1
0

test_event_auth.py 8.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272
  1. # -*- coding: utf-8 -*-
  2. # Copyright 2018 New Vector Ltd
  3. #
  4. # Licensed under the Apache License, Version 2.0 (the "License");
  5. # you may not use this file except in compliance with the License.
  6. # You may obtain a copy of the License at
  7. #
  8. # http://www.apache.org/licenses/LICENSE-2.0
  9. #
  10. # Unless required by applicable law or agreed to in writing, software
  11. # distributed under the License is distributed on an "AS IS" BASIS,
  12. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13. # See the License for the specific language governing permissions and
  14. # limitations under the License.
  15. import unittest
  16. from synapse import event_auth
  17. from synapse.api.errors import AuthError
  18. from synapse.api.room_versions import RoomVersions
  19. from synapse.events import make_event_from_dict
  20. from synapse.types import get_domain_from_id
  21. class EventAuthTestCase(unittest.TestCase):
  22. def test_random_users_cannot_send_state_before_first_pl(self):
  23. """
  24. Check that, before the first PL lands, the creator is the only user
  25. that can send a state event.
  26. """
  27. creator = "@creator:example.com"
  28. joiner = "@joiner:example.com"
  29. auth_events = {
  30. ("m.room.create", ""): _create_event(creator),
  31. ("m.room.member", creator): _join_event(creator),
  32. ("m.room.member", joiner): _join_event(joiner),
  33. }
  34. # creator should be able to send state
  35. event_auth.check(
  36. RoomVersions.V1,
  37. _random_state_event(creator),
  38. auth_events,
  39. do_sig_check=False,
  40. )
  41. # joiner should not be able to send state
  42. self.assertRaises(
  43. AuthError,
  44. event_auth.check,
  45. RoomVersions.V1,
  46. _random_state_event(joiner),
  47. auth_events,
  48. do_sig_check=False,
  49. )
  50. def test_state_default_level(self):
  51. """
  52. Check that users above the state_default level can send state and
  53. those below cannot
  54. """
  55. creator = "@creator:example.com"
  56. pleb = "@joiner:example.com"
  57. king = "@joiner2:example.com"
  58. auth_events = {
  59. ("m.room.create", ""): _create_event(creator),
  60. ("m.room.member", creator): _join_event(creator),
  61. ("m.room.power_levels", ""): _power_levels_event(
  62. creator, {"state_default": "30", "users": {pleb: "29", king: "30"}}
  63. ),
  64. ("m.room.member", pleb): _join_event(pleb),
  65. ("m.room.member", king): _join_event(king),
  66. }
  67. # pleb should not be able to send state
  68. self.assertRaises(
  69. AuthError,
  70. event_auth.check,
  71. RoomVersions.V1,
  72. _random_state_event(pleb),
  73. auth_events,
  74. do_sig_check=False,
  75. ),
  76. # king should be able to send state
  77. event_auth.check(
  78. RoomVersions.V1, _random_state_event(king), auth_events, do_sig_check=False,
  79. )
  80. def test_alias_event(self):
  81. """Alias events have special behavior up through room version 6."""
  82. creator = "@creator:example.com"
  83. other = "@other:example.com"
  84. auth_events = {
  85. ("m.room.create", ""): _create_event(creator),
  86. ("m.room.member", creator): _join_event(creator),
  87. }
  88. # creator should be able to send aliases
  89. event_auth.check(
  90. RoomVersions.V1, _alias_event(creator), auth_events, do_sig_check=False,
  91. )
  92. # Reject an event with no state key.
  93. with self.assertRaises(AuthError):
  94. event_auth.check(
  95. RoomVersions.V1,
  96. _alias_event(creator, state_key=""),
  97. auth_events,
  98. do_sig_check=False,
  99. )
  100. # If the domain of the sender does not match the state key, reject.
  101. with self.assertRaises(AuthError):
  102. event_auth.check(
  103. RoomVersions.V1,
  104. _alias_event(creator, state_key="test.com"),
  105. auth_events,
  106. do_sig_check=False,
  107. )
  108. # Note that the member does *not* need to be in the room.
  109. event_auth.check(
  110. RoomVersions.V1, _alias_event(other), auth_events, do_sig_check=False,
  111. )
  112. def test_msc2432_alias_event(self):
  113. """After MSC2432, alias events have no special behavior."""
  114. creator = "@creator:example.com"
  115. other = "@other:example.com"
  116. auth_events = {
  117. ("m.room.create", ""): _create_event(creator),
  118. ("m.room.member", creator): _join_event(creator),
  119. }
  120. # creator should be able to send aliases
  121. event_auth.check(
  122. RoomVersions.V6, _alias_event(creator), auth_events, do_sig_check=False,
  123. )
  124. # No particular checks are done on the state key.
  125. event_auth.check(
  126. RoomVersions.V6,
  127. _alias_event(creator, state_key=""),
  128. auth_events,
  129. do_sig_check=False,
  130. )
  131. event_auth.check(
  132. RoomVersions.V6,
  133. _alias_event(creator, state_key="test.com"),
  134. auth_events,
  135. do_sig_check=False,
  136. )
  137. # Per standard auth rules, the member must be in the room.
  138. with self.assertRaises(AuthError):
  139. event_auth.check(
  140. RoomVersions.V6, _alias_event(other), auth_events, do_sig_check=False,
  141. )
  142. def test_msc2209(self):
  143. """
  144. Notifications power levels get checked due to MSC2209.
  145. """
  146. creator = "@creator:example.com"
  147. pleb = "@joiner:example.com"
  148. auth_events = {
  149. ("m.room.create", ""): _create_event(creator),
  150. ("m.room.member", creator): _join_event(creator),
  151. ("m.room.power_levels", ""): _power_levels_event(
  152. creator, {"state_default": "30", "users": {pleb: "30"}}
  153. ),
  154. ("m.room.member", pleb): _join_event(pleb),
  155. }
  156. # pleb should be able to modify the notifications power level.
  157. event_auth.check(
  158. RoomVersions.V1,
  159. _power_levels_event(pleb, {"notifications": {"room": 100}}),
  160. auth_events,
  161. do_sig_check=False,
  162. )
  163. # But an MSC2209 room rejects this change.
  164. with self.assertRaises(AuthError):
  165. event_auth.check(
  166. RoomVersions.V6,
  167. _power_levels_event(pleb, {"notifications": {"room": 100}}),
  168. auth_events,
  169. do_sig_check=False,
  170. )
  171. # helpers for making events
  172. TEST_ROOM_ID = "!test:room"
  173. def _create_event(user_id):
  174. return make_event_from_dict(
  175. {
  176. "room_id": TEST_ROOM_ID,
  177. "event_id": _get_event_id(),
  178. "type": "m.room.create",
  179. "sender": user_id,
  180. "content": {"creator": user_id},
  181. }
  182. )
  183. def _join_event(user_id):
  184. return make_event_from_dict(
  185. {
  186. "room_id": TEST_ROOM_ID,
  187. "event_id": _get_event_id(),
  188. "type": "m.room.member",
  189. "sender": user_id,
  190. "state_key": user_id,
  191. "content": {"membership": "join"},
  192. }
  193. )
  194. def _power_levels_event(sender, content):
  195. return make_event_from_dict(
  196. {
  197. "room_id": TEST_ROOM_ID,
  198. "event_id": _get_event_id(),
  199. "type": "m.room.power_levels",
  200. "sender": sender,
  201. "state_key": "",
  202. "content": content,
  203. }
  204. )
  205. def _alias_event(sender, **kwargs):
  206. data = {
  207. "room_id": TEST_ROOM_ID,
  208. "event_id": _get_event_id(),
  209. "type": "m.room.aliases",
  210. "sender": sender,
  211. "state_key": get_domain_from_id(sender),
  212. "content": {"aliases": []},
  213. }
  214. data.update(**kwargs)
  215. return make_event_from_dict(data)
  216. def _random_state_event(sender):
  217. return make_event_from_dict(
  218. {
  219. "room_id": TEST_ROOM_ID,
  220. "event_id": _get_event_id(),
  221. "type": "test.state",
  222. "sender": sender,
  223. "state_key": "",
  224. "content": {"membership": "join"},
  225. }
  226. )
  227. event_count = 0
  228. def _get_event_id():
  229. global event_count
  230. c = event_count
  231. event_count += 1
  232. return "!%i:example.com" % (c,)