synapse/event_auth.py
def _verify_third_party_invite(event, auth_events):
    """
    Validates that the invite event is authorized by a previous third-party invite.

    Checks that the public key, and keyserver, match those in the third party invite,
    and that the invite event has a signature issued using that public key.

    Args:
        event: The m.room.member join event being validated.
        auth_events: All relevant previous context events which may be used
            for authorization decisions.

    Return:
        True if the event fulfills the expectations of a previous third party
        invite event.
    """
    if "third_party_invite" not in event.content:
        return False
    if "signed" not in event.content["third_party_invite"]:
        return False
    signed = event.content["third_party_invite"]["signed"]
    for key in {"mxid", "token"}:
        if key not in signed:
            return False

    token = signed["token"]

    invite_event = auth_events.get(
        (EventTypes.ThirdPartyInvite, token,)
    )
    if not invite_event:
        return False

    if invite_event.sender != event.sender:
        return False

    if event.user_id != invite_event.user_id:
        return False

    if signed["mxid"] != event.state_key:
        return False
    if signed["token"] != token:
        return False

    for public_key_object in get_public_keys(invite_event):
        public_key = public_key_object["public_key"]
        try:
            for server, signature_block in signed["signatures"].items():
                for key_name, encoded_signature in signature_block.items():
                    if not key_name.startswith("ed25519:"):
                        continue
                    verify_key = decode_verify_key_bytes(
                        key_name,
                        decode_base64(public_key)
                    )
                    verify_signed_json(signed, server, verify_key)

                    # We got the public key from the invite, so we know that the
                    # correct server signed the signed bundle.
                    # The caller is responsible for checking that the signing
                    # server has not revoked that public key.
                    return True
        except (KeyError, SignatureVerifyException,):
            continue
    return False

    Validates that the invite event is authorized by a previous third-party invite.

    Checks that the public key, and keyserver, match those in the third party invite,
    and that the invite event has a signature issued using that public key.

    Args:
        event: The m.room.member join event being validated.
        auth_events: All relevant previous context events which may be used
            for authorization decisions.

    Return:
        True if the event fulfills the expectations of a previous third party
        invite event.
    
Validates that the invite event is authorized by a previous third-party invite.
Checks that the public key, and keyserver, match those in the third party invite,
and that the invite event has a signature issued using that public key.
Validates that the invite event is authorized by a previous third - party invite . Checks that the public key and keyserver match those in the third party invite and that the invite event has a signature issued using that public key .
def _verify_third_party_invite(event, auth_events):
    if "third_party_invite" not in event.content:
        return False
    if "signed" not in event.content["third_party_invite"]:
        return False
    signed = event.content["third_party_invite"]["signed"]
    for key in {"mxid", "token"}:
        if key not in signed:
            return False
    token = signed["token"]
    invite_event = auth_events.get(
        (EventTypes.ThirdPartyInvite, token,)
    )
    if not invite_event:
        return False
    if invite_event.sender != event.sender:
        return False
    if event.user_id != invite_event.user_id:
        return False
    if signed["mxid"] != event.state_key:
        return False
    if signed["token"] != token:
        return False
    for public_key_object in get_public_keys(invite_event):
        public_key = public_key_object["public_key"]
        try:
            for server, signature_block in signed["signatures"].items():
                for key_name, encoded_signature in signature_block.items():
                    if not key_name.startswith("ed25519:"):
                        continue
                    verify_key = decode_verify_key_bytes(
                        key_name,
                        decode_base64(public_key)
                    )
                    verify_signed_json(signed, server, verify_key)
                    return True
        except (KeyError, SignatureVerifyException,):
            continue
    return False
def _verify_third_party_invite ( event , auth_events ) : if "third_party_invite" not in event . content : return False if "signed" not in event . content [ "third_party_invite" ] : return False signed = event . content [ "third_party_invite" ] [ "signed" ] for key in { "mxid" , "token" } : if key not in signed : return False token = signed [ "token" ] invite_event = auth_events . get ( ( EventTypes . ThirdPartyInvite , token , ) ) if not invite_event : return False if invite_event . sender != event . sender : return False if event . user_id != invite_event . user_id : return False if signed [ "mxid" ] != event . state_key : return False if signed [ "token" ] != token : return False for public_key_object in get_public_keys ( invite_event ) : public_key = public_key_object [ "public_key" ] try : for server , signature_block in signed [ "signatures" ] . items ( ) : for key_name , encoded_signature in signature_block . items ( ) : if not key_name . startswith ( "ed25519:" ) : continue verify_key = decode_verify_key_bytes ( key_name , decode_base64 ( public_key ) ) verify_signed_json ( signed , server , verify_key ) return True except ( KeyError , SignatureVerifyException , ) : continue return False
Validates that the invite event is authorized by a previous third-party invite.
Validates that the invite event is authorized by a previous third - party invite .
"""
    Validates that the invite event is authorized by a previous third-party invite.

    Checks that the public key, and keyserver, match those in the third party invite,
    and that the invite event has a signature issued using that public key.

    Args:
        event: The m.room.member join event being validated.
        auth_events: All relevant previous context events which may be used
            for authorization decisions.

    Return:
        True if the event fulfills the expectations of a previous third party
        invite event.
    """ # We got the public key from the invite, so we know that the # correct server signed the signed bundle. # The caller is responsible for checking that the signing # server has not revoked that public key.
event
The m.room.member join event being validated.
The m . room . member join event being validated .
auth_events
All relevant previous context events which may be used
for authorization decisions.
All relevant previous context events which may be used for authorization decisions .