Check for space membership during a remote join of a restricted room #9814

clokep · 2021-04-14T16:39:38Z

This is a re-do of #9763 since I merged that prematurely. Conveniently this also means it is rebased on #9800 / the history is cleaned up into a single commit.

When receiving a /send_join request for a room with join rules set to 'restricted', check if the user is a member of the spaces defined in the 'allow' key of the join rules.

This now also returns the auth error properly back to the client (instead of a generic 400 error).

This only applies to an experimental room version, as defined in MSC3083.

See matrix-org/complement#99 for integration tests on this.

Fixes #9715

clokep · 2021-04-14T16:40:42Z

synapse/handlers/room_member.py

-    async def _can_join_without_invite(
-        self, state_ids: StateMap[str], room_version: RoomVersion, user_id: str
-    ) -> bool:


This is moved to a separate handler to avoid an import loop between the RoomMemberHandler and FederationHandler.

clokep · 2021-04-14T16:41:04Z

synapse/handlers/federation.py

@@ -2006,7 +2037,7 @@ async def _auth_and_persist_event(
        state: Optional[Iterable[EventBase]] = None,
        auth_events: Optional[MutableStateMap[EventBase]] = None,
        backfilled: bool = False,
-    ) -> EventContext:
+    ) -> None:


The return value here was now never used.

clokep · 2021-04-14T16:41:44Z

synapse/handlers/event_auth.py

+    async def can_join_without_invite(
+        self, state_ids: StateMap[str], room_version: RoomVersion, user_id: str
+    ) -> bool:


This is identical to the original version, except changing self.store to self._store.

…#9763) When receiving a /send_join request for a room with join rules set to 'restricted', check if the user is a member of the spaces defined in the 'allow' key of the join rules. This only applies to an experimental room version, as defined in MSC3083.

clokep · 2021-04-14T16:48:00Z

One last piece of this, which was mentioned on the complement PR would be to return a better error code over federation when this happens. I'm not sure if that's really part of this PR or a follow-up though.

richvdh

a few nits, generally lgtm

synapse/federation/federation_client.py

synapse/handlers/event_auth.py

synapse/handlers/federation.py

Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>

…remote-joins

richvdh

lgtm

@rkfg

Synapse 1.33.0rc1 (2021-04-28) ============================== Features -------- - Update experimental support for [MSC3083](matrix-org/matrix-spec-proposals#3083): restricting room access via group membership. ([\#9800](#9800), [\#9814](#9814)) - Add experimental support for handling presence on a worker. ([\#9819](#9819), [\#9820](#9820), [\#9828](#9828), [\#9850](#9850)) - Return a new template when an user attempts to renew their account multiple times with the same token, stating that their account is set to expire. This replaces the invalid token template that would previously be shown in this case. This change concerns the optional account validity feature. ([\#9832](#9832)) Bugfixes -------- - Fixes the OIDC SSO flow when using a `public_baseurl` value including a non-root URL path. ([\#9726](#9726)) - Fix thumbnail generation for some sites with non-standard content types. Contributed by @rkfg. ([\#9788](#9788)) - Add some sanity checks to identity server passed to 3PID bind/unbind endpoints. ([\#9802](#9802)) - Limit the size of HTTP responses read over federation. ([\#9833](#9833)) - Fix a bug which could cause Synapse to get stuck in a loop of resyncing device lists. ([\#9867](#9867)) - Fix a long-standing bug where errors from federation did not propagate to the client. ([\#9868](#9868)) Improved Documentation ---------------------- - Add a note to the docker docs mentioning that we mirror upstream's supported Docker platforms. ([\#9801](#9801)) Internal Changes ---------------- - Add a dockerfile for running Synapse in worker-mode under Complement. ([\#9162](#9162)) - Apply `pyupgrade` across the codebase. ([\#9786](#9786)) - Move some replication processing out of `generic_worker`. ([\#9796](#9796)) - Replace `HomeServer.get_config()` with inline references. ([\#9815](#9815)) - Rename some handlers and config modules to not duplicate the top-level module. ([\#9816](#9816)) - Fix a long-standing bug which caused `max_upload_size` to not be correctly enforced. ([\#9817](#9817)) - Reduce CPU usage of the user directory by reusing existing calculated room membership. ([\#9821](#9821)) - Small speed up for joining large remote rooms. ([\#9825](#9825)) - Introduce flake8-bugbear to the test suite and fix some of its lint violations. ([\#9838](#9838)) - Only store the raw data in the in-memory caches, rather than objects that include references to e.g. the data stores. ([\#9845](#9845)) - Limit length of accepted email addresses. ([\#9855](#9855)) - Remove redundant `synapse.types.Collection` type definition. ([\#9856](#9856)) - Handle recently added rate limits correctly when using `--no-rate-limit` with the demo scripts. ([\#9858](#9858)) - Disable invite rate-limiting by default when running the unit tests. ([\#9871](#9871)) - Pass a reactor into `SynapseSite` to make testing easier. ([\#9874](#9874)) - Make `DomainSpecificString` an `attrs` class. ([\#9875](#9875)) - Add type hints to `synapse.api.auth` and `synapse.api.auth_blocking` modules. ([\#9876](#9876)) - Remove redundant `_PushHTTPChannel` test class. ([\#9878](#9878)) - Remove backwards-compatibility code for Python versions < 3.6. ([\#9879](#9879)) - Small performance improvement around handling new local presence updates. ([\#9887](#9887))

@rkfg

Synapse 1.33.0 (2021-05-05) =========================== Features -------- - Build Debian packages for Ubuntu 21.04 (Hirsute Hippo). ([\#9909](matrix-org/synapse#9909)) Synapse 1.33.0rc2 (2021-04-29) ============================== Bugfixes -------- - Fix tight loop when handling presence replication when using workers. Introduced in v1.33.0rc1. ([\#9900](matrix-org/synapse#9900)) Synapse 1.33.0rc1 (2021-04-28) ============================== Features -------- - Update experimental support for [MSC3083](matrix-org/matrix-spec-proposals#3083): restricting room access via group membership. ([\#9800](matrix-org/synapse#9800), [\#9814](matrix-org/synapse#9814)) - Add experimental support for handling presence on a worker. ([\#9819](matrix-org/synapse#9819), [\#9820](matrix-org/synapse#9820), [\#9828](matrix-org/synapse#9828), [\#9850](matrix-org/synapse#9850)) - Return a new template when an user attempts to renew their account multiple times with the same token, stating that their account is set to expire. This replaces the invalid token template that would previously be shown in this case. This change concerns the optional account validity feature. ([\#9832](matrix-org/synapse#9832)) Bugfixes -------- - Fixes the OIDC SSO flow when using a `public_baseurl` value including a non-root URL path. ([\#9726](matrix-org/synapse#9726)) - Fix thumbnail generation for some sites with non-standard content types. Contributed by @rkfg. ([\#9788](matrix-org/synapse#9788)) - Add some sanity checks to identity server passed to 3PID bind/unbind endpoints. ([\#9802](matrix-org/synapse#9802)) - Limit the size of HTTP responses read over federation. ([\#9833](matrix-org/synapse#9833)) - Fix a bug which could cause Synapse to get stuck in a loop of resyncing device lists. ([\#9867](matrix-org/synapse#9867)) - Fix a long-standing bug where errors from federation did not propagate to the client. ([\#9868](matrix-org/synapse#9868)) Improved Documentation ---------------------- - Add a note to the docker docs mentioning that we mirror upstream's supported Docker platforms. ([\#9801](matrix-org/synapse#9801)) Internal Changes ---------------- - Add a dockerfile for running Synapse in worker-mode under Complement. ([\#9162](matrix-org/synapse#9162)) - Apply `pyupgrade` across the codebase. ([\#9786](matrix-org/synapse#9786)) - Move some replication processing out of `generic_worker`. ([\#9796](matrix-org/synapse#9796)) - Replace `HomeServer.get_config()` with inline references. ([\#9815](matrix-org/synapse#9815)) - Rename some handlers and config modules to not duplicate the top-level module. ([\#9816](matrix-org/synapse#9816)) - Fix a long-standing bug which caused `max_upload_size` to not be correctly enforced. ([\#9817](matrix-org/synapse#9817)) - Reduce CPU usage of the user directory by reusing existing calculated room membership. ([\#9821](matrix-org/synapse#9821)) - Small speed up for joining large remote rooms. ([\#9825](matrix-org/synapse#9825)) - Introduce flake8-bugbear to the test suite and fix some of its lint violations. ([\#9838](matrix-org/synapse#9838)) - Only store the raw data in the in-memory caches, rather than objects that include references to e.g. the data stores. ([\#9845](matrix-org/synapse#9845)) - Limit length of accepted email addresses. ([\#9855](matrix-org/synapse#9855)) - Remove redundant `synapse.types.Collection` type definition. ([\#9856](matrix-org/synapse#9856)) - Handle recently added rate limits correctly when using `--no-rate-limit` with the demo scripts. ([\#9858](matrix-org/synapse#9858)) - Disable invite rate-limiting by default when running the unit tests. ([\#9871](matrix-org/synapse#9871)) - Pass a reactor into `SynapseSite` to make testing easier. ([\#9874](matrix-org/synapse#9874)) - Make `DomainSpecificString` an `attrs` class. ([\#9875](matrix-org/synapse#9875)) - Add type hints to `synapse.api.auth` and `synapse.api.auth_blocking` modules. ([\#9876](matrix-org/synapse#9876)) - Remove redundant `_PushHTTPChannel` test class. ([\#9878](matrix-org/synapse#9878)) - Remove backwards-compatibility code for Python versions < 3.6. ([\#9879](matrix-org/synapse#9879)) - Small performance improvement around handling new local presence updates. ([\#9887](matrix-org/synapse#9887))

clokep requested a review from richvdh April 14, 2021 16:40

clokep commented Apr 14, 2021

View reviewed changes

clokep force-pushed the clokep/restricted-remote-joins branch from 8b084f2 to bd901fe Compare April 14, 2021 16:47

Return auth errors back to the client.

4c25353

richvdh reviewed Apr 16, 2021

View reviewed changes

clokep and others added 7 commits April 20, 2021 09:48

Apply suggestions from code review

af2d1e6

Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>

Rename variables based on feedback.

5350838

Fix-up comments.

03a8d43

Remove extraneous log-line.

6e8a50c

Lint

32c9467

Merge remote-tracking branch 'origin/develop' into clokep/restricted-…

680167d

…remote-joins

Revert changes to FederationClient.

4e37845

clokep requested a review from richvdh April 22, 2021 12:20

clokep mentioned this pull request Apr 22, 2021

Pass back errors to the client when trying multiple federation destinations #9868

Merged

richvdh approved these changes Apr 22, 2021

View reviewed changes

clokep merged commit d924827 into develop Apr 23, 2021

clokep deleted the clokep/restricted-remote-joins branch April 23, 2021 11:05

clokep mentioned this pull request Jun 29, 2021

Move methods involving event authentication to EventAuthHandler. #10268

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Check for space membership during a remote join of a restricted room #9814

Check for space membership during a remote join of a restricted room #9814

clokep commented Apr 14, 2021 •

edited

Loading

clokep Apr 14, 2021

clokep Apr 14, 2021

clokep Apr 14, 2021

clokep commented Apr 14, 2021

richvdh left a comment

richvdh left a comment

Check for space membership during a remote join of a restricted room #9814

Check for space membership during a remote join of a restricted room #9814

Conversation

clokep commented Apr 14, 2021 • edited Loading

clokep Apr 14, 2021

Choose a reason for hiding this comment

clokep Apr 14, 2021

Choose a reason for hiding this comment

clokep Apr 14, 2021

Choose a reason for hiding this comment

clokep commented Apr 14, 2021

richvdh left a comment

Choose a reason for hiding this comment

richvdh left a comment

Choose a reason for hiding this comment

clokep commented Apr 14, 2021 •

edited

Loading