matrix-org / matrix-org/matrix-spec

Auth rules: behaviour unclear if no power level event is cited as an auth event

Open
#1,098 7 comments 0 reactions 0 assignees View on GitHub
A-S2S clarification
Dominant language
HTML
Stars
330
Forks
150
Avg merge
2h 21m
Merged PRs (30d)
3

Description

**Link to problem area**: https://spec.matrix.org/v1.2/rooms/v9/#authorization-rules and also https://spec.matrix.org/v1.2/client-server-api/#mroompower_levels

**Issue**
The auth rules say:

> **INFO:** Power levels are inferred from defaults when not explicitly supplied. For example, mentions of the sender’s power level can also refer to the default power level for users in the room.

I think this is talking about the situation where the auth rules need to lookup the power level of `@alice:alice.com` from some state map, but Alice does not have an explicit power level.

What happens if the event *E* under consideration does _not_ cite an auth event of type `m.room.power_levels`?

Options that spring to mind:
1. Reject *E* outright (making an exception for [the initial bit of room state added after the room is created](https://spec.matrix.org/v1.2/client-server-api/#post_matrixclientv3createroom)).
2. Look for a power levels event in the auth chain of *E*, rather than just *E* itself. (But perhaps this need not exist---what then?)
3. Use the default power levels [given in the C-S spec](https://spec.matrix.org/v1.2/client-server-api/#mroompower_levels) as the intended power levels when there is no such power level event in the room.
* If this is the case, the wording in the C-S spec is unhelpful. It reads
> if the room contains no `m.room.power_levels` event [...]

but it's possible that the room contains an `m.room.power_levels` event somewhere else in the DAG---it's just that one hasn't been cited as an auth_event here.

The wording of the **INFO** box in the auth rules makes me think option 3 is intended. Can anyone confirm or refute?

Contributor guide

Open the contributing guide

Research direction

Start with the authorization-rules and m.room.power_levels sections of the Matrix v1.2 specification linked in the issue, then review the seven comments for an agreed interpretation. Done means resolving whether a missing cited power-level event has defined behavior and recording that behavior clearly in the relevant specification text.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.