synapse/event_auth.py
def check(event, auth_events, do_sig_check=True, do_size_check=True):
    """ Checks if this event is correctly authed.

    Args:
        event: the event being checked.
        auth_events (dict: event-key -> event): the existing room state.


    Returns:
        True if the auth checks pass.
    """
    if do_size_check:
        _check_size_limits(event)

    if not hasattr(event, "room_id"):
        raise AuthError(500, "Event has no room_id: %s" % event)

    if do_sig_check:
        sender_domain = get_domain_from_id(event.sender)
        event_id_domain = get_domain_from_id(event.event_id)

        is_invite_via_3pid = (
            event.type == EventTypes.Member
            and event.membership == Membership.INVITE
            and "third_party_invite" in event.content
        )

        # Check the sender's domain has signed the event
        if not event.signatures.get(sender_domain):
            # We allow invites via 3pid to have a sender from a different
            # HS, as the sender must match the sender of the original
            # 3pid invite. This is checked further down with the
            # other dedicated membership checks.
            if not is_invite_via_3pid:
                raise AuthError(403, "Event not signed by sender's server")

        # Check the event_id's domain has signed the event
        if not event.signatures.get(event_id_domain):
            raise AuthError(403, "Event not signed by sending server")

    if auth_events is None:
        # Oh, we don't know what the state of the room was, so we
        # are trusting that this is allowed (at least for now)
        logger.warn("Trusting event: %s", event.event_id)
        return True

    if event.type == EventTypes.Create:
        room_id_domain = get_domain_from_id(event.room_id)
        if room_id_domain != sender_domain:
            raise AuthError(
                403,
                "Creation event's room_id domain does not match sender's"
            )
        # FIXME
        return True

    creation_event = auth_events.get((EventTypes.Create, ""), None)

    if not creation_event:
        raise SynapseError(
            403,
            "Room %r does not exist" % (event.room_id,)
        )

    creating_domain = get_domain_from_id(event.room_id)
    originating_domain = get_domain_from_id(event.sender)
    if creating_domain != originating_domain:
        if not _can_federate(event, auth_events):
            raise AuthError(
                403,
                "This room has been marked as unfederatable."
            )

    # FIXME: Temp hack
    if event.type == EventTypes.Aliases:
        if not event.is_state():
            raise AuthError(
                403,
                "Alias event must be a state event",
            )
        if not event.state_key:
            raise AuthError(
                403,
                "Alias event must have non-empty state_key"
            )
        sender_domain = get_domain_from_id(event.sender)
        if event.state_key != sender_domain:
            raise AuthError(
                403,
                "Alias event's state_key does not match sender's domain"
            )
        return True

    if logger.isEnabledFor(logging.DEBUG):
        logger.debug(
            "Auth events: %s",
            [a.event_id for a in auth_events.values()]
        )

    if event.type == EventTypes.Member:
        allowed = _is_membership_change_allowed(
            event, auth_events
        )
        if allowed:
            logger.debug("Allowing! %s", event)
        else:
            logger.debug("Denying! %s", event)
        return allowed

    _check_event_sender_in_room(event, auth_events)

    # Special case to allow m.room.third_party_invite events wherever
    # a user is allowed to issue invites.  Fixes
    # https://github.com/vector-im/vector-web/issues/1208 hopefully
    if event.type == EventTypes.ThirdPartyInvite:
        user_level = get_user_power_level(event.user_id, auth_events)
        invite_level = _get_named_level(auth_events, "invite", 0)

        if user_level < invite_level:
            raise AuthError(
                403, (
                    "You cannot issue a third party invite for %s." %
                    (event.content.display_name,)
                )
            )
        else:
            return True

    _can_send_event(event, auth_events)

    if event.type == EventTypes.PowerLevels:
        _check_power_levels(event, auth_events)

    if event.type == EventTypes.Redaction:
        check_redaction(event, auth_events)

    logger.debug("Allowing! %s", event)
 Checks if this event is correctly authed.

    Args:
        event: the event being checked.
        auth_events (dict: event-key -> event): the existing room state.


    Returns:
        True if the auth checks pass.
    
Checks if this event is correctly authed.
Checks if this event is correctly authed .
def check(event, auth_events, do_sig_check=True, do_size_check=True):
    if do_size_check:
        _check_size_limits(event)
    if not hasattr(event, "room_id"):
        raise AuthError(500, "Event has no room_id: %s" % event)
    if do_sig_check:
        sender_domain = get_domain_from_id(event.sender)
        event_id_domain = get_domain_from_id(event.event_id)
        is_invite_via_3pid = (
            event.type == EventTypes.Member
            and event.membership == Membership.INVITE
            and "third_party_invite" in event.content
        )
        if not event.signatures.get(sender_domain):
            if not is_invite_via_3pid:
                raise AuthError(403, "Event not signed by sender's server")
        if not event.signatures.get(event_id_domain):
            raise AuthError(403, "Event not signed by sending server")
    if auth_events is None:
        logger.warn("Trusting event: %s", event.event_id)
        return True
    if event.type == EventTypes.Create:
        room_id_domain = get_domain_from_id(event.room_id)
        if room_id_domain != sender_domain:
            raise AuthError(
                403,
                "Creation event's room_id domain does not match sender's"
            )
        return True
    creation_event = auth_events.get((EventTypes.Create, ""), None)
    if not creation_event:
        raise SynapseError(
            403,
            "Room %r does not exist" % (event.room_id,)
        )
    creating_domain = get_domain_from_id(event.room_id)
    originating_domain = get_domain_from_id(event.sender)
    if creating_domain != originating_domain:
        if not _can_federate(event, auth_events):
            raise AuthError(
                403,
                "This room has been marked as unfederatable."
            )
    : Temp hack
    if event.type == EventTypes.Aliases:
        if not event.is_state():
            raise AuthError(
                403,
                "Alias event must be a state event",
            )
        if not event.state_key:
            raise AuthError(
                403,
                "Alias event must have non-empty state_key"
            )
        sender_domain = get_domain_from_id(event.sender)
        if event.state_key != sender_domain:
            raise AuthError(
                403,
                "Alias event's state_key does not match sender's domain"
            )
        return True
    if logger.isEnabledFor(logging.DEBUG):
        logger.debug(
            "Auth events: %s",
            [a.event_id for a in auth_events.values()]
        )
    if event.type == EventTypes.Member:
        allowed = _is_membership_change_allowed(
            event, auth_events
        )
        if allowed:
            logger.debug("Allowing! %s", event)
        else:
            logger.debug("Denying! %s", event)
        return allowed
    _check_event_sender_in_room(event, auth_events)
    if event.type == EventTypes.ThirdPartyInvite:
        user_level = get_user_power_level(event.user_id, auth_events)
        invite_level = _get_named_level(auth_events, "invite", 0)
        if user_level < invite_level:
            raise AuthError(
                403, (
                    "You cannot issue a third party invite for %s." %
                    (event.content.display_name,)
                )
            )
        else:
            return True
    _can_send_event(event, auth_events)
    if event.type == EventTypes.PowerLevels:
        _check_power_levels(event, auth_events)
    if event.type == EventTypes.Redaction:
        check_redaction(event, auth_events)
    logger.debug("Allowing! %s", event)
def check ( event , auth_events , do_sig_check = True , do_size_check = True ) : if do_size_check : _check_size_limits ( event ) if not hasattr ( event , "room_id" ) : raise AuthError ( 500 , "Event has no room_id: %s" % event ) if do_sig_check : sender_domain = get_domain_from_id ( event . sender ) event_id_domain = get_domain_from_id ( event . event_id ) is_invite_via_3pid = ( event . type == EventTypes . Member and event . membership == Membership . INVITE and "third_party_invite" in event . content ) if not event . signatures . get ( sender_domain ) : if not is_invite_via_3pid : raise AuthError ( 403 , "Event not signed by sender's server" ) if not event . signatures . get ( event_id_domain ) : raise AuthError ( 403 , "Event not signed by sending server" ) if auth_events is None : logger . warn ( "Trusting event: %s" , event . event_id ) return True if event . type == EventTypes . Create : room_id_domain = get_domain_from_id ( event . room_id ) if room_id_domain != sender_domain : raise AuthError ( 403 , "Creation event's room_id domain does not match sender's" ) return True creation_event = auth_events . get ( ( EventTypes . Create , "" ) , None ) if not creation_event : raise SynapseError ( 403 , "Room %r does not exist" % ( event . room_id , ) ) creating_domain = get_domain_from_id ( event . room_id ) originating_domain = get_domain_from_id ( event . sender ) if creating_domain != originating_domain : if not _can_federate ( event , auth_events ) : raise AuthError ( 403 , "This room has been marked as unfederatable." ) if event . type == EventTypes . Aliases : if not event . is_state ( ) : raise AuthError ( 403 , "Alias event must be a state event" , ) if not event . state_key : raise AuthError ( 403 , "Alias event must have non-empty state_key" ) sender_domain = get_domain_from_id ( event . sender ) if event . state_key != sender_domain : raise AuthError ( 403 , "Alias event's state_key does not match sender's domain" ) return True if logger . isEnabledFor ( logging . DEBUG ) : logger . debug ( "Auth events: %s" , [ a . event_id for a in auth_events . values ( ) ] ) if event . type == EventTypes . Member : allowed = _is_membership_change_allowed ( event , auth_events ) if allowed : logger . debug ( "Allowing! %s" , event ) else : logger . debug ( "Denying! %s" , event ) return allowed _check_event_sender_in_room ( event , auth_events ) if event . type == EventTypes . ThirdPartyInvite : user_level = get_user_power_level ( event . user_id , auth_events ) invite_level = _get_named_level ( auth_events , "invite" , 0 ) if user_level < invite_level : raise AuthError ( 403 , ( "You cannot issue a third party invite for %s." % ( event . content . display_name , ) ) ) else : return True _can_send_event ( event , auth_events ) if event . type == EventTypes . PowerLevels : _check_power_levels ( event , auth_events ) if event . type == EventTypes . Redaction : check_redaction ( event , auth_events ) logger . debug ( "Allowing! %s" , event )
Checks if this event is correctly authed.
Checks if this event is correctly authed .
""" Checks if this event is correctly authed.

    Args:
        event: the event being checked.
        auth_events (dict: event-key -> event): the existing room state.


    Returns:
        True if the auth checks pass.
    """ # Check the sender's domain has signed the event # We allow invites via 3pid to have a sender from a different # HS, as the sender must match the sender of the original # 3pid invite. This is checked further down with the # other dedicated membership checks. # Check the event_id's domain has signed the event # Oh, we don't know what the state of the room was, so we # are trusting that this is allowed (at least for now) # FIXME # FIXME: Temp hack # Special case to allow m.room.third_party_invite events wherever # a user is allowed to issue invites.  Fixes # https://github.com/vector-im/vector-web/issues/1208 hopefully
True if the auth checks pass.
True if the auth checks pass .
event
the event being checked.
the event being checked .
auth_events
do_sig_check
do_size_check
auth_events (dict
event-key -> event): the existing room state.
event - key - > event ) : the existing room state .