devsyncwrld/backspace
1
0
Fork 0
Code Issues Pull Requests Actions 34 Packages Projects Releases Wiki Activity

feat: relax group DM authority check for trusted peers

Browse Source 
Remove sourceInstance === ownerHomeInstance check for incremental
member_add. Allows federated users to create group DMs on non-home
instances. HMAC trust boundary + attribution check remain.
This commit is contained in:
Jannis Braun
2026-04-07 19:53:15 +02:00
parent dc57a050b0
commit ad172b34e1
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/server/src/routes/federation.ts
+3 -5
View File
@@ -2384,11 +2384,9 @@ function processMemberAddEvent(
return;
}
// Validate authority: only the owner's instance can add members
if (channel.ownerHomeInstance && sourceInstance !== channel.ownerHomeInstance) {
rejected.push({ messageId: event.messageId, reason: 'unauthorized_source' });
return;
}
// Authority note: any HMAC-verified peer can relay member_add events.
// The HMAC signature proves the event came from a trusted peer.
// The attribution check below still validates that addedBy belongs to the source instance.
// Attribution: adder must belong to source instance (FED-010)
if (event.membership.addedBy && !verifyAttribution(event.membership.addedBy.homeInstance, sourceInstance)) {