From 87030a3a22406c97177892786ce2482e640f99ad Mon Sep 17 00:00:00 2001
From: timedout <git@nexy7574.co.uk>
Date: Sat, 11 Jul 2026 19:47:20 +0100
Subject: [PATCH] fix: Ensure PDU returned by `create_hash_and_sign_event` is
 itself signed

---
 src/api/client/membership/invite.rs  |  3 ++-
 src/api/server/invite.rs             |  3 +++
 src/service/rooms/timeline/create.rs | 15 +++++++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/api/client/membership/invite.rs b/src/api/client/membership/invite.rs
index 7c638c7d1..ac233675d 100644
--- a/src/api/client/membership/invite.rs
+++ b/src/api/client/membership/invite.rs
@@ -3,7 +3,7 @@ use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug_error, err, info,
 	matrix::{event::gen_event_id_canonical_json, pdu::PartialPdu},
-	warn,
+	trace, warn,
 };
 use futures::FutureExt;
 use ruma::{
@@ -193,6 +193,7 @@ pub(crate) async fn invite_helper(
 			.await
 			.ok();
 
+		trace!(?request, "Sending invite");
 		let response = services
 			.sending
 			.send_federation_request(recipient_user.server_name(), request)
diff --git a/src/api/server/invite.rs b/src/api/server/invite.rs
index 9dcd55549..490f0fdf0 100644
--- a/src/api/server/invite.rs
+++ b/src/api/server/invite.rs
@@ -61,6 +61,8 @@ pub(crate) async fn create_invite_route(
 	debug!(
 		event_id=%body.event_id,
 		room_id=%body.room_id,
+		room_version=?body.room_version,
+		via=?body.via,
 		"Validating invite room state for invite request"
 	);
 	let (create_event_id, state) = validate_invite_state(
@@ -290,6 +292,7 @@ async fn validate_invite_state(
 	room_version_rules: &RoomVersionRules,
 	room_id: OwnedRoomId,
 ) -> Result<(OwnedEventId, HashMap<(StateEventType, StateKey), CanonicalJsonObject>)> {
+	trace!(?invite_state, "Raw invite state");
 	let mut invite_state_map: HashMap<(StateEventType, StateKey), _> =
 		HashMap::with_capacity(invite_state.len());
 	let mut create_event_id: Option<OwnedEventId> = None;
diff --git a/src/service/rooms/timeline/create.rs b/src/service/rooms/timeline/create.rs
index 2f05ca8cc..60fc9e42d 100644
--- a/src/service/rooms/timeline/create.rs
+++ b/src/service/rooms/timeline/create.rs
@@ -308,6 +308,21 @@ impl super::Service {
 				| _ => Err!(Request(Unknown(warn!("Signing event failed: {e}")))),
 			};
 		}
+
+		// Evil hack because only the PDU JSON gets signed
+		pdu.hashes = serde_json::from_value(serde_json::to_value(
+			pdu_json
+				.get("hashes")
+				.expect("must have hashes after signing")
+				.clone(),
+		)?)?;
+		pdu.signatures = serde_json::from_value(serde_json::to_value(
+			pdu_json
+				.get("signatures")
+				.expect("must have signatures after signing")
+				.clone(),
+		)?)?;
+
 		// Generate event id
 		pdu.event_id = gen_event_id(&pdu_json, &room_version_rules)?;
 		pdu_json