Client-Server and Server-Server specs disagree on default invite power level

[syldrathecat]

Link to problem area:

https://spec.matrix.org/v1.3/client-server-api/#mroompower_levels

The levels for kick, ban and redact default to 50 if they are not specified in the m.room.power_levels event, or if the room contains no m.room.power_levels event. invite defaults to 0 in either case.

https://spec.matrix.org/v1.3/server-server-api/#definitions

The levels given by the invite, kick, ban, and redact properties in the current m.room.power_levels state. Each defaults to 50 if unspecified.

Issue
With the change made in 136b5c9 to fix #860 / #1019, the client-server spec is now inconsistent with the default power levels specified in the server-server spec.

The server-server spec should be changed to also specify 0 as the default invite power level.

[turt2live]

at some point there was a security issue related to all of this, which isn't coming up in the flip-flopping history of the default power level.

That should be dug up and the history re-examined, I think.

[richvdh]

I don't think there's any flip-flopping. The spec originally said the default level was 50, but Synapse never implemented that, and so the spec was changed in #1021 to match - except for this bit which seems to have been missed.

You might be thinking of matrix-org/synapse#6834, which changed the shape of the power_levels event that Synapse emits when it creates a room. But that's a different thing.

[turt2live]

I'm fairly certain there was an MSC about this, and an internal issue. Neither seem to be linked from the previous history :(

[richvdh]

I don't believe there was an MSC, and the only internal issue I'm aware of is the one relating to matrix-org/synapse#6834.

[richvdh]

For the record, this particular spec but was introduced at https://github.com/matrix-org/matrix-doc/pull/1027/files#diff-90803a49d366c4ab693b7ea5d1dd061d2f948a6361bfcca523260cefb67e00ccR470.

[richvdh]

@syldrathecat: thanks for reporting this! Would you mind opening a pull-request to fix it? It looks like the line that needs changing is in https://github.com/matrix-org/matrix-spec/blob/main/content/server-server-api.md.

[syldrathecat]

@syldrathecat: thanks for reporting this! Would you mind opening a pull-request to fix it? It looks like the line that needs changing is in https://github.com/matrix-org/matrix-spec/blob/main/content/server-server-api.md.

I can't, sorry. The project does not accept pseudonymous contributions.