Add room power levels to verify user in room response

If Synapse has the related admin api (matrix-org/synapse#9168), fetch power levels and add them to the result of the verify user in room.

The response structure is the m.room.power_levels state event content with the users stripped out. The user level is found separately on the higher level to avoid confusion related to all the power levels for users in the room.

CHANGELOG.md

@@ -17,6 +17,10 @@
 
 * Better documentation in readme.
 
+* The `/verify/user_in_room` now also returns power levels of the room. In addition to
+  the user power level in the room returned are the levels required for various actions
+  in the room and default levels.
+
 ## v1.1.0
 
 ### Added

README.md

@@ -7,6 +7,8 @@ Main features:
 * Verifies a C2S [Open ID token](https://matrix.org/docs/spec/client_server/r0.6.1#id154)
   using the S2S [UserInfo endpoint](https://matrix.org/docs/spec/server_server/r0.1.4#openid).
 * Can verify user is a member in a given room (Synapse only currently, requires admin level token).
+  In addition to returning membership status, returned will be user power level, the room power 
+  defaults and required power for events.
 
 ## How to use
 
@@ -147,7 +149,26 @@ Successful validation response:
     "room_membership": true,
     "user": true
   },
-  "user_id": "@user:domain.tld"
+  "user_id": "@user:domain.tld",
+  "power_levels": {
+    "room": {
+      "ban": 50,
+      "events": {
+        "m.room.avatar": 50,
+        "m.room.canonical_alias": 50,
+        "m.room.history_visibility": 100,
+        "m.room.name": 50,
+        "m.room.power_levels": 100
+      },
+      "events_default": 0,
+      "invite": 0,
+      "kick": 50,
+      "redact": 50,
+      "state_default": 50,
+      "users_default": 0
+    },
+    "user": 50
+  }
 }
 ```
 
@@ -159,7 +180,8 @@ Failed validation, in case token is not valid:
     "room_membership": false,
     "user": false
   },
-  "user_id": null
+  "user_id": null,
+  "power_levels": null
 }
 ```
 
@@ -171,7 +193,8 @@ In the token was validated but user is not in room, the failed response is:
     "room_membership": false,
     "user": true
   },
-  "user_id": "@user:domain.tld"
+  "user_id": "@user:domain.tld",
+  "power_levels": null
 }
 ```
 

src/routes.js

@@ -1,4 +1,5 @@
 const {
+    getRoomPowerLevels,
     sanityCheckRequest,
     verifyOpenIDToken,
     verifyRoomMembership,
@@ -59,28 +60,40 @@ const routes = {
             logger.log('info', 'Request sanity check failed.', {requestId: req.requestId});
             return;
         }
+        // First verify token is ok
         const tokenResult = await verifyOpenIDToken(req);
         if (!tokenResult) {
             res.send({
                 results: { user: false, room_membership: null },
-                user_id: null,
+                user_id: null, power_levels: null,
             });
             logger.log('info', 'User token check failed.', {requestId: req.requestId});
             return false;
         }
+        // Then verify room membership
         // noinspection JSUnresolvedVariable
         const membershipResult = await verifyRoomMembership(tokenResult, req);
         if (!membershipResult) {
             res.send({
                 results: { user: true, room_membership: false },
-                user_id: tokenResult,
+                user_id: tokenResult, power_levels: null,
             });
             logger.log('info', 'User verified but room membership check failed.', {requestId: req.requestId});
             return;
         }
+        // Then get power level if available
+        const powerLevelResult = await getRoomPowerLevels(tokenResult, req);
+        if (!powerLevelResult) {
+            logger.log('info', 'User and room membership verified, but failed to fetch power levels',
+                {requestId: req.requestId});
+            res.send({
+                results: { user: true, room_membership: true },
+                user_id: tokenResult, power_levels: null,
+            });
+        }
         res.send({
             results: { user: true, room_membership: true },
-            user_id: tokenResult,
+            user_id: tokenResult, power_levels: powerLevelResult,
         });
         logger.log('info', 'Token and room membership check out, user verified.', {requestId: req.requestId});
     },

src/verify.js

@@ -5,6 +5,53 @@ const {errorLogger, tryStringify} = require('./utils');
 
 require('dotenv').config();
 
+/**
+ * Fetch power levels for a room.
+ *
+ * Uses Synapse admin API. Returns an object of;
+ *
+ * `room` - the content of the state event `m.room.power_levels` but with `users` removed
+ * `user` - the power level of the user
+ *
+ * @param {string} userId               Matrix user ID
+ * @param req                           Request object
+ * @returns {Promise<object|null>}
+ */
+async function getRoomPowerLevels(userId, req) {
+    let response;
+    const homeserverUrl = process.env.UVS_HOMESERVER_URL;
+    try {
+        const url = `${homeserverUrl}/_synapse/admin/v1/rooms/${req.body.room_id}/state`;
+        logger.log('debug', `Making request to: ${url}`, {requestId: req.requestId});
+        response = await axios.get(
+            url,
+            {
+                headers: {
+                    Authorization: `Bearer ${process.env.UVS_ACCESS_TOKEN}`,
+                },
+            },
+        );
+    } catch (error) {
+        errorLogger(error, req);
+        return;
+    }
+    if (response && response.data && response.data.state) {
+        try {
+            const content = response.data.state.filter(o => o.type === 'm.room.power_levels')[0].content;
+            const userLevel = content.users[userId];
+            delete content.users;
+            return {
+                room: content,
+                user: userLevel,
+            };
+        } catch (error) {
+            logger.log('warn', `Failed to find power levels in state ${req.body.room_id}`, {requestId: req.requestId});
+            return;
+        }
+    }
+    logger.log('debug', `Failed to fetch power levels for room ${req.body.room_id}`, {requestId: req.requestId});
+}
+
 function sanityCheckRequest(req, res, fields=[]) {
     if (!req.body) {
         res.status(400);
@@ -119,6 +166,7 @@ async function verifyRoomMembership(userId, req) {
 }
 
 module.exports = {
+    getRoomPowerLevels,
     sanityCheckRequest,
     verifyOpenIDToken,
     verifyRoomMembership,

tests/routes.tests.js

@@ -236,14 +236,46 @@ describe('routes', function() {
             await routes.postVerifyUserInRoom(req, res);
 
             expect(res.send.firstCall.args[0]).to.deep.equal({
-                results: {user: true, room_membership: false}, user_id: '@user:synapse.local',
+                results: {user: true, room_membership: false},
+                user_id: '@user:synapse.local',
+                power_levels: null,
             });
             expect(res.send.calledOnce).to.be.true;
         });
 
         it('returns true and user ID on valid token', async function() {
             axiosStub = sinon.stub(axios, 'get').onFirstCall().returns({data: {sub: '@user:synapse.local'}});
             axiosStub.onSecondCall().returns({data: {members: ['@user:synapse.local']}});
+            axiosStub.onThirdCall().returns({data: { state: [
+                {
+                    type: 'random.state_event',
+                },
+                {
+                    type: 'm.room.power_levels', content: {
+                        ban: 50,
+                        events: {
+                            'm.room.avatar': 50,
+                            'm.room.canonical_alias': 50,
+                            'm.room.history_visibility': 100,
+                            'm.room.name': 50,
+                            'm.room.power_levels': 100,
+                        },
+                        events_default: 0,
+                        invite: 0,
+                        kick: 50,
+                        redact: 50,
+                        state_default: 50,
+                        users_default: 0,
+                        users: {
+                            '@user:synapse.local': 100,
+                            '@user2:synapse.local': 50,
+                        },
+                    },
+                },
+                {
+                    type: 'some.other.state_event',
+                },
+            ]}});
             let req = {
                 body: {
                     room_id: '!barfoo:synapse.local',
@@ -256,7 +288,27 @@ describe('routes', function() {
             await routes.postVerifyUserInRoom(req, res);
 
             expect(res.send.firstCall.args[0]).to.deep.equal({
-                results: {user: true, room_membership: true}, user_id: '@user:synapse.local',
+                results: {user: true, room_membership: true},
+                user_id: '@user:synapse.local',
+                power_levels: {
+                    room: {
+                        ban: 50,
+                        events: {
+                            'm.room.avatar': 50,
+                            'm.room.canonical_alias': 50,
+                            'm.room.history_visibility': 100,
+                            'm.room.name': 50,
+                            'm.room.power_levels': 100,
+                        },
+                        events_default: 0,
+                        invite: 0,
+                        kick: 50,
+                        redact: 50,
+                        state_default: 50,
+                        users_default: 0,
+                    },
+                    user: 100,
+                },
             });
             expect(res.send.calledOnce).to.be.true;
         });