Exclude insecure devices: auditbot & adminbot verification

Problem

As part of ESS, we provide the auditbot and adminbot extensions for auditing and moderation purposes. For both of these, a dedicated Matrix user account is created in order to listen to room events and act accordingly. However, currently the devices created for this purpose are not verified. Thus the bot user won't be able to receive or send messages when insecure devices get excluded.

Solution

Based on the documentation (e.g. https://docs.element.io/latest/element-cloud-documentation/integrations/audit-bot/) it seems like recovery is already set up for the bot account because when a human user wants to log in as a bot, they are provided with the recovery key/passphrase to see history. This means that getting all the devices verified at all times may not be a high effort.

Work required

• ESS and related work:
• matrix-rust-sdk-crypto-nodejs and matrix-bot-sdk: https://github.com/element-hq/element-meta/issues/3088

Start by reviewing the linked audit-bot documentation and the related work in element-meta issue 3088, then trace how ESS creates and verifies the auditbot and adminbot accounts. Done means both bot devices remain usable when insecure devices are excluded; the issue does not name specific files or tests.