( req *http.Request, device *userapi.Device, roomID, eventID string, cfg *config.ClientAPI, rsAPI roomserverAPI.ClientRoomserverAPI, txnID *string, txnCache *transactions.Cache, )
| 39 | } |
| 40 | |
| 41 | func SendRedaction( |
| 42 | req *http.Request, device *userapi.Device, roomID, eventID string, cfg *config.ClientAPI, |
| 43 | rsAPI roomserverAPI.ClientRoomserverAPI, |
| 44 | txnID *string, |
| 45 | txnCache *transactions.Cache, |
| 46 | ) util.JSONResponse { |
| 47 | resErr := checkMemberInRoom(req.Context(), rsAPI, device.UserID, roomID) |
| 48 | if resErr != nil { |
| 49 | return *resErr |
| 50 | } |
| 51 | |
| 52 | if txnID != nil { |
| 53 | // Try to fetch response from transactionsCache |
| 54 | if res, ok := txnCache.FetchTransaction(device.AccessToken, *txnID); ok { |
| 55 | return *res |
| 56 | } |
| 57 | } |
| 58 | |
| 59 | ev := roomserverAPI.GetEvent(req.Context(), rsAPI, eventID) |
| 60 | if ev == nil { |
| 61 | return util.JSONResponse{ |
| 62 | Code: 400, |
| 63 | JSON: jsonerror.NotFound("unknown event ID"), // TODO: is it ok to leak existence? |
| 64 | } |
| 65 | } |
| 66 | if ev.RoomID() != roomID { |
| 67 | return util.JSONResponse{ |
| 68 | Code: 400, |
| 69 | JSON: jsonerror.NotFound("cannot redact event in another room"), |
| 70 | } |
| 71 | } |
| 72 | |
| 73 | // "Users may redact their own events, and any user with a power level greater than or equal |
| 74 | // to the redact power level of the room may redact events there" |
| 75 | // https://matrix.org/docs/spec/client_server/r0.6.1#put-matrix-client-r0-rooms-roomid-redact-eventid-txnid |
| 76 | allowedToRedact := ev.Sender() == device.UserID |
| 77 | if !allowedToRedact { |
| 78 | plEvent := roomserverAPI.GetStateEvent(req.Context(), rsAPI, roomID, gomatrixserverlib.StateKeyTuple{ |
| 79 | EventType: gomatrixserverlib.MRoomPowerLevels, |
| 80 | StateKey: "", |
| 81 | }) |
| 82 | if plEvent == nil { |
| 83 | return util.JSONResponse{ |
| 84 | Code: 403, |
| 85 | JSON: jsonerror.Forbidden("You don't have permission to redact this event, no power_levels event in this room."), |
| 86 | } |
| 87 | } |
| 88 | pl, err := plEvent.PowerLevels() |
| 89 | if err != nil { |
| 90 | return util.JSONResponse{ |
| 91 | Code: 403, |
| 92 | JSON: jsonerror.Forbidden( |
| 93 | "You don't have permission to redact this event, the power_levels event for this room is malformed so auth checks cannot be performed.", |
| 94 | ), |
| 95 | } |
| 96 | } |
| 97 | allowedToRedact = pl.UserLevel(device.UserID) >= pl.Redact |
| 98 | } |
no test coverage detected