6406 Commits (andybalaam/shared-key-backup-preference)

 

All Branches   

Search

Author	SHA1	Message	Date
Andy Balaam	d249eb2002	Note that servers can delete key backups already	7 months ago
Andy Balaam	3d926bd2fe	Note that clients should notice when key backup is deleted	7 months ago
Andy Balaam	c6a6ffc8a1	Improve wording around turning on key backups	7 months ago
Andy Balaam	eb3eebd56d	Fix wording of 'not perform key backup'	7 months ago
Andy Balaam	b7f2324a14	Note that the security problem is less if clients make the setting visible	7 months ago
Andy Balaam	e635ab0e04	Mention the weird unstable prefix	7 months ago
Andy Balaam	4b50617121	Small fixes and corrections	7 months ago
Andy Balaam	15f7585dac	Update MSC number in title	7 months ago
Andy Balaam	8309e2050c	Rename to reflect MSC number	7 months ago
Andy Balaam	9a9ded8628	First draft of shared-key-backup-preference	7 months ago
Richard van der Hoff	5beaf2e7a7	checklist: fix links (#4285) ... Fix a couple of broken links in the MSC checklist	7 months ago
Travis Ralston	c8d22786c3	typo	8 months ago
Quentin Gliech	b2ea1a7f9e	MSC2967: API scopes (#2967) ... * API Scopes MSC * Proposed insufficient privilege response format * Remove realm as not required * Clarifications + update on latest device management proposal * Revised namespace structure + unstable prefixes * Revise prefix for device ID * Reference to MSC3861 + cleanup * Add scope for guest access and tidy up * No need for UIA scope * Update proposals/2967-api-scopes.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Clarification about encoding of device ID within URN scope * Rework MSC - Remove insufficient privilege response - Remove guest scopes - Reword some parts * Update proposals/2967-api-scopes.md Co-authored-by: Travis Ralston <travpc@gmail.com> * Reword as dbkr suggested * Reword how unstable subdivisions are used * Remove confusing sentence * Gather all the links at the bottom of the document * Tyding up, define exactly how device IDs are handled * Don't use a table for a single row * Typo Co-authored-by: David Baker <dbkr@users.noreply.github.com> * Fix math rendering * Fix the math * Minor rewording on device uniqueness Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Simplify wording around the ASCII range Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Typo Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Scope vs scope token is confusing Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Reword how the device ID is requested * Explain why we keep the device ID generation on the client * MSCXXXX is a better placeholder Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * The scope MUST have a device ID * Clarify that device IDs are still unique per user Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	8 months ago
Quentin Gliech	d83a46e498	MSC2966: Usage of OAuth 2.0 Dynamic Client Registration in Matrix (#2966) ... * OAuth 2.0 Dynamic Registration MSC * contacts is required non-empty * Make client_uri mandatory * Rework MSC - makes some metadata optional - better explain how each metadata field is used - better explain what the restrictions on redirect_uris are - remove the signed metadata part - mention the client metadata JSON document alternative * Mention the `token_endpoint_auth_method` client metadata * Update proposals/2966-oauth2-dynamic-registration.md Co-authored-by: Tonkku <4409524+tonkku107@users.noreply.github.com> * State that the homeserver should display the tos_uri and policy_uri * Make the wording for the refresh token clearer * Clarify that native callbacks with no slashes are allowed * Give an example where the server ignores an unsupported grant type * Add security considerations * must -> MUST, should -> SHOULD, may -> MAY * Clarify the client should store the client_id * Simplify definition of client_uri, already covered by the RFC * Explain the point of the MSC earlier Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Remove empty section * Explicitly state that the client_uri is required * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Fix the web/native client sub-sub-sub sections * Clarify the localhost port-less redirect URIs * The server should return a 201 on successful registration * Explain better the restrictions on URIs * Allow custom ports in the redirect URI * Client regs won't grow exponentially * Explain how to mitigate the problem of client registrations growing over time. * Add missing metadata in the dynamic registration response * Make 'metadata localization' its own sub-sub-sub-sub-section Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Server may still deduplicate registrations Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Suggest different strategies to mitigate the growing number of client registrations * Let the server delete client registrations that have no active sessions * Really, shoud MUST do a new client reg * Make sure the summary doesn't sound authoritative * Put the links at the end of the file * Explain what is Matrix-specific, what is not --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Tonkku <4409524+tonkku107@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	8 months ago
Quentin Gliech	52db4c684a	MSC2964: Usage of OAuth 2.0 authorization code grant and refresh token grant (#2964) ... * OAuth 2.0 profile MSC * Refer to OP rather than AS to avoid clash with Application Service * Title update and intro about architectural change * Add section on endpoints that would now be outside of scope and so removed * Spelling * Section on proposed endpoints that would no longer be relevant * Consistency with MSC3861 and cleanup * Standardise terminology on OpenID Provider = OP * Update proposals/2964-oauth2-profile.md Co-authored-by: Dominik Henneke <dominik.henneke@nordeck.net> * Notes on QR and browserless * OpenID id_token endpoint is still needed * Notes about confusion with existing OIDC and OpenID capabilities * Additional endpoints to be removed * Add 3pid endpoints that would be removed * Changes to GET /account/3pid * Alternative proposal for 3PID handling * Add section on removing UIA * Refer to UIA as API * We now have proposal for 3PID and guest access * Logout semantics * Remove TBDs that are done * More done items * Remove dependency loop * Rework proposal to only cover the authorization code flow * Fix a bunch of todos * Fix typos * Fix the response_mode being an authorization request parameter * Apply suggestions from code review Co-authored-by: Tonkku <tonkku.kallio3@gmail.com> * Remove unused images * Expand the security considerations section * Clarify that using PKCE with *S256* is mandatory * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * All Matrix clients are public clients, no need to be too specific * Add PAR/RAR in 'alternatives' section * Replace horizontal rules with subsections * Clarify how the client should handle access token refresh failures * Explain why clients should use the fragment response_mode better * Explain the scope better in the example * Clarify that `code_verifier` should be cryptographically random Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Typo Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Hugh Nimmo-Smith <hughns@element.io> Co-authored-by: Dominik Henneke <dominik.henneke@nordeck.net> Co-authored-by: Tonkku <tonkku.kallio3@gmail.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	8 months ago
Hugh Nimmo-Smith	2f670cafb3	MSC3861: Next-generation auth for Matrix, based on OAuth 2.0/OIDC (#3861) ... * Matrix architecture change to delegate authentication via OIDC * MSC3861 * typoe * typoes * typoes * Add proposal for Matrix.org Foundation to become member of OpenID Foundation * Update proposals/3861-delegated-oidc-architecture.md Co-authored-by: greizgh <greizgh@ephax.org> * Move images inline * Use term OpenID Provider * Add note about extending UIA as alternative * Add reference to related MSCs * Rework the MSC to better explain the rationale for the change * Start writing the actual proposal * Remove unused images * Expand on 'why not just OIDC' and fix some typos * Add note on the history of the proposal * renamed 3861-delegated-oidc-architecture.md -> 3861-next-generation-auth.md * Define token revocation through MSC4254 & add sample flow * Use the new version of MSC2965 * List a few potential issues * Mention areweoidcyet.com * Apply suggestions from code review Co-authored-by: Travis Ralston <travisr@matrix.org> * § about how we keep the ecosystem open * Update the alternatives table to stop mentioning 'OP' * Reword how we mention MSC dependencies that are already in the spec * Reformat with prettier * Make it clearer what proposals are adjacente, write about ASes * Add links about the current C-S API * Add links to the spec * Add links about OIDC and OAuth 2.0 * Clarify what the 'system browser' means * Give an example of a better email verification flow * Typo * Reword what the benefits of using the homeserver's domain name are * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Talk more about the implications of scoped access tokens. * Linkify /capabilities * Clarify that the sample flow is non-normative * Explain why we can't 'just use' OpenID Connect better * Explain how currently HS can restrict client used * Clarify what 'UIA APIs' mean in this proposal * Mention that in theory UIA fallbacks also means implementation complexity on the homeserver side. * Clarify that it doesn't have to be the *default* browser * Clarify that I meant /login * Reword around dynamic registration * Reword: /login is not UIA! Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Add link for "web-based fallback" Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Typo Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> * Reword the browser redirect explanation Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> * Remove easter egg * Better outline the rationale for this MSC Co-Authored-By: Erik Johnston <erikj@matrix.org> * Remove the redundant point about 'protecting the user's creds' * Simplify the argument for client registration Co-Authored-By: Richard van der Hoff <richvdh@users.noreply.github.com> Co-Authored-By: Erik Johnston <erikj@matrix.org> * Clarify what we aim to deprecate * Typo Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> --------- Co-authored-by: Matthew Hodgson <matthew@matrix.org> Co-authored-by: greizgh <greizgh@ephax.org> Co-authored-by: Quentin Gliech <quenting@element.io> Co-authored-by: Travis Ralston <travisr@matrix.org> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> Co-authored-by: Erik Johnston <erikj@matrix.org> Co-authored-by: Richard van der Hoff <richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	8 months ago
Quentin Gliech	8d2fb67793	MSC4254: Usage of RFC7009 Token Revocation for Matrix client logout (#4254) ... * MSC4254: Usage of RFC7009 Token Revocation for Matrix client logout * Clarify how the token_type_hint parameter is used * Clarify what the server should do if the client_id is not provided * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Tonkku <contact@tonkku.me> * Explain why we allow revoking without a client_id better * Clarify how this replaces the /logout API * Some non-contentious clarifying bits * s/login/logout/ Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> --------- Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Tonkku <contact@tonkku.me> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com>	8 months ago
Quentin Gliech	1e689aaff8	MSC2965: OAuth 2.0 Authorization Server Metadata discovery (#2965) ... * OIDC discovery MSC * Add `account` field * Add id_token_hint to account management URL * Add reference to MSC3861 * Add missing heading * Fix reference to MSC3861 * Update proposals/2965-oidc-discovery.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Fix typo * Update 2965-oidc-discovery.md * Update proposals/2965-oidc-discovery.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Update proposals/2965-oidc-discovery.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * OIDC Provider -> OpenID Provider * Define account management URL params * Link for account management URLs * MSC2965: move from well-known discovery to a dedicated C-S endpoint * MSC2965: add a note about why the well-known alternative has been discarded * MSC2965: move the account management URL to the provider metadata * MSC2965: line breaks * MSC2965: update note about the account endpoint metadata * Move the /auth_issuer endpoint to the v1 prefix * Add the `org.matrix.cross_signing_reset` action * Typo * Rename MSC * Remove account-related URLs * Mention RFC8414 as alternative * Outline another alternative: publish the metadata through a C-S API * Fix the alternative flow * Publish the auth server metadata through a new C-S API endpoint This removes the depdency on OIDC specs * renamed 2965-oidc-discovery.md -> 2965-auth-metadata.md * Clarify auth & rate limiting requirements Co-authored-by: Travis Ralston <travpc@gmail.com> * Mention the MSCs using each metadata value * Explain what to do when next-gen auth is not available * Add rationale for not using a .well-known endpoint * Reformat with prettier * Add `issuer` to the required metadata fields * Explain why we don't just use static C-S endpoints * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Move the rationale for not using a `.well-known` document to the alternatives section. * Typo * Clarify why using the .well-known would be confusing Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Clarify what 'UIA flows' are exactly Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	8 months ago
Travis Ralston	9e729ec18c	Fix typos	8 months ago
DeepBlueV7.X	e39f38ae8a	MSC3266: Room summary API (#3266) ... * Room summary proposal Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Remove alias resolution step from the federation API * Reference #688 in the alternatives section Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Remove `is_direct` from response Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Fix unstable prefixes for implementations which keep the prefix and rest of the path separate Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add allowed_room_ids field That way the requesting server knows, if any user would have access to that room and it can forward the room to the user. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Extend rationale for additional fields to reference MSC2946 Also explain that membership is already accessible information. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add bulk API as an alternative Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Remove federation API and address feedback - Add some additional rationale to some things. - Federation API now reuses MSC 2946 - roomid -> roomId - Move it out of /rooms, because it allows using an alias Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * fix prefixes again * Remove extensions to federation API since that MSC is amended now Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Fix minor inaccuracy about the spaces sumary api * Add encryption field back * Add room version field Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Apply suggestions from code review Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> * Add a bit more reasoning * version -> room_version * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Try to address review comments Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Fix incorrect statement about encryption being a bool Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Split up the big alternatives section * Collapse the same descriptions for publicRooms and hierarchy into one * Shorten the 'accessible' section again * Update proposals/3266-room-summary.md Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Update proposals/3266-room-summary.md * Update proposals/3266-room-summary.md Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> * Support knock_restricted rooms and rename to room_summary As well as a few smaller clarifications. * Be more explicit about authentication * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Fix error codes and missing "Optional" * Also add allowed_room_ids to hierarchy API It suffers from the same knock_restricted issue. * Apply suggestions from code review Co-authored-by: Eric Eastwood <madlittlemods@gmail.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Update spec links * Clarify accessibility rules * Update proposals/3266-room-summary.md Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Update proposals/3266-room-summary.md Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Unauthenticated access is impl-dependent * add to response * Clarify resposnse documentation. * Clarify situation for invited rooms * further clarification about unauth access * Update proposals/3266-room-summary.md Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> --------- Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Eric Eastwood <madlittlemods@gmail.com> Co-authored-by: Richard van der Hoff <richard@matrix.org> Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org>	8 months ago
Travis Ralston	a15271b608	MSC4260: Reporting users (Client-Server API) (#4260) ... * MSC: Reporting users (Client-Server API) * Add guest access requirements * Add examples; fix reason * Clarify that reports don't transit federation, but can still be received	9 months ago
Johannes Marbach	3f3b34a427	MSC3765: Rich text in room topics (#3765) ... * Add rich room topic MSC Signed-off-by: Johannes Marbach <johannesm@element.io> * Rename to reflect propper MSC number * Fix typo * Explain why m.topic is kept separate from m.message * Use json5 for formatting code snippet Co-authored-by: Travis Ralston <travisr@matrix.org> * Remove unneeded unstable room version * Adapt to latest version of MSC1767 * Add paragraph about preventing formatting abuse * Introduce wrapping m.topic content block (#4111) * Clarify the case of HTML-only topics and transition logic (#4112) * Clarify and simplify transition logic * Clarify the case of HTML-only topics * Make it more explicit that m.topic replaces m.room.topic without deprecation (#4181) * Remove line-based formatting logic and limit length of topics (#4182) * Update MSC3765: Rich text in room topics (#4215) Updates MSC from feedback, * Accept suggestion Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Clarify length / display limits. Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Apply clarifications from author Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Make MSC3765 independent of extensible events and new room versions (#4240) * Apply suggestions from code review * Update proposals/3765-rich-room-topics.md Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Properly explain why the m.topic content block is needed (#4251) * Apply suggestions from code review Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> --------- Signed-off-by: Johannes Marbach <johannesm@element.io> Co-authored-by: Travis Ralston <travisr@matrix.org> Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	9 months ago
David Baker	93b0353581	MSC4183: Additional Error Codes for submitToken endpoint (#4183) ... * MSC4180: Additional Error Codes for submitToken endpoint * Bah, markdown * Line wrapping * Typos * Right MSC number Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Rename * Add http status code * Apply suggestions from code review Spelling / grammar fixes Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Word wrap * Clearer wording * clarify * Clarify * Add note about not reusing error code * Clarify that we're taking about the submittoken api in requestToken * spelling * Clearer wording Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Add note on POST email submitToken api and how it isn't really a thing in practice * Hopefully make more clearer * Apply same change to other submitToken endpoints ...from the other requestToken enpoints Also try to further clarify the note about the largely unused POST email submitToken * Remove stray lines, more clarifications & consistency fix * clarify only c/s api Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Typos & clarity Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Clarify --------- Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	9 months ago
Tom Foster	eb813af46d	MSC4133: Extending User Profile API with Key:Value Pairs (#4133) ... * Extended profile fields * Unstable client features * Clarification on limits * Warning about avatar_url and displayname limits * Error code clarification * Whitespace fixes * Adjusted size limits * Clarified Canonical JSON * Clarifications * Clarifications * Remove UTF-16 * Clarify key persistence * Out of date line * Clarify only `u.*` namespace is limited to 512 bytes * Include read-only fields in capability * Change missing capability behaviour * Typo correction * Privacy clarification for T&S * Consolidation and rewrite * Whitespace fix * Safety and security updates * Clarify servers can hide fields * References to MSC4201 and MSC4202 * Clarify redacted `m.room.member` events * Error codes and redundant instructions * Removing custom fields * Typo fix * Clarifications and readability * Correct key length error to match common grammar limit * Remove PATCH/PUT. * Removed redundant sections after `PUT` and `PATCH` methods removed * Re-add client feature for managing profile fields * Update proposals/4133-extended-profiles.md Co-authored-by: Travis Ralston <travpc@gmail.com> * Clarify 403 error scenarios * Add section on caching behaviour under S-S API * Link to Canonical JSON in current spec * Cut down instructions for clients on when to display content from federated users. * Revert c82dab67d1 * Clarify caching and freshness challenges * Adjust abuse section * Authentication/rate-limiting/guest access requirements * Un-revert accidental revert of af87bbeb26 * Simplify caching recommendations * Up to clients whether they check capability Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Technically correct is the best kind of correct Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Link to current federation profile endpoint Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Mention check for spec version when using profile fields Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Attempt to clarify what servers should not enforce about key naming * Fix line wrapping after 9b2918e373 * Add `M_MISSING_PARAM` error * Clarify where errors apply * Clarify optional ability to not always federate every field * Fix inconsistent line wrapping * Offer suggestions for hiding extended fields when member event redacted Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Fix wrapping length of one line --------- Co-authored-by: Patrick Cloke <patrickc@matrix.org> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	10 months ago
Travis Ralston	4c1cfb1125	MSC4239: Room version 11 as the default room version (#4239) ... * MSC: Room version 11 as the default room version * s	10 months ago
Johannes Marbach	03197edb69	MSC4213: Remove server_name parameter (#4213) ... Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>	11 months ago
Hubert Chathi	51ebe01d75	MSC4147: Including device keys with Olm-encrypted events (#4147)	12 months ago
Richard van der Hoff	5370f489cd	MSC4225: Specification of an order in which one-time-keys should be issued (#4225) ... * Initial proposal * edits * typos * Add impl note about dropping old keys	12 months ago
David Teller	aa7a3fc035	MSC3823: Account Suspension (#3823) ... * MSC: A code for account suspension Signed-off-by: David Teller <davidt@element.io> * WIP: Adding prefix * Update proposals/3823-code-for-account-suspension.md Co-authored-by: Travis Ralston <travpc@gmail.com> * Apply suggestions from code review Co-authored-by: Dirk Klimpel <5740567+dklimpel@users.noreply.github.com> * Update for latest requirements * Add list of permitted/forbidden actions * Remove `href` from error code - this will be handled in a later MSC * Match modern template * Clarify MSC * Clarify differences in locking vs suspension, and future scope --------- Signed-off-by: David Teller <davidt@element.io> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Dirk Klimpel <5740567+dklimpel@users.noreply.github.com> Co-authored-by: Travis Ralston <travisr@matrix.org>	1 year ago
DeepBlueV7.X	9deddd1558	MSC2781: Remove the reply fallbacks from the specification (#2781) ... * MSC2781: Down with the fallbacks Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add a note about dropping the html requirement Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add an unstable prefix for removed fallbacks. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add a section about fallbacks not being properly specified. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add appendix about which clients do not support replies (and why, if possible) Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Correct weechat status Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add another alternative Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Document a few more issues with fallbacks Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Update client status, remove proposal for edits and try to turn down the language a bit Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Remove mistaken reference to the Qt renderer Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Try to make motivation a bit clearer in the proposal Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * How do anchors work? Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Drop reference to issues with edit fallbacks Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Typos Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Address review comments Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * More edits Move edit section to a single sentence in "interaction with other features". Spell out why the IRC example is there. Reword body stripping. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Implementation traps Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Add dates to client status list Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Mention pushrules proposal in the alternatives section Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Update proposal to 2024 This also addresses several review comments from clokep and Travis. * Be explicit about removal * Apply suggestions from code review Thanks dbkr, richvdh and clokep! Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Update proposals/2781-down-with-the-fallbacks.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Simplify wording around invalid html and potential issues Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> --------- Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	1 year ago
Richard van der Hoff	22c774de58	Revert "MSC3061: Sharing room keys for past messages (#3061)" ... This reverts commit 6a3ab1d64c. Per https://matrix.org/blog/2024/10/security-disclosure-matrix-js-sdk-and-matrix-react-sdk/ and https://github.com/matrix-org/matrix-spec-proposals/pull/3061#issuecomment-2444845098, we are removing the merged status of this PR.	1 year ago
Travis Ralston	b76697ed1a	spelling	1 year ago
Sorunome	c1fc612e86	MSC2409: Proposal to send EDUs to appservices (#2409) ... * Initial proposal commit * Add body of proposal * rename file * finish up MSC * address issues * change key names and add unstable prefix * Clarifications; to-device handling * It's not exactly like sync * Move to-device messages * Copy edu_type behaviour * Add full transaction example * Add implementation notes for to-device cleanup * Use type instead of edu_type to match realities of implementations * Add note to say ephemeral can be omitted. * Improve wording on why we use a seperate array. Co-authored-by: Kevin Cox <kevincox@kevincox.ca> * push_ephemeral -> receive_ephemeral * Fix some typos and clarify EDU room association * Clarify EDU formatting * Explicitly list all event types * Delete to-device events to be moved to a new MSC * Update spec link and fix typo Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Add private read receipt rules * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Wrap lines * Apply suggestions from code review Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Explicitly mention to-device events are not here * Mention the possibility of more granular filtering --------- Co-authored-by: Will Hunt <will@half-shot.uk> Co-authored-by: Travis Ralston <travisr@matrix.org> Co-authored-by: Kevin Cox <kevincox@kevincox.ca> Co-authored-by: Tulir Asokan <tulir@maunium.net> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	1 year ago
Johannes Marbach	6b10266b14	MSC4170: 403 error responses for profile APIs (#4170) ... Relates to matrix-org/matrix-spec#1867 Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>	1 year ago
Travis Ralston	4c0ec1ea73	MSC4189: Allowing guests to access uploaded media (#4189)	1 year ago
Catalan Lover	e5f33b9839	Clean up MSC_CHECKLIST.md (#4200) ... Signed-off-by: Catalan Lover catalanlover@protonmail.com	1 year ago
Kegan Dougal	27bc9a50e9	Mandate a 'Security Considerations' section on MSCs (#4199) ... And link to lists of possible problems to think about. This is part of an effort to improve the overall security of Matrix during the design process.	1 year ago
Travis Ralston	f633d3006e	Update spec text for CORS MSC (#4187)	1 year ago
David Baker	41495d2355	MSC4178: Additional Error Codes for requestToken endpoint (#4178)	1 year ago
Travis Ralston	abaaaee1c5	MSC4138: Update allowed HTTP methods in CORS responses (#4138)	1 year ago
DeepBlueV7.X	3b7108535b	Add a stable flag to MSC3916 (#4180) ... In conversation with several client and homeserver developers it has come up that the current schedule for rolling out authenticated media is hard for them to follow if they have to support all of 1.11 at once. I think the value of authenticated media is high enough to warrant a stable flag to encourage a faster rollout of authenticated media. This allows servers to support authenticated media without supporting all of 1.11 already and the additional burden on client developers is minimal. This flag is already in use by serveral implementations: - 51b5c98033 - 2dce08bab1 Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de>	1 year ago
Johannes Marbach	4251928aed	MSC4156: Migrate server_name to via (#4156)	1 year ago
Matthias Ahouansou	cf4cdf2663	MSC4163: Make ACLs apply to EDUs (#4163)	1 year ago
Josh Simmons	f07c4508a8	drop real/legal name requirement from DCO (#4172) ... Co-authored-by: Josh Simmons <git@josh.tel>	1 year ago
Johannes Marbach	bbe54bc1c2	MSC4159: Remove the deprecated name attribute on HTML anchor elements (#4159) ... Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>	1 year ago
Tulir Asokan	f2c6766e09	Clarify "real name" in contributor requirements (#4160) ... This updates the sign-off requirements to match what most other matrix-org and element-hq repos already have. The change was first made in synapse: https://github.com/matrix-org/synapse/pull/3467 Signed-off-by: Tulir Asokan <tulir@maunium.net>	1 year ago
Marcus	d04470eca4	MSC2867: Marking rooms as unread (#2867) ... * marking rooms as unread Signed-off-by: Marcus Hoffmann <bubu@bubu1.eu> * Add alternative suggestion by @turt2live Co-authored-by: Travis Ralston <travpc@gmail.com> * mention that this msc lacks thread support * typo fix * clarify type of notification we are referring to * fix some small typos * Update proposals/2867-rooms_marked_unread.md grammar improvement Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> --------- Signed-off-by: Marcus Hoffmann <bubu@bubu1.eu> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Andrew Morgan <andrew@amorgan.xyz> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	1 year ago
Travis Ralston	9acf41a92b	MSC4151: Reporting rooms (Client-Server API) (#4151) ... * MSC: Reporting rooms (Client-Server API) * Add legal notes, and limit scope creep on those notes * Mention MSC3840 * Mention information disclosure. * Update proposals/4151-report-room.md Co-authored-by: Quentin Gliech <quenting@element.io> --------- Co-authored-by: Quentin Gliech <quenting@element.io>	1 year ago
Richard van der Hoff	36c5ec47a2	MSC3916: Authentication for media (#3916)	2 years ago
Richard van der Hoff	712dd41e4f	MSC4115: membership information on events (#4115) ... * Proposal for membership information on events * unstable prefix * typo * Update proposals/4115-membership-on-events.md Co-authored-by: Matthew Hodgson <matthew@matrix.org> * Update MSC4115 * Make the new property *optional*. * Describe linear-DAG situation. * Mention client-side calculation as an alternative. * spleling * Return state *after* the event This is much easier to calculate in Synapse. * Clarificatoins to scope of MSC * List of endpoints is incomplete * RFC2119 keywords * Remove non-issue potential issue * Expand on why doing it client side doesn't work * Update proposals/4115-membership-on-events.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Update proposals/4115-membership-on-events.md * Update proposals/4115-membership-on-events.md * fix formatting --------- Co-authored-by: Matthew Hodgson <matthew@matrix.org> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com>	2 years ago