Disable backfilling with double puppets on other servers

config/config.go

@@ -87,6 +87,18 @@ func (config *Config) CanAutoDoublePuppet(userID id.UserID) bool {
 	return hasSecret
 }
 
+func (config *Config) CanDoublePuppetBackfill(userID id.UserID) bool {
+	if !config.Bridge.HistorySync.DoublePuppetBackfill {
+		return false
+	}
+	_, homeserver, _ := userID.Parse()
+	// Batch sending can only use local users, so don't allow double puppets on other servers.
+	if homeserver != config.Homeserver.Domain {
+		return false
+	}
+	return true
+}
+
 func Load(path string) (*Config, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {

example-config.yaml

@@ -104,6 +104,7 @@ bridge:
         # Use double puppets for backfilling?
         # In order to use this, the double puppets must be in the appservice's user ID namespace
         # (because the bridge can't use the double puppet access token with batch sending).
+        # This only affects double puppets on the local server, double puppets on other servers will never be used.
         double_puppet_backfill: false
         # Should the bridge request a full sync from the phone when logging in?
         # This bumps the size of history syncs from 3 months to 1 year.

historysync.go

@@ -392,7 +392,7 @@ func (portal *Portal) backfill(source *User, messages []*waProto.WebMessageInfo)
 		}
 		puppet := portal.getMessagePuppet(source, info)
 		intent := puppet.IntentFor(portal)
-		if intent.IsCustomPuppet && !portal.bridge.Config.Bridge.HistorySync.DoublePuppetBackfill {
+		if intent.IsCustomPuppet && !portal.bridge.Config.CanDoublePuppetBackfill(puppet.CustomMXID) {
 			intent = puppet.DefaultIntent()
 			addMember(puppet)
 		}