From 7ecd2aa5e24229cff290fcd791c5c809df681573 Mon Sep 17 00:00:00 2001
From: Erwan Leboucher <erwanleboucher@gmail.com>
Date: Tue, 14 Jul 2026 19:14:58 +0200
Subject: [PATCH] fix(pdu): Exempt m.room.create from auth_events check

---
 CONTRIBUTING.md                               |  2 +-
 changelog.d/1987.bugfix                       |  1 +
 src/service/rooms/event_handler/pdu_checks.rs | 31 ++++++++++++++-----
 3 files changed, 26 insertions(+), 8 deletions(-)
 create mode 100644 changelog.d/1987.bugfix

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 805bca71d..0f867686d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -27,7 +27,7 @@ ### Pre-commit Checks
 
 ```bash
 # Install prek using cargo-binstall
-cargo binstall prek
+cargo install prek
 
 # Install git hooks to run checks automatically
 prek install
diff --git a/changelog.d/1987.bugfix b/changelog.d/1987.bugfix
new file mode 100644
index 000000000..6dc11ddc9
--- /dev/null
+++ b/changelog.d/1987.bugfix
@@ -0,0 +1 @@
+Exempt m.room.create from auth_events check. Contributed by @eleboucher
diff --git a/src/service/rooms/event_handler/pdu_checks.rs b/src/service/rooms/event_handler/pdu_checks.rs
index 1f84e2b41..e920806f2 100644
--- a/src/service/rooms/event_handler/pdu_checks.rs
+++ b/src/service/rooms/event_handler/pdu_checks.rs
@@ -6,8 +6,9 @@
 };
 use futures::future::ready;
 use ruma::{
-	CanonicalJsonObject, EventId, OwnedEventId, ServerName, api::error::ErrorKind,
-	canonical_json::redact, events::StateEventType, room_version_rules::RoomVersionRules,
+	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, ServerName,
+	api::error::ErrorKind, canonical_json::redact, events::StateEventType,
+	room_version_rules::RoomVersionRules,
 };
 
 use crate::rooms::{
@@ -42,11 +43,27 @@ pub fn pdu_format_check_1(
 			return Err!(Request(BadJson("PDU has too many auth events")));
 		}
 
-		let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
-		if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
-			return Err!(Request(BadJson("PDU references a create event")));
-		} else if event_format.allow_room_create_in_auth_events && !create_event_in_auth_events {
-			return Err!(Request(BadJson("PDU does not reference the room create event")));
+		// The m.room.create event is the genesis event and has empty auth_events
+		// by definition, so it is exempt from the checks below requiring or
+		// forbidding the create event in auth_events (it cannot reference itself).
+		let Some(event_type) = pdu_json.get("type").and_then(CanonicalJsonValue::as_str) else {
+			return Err!(Request(BadJson("PDU is missing a type")));
+		};
+		let state_key = pdu_json
+			.get("state_key")
+			.and_then(CanonicalJsonValue::as_str);
+
+		let is_create_event = event_type == "m.room.create" && state_key == Some("");
+
+		if !is_create_event {
+			let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
+			if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
+				return Err!(Request(BadJson("PDU references a create event")));
+			} else if event_format.allow_room_create_in_auth_events
+				&& !create_event_in_auth_events
+			{
+				return Err!(Request(BadJson("PDU does not reference the room create event")));
+			}
 		}
 
 		let prev_events = expect_event_id_array(pdu_json, "prev_events")?;