Files
synapse/tests/test_types.py
T
Kegan DougalandClaude Fable 5.1 5161187a50 B1: Define the MSC4430 room version, the MemberKey type and the signing helpers
Rust: `RoomVersion.msc4430_member_keys` and `MSC4430V12`
("org.matrix.msc4430.12" = `MSC4242V12` + the flag); redaction of
`m.room.member` keeps `content.domain` and drops `content.localpart` in such
rooms, so the reference hash, the event ID and the member key signature cover
the claimed domain but not the claimed localpart;
`membership_field::{DOMAIN,LOCALPART}`; `org.matrix.msc4430` in `/versions`;
`.pyi` updated. The version is defined but *not* registered in
`KNOWN_ROOM_VERSIONS`, not even when the flag is on.

Python: `MemberKey` in `synapse.types` next to the other identifier types, with
the grammar `^@[A-Za-z0-9_-]{43}$` (anything with a `:` is a user ID),
`is_member_key` (syntactic, regex only, for hot paths) and
`MemberKey.from_string` (strict: rejects non-canonical base64, so each public
key has exactly one member key string). `MemberKeys` constants
(`SIGNATURE_ENTITY = "sender"`, key ID `ed25519:1`) and
`EventContentFields.MSC4430_{LOCALPART,DOMAIN}`. `supports_msc4430_member_keys`
is a `TypeIs[MSC4430Event]` modelled on `supports_msc4242_state_dag`;
`MSC4430Event` subclasses `MSC4242Event`, since every member key room is a state
DAG room, so one predicate narrows to both.

Signing: `add_hashes_and_signatures_from_signers(room_version, event_dict,
signers, *, server_name)` hashes once and then applies `(entity, key)` signers
in order; `compute_member_key_room_signature(room_version, event_dict, signer,
*, server_name)` adds one signature to an already hashed event (the authoriser's
signature on `/send_join`, our co-signature on an inbound `/invite`) without
rehashing a PDU we have not checked. The three signer kinds are: the sender's
member key under `sender`; our own server name co-signing linkage information;
the authorising member key of a restricted join under the member key string
itself. Together these are the one choke point for signing in member key rooms,
and they refuse with `MemberKeySigningRefusedError` (500) any signer the MSC
does not allow: a `sender` signature by a key other than the one `sender` names,
a key ID other than `ed25519:1`, a server co-signature under any name but ours
or on anything but an `m.room.member` whose `content.domain` is us, or an
authorising signature on anything but a join that names that key in
`join_authorised_via_users_server`. A bug in choosing signers therefore cannot
make us sign as a key we do not hold or vouch for linkage information that is
not ours. An empty signer list hashes only (`/make_join` templates).

Loudness: `get_domain_from_id` and `get_localpart_from_id` raise
`MemberKeyHasNoDomainError` (a `SynapseError`, 500: it is a server bug) when
given a member key, on the no-colon branch only, so user IDs and aliases are
untouched. Because the HTTP layer logs every `SynapseError` at INFO without a
traceback, and the error may be caught before it gets there, both MSC4430 errors
log themselves at ERROR with the stack of the raise site: the point of them is
to name the unadapted code path. `hs.is_mine_id` is left alone: it is called on
raw client strings (state keys, sliding-sync `required_state`,
`/users/{id}/report`, module API) and on remote-controlled room content
(`/upgrade` moving a canonical alias), where "False if malformed" is relied upon
and a member-key-shaped string in a legacy room is just malformed.
`hs.is_mine_identity(room_id, identity)` is the sanctioned question for room
identities; it answers for user IDs and raises `MemberKeyHasNoDomainError` for
member keys. The Prometheus counter
`synapse_msc4430_unsupported_path_total{server_name,path}` and
`record_unsupported_path(server_name, path)` (counts always, warns once per path
per process) are for branches that deliberately skip member keys.

The identity module is `synapse/handlers/member_keys.py` (`MemberKeyHandler`,
`hs.get_member_key_handler()`). The `MemberKey` type and `is_member_key` live in
`synapse.types` because `get_domain_from_id` needs them and the module cannot
import handlers.

Config: `msc4430_enabled` implies `msc4428_enabled`; the Complement image sets
it.

None of this is reachable: no identity in any existing room can satisfy
`is_member_key`, and the room version cannot be used. Not gated, by design: the
`is_member_key`-guarded raises in `get_domain_from_id`/`get_localpart_from_id`,
which only fire for member-key-shaped strings and turn a 400 "Invalid ID" into a
500. The one remote-reachable path that was a clean 400 before,
`/make_join|leave|knock/{roomId}/{userId}` with a member-key-shaped path
parameter (the handlers compare `get_domain_from_id(user_id)` with the origin),
now validates the parameter as a user ID at the servlet (400 `M_INVALID_PARAM`),
so a malformed request cannot make the Synapse federation client fail over
across every resident on a 5xx. A PDU whose sender is member-key-shaped in a
legacy room already fails at `_check_sigs_on_pdu` and is logged at ERROR with a
traceback on `/send`; only the status code changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-10-15 09:22:38 +02:00

492 lines
18 KiB
Python

#
# This file is licensed under the Affero General Public License (AGPL) version 3.
#
# Copyright 2014-2016 OpenMarket Ltd
# Copyright (C) 2023 New Vector, Ltd
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# See the GNU Affero General Public License for more details:
# <https://www.gnu.org/licenses/agpl-3.0.html>.
#
# Originally licensed under the Apache License, Version 2.0:
# <http://www.apache.org/licenses/LICENSE-2.0>.
#
# [This file includes modifications made by New Vector Limited]
#
#
import copy
from unittest import skipUnless
from immutabledict import immutabledict
from parameterized import parameterized_class
from pydantic import BaseModel, PydanticInvalidForJsonSchema, ValidationError
from signedjson.key import generate_signing_key, get_verify_key
from synapse.api.errors import MemberKeyHasNoDomainError, SynapseError
from synapse.types import (
Absent,
AbsentType,
AbstractMultiWriterStreamToken,
MemberKey,
MultiWriterStreamToken,
NonNegativeStrictInt,
RoomAlias,
RoomStreamToken,
StreamKeyType,
StreamToken,
UserID,
get_domain_from_id,
get_localpart_from_id,
is_member_key,
map_username_to_mxid_localpart,
)
from tests import unittest
from tests.utils import USE_POSTGRES_FOR_TESTS
class IsMineIDTests(unittest.HomeserverTestCase):
def test_is_mine_id(self) -> None:
self.assertTrue(self.hs.is_mine_id("@user:test"))
self.assertTrue(self.hs.is_mine_id("#room:test"))
self.assertTrue(self.hs.is_mine_id("invalid:test"))
self.assertFalse(self.hs.is_mine_id("@user:test\0"))
self.assertFalse(self.hs.is_mine_id("@user"))
def test_two_colons(self) -> None:
"""Test handling of IDs containing more than one colon."""
# The domain starts after the first colon.
# These functions must interpret things consistently.
self.assertFalse(self.hs.is_mine_id("@user:test:test"))
self.assertEqual("user", get_localpart_from_id("@user:test:test"))
self.assertEqual("test:test", get_domain_from_id("@user:test:test"))
def test_member_key_is_loud(self) -> None:
"""An MSC4430 member key has no domain. Code which parses one as a user ID
is not member-key aware, so it must fail with a distinct 500 rather than
"Invalid ID"."""
for fn in (get_domain_from_id, get_localpart_from_id):
with self.assertRaises(MemberKeyHasNoDomainError) as cm:
fn(EXAMPLE_MEMBER_KEY)
self.assertEqual(cm.exception.code, 500)
self.assertEqual(cm.exception.member_key, EXAMPLE_MEMBER_KEY)
# Other malformed IDs are unchanged: a 400.
for fn in (get_domain_from_id, get_localpart_from_id):
with self.assertRaises(SynapseError) as cm:
fn("@user")
self.assertEqual(cm.exception.code, 400)
self.assertNotIsInstance(cm.exception, MemberKeyHasNoDomainError)
# `is_mine_id` keeps its "False if malformed" contract: clients can put
# arbitrary strings where a user ID is expected (a state key, a report).
# Room identities go through `is_mine_identity`.
self.assertFalse(self.hs.is_mine_id(EXAMPLE_MEMBER_KEY))
self.assertFalse(self.hs.is_mine_id("@user"))
class UserIDTestCase(unittest.HomeserverTestCase):
def test_parse(self) -> None:
user = UserID.from_string("@1234abcd:test")
self.assertEqual("1234abcd", user.localpart)
self.assertEqual("test", user.domain)
self.assertEqual(True, self.hs.is_mine(user))
def test_parse_rejects_empty_id(self) -> None:
with self.assertRaises(SynapseError):
UserID.from_string("")
def test_parse_rejects_missing_sigil(self) -> None:
with self.assertRaises(SynapseError):
UserID.from_string("alice:example.com")
def test_parse_rejects_missing_separator(self) -> None:
with self.assertRaises(SynapseError):
UserID.from_string("@alice.example.com")
def test_validation_rejects_missing_domain(self) -> None:
self.assertFalse(UserID.is_valid("@alice:"))
def test_build(self) -> None:
user = UserID("5678efgh", "my.domain")
self.assertEqual(user.to_string(), "@5678efgh:my.domain")
def test_compare(self) -> None:
userA = UserID.from_string("@userA:my.domain")
userAagain = UserID.from_string("@userA:my.domain")
userB = UserID.from_string("@userB:my.domain")
self.assertTrue(userA == userAagain)
self.assertTrue(userA != userB)
# The example member key from MSC4430.
EXAMPLE_MEMBER_KEY = "@l8Hft5qXKn1vfHrg3p4-W8gELQVo8N13JkluMfmn2sQ"
class MemberKeyTestCase(unittest.TestCase):
def test_is_member_key(self) -> None:
self.assertTrue(is_member_key(EXAMPLE_MEMBER_KEY))
# Anything with a colon is a user ID.
self.assertFalse(is_member_key("@alice:example.com"))
self.assertFalse(is_member_key("@l8Hft5qXKn1vfHrg3p4-W8gELQVo8N13JkluMfmn2:Q"))
# Room IDs and event IDs of the same shape have a different sigil.
self.assertFalse(is_member_key("!l8Hft5qXKn1vfHrg3p4-W8gELQVo8N13JkluMfmn2sQ"))
self.assertFalse(is_member_key("$l8Hft5qXKn1vfHrg3p4-W8gELQVo8N13JkluMfmn2sQ"))
# Wrong length, padding, or the standard (non-urlsafe) alphabet.
self.assertFalse(is_member_key(EXAMPLE_MEMBER_KEY[:-1]))
self.assertFalse(is_member_key(EXAMPLE_MEMBER_KEY + "A"))
self.assertFalse(is_member_key(EXAMPLE_MEMBER_KEY + "="))
self.assertFalse(is_member_key(EXAMPLE_MEMBER_KEY + "\n"))
self.assertFalse(is_member_key("@l8Hft5qXKn1vfHrg3p4/W8gELQVo8N13JkluMfmn2sQ"))
self.assertFalse(is_member_key("@l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ"))
self.assertFalse(is_member_key(""))
self.assertFalse(is_member_key("@"))
def test_parse(self) -> None:
member_key = MemberKey.from_string(EXAMPLE_MEMBER_KEY)
self.assertEqual(member_key.key, EXAMPLE_MEMBER_KEY[1:])
self.assertEqual(member_key.to_string(), EXAMPLE_MEMBER_KEY)
self.assertEqual(str(member_key), EXAMPLE_MEMBER_KEY)
self.assertTrue(MemberKey.is_valid(EXAMPLE_MEMBER_KEY))
def test_parse_rejects_user_ids(self) -> None:
with self.assertRaises(SynapseError) as cm:
MemberKey.from_string("@alice:example.com")
self.assertEqual(cm.exception.code, 400)
self.assertFalse(MemberKey.is_valid("@alice:example.com"))
# ... and `UserID` rejects member keys.
with self.assertRaises(SynapseError):
UserID.from_string(EXAMPLE_MEMBER_KEY)
self.assertFalse(UserID.is_valid(EXAMPLE_MEMBER_KEY))
def test_parse_rejects_non_canonical_encoding(self) -> None:
"""43 base64 characters carry 258 bits; the spare two must be zero so that
each public key has exactly one member key string."""
# The last character of the example is `Q` (0b010000): its low two bits are
# clear. `R` (0b010001) decodes to the same 32 bytes.
non_canonical = EXAMPLE_MEMBER_KEY[:-1] + "R"
self.assertTrue(is_member_key(non_canonical))
with self.assertRaises(SynapseError) as cm:
MemberKey.from_string(non_canonical)
self.assertEqual(cm.exception.code, 400)
self.assertFalse(MemberKey.is_valid(non_canonical))
def test_from_keys_round_trip(self) -> None:
signing_key = generate_signing_key("1")
verify_key = get_verify_key(signing_key)
member_key = MemberKey.from_verify_key(verify_key)
self.assertEqual(MemberKey.from_signing_key(signing_key), member_key)
self.assertTrue(is_member_key(member_key.to_string()))
self.assertEqual(MemberKey.from_string(member_key.to_string()), member_key)
# `verify_key()` yields the same public key, with the MSC's constant key ID.
decoded = member_key.verify_key()
self.assertEqual(decoded.encode(), verify_key.encode())
self.assertEqual(decoded.alg, "ed25519")
self.assertEqual(decoded.version, "1")
def test_compare(self) -> None:
self.assertEqual(
MemberKey.from_string(EXAMPLE_MEMBER_KEY),
MemberKey.from_string(EXAMPLE_MEMBER_KEY),
)
self.assertNotEqual(
MemberKey.from_string(EXAMPLE_MEMBER_KEY),
MemberKey.from_signing_key(generate_signing_key("1")),
)
def test_copy(self) -> None:
member_key = MemberKey.from_string(EXAMPLE_MEMBER_KEY)
self.assertIs(copy.copy(member_key), member_key)
self.assertIs(copy.deepcopy(member_key), member_key)
class RoomAliasTestCase(unittest.HomeserverTestCase):
def test_parse(self) -> None:
room = RoomAlias.from_string("#channel:test")
self.assertEqual("channel", room.localpart)
self.assertEqual("test", room.domain)
self.assertEqual(True, self.hs.is_mine(room))
def test_build(self) -> None:
room = RoomAlias("channel", "my.domain")
self.assertEqual(room.to_string(), "#channel:my.domain")
def test_validate(self) -> None:
id_string = "#test:domain,test"
self.assertFalse(RoomAlias.is_valid(id_string))
class MapUsernameTestCase(unittest.TestCase):
def test_pass_througuh(self) -> None:
self.assertEqual(map_username_to_mxid_localpart("test1234"), "test1234")
def test_upper_case(self) -> None:
self.assertEqual(map_username_to_mxid_localpart("tEST_1234"), "test_1234")
self.assertEqual(
map_username_to_mxid_localpart("tEST_1234", case_sensitive=True),
"t_e_s_t__1234",
)
def test_symbols(self) -> None:
self.assertEqual(
map_username_to_mxid_localpart("test=$?_1234"), "test=3d=24=3f_1234"
)
def test_leading_underscore(self) -> None:
self.assertEqual(map_username_to_mxid_localpart("_test_1234"), "=5ftest_1234")
def test_non_ascii(self) -> None:
# this should work with either a unicode or a bytes
self.assertEqual(map_username_to_mxid_localpart("têst"), "t=c3=aast")
self.assertEqual(map_username_to_mxid_localpart("têst".encode()), "t=c3=aast")
@parameterized_class(
("token_type",),
[
(MultiWriterStreamToken,),
(RoomStreamToken,),
],
class_name_func=lambda cls,
num,
params_dict: f"{cls.__name__}_{params_dict['token_type'].__name__}",
)
class MultiWriterTokenTestCase(unittest.HomeserverTestCase):
"""Tests for the different types of multi writer tokens."""
token_type: type[AbstractMultiWriterStreamToken]
def test_basic_token(self) -> None:
"""Test that a simple stream token can be serialized and unserialized"""
store = self.hs.get_datastores().main
token = self.token_type(stream=5)
string_token = self.get_success(token.to_string(store))
if isinstance(token, RoomStreamToken):
self.assertEqual(string_token, "s5")
else:
self.assertEqual(string_token, "5")
parsed_token = self.get_success(self.token_type.parse(store, string_token))
self.assertEqual(parsed_token, token)
@skipUnless(USE_POSTGRES_FOR_TESTS, "Requires Postgres")
def test_instance_map(self) -> None:
"""Test for stream token with instance map"""
store = self.hs.get_datastores().main
token = self.token_type(stream=5, instance_map=immutabledict({"foo": 6}))
string_token = self.get_success(token.to_string(store))
self.assertEqual(string_token, "m5~1.6")
parsed_token = self.get_success(self.token_type.parse(store, string_token))
self.assertEqual(parsed_token, token)
def test_instance_map_assertion(self) -> None:
"""Test that we assert values in the instance map are greater than the
min stream position"""
with self.assertRaises(ValueError):
self.token_type(stream=5, instance_map=immutabledict({"foo": 4}))
with self.assertRaises(ValueError):
self.token_type(stream=5, instance_map=immutabledict({"foo": 5}))
def test_parse_bad_token(self) -> None:
"""Test that we can parse tokens produced by a bug in Synapse of the
form `m5~`"""
store = self.hs.get_datastores().main
parsed_token = self.get_success(self.token_type.parse(store, "m5~"))
self.assertEqual(parsed_token, self.token_type(stream=5))
class AbsentTestCase(unittest.TestCase):
"""
Tests for the `Absent` utility, which is meant to be like `None` except
explicitly signalling absence rather than JSON null.
"""
def test_cant_create_second_absent(self) -> None:
"""
Tests that we aren't allowed to instantiate a second `Absent`.
"""
with self.assertRaises(TypeError):
AbsentType() # type: ignore[call-arg]
def test_is_falsy(self) -> None:
"""
Tests `Absent` is falsy and can therefore be used a bit like `None`.
"""
if Absent:
self.fail("Absent is truthy!")
self.assertEqual(Absent or "something", "something")
def test_pydantic_jsonschema(self) -> None:
"""
Tests that `Absent` can't be used to produce JSONSchema in Pydantic models.
In the future, it may be useful to produce correct JSONSchema, but for now
I was mostly interested in making sure we don't produce weird/invalid JSONSchema.
"""
class MyModel(BaseModel):
absent: AbsentType = Absent
with self.assertRaises(PydanticInvalidForJsonSchema):
MyModel.model_json_schema()
def test_pydantic_reject_null(self) -> None:
"""
Tests that `Absent` rejects `None` (JSON null) when used in Pydantic models.
"""
class MyModel(BaseModel):
absent: AbsentType = Absent
with self.assertRaises(ValidationError):
MyModel.model_validate({"absent": None})
with self.assertRaises(ValidationError):
MyModel.model_validate_json('{"absent": null}')
def test_pydantic_accept_absence(self) -> None:
"""
Tests that `Absent` accepts the absence of a value when used in Pydantic models.
"""
class MyModel(BaseModel):
absent: AbsentType = Absent
self.assertEqual(MyModel.model_validate({}), MyModel(absent=Absent))
self.assertEqual(MyModel.model_validate_json("{}"), MyModel(absent=Absent))
def test_copy(self) -> None:
"""
Tests that the `copy` module always uses the same instance of Absent.
"""
class MyModel(BaseModel):
absent: AbsentType = Absent
a = MyModel.model_validate({})
b = copy.deepcopy(a)
self.assertIs(copy.copy(Absent), Absent)
self.assertIs(a.absent, b.absent)
class NonNegativeStrictIntTestCase(unittest.TestCase):
"""
Tests for the `NonNegativeStrictInt` utility.
"""
def test_pydantic_jsonschema(self) -> None:
"""
Tests that `NonNegativeStrictInt` produces sensible JSONSchema.
"""
class MyModel(BaseModel):
limit: NonNegativeStrictInt = 100
self.assertEqual(
MyModel.model_json_schema(),
{
"properties": {
"limit": {
"default": 100,
"minimum": 0,
"title": "Limit",
"type": "integer",
}
},
"title": "MyModel",
"type": "object",
},
f"JSONSchema actually is:\n{MyModel.model_json_schema()!r}",
)
def test_pydantic_reject(self) -> None:
"""
Tests that `NonNegativeStrictInt` rejects negative numbers
and non-ints.
"""
class MyModel(BaseModel):
limit: NonNegativeStrictInt = 100
with self.assertRaises(ValidationError):
MyModel.model_validate({"limit": -1})
with self.assertRaises(ValidationError):
MyModel.model_validate_json('{"limit": -1}')
# StrictInt, so don't accept floats...
with self.assertRaises(ValidationError):
MyModel.model_validate({"limit": 1.5})
with self.assertRaises(ValidationError):
MyModel.model_validate_json('{"limit": 1.5}')
# ...and don't accept stringy ints either.
with self.assertRaises(ValidationError):
MyModel.model_validate({"limit": "42"})
with self.assertRaises(ValidationError):
MyModel.model_validate_json('{"limit": "42"}')
def test_pydantic_accept(self) -> None:
"""
Tests that `Absent` accepts the absence of a value when used in Pydantic models.
"""
class MyModel(BaseModel):
limit: NonNegativeStrictInt = 100
self.assertEqual(MyModel.model_validate_json('{"limit": 0}'), MyModel(limit=0))
self.assertEqual(MyModel.model_validate({"limit": 42}), MyModel(limit=42))
class StreamTokenTestCase(unittest.HomeserverTestCase):
"""Serialisation of the composite `StreamToken`."""
def test_round_trip(self) -> None:
store = self.hs.get_datastores().main
token = StreamToken.START.copy_and_replace(
StreamKeyType.MEMBER_INFO, MultiWriterStreamToken(stream=7)
)
string_token = self.get_success(token.to_string(store))
# One component per stream, the member info stream last.
self.assertEqual(string_token, "s0_0_0_0_0_0_0_0_0_0_0_0_0_0_7")
parsed = self.get_success(StreamToken.from_string(store, string_token))
self.assertEqual(parsed, token)
def test_parse_without_trailing_components(self) -> None:
"""Tokens issued before a stream existed parse with that stream at its
start position."""
store = self.hs.get_datastores().main
parsed = self.get_success(
StreamToken.from_string(store, "s5_0_0_0_0_0_0_0_0_0_0_0_0_0")
)
self.assertEqual(parsed.room_key, RoomStreamToken(stream=5))
self.assertEqual(parsed.member_info_key, MultiWriterStreamToken(stream=0))