test

Author: FrenchGithubUser

synapse/storage/databases/main/registration.py

@@ -2589,7 +2589,6 @@ def user_delete_access_tokens_for_devices_txn(
             """
             txn.execute(sql, args)
             tokens_and_devices = txn.fetchall()
-
             self._invalidate_cache_and_stream_bulk(
                 txn,
                 self.get_user_by_access_token,
@@ -2605,7 +2604,10 @@ def user_delete_access_tokens_for_devices_txn(
                 batch_device_ids,
             )
             results.extend(tokens_and_devices)
-
+            # Print after transaction completes (cache invalidation has happened)
+            if tokens_and_devices:
+                print(tokens_and_devices)
+                print(self.get_user_by_access_token(tokens_and_devices[0][0]))
         return results
 
     async def delete_access_token(self, access_token: str) -> None:

tests/rest/client/test_read_marker.py

@@ -18,16 +18,20 @@
 # [This file includes modifications made by New Vector Limited]
 #
 #
+from typing import Any
+
 from twisted.internet.testing import MemoryReactor
 
 import synapse.rest.admin
 from synapse.api.constants import EventTypes
 from synapse.rest import admin
-from synapse.rest.client import login, read_marker, register, room
+from synapse.rest.client import devices, login, read_marker, register, room
 from synapse.server import HomeServer
 from synapse.util.clock import Clock
 
 from tests import unittest
+from tests.replication._base import BaseMultiWorkerStreamTestCase
+from tests.rest.client.utils import make_request
 
 ONE_HOUR_MS = 3600000
 ONE_DAY_MS = ONE_HOUR_MS * 24
@@ -39,6 +43,7 @@ class ReadMarkerTestCase(unittest.HomeserverTestCase):
         register.register_servlets,
         read_marker.register_servlets,
         room.register_servlets,
+        devices.register_servlets,
         synapse.rest.admin.register_servlets,
         admin.register_servlets,
     ]
@@ -149,3 +154,75 @@ def send_message() -> str:
             access_token=self.owner_tok,
         )
         self.assertEqual(channel.code, 200, channel.result)
+
+    def test_deleted_device_cannot_set_read_marker_or_send_message(self) -> None:
+        """
+        Test that a deleted device cannot set a read marker or send a message.
+        """
+        # Register a user and login with a specific device_id
+        user_id = self.register_user("testuser", "password")
+        device_id = "TEST_DEVICE_123"
+        access_token = self.login("testuser", "password", device_id=device_id)
+        print("access token: ", access_token)
+
+        # Create a room
+        room_id = self.helper.create_room_as(user_id, tok=access_token)
+
+        # Send a message
+        message_result = self.helper.send(room_id=room_id, body="Hello", tok=access_token)
+        event_id = message_result["event_id"]
+
+        # Delete the device
+        channel = self.make_request(
+            "DELETE",
+            f"devices/{device_id}",
+            access_token=access_token,
+        )
+        
+        # If UI auth is required, provide it
+        if channel.code == 401:
+            session = channel.json_body["session"]
+            channel = self.make_request(
+                "DELETE",
+                f"devices/{device_id}",
+                access_token=access_token,
+                content={
+                    "auth": {
+                        "type": "m.login.password",
+                        "user": "testuser",
+                        "password": "password",
+                        "session": session,
+                    },
+                },
+            )
+        
+        self.assertEqual(channel.code, 200, channel.result)
+
+        # Try to set a read marker with the deleted device's token
+        channel = self.make_request(
+            "POST",
+            f"/rooms/{room_id}/read_markers",
+            content={
+                "m.fully_read": event_id,
+            },
+            access_token=access_token,
+        )
+        # Should fail with 401 (unauthorized) since the device is deleted
+        self.assertEqual(channel.code, 401, channel.result)
+        self.assertEqual(channel.json_body["errcode"], "M_UNKNOWN_TOKEN")
+
+        # Try to send a message with the deleted device's token
+        channel = self.make_request(
+            "PUT",
+            f"/rooms/{room_id}/send/m.room.message/test_msg",
+            content={
+                "msgtype": "m.text",
+                "body": "This should fail",
+            },
+            access_token=access_token,
+        )
+        # Should fail with 401 (unauthorized) since the device is deleted
+        self.assertEqual(channel.code, 401, channel.result)
+        self.assertEqual(channel.json_body["errcode"], "M_UNKNOWN_TOKEN")
+
+