Forbid non-admin user to create spaces and rooms

[Thatoo]

A server with open registration is needed to host a support room with auto_join_rooms without giving any right to these users to be able to create other space nor room on the server.

Then, it would be nice to have a config such as :
spaces_rooms_creation_admin_only : true

[Thatoo]

Does that still work (no PR in 4 years...) https://github.com/matrix-org/synapse-user-restrictions ?

[anoadragon453]

I believe you're asking for an option to prevent users from creating rooms. This is doable, though can be achieved through the module API already.

The module you mentioned will do what you desire, so I would recommend giving it a try.

Does that still work (no PR in 4 years...) matrix-org/synapse-user-restrictions ?

Probably. Synapse's module API strives to maintain backwards-compatibility wherever possible.

If the module fails for some reason, please create an issue on its issue tracker.

---

Wwhat I think you're actually looking for is a module that checks whether the user is an admin, rather than simply comparing against a static list of user IDs. Still, the referenced module may be a good solution in the meantime, and it could be extended to specifically check for a user's admin status.

There are other issues (i.e. #18151) asking for room creation restrictions based on other conditions. The module API can satisfy all of these, so I'd rather recommend that then start creating several options for each use case.

[BloodyIron]

@anoadragon453 I'm actually recently encountering deficiencies/shortcomings in Synapse's homeserver.yaml aspect specific to spaces. I'd like to lend some current thoughts:

1. Spaces appear to be given the "type" "m.space", so for functional declarations such as "alias_creation_rules" "room_list_publication_rules" and other similar declarations, I think it would be worthwhile to expand their capabilities to also declare things based on "type" (as I think there's also a type for Direct Messages but I don't have that on-hand right now). That way following the same nomenclature for those said functional declarations you can determine who can/can't create Spaces/DMs, whether it's all allow/deny or granular or whatever.
2. "auto_join_rooms" IMO should be extended (or something equivalent) to grant the same/similar functionality for Spaces. This way for environments that do want Spaces you can, whether it's via convenience, or compliance, automatically/forcefully put new users into Spaces and in-turn Rooms inside those spaces.
3. If we can get a way to fully disable Spaces within a Matrix ecosystem, can we also please tell Matrix clients to just "not show Spaces" from a GUI perspective? Unsure if that leads to a Matrix Spec change or not, but there are implementations I'm seeing where Spaces provide zero value, so if the Clients could be informed of their disablement, having that lead to a tidier UX would be nice (even though I know those clients are out-of-scope for this repo, but it has to start somewhere, so to say).

IMO Spaces can be useful, but at times they also can be useless, and administrators should have a lot more control over their behaviour. Can we please get that? :)

[BloodyIron]

Oh I also want to add that we need the means to also disable and/or control the creation of PRIVATE rooms too, not just Public rooms. For implementations with very strict structures, private rooms not having controls of such nature can become problematic from a UX and expectations perspective. The users might think that creating such rooms are acceptable, when those operating the ecosystem don't want that as a possibility. Sometimes this is for compliance and visibility reasons, sometimes this is just for building a specific user experience.

So far as I can see it right now, I don't really see a way to block users from creating Private Rooms via homeserver.yaml declarations. Apart from blocking the URL endpoint I'm also not sure how to block it in general otherwise.

[anoadragon453]

@BloodyIron good thoughts, thanks for sharing them!

nit: could you place them on a separate issue so we can continue to track them even when this specific issue/problem is solved and closed?

[BloodyIron]

I've done a bit more digging on related aspects here, and it looks like the module synapse_user_restrictions can control who creates rooms, however DMs are treated the same as "rooms" so that becomes problematic in ecosystems that want room creation limitations, but also to allow DMs. Any thoughts on that @anoadragon453 ?