inviteUrl is built with getMatrixToRoom(room.roomId, domain ? [domain] : undefined), i.e. it always uses only the current user's own homeserver domain (mx.getDomain()) as the sole via parameter. The codebase already has a purpose-built helper, getViaServers(room) (src/app/plugins/via-servers.ts), that computes a resilient via-server list (room creator's / highest-power user's server plus the top-populated member servers) — and this helper is correctly used elsewhere for the exact same kind of link (src/app/features/add-existing/AddExisting.tsx:137-149 uses it for m.space.childvia). By not reusing it, the invite link/QR code this feature generates degrades badly if the sharer's own homeserver is small, later goes offline, or the sharer's account is deactivated/leaves — recipients resolving the matrix.to link may fail to find the room even though it's alive and well-populated on other servers that getViaServers would have included.
How to trigger
Share a room invite link/QR from an account on a small or later-decommissioned homeserver for a room that is mostly populated on other servers; the link's only routing hint points at a server that may not have (or may lose) the room.
Suggested fix
Reuse getViaServers(room) instead of [mx.getDomain()] when building inviteUrl in RoomShareInvite.tsx.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** medium · **Type:** bug · **Confidence:** high
**Location:** `src/app/features/common-settings/general/RoomShareInvite.tsx:39-40`
### Problem
`inviteUrl` is built with `getMatrixToRoom(room.roomId, domain ? [domain] : undefined)`, i.e. it always uses only the current user's own homeserver domain (`mx.getDomain()`) as the sole `via` parameter. The codebase already has a purpose-built helper, `getViaServers(room)` (`src/app/plugins/via-servers.ts`), that computes a resilient via-server list (room creator's / highest-power user's server plus the top-populated member servers) — and this helper is correctly used elsewhere for the exact same kind of link (`src/app/features/add-existing/AddExisting.tsx:137-149` uses it for `m.space.child` `via`). By not reusing it, the invite link/QR code this feature generates degrades badly if the sharer's own homeserver is small, later goes offline, or the sharer's account is deactivated/leaves — recipients resolving the `matrix.to` link may fail to find the room even though it's alive and well-populated on other servers that `getViaServers` would have included.
### How to trigger
Share a room invite link/QR from an account on a small or later-decommissioned homeserver for a room that is mostly populated on other servers; the link's only routing hint points at a server that may not have (or may lose) the room.
### Suggested fix
Reuse `getViaServers(room)` instead of `[mx.getDomain()]` when building `inviteUrl` in `RoomShareInvite.tsx`.
---
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:14 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: medium · Type: bug · Confidence: high
Location:
src/app/features/common-settings/general/RoomShareInvite.tsx:39-40Problem
inviteUrlis built withgetMatrixToRoom(room.roomId, domain ? [domain] : undefined), i.e. it always uses only the current user's own homeserver domain (mx.getDomain()) as the soleviaparameter. The codebase already has a purpose-built helper,getViaServers(room)(src/app/plugins/via-servers.ts), that computes a resilient via-server list (room creator's / highest-power user's server plus the top-populated member servers) — and this helper is correctly used elsewhere for the exact same kind of link (src/app/features/add-existing/AddExisting.tsx:137-149uses it form.space.childvia). By not reusing it, the invite link/QR code this feature generates degrades badly if the sharer's own homeserver is small, later goes offline, or the sharer's account is deactivated/leaves — recipients resolving thematrix.tolink may fail to find the room even though it's alive and well-populated on other servers thatgetViaServerswould have included.How to trigger
Share a room invite link/QR from an account on a small or later-decommissioned homeserver for a room that is mostly populated on other servers; the link's only routing hint points at a server that may not have (or may lose) the room.
Suggested fix
Reuse
getViaServers(room)instead of[mx.getDomain()]when buildinginviteUrlinRoomShareInvite.tsx.Filed from the September 2026 client audit (branch
lotus@4bea4895).