Skip to content

Move call invite filtering logic to filter_events_for_client#17782

Merged
anoadragon453 merged 12 commits intodevelopfrom
anoa/filter_call_events
Nov 28, 2025
Merged

Move call invite filtering logic to filter_events_for_client#17782
anoadragon453 merged 12 commits intodevelopfrom
anoa/filter_call_events

Conversation

@anoadragon453
Copy link
Copy Markdown
Member

Fixes #17359. Follow-up to #16908

This allows Simplified Sliding Sync to also filter call invites events in public rooms.

@anoadragon453 anoadragon453 marked this pull request as ready for review October 3, 2024 10:44
@anoadragon453 anoadragon453 requested a review from a team as a code owner October 3, 2024 10:44
This allows SSS to benefit from it as well.
@anoadragon453 anoadragon453 force-pushed the anoa/filter_call_events branch from 9d9789d to 287d44f Compare October 3, 2024 11:14
It appears there's an additional DB transaction as the JoinRules state chunk is not cached for these tests.
Comment thread synapse/visibility.py Outdated
)

self._test_bundled_aggregations(RelationTypes.REFERENCE, assert_annotations, 6)
self._test_bundled_aggregations(RelationTypes.REFERENCE, assert_annotations, 7)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To explain this change; the extra database call is because (EventTypes.JoinRules, "") was added to the types we query for in filter_events_for_client(...)

Comment thread synapse/visibility.py
Appending to a tuple changes its type, which mypy did not appreciated.

Lists may be appended to. We don't gain much overhead by using a list,
so let's just do so.
Comment thread synapse/visibility.py Outdated
Comment on lines +198 to +202
if (
state_after_event is not None
and not event.is_state()
and event.type == EventTypes.CallInvite
):
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm, it seems like state_after_event is None for outliers.

Are we ok with this hole? We should at-least comment about it.

Since outliers are not tied into the DAG, they do not normally form part of the
timeline sent down to clients via /sync or /messages; however there is an
exception:

-- Room DAG concepts

In terms of timeline, I don't think we will encounter this.

It seems like we could encounter this for state in the room. Do invites also need to be filtered out of state 🤔? I think not as we don't want to hide room state. Calls being part of state seems pretty weird in the first place.

What are clients keying off of to start the ring?


We can merge in any case as this is better than before (probably for /sync and yes for Sliding Sync).

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Calls being part of state seems pretty weird in the first place.

The m.call.invite event is not kept in state. We're just querying the local state to see if the room's join_rules are "public".

I'm not sure if it makes sense for a non-state m.call.invite event to be an outlier?

Copy link
Copy Markdown
Contributor

@MadLittleMods MadLittleMods Nov 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The m.call.invite event is not kept in state.

Ahh, sorry. Conflating things as I read through.

I'm not sure if it makes sense for a non-state m.call.invite event to be an outlier?

We should at-least have a comment with this assumption. Perhaps we should assert it? Is it safe to assume that only state events are outliers?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Most of our code that deals with outliers relates to invite membership events. However, every event does start as an outlier before the state is figured out for it:

builder.internal_metadata.outlier = outlier

So I'm not against adding a guard just in case! Done in 32d1d1c.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we have a rock solid explanation for why we think this is always true. But if we do, let's ship it ⏩

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just realised that state_after_event is guaranteed to be None if the event is an outlier:

frozenset(e.event_id for e in events if not e.internal_metadata.outlier),

And _check_client_allowed_to_see_event will prevent the client from seeing the event at all if it's an outlier.

So the guard technically isn't needed. But I'm happy to leave it there just in case the surrounding code changes.

Comment thread synapse/visibility.py
Comment on lines +202 to +204
# `state_after_event` should only be None if the event is an outlier,
# and call invites should not be outliers.
assert state_after_event is not None
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs a comment why

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dug into this more and updated the comment with some more reassurances in cf78c05.

Comment thread synapse/visibility.py Outdated
Comment on lines +198 to +202
if (
state_after_event is not None
and not event.is_state()
and event.type == EventTypes.CallInvite
):
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we have a rock solid explanation for why we think this is always true. But if we do, let's ship it ⏩

@anoadragon453 anoadragon453 enabled auto-merge (squash) November 28, 2025 17:13
@anoadragon453 anoadragon453 merged commit 034c5e6 into develop Nov 28, 2025
45 checks passed
@anoadragon453 anoadragon453 deleted the anoa/filter_call_events branch November 28, 2025 17:41
reivilibre added a commit that referenced this pull request Dec 11, 2025
The team has decided to deprecate and stop publishing python wheels for MacOS.
Synapse docker images will continue to work on MacOS, as will building Synapse
from source (though note this requires a Rust compiler).

Admins using the unstable [MSC2666](matrix-org/matrix-spec-proposals#2666) endpoint (`/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms`),
please check [the relevant section in the upgrade notes](https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11440) as this release contains changes
that disable that endpoint by default.

No significant changes since 1.144.0rc1.

Admins using the unstable [MSC2666](matrix-org/matrix-spec-proposals#2666) endpoint (`/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms`), please check [the relevant section in the upgrade notes](https://github.com/element-hq/synapse/blob/develop/docs/upgrade.md#upgrading-to-v11440) as this release contains changes that disable that endpoint by default.

- Add experimentatal implememntation of [MSC4380](matrix-org/matrix-spec-proposals#4380) (invite blocking). ([\#19203](#19203))
- Allow restarting delayed event timeouts on workers. ([\#19207](#19207))

- Fix a bug in the database function for fetching state deltas that could result in unnecessarily long query times. ([\#18960](#18960))
- Fix v12 rooms when running with `use_frozen_dicts: True`. ([\#19235](#19235))
- Fix bug where invalid `canonical_alias` content would return 500 instead of 400. ([\#19240](#19240))
- Fix bug where `Duration` was logged incorrectly. ([\#19267](#19267))

- Document in the `--config-path` help how multiple files are merged - by merging them shallowly. ([\#19243](#19243))

- Stop building release wheels for MacOS. ([\#19225](#19225))

- Improve event filtering for Simplified Sliding Sync. ([\#17782](#17782))
- Export `SYNAPSE_SUPPORTED_COMPLEMENT_TEST_PACKAGES` environment variable from `scripts-dev/complement.sh`. ([\#19208](#19208))
- Refactor `scripts-dev/complement.sh` logic to avoid `exit` to facilitate being able to source it from other scripts (composable). ([\#19209](#19209))
- Expire sliding sync connections that are too old or have too much pending data. ([\#19211](#19211))
- Require an experimental feature flag to be enabled in order for the unstable [MSC2666](matrix-org/matrix-spec-proposals#2666) endpoint (`/_matrix/client/unstable/uk.half-shot.msc2666/user/mutual_rooms`) to be available. ([\#19219](#19219))
- Prevent changelog check CI running on @dependabot's PRs even when a human has modified the branch. ([\#19220](#19220))
- Auto-fix trailing spaces in multi-line strings and comments when running the lint script. ([\#19221](#19221))
- Move towards using a dedicated `Duration` type. ([\#19223](#19223), [\#19229](#19229))
- Improve robustness of the SQL schema linting in CI. ([\#19224](#19224))
- Add log to determine whether clients are using `/messages` as expected. ([\#19226](#19226))
- Simplify README and add ESS Getting started section. ([\#19228](#19228), [\#19259](#19259))
- Add a unit test for ensuring associated refresh tokens are erased when a device is deleted. ([\#19230](#19230))
- Prompt user to consider adding future deprecations to the changelog in release script. ([\#19239](#19239))
- Fix check of the Rust compiled code being outdated when using source checkout and `.egg-info`. ([\#19251](#19251))
- Stop building macos wheels in CI pipeline. ([\#19263](#19263))

* Bump Swatinem/rust-cache from 2.8.1 to 2.8.2. ([\#19244](#19244))
* Bump actions/checkout from 5.0.0 to 6.0.0. ([\#19213](#19213))
* Bump actions/setup-go from 6.0.0 to 6.1.0. ([\#19214](#19214))
* Bump actions/setup-python from 6.0.0 to 6.1.0. ([\#19245](#19245))
* Bump attrs from 25.3.0 to 25.4.0. ([\#19215](#19215))
* Bump docker/metadata-action from 5.9.0 to 5.10.0. ([\#19246](#19246))
* Bump http from 1.3.1 to 1.4.0. ([\#19249](#19249))
* Bump pydantic from 2.12.4 to 2.12.5. ([\#19250](#19250))
* Bump pyopenssl from 25.1.0 to 25.3.0. ([\#19248](#19248))
* Bump rpds-py from 0.28.0 to 0.29.0. ([\#19216](#19216))
* Bump rpds-py from 0.29.0 to 0.30.0. ([\#19247](#19247))
* Bump sentry-sdk from 2.44.0 to 2.46.0. ([\#19218](#19218))
* Bump types-bleach from 6.2.0.20250809 to 6.3.0.20251115. ([\#19217](#19217))
* Bump types-jsonschema from 4.25.1.20250822 to 4.25.1.20251009. ([\#19252](#19252))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Move public room call invite mitigations to filter_events_for_client

2 participants