feat: add sendtransaction validation pdu

packages/core/src/events/m.room.create.spec.ts

@@ -44,7 +44,7 @@ test("roomCreateEvent", async () => {
 	});
 
 	const signed = await signEvent(event, signature, "hs1");
-
+	// @ts-ignore
 	expect(signed).toStrictEqual(finalEvent);
 	expect(signed).toHaveProperty(
 		"signatures.hs1.ed25519:a_HDhg",

packages/core/src/events/m.room.power_levels.ts

@@ -32,6 +32,10 @@ export interface RoomPowerLevelsEvent extends EventBase {
 		redact: number;
 		invite: number;
 		historical: number;
+
+		notifications?: {
+			[key: string]: number;
+		};
 	};
 	unsigned?: {
 		age_ts: number;

packages/fake/src/room.ts

@@ -137,11 +137,17 @@ export const fakeEndpoints = new Elysia({ prefix: "/fake" })
 			}
 
 			const lastEventId = events[events.length - 1]._id;
-			const lastEvent = events[events.length - 1].event as any; //TODO: fix typing
+			const lastEvent = events[events.length - 1].event;
 
 			const inviteEvent = await signEvent(
 				roomMemberEvent({
-					auth_events: lastEvent.auth_events,
+					auth_events: {
+						// that's not true but it's a fake operation
+						create: lastEvent.auth_events[0],
+						power_levels: lastEvent.auth_events[1],
+						join_rules: lastEvent.auth_events[2],
+						history_visibility: lastEvent.auth_events[3],
+					},
 					membership: "invite",
 					depth: lastEvent.depth + 1,
 					// origin: lastEvent.origin,

packages/homeserver/src/fixtures/ContextBuilder.ts

@@ -34,9 +34,9 @@
 }
 
 class MockedRoom {
-	private events: EventStore[] = [];
+	public events: EventStore[] = [];
 	constructor(
-		private roomId: string,
+		public roomId: string,
 		events: EventStore[],
 	) {
 		for (const event of events) {
@@ -61,8 +61,8 @@
 		return new ContextBuilder(name);
 	}
 
 	public withName(name: string) {
 		this.name = name;
 		return this;
 	}
 
@@ -76,18 +76,18 @@
 		return this;
 	}
 
 	public withConfig(config: any) {
 		this.config = config;
 		return this;
 	}
 
 	public withMongo(mongo: any) {
 		this.mongo = mongo;
 		return this;
 	}
 
 	public withMutex(mutex: any) {
 		this.mutex = mutex;
 		return this;
 	}
 
@@ -101,8 +101,8 @@
 		return this;
 	}
 
 	public withRemoteSigningKey(remote: string, signingKey: SigningKey) {
 		this.remoteRemoteSigningKeys.set(remote, signingKey);
 		return this;
 	}
 
@@ -143,13 +143,13 @@
 							?.filter((event) => eventIds.includes(event._id)) ?? []
 					);
 				},
 				createStagingEvent: async (event: EventBase) => {
 					const id = generateId(event);
 					this.events.get(event.room_id)?.push({
 						_id: id,
 						event,
 						staged: true,
 					});
 					return id;
 				},
 				createEvent: async (event: EventBase) => {
@@ -191,7 +191,10 @@
 			makeRequest,
 			createRoom: async (sender: string, ...members: string[]) => {
 				const { roomId, events } = await createRoom(
-					[sender, ...members],
+					[
+						`@${sender}:${config.name}`,
+						...members.map((member) => `@${member}:${config.name}`),
+					],
 					createSignedEvent(config.signingKey[0], config.name),
 					`!${createMediaId(18)}:${config.name}`,
 				);

packages/homeserver/src/procedures/autorization/ensureAuthorizationRules.ts

@@ -0,0 +1,218 @@
+import type { EventBase } from "@hs/core/src/events/eventBase";
+import { generateId } from "../../authentication";
+import type { EventStore } from "../../plugins/mongodb";
+import { isRoomCreateEvent } from "@hs/core/src/events/m.room.create";
+import {
+	type RoomMemberEvent,
+	isRoomMemberEvent,
+} from "@hs/core/src/events/m.room.member";
+import {
+	type PowerLevelNames,
+	isRoomPowerLevelsEvent,
+} from "@hs/core/src/events/m.room.power_levels";
+import { validateRoomCreateEvent } from "./validateRoomCreateEvent";
+import { validateRoomMemberEvent } from "./validateRoomMemberEvent";
+import { validateRoomPowerLevelsEvent } from "./validateRoomPowerLevelsEvent";
+
+const difference = (a: string[], b: string[]) =>
+	a.filter((x) => !b.includes(x));
+const getMissingEvents = (a: string[]) => [];
+
+// https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules
+
+export const ensureAuthorizationRulesBatch = function* (
+	events: EventBase[],
+	roomId: string,
+	size = 100,
+) {
+	const array = [...events];
+	while (array.length) {
+		yield ensureAuthorizationRules(array.splice(0, size), roomId);
+	}
+};
+
+export const ensureAuthorizationRules = async (
+	events: EventBase[],
+	roomId: string,
+) => {
+	const eventMap = new Map(events.map((event) => [generateId(event), event]));
+	// const eventKeys = Array.from(eventMap.keys());
+
+	const seenRemoteEvents = new Set<EventStore>(); // get from database
+
+	for (const seen of seenRemoteEvents) {
+		eventMap.delete(seen._id);
+	}
+
+	const authGraph = Object.fromEntries(
+		[...eventMap.entries()].map(([id, event]) => {
+			return [id, event.auth_events.map((eventId) => eventMap.get(eventId))];
+		}),
+	);
+
+	const sortedAuthEvents = [...eventMap.values()];
+
+	const authEventIds = sortedAuthEvents
+		.flatMap((event) => event.auth_events.map((eventId) => eventId))
+		.filter(Boolean);
+
+	const authMap = new Map(
+		sortedAuthEvents
+			.filter((event) => authEventIds.includes(generateId(event)))
+			.map((event) => [generateId(event), event]),
+	);
+
+	const missingEventsId = difference(authEventIds, [...authMap.keys()]);
+
+	if (!missingEventsId.length) {
+		const missingEvents = getMissingEvents(missingEventsId);
+		for (const event of missingEvents) {
+			eventMap.set(generateId(event), event);
+		}
+	}
+
+	const eventsToBeStored = new Set<string>();
+	for await (const event of sortedAuthEvents) {
+		try {
+			if (await prep(event, authMap)) {
+				eventsToBeStored.add(generateId(event));
+			}
+		} catch (e) {
+			console.log("error", e);
+		}
+	}
+
+	return eventsToBeStored;
+};
+
+async function prep(event: EventBase, authMap: Map<string, EventBase>) {
+	const authEvents = new Map<string, EventBase>();
+	for (const authEventId of event.auth_events) {
+		const ae = authMap.get(authEventId);
+		if (!ae) {
+			// The fact we can't find the auth event doesn't mean it doesn't
+			// exist, which means it is premature to reject `event`. Instead, we
+			// just ignore it for now.
+			console.log(
+				`Dropping event ${generateId(event)}, which relies on auth_event ${authEventId}, which could not be found`,
+			);
+			return;
+		}
+		authEvents.set(authEventId, ae);
+	}
+	// We're not bothering about room state, so flag the event as an outlier.
+	// event.internalMetadata.outlier = true;
+	// const context = EventContext.forOutlier(this._storageControllers);
+
+	// validateEventForRoomVersion(event);
+	switch (true) {
+		case isRoomCreateEvent(event): {
+			await validateRoomCreateEvent(event, authEvents);
+			return true;
+		}
+		case isRoomMemberEvent(event): {
+			await validateRoomMemberEvent(event, authEvents);
+			return true;
+		}
+	}
+
+	const caller = [...authMap.values()].find((authEvent) => {
+		if (isRoomMemberEvent(authEvent)) {
+			return authEvent.state_key === event.sender;
+		}
+		return false;
+	}) as RoomMemberEvent | undefined;
+
+	const callerInRoom = caller?.content.membership === "join";
+
+	const callerPowerLevel = getUserPowerLevel(event.sender, authEvents);
+
+	const inviteLevel = getNamedPowerLevel("invite", authEvents) ?? 0;
+
+	// 5 If the sender’s current membership state is not join, reject.
+	if (!callerInRoom) {
+		throw new Error("Invalid sender");
+	}
+	// 6 If type is m.room.third_party_invite:
+	if (event.type === "m.room.third_party_invite") {
+		// 6.1 Allow if and only if sender’s current power level is greater than or equal to the invite level.
+		if (callerPowerLevel >= inviteLevel) {
+			return;
+		}
+		throw new Error("Invalid sender");
+	}
+
+	// TODO: 7 If the event type’s required power level is greater than the sender’s power level, reject.
+
+	// TODO: 8 If the event has a state_key that starts with an @ and does not match the sender, reject.
+	if (
+		"state_key" in event &&
+		event.state_key &&
+		event.state_key.startsWith("@") &&
+		event.state_key !== event.sender
+	) {
+		throw new Error("Invalid state_key");
+	}
+
+	// 9 If type is m.room.power_levels
+	if (isRoomPowerLevelsEvent(event)) {
+		await validateRoomPowerLevelsEvent(event, authEvents);
+	}
+	// 10 otherwise, allow.
+	return true;
+}
+
+export const getNamedPowerLevel = (
+	name: PowerLevelNames,
+	authEvents: Map<string, EventBase>,
+) => {
+	const powerLevelEvent = getEventPowerLevel(authEvents);
+	if (!powerLevelEvent) {
+		return;
+	}
+	return powerLevelEvent.content[name];
+};
+
+const getEventPowerLevel = (authEvents: Map<string, EventBase>) =>
+	[...authEvents.values()].find(isRoomPowerLevelsEvent);
+
+export function getUserPowerLevel(
+	userId: string,
+	authEvents: Map<string, EventBase>,
+): number {
+	/**
+	 * Get a user's power level.
+	 *
+	 * @param userId - User's ID to look up in power levels.
+	 * @param authEvents - State in force at this point in the room (or rather, a subset
+	 *                     of it including at least the create event and power levels event).
+	 * @returns The user's power level in this room.
+	 */
+
+	const powerLevelEvent = getEventPowerLevel(authEvents);
+
+	if (powerLevelEvent) {
+		const powerLevelDefault = powerLevelEvent.content?.users_default ?? 0;
+
+		return Number(
+			powerLevelEvent.content?.users?.[userId] ?? powerLevelDefault,
+		);
+	}
+	// If there is no power levels event, the creator gets 100 and everyone else gets 0.
+
+	// Some things which call this don't pass the create event: hack around that.
+
+	const createEvent = [...authEvents.values()].find(isRoomCreateEvent);
+
+	if (createEvent) {
+		// TODO: const creator = createEvent.roomVersion?.implicitRoomCreator
+		// 	? createEvent.sender
+		// 	: createEvent.content?.[EventContentFields.ROOM_CREATOR];
+
+		if (createEvent.sender === userId) {
+			return 100;
+		}
+	}
+
+	return 0;
+}