Manage User Room Restrictions

The User Restrictions module controls whether users can create rooms and spaces or invite other users to rooms. You can define rules for selected users by matching their full Matrix user IDs with regular expressions.

NOTE. These restrictions do not apply to server administrators.

Configure restrictions

SalaX Secure Messaging homeservers include this module by default. To use it, add the required settings to the homeserver configuration.

The following example defines different permissions for Matrix user IDs whose local parts begin with admin or assistant:

modules:
  - module: synapse_user_restrictions.UserRestrictionsModule
    config:
      # Rules are evaluated from top to bottom.
      rules:
        - match: '@admin.*:example\.org'
          allow: [invite, create_room]

        - match: '@assistant.*:example\.org'
          allow: [invite]

      # Deny these permissions when no rule matches.
      default_deny: [invite, create_room]

In this example:

• @adminalice:example.org can create rooms and spaces and invite users to rooms.
• @assistantbob:example.org can invite users to rooms but cannot create rooms or spaces.
• @plainoldjoe:example.org cannot create rooms or spaces or invite users to rooms.
• A server administrator can perform all of these actions, regardless of whether the administrator's user ID matches a rule.

The @admin.* pattern is only a user-ID naming pattern. Matching it does not grant a user server administrator privileges.

How rules are evaluated

Rules are evaluated from top to bottom. A rule applies when both of the following conditions are met:

• The match regular expression fully matches the user's Matrix ID.
• The requested permission appears in the rule's allow or deny list.

The first applicable rule determines whether the requested action is allowed or denied. Place more specific rules before more general rules.

The supported permissions are:

• invite: Invite another user to a room or space.
• create_room: Create a room or space.

If no rule applies, the module checks default_deny. A permission listed in default_deny is denied; other permissions are allowed by default.

NOTE. A regular expression must match the entire Matrix user ID, including the leading @, the colon, and the homeserver name. Escape dots in a homeserver domain with \. so that they are treated as literal dots.

We have listed below some example scenarios:

Restrict all non-administrator users

To prevent every non-administrator user from creating rooms or spaces and inviting users to rooms, use an empty rules list and deny both permissions by default:

modules:
  - module: synapse_user_restrictions.UserRestrictionsModule
    config:
      rules: []
      default_deny: [invite, create_room]

With this configuration, the restrictions apply to every non-administrator user. Server administrators remain unrestricted.

Allow selected users

To grant both permissions only to users whose Matrix user ID local parts start with user2 on the localhost homeserver, configure an allow rule followed by the default restrictions:

modules:
  - module: synapse_user_restrictions.UserRestrictionsModule
    config:
      rules:
        - match: '@user2.*:localhost'
          allow: [invite, create_room]
      default_deny: [invite, create_room]

Users matching @user2.*:localhost can create rooms and spaces and invite users to rooms. All other non-administrator users are denied those actions. Server administrators remain unrestricted.

For example, the rule matches @user2:localhost and @user2alice:localhost. It does not match users on a different homeserver.