fix: Omitting redundant entries from the auth_chain caused problems

.forgejo/workflows/release-image.yml

@@ -101,7 +101,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Install rust
-        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
         id: rust-toolchain
         uses: ./.forgejo/actions/rust-toolchain
 
@@ -112,7 +111,6 @@ jobs:
           driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
           endpoint: ${{ env.BUILDKIT_ENDPOINT || '' }}
       - name: Set up QEMU
-        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
         uses: docker/setup-qemu-action@v3
       # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
       - name: Login to builtin registry
@@ -142,21 +140,15 @@ jobs:
         run: |
           calculatedSha=$(git rev-parse --short ${{ github.sha }})
           echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
-          echo "Short SHA: $calculatedSha"
       - name: Get Git commit timestamps
-        run: |
-          timestamp=$(git log -1 --pretty=%ct)
-          echo "TIMESTAMP=$timestamp" >> $GITHUB_ENV
-          echo "Commit timestamp: $timestamp"
+        run: echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
 
       - uses: ./.forgejo/actions/timelord
-        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
         with:
           key: timelord-v0
           path: .
 
       - name: Cache Rust registry
-        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
         uses: actions/cache@v3
         with:
           path: |
@@ -166,7 +158,6 @@ jobs:
             .cargo/registry/src
           key: rust-registry-image-${{hashFiles('**/Cargo.lock') }}
       - name: Cache cargo target
-        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
         id: cache-cargo-target
         uses: actions/cache@v3
         with:
@@ -174,7 +165,6 @@ jobs:
             cargo-target-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}
           key: cargo-target-${{ matrix.target_cpu }}-${{ matrix.slug }}-${{ matrix.profile }}-${{hashFiles('**/Cargo.lock') }}-${{steps.rust-toolchain.outputs.rustc_version}}
       - name: Cache apt cache
-        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
         id: cache-apt
         uses: actions/cache@v3
         with:
@@ -182,7 +172,6 @@ jobs:
             var-cache-apt-${{ matrix.slug }}
           key: var-cache-apt-${{ matrix.slug }}
       - name: Cache apt lib
-        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
         id: cache-apt-lib
         uses: actions/cache@v3
         with:
@@ -190,7 +179,6 @@ jobs:
             var-lib-apt-${{ matrix.slug }}
           key: var-lib-apt-${{ matrix.slug }}
       - name: inject cache into docker
-        if: ${{ env.BUILDKIT_ENDPOINT == '' }}
         uses: https://github.com/reproducible-containers/buildkit-cache-dance@v3.3.0
         with:
           cache-map: |

src/api/server/send_join.rs

@@ -56,10 +56,8 @@ async fn create_join_event(
 
 	// We do not add the event_id field to the pdu here because of signature and
 	// hashes checks
-	trace!("Getting room version");
 	let room_version_id = services.rooms.state.get_room_version(room_id).await?;
 
-	trace!("Generating event ID and converting to canonical json");
 	let Ok((event_id, mut value)) = gen_event_id_canonical_json(pdu, &room_version_id) else {
 		// Event could not be converted to canonical json
 		return Err!(Request(BadJson("Could not convert event to canonical json.")));
@@ -108,6 +106,7 @@ async fn create_join_event(
 		)));
 	}
 
+	// ACL check sender user server name
 	let sender: OwnedUserId = serde_json::from_value(
 		value
 			.get("sender")
@@ -117,6 +116,12 @@ async fn create_join_event(
 	)
 	.map_err(|e| err!(Request(BadJson(warn!("sender property is not a valid user ID: {e}")))))?;
 
+	services
+		.rooms
+		.event_handler
+		.acl_check(sender.server_name(), room_id)
+		.await?;
+
 	// check if origin server is trying to send for another server
 	if sender.server_name() != origin {
 		return Err!(Request(Forbidden("Not allowed to join on behalf of another server.")));
@@ -178,6 +183,11 @@ async fn create_join_event(
 		}
 	}
 
+	services
+		.server_keys
+		.hash_and_sign_event(&mut value, &room_version_id)
+		.map_err(|e| err!(Request(InvalidParam(warn!("Failed to sign send_join event: {e}")))))?;
+
 	let origin: OwnedServerName = serde_json::from_value(
 		value
 			.get("origin")
@@ -187,12 +197,6 @@ async fn create_join_event(
 	)
 	.map_err(|e| err!(Request(BadJson("Event has an invalid origin server name: {e}"))))?;
 
-	trace!("Signing send_join event");
-	services
-		.server_keys
-		.hash_and_sign_event(&mut value, &room_version_id)
-		.map_err(|e| err!(Request(InvalidParam(warn!("Failed to sign send_join event: {e}")))))?;
-
 	let mutex_lock = services
 		.rooms
 		.event_handler
@@ -200,7 +204,7 @@ async fn create_join_event(
 		.lock(room_id)
 		.await;
 
-	trace!("Acquired send_join mutex, persisting join event");
+	debug!("Acquired send_join mutex, persisting join event");
 	let pdu_id = services
 		.rooms
 		.event_handler
@@ -210,7 +214,7 @@ async fn create_join_event(
 		.ok_or_else(|| err!(Request(InvalidParam("Could not accept as timeline event."))))?;
 
 	drop(mutex_lock);
-	trace!("Fetching current state IDs");
+	debug!("Fetching current state IDs");
 	let state_ids: Vec<OwnedEventId> = services
 		.rooms
 		.state_accessor
@@ -219,19 +223,21 @@ async fn create_join_event(
 		.collect()
 		.await;
 
-	trace!(%omit_members, "Constructing current state");
+	#[allow(clippy::unnecessary_unwrap)]
 	let state = state_ids
 		.iter()
 		.try_stream()
 		.broad_filter_map(|event_id| async move {
-			if omit_members {
-				if let Ok(e) = event_id.as_ref() {
-					let pdu = services.rooms.timeline.get_pdu(e).await;
-					if pdu.is_ok_and(|p| p.kind().to_cow_str() == "m.room.member") {
-						trace!("omitting member event {e:?} from returned state");
-						// skip members
-						return None;
-					}
+			if omit_members && event_id.is_ok() {
+				let pdu = services
+					.rooms
+					.timeline
+					.get_pdu(event_id.as_ref().unwrap())
+					.await;
+				if pdu.is_ok_and(|p| p.kind().to_cow_str() == "m.room.member") {
+					trace!("omitting member event {event_id:?} from returned state");
+					// skip members
+					return None;
 				}
 			}
 			Some(event_id)
@@ -248,11 +254,21 @@ async fn create_join_event(
 		.await?;
 
 	let starting_events = state_ids.iter().map(Borrow::borrow);
-	trace!("Constructing auth chain");
 	let auth_chain = services
 		.rooms
 		.auth_chain
 		.event_ids_iter(room_id, starting_events)
+		// .broad_filter_map(|event_id| async {
+		// 	if omit_members && event_id.as_ref().is_ok_and(|e| state_ids.contains(e)) {
+		// 		// Don't include this event if it's already in the state
+		// 		trace!(
+		// 			"omitting member event {event_id:?} from returned auth chain as it is \
+		// 			 already in state"
+		// 		);
+		// 		return None;
+		// 	}
+		// 	Some(event_id)
+		// })
 		.broad_and_then(|event_id| async move {
 			services.rooms.timeline.get_pdu_json(&event_id).await
 		})
@@ -265,13 +281,12 @@ async fn create_join_event(
 		.try_collect()
 		.boxed()
 		.await?;
-	info!(fast_join = %omit_members, "Sending join event to other servers");
+
 	services.sending.send_pdu_room(room_id, &pdu_id).await?;
-	debug!("Finished sending join event");
 	let servers_in_room: Option<Vec<_>> = if !omit_members {
 		None
 	} else {
-		trace!("Fetching list of servers in room");
+		debug!("Fetching list of servers in room");
 		let servers: Vec<String> = services
 			.rooms
 			.state_cache
@@ -281,10 +296,8 @@ async fn create_join_event(
 			.await;
 		// If there's no servers, just add us
 		let servers = if servers.is_empty() {
-			warn!("Failed to find any servers, adding our own server name as a last resort");
 			vec![services.globals.server_name().to_string()]
 		} else {
-			trace!("Found {} servers in room", servers.len());
 			servers
 		};
 		Some(servers)
@@ -333,6 +346,7 @@ pub(crate) async fn create_join_event_v1_route(
 		}
 	}
 
+	info!("Providing send_join for {} in {}", body.origin(), &body.room_id);
 	let now = Instant::now();
 	let room_state = create_join_event(&services, body.origin(), &body.room_id, &body.pdu, false)
 		.boxed()
@@ -343,7 +357,7 @@ pub(crate) async fn create_join_event_v1_route(
 		event: room_state.event,
 	};
 	info!(
-		"Finished sending a join for {} in {} in {:?}",
+		"Finished creating the send_join payload for {} in {} in {:?}",
 		body.origin(),
 		&body.room_id,
 		now.elapsed()
@@ -380,13 +394,14 @@ pub(crate) async fn create_join_event_v2_route(
 		}
 	}
 
+	info!("Providing send_join for {} in {}", body.origin(), &body.room_id);
 	let now = Instant::now();
 	let room_state =
 		create_join_event(&services, body.origin(), &body.room_id, &body.pdu, body.omit_members)
 			.boxed()
 			.await?;
 	info!(
-		"Finished sending a join for {} in {} in {:?}",
+		"Finished creating the send_join payload for {} in {} in {:?}",
 		body.origin(),
 		&body.room_id,
 		now.elapsed()