Repository: matrix-org/synapse

Issue:
Declare support for Matrix 1.6
See https://matrix.org/blog/2023/02/14/matrix-v-1-6-release

## Client-Server API

* [x] Add information on standard error responses for unknown endpoints/methods, as per [MSC3743](https://github.com/matrix-org/matrix-spec-proposals/pull/3743).
	* See #14209 and #14599
* [x] Add /rooms/<roomID>/timestamp_to_event endpoint, as per [MSC3030](https://github.com/matrix-org/matrix-spec-proposals/pull/3030).
	* See #14471
* [x] Define hkdf-hmac-sha256.v2 MAC method for SAS verification, as per [MSC3783](https://github.com/matrix-org/matrix-spec-proposals/pull/3783).

## Server-Server API

* [ ] Remove keyId from the server /keys endpoints, as per [MSC3938](https://github.com/matrix-org/matrix-spec-proposals/pull/3938).

## Application Service API

* [x] Add information on standard error responses for unknown endpoints/methods, as per [MSC3743](https://github.com/matrix-org/matrix-spec-proposals/pull/3743).
	* We would only care about this for calling out to AS, but I don't think we call any potentially unknown endpoints so maybe nothing to do? Could future proof by using the same code we do for federation though.

## Identity Service API

* [ ] Add information on standard error responses for unknown endpoints/methods, as per [MSC3743](https://github.com/matrix-org/matrix-spec-proposals/pull/3743).
	* We would only care about this for calling out to IS, but I don't think we call any potentially unknown endpoints so maybe nothing to do? Could future proof by using the same code we do for federation though.

## Push Gateway API

* [ ] Add information on standard error responses for unknown endpoints/methods, as per [MSC3743](https://github.com/matrix-org/matrix-spec-proposals/pull/3743).
	* We would only care about this for calling out to PG, but I don't think we call any potentially unknown endpoints so maybe nothing to do? Could future proof by using the same code we do for federation though.

## Room Versions

* [x] Update the default room version to 10, as per [MSC3904](https://github.com/matrix-org/matrix-spec-proposals/pull/3904).
    * See #14111


Discussion:
I've attempted to add some notes about what I think is done, but likely could use double checking. See #14486 for a previous iteration.
> Define `hkdf-hmac-sha256.v2` MAC method for SAS verification

The legacy. method (`hkdf-hmac-sha256`) doesn't appear in the Synapse repo at all, so I'm going to assume there's nothing to do here.
> ## Application Service API / Identity Service API / Push Gateway API
>
> * Add information on standard error responses for unknown endpoints/methods

#15317 ended up using this for appservices, will need to split this into three tasks. I think.
> Remove keyId from the server /keys endpoints, as per MSC3938.

Up until #14525, which landed in v1.74.0rc1, Synapse sent the key ID when requesting keys. MSC3938 notes that this is a breaking change. Making it such that the key ID / trailing slash is invalid means that Synapse < 1.74.0 will be unable to request keys from Synapse >= 1.xx (whenever this lands). This seems pretty awful, @richvdh did you have any thoughts on how we were hoping to roll this out? I'm not getting a good feel of how much this would break if we just did it now.
Yeah, it's probably premature to rip out support.

I think my intention here was that servers that support *only* spec v1.6 do not need to allow the trailing slash (and of course, they should not include the trailing slash, or the key ID, in outgoing requests), but servers that want to maintain support for earlier versions of the spec still need to permit it.

My suggestion would be to continue to permit key ID or trailing slash, but log a warning. Strictly speaking that makes Synapse non-spec-compliant for v1.6, but I think it's the best we can do for now.
> My suggestion would be to continue to permit key ID or trailing slash, but log a warning. Strictly speaking that makes Synapse non-spec-compliant for v1.6, but I think it's the best we can do for now.

That seems reasonable. Looking back, we maybe should have revved the endpoint version. 🤷 

Resolving patch:
diff --git a/synapse/rest/client/versions.py b/synapse/rest/client/versions.py
--- a/synapse/rest/client/versions.py
+++ b/synapse/rest/client/versions.py
@@ -79,6 +79,7 @@ def on_GET(self, request: Request) -> Tuple[int, JsonDict]:
                     "v1.3",
                     "v1.4",
                     "v1.5",
+                    "v1.6",
                 ],
                 # as per MSC1497:
                 "unstable_features": {
diff --git a/synapse/rest/key/v2/local_key_resource.py b/synapse/rest/key/v2/local_key_resource.py
--- a/synapse/rest/key/v2/local_key_resource.py
+++ b/synapse/rest/key/v2/local_key_resource.py
@@ -34,6 +34,8 @@ class LocalKey(RestServlet):
     """HTTP resource containing encoding the TLS X.509 certificate and NACL
     signature verification keys for this server::
 
+        GET /_matrix/key/v2/server HTTP/1.1
+
         GET /_matrix/key/v2/server/a.key.id HTTP/1.1
 
         HTTP/1.1 200 OK
@@ -100,6 +102,15 @@ def response_json_object(self) -> JsonDict:
     def on_GET(
         self, request: Request, key_id: Optional[str] = None
     ) -> Tuple[int, JsonDict]:
+        # Matrix 1.6 drops support for passing the key_id, this is incompatible
+        # with earlier versions and is allowed in order to support both.
+        # A warning is issued to help determine when it is safe to drop this.
+        if key_id:
+            logger.warning(
+                "Request for local server key with deprecated key ID (logging to determine usage level for future removal): %s",
+                key_id,
+            )
+
         time_now = self.clock.time_msec()
         # Update the expiry time if less than half the interval remains.
         if time_now + self.config.key.key_refresh_interval / 2 > self.valid_until_ts:
diff --git a/synapse/rest/key/v2/remote_key_resource.py b/synapse/rest/key/v2/remote_key_resource.py
--- a/synapse/rest/key/v2/remote_key_resource.py
+++ b/synapse/rest/key/v2/remote_key_resource.py
@@ -126,6 +126,15 @@ async def on_GET(
         self, request: Request, server: str, key_id: Optional[str] = None
     ) -> Tuple[int, JsonDict]:
         if server and key_id:
+            # Matrix 1.6 drops support for passing the key_id, this is incompatible
+            # with earlier versions and is allowed in order to support both.
+            # A warning is issued to help determine when it is safe to drop this.
+            logger.warning(
+                "Request for remote server key with deprecated key ID (logging to determine usage level for future removal): %s / %s",
+                server,
+                key_id,
+            )
+
             minimum_valid_until_ts = parse_integer(request, "minimum_valid_until_ts")
             arguments = {}
             if minimum_valid_until_ts is not None:
@@ -161,7 +170,7 @@ async def query_keys(
 
         time_now_ms = self.clock.time_msec()
 
-        # Map server_name->key_id->int. Note that the value of the init is unused.
+        # Map server_name->key_id->int. Note that the value of the int is unused.
         # XXX: why don't we just use a set?
         cache_misses: Dict[str, Dict[str, int]] = {}
         for (server_name, key_id, _), key_results in cached.items():


Test patch: