AppService registration fails with OAuth2/MAS homeservers due to missing `inhibit_login: true`

[irony]

When using matrix-bot-sdk with OAuth2/MAS (Matrix Authentication Service) enabled homeservers, AppService registration fails with M_UNKNOWN_TOKEN: Unrecognised access token.

Root Cause

The ensureRegistered() method in src/appservice/Intent.ts sends a POST request to /_matrix/client/v3/register with:

{
    type: "m.login.application_service",
    username: this.userId.substring(1).split(":")[0],
    device_id: deviceId,
}

However, OAuth2/MAS homeservers require inhibit_login: true to be included in the registration request. Without this flag, the homeserver rejects the registration attempt.

Expected Behavior

The SDK should automatically include inhibit_login: true in AppService registration requests to support OAuth2/MAS homeservers.

Actual Behavior

The registration request fails with:

MatrixError: M_UNKNOWN_TOKEN: Unrecognised access token

Workaround

Currently, the only workaround is to manually patch the compiled JavaScript file:

sed -i.bak '/doRequest.*register/,/username:/{s/type: "m.login.application_service",/type: "m.login.application_service",\n                    inhibit_login: true,/}' node_modules/matrix-bot-sdk/lib/appservice/Intent.js

Suggested Fix

Update the ensureRegistered() method in src/appservice/Intent.ts to include inhibit_login: true:

const result = await this.client.doRequest("POST", "/_matrix/client/v3/register", null, {
    type: "m.login.application_service",
    inhibit_login: true,  // Add this line
    username: this.userId.substring(1).split(":")[0],
    device_id: deviceId,
});

Environment

• matrix-bot-sdk version: 0.7.0
• Homeserver: Synapse with Matrix Authentication Service (MAS) enabled
• OAuth2 provider: Keycloak

Additional Context

• This is related to issue Support refresh tokens/OIDC login & registration #298 (Support refresh tokens/OIDC login & registration)
• The inhibit_login flag is required by the Matrix spec for OAuth2 homeservers
• Without this fix, AppServices cannot be used with modern OAuth2/MAS setups