Repository navigation
Read invitations through the contract; res$raw goes unread - #172
Merged
Merged
Conversation
The poll loop takes chat_poll()$invites and joins with chat_join(). That was the last thing it read off the raw sync response, so the migration reaches its stated finish line: every message, decrypted message, reaction and invitation now arrives as a record, and grep for res$raw in matrix_poll() finds only the comment saying so. matrix_invite_inviters() is deleted. Reading who sent an invitation meant walking the stripped invite_state, which put Matrix sync-shape knowledge two packages away from the sync. mx.client owns it now and the record carries it, which is the only reason this phase removed the reach-through rather than moving it. The operator gate keeps its behaviour and reports better. An invitation from someone not on the list and one whose sender the homeserver never named both refuse -- they always did -- but the log now says which, because "someone I do not trust" and "a question that went unanswered" are different things to whoever reads it at 3am. One invitation that cannot be joined no longer risks the others. chat_join() raises so each failure is visible; matrix_accept_invites() catches per room, so a revoked invitation cannot take the poll and the rooms beside it down too. The startup catch-up still reads a raw sync, deliberately. It needs a full no-since sync to see invitations issued while the bot was down, and chat_poll() only ever resumes from a cursor, so it stays until the contract grows a verb for that. It goes through the same gate, so the operator policy is still written once. 2783 assertions. Three mutations, all caught: accepting an invitation whose sender is unknown, bypassing the operator gate entirely, and letting one failed join abort the rest.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The poll loop reads
chat_poll()$invitesand joins withchat_join().That was the last
$rawconsumer.grep 'res\$raw' R/matrix.Rinmatrix_poll()now finds only the comment saying it goes unread. Every message, decrypted message, reaction and invitation arrives as a record — the migration plan's stated finish line for phase 2.What moved and why it could
matrix_invite_inviters()is deleted. Reading who sent an invitation meant walking the strippedinvite_state, which put Matrix sync-shape knowledge two packages away from the sync. mx.client owns that now andchat_invite()carries the sender — which is the only reason this phase removed the reach-through instead of relocating it.The gate reports better
An invitation from someone not on the operator list, and one whose sender the homeserver never named, both refuse. They always did. The log now distinguishes them:
"Someone I do not trust" and "a question that went unanswered" are different things to whoever reads that at 3am.
One bad invite no longer risks the rest
chat_join()raises, so each failure is visible;matrix_accept_invites()catches per room. A revoked invitation, or a room the bot was kicked from between the sync and the join, cannot take the poll and the rooms beside it down with it.What deliberately stays on a raw sync
The startup catch-up in
matrix_run_init(). It needs a full no-since sync to see invitations issued while the bot was down, andchat_poll()only ever resumes from a cursor — that is not expressible in the contract yet, and belongs with the backfill design phase. It goes through the same gate, so the operator policy is still written exactly once.Testing
2783 assertions. Three mutations, all caught: accepting an invitation whose sender is unknown, bypassing the operator gate entirely, and letting one failed join abort the rest.
Floors:
chat.api >= 0.0.1.14,mx.client >= 0.2.0.4, both enforced at runtime.