LotusGuild/cinny
3
0
Fork 0
Code Issues 40 Pull Requests 2 Actions 1 Packages Projects Releases Wiki Activity

Policy list viewer double-lists rules a bot publishes under both the stable and legacy types (de-dup keys on the raw recommendation) #321

New Issue
Closed
opened 2026-10-05 16:38:45 -04:00 by jared · 0 comments
jared commented 2026-10-05 16:38:45 -04:00
Owner
Copy Link
Copy Source

Room Settings → Policy Lists (src/app/features/room-settings/PolicyListViewer.tsx) reads m.policy.rule.* and the legacy org.matrix.mjolnir.rule.* types, and "merges/de-dupes" them. dedupePolicyEntries (line 92) keys on `${entry.entity} ${entry.recommendation}` using the raw recommendation. A stable rule says m.ban and its legacy twin says org.matrix.mjolnir.ban, so the keys never match. recommendationLabel() shows both as "Ban".

Measured: a list with m.policy.rule.user {entity: "@spammer:evil.example", recommendation: "m.ban"} and org.matrix.mjolnir.rule.user {entity: "@spammer:evil.example", recommendation: "org.matrix.mjolnir.ban"} shows Users (3) with @spammer:evil.example · Ban · spam waves twice (the third entry is a glob rule).

Fix: normalise before keying (org.matrix.mjolnir.ban → m.ban, the same mapping recommendationLabel uses), and add a unit case with one stable and one legacy rule for the same entity.

The rest of the viewer checked out:

  • a removed rule (empty content) is hidden;
  • @*:spam.example gets the "glob" badge;
  • the Rooms (1) and Servers (1) tabs work;
  • an HTML reason (<b>raid</b> origin) is shown as text.
  • It's admin-only (PL ≥ 50 or creator) and needs a room ID typed in. A picker for rooms the user is in, or for the space's linked policy rooms, would make it easier to find.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

Room Settings → Policy Lists (`src/app/features/room-settings/PolicyListViewer.tsx`) reads `m.policy.rule.*` **and** the legacy `org.matrix.mjolnir.rule.*` types, and "merges/de-dupes" them. `dedupePolicyEntries` (line 92) keys on `` `${entry.entity} ${entry.recommendation}` `` using the **raw** recommendation. A stable rule says `m.ban` and its legacy twin says `org.matrix.mjolnir.ban`, so the keys never match. `recommendationLabel()` shows both as "Ban". **Measured:** a list with `m.policy.rule.user` `{entity: "@spammer:evil.example", recommendation: "m.ban"}` and `org.matrix.mjolnir.rule.user` `{entity: "@spammer:evil.example", recommendation: "org.matrix.mjolnir.ban"}` shows **Users (3)** with `@spammer:evil.example · Ban · spam waves` **twice** (the third entry is a glob rule). **Fix:** normalise before keying (`org.matrix.mjolnir.ban` → `m.ban`, the same mapping `recommendationLabel` uses), and add a unit case with one stable and one legacy rule for the same entity. The rest of the viewer checked out: - a removed rule (empty content) is hidden; - `@*:spam.example` gets the "glob" badge; - the Rooms (1) and Servers (1) tabs work; - an HTML reason (`<b>raid</b> origin`) is shown as text. - It's admin-only (PL ≥ 50 or creator) and needs a room ID typed in. A picker for rooms the user is in, or for the space's linked policy rooms, would make it easier to find. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the bugpriority: lowarea: moderation labels 2026-10-05 16:38:45 -04:00
jared closed this issue 2026-10-18 02:05:13 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: moderation bug priority: low
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#321