Ability to constrain 3PID invites (SPEC-351)

matrix-org / matrix-spec

The Matrix protocol specification

Apache License 2.0

186 stars 94 forks source link

Ability to constrain 3PID invites (SPEC-351) #157

Open matrixbot opened 8 years ago

matrixbot commented 8 years ago

Submitted by @matthew:matrix.org would be very useful for an inviter or admin to be able to limit the lifetime of a 3pid invite, or how many times it is allowed to be followed, or critically whether the target's account has to match the invited 3pid or not

(Imported from https://matrix.org/jira/browse/SPEC-351)

matrixbot commented 8 years ago

Jira watchers: @illicitonion @ara4n

matrixbot commented 8 years ago

Policies I think are worth implementing:

Allow n uses of token
Expire token after n seconds
Require matching 3pid binding

Any more for any more?

-- @illicitonion

matrixbot commented 8 years ago

Things that may be interesting but I'd like to defer:

Constrain on email domain ==

-- @illicitonion

matrixbot commented 8 years ago

these sound good. how in practice would the inviter select the constraint?

-- @ara4n

matrixbot commented 8 years ago

So, this could be a server default, a room setting with default, or a per-invite UX. It's definitely an unclear thing to explain, though, so worth considering...

I don't have a good answer; do you?

-- @illicitonion

matrixbot commented 8 years ago

I totally failed to spot that you'd answered this - sorry.

I have no good answer to this either. I guess the ideal thing would be for the inviter to get to chose, and for the client to pick sensible defaults. Either that or we just pick a totally arbitrary default on sydent for now - something like "3 uses or 1 week elapses; whichever first". And we just make sure the error is clear to the invitee that they should go bug the inviter to re-invite them if they get timed out.

-- @ara4n