diff --git a/userapi/internal/api.go b/userapi/internal/api.go index c1b9bcabf..1b647a0df 100644 --- a/userapi/internal/api.go +++ b/userapi/internal/api.go @@ -389,9 +389,9 @@ func (a *UserInternalAPI) queryAppServiceToken(ctx context.Context, token, appSe if localpart != "" { // AS is masquerading as another user // Verify that the user is registered - account, err := a.AccountDB.GetAccountByLocalpart(ctx, localpart) - // Verify that account exists & appServiceID matches - if err == nil && account.AppServiceID == appService.ID { + _, err := a.AccountDB.GetAccountByLocalpart(ctx, localpart) + // Verify that the account belongs to the appservice user namespaces + if err == nil && appService.IsInterestedInUserID(appServiceUserID) { // Set the userID of dummy device dev.UserID = appServiceUserID return &dev, nil