From 18f1d28a498c8ac18a7f8b3fdb778af2f0954fc4 Mon Sep 17 00:00:00 2001
From: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
Date: Fri, 7 Nov 2025 10:41:05 +0000
Subject: [PATCH] 1.142.0rc1 regression fix: Allow coercing a `str` to a
 `FilePath` in `MasConfigModel` (#19144)

---
 changelog.d/19144.bugfix        | 1 +
 synapse/config/mas.py           | 3 ++-
 synapse/util/pydantic_models.py | 7 +++++++
 3 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/19144.bugfix

diff --git a/changelog.d/19144.bugfix b/changelog.d/19144.bugfix
new file mode 100644
index 000000000..3efec8080
--- /dev/null
+++ b/changelog.d/19144.bugfix
@@ -0,0 +1 @@
+Fix a bug introduced in 1.142.0rc1 where any attempt to configure `matrix_authentication_service.secret_path` would prevent the homeserver from starting up.
\ No newline at end of file
diff --git a/synapse/config/mas.py b/synapse/config/mas.py
index 53cf500e9..c3e2630f2 100644
--- a/synapse/config/mas.py
+++ b/synapse/config/mas.py
@@ -37,7 +37,8 @@ class MasConfigModel(ParseModel):
     enabled: StrictBool = False
     endpoint: AnyHttpUrl = AnyHttpUrl("http://localhost:8080")
     secret: Optional[StrictStr] = Field(default=None)
-    secret_path: Optional[FilePath] = Field(default=None)
+    # We set `strict=False` to allow `str` instances.
+    secret_path: Optional[FilePath] = Field(default=None, strict=False)
 
     @model_validator(mode="after")
     def verify_secret(self) -> Self:
diff --git a/synapse/util/pydantic_models.py b/synapse/util/pydantic_models.py
index e1e2d8b99..506063d1a 100644
--- a/synapse/util/pydantic_models.py
+++ b/synapse/util/pydantic_models.py
@@ -30,6 +30,13 @@ class ParseModel(BaseModel):
 
     but otherwise uses Pydantic's default behaviour.
 
+    Strict mode can adversely affect some types of fields, and should be disabled
+    for a field if:
+
+    - the field's type is a `Path` or `FilePath`. Strict mode will refuse to
+      coerce from `str` (likely what the yaml parser will produce) to `FilePath`,
+      raising a `ValidationError`.
+
     For now, ignore unknown fields. In the future, we could change this so that unknown
     config values cause a ValidationError, provided the error messages are meaningful to
     server operators.