MSC4311: Use full PDU's in stripped state (like `invite_room_state`) over federation and always include `m.room.create` event by MadLittleMods · Pull Request #19723 · element-hq/synapse

MadLittleMods · 2026-04-23T17:23:09Z

Background

This PR was originally just trying to remove the flawed MSC4311 partial implementation as client side API's like /sync should still use stripped events. But it turns out we were just re-using the client logic for the federation side and things might break if we didn't include the full m.room.create event so this PR now introduces MSC4311 support to use full PDU's in the invite_room_state/knock_room_state in the federation API's.

The flawed implementation was originally introduced in 0eb7252 (no PR I assume because part of Hydra security fix)

Spawning from reviewing #19722 and noticing that we have TestMSC4311FullCreateEventOnStrippedState in Complement which already passes even though that test looks flawed:

I think this test is mixing up what MSC4311 proposes. Perhaps these were changes to the MSC that came after?

For the client API's like /sync, it only proposes that m.room.create is a required stripped state event.

For the federation API's, alongside requiring m.room.create, it also mandates using the full event PDU format for all events in the invite_room_state/knock_room_state on m.room.member events (in unsigned)

What does this PR do?

Always use stripped state for client API's
1. Remove flawed MSC4311 partial implementation (as explained above)
2. Sanitize stripped state when we receive events over federation
Use full PDU's when sending invite_room_state/knock_room_state over federation
Validate PDU's and warn when receiving invite_room_state/knock_room_state over federation

Complement tests: matrix-org/complement#796

Part of #19414

Dev notes

COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh -run TestMSC4311FullEventsOnStrippedStateFederation

COMPLEMENT_DIR=../complement ./scripts-dev/complement.sh -run TestMSC4311StrippedStateClientApi

Todo

Fix/remove TestMSC4311FullCreateEventOnStrippedState Complement test so it doesn't look for the full PDU in /sync.
- It looks like Update MSC4311 tests to conform to the spec and better coverage matrix-org/complement#796 tries to address this
Figure out whether we care about addressing knock_room_state in this PR
Validate knock_room_state
Figure out Sytest failures -> Use sender instead of user_id for any stripped state event usages matrix-org/sytest#1425
Merge Sytest changes, Use sender instead of user_id for any stripped state event usages matrix-org/sytest#1425
Merge Complement tests when we merge this PR, Update MSC4311 tests to conform to the spec and better coverage matrix-org/complement#796

Pull Request Checklist

Pull request is based on the develop branch
Pull request includes a changelog file. The entry should:
- Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
- Use markdown where necessary, mostly for code blocks.
- End with either a period (.) or an exclamation mark (!).
- Start with a capital letter.
- Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
Code style is correct (run the linters)

…al-implementation

MadLittleMods · 2026-05-04T21:05:09Z

-        and event.get_state_key() == ""
-    ):
-        return event.get_pdu_json()
-


Removing the flawed MSC4311 partial implementation

MadLittleMods · 2026-05-04T21:07:05Z

+
+        return [strip_event(e) for e in state_to_include.values()]
+
+    async def get_stripped_room_state_ids_from_event_context(


Split some logic out of get_stripped_room_state_from_event_context(...) into get_stripped_room_state_ids_from_event_context(...)

This way we can use the same event selection logic but fetch/format them however we see fit.

MadLittleMods · 2026-05-04T23:25:37Z

-        # TODO(paul): assert that room_id/event_id parsed from path actually
-        #   match those given in content


Removed as we actually do this now in FederationServer.on_invite_request(...) (added in this PR)

…al-implementation Conflicts: rust/src/room_versions.rs

MadLittleMods · 2026-05-22T00:09:04Z

+            # Add the invite itself
+            #
+            # FIXME: Doesn't seem to be in the spec
+            invited_state.append(strip_event(room.invite))


Found that we were accidentally providing the full invite event in this case. This is just something that's been happening since inception (2015)

The Complement tests check to make sure the client sees stripped state which is how I caught this.

Additionally, just documenting this existing behavior.

To note, the stripped state event fields cover the use cases described in matrix-org/synapse#6739 (comment). The client has the invite sender to show who invited you.

… of deriving from `invite_room_state` We don't even calculate `knock_room_state` to do the same pattern and it's a bunch of extra complexity.

…al-implementation

…ional

MadLittleMods · 2026-05-26T20:22:17Z

            # the client with:
            #
            # * A knock state event that they can use for easier internal tracking
-            # * The rough timestamp of when the knock occurred contained within the event


Removed the note about the timestamp as a stripped state event doesn't have origin_server_ts like the full PDU would.

There is some previous discussion in matrix-org/synapse#6739 (comment) where this is both argued for and against.

The timestamp use case seems to be theoretical vs something the client actually does so I'm minded to just to align with the spec. If it's useful, it deserves its own MSC.

MadLittleMods · 2026-05-26T20:43:11Z

-            invited_state.append(invite)
+            # Add the invite itself
+            #
+            # FIXME: Doesn't seem to be in the spec


As a note, in the spec /sync example under invite_state: it does actually include the m.room.member invite:

{ // ... "rooms": { "invite": { "!696r7674:example.com": { "invite_state": { "events": [ { "content": { "name": "My Room Name" }, "sender": "@alice:example.com", "state_key": "", "type": "m.room.name" }, { "content": { "membership": "invite" }, "sender": "@alice:example.com", "state_key": "@bob:example.com", "type": "m.room.member" } ] } } }, // ... }

But m.room.member is not mentioned in the list stripped state event types in https://spec.matrix.org/v1.18/client-server-api/#stripped-state

And my guess is that the example is just copy-pasted from Synapse though so I don't think it's a great beacon to hang our hat on. The idea makes sense and should get its own MSC.

MadLittleMods · 2026-05-26T20:56:37Z

@@ -0,0 +1 @@
+Remove flawed [MSC4311](https://github.com/matrix-org/matrix-spec-proposals/pull/4311) partial implementation: Client-side API's like `/sync` should still use stripped events.


The Complement tests are expected to fail ❌ as we removed the flawed partial implementation in this PR.

The Complement tests have been updated in matrix-org/complement#796 and pass locally. We will merge both PRs at the same time.

MadLittleMods · 2026-05-26T20:57:27Z

-            # Ensure the event has been stripped
-            self.assertNotIn("signatures", event)


Removed as these can be full PDU's now (that's the whole point of MSC4311)

MadLittleMods · 2026-05-26T21:44:08Z

+                    "(either one could be at fault).",
+                    Codes.UNKNOWN,
+                    additional_fields={
+                        "cause": err.msg,


I don't think we have to worry about leaking anything by passing this error message along. Calling this out so the reviewer can sanity check this assumption

See matrix-org/sytest#1425

…al-implementation

Copilot

Pull request overview

This PR implements MSC4311 handling for federation invite/knock room state while keeping client APIs on stripped-state formats. It adds full-PDU federation payloads, inbound validation/sanitization, and a room-version capability flag for version 12+ behavior.

Changes:

Restores client stripped-state serialization and updates /sync invite/knock rendering.
Sends full PDUs for federation invite_room_state/knock_room_state and validates received state.
Adds storage helpers, room-version metadata, changelog, and test updates for new call signatures/behavior.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`changelog.d/19723.bugfix`	Records the MSC4311 client stripped-state bugfix.
`rust/src/room_versions.rs`	Adds the MSC4311 room-version capability flag.
`synapse/events/utils.py`	Removes full-PDU special casing from `strip_event` and adds stripped-state serialization.
`synapse/federation/federation_client.py`	Builds federation invite room state as full PDUs and maps MSC4311 remote errors.
`synapse/federation/federation_server.py`	Validates invite path IDs and returns full-PDU knock room state.
`synapse/federation/transport/server/federation.py`	Passes expected invite path IDs through transport handlers.
`synapse/handlers/federation.py`	Adds inbound invite/knock room-state validation and sanitization.
`synapse/handlers/message.py`	Passes invite event context into federation invite sending.
`synapse/rest/client/sync.py`	Ensures client invite/knock events remain stripped in sync responses.
`synapse/storage/databases/main/events_worker.py`	Splits stripped-state event ID retrieval from stripped event serialization.
`synapse/synapse_rust/room_versions.pyi`	Exposes the new room-version flag to Python typing.
`tests/events/test_auto_accept_invites.py`	Updates invite handler calls to keyword arguments.
`tests/federation/transport/test_knocking.py`	Updates knock federation expectations for full-PDU state.
`tests/handlers/test_federation.py`	Updates invite handler calls to keyword arguments.
`tests/handlers/test_room_member.py`	Updates invite handler calls to keyword arguments.
`tests/handlers/test_room_summary.py`	Updates invite handler calls to keyword arguments.
`tests/test_visibility.py`	Updates federation invite test to pass expected path IDs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+            _, content = await self.transport_layer.send_invite_v1(
+                destination=destination,
+                room_id=pdu.room_id,
+                event_id=pdu.event_id,
+                content=pdu.get_pdu_json(time_now),


+            # validation above. The only reason this is here is because the validation
+            # can fail for non-compliant servers but we should still use stripped state.
+            stripped_room_state_for_client = self._minimal_parse_stripped_room_state(
+                stripped_room_state=event.unsigned.get("knock_room_state"),


+                raise SynapseError(
+                    500,
+                    f"Received {HTTPStatus.BAD_REQUEST} {Codes.MISSING_PARAM} response from remote homeserver "
+                    "while trying to send the invite over federation. This indicates a compatability problem "


+                raise SynapseError(
+                    500,
+                    f"Received {HTTPStatus.BAD_REQUEST} {Codes.MISSING_PARAM} response from remote homeserver "
+                    "while trying to send the invite over federation. This indicates a compatability problem "


+        # Find the full events based on the state at the time of the invite
+        state_ids = await self.store.get_stripped_room_state_ids_from_event_context(
+            context, self._room_prejoin_state_types


…c/test_rooms_invites.SlidingSyncRoomsInvitesTestCase to use 'stripped state' to compare against responses instead of fleshing out a full PDU

Client side API's should still use stripped events with MSC4311

bdfeb90

MadLittleMods added A-Sync A-Spec-Compliance labels Apr 23, 2026

MadLittleMods mentioned this pull request Apr 23, 2026

Room version 12 tests matrix-org/complement#791

Merged

MadLittleMods changed the title ~~Client side API's like /sync should still use stripped events with MSC4311~~ Remove flawed MSC4311 partial implementation: Client side API's like /sync should still use stripped events Apr 23, 2026

MadLittleMods changed the title ~~Remove flawed MSC4311 partial implementation: Client side API's like /sync should still use stripped events~~ Remove flawed MSC4311 partial implementation: Client-side API's like /sync should still use stripped events Apr 23, 2026

Add changelog

43a11f5

MadLittleMods mentioned this pull request Apr 23, 2026

MSC4311: invites and knocks should contain the create event #19722

Merged

3 tasks

MadLittleMods added 4 commits May 1, 2026 18:23

Merge branch 'develop' into madlittlemods/remove-flawed-msc4311-parti…

7f25120

…al-implementation

Non-working: Use full PDU's for invite_room_state in federation

6026aaa

Iteration that uses current state

e0eb224

Use get_stripped_room_state_ids_from_event_context

3464ec8

Invite event should be stripped when included in invite_state

f96c008

MadLittleMods commented May 4, 2026

View reviewed changes

MadLittleMods added 3 commits May 4, 2026 17:54

Sanitize invite_room_state received over federation

a088aa8

Fix test lints

336b686

Updated comment

22f4f20

MadLittleMods commented May 4, 2026

View reviewed changes

MadLittleMods changed the title ~~Remove flawed MSC4311 partial implementation: Client-side API's like /sync should still use stripped events~~ MSC4311: Use full PDU's in stripped state (like invite_room_state) over federation and always include m.room.create event May 4, 2026

MadLittleMods added 5 commits May 21, 2026 18:07

Merge branch 'develop' into madlittlemods/remove-flawed-msc4311-parti…

cce5dc7

…al-implementation Conflicts: rust/src/room_versions.rs

Make the TODO more obvious

7e379e7

Placeholder arg docstring

92d0d8b

Better logic/reasoning

76b4905

Better comment flow

5103f1b

MadLittleMods commented May 22, 2026

View reviewed changes

MadLittleMods added 11 commits May 21, 2026 19:14

Small comment to explain (we also explain above)

ffe5c4b

Better invite_room_state scrutiny

2b900b4

Fix events typo

5e12cb8

Event ID context

ff533df

Simplify logic to just use hs.config.api.room_prejoin_state instead…

de78d9e

… of deriving from `invite_room_state` We don't even calculate `knock_room_state` to do the same pattern and it's a bunch of extra complexity.

_parse_stripped_room_state

4598a43

_minimal_parse_stripped_room_state

fbff685

Strip the knock itself we add down /sync

75a53ef

Merge branch 'develop' into madlittlemods/remove-flawed-msc4311-parti…

178dd89

…al-implementation

Account for previous Matrix versions where invite_room_state is opt…

1926534

…ional

Better msc4311_stripped_state description

17c3763

MadLittleMods commented May 26, 2026

View reviewed changes

The PDU's over federation can be full PDU's now

75d1935

MadLittleMods commented May 26, 2026

View reviewed changes

Raise 500 when federation returns 400 M_MISSING_PARAM

3888387

MadLittleMods mentioned this pull request May 26, 2026

Use sender instead of user_id for any stripped state event usages matrix-org/sytest#1424

Closed

MadLittleMods commented May 26, 2026

View reviewed changes

Add note about future Complement tests

259f151

MadLittleMods mentioned this pull request May 27, 2026

Use sender instead of user_id for any stripped state event usages matrix-org/sytest#1425

Closed

MadLittleMods added 2 commits May 27, 2026 15:35

Kick CI after Sytest fixes

c289e93

See matrix-org/sytest#1425

Merge branch 'develop' into madlittlemods/remove-flawed-msc4311-parti…

ec572c6

…al-implementation

MadLittleMods marked this pull request as ready for review May 27, 2026 21:04

MadLittleMods requested a review from a team as a code owner May 27, 2026 21:04

anoadragon453 requested a review from Copilot May 28, 2026 15:13

Copilot started reviewing on behalf of anoadragon453 May 28, 2026 15:13 View session

Copilot AI reviewed May 28, 2026

View reviewed changes

MadLittleMods removed the request for review from a team May 28, 2026 16:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

MSC4311: Use full PDU's in stripped state (like `invite_room_state`) over federation and always include `m.room.create` event#19723

MSC4311: Use full PDU's in stripped state (like `invite_room_state`) over federation and always include `m.room.create` event#19723
MadLittleMods wants to merge 33 commits into
developfrom
madlittlemods/remove-flawed-msc4311-partial-implementation

MadLittleMods commented Apr 23, 2026 •

edited

Loading

Uh oh!

MadLittleMods May 4, 2026

Uh oh!

MadLittleMods May 4, 2026

Uh oh!

MadLittleMods May 4, 2026 •

edited

Loading

Uh oh!

MadLittleMods May 22, 2026 •

edited

Loading

Uh oh!

MadLittleMods May 26, 2026

Uh oh!

MadLittleMods May 26, 2026

Uh oh!

MadLittleMods May 26, 2026

Uh oh!

MadLittleMods May 26, 2026 •

edited

Loading

Uh oh!

MadLittleMods May 26, 2026

Uh oh!

MadLittleMods May 26, 2026

Uh oh!

MadLittleMods May 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		return [strip_event(e) for e in state_to_include.values()]

		async def get_stripped_room_state_ids_from_event_context(

		# TODO(paul): assert that room_id/event_id parsed from path actually
		# match those given in content

		@@ -0,0 +1 @@
		Remove flawed [MSC4311](https://github.com/matrix-org/matrix-spec-proposals/pull/4311) partial implementation: Client-side API's like `/sync` should still use stripped events.

		# Ensure the event has been stripped
		self.assertNotIn("signatures", event)

Uh oh!

Conversation

MadLittleMods commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Background

What does this PR do?

Dev notes

Todo

Pull Request Checklist

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MadLittleMods May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MadLittleMods May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MadLittleMods May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

MadLittleMods commented Apr 23, 2026 •

edited

Loading

MadLittleMods May 4, 2026 •

edited

Loading

MadLittleMods May 22, 2026 •

edited

Loading

MadLittleMods May 26, 2026 •

edited

Loading