Update and stabilize mutual rooms support (MSC2666) by tulir · Pull Request #19511 · element-hq/synapse

tulir · 2026-02-27T21:59:25Z

Updates the error codes to match MSC2666 changes (user ID query param validation + proper errcode for requesting rooms with self), added the new count field, and stabilized the endpoint. Can be merged in 5 days assuming nothing comes up during FCP

Pull Request Checklist

Pull request is based on the develop branch
Pull request includes a changelog file
Code style is correct (run the linters)

reivilibre

Thanks! I also notice the MSC isn't actually stable yet but I guess this is good to prepare

reivilibre · 2026-03-03T15:43:28Z

        super().__init__()
        self.auth = hs.get_auth()
        self.store = hs.get_datastores().main
+        if hs.config.experimental.msc2666_enabled:


Should we just remove unstable support altogether? Personally I'd be in favour, given the point of unstable is for experimentation and now the experiment has finished.

In that case, can also remove the non-stable client capability/feature flag on /versions.

If we want to keep this, it's a bit dodgy to mutate the PATTERNS variable given it's a class-variable and this is the constructor. This might screw us up in tests or Synapse small hosts. Probably also should add a test / parameterise a test to ensure the unstable keeps working. I personally think not worth the effort

I copied the mutation pattern from msc4133_enabled https://github.com/element-hq/synapse/blob/develop/synapse/rest/client/profile.py#L113

Usually it's nicer to keep the unstable version for a while and remove after a month or two, but I don't mind either way

I removed the unstable support in the last commit if the PATTERNS mutation isn't wanted (but removing it for MSC4133 will need another PR)

reivilibre · 2026-03-03T15:43:28Z

+            # possible for invalid data to exist in room-state, etc.
+            parse_and_validate_server_name(obj.domain)
+            return True
+        except Exception:


can we narrow this exception type and/or narrow the block of code it applies to?

This was mostly copied from DomainSpecificString's is_valid above. The only addition (is_compliant_user_id_localpart) shouldn't cause any exceptions, so it's just cls.from_string and parse_and_validate_server_name which do.

I guess replacing with except SynapseError might work? not completely sure though

parse_and_validate_server_name throws ValueError, cls.from_string does SynapseErrors, so I changed it to except (SynapseError, ValueError)

Co-authored-by: Olivier 'reivilibre' <olivier@librepush.net>

erikjohnston · 2026-03-03T15:13:51Z

    __repr__ = to_string


+def is_compliant_user_id_localpart(localpart: str) -> bool:


Note that this is similar to the logic we already have in check_username

synapse/synapse/handlers/register.py

Lines 166 to 182 in 160d978

if types.contains_invalid_mxid_characters(localpart):

raise SynapseError(

400,

"User ID can only contain characters a-z, 0-9, or '=_-./+'",

Codes.INVALID_USERNAME,

)

if not localpart:

raise SynapseError(400, "User ID cannot be empty", Codes.INVALID_USERNAME)

if (

localpart[0] == "_"

and not self.hs.config.registration.allow_underscore_prefixed_localpart

):

raise SynapseError(

400, "User ID may not begin with _", Codes.INVALID_USERNAME

)

We should probably put all of the different functions together and document the differences between the two?

Yeah good point, will change that

…ms-updates

…racters and add more docs

tulir · 2026-03-04T22:47:12Z

The MSC has been accepted now

tulir · 2026-03-13T17:23:09Z

The MSC had a slight path confusion (/v1/user/mutual_rooms vs /v1/mutual_rooms), drafting until it's resolved

…ms-updates

tulir · 2026-03-16T19:24:50Z

Complement and sytest flaked 3:<

reivilibre

Thanks!

Updates the error codes to match MSC2666 changes (user ID query param validation + proper errcode for requesting rooms with self), added the new `count` field, and stabilized the endpoint.

@jason-famedly

Tested on NetBSD 10 amd64 with 2026Q2 environment. # Synapse 1.156.0 (2026-07-07) ## Features - Expose [MSC4354 Sticky Events](matrix-org/matrix-spec-proposals#4354) over [MSC4186 (Simplified) Sliding Sync](matrix-org/matrix-spec-proposals#4186). ([\#19591](element-hq/synapse#19591)) - Stabilize support for sending ephemeral events to application services, as per [MSC2409](matrix-org/matrix-spec-proposals#2409). Contributed by @jason-famedly @ Famedly. ([\#19758](element-hq/synapse#19758)) - Include `allowed_room_ids` in the `/summary` client-server API response for rooms with restricted join rules, as required by Matrix 1.15. Contributed by @FrenchGithubUser @famedly. ([\#19762](element-hq/synapse#19762)) - [MSC4140: Cancellable delayed events](matrix-org/matrix-spec-proposals#4140): Allow authentication on delayed event management endpoints (such as `/restart`) to bypass ratelimits for unauthenticated requests based on the client IP address. ([\#19794](element-hq/synapse#19794)) - Add new metric `synapse_non_deactivated_user_count` which tracks the number of non-deactivated users in the database, split by `app_service`. ([\#19848](element-hq/synapse#19848)) - The `GET /_matrix/client/unstable/org.matrix.msc1763/retention/configuration` endpoint is now provided when retention is enabled and `experimental_features.msc1763_enabled` is enabled, based on [MSC1763](matrix-org/matrix-spec-proposals#1763). ([\#19853](element-hq/synapse#19853)) - Add experimental support for [MSC4491: Invite reasons in room creation](matrix-org/matrix-spec-proposals#4491). ([\#19874](element-hq/synapse#19874)) # Synapse 1.155.0 (2026-06-16) # Synapse 1.154.0 (2026-06-04) ## Features - Add support for [MSC4452: Preview URL capabilities API](matrix-org/matrix-spec-proposals#4452) which exposes a `io.element.msc4452.preview_url` capability. If `experimental_features.msc4452_enabled` is `true`, the `/_matrix/(client/v1/media|media/v3)/preview_url` endpoint now responds with a 403 status code when the capability is disabled. ([\#19715](element-hq/synapse#19715)) # Synapse 1.153.0 (2026-05-19) ## Features - Make ACLs apply to EDUs per [MSC4163](matrix-org/matrix-spec-proposals#4163). ([\#18475](element-hq/synapse#18475)) - Stabilize [MSC3266: Room summary API](matrix-org/matrix-spec-proposals#3266), removing the experimental config flag `msc3266_enabled`. Contributed by @dasha-uwu. ([\#19720](element-hq/synapse#19720)) - Partial [MSC4311](matrix-org/matrix-spec-proposals#4311) implementation: `m.room.create` is now a required part of stripped `invite_state`/`knock_state` . Contributed by @FrenchGithubUser @famedly. ([\#19722](element-hq/synapse#19722)) - Expose `tombstoned` and `replacement_room` in room details on admin API endpoint `GET /_synapse/admin/v1/rooms/<room_id>`. Contributed by Noah Markert. ([\#19737](element-hq/synapse#19737)) # Synapse 1.152.1 (2026-05-07) # Synapse 1.152.0 (2026-04-28) ## Features - Add a ["Listing quarantined media changes" Admin API](https://element-hq.github.io/synapse/latest/admin_api/media_admin_api.html#listing-quarantined-media-changes) for retrieving a paginated record of when media became (un)quarantined. ([\#19558](element-hq/synapse#19558), [\#19677](element-hq/synapse#19677), [\#19694](element-hq/synapse#19694)) - Advertise [MSC4445](matrix-org/matrix-spec-proposals#4445) sync timeline order in `unstable_features`. ([\#19642](element-hq/synapse#19642)) - Report the Rust compiler version used in the Prometheus metrics. Contributed by Noah Markert. ([\#19643](element-hq/synapse#19643)) - Passthrough 'article' and 'profile' OpenGraph metadata on URL preview requests. ([\#19659](element-hq/synapse#19659)) - Add a way to re-sign local events with a new signing key. ([\#19668](element-hq/synapse#19668)) - Support [MSC4450: Identity Provider selection for User-Interactive Authentication with Legacy Single Sign-On](matrix-org/matrix-spec-proposals#4450). ([\#19693](element-hq/synapse#19693)) - Add experimental support for [MSC4242](matrix-org/matrix-spec-proposals#4242): State DAGs. Excludes federation support. ([\#19424](element-hq/synapse#19424)) - Adds [Admin API](https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html) endpoints to list, fetch and delete user reports. ([\#19657](element-hq/synapse#19657)) - Reduce database disk space usage by pruning old rows from `device_lists_changes_in_room`. ([\#19473](element-hq/synapse#19473), [\#19709](element-hq/synapse#19709)) # Synapse 1.151.0 (2026-04-07) ## Features - Add stable support for [MSC4284](matrix-org/matrix-spec-proposals#4284) Policy Servers. ([\#19503](element-hq/synapse#19503)) - Update and stabilize support for [MSC2666](matrix-org/matrix-spec-proposals#2666): Get rooms in common with another user. Contributed by @tulir @ Beeper. ([\#19511](element-hq/synapse#19511)) - Updated experimental support for [MSC4388: Secure out-of-band channel for sign in with QR](matrix-org/matrix-spec-proposals#4388). ([\#19573](element-hq/synapse#19573)) - Stabilize `room_version` and `encryption` fields in the space/room `/hierarchy` API (part of [MSC3266](matrix-org/matrix-spec-proposals#3266)). ([\#19576](element-hq/synapse#19576)) - Introduce a [configuration option](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#matrix_authentication_service) to allow using HTTP/2 over plaintext when Synapse connects to Matrix Authentication Service. ([\#19586](element-hq/synapse#19586)) ## Deprecations and Removals - Remove support for [MSC3852: Expose user agent information on Device](matrix-org/matrix-spec-proposals#3852) as the MSC was closed. ([\#19430](element-hq/synapse#19430)) # Synapse 1.150.0 (2026-03-24) ## Features - Add experimental support for the [MSC4370](matrix-org/matrix-spec-proposals#4370) Federation API `GET /extremities` endpoint. ([\#19314](element-hq/synapse#19314)) - [MSC4140: Cancellable delayed events](matrix-org/matrix-spec-proposals#4140): When persisting a delayed event to the timeline, include its `delay_id` in the event's `unsigned` section in `/sync` responses to the event sender. ([\#19479](element-hq/synapse#19479)) - Expose [MSC4354 Sticky Events](matrix-org/matrix-spec-proposals#4354) over the legacy (v3) /sync API. ([\#19487](element-hq/synapse#19487)) - When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse. ([\#19554](element-hq/synapse#19554))

@jason-famedly

Tested on NetBSD 10 amd64 with 2026Q2 environment. # Synapse 1.156.0 (2026-07-07) ## Features - Expose [MSC4354 Sticky Events](matrix-org/matrix-spec-proposals#4354) over [MSC4186 (Simplified) Sliding Sync](matrix-org/matrix-spec-proposals#4186). ([\#19591](element-hq/synapse#19591)) - Stabilize support for sending ephemeral events to application services, as per [MSC2409](matrix-org/matrix-spec-proposals#2409). Contributed by @jason-famedly @ Famedly. ([\#19758](element-hq/synapse#19758)) - Include `allowed_room_ids` in the `/summary` client-server API response for rooms with restricted join rules, as required by Matrix 1.15. Contributed by @FrenchGithubUser @famedly. ([\#19762](element-hq/synapse#19762)) - [MSC4140: Cancellable delayed events](matrix-org/matrix-spec-proposals#4140): Allow authentication on delayed event management endpoints (such as `/restart`) to bypass ratelimits for unauthenticated requests based on the client IP address. ([\#19794](element-hq/synapse#19794)) - Add new metric `synapse_non_deactivated_user_count` which tracks the number of non-deactivated users in the database, split by `app_service`. ([\#19848](element-hq/synapse#19848)) - The `GET /_matrix/client/unstable/org.matrix.msc1763/retention/configuration` endpoint is now provided when retention is enabled and `experimental_features.msc1763_enabled` is enabled, based on [MSC1763](matrix-org/matrix-spec-proposals#1763). ([\#19853](element-hq/synapse#19853)) - Add experimental support for [MSC4491: Invite reasons in room creation](matrix-org/matrix-spec-proposals#4491). ([\#19874](element-hq/synapse#19874)) # Synapse 1.155.0 (2026-06-16) # Synapse 1.154.0 (2026-06-04) ## Features - Add support for [MSC4452: Preview URL capabilities API](matrix-org/matrix-spec-proposals#4452) which exposes a `io.element.msc4452.preview_url` capability. If `experimental_features.msc4452_enabled` is `true`, the `/_matrix/(client/v1/media|media/v3)/preview_url` endpoint now responds with a 403 status code when the capability is disabled. ([\#19715](element-hq/synapse#19715)) # Synapse 1.153.0 (2026-05-19) ## Features - Make ACLs apply to EDUs per [MSC4163](matrix-org/matrix-spec-proposals#4163). ([\#18475](element-hq/synapse#18475)) - Stabilize [MSC3266: Room summary API](matrix-org/matrix-spec-proposals#3266), removing the experimental config flag `msc3266_enabled`. Contributed by @dasha-uwu. ([\#19720](element-hq/synapse#19720)) - Partial [MSC4311](matrix-org/matrix-spec-proposals#4311) implementation: `m.room.create` is now a required part of stripped `invite_state`/`knock_state` . Contributed by @FrenchGithubUser @famedly. ([\#19722](element-hq/synapse#19722)) - Expose `tombstoned` and `replacement_room` in room details on admin API endpoint `GET /_synapse/admin/v1/rooms/<room_id>`. Contributed by Noah Markert. ([\#19737](element-hq/synapse#19737)) # Synapse 1.152.1 (2026-05-07) # Synapse 1.152.0 (2026-04-28) ## Features - Add a ["Listing quarantined media changes" Admin API](https://element-hq.github.io/synapse/latest/admin_api/media_admin_api.html#listing-quarantined-media-changes) for retrieving a paginated record of when media became (un)quarantined. ([\#19558](element-hq/synapse#19558), [\#19677](element-hq/synapse#19677), [\#19694](element-hq/synapse#19694)) - Advertise [MSC4445](matrix-org/matrix-spec-proposals#4445) sync timeline order in `unstable_features`. ([\#19642](element-hq/synapse#19642)) - Report the Rust compiler version used in the Prometheus metrics. Contributed by Noah Markert. ([\#19643](element-hq/synapse#19643)) - Passthrough 'article' and 'profile' OpenGraph metadata on URL preview requests. ([\#19659](element-hq/synapse#19659)) - Add a way to re-sign local events with a new signing key. ([\#19668](element-hq/synapse#19668)) - Support [MSC4450: Identity Provider selection for User-Interactive Authentication with Legacy Single Sign-On](matrix-org/matrix-spec-proposals#4450). ([\#19693](element-hq/synapse#19693)) - Add experimental support for [MSC4242](matrix-org/matrix-spec-proposals#4242): State DAGs. Excludes federation support. ([\#19424](element-hq/synapse#19424)) - Adds [Admin API](https://element-hq.github.io/synapse/latest/usage/administration/admin_api/index.html) endpoints to list, fetch and delete user reports. ([\#19657](element-hq/synapse#19657)) - Reduce database disk space usage by pruning old rows from `device_lists_changes_in_room`. ([\#19473](element-hq/synapse#19473), [\#19709](element-hq/synapse#19709)) # Synapse 1.151.0 (2026-04-07) ## Features - Add stable support for [MSC4284](matrix-org/matrix-spec-proposals#4284) Policy Servers. ([\#19503](element-hq/synapse#19503)) - Update and stabilize support for [MSC2666](matrix-org/matrix-spec-proposals#2666): Get rooms in common with another user. Contributed by @tulir @ Beeper. ([\#19511](element-hq/synapse#19511)) - Updated experimental support for [MSC4388: Secure out-of-band channel for sign in with QR](matrix-org/matrix-spec-proposals#4388). ([\#19573](element-hq/synapse#19573)) - Stabilize `room_version` and `encryption` fields in the space/room `/hierarchy` API (part of [MSC3266](matrix-org/matrix-spec-proposals#3266)). ([\#19576](element-hq/synapse#19576)) - Introduce a [configuration option](https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#matrix_authentication_service) to allow using HTTP/2 over plaintext when Synapse connects to Matrix Authentication Service. ([\#19586](element-hq/synapse#19586)) ## Deprecations and Removals - Remove support for [MSC3852: Expose user agent information on Device](matrix-org/matrix-spec-proposals#3852) as the MSC was closed. ([\#19430](element-hq/synapse#19430)) # Synapse 1.150.0 (2026-03-24) ## Features - Add experimental support for the [MSC4370](matrix-org/matrix-spec-proposals#4370) Federation API `GET /extremities` endpoint. ([\#19314](element-hq/synapse#19314)) - [MSC4140: Cancellable delayed events](matrix-org/matrix-spec-proposals#4140): When persisting a delayed event to the timeline, include its `delay_id` in the event's `unsigned` section in `/sync` responses to the event sender. ([\#19479](element-hq/synapse#19479)) - Expose [MSC4354 Sticky Events](matrix-org/matrix-spec-proposals#4354) over the legacy (v3) /sync API. ([\#19487](element-hq/synapse#19487)) - When Matrix Authentication Service (MAS) integration is enabled, allow MAS to set the user locked status in Synapse. ([\#19554](element-hq/synapse#19554))

tulir added 4 commits February 27, 2026 23:36

Add custom validation for user_id query param

90e2b3a

Add count field to mutual rooms response

ba85c55

Stabilize mutual rooms endpoint

8ba36fb

Add changelog

105a544

tulir requested a review from a team as a code owner February 27, 2026 21:59

tulir added 2 commits February 28, 2026 00:00

Add tests to ensure user ID validation works

3ba989f

Also reject too long user IDs

773c406

tulir mentioned this pull request Feb 27, 2026

MSC2666: Get rooms in common with another user matrix-org/matrix-spec-proposals#2666

Merged

1vel reviewed Feb 27, 2026

View reviewed changes

Comment thread synapse/rest/client/mutual_rooms.py

reivilibre self-requested a review March 3, 2026 14:00

reivilibre requested changes Mar 3, 2026

View reviewed changes

tulir and others added 2 commits March 3, 2026 18:20

Update changelog.d/19511.feature

47c4a75

Co-authored-by: Olivier 'reivilibre' <olivier@librepush.net>

Remove unnecessary list()

fc8d8bb

erikjohnston reviewed Mar 3, 2026

View reviewed changes

tulir added 4 commits March 3, 2026 21:45

Merge remote-tracking branch 'upstream/develop' into tulir/mutual-roo…

2dd81ef

…ms-updates

Move is_compliant_user_id_localpart next to contains_invalid_mxid_cha…

5ff600c

…racters and add more docs

Catch SynapseError and ValueError instead of Exception

a3f96ab

Remove unstable support

c582d9a

tulir requested a review from reivilibre March 4, 2026 22:47

Fix path

e19779d

tulir marked this pull request as draft March 13, 2026 17:23

turt2live reviewed Mar 16, 2026

View reviewed changes

Comment thread synapse/rest/client/mutual_rooms.py Outdated

Merge remote-tracking branch 'upstream/develop' into tulir/mutual-roo…

3275cce

…ms-updates

tulir marked this pull request as ready for review March 16, 2026 18:46

reivilibre approved these changes Mar 18, 2026

View reviewed changes

reivilibre merged commit 8201e58 into element-hq:develop Mar 18, 2026
73 of 76 checks passed

		__repr__ = to_string


		def is_compliant_user_id_localpart(localpart: str) -> bool:

	if types.contains_invalid_mxid_characters(localpart):
	raise SynapseError(
	400,
	"User ID can only contain characters a-z, 0-9, or '=_-./+'",
	Codes.INVALID_USERNAME,
	)

	if not localpart:
	raise SynapseError(400, "User ID cannot be empty", Codes.INVALID_USERNAME)

	if (
	localpart[0] == "_"
	and not self.hs.config.registration.allow_underscore_prefixed_localpart
	):
	raise SynapseError(
	400, "User ID may not begin with _", Codes.INVALID_USERNAME
	)

Conversation

tulir commented Feb 27, 2026

Pull Request Checklist

Uh oh!

Uh oh!

reivilibre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tulir commented Mar 4, 2026

Uh oh!

tulir commented Mar 13, 2026

Uh oh!

Uh oh!

tulir commented Mar 16, 2026

Uh oh!

reivilibre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants