getRoomPolicyEvents only queries the stable m.policy.rule.user/.room/.server state event types. Many real-world Draupnir/Mjolnir ban lists (referenced explicitly in this feature's own description as "Draupnir compatible") still emit the legacy, unstable-prefixed types org.matrix.mjolnir.rule.user/.room/.server for backwards compatibility — the same file's own recommendationLabel() helper explicitly acknowledges the legacy org.matrix.mjolnir.banrecommendation value exists, but the code never queries the corresponding legacy event types. For any policy room still using legacy state event types, this viewer reports "No user/room/server ban rules found" even though the list is fully populated, which is misleading in a moderation-safety context — a moderator could conclude a ban list room is inactive/empty when it is actually enforcing rules via the bot, just not visible in this read-only viewer.
How to trigger
Point the viewer at a real Draupnir/Mjolnir policy list room that still writes legacy org.matrix.mjolnir.rule.* state events (common for lists that predate MSC stabilization or haven't been migrated) — all three tabs show 0 entries.
Suggested fix
Also query org.matrix.mjolnir.rule.user/.room/.server and merge/dedupe with the stable-type results before rendering.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** high · **Type:** bug · **Confidence:** high
**Location:** `src/app/features/room-settings/PolicyListViewer.tsx:23-25, 59-63, 204-206`
### Problem
`getRoomPolicyEvents` only queries the stable `m.policy.rule.user`/`.room`/`.server` state event *types*. Many real-world Draupnir/Mjolnir ban lists (referenced explicitly in this feature's own description as "Draupnir compatible") still emit the legacy, unstable-prefixed types `org.matrix.mjolnir.rule.user`/`.room`/`.server` for backwards compatibility — the same file's own `recommendationLabel()` helper explicitly acknowledges the legacy `org.matrix.mjolnir.ban` *recommendation* value exists, but the code never queries the corresponding legacy *event types*. For any policy room still using legacy state event types, this viewer reports "No user/room/server ban rules found" even though the list is fully populated, which is misleading in a moderation-safety context — a moderator could conclude a ban list room is inactive/empty when it is actually enforcing rules via the bot, just not visible in this read-only viewer.
### How to trigger
Point the viewer at a real Draupnir/Mjolnir policy list room that still writes legacy `org.matrix.mjolnir.rule.*` state events (common for lists that predate MSC stabilization or haven't been migrated) — all three tabs show 0 entries.
### Suggested fix
Also query `org.matrix.mjolnir.rule.user`/`.room`/`.server` and merge/dedupe with the stable-type results before rendering.
---
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · High milestone 2026-09-12 01:50:55 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: high · Type: bug · Confidence: high
Location:
src/app/features/room-settings/PolicyListViewer.tsx:23-25, 59-63, 204-206Problem
getRoomPolicyEventsonly queries the stablem.policy.rule.user/.room/.serverstate event types. Many real-world Draupnir/Mjolnir ban lists (referenced explicitly in this feature's own description as "Draupnir compatible") still emit the legacy, unstable-prefixed typesorg.matrix.mjolnir.rule.user/.room/.serverfor backwards compatibility — the same file's ownrecommendationLabel()helper explicitly acknowledges the legacyorg.matrix.mjolnir.banrecommendation value exists, but the code never queries the corresponding legacy event types. For any policy room still using legacy state event types, this viewer reports "No user/room/server ban rules found" even though the list is fully populated, which is misleading in a moderation-safety context — a moderator could conclude a ban list room is inactive/empty when it is actually enforcing rules via the bot, just not visible in this read-only viewer.How to trigger
Point the viewer at a real Draupnir/Mjolnir policy list room that still writes legacy
org.matrix.mjolnir.rule.*state events (common for lists that predate MSC stabilization or haven't been migrated) — all three tabs show 0 entries.Suggested fix
Also query
org.matrix.mjolnir.rule.user/.room/.serverand merge/dedupe with the stable-type results before rendering.Filed from the September 2026 client audit (branch
lotus@4bea4895).