LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Policy List Viewer misses legacy Draupnir/Mjolnir policy event types, showing false "no rules found" #22

New Issue
Closed
opened 2026-09-12 01:50:55 -04:00 by jared · 0 comments
jared commented 2026-09-12 01:50:55 -04:00
Owner
Copy Link
Copy Source

Severity: high · Type: bug · Confidence: high

Location: src/app/features/room-settings/PolicyListViewer.tsx:23-25, 59-63, 204-206

Problem

getRoomPolicyEvents only queries the stable m.policy.rule.user/.room/.server state event types. Many real-world Draupnir/Mjolnir ban lists (referenced explicitly in this feature's own description as "Draupnir compatible") still emit the legacy, unstable-prefixed types org.matrix.mjolnir.rule.user/.room/.server for backwards compatibility — the same file's own recommendationLabel() helper explicitly acknowledges the legacy org.matrix.mjolnir.ban recommendation value exists, but the code never queries the corresponding legacy event types. For any policy room still using legacy state event types, this viewer reports "No user/room/server ban rules found" even though the list is fully populated, which is misleading in a moderation-safety context — a moderator could conclude a ban list room is inactive/empty when it is actually enforcing rules via the bot, just not visible in this read-only viewer.

How to trigger

Point the viewer at a real Draupnir/Mjolnir policy list room that still writes legacy org.matrix.mjolnir.rule.* state events (common for lists that predate MSC stabilization or haven't been migrated) — all three tabs show 0 entries.

Suggested fix

Also query org.matrix.mjolnir.rule.user/.room/.server and merge/dedupe with the stable-type results before rendering.

Filed from the September 2026 client audit (branch lotus @ 4bea4895).

**Severity:** high · **Type:** bug · **Confidence:** high **Location:** `src/app/features/room-settings/PolicyListViewer.tsx:23-25, 59-63, 204-206` ### Problem `getRoomPolicyEvents` only queries the stable `m.policy.rule.user`/`.room`/`.server` state event *types*. Many real-world Draupnir/Mjolnir ban lists (referenced explicitly in this feature's own description as "Draupnir compatible") still emit the legacy, unstable-prefixed types `org.matrix.mjolnir.rule.user`/`.room`/`.server` for backwards compatibility — the same file's own `recommendationLabel()` helper explicitly acknowledges the legacy `org.matrix.mjolnir.ban` *recommendation* value exists, but the code never queries the corresponding legacy *event types*. For any policy room still using legacy state event types, this viewer reports "No user/room/server ban rules found" even though the list is fully populated, which is misleading in a moderation-safety context — a moderator could conclude a ban list room is inactive/empty when it is actually enforcing rules via the bot, just not visible in this read-only viewer. ### How to trigger Point the viewer at a real Draupnir/Mjolnir policy list room that still writes legacy `org.matrix.mjolnir.rule.*` state events (common for lists that predate MSC stabilization or haven't been migrated) — all three tabs show 0 entries. ### Suggested fix Also query `org.matrix.mjolnir.rule.user`/`.room`/`.server` and merge/dedupe with the stable-type results before rendering. --- --- _Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared added this to the Audit 2026-09 · High milestone 2026-09-12 01:50:55 -04:00
jared added the bugpriority: higharea: moderation labels 2026-09-12 01:50:55 -04:00
jared self-assigned this 2026-09-12 01:50:55 -04:00
jared closed this issue 2026-09-12 14:59:49 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: moderation bug priority: high
Milestone
No items
No Milestone Audit 2026-09 · High
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees jared
1 Participants
Notifications
Due Date
2026-10-14
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#22