element-hq / element-hq/synapse
`/_matrix/client/r0/rooms/{roomId}/event/{eventId}` return Http 404 for invitation Event
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 600
- Avg merge
- 5d 22h
- Merged PRs (30d)
- 51
Description
This issue has been migrated from [#15246](https://github.com/matrix-org/synapse/issues/15246).
---
### Description
When a user is invited to a room, a Push is received with the `eventId` and the `roomId` of the invitation (it's a `m.room.member` event)
If the application tries to request the event content **before the user has joined the room** using `/_matrix/client/r0/rooms/{roomId}/event/${eventId}` (`RoomEventServlet`), the server answers with a HTTP 404.
Once the user joins the room, the server returns the event content for the same request.
I would expect the server to return the Event content, since the user is allowed to see it (it's coming from the sync response).
### Steps to reproduce
See description.
### Homeserver
Synapse
### Synapse Version
1.79.0rc1 (b=matrix-org-hotfixes,a95e906227)
### Installation Method
I don't know
### Database
matrix.org
### Workers
I don't know
### Platform
matrix.org
### Configuration
_No response_
### Relevant log output
```shell
N/A
```
### Anything else that would be useful to know?
This issue is not critical, and no bad side effect has been detected on Element Android due to this.
Contributor guide
Research direction
Start at the RoomEventServlet handling /_matrix/client/r0/rooms/{roomId}/event/{eventId}, and trace how access to invitation events is checked before and after room membership changes. Reproduce the request for an invitation event before joining, then verify that an allowed user receives the event content instead of HTTP 404.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100