Synapse: Missing transaction_id in syncs for remote-echo of messages for guests

[t3chguy]

See https://github.com/vector-im/element-web/issues/13706 for details

[clokep]

I've unfortunately been unable to reproduce this. I've been unable to get Element Web into a room as a guest. Can you provide more specific steps to reproduce?

[t3chguy]

It is only possible if Synapse joins them into that room, e.g using auto_join

[clokep]

I was able to confirm this:

1. Configure synapse to allow guests and to auto-join rooms (not sure this is all necessary), this uses the room #public:localhost:8480, which I created with a separate user:

allow_guest_access: true
auto_join_rooms:
  - "#public:localhost:8480"
auto_join_rooms_for_guests: true

1. Setup an Element Web that points to localhost:8480 by default

   1. Download the latest Element Web release
   2. Unpack it.
   3. cp config.sample.json config.json
   4. Modify the default_server_config key

2. Serve Element Web locally: python -m http.server from the directory you unpacked Element Web in

3. Go to http://localhost:8000/#/room/#public:localhost:8480
4. Type something and you'll see copies of your own messages stuck at the bottom.

[clokep]

This is a bit of an edge-case and it is unclear how much impact this is having on end-users. At the moment we're not going to prioritize this, but if anyone is keen to investigate further they can join #synapse-dev:matrix.org for help! On the surface it seems to be something with the serialize_event method.

[grinapo]

I've unfortunately been unable to reproduce this. I've been unable to get Element Web into a room as a guest. Can you provide more specific steps to reproduce?

See vector-im/element-web#15567 and try the link there.

[grinapo]

This is a bit of an edge-case and it is unclear how much impact this is having on end-users.

Basically it affects everyone coming to a specific matrix room from a click on a webpage, as a guest user, to simply chat, without even being aware that it's "something called matrix". As it is now it makes plainly _impossible to use_ since own messages accumulate at the bottom and new messages appear from the middle to top, possibly without even noticed and the user simply gives up and leaves.

[erikjohnston]

This looks to be because guests use macaroons, which don't have an associated token_id:

https://github.com/matrix-org/synapse/blob/34a5696f9338f1a1ec52203e3871a797a02138a9/synapse/api/auth.py#L357-L364

So when we serialize the event we don't include the transaction ID:

https://github.com/matrix-org/synapse/blob/34a5696f9338f1a1ec52203e3871a797a02138a9/synapse/events/utils.py#L305-L309

To fix this we may want to pass in both a user_id and token_id and changing the guard to be if user_id is not None: .... I think only a couple of places call serialize_event while specifying a token_id so it shouldn't be too invasive