                 (
                     AuthScheme::None
+                    | AuthScheme::AppserviceToken
                     | AuthScheme::AppserviceTokenOptional
                     | AuthScheme::AccessTokenOptional,
                     Token::Appservice(info),