Add support for MSC4560 #2352

Merged
ginger merged 4 commits from ginger/msc4560 into main 2026-10-16 03:39:39 +00:00
Owner

This pull request adds support for MSC4560 (stripped state requests over federation).

Pull request checklist:

  • This pull request targets the main branch, and the branch is named something other than
    main.
  • I have written an appropriate pull request title and my description is clear.
  • I understand I am responsible for the contents of this pull request.
  • I have followed the contributing guidelines:
<!-- In order to help reviewers know what your pull request does at a glance, you should ensure that 1. Your PR title is a short, single sentence describing what you changed 2. You have described in more detail what you have changed, why you have changed it, what the intended effect is, and why you think this will be beneficial to the project. If you have made any potentially strange/questionable design choices, but didn't feel they'd benefit from code comments, please don't mention them here - after opening your pull request, go to "files changed", and click on the "+" symbol in the line number gutter, and attach comments to the lines that you think would benefit from some clarification. --> This pull request adds support for [MSC4560](https://github.com/matrix-org/matrix-spec-proposals/pull/4560) (stripped state requests over federation). <!-- Example: This pull request allows us to warp through time and space ten times faster than before by double-inverting the warp drive with hyperheated jump fluid, both making the drive faster and more efficient. This resolves the common issue where we have to wait more than 10 milliseconds to engage, use, and disengage the warp drive when travelling between galaxies. --> <!-- Closes: #... --> <!-- Fixes: #... --> <!-- Uncomment the above line(s) if your pull request fixes an issue or closes another pull request by superseding it. Replace `#...` with the issue/pr number, such as `#123`. --> **Pull request checklist:** <!-- You need to complete these before your PR can be considered. If you aren't sure about some, feel free to ask for clarification in #dev:continuwuity.org. --> - [x] This pull request targets the `main` branch, and the branch is named something other than `main`. - [x] I have written an appropriate pull request title and my description is clear. - [x] I understand I am responsible for the contents of this pull request. - I have followed the [contributing guidelines][c1]: - [x] My contribution follows the [code style][c2], if applicable. - [x] I ran [pre-commit checks][c1pc] before opening/drafting this pull request. - [x] I have [tested my contribution][c1t] (or proof-read it for documentation-only changes) myself, if applicable. This includes ensuring code compiles. - [x] My commit messages follow the [commit message format][c1cm] and are descriptive. <!-- Notes on these requirements: - While not required, we encourage you to sign your commits with GPG or SSH to attest the authenticity of your changes. - While we allow LLM-assisted contributions, we do not appreciate contributions that are low quality, which is typical of machine-generated contributions that have not had a lot of love and care from a human. Please do not open a PR if all you have done is asked ChatGPT to tidy up the codebase with a +-100,000 diff. - In the case of code style violations, reviewers may leave review comments/change requests indicating what the ideal change would look like. For example, a reviewer may suggest you lower a log level, or use `match` instead of `if/else` etc. - In the case of code style violations, pre-commit check failures, minor things like typos/spelling errors, and in some cases commit format violations, reviewers may modify your branch directly, typically by making changes and adding a commit. Particularly in the latter case, a reviewer may rebase your commits to squash "spammy" ones (like "fix", "fix", "actually fix"), and reword commit messages that don't satisfy the format. - Pull requests MUST pass the `Checks` CI workflows to be capable of being merged. This can only be bypassed in exceptional circumstances. If your CI flakes, let us know in matrix:r/dev:continuwuity.org. - Pull requests have to be based on the latest `main` commit before being merged. If the main branch changes while you're making your changes, you should make sure you rebase on main before opening a PR. Your branch will be rebased on main before it is merged if it has fallen behind. - We typically only do fast-forward merges, so your entire commit log will be included. Once in main, it's difficult to get out cleanly, so put on your best dress, smile for the cameras! --> [c1]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md [c2]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/docs/development/code_style.mdx [c1pc]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#pre-commit-checks [c1t]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#running-tests-locally [c1cm]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#commit-messages
ginger added this to the 26.10.0 milestone 2026-10-12 18:20:20 +00:00
feat: Add support for MSC4560
Some checks failed
Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 5s
Checks / Prek / Check changed files (pull_request) Successful in 8s
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 9s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 58s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m6s
Update flake hashes / update-flake-hashes (pull_request) Successful in 2m37s
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
d2830ebad6
chore: Add some comments
All checks were successful
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 8s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 56s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m6s
Update flake hashes / update-flake-hashes (pull_request) Successful in 2m26s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m57s
bb3a802c29
nex requested changes 2026-10-12 19:17:43 +00:00
Dismissed
Lines 10-12
@ -0,0 +7,6 @@
use crate::{Ruma, router::ClientIdentity};
/// # `POST /_matrix/client/unstable/org.continuwuity.msc4560.stripped_state/{room_id_or_alias}`
///
/// Returns a room's stripped state.
Owner

nit: No link to the MSC?

nit: No link to the MSC?
ginger marked this conversation as resolved
Lines 24-29
@ -0,0 +21,9 @@
return Err!(Request(TooLarge("Too many vias, please be less indecisive.")));
}
if body.is_empty() {
// hey jimmy, gimme a stripped state with nuthin'
return Ok(get_stripped_state::unstable::Response::new(
services.globals.server_name().to_owned(),
));
}
Owner

This might mislead a client into believing a room exists because it gets a 200 OK, which skips any sort of presence/access checks that may in turn actually mean the room is inaccessible

This might mislead a client into believing a room exists because it gets a 200 OK, which skips any sort of presence/access checks that may in turn actually mean the room is inaccessible
ginger marked this conversation as resolved
Lines 38-40
@ -35,9 +25,6 @@ pub(crate) async fn create_join_event_template_route(
State(services): State<crate::State>,
body: Ruma<prepare_join_event::v1::Request>,
) -> Result<prepare_join_event::v1::Response> {
if !services.rooms.metadata.exists(&body.room_id).await {
return Err!(Request(NotFound("Room is unknown to this server.")));
}
Owner

Why was this check removed?

Why was this check removed?
Author
Owner

It's redundant. If we don't have a room we certainly aren't a resident of it, which is checked immediately afterwards.

It's redundant. If we don't have a room we certainly aren't a resident of it, which is checked immediately afterwards.
nex marked this conversation as resolved
Lines 156-158
@ -114,2 +157,6 @@
// We can't sign this, and if we don't sign it our event will fail
// the auth check, so we have to bail out here.
return Err!(Request(InvalidParam(
"join_authorized_via_users_server was supplied for a room that is not restricted"
)));
}
Owner

This isn't true, the field is ignored in this case. There's no need to return an error

This isn't true, the field is ignored in this case. There's no need to return an error
Author
Owner

Event auth step 5.2.1 runs if join_authorized_via_users_server is present, regardless of the room's join rules. We obviously cannot remove join_authorized_via_users_server from the event without invalidating the signature, so we have two options:

  1. Sign the event ourselves even though there's no point to doing that.
  2. Bail out.

I chose option 2 on the grounds that the best course of action is generally not to hand out signatures that we don't need to hand out, even if doing so would currently be harmless.

[Event auth step 5.2.1](https://spec.matrix.org/v1.19/rooms/v12/#:~:text=If%20the%20event%20is%20not%20validly%20signed%20by%20the%20homeserver%20of%20the%20user%20ID%20denoted%20by%20the%20key%2C%20reject) runs if `join_authorized_via_users_server` is present, regardless of the room's join rules. We obviously cannot remove `join_authorized_via_users_server` from the event without invalidating the signature, so we have two options: 1. Sign the event ourselves even though there's no point to doing that. 2. Bail out. I chose option 2 on the grounds that the best course of action is generally not to hand out signatures that we don't need to hand out, even if doing so would currently be harmless.
Owner

Oh it DOES I didn't see that, I skipped over to 5.5.3.2, which would have fallen through to the implicit allow. That's dumb, oh well

Oh it DOES I didn't see that, I skipped over to [5.5.3.2](https://spec.matrix.org/v1.19/rooms/v12/#:~:text=If%20the%20join%5Fauthorised%5Fvia%5Fusers%5Fserver%20key%20in%20content%20is%20not%20a%20user%20with%20sufficient%20permission%20to%20invite%20other%20users%20or%20is%20not%20a%20joined%20member%20of%20the%20room%2C%20reject), which would have fallen through to the implicit allow. That's dumb, oh well
nex marked this conversation as resolved
Lines 10-12
@ -0,0 +7,6 @@
use crate::Ruma;
/// # `POST /_matrix/federation/unstable/org.continuwuity.msc4560.stripped_state/{room_id}`
///
/// Returns a room's stripped state.
Owner

nit: Same thing as the c2s route, no link to the proposal?

nit: Same thing as the c2s route, no link to the proposal?
ginger marked this conversation as resolved
Lines 17-19
@ -0,0 +14,6 @@
State(services): State<crate::State>,
body: Ruma<get_stripped_state::unstable::Request>,
) -> Result<get_stripped_state::unstable::Response> {
if body.is_empty() {
return Ok(get_stripped_state::unstable::Response::default());
}
Owner

Also doesn't do any sort of access checks that might result in an erroneous OK

Also doesn't do any sort of access checks that might result in an erroneous OK
ginger marked this conversation as resolved
@ -240,2 +273,3 @@
// to federation.
auth_user = self
.select_authorising_user(room_id, sender_user, &state_lock)
.select_authorizing_user(room_id, sender_user, state_lock)
Owner

👎

👎
nex marked this conversation as resolved
@ -809,3 +816,3 @@
/// Attempts to find a user who is able to issue an invite in the target
/// room.
pub async fn select_authorising_user<'a>(
pub async fn select_authorizing_user<'a>(
Owner

was there actually any reason to rename this? Given it is actually spelt with an S in the spec

was there actually any reason to rename this? Given it is actually spelt with an S in the spec
Author
Owner

The zpec uzez a Z in field and error code namez. I don't feel that strongly about it though.

The zpec uzez a Z in field and error code namez. I don't feel that strongly about it though.
ginger marked this conversation as resolved
@ -941,0 +936,4 @@
.meowlnir_accept_make_join(room_id.to_owned(), user_id.to_owned())
.await
} else {
// Servers can't pass the spam checker.
Owner

yes they can

yes they can
Owner

(no they can't)

(no they can't)
Author
Owner

Not with the current spam checker API. I've updated the comment to clarify that.

Not with the current spam checker API. I've updated the comment to clarify that.
nex marked this conversation as resolved
Lines 567-571
@ -539,0 +565,8 @@
.build_local_stripped_state(room_id, state, num_joined_members)
.await
{
if self.user_may_see_summary(querying_user, room_id).await {
Accessibility::Accessible((self.services.globals.server_name().to_owned(), state))
} else {
Accessibility::Inaccessible
}
Owner

Wouldn't it be cheaper to check this before building the local state?

Wouldn't it be cheaper to check this before building the local state?
Author
Owner

The summary visibility functions assume that the room exists. We have to try to build the summary first so that we can return NotFound if it doesn't.

The summary visibility functions assume that the room exists. We have to try to build the summary first so that we can return `NotFound` if it doesn't.
nex marked this conversation as resolved
Lines 589-593
@ -539,0 +588,8 @@
.build_local_stripped_state(room_id, state, num_joined_members)
.await
{
if self.server_may_see_summary(querying_server, room_id).await {
Accessibility::Accessible(state)
} else {
Accessibility::Inaccessible
}
Owner

Wouldn't it be cheaper to check this before building the local state?

Wouldn't it be cheaper to check this before building the local state?
Author
Owner

(same as other case)

(same as other case)
nex marked this conversation as resolved
ginger force-pushed ginger/msc4560 from bb3a802c29
All checks were successful
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 8s
Checks / Prek / Check changed files (pull_request) Successful in 6s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 56s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m6s
Update flake hashes / update-flake-hashes (pull_request) Successful in 2m26s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m57s
to 4f231db72a
Some checks failed
Checks / Prek / Check changed files (pull_request) Successful in 8s
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 17s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m11s
Update flake hashes / update-flake-hashes (pull_request) Successful in 2m34s
Checks / Prek / Clippy and Cargo Tests (pull_request) Successful in 9m6s
Checks / Prek / Pre-commit & Formatting (pull_request) Failing after 20m49s
2026-10-12 19:54:06 +00:00
Compare
nex approved these changes 2026-10-13 00:18:29 +00:00
nex left a comment

Conflicts with main and needs formatting, otherwise lgtm

Conflicts with main and needs formatting, otherwise lgtm
chore: Switch to upstream ruma
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 10s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m19s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m29s
Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
36b91da546
ginger force-pushed ginger/msc4560 from 36b91da546
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 10s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m19s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m29s
Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
to 0a5e9ab7ac
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 8s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m6s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m22s
Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
2026-10-16 02:54:04 +00:00
Compare
ginger changed title from WIP: Add support for MSC4560 to Add support for MSC4560 2026-10-16 02:55:05 +00:00
ginger force-pushed ginger/msc4560 from 0a5e9ab7ac
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 8s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m6s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m22s
Checks / Prek / Pre-commit & Formatting (pull_request) Has been cancelled
Checks / Prek / Clippy and Cargo Tests (pull_request) Has been cancelled
to 138dd61f82
Some checks failed
Checks / Changelog / Check changelog is added (pull_request_target) Successful in 6s
Checks / Prek / Check changed files (pull_request) Successful in 7s
Documentation / Build and Deploy Documentation (pull_request) Successful in 1m6s
Update flake hashes / update-flake-hashes (pull_request) Successful in 1m20s
Checks / Prek / Pre-commit & Formatting (pull_request) Successful in 21m1s
Checks / Prek / Clippy and Cargo Tests (pull_request) Failing after 40m34s
Checks / Prek / Check changed files (push) Successful in 8s
Documentation / Build and Deploy Documentation (push) Successful in 1m5s
Checks / Prek / Clippy and Cargo Tests (push) Successful in 13m38s
Release Docker Image / Build linux-amd64 (release) (push) Successful in 14m43s
Checks / Prek / Pre-commit & Formatting (push) Successful in 21m3s
Release Docker Image / Build linux-arm64 (release) (push) Successful in 53m31s
Release Docker Image / Create Multi-arch Release Manifest (push) Successful in 16s
Release Docker Image / Build linux-amd64 (max-perf) (push) Successful in 32m46s
Release Docker Image / Build linux-arm64 (max-perf) (push) Successful in 1h14m28s
Release Docker Image / Release Binaries (push) Has been skipped
Release Docker Image / Create Max-Perf Manifest (push) Successful in 16s
Release Docker Image / Mirror Images (push) Successful in 2m17s
2026-10-16 02:56:39 +00:00
Compare
ginger merged commit 138dd61f82 into main 2026-10-16 03:39:39 +00:00
ginger deleted branch ginger/msc4560 2026-10-16 03:39:40 +00:00
Sign in to join this conversation.
No reviewers
nex
No milestone
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
continuwuation/continuwuity!2352
No description provided.