Skip to content

Open the invite's room after registering - #6025

Open
devonh wants to merge 6 commits into
devonh/invite-registrationsfrom
devonh/open-room
Open

Open the invite's room after registering#6025
devonh wants to merge 6 commits into
devonh/invite-registrationsfrom
devonh/open-room

Conversation

@devonh

@devonh devonh commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Part of https://github.com/element-hq/backend-internal/issues/292

Reviewable commit by commit.

Adds a post-auth action that sends the user to a room in Element Web once they have signed in or registered. It's the first piece of guest invites by email. The guest invite link will carry the room, and the invitee will land on it after signing up.

room_invites:
  client_room_url: https://chat.example.com/#/room/{room_id}

Nothing builds an OpenRoom link yet. That happens in the follow on PR #6026
This just lays the groundwork for handling room redirects for guest registration.

Later commits rework this to:

  • use room_invites terminology everywhere and not mention guests
  • Add the room_id to the registration token itself
    • this deliberately doesn't add the post-auth action to the token since that seems messy right now, and would require more careful handling across the board to validate what post auth actions are allowed where
    • a room_id is straightforward data on the token
  • renames the action to ContinueRoomInvite to match the existing MAS actions better

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying matrix-authentication-service-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: f231f48
Status: ✅  Deploy successful!
Preview URL: https://8f96670b.matrix-authentication-service-docs.pages.dev
Branch Preview URL: https://devonh-open-room.matrix-authentication-service-docs.pages.dev

View logs

@devonh devonh changed the title Devonh/open room Add an OpenRoom post-auth action Oct 5, 2026
@devonh
devonh added this pull request to stack #6027 October 5, 2026 20:48
devonh
devonh commented Oct 11, 2026
View reviewed changes
Comment thread crates/cli/src/commands/templates.rs
@@ -1,3 +1,4 @@
// Copyright 2025, 2026 Element Creations Ltd.

@devonh devonh Oct 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should 2025 be here?

devonh
devonh commented Oct 11, 2026
View reviewed changes
Comment thread crates/cli/src/commands/worker.rs
@@ -1,3 +1,4 @@
// Copyright 2025, 2026 Element Creations Ltd.

@devonh devonh Oct 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should 2025 be here?

devonh
devonh commented Oct 11, 2026
View reviewed changes
Comment thread crates/config/src/sections/mod.rs
@@ -1,3 +1,4 @@
// Copyright 2025, 2026 Element Creations Ltd.

@devonh devonh Oct 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should 2025 be here?

devonh
devonh commented Oct 11, 2026
View reviewed changes
Comment thread crates/data-model/src/site_config.rs
@@ -1,3 +1,4 @@
// Copyright 2025, 2026 Element Creations Ltd.

@devonh devonh Oct 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should 2025 be here?

devonh
devonh commented Oct 11, 2026
View reviewed changes
Comment thread crates/handlers/src/views/mod.rs
@@ -1,3 +1,4 @@
// Copyright 2025, 2026 Element Creations Ltd.

@devonh devonh Oct 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should 2025 be here?

devonh
devonh commented Oct 11, 2026
View reviewed changes
Comment thread crates/handlers/src/views/shared.rs
@@ -1,3 +1,4 @@
// Copyright 2025, 2026 Element Creations Ltd.

@devonh devonh Oct 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should 2025 be here?

@devonh
devonh marked this pull request as ready for review October 11, 2026 03:50
@devonh
devonh requested a review from a team as a code owner October 11, 2026 03:50
@devonh
devonh requested review from sandhose and removed request for a team October 11, 2026 03:50
@sandhose
sandhose removed this pull request from stack #6027 October 13, 2026 09:32
@sandhose
sandhose added this pull request to stack #6046 October 13, 2026 09:32
@sandhose
sandhose removed this pull request from stack #6046 October 13, 2026 12:02
@sandhose
sandhose added this pull request to stack #6047 October 13, 2026 12:02
@devonh
devonh removed this pull request from stack #6047 October 14, 2026 22:01
@devonh
devonh added this pull request to stack #6052 October 14, 2026 22:01
@devonh devonh changed the title Add an OpenRoom post-auth action Open the invite's room after registering Oct 14, 2026
devonh and others added 6 commits October 16, 2026 14:58
@devonh @claude @sandhose
Add a guest_invites config section
50b818b 
Holds the settings for inviting guests to rooms by email, starting with
the client URL invitees are sent to once they are signed in. The value
goes on `SiteConfig`, which the admin handlers and the views already
take.

`client_room_url` is a string rather than a URL, because parsing it as
one would percent-encode the braces of a `{room_id}` placeholder in its
path, which would then never be replaced. Whenever it is set, it must
contain `{room_id}` and still parse as an absolute `http` or `https` URL
with a host once the placeholder is filled in, so that `/open-room`
never redirects relative to MAS.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devonh @claude @sandhose
Add an OpenRoom post-auth action
234c0bc 
Guest invite links need to land the invitee on the room in their client
once they have registered or signed in. Post-auth actions can only name
MAS's own routes, because `go_next` has no access to config, so
`OpenRoom` goes to a new `GET /open-room`, which redirects to the
configured `client_room_url` with the room ID in it.

The action carries a room ID and never a URL: actions come from query
strings, so a URL in one would be an open redirect. The room ID is
percent-encoded with `urlencoding` rather than as a form value, because
clients decode the fragment with `decodeURIComponent`, which doesn't
turn `+` back into a space.

Without a client URL, or without a room ID that `ruma` parses and that
has no control or bidirectional characters, it goes where a missing
post-auth action goes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devonh @claude @sandhose
Rename the guest_invites config section to room_invites
46b97d9 
The section only says where to send someone invited to a room, so it is
named after room invites. Nothing is released yet, so no alias for the
old key is kept.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RkxQWj8RAKd7iZ1JQtXdxm
@devonh @claude @sandhose
Store the room an invite opens on its registration token
427f639 
A token can now name a room, so that the links built from it can find
the room without carrying it in their URLs. The column is nullable and
nothing sets it yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RkxQWj8RAKd7iZ1JQtXdxm
@devonh @claude @sandhose
Name the invite's token, not its room, in the post-auth action
4c5f171 
`ContinueRoomInvite { id }` replaces `OpenRoom { room_id }`, so no MAS
URL carries a room ID, and none can be edited to name another room. Its
`go_next` goes to `GET /open-room/{id}`, which reads the room from the
registration token and redirects to the configured client.

The lookup ignores the token's validity: a used, expired or revoked
token can no longer register anyone, but still names the room its
invite was for. That is what lets an invite link opened again, or a
second invite link for the same address, reach its room.

The route trusts the room on the token, leaving the check to whatever
sets it, so `room_id.rs` goes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RkxQWj8RAKd7iZ1JQtXdxm
@devonh @claude @sandhose
Open the invite's room from its token when registering
f231f48 
The registration page takes its post-auth action from the query if it
has one, and otherwise opens the room of the registration token it was
given. That covers a browser already signed in, which goes straight to
the room; the page's Sign in link and provider buttons; and the
registration itself, which stores the action so that every later step
follows it, including the email-in-use page's Start over.

The token is looked up whatever its validity, before the signed-in
redirect: a used token still names its room, which is how an invite
link opened again after registering, or a second invite for the same
address, reaches its room. Only registering needs a valid token. The
page of an invalid invite doesn't submit its token, so a submission
without one takes it from the page's URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RkxQWj8RAKd7iZ1JQtXdxm
@devonh devonh mentioned this pull request Oct 16, 2026
Draft

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sandhose sandhose Awaiting requested review from sandhose sandhose is a code owner automatically assigned from element-hq/mas-maintainers

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@devonh