devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 35 Packages Projects Releases Wiki Activity

feat: relax group DM authority check for trusted peers

Browse Source 
Remove sourceInstance === ownerHomeInstance check for incremental
member_add. Allows federated users to create group DMs on non-home
instances. HMAC trust boundary + attribution check remain.
This commit is contained in:
Jannis Braun
2026-04-07 19:53:15 +02:00
parent dc57a050b0
commit ad172b34e1
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/routes/federation.ts
+3 -5
View File
@@ -2384,11 +2384,9 @@ function processMemberAddEvent(
return; return;
} }
// Validate authority: only the owner's instance can add members // Authority note: any HMAC-verified peer can relay member_add events.
if (channel.ownerHomeInstance && sourceInstance !== channel.ownerHomeInstance) { // The HMAC signature proves the event came from a trusted peer.
rejected.push({ messageId: event.messageId, reason: 'unauthorized_source' }); // The attribution check below still validates that addedBy belongs to the source instance.
return;
}
// Attribution: adder must belong to source instance (FED-010) // Attribution: adder must belong to source instance (FED-010)
if (event.membership.addedBy && !verifyAttribution(event.membership.addedBy.homeInstance, sourceInstance)) { if (event.membership.addedBy && !verifyAttribution(event.membership.addedBy.homeInstance, sourceInstance)) {