MSC4452: Preview URL capabilities API

[Half-Shot]

Rendered

Signed-off-by: Will Hunt signoff@half-shot.uk

---

SCT Stuff:

MSC checklist

FCP tickyboxes

[turt2live]

Implementation requirements:

• Server (capability)
• Client (respecting capability)
• Client (unaware of capability)

[Half-Shot]

• Capability MSC4452: Preview URL capability element-hq/synapse#19715
• Element Web (aware) -> Disable URL Preview setting if disabled on the homeserver element-hq/element-web#33279
• Element Web (unaware) ->
  • When the capability is OFF, an unaware version of Element Web continues to work. It doesn't show the user any errors, and the setting can be toggled in settings.
  • When the capability is ON, the /preview_url experience is identical to the spec. The extra capability didn't cause any issues.

[Half-Shot]

Both the client and server changes have now merged!

[clokep]

MSCs proposed for Final Comment Period (FCP) should meet the requirements outlined in the checklist prior to being accepted into the spec. This checklist is a bit long, but aims to reduce the number of follow-on MSCs after a feature lands.

Spec Core Team (SCT) members, please ensure that all of the following checks
pass before accepting a given Matrix Spec Change (MSC).

MSC authors, feel free to ask in a thread on your PR or in the
#matrix-spec:matrix.org room for
clarification of any of these points.

• Are appropriate implementation(s) specified in the MSC’s PR description?
• Are all MSCs that this MSC depends on already accepted?
• For each endpoint that is introduced or modified:
  • Have authentication requirements been specified?
  • Have rate-limiting requirements been specified?
  • Have guest access requirements been specified?
  • Are error responses specified?
    • Does each error case have a specified errcode (e.g. M_FORBIDDEN) and HTTP status code?
      • If a new errcode is introduced, is it clear that it is new?
  • Are the endpoint conventions honoured?
    • Do HTTP endpoints use_underscores_like_this?
    • Will the endpoint return unbounded data? If so, has pagination been considered?
    • If the endpoint utilises pagination, is it consistent with the appendices?
• Will the MSC require a new room version, and if so, has that been made clear?
  • Is the reason for a new room version clearly stated? For example, modifying the set of redacted fields changes how event IDs are calculated, thus requiring a new room version.
• Are backwards-compatibility concerns appropriately addressed?
• An introduction exists and clearly outlines the problem being solved. Ideally, the first paragraph should be understandable by a non-technical audience.
• All outstanding threads are resolved
  • All feedback is incorporated into the proposal text itself, either as a fix or noted as an alternative
• There is a dedicated "Security Considerations" section which detail any possible attacks/vulnerabilities this proposal may introduce, even if this is "None.". See RFC3552 for things to think about, but in particular pay attention to the OWASP Top Ten.
• The other section headings in the template are optional, but even if they are omitted, the relevant details should still be considered somewhere in the text of the proposal. Those section headings are:
  • Introduction
  • Proposal text
  • Potential issues
  • Alternatives
  • Unstable prefix
  • Dependencies
• Stable identifiers are used throughout the proposal, except for the unstable prefix section
  • Unstable prefixes consider the awkward accepted-but-not-merged state
  • Chosen unstable prefixes do not pollute any global namespace (use “org.matrix.mscXXXX”, not “org.matrix”).
• Changes have applicable Sign Off from all authors/editors/contributors

[clokep]

@mscbot fcp merge

[mscbot]

Team member @mscbot has proposed to merge this. The next step is review by the rest of the tagged people:

• @clokep
• @dbkr
• @uhoreg
• @turt2live
• @ara4n
• @anoadragon453
• @richvdh
• @tulir
• @erikjohnston
• @KitsuneRal

Concerns:

• Lacking implementation - see implementation requirements

Once at least 75% of reviewers approve (and there are no outstanding concerns), this will enter its final comment period. If you spot a major issue that hasn't been raised at any point in this process, please speak up!

See this document for information about what commands tagged team members can give me.

[turt2live]

@mscbot concern Lacking implementation - see implementation requirements

[clokep]

I checked the implementations last night and they seemed good. I've checked the related boxes. The checklist is now complete.

@mscbot resolve Lacking implementation - see implementation requirements