hmm, that should generate a config file with a listener on port 1234. Are you also port forwarding to port 1234 when you run the container?

Also note that the better room for this would be #synapse:matrix.org

Hi everyone. Synapse 1.122.0rc1 has just been released.

Please note that this version of Synapse drops support for PostgreSQL 11 and 12. The minimum version of PostgreSQL supported is now version 13.

notes | docker | debs | pypi

Hi, I've recently come across a challenge regarding space privacy. Users from the same homeserver are allowed to see the membership list, even if they haven't joined the space. The goal is to have a public space with join rules set to "invite only," but with a hidden membership list for users who have not joined.

Regarding this issue, I started to dig a little at the source code of Synapse, specifically here at :

synapse/synapse/rest/client/room.py 

I found this specific section :

class RoomMemberListRestServlet(RestServlet):
    PATTERNS = client_patterns("/rooms/(?P<room_id>[^/]*)/members$", v1=True)
    CATEGORY = "Client API requests"

    def __init__(self, hs: "HomeServer"):
        super().__init__()
        self.message_handler = hs.get_message_handler()
        self.auth = hs.get_auth()
        self.store = hs.get_datastores().main

    @cancellable
    async def on_GET(
        self, request: SynapseRequest, room_id: str
    ) -> Tuple[int, JsonDict]:
        # TODO support Pagination stream API (limit/tokens)
        requester = await self.auth.get_user_by_req(request, allow_guest=True)
        handler = self.message_handler

        # request the state as of a given event, as identified by a stream token,
        # for consistency with /messages etc.
        # useful for getting the membership in retrospect as of a given /sync
        # response.
        at_token_string = parse_string(request, "at")
        if at_token_string is None:
            at_token = None
        else:
            at_token = await StreamToken.from_string(self.store, at_token_string)

        membership = parse_string(request, "membership")
        not_membership = parse_string(request, "not_membership")

        events = await handler.get_state_events(
            room_id=room_id,
            requester=requester,
            at_token=at_token,
            state_filter=StateFilter.from_types([(EventTypes.Member, None)]),
        )

        chunk = []

        for event in events:
            if (membership and event["content"].get("membership") != membership) or (
                not_membership and event["content"].get("membership") == not_membership
            ):
                continue
            chunk.append(event)

        return 200, {"chunk": chunk}

I wonder if it could be possible to introduce additional steps or checks before returning the membership data. For example, there might be an option to confirm whether the requesting user has the correct membership status to view the list. Or, maybe enforcing stricter checks so that only joined members see those details, or potentially add configuration flags that govern who can view membership data.

I’d be very interested in any feedback on whether this approach is consistent with Synapse’s principles.

Thanks for your help either way 🚀

Well it is just a public room with different join rule

My first steps were to make the create a public space, then i changed the join rule to invite only using this command :

curl -X PUT \
  -H "Authorization: Bearer $ADMIN_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "join_rule": "invite"
  }' \
  "https://homeserver/_matrix/client/v3/rooms/ROOMID/state/m.room.join_rules"

But the issue doesn't arise here, the issue is the membership list of a space than can be viewed by anyone, regardless if you joined or not the space

So a user is allowed to see the membership list if:

1. They are currently joined to the room (of course)
2. They were joined to the room at some point (in which case they can see the membership list at the point in time they left)
3. The room's history visibility setting is set to world_readable.

A room may appear in the public rooms list if it:

1. Has its history visibility set to world_readable.
2. Has a join_rule of public, knock, or knock_restricted.

The latter is so you can find rooms to knock on.

Well actually the problem came when I tried to hide the membership list from outsiders by setting:

curl -X PUT \
  -H "Authorization: Bearer $ADMIN_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"history_visibility": "joined"}' \
  "https://HOMESERVER/_matrix/client/v3/rooms/ROOMID/state/m.room.history_visibility"

As soon as I did that, the space vanished from the public listing in Element, even though I still wanted it to remain discoverable. My main goal is to let people see that this space exists while ensuring they can’t see who’s in it unless they’re invited and become members.

if you can see the events in a room(space), you can see the rooms within that space as well as the members in that space

If you can't see them, you can't see any. There's no in-between; both are considered events in the room history

Thats why i was asked about the specs above in the source code of Synapse in

synapse/synapse/rest/client/room.py 

In reply to @loic.le_guen:matrix.org
Since I think my use case is quite narrow, I don't believe there's much chance my request will be considered over more important spec updates...