MSC4140: authenticate the delayed event management endpoints and allow guests

[barodeur]

Note

This depends on matrix-org/complement#924

MSC4140 makes the management endpoints authenticated and scoped to the requesting user:

A set of new authenticated Client-Server API endpoints at POST /_matrix/client/v1/delayed_events/{delay_id}/{action} [...]

If no delayed event for the requesting user with the specified delay_id can be found, the homeserver will respond with HTTP 404 and a standard error response with an errcode of M_NOT_FOUND.

All delayed event related endpoints are available to guest accounts.

Today cancel, restart and send accept requests without an access token and act on any delay_id; a token, when present, only keys the ratelimiter (#19794). The two GET endpoints reject guests.

What changes

• cancel, restart and send require an access token and answer 404 for a delay_id that belongs to another user.
• The management ratelimiter is keyed on the user only.
• GET /delayed_events/{delay_id} and GET /delayed_events allow guests.
• rc_delayed_event_mgmt documentation updated accordingly.

Appservices acting for a user through ?user_id= keep working.

Pull Request Checklist

• Pull request is based on the develop branch
• Pull request includes a changelog file. The entry should:
  • Be a short description of your change which makes sense to users. "Fixed a bug that prevented receiving messages from other servers." instead of "Moved X method from EventStore to EventWorkerStore.".
  • Use markdown where necessary, mostly for code blocks.
  • End with either a period (.) or an exclamation mark (!).
  • Start with a capital letter.
  • Feel free to credit yourself, by adding a sentence "Contributed by @github_username." or "Contributed by [Your Name]." to the end of the entry.
• Code style is correct (run the linters)