Use more basic function to check user

Signed-off-by: Olivier 'reivilibre <oliverw@matrix.org>

changelog.d/18518.bugfix

@@ -0,0 +1 @@
+Fix the 'Login as a user' Admin API not checking if the user exists before issuing an access token.

synapse/rest/admin/users.py

@@ -1068,6 +1068,7 @@ class UserTokenRestServlet(RestServlet):
         self.store = hs.get_datastores().main
         self.auth = hs.get_auth()
         self.auth_handler = hs.get_auth_handler()
+        self.admin_handler = hs.get_admin_handler()
         self.is_mine_id = hs.is_mine_id
 
     async def on_POST(
@@ -1082,6 +1083,12 @@ class UserTokenRestServlet(RestServlet):
                 HTTPStatus.BAD_REQUEST, "Only local users can be logged in as"
             )
 
+        # Validate user_id
+        UserID.from_string(user_id)
+        _user_info_dict = await self.store.get_user_by_id(user_id)
+        if not _user_info_dict:
+            raise NotFoundError("User not found")
+
         body = parse_json_object_from_request(request, allow_empty_body=True)
 
         valid_until_ms = body.get("valid_until_ms")

tests/rest/admin/test_user.py

@@ -4279,6 +4279,17 @@ class UserTokenRestTestCase(unittest.HomeserverTestCase):
 
         self.assertEqual(403, channel.code, msg=channel.json_body)
 
+    def test_no_user(self) -> None:
+        """Try to log in as a user that doesn't exist."""
+        channel = self.make_request(
+            "POST",
+            "/_synapse/admin/v1/users/%s/login" % urllib.parse.quote("@ghost:test"),
+            b"{}",
+            access_token=self.admin_user_tok,
+        )
+        self.assertEqual(404, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.NOT_FOUND, channel.json_body["errcode"])
+
     def test_send_event(self) -> None:
         """Test that sending event as a user works."""
         # Create a room.