Federation: /rooms/.../members fails for the invites received from a federated server

[giomfo]

Description
get /_matrix/client/r0/rooms/{roomId}/members on an invite received from another federated server fails with the following error:

errcode = "M_NOT_FOUND";
error = "Can't find event for token Token(room_key=u'xxx', presence_key=u'xxx', typing_key=u'x', receipt_key=u'xxx', account_data_key=u'xxx', push_rules_key=u'xx', to_device_key=u'xxx', device_list_key=u'xxx', groups_key=u'xx')";

Steps to reproduce
Consider 2 users userA and userB, created on 2 different Homeservers.
userA creates a room and invites userB
When userB requests for the members of this room, he gets an error

[DMRobertson]

Given that we're not yet joined to the room, we don't have any sense of its current state and hence have no idea who's in the room.

The invite event may include stripped state events in its unsigned.invite_room_state, but this doesn't include membership events.

[DMRobertson]

The spec is not explicit but my reading of https://spec.matrix.org/v1.5/client-server-api/#get_matrixclientv3roomsroomidmembers is that we should return HTTP 403 in this situation.

The error comes from

synapse/synapse/handlers/message.py

Lines 205 to 206 in 86c5a71

	if not last_event_id:
	raise NotFoundError("Can't find event for token %s" % (at_token,))

which is called

synapse/synapse/rest/client/room.py

Lines 590 to 595 in 86c5a71

	events = await handler.get_state_events(
	room_id=room_id,
	requester=requester,
	at_token=at_token,
	state_filter=StateFilter.from_types([(EventTypes.Member, None)]),
	)

So this is another example of NotFoundError bubbling up to the rest layer and deciding what the status code is.

[DMRobertson]

If anyone wants to take this on, I suggest:

• wrap the call to get_state_events in a try/except block catching NotFoundError
• catch NotFoundError and raise a SynapseError with
  • code 403
  • an appropriate user-facing error message
  • an appropriate matrix errcode (probably M_FORBIDDEN)
• for bonus points, write a complement test which creates this scenario and and checks that the status code is 403.

[vemmos]

Hello there! Is this still up?I would like to contribute :)

[squahtx]

Hello there! Is this still up?I would like to contribute :)

The issue has not been fixed yet. Feel free to PR a fix.