`TestRoomDeleteAlias` tests optional behaviour but fails if it is not performed

[timedoutuk]

complement/tests/csapi/apidoc_room_alias_test.go

Lines 277 to 308 in 1a2baac

	// sytest: Can delete canonical alias
	t.Run("Can delete canonical alias", func(t *testing.T) {
	t.Parallel()
	roomID := alice.MustCreateRoom(t, map[string]interface{}{})
	roomAlias := "#random_alias:hs1"
	res := setRoomAliasResp(t, alice, roomID, roomAlias)
	must.MatchResponse(t, res, match.HTTPResponse{
	StatusCode: 200,
	})
	mustSetCanonicalAlias(t, alice, roomID, roomAlias, nil)
	_, sinceToken := alice.MustSync(t, client.SyncReq{TimeoutMillis: "0"})
	res = deleteRoomAliasResp(t, alice, roomAlias)
	must.MatchResponse(t, res, match.HTTPResponse{
	StatusCode: 200,
	})
	alice.MustSyncUntil(t, client.SyncReq{Since: sinceToken}, client.SyncTimelineHas(roomID, func(ev gjson.Result) bool {
	if ev.Get("type").Str == "m.room.canonical_alias" &&
	ev.Get("content").IsObject() &&
	len(ev.Get("content").Map()) == 0 {
	return true
	}
	return false
	}))
	})

The test Can delete canonical alias requires that servers update the m.room.canonical_alias event when an associated alias is deleted via DELETE /_matrix/client/v3/directory/room/{roomAlias}, but this behaviour is optional, and not even a SHOULD in the spec:

Note: Servers may choose to update the alt_aliases for the m.room.canonical_alias state event in the room when an alias is removed. Servers which choose to update the canonical alias event are recommended to, in addition to their other relevant permission checks, delete the alias and return a successful response even if the user does not have permission to update the m.room.canonical_alias event.

This means the test will fail on any server that does not choose to implement this behaviour. The test should simply pass or at least be skipped if the canonical alias event update does not come down sync.

[timedoutuk]

It looks like there's another test, Users can't delete other's aliases, which exclusively tests and fails another optional behaviour:

complement/tests/csapi/apidoc_room_alias_test.go

Lines 384 to 415 in 1a2baac

	// sytest: Users can't delete other's aliases
	t.Run("Users can't delete other's aliases", func(t *testing.T) {
	t.Parallel()
	roomID := alice.MustCreateRoom(t, map[string]interface{}{})
	randomAlias := "#random_alias_4:hs1"
	alice.MustInviteRoom(t, roomID, bob.UserID)
	bob.MustJoinRoom(t, roomID, nil)
	res := setRoomAliasResp(t, alice, roomID, randomAlias)
	must.MatchResponse(t, res, match.HTTPResponse{
	StatusCode: 200,
	})
	res = getRoomAliasResp(t, bob, randomAlias)
	must.MatchResponse(t, res, match.HTTPResponse{
	StatusCode: 200,
	JSON: []match.JSON{
	match.JSONKeyEqual("room_id", roomID),
	},
	})
	res = deleteRoomAliasResp(t, bob, randomAlias)
	must.MatchResponse(t, res, match.HTTPResponse{
	StatusCode: 403,
	JSON: []match.JSON{
	match.JSONKeyEqual("errcode", "M_FORBIDDEN"),
	},
	})
	})

Servers may choose to implement additional access control checks here, for instance that room aliases can only be deleted by their creator or a server administrator.

Users with sufficient power-level can delete other's aliases may be an extension of this but will pass on servers that don't implement the optional ownership restriction.