MSC3911 AP8: Expose restrictions over federation #101
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nico-famedly
reviewed
Sep 9, 2025
nico-famedly
reviewed
Sep 9, 2025
nico-famedly
approved these changes
Sep 10, 2025
nico-famedly
deleted the
syk/ap8-expose-restrictions-over-federation
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Linked Media MSC3911 AP8: Expose restrictions over federation #3358
fixes #3358
If restrictions are present, they should be exposed in the first part of the https://spec.matrix.org/v1.14/server-server-api/#get_matrixfederationv1mediadownloadmediaid response.
Acceptance criteria
Expose the restrictions json key in https://spec.matrix.org/v1.14/server-server-api/#get_matrixfederationv1mediadownloadmediaid
This should only be returned, if the msc is enabled.
The key is prefixed:
org.matrix.msc3911.restrictions(event_id and profile_user_id are not prefixed)If the server has no way to be able to see the media, an error should be returned instead of the media. (this is quite tricky, see https://github.com/famedly/product-management/issues/3357 )
The
/_matrix/federation/v1/media/downloadand/_matrix/federation/v1/media/thumbnailendpoints specified by MSC3916: Authentication for media matrix-org/matrix-spec-proposals#3916 are extended: the returned json object may have a property restrictions.If there is no restrictions property, the media is a legacy "unrestricted" media. Otherwise, restrictions should be a JSON object with one of the following properties: event_id, profile_user_id.
It is invalid for both event_id and profile_user_id to be set.
If neither event_id nor profile_user_id are present, the requesting user should assume that an unknown restriction is present, and not allow access to any user.
Open Questions
Which permission checks over federation are actually feasible, if the server wants to join the room for example?