matrix-spec-proposals

Commit Graph

Author	SHA1	Message	Date
Travis Ralston	83613457f7	MSC: Supporting alternative room directory sorting	1 week ago
Hugh Nimmo-Smith	e9f0f31d27	MSC3824: OAuth 2.0 API aware clients (#3824 ) * Add an optional query parameter to SSO redirect * MSC3824 * Update proposals/3824-sso-redirect-action.md Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Add supported actions per auth type * Add GET /_matrix/client/v3/register alternative * Rework proposal to be about OIDC aware clients * Rename proposal file * Use _ formatted flag name * Fixes to Homeserver and Client requirements list * RECOMMENDED: label SSO button as "Continue" * Use unstable prefix for action query param * Reference to MSC3861 * Update proposals/3824-oidc-aware-clients.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Style * Reorganise requiremetns * Add 3pid and session management requirements * Update account management/web UI link parameters for consistency with MSC2965 https://github.com/sandhose/matrix-doc/blob/msc/sandhose/oidc-discovery/proposals/2965-oidc-discovery.md#account-management-url-parameters * Update to reference OAuth 2.0 API in spec and MSC4191 * Add note about session_end vs org.matrix.session_end * Update proposals/3824-oidc-aware-clients.md * Add note on where action=login\|register value might come from * Clarify what was meant by "compatibility layer" * Add requirement about deactivating account * Use org.matrix.device_delete from MSC4191 not org.matrix.session_end * Update proposals/3824-oidc-aware-clients.md Co-authored-by: David Baker <dbkr@users.noreply.github.com> * Cleanup * Feedback from review Re https://github.com/matrix-org/matrix-spec-proposals/pull/3824#discussion_r2410559153 * Linewrap * DItto * Links * Link to m.login.sso * Attempt to clarify purpose/intent of MSC * Fix links * Spelling * Clarify that server discovery is needed + that the whole thing is optional * Clarify that m.login.password is only required where homeserver previously supported it * Apply suggestions from code review Co-authored-by: Hubert Chathi <hubertc@matrix.org> --------- Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Hubert Chathi <hubertc@matrix.org>	1 week ago
Quentin Gliech	2b6da16d52	MSC4191: Account management for OAuth 2.0 API (#4191 ) * WIP: Account management deep-linking * Update to reference OAuth 2.0 API * Update title for MSC4191 deep-linking proposal * Clarifications and relate to existing wording in spec * Update proposals/4191-account-deeplink.md * Add note about malicious link mitigation * Apply suggestions from code review Co-authored-by: Hubert Chathi <hubert@uhoreg.ca> * Update action values and reorder sections for readability * Update proposals/4191-account-deeplink.md Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Update proposals/4191-account-deeplink.md Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Update cross-signing reset action with additional details Added a reference to MSC4312 for cross-signing reset details. * Apply suggestions from code review Co-authored-by: Tonkku <contact@tonkku.me> --------- Co-authored-by: Hugh Nimmo-Smith <hughns@element.io> Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Hubert Chathi <hubert@uhoreg.ca> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> Co-authored-by: Tonkku <contact@tonkku.me>	1 week ago
timedout	24f045ba45	MSC4323: User suspension & locking endpoints (#4323 )	2 weeks ago
codedust	765af8d00f	Proposal template: explicitly mention RFC 3552 in security section (#4378 ) * Template: explicitly mention RFC 3552 in security section Signed-off-by: codedust <codedust@users.noreply.github.com> * Apply suggestions from code review --------- Signed-off-by: codedust <codedust@users.noreply.github.com> Co-authored-by: Travis Ralston <travpc@gmail.com>	3 weeks ago
Andrew Morgan	b8a558afd9	fix MSC ID in MSC3820 title	3 weeks ago
Andrew Morgan	5921d432b0	Note general endpoint reminders apply to existing endpoints that are modified (#4364 )	3 weeks ago
Johannes Marbach	ea0aef0aa3	MSC4312: Resetting cross-signing keys in the OAuth world (#4312 ) * MSC4312: Resetting cross-signing keys in the OAuth world Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Link to MSC4191 * Add org.matrix.cross_signing_reset navigation action Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Mention RFC9470 as an alternative as per @hughns's suggestion Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Rename m.cross_signing_reset to m.oauth Co-authored-by: Travis Ralston <travpc@gmail.com> * Clarify that security risks are specific to implementations Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Rename leftover occurrences of m.cross_signing_reset Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Clarify that this proposal (now) aims to spec an interim solution Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Reformat Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Mention MSC4363 as a future alternative Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Add recommendation for how to migrate from the unstable to the stable identifier Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Explain the renaming to m.oauth Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Relax wording around server requirements --------- Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org> Co-authored-by: Travis Ralston <travpc@gmail.com>	2 months ago
Hubert Chathi	55ec009949	MSC4153: Exclude non-cross-signed devices (#4153 )	2 months ago
Quentin Gliech	ebb7d204ec	MSC4190: Device management for application services (#4190 ) Co-authored-by: Tulir Asokan <tulir@maunium.net>	2 months ago
Travis Ralston	2b15b1074b	MSC4326: Device masquerading for appservices (#4326 ) Co-authored-by: Tulir Asokan <tulir@maunium.net>	2 months ago
Tulir Asokan	130da801e3	Fix links and remove linebreaks in checklist (#4346 ) Signed-off-by: Tulir Asokan <tulir@maunium.net> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	3 months ago
Patrick Cloke	05bc4b4c13	MSC4175: Profile field for user time zone (#4175 ) * MSC4175: Profile field for user time zone * Expand security section. * Fix typos. Co-authored-by: Will Hunt <will@half-shot.uk> * Updates. * Update with concerns * Add additional required info * Typo fix * Review comments. Co-authored-by: Travis Ralston <travisr@matrix.org> * Typo fix Co-authored-by: Hubert Chathi <hubert@uhoreg.ca> * Add examples --------- Co-authored-by: Will Hunt <will@half-shot.uk> Co-authored-by: Travis Ralston <travisr@matrix.org> Co-authored-by: Hubert Chathi <hubert@uhoreg.ca>	3 months ago
Travis Ralston	71cb0bdbb5	MSC4311: Ensuring the create event is available on invites (#4311 ) * MSC: Ensuring the create event is available on invites and knocks * Clarify that we're not replacing auth checks on create events * Acknowledge disparity in unaffected room formats * This isn't a word despite what spellcheck thinks * add migration steps * Just use the normal stripped_state format * Rewrite problem statement and solution components to match new scope * review: improve intro * review: clarify format * review: fix knocks * review: fix room_id calculation * review: rework migration wording * Fully format all events in stripped state * Spelling * Make migration normative * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Adjust requirements on servers --------- Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	3 months ago
Tulir Asokan	0b27750479	MSC4142: Remove unintentional intentional mentions in replies (#4142 ) * Proposal for removing unintentional intentional mentions in replies Signed-off-by: Tulir Asokan <tulir@maunium.net> * Explicitly specify that clients can add more mentions Signed-off-by: Tulir Asokan <tulir@maunium.net> --------- Signed-off-by: Tulir Asokan <tulir@maunium.net>	3 months ago
Travis Ralston	e7475e0c5b	Placeholder for MSC4289 unembargo (#4328 ) * Placeholder for MSC4289 unembargo * Incorporate pre-FCP embargoed MSC content Cover security@ email too	4 months ago
Travis Ralston	75f585d1df	MSC4304: Room Version 12 (#4304 ) * Create 4304-placeholder.md * MSC: Room Version 12 spellcheck Update 4304-room-version-12.md Encourage servers to deviate from the SHOULD in the spec Apply suggestions from code review Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> --------- Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	4 months ago
Kegan Dougal	d9ec3387c0	MSC4297: State Resolution 2.1 (#4297 ) * Placeholder * Add MSC4297: SR2.1 manually `git apply` hates me --------- Co-authored-by: Travis Ralston <travisr@matrix.org>	4 months ago
Johannes Marbach	2bb34224dd	Clarify capability behaviour with respect to avatar_url and displayname in MSC4133 (#4327 )	4 months ago
Travis Ralston	f6df298869	Clarify `/upgrade` behaviour in MSC4289 to match implementation (#4315 ) Discovered while writing the spec PR.	4 months ago
Travis Ralston	0dcb9d063b	Editorial: Fix dates & unstable prefix of MSC4291 (#4314 ) * Fix dates & unstable prefix of MSC4291 * circular dep is circular * fix the correct circular dep	4 months ago
Matthew Hodgson	3d68238b0f	MSC4289: Explicitly privilege room creators (#4289 ) * msc4289 placeholder * Populate MSC --------- Co-authored-by: Travis Ralston <travisr@matrix.org>	4 months ago
Matthew Hodgson	b1f4ea8c3d	MSC4291: Room IDs as hashes of the create event (#4291 ) * msc4291 placeholder * Add MSC4291: Room IDs as hashes of the create event Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Matthias Ahouansou <matthias@ahouansou.cz> * Fix image src * Review comments * Add prose on blocking alternative * Add MSC4311 note * Update proposals/4291-room-ids-as-hashes.md Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * 11th hour review --------- Co-authored-by: Kegan Dougal <7190048+kegsay@users.noreply.github.com> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Matthias Ahouansou <matthias@ahouansou.cz> Co-authored-by: Tulir Asokan <tulir@maunium.net> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Travis Ralston <travisr@matrix.org>	4 months ago
Richard van der Hoff	45fb4ba63e	Proposal to fix the auth events (#4307 )	5 months ago
Erik Johnston	6e3e1622b5	MSC4222: Adding `state_after` to `/sync` (#4222 ) * First draft of MSC4222 * Fix indentation * Fix json * Include msc number in unstable prefixes * Update proposals/4222-sync-v2-state-after.md Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Update proposals/4222-sync-v2-state-after.md Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Apply suggestions from code review As discussed during the MSC clinic hour Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Re-word the paragraphs about rebuilding the history of state * Add more details about why /v3/sync's current behaviour is insufficient. * Clarify state_after limitation regarding state removal * Update proposals/4222-sync-v2-state-after.md Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: fkwp <fkwp@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andy Balaam <andy.balaam@matrix.org> Co-authored-by: fkwp <github-fkwp@w4ve.de> Co-authored-by: Travis Ralston <travisr@matrix.org> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net>	5 months ago
Tulir Asokan	07ee4ffef7	MSC4210: Remove legacy mentions (#4210 ) * Remove legacy mentions Signed-off-by: Tulir Asokan <tulir@maunium.net> * Add another potential issue Signed-off-by: Tulir Asokan <tulir@maunium.net> * Add new room version to alternatives Signed-off-by: Tulir Asokan <tulir@maunium.net> * Specify that including `m.mentions` in all events is still necessary Signed-off-by: Tulir Asokan <tulir@maunium.net> * Add links to current spec --------- Signed-off-by: Tulir Asokan <tulir@maunium.net>	5 months ago
Richard van der Hoff	5beaf2e7a7	checklist: fix links (#4285 ) Fix a couple of broken links in the MSC checklist	7 months ago
Travis Ralston	c8d22786c3	typo	8 months ago
Quentin Gliech	b2ea1a7f9e	MSC2967: API scopes (#2967 ) * API Scopes MSC * Proposed insufficient privilege response format * Remove realm as not required * Clarifications + update on latest device management proposal * Revised namespace structure + unstable prefixes * Revise prefix for device ID * Reference to MSC3861 + cleanup * Add scope for guest access and tidy up * No need for UIA scope * Update proposals/2967-api-scopes.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Clarification about encoding of device ID within URN scope * Rework MSC - Remove insufficient privilege response - Remove guest scopes - Reword some parts * Update proposals/2967-api-scopes.md Co-authored-by: Travis Ralston <travpc@gmail.com> * Reword as dbkr suggested * Reword how unstable subdivisions are used * Remove confusing sentence * Gather all the links at the bottom of the document * Tyding up, define exactly how device IDs are handled * Don't use a table for a single row * Typo Co-authored-by: David Baker <dbkr@users.noreply.github.com> * Fix math rendering * Fix the math * Minor rewording on device uniqueness Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Simplify wording around the ASCII range Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Typo Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Scope vs scope token is confusing Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Reword how the device ID is requested * Explain why we keep the device ID generation on the client * MSCXXXX is a better placeholder Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * The scope MUST have a device ID * Clarify that device IDs are still unique per user Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	8 months ago
Quentin Gliech	d83a46e498	MSC2966: Usage of OAuth 2.0 Dynamic Client Registration in Matrix (#2966 ) * OAuth 2.0 Dynamic Registration MSC * contacts is required non-empty * Make client_uri mandatory * Rework MSC - makes some metadata optional - better explain how each metadata field is used - better explain what the restrictions on redirect_uris are - remove the signed metadata part - mention the client metadata JSON document alternative * Mention the `token_endpoint_auth_method` client metadata * Update proposals/2966-oauth2-dynamic-registration.md Co-authored-by: Tonkku <4409524+tonkku107@users.noreply.github.com> * State that the homeserver should display the tos_uri and policy_uri * Make the wording for the refresh token clearer * Clarify that native callbacks with no slashes are allowed * Give an example where the server ignores an unsupported grant type * Add security considerations * must -> MUST, should -> SHOULD, may -> MAY * Clarify the client should store the client_id * Simplify definition of client_uri, already covered by the RFC * Explain the point of the MSC earlier Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Remove empty section * Explicitly state that the client_uri is required * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Fix the web/native client sub-sub-sub sections * Clarify the localhost port-less redirect URIs * The server should return a 201 on successful registration * Explain better the restrictions on URIs * Allow custom ports in the redirect URI * Client regs won't grow exponentially * Explain how to mitigate the problem of client registrations growing over time. * Add missing metadata in the dynamic registration response * Make 'metadata localization' its own sub-sub-sub-sub-section Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Server may still deduplicate registrations Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Suggest different strategies to mitigate the growing number of client registrations * Let the server delete client registrations that have no active sessions * Really, shoud MUST do a new client reg * Make sure the summary doesn't sound authoritative * Put the links at the end of the file * Explain what is Matrix-specific, what is not --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Tonkku <4409524+tonkku107@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	8 months ago
Quentin Gliech	52db4c684a	MSC2964: Usage of OAuth 2.0 authorization code grant and refresh token grant (#2964 ) * OAuth 2.0 profile MSC * Refer to OP rather than AS to avoid clash with Application Service * Title update and intro about architectural change * Add section on endpoints that would now be outside of scope and so removed * Spelling * Section on proposed endpoints that would no longer be relevant * Consistency with MSC3861 and cleanup * Standardise terminology on OpenID Provider = OP * Update proposals/2964-oauth2-profile.md Co-authored-by: Dominik Henneke <dominik.henneke@nordeck.net> * Notes on QR and browserless * OpenID id_token endpoint is still needed * Notes about confusion with existing OIDC and OpenID capabilities * Additional endpoints to be removed * Add 3pid endpoints that would be removed * Changes to GET /account/3pid * Alternative proposal for 3PID handling * Add section on removing UIA * Refer to UIA as API * We now have proposal for 3PID and guest access * Logout semantics * Remove TBDs that are done * More done items * Remove dependency loop * Rework proposal to only cover the authorization code flow * Fix a bunch of todos * Fix typos * Fix the response_mode being an authorization request parameter * Apply suggestions from code review Co-authored-by: Tonkku <tonkku.kallio3@gmail.com> * Remove unused images * Expand the security considerations section * Clarify that using PKCE with S256 is mandatory * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * All Matrix clients are public clients, no need to be too specific * Add PAR/RAR in 'alternatives' section * Replace horizontal rules with subsections * Clarify how the client should handle access token refresh failures * Explain why clients should use the fragment response_mode better * Explain the scope better in the example * Clarify that `code_verifier` should be cryptographically random Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Typo Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Hugh Nimmo-Smith <hughns@element.io> Co-authored-by: Dominik Henneke <dominik.henneke@nordeck.net> Co-authored-by: Tonkku <tonkku.kallio3@gmail.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	8 months ago
Hugh Nimmo-Smith	2f670cafb3	MSC3861: Next-generation auth for Matrix, based on OAuth 2.0/OIDC (#3861 ) * Matrix architecture change to delegate authentication via OIDC * MSC3861 * typoe * typoes * typoes * Add proposal for Matrix.org Foundation to become member of OpenID Foundation * Update proposals/3861-delegated-oidc-architecture.md Co-authored-by: greizgh <greizgh@ephax.org> * Move images inline * Use term OpenID Provider * Add note about extending UIA as alternative * Add reference to related MSCs * Rework the MSC to better explain the rationale for the change * Start writing the actual proposal * Remove unused images * Expand on 'why not just OIDC' and fix some typos * Add note on the history of the proposal * renamed 3861-delegated-oidc-architecture.md -> 3861-next-generation-auth.md * Define token revocation through MSC4254 & add sample flow * Use the new version of MSC2965 * List a few potential issues * Mention areweoidcyet.com * Apply suggestions from code review Co-authored-by: Travis Ralston <travisr@matrix.org> * § about how we keep the ecosystem open * Update the alternatives table to stop mentioning 'OP' * Reword how we mention MSC dependencies that are already in the spec * Reformat with prettier * Make it clearer what proposals are adjacente, write about ASes * Add links about the current C-S API * Add links to the spec * Add links about OIDC and OAuth 2.0 * Clarify what the 'system browser' means * Give an example of a better email verification flow * Typo * Reword what the benefits of using the homeserver's domain name are * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Talk more about the implications of scoped access tokens. * Linkify /capabilities * Clarify that the sample flow is non-normative * Explain why we can't 'just use' OpenID Connect better * Explain how currently HS can restrict client used * Clarify what 'UIA APIs' mean in this proposal * Mention that in theory UIA fallbacks also means implementation complexity on the homeserver side. * Clarify that it doesn't have to be the default browser * Clarify that I meant /login * Reword around dynamic registration * Reword: /login is not UIA! Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Add link for "web-based fallback" Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Typo Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> * Reword the browser redirect explanation Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> * Remove easter egg * Better outline the rationale for this MSC Co-Authored-By: Erik Johnston <erikj@matrix.org> * Remove the redundant point about 'protecting the user's creds' * Simplify the argument for client registration Co-Authored-By: Richard van der Hoff <richvdh@users.noreply.github.com> Co-Authored-By: Erik Johnston <erikj@matrix.org> * Clarify what we aim to deprecate * Typo Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> --------- Co-authored-by: Matthew Hodgson <matthew@matrix.org> Co-authored-by: greizgh <greizgh@ephax.org> Co-authored-by: Quentin Gliech <quenting@element.io> Co-authored-by: Travis Ralston <travisr@matrix.org> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> Co-authored-by: Erik Johnston <erikj@matrix.org> Co-authored-by: Richard van der Hoff <richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	8 months ago
Quentin Gliech	8d2fb67793	MSC4254: Usage of RFC7009 Token Revocation for Matrix client logout (#4254 ) * MSC4254: Usage of RFC7009 Token Revocation for Matrix client logout * Clarify how the token_type_hint parameter is used * Clarify what the server should do if the client_id is not provided * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Tonkku <contact@tonkku.me> * Explain why we allow revoking without a client_id better * Clarify how this replaces the /logout API * Some non-contentious clarifying bits * s/login/logout/ Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> --------- Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Tonkku <contact@tonkku.me> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com>	8 months ago
Quentin Gliech	1e689aaff8	MSC2965: OAuth 2.0 Authorization Server Metadata discovery (#2965 ) * OIDC discovery MSC * Add `account` field * Add id_token_hint to account management URL * Add reference to MSC3861 * Add missing heading * Fix reference to MSC3861 * Update proposals/2965-oidc-discovery.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Fix typo * Update 2965-oidc-discovery.md * Update proposals/2965-oidc-discovery.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Update proposals/2965-oidc-discovery.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * OIDC Provider -> OpenID Provider * Define account management URL params * Link for account management URLs * MSC2965: move from well-known discovery to a dedicated C-S endpoint * MSC2965: add a note about why the well-known alternative has been discarded * MSC2965: move the account management URL to the provider metadata * MSC2965: line breaks * MSC2965: update note about the account endpoint metadata * Move the /auth_issuer endpoint to the v1 prefix * Add the `org.matrix.cross_signing_reset` action * Typo * Rename MSC * Remove account-related URLs * Mention RFC8414 as alternative * Outline another alternative: publish the metadata through a C-S API * Fix the alternative flow * Publish the auth server metadata through a new C-S API endpoint This removes the depdency on OIDC specs * renamed 2965-oidc-discovery.md -> 2965-auth-metadata.md * Clarify auth & rate limiting requirements Co-authored-by: Travis Ralston <travpc@gmail.com> * Mention the MSCs using each metadata value * Explain what to do when next-gen auth is not available * Add rationale for not using a .well-known endpoint * Reformat with prettier * Add `issuer` to the required metadata fields * Explain why we don't just use static C-S endpoints * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Move the rationale for not using a `.well-known` document to the alternatives section. * Typo * Clarify why using the .well-known would be confusing Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Clarify what 'UIA flows' are exactly Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> --------- Co-authored-by: Hugh Nimmo-Smith <hughns@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	8 months ago
Travis Ralston	9e729ec18c	Fix typos	8 months ago
DeepBlueV7.X	e39f38ae8a	MSC3266: Room summary API (#3266 ) * Room summary proposal Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Remove alias resolution step from the federation API * Reference #688 in the alternatives section Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Remove `is_direct` from response Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Fix unstable prefixes for implementations which keep the prefix and rest of the path separate Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add allowed_room_ids field That way the requesting server knows, if any user would have access to that room and it can forward the room to the user. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Extend rationale for additional fields to reference MSC2946 Also explain that membership is already accessible information. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add bulk API as an alternative Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Remove federation API and address feedback - Add some additional rationale to some things. - Federation API now reuses MSC 2946 - roomid -> roomId - Move it out of /rooms, because it allows using an alias Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * fix prefixes again * Remove extensions to federation API since that MSC is amended now Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Fix minor inaccuracy about the spaces sumary api * Add encryption field back * Add room version field Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Apply suggestions from code review Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> * Add a bit more reasoning * version -> room_version * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Try to address review comments Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Fix incorrect statement about encryption being a bool Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Split up the big alternatives section * Collapse the same descriptions for publicRooms and hierarchy into one * Shorten the 'accessible' section again * Update proposals/3266-room-summary.md Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Update proposals/3266-room-summary.md * Update proposals/3266-room-summary.md Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> * Support knock_restricted rooms and rename to room_summary As well as a few smaller clarifications. * Be more explicit about authentication * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Fix error codes and missing "Optional" * Also add allowed_room_ids to hierarchy API It suffers from the same knock_restricted issue. * Apply suggestions from code review Co-authored-by: Eric Eastwood <madlittlemods@gmail.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Update spec links * Clarify accessibility rules * Update proposals/3266-room-summary.md Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Update proposals/3266-room-summary.md Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Unauthenticated access is impl-dependent * add to response * Clarify resposnse documentation. * Clarify situation for invited rooms * further clarification about unauth access * Update proposals/3266-room-summary.md Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> --------- Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Alexey Rusakov <Kitsune-Ral@users.sf.net> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Eric Eastwood <madlittlemods@gmail.com> Co-authored-by: Richard van der Hoff <richard@matrix.org> Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org>	8 months ago
Travis Ralston	a15271b608	MSC4260: Reporting users (Client-Server API) (#4260 ) * MSC: Reporting users (Client-Server API) * Add guest access requirements * Add examples; fix reason * Clarify that reports don't transit federation, but can still be received	9 months ago
Johannes Marbach	3f3b34a427	MSC3765: Rich text in room topics (#3765 ) * Add rich room topic MSC Signed-off-by: Johannes Marbach <johannesm@element.io> * Rename to reflect propper MSC number * Fix typo * Explain why m.topic is kept separate from m.message * Use json5 for formatting code snippet Co-authored-by: Travis Ralston <travisr@matrix.org> * Remove unneeded unstable room version * Adapt to latest version of MSC1767 * Add paragraph about preventing formatting abuse * Introduce wrapping m.topic content block (#4111) * Clarify the case of HTML-only topics and transition logic (#4112) * Clarify and simplify transition logic * Clarify the case of HTML-only topics * Make it more explicit that m.topic replaces m.room.topic without deprecation (#4181) * Remove line-based formatting logic and limit length of topics (#4182) * Update MSC3765: Rich text in room topics (#4215) Updates MSC from feedback, * Accept suggestion Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Clarify length / display limits. Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Apply clarifications from author Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Make MSC3765 independent of extensible events and new room versions (#4240) * Apply suggestions from code review * Update proposals/3765-rich-room-topics.md Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Properly explain why the m.topic content block is needed (#4251) * Apply suggestions from code review Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> --------- Signed-off-by: Johannes Marbach <johannesm@element.io> Co-authored-by: Travis Ralston <travisr@matrix.org> Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	9 months ago
David Baker	93b0353581	MSC4183: Additional Error Codes for submitToken endpoint (#4183 ) * MSC4180: Additional Error Codes for submitToken endpoint * Bah, markdown * Line wrapping * Typos * Right MSC number Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> * Rename * Add http status code * Apply suggestions from code review Spelling / grammar fixes Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Word wrap * Clearer wording * clarify * Clarify * Add note about not reusing error code * Clarify that we're taking about the submittoken api in requestToken * spelling * Clearer wording Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Add note on POST email submitToken api and how it isn't really a thing in practice * Hopefully make more clearer * Apply same change to other submitToken endpoints ...from the other requestToken enpoints Also try to further clarify the note about the largely unused POST email submitToken * Remove stray lines, more clarifications & consistency fix * clarify only c/s api Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Typos & clarity Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Clarify --------- Co-authored-by: Johannes Marbach <n0-0ne+github@mailbox.org> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>	9 months ago
Tom Foster	eb813af46d	MSC4133: Extending User Profile API with Key:Value Pairs (#4133 ) * Extended profile fields * Unstable client features * Clarification on limits * Warning about avatar_url and displayname limits * Error code clarification * Whitespace fixes * Adjusted size limits * Clarified Canonical JSON * Clarifications * Clarifications * Remove UTF-16 * Clarify key persistence * Out of date line * Clarify only `u.` namespace is limited to 512 bytes Include read-only fields in capability * Change missing capability behaviour * Typo correction * Privacy clarification for T&S * Consolidation and rewrite * Whitespace fix * Safety and security updates * Clarify servers can hide fields * References to MSC4201 and MSC4202 * Clarify redacted `m.room.member` events * Error codes and redundant instructions * Removing custom fields * Typo fix * Clarifications and readability * Correct key length error to match common grammar limit * Remove PATCH/PUT. * Removed redundant sections after `PUT` and `PATCH` methods removed * Re-add client feature for managing profile fields * Update proposals/4133-extended-profiles.md Co-authored-by: Travis Ralston <travpc@gmail.com> * Clarify 403 error scenarios * Add section on caching behaviour under S-S API * Link to Canonical JSON in current spec * Cut down instructions for clients on when to display content from federated users. * Revert `c82dab67d1` * Clarify caching and freshness challenges * Adjust abuse section * Authentication/rate-limiting/guest access requirements * Un-revert accidental revert of `af87bbeb26` * Simplify caching recommendations * Up to clients whether they check capability Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Technically correct is the best kind of correct Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Link to current federation profile endpoint Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Mention check for spec version when using profile fields Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Attempt to clarify what servers should not enforce about key naming * Fix line wrapping after `9b2918e373` * Add `M_MISSING_PARAM` error * Clarify where errors apply * Clarify optional ability to not always federate every field * Fix inconsistent line wrapping * Offer suggestions for hiding extended fields when member event redacted Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Fix wrapping length of one line --------- Co-authored-by: Patrick Cloke <patrickc@matrix.org> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	10 months ago
Travis Ralston	4c1cfb1125	MSC4239: Room version 11 as the default room version (#4239 ) * MSC: Room version 11 as the default room version * s	10 months ago
Johannes Marbach	03197edb69	MSC4213: Remove server_name parameter (#4213 ) Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>	11 months ago
Hubert Chathi	51ebe01d75	MSC4147: Including device keys with Olm-encrypted events (#4147 )	12 months ago
Richard van der Hoff	5370f489cd	MSC4225: Specification of an order in which one-time-keys should be issued (#4225 ) * Initial proposal * edits * typos * Add impl note about dropping old keys	12 months ago
David Teller	aa7a3fc035	MSC3823: Account Suspension (#3823 ) * MSC: A code for account suspension Signed-off-by: David Teller <davidt@element.io> * WIP: Adding prefix * Update proposals/3823-code-for-account-suspension.md Co-authored-by: Travis Ralston <travpc@gmail.com> * Apply suggestions from code review Co-authored-by: Dirk Klimpel <5740567+dklimpel@users.noreply.github.com> * Update for latest requirements * Add list of permitted/forbidden actions * Remove `href` from error code - this will be handled in a later MSC * Match modern template * Clarify MSC * Clarify differences in locking vs suspension, and future scope --------- Signed-off-by: David Teller <davidt@element.io> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Dirk Klimpel <5740567+dklimpel@users.noreply.github.com> Co-authored-by: Travis Ralston <travisr@matrix.org>	1 year ago
DeepBlueV7.X	9deddd1558	MSC2781: Remove the reply fallbacks from the specification (#2781 ) * MSC2781: Down with the fallbacks Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add a note about dropping the html requirement Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add an unstable prefix for removed fallbacks. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add a section about fallbacks not being properly specified. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add appendix about which clients do not support replies (and why, if possible) Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Correct weechat status Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Add another alternative Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Document a few more issues with fallbacks Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Update client status, remove proposal for edits and try to turn down the language a bit Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Remove mistaken reference to the Qt renderer Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Try to make motivation a bit clearer in the proposal Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * How do anchors work? Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Drop reference to issues with edit fallbacks Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Typos Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Address review comments Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * More edits Move edit section to a single sentence in "interaction with other features". Spell out why the IRC example is there. Reword body stripping. Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Implementation traps Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Add dates to client status list Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Mention pushrules proposal in the alternatives section Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> * Update proposal to 2024 This also addresses several review comments from clokep and Travis. * Be explicit about removal * Apply suggestions from code review Thanks dbkr, richvdh and clokep! Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Update proposals/2781-down-with-the-fallbacks.md Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Simplify wording around invalid html and potential issues Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> --------- Signed-off-by: Nicolas Werner <nicolas.werner@hotmail.de> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: David Baker <dbkr@users.noreply.github.com> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Travis Ralston <travpc@gmail.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	1 year ago
Richard van der Hoff	22c774de58	Revert "MSC3061: Sharing room keys for past messages (#3061 )" This reverts commit `6a3ab1d64c`. Per https://matrix.org/blog/2024/10/security-disclosure-matrix-js-sdk-and-matrix-react-sdk/ and https://github.com/matrix-org/matrix-spec-proposals/pull/3061#issuecomment-2444845098, we are removing the merged status of this PR.	1 year ago
Travis Ralston	b76697ed1a	spelling	1 year ago
Sorunome	c1fc612e86	MSC2409: Proposal to send EDUs to appservices (#2409 ) * Initial proposal commit * Add body of proposal * rename file * finish up MSC * address issues * change key names and add unstable prefix * Clarifications; to-device handling * It's not exactly like sync * Move to-device messages * Copy edu_type behaviour * Add full transaction example * Add implementation notes for to-device cleanup * Use type instead of edu_type to match realities of implementations * Add note to say ephemeral can be omitted. * Improve wording on why we use a seperate array. Co-authored-by: Kevin Cox <kevincox@kevincox.ca> * push_ephemeral -> receive_ephemeral * Fix some typos and clarify EDU room association * Clarify EDU formatting * Explicitly list all event types * Delete to-device events to be moved to a new MSC * Update spec link and fix typo Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> * Add private read receipt rules * Apply suggestions from code review Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> * Wrap lines * Apply suggestions from code review Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com> * Explicitly mention to-device events are not here * Mention the possibility of more granular filtering --------- Co-authored-by: Will Hunt <will@half-shot.uk> Co-authored-by: Travis Ralston <travisr@matrix.org> Co-authored-by: Kevin Cox <kevincox@kevincox.ca> Co-authored-by: Tulir Asokan <tulir@maunium.net> Co-authored-by: Patrick Cloke <clokep@users.noreply.github.com> Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com> Co-authored-by: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>	1 year ago
Johannes Marbach	6b10266b14	MSC4170: 403 error responses for profile APIs (#4170 ) Relates to matrix-org/matrix-spec#1867 Signed-off-by: Johannes Marbach <n0-0ne+github@mailbox.org>	1 year ago

1 2 3 4 5 ...

6422 Commits (83613457f7be829d5bd123e7023e83faf20e581f) All Branches Search

6422 Commits (83613457f7be829d5bd123e7023e83faf20e581f)

All Branches