chore(Nix): Updated flake hashes

version availability

changelog.d/+8b3a57647.bugfix.md

@@ -0,0 +1 @@
+Fixed newly joined rooms failing to sync their full state (including the room name) to clients using legacy sync.

changelog.d/1999.doc

@@ -0,0 +1 @@
+Updated an out-of-date statement about Oracle Linux release cadences.

changelog.d/2006.bugfix

@@ -0,0 +1 @@
+Fixed high CPU usage when multiple clients from the same account were connected at once. Each sync woke the account's other sync loops, causing them to wake each other in a loop.

changelog.d/fix-federation-signature.bugfix

@@ -0,0 +1 @@
+Fix joining restricted rooms over federation failing with signature verification error.

docs/deploying/rpm.mdx

@@ -15,8 +15,8 @@ ## Overview
 
 :::warning Oracle Linux support
 Due to upstream limitations, Terra is only usable on Oracle Linux if you use [upstream EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/)
-rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, as of the time of writing, 10.2 has been
-available for over a month through other ELs, but Oracle has not yet released corresponding updates—so you may encounter further compatibility issues with EPEL.
+rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, Oracle's release of 10.2 lagged
+approximately 1.5 months behind other ELs—so you may encounter further compatibility issues with EPEL.
 **For this reason, it is recommended that you use another EL distribution if at all possible.**
 :::
 

nix/rust.nix

@@ -12,7 +12,7 @@
         target:
         target.fromToolchainName {
           name = (lib.importTOML "${inputs.self}/rust-toolchain.toml").toolchain.channel;
-          sha256 = "sha256-OATSZm98Es5kIFuqaba+UvkQtFsVgJEBMmS+t6od5/U=";
+          sha256 = "sha256-A1abGIbOtcBSdrUMhDGrER3pRM1hQP4fp9gh3Y4PKc8=";
         };
     in
     {

rust-toolchain.toml

@@ -10,7 +10,7 @@
 
 [toolchain]
 profile = "minimal"
-channel = "1.97.0"
+channel = "1.97.1"
 components = [
     # For rust-analyzer
     "rust-src",

src/api/client/sync/v3/joined.rs

@@ -269,13 +269,22 @@ async fn build_state_and_timeline(
 	)
 	.await?;
 
-	let (state_events, notification_counts, joined_since_last_sync) = try_join3(
-		build_state_events(services, sync_context, room_id, shortstatehashes, &timeline),
+	let (notification_counts, joined_since_last_sync) = try_join(
 		build_notification_counts(services, sync_context, room_id, &timeline),
 		check_joined_since_last_sync(services, shortstatehashes, sync_context),
 	)
 	.await?;
 
+	let state_events = build_state_events(
+		services,
+		sync_context,
+		room_id,
+		shortstatehashes,
+		&timeline,
+		joined_since_last_sync,
+	)
+	.await?;
+
 	// the timeline should always include at least one PDU if the syncing user
 	// joined since the last sync, that being the syncing user's join event. if
 	// it's empty something is wrong.
@@ -459,6 +468,7 @@ async fn build_state_events(
 	room_id: &RoomId,
 	shortstatehashes: ShortStateHashes,
 	timeline: &TimelinePdus,
+	joined_since_last_sync: bool,
 ) -> Result<Vec<PduEvent>> {
 	let SyncContext {
 		syncing_user,
@@ -488,9 +498,10 @@ async fn build_state_events(
 		/*
 		if `last_sync_end_count` is Some (meaning this is an incremental sync), and `last_sync_end_shortstatehash`
 		is Some (meaning the syncing user didn't just join this room for the first time ever), and `full_state` is false,
-		then use `build_state_incremental`.
+		and the user didn't just join the room since the last sync, then use `build_state_incremental`.
 		*/
-		| (Some(_), Some(last_sync_end_shortstatehash)) if !full_state =>
+		| (Some(_), Some(last_sync_end_shortstatehash))
+			if !full_state && !joined_since_last_sync =>
 			build_state_incremental(
 				services,
 				syncing_user,

src/api/server/utils.rs

@@ -91,7 +91,7 @@ pub(crate) async fn validate_any_membership_event(
 	expected_room_id: OwnedRoomId,
 	expected_event_id: OwnedEventId,
 ) -> Result<(CanonicalJsonObject, MembershipState, OwnedUserId, OwnedUserId)> {
-	let (template_room_id, template_event_id, pdu) = services
+	let (template_room_id, template_event_id, mut pdu) = services
 		.rooms
 		.event_handler
 		.parse_incoming_pdu(body, Some(room_version_rules))
@@ -109,6 +109,37 @@ pub(crate) async fn validate_any_membership_event(
 		))));
 	}
 
+	// Only `join` events carry `join_authorised_via_users_server`; co-sign
+	// restricted joins so verification passes. Authorisation is enforced in
+	// create_join_event.
+	let membership_is_join = pdu
+		.get("content")
+		.and_then(|v| v.as_object())
+		.and_then(|c| c.get("membership"))
+		.and_then(|v| v.as_str())
+		.is_some_and(|m| m == "join");
+
+	let authorising_user = pdu
+		.get("content")
+		.and_then(|v| v.as_object())
+		.and_then(|c| c.get("join_authorised_via_users_server"))
+		.and_then(|v| v.as_str())
+		.map(UserId::parse)
+		.and_then(Result::ok);
+
+	if room_version_rules.authorization.restricted_join_rule
+		&& membership_is_join
+		&& let Some(authorising_user) = authorising_user
+		&& services.globals.user_is_local(&authorising_user)
+	{
+		services
+			.server_keys
+			.hash_and_sign_event(&mut pdu, room_version_rules)
+			.map_err(|e| {
+				err!(Request(InvalidParam("Failed to sign restricted join event: {e}")))
+			})?;
+	}
+
 	services
 		.server_keys
 		.verify_event(&pdu, room_version_rules)

src/service/users/device.rs

@@ -253,8 +253,6 @@ pub async fn remove_to_device_events<Until>(
 				self.db.todeviceid_events.del(key);
 			})
 			.await;
-
-		self.services.sync.wake(user_id).await;
 	}
 
 	/// Updates device metadata and increments the device list version.