fix: SEC34

Reviewed-By: Jade Ellis <jade@ellis.link>
Reviewed-By: Ginger <ginger@gingershaped.computer>
Reviewed-By: Jacob Taylor <jacob@explodie.org>

src/service/rooms/event_handler/pdu_checks.rs

@@ -159,15 +159,9 @@ impl super::Service {
 			ready(auth_events_by_key.get(&key).map(ToOwned::to_owned))
 		};
 
-		state_res::event_auth::auth_check(
-			room_version_rules,
-			pdu,
-			None, // TODO: third party invite
-			state_fetch,
-			create_event,
-		)
-		.await
-		.map_err(|e| err!("Event self-authentication failed: {e:?}"))
+		state_res::event_auth::auth_check(room_version_rules, pdu, state_fetch, create_event)
+			.await
+			.map_err(|e| err!("Event self-authentication failed: {e:?}"))
 	}
 
 	/// Checks that the event passes PDU check 5, which ensures that the event
@@ -241,7 +235,6 @@ impl super::Service {
 		let auth_check = state_res::event_auth::auth_check(
 			room_version_rules,
 			incoming_pdu,
-			None, // TODO: third party invite
 			|ty, sk| state_fetch(ty.clone(), sk.into()),
 			create_event.as_pdu(),
 		)
@@ -291,7 +284,6 @@ impl super::Service {
 		state_res::event_auth::auth_check(
 			room_version_rules,
 			incoming_pdu,
-			None, // third-party invite
 			state_fetch,
 			create_event.as_pdu(),
 		)

src/service/rooms/membership/mod.rs

@@ -617,7 +617,6 @@ impl Service {
 		let auth_check = state_res::event_auth::auth_check(
 			&room_version.rules().unwrap(),
 			&parsed_join_pdu,
-			None, // TODO: third party invite
 			|k, s| state_fetch(k.clone(), s.into()),
 			&create_event,
 		)

src/service/rooms/timeline/create.rs

@@ -256,15 +256,10 @@ impl super::Service {
 			| _ => create_pdu.as_ref().unwrap().as_pdu(),
 		};
 
-		let auth_check = state_res::auth_check(
-			&room_version_rules,
-			&pdu,
-			None, // TODO: third_party_invite
-			auth_fetch,
-			create_event,
-		)
-		.await
-		.map_err(|e| err!(Request(Forbidden(warn!("Auth check failed: {e:?}")))))?;
+		let auth_check =
+			state_res::auth_check(&room_version_rules, &pdu, auth_fetch, create_event)
+				.await
+				.map_err(|e| err!(Request(Forbidden(warn!("Auth check failed: {e:?}")))))?;
 
 		if !auth_check {
 			return Err!(Request(Forbidden("Event is not authorized.")));