Spec Account management for OAuth 2.0 API

[zecakeh]

As per MSC4191.

Pull Request Checklist

• Pull request includes a changelog file
• Pull request includes a sign off
• Pull request is classified as 'other changes'

Preview: https://pr2270--matrix-spec-previews.netlify.app

[hughns]

Question: would it be useful to add notes to the legacy API endpoints to say what the equivalent functionality is in the OAuth 2.0 API?

For example for /_matrix/client/v3/account/deactivate saying something like:

Note: In the OAuth 2.0 API this is replaced by the org.matrix.account_deactivate account management URL action, where supported.

[hughns]

One of the field names is wrong. Otherwise this looks sensible 👍

[zecakeh]

Question: would it be useful to add notes to the legacy API endpoints to say what the equivalent functionality is in the OAuth 2.0 API?

For example for /_matrix/client/v3/account/deactivate saying something like:

Note: In the OAuth 2.0 API this is replaced by the org.matrix.account_deactivate account management URL action, where supported.

I would rather not, we don't do that for other endpoints of the legacy API, and we already have an overview on how to do things depending on the authentication API before defining both APIs.

That said my feelings are not that strong on the subject so if you really think that's better, I'll add it.

[zecakeh]

I would rather not, we don't do that for other endpoints of the legacy API, and we already have an overview on how to do things depending on the authentication API before defining both APIs.

That said my feelings are not that strong on the subject so if you really think that's better, I'll add it.

Now that I think bout it, it might be good to add this a warning for OAuth aware clients however in #2272.

[richvdh]

lgtm modulo a couple of nits

[hughns]

This now looks good to me.

Please can we ask @turt2live to review to make sure it meets the requirements he said here?

Per recent emails sent to oauth-ext-review on our thread, it seems possible to allow this MSC to go through without formal registration. When we get to the spec PR, we should verbosely describe the fields so we can point to them in a more complete registration application.

[richvdh]

LGTM

[turt2live]

I've done a pass based on IANA's perceived requirements, which is a bit nitpicky (sorry). I haven't checked to see how compatible the SHOULD/MAY/MUST-style suggestions are with the original MSC.

Edit: to clarify review state: "approved with changes".