Absorb the matrix-react-sdk repository (#28192)

Co-authored-by: github-merge-queue <118344674+github-merge-queue@users.noreply.github.com>
Co-authored-by: github-merge-queue <github-merge-queue@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Florian Duros <florian.duros@ormaz.fr>
Co-authored-by: Kim Brose <kim.brose@nordeck.net>
Co-authored-by: Florian Duros <florianduros@element.io>
Co-authored-by: R Midhun Suresh <hi@midhun.dev>
Co-authored-by: dbkr <986903+dbkr@users.noreply.github.com>
Co-authored-by: ElementRobot <releases@riot.im>
Co-authored-by: dbkr <dbkr@users.noreply.github.com>
Co-authored-by: David Baker <dbkr@users.noreply.github.com>
Co-authored-by: Michael Telatynski <7t3chguy@gmail.com>
Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>
Co-authored-by: David Langley <davidl@element.io>
Co-authored-by: Michael Weimann <michaelw@matrix.org>
Co-authored-by: Timshel <Timshel@users.noreply.github.com>
Co-authored-by: Sahil Silare <32628578+sahil9001@users.noreply.github.com>
Co-authored-by: Will Hunt <will@half-shot.uk>
Co-authored-by: Hubert Chathi <hubert@uhoreg.ca>
Co-authored-by: Andrew Ferrazzutti <andrewf@element.io>
Co-authored-by: Robin <robin@robin.town>
Co-authored-by: Tulir Asokan <tulir@maunium.net>

playwright/plugins/docker/index.ts

@@ -0,0 +1,147 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import * as os from "os";
+import * as crypto from "crypto";
+import * as childProcess from "child_process";
+import * as fse from "fs-extra";
+
+/**
+ * @param cmd - command to execute
+ * @param args - arguments to pass to executed command
+ * @param suppressOutput - whether to suppress the stdout and stderr resulting from this command.
+ * @return Promise which resolves to an object containing the string value of what was
+ *         written to stdout and stderr by the executed command.
+ */
+const exec = (cmd: string, args: string[], suppressOutput = false): Promise<{ stdout: string; stderr: string }> => {
+    return new Promise((resolve, reject) => {
+        if (!suppressOutput) {
+            const log = ["Running command:", cmd, ...args, "\n"].join(" ");
+            // When in CI mode we combine reports from multiple runners into a single HTML report
+            // which has separate files for stdout and stderr, so we print the executed command to both
+            process.stdout.write(log);
+            if (process.env.CI) process.stderr.write(log);
+        }
+        const { stdout, stderr } = childProcess.execFile(cmd, args, { encoding: "utf8" }, (err, stdout, stderr) => {
+            if (err) reject(err);
+            resolve({ stdout, stderr });
+            if (!suppressOutput) {
+                process.stdout.write("\n");
+                if (process.env.CI) process.stderr.write("\n");
+            }
+        });
+        if (!suppressOutput) {
+            stdout.pipe(process.stdout);
+            stderr.pipe(process.stderr);
+        }
+    });
+};
+
+export class Docker {
+    public id: string;
+
+    async run(opts: { image: string; containerName: string; params?: string[]; cmd?: string[] }): Promise<string> {
+        const userInfo = os.userInfo();
+        const params = opts.params ?? [];
+
+        const isPodman = await Docker.isPodman();
+        if (params.includes("-v") && userInfo.uid >= 0) {
+            // Run the docker container as our uid:gid to prevent problems with permissions.
+            if (isPodman) {
+                // Note: this setup is for podman rootless containers.
+
+                // In podman, run as root in the container, which maps to the current
+                // user on the host. This is probably the default since Synapse's
+                // Dockerfile doesn't specify, but we're being explicit here
+                // because it's important for the permissions to work.
+                params.push("-u", "0:0");
+
+                // Tell Synapse not to switch UID
+                params.push("-e", "UID=0");
+                params.push("-e", "GID=0");
+            } else {
+                params.push("-u", `${userInfo.uid}:${userInfo.gid}`);
+            }
+        }
+
+        // Make host.containers.internal work to allow the container to talk to other services via host ports.
+        if (isPodman) {
+            params.push("--network");
+            params.push("slirp4netns:allow_host_loopback=true");
+        } else {
+            // Docker for Desktop includes a host-gateway mapping on host.docker.internal but to simplify the config
+            // we use the Podman variant host.containers.internal in all environments.
+            params.push("--add-host");
+            params.push("host.containers.internal:host-gateway");
+        }
+
+        // Provided we are not running in CI, add a `--rm` parameter.
+        // There is no need to remove containers in CI (since they are automatically removed anyway), and
+        // `--rm` means that if a container crashes this means its logs are wiped out.
+        if (!process.env.CI) params.unshift("--rm");
+
+        const args = [
+            "run",
+            "--name",
+            `${opts.containerName}-${crypto.randomBytes(4).toString("hex")}`,
+            "-d",
+            ...params,
+            opts.image,
+        ];
+
+        if (opts.cmd) args.push(...opts.cmd);
+
+        const { stdout } = await exec("docker", args);
+        this.id = stdout.trim();
+        return this.id;
+    }
+
+    async stop(): Promise<void> {
+        try {
+            await exec("docker", ["stop", this.id]);
+        } catch (err) {
+            console.error(`Failed to stop docker container`, this.id, err);
+        }
+    }
+
+    /**
+     * @param params - list of parameters to pass to `docker exec`
+     * @param suppressOutput - whether to suppress the stdout and stderr resulting from this command.
+     */
+    async exec(params: string[], suppressOutput = true): Promise<void> {
+        await exec("docker", ["exec", this.id, ...params], suppressOutput);
+    }
+
+    async getContainerIp(): Promise<string> {
+        const { stdout } = await exec("docker", ["inspect", "-f", "{{ .NetworkSettings.IPAddress }}", this.id]);
+        return stdout.trim();
+    }
+
+    async persistLogsToFile(args: { stdoutFile?: string; stderrFile?: string }): Promise<void> {
+        const stdoutFile = args.stdoutFile ? await fse.open(args.stdoutFile, "w") : "ignore";
+        const stderrFile = args.stderrFile ? await fse.open(args.stderrFile, "w") : "ignore";
+        await new Promise<void>((resolve) => {
+            childProcess
+                .spawn("docker", ["logs", this.id], {
+                    stdio: ["ignore", stdoutFile, stderrFile],
+                })
+                .once("close", resolve);
+        });
+        if (args.stdoutFile) await fse.close(<number>stdoutFile);
+        if (args.stderrFile) await fse.close(<number>stderrFile);
+    }
+
+    /**
+     * Detects whether the docker command is actually podman.
+     * To do this, it looks for "podman" in the output of "docker --help".
+     */
+    static async isPodman(): Promise<boolean> {
+        const { stdout } = await exec("docker", ["--help"], true);
+        return stdout.toLowerCase().includes("podman");
+    }
+}

playwright/plugins/homeserver/dendrite/index.ts

@@ -0,0 +1,148 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import * as path from "node:path";
+import * as os from "node:os";
+import * as fse from "fs-extra";
+
+import { getFreePort } from "../../utils/port";
+import { Homeserver, HomeserverConfig, HomeserverInstance, StartHomeserverOpts } from "../";
+import { randB64Bytes } from "../../utils/rand";
+import { Synapse } from "../synapse";
+import { Docker } from "../../docker";
+
+const dockerConfigDir = "/etc/dendrite/";
+const dendriteConfigFile = "dendrite.yaml";
+
+// Surprisingly, Dendrite implements the same register user Admin API Synapse, so we can just extend it
+export class Dendrite extends Synapse implements Homeserver, HomeserverInstance {
+    protected image = "matrixdotorg/dendrite-monolith:main";
+    protected entrypoint = "/usr/bin/dendrite";
+
+    /**
+     * Start a dendrite instance: the template must be the name of one of the templates
+     * in the playwright/plugins/dendritedocker/templates directory
+     * @param opts
+     */
+    public async start(opts: StartHomeserverOpts): Promise<HomeserverInstance> {
+        const denCfg = await cfgDirFromTemplate(this.image, opts);
+
+        console.log(`Starting dendrite with config dir ${denCfg.configDir}...`);
+
+        const dendriteId = await this.docker.run({
+            image: this.image,
+            params: [
+                "-v",
+                `${denCfg.configDir}:` + dockerConfigDir,
+                "-p",
+                `${denCfg.port}:8008/tcp`,
+                "--entrypoint",
+                this.entrypoint,
+            ],
+            containerName: `react-sdk-playwright-dendrite`,
+            cmd: ["--config", dockerConfigDir + dendriteConfigFile, "--really-enable-open-registration", "true", "run"],
+        });
+
+        console.log(`Started dendrite with id ${dendriteId} on port ${denCfg.port}.`);
+
+        // Await Dendrite healthcheck
+        await this.docker.exec([
+            "curl",
+            "--connect-timeout",
+            "30",
+            "--retry",
+            "30",
+            "--retry-delay",
+            "1",
+            "--retry-all-errors",
+            "--silent",
+            "http://localhost:8008/_matrix/client/versions",
+        ]);
+
+        const dockerUrl = `http://${await this.docker.getContainerIp()}:8008`;
+        this.config = {
+            ...denCfg,
+            serverId: dendriteId,
+            dockerUrl,
+        };
+        return this;
+    }
+
+    public async stop(): Promise<string[]> {
+        if (!this.config) throw new Error("Missing existing dendrite instance, did you call stop() before start()?");
+
+        const dendriteLogsPath = path.join("playwright", "dendritelogs", this.config.serverId);
+        await fse.ensureDir(dendriteLogsPath);
+
+        await this.docker.persistLogsToFile({
+            stdoutFile: path.join(dendriteLogsPath, "stdout.log"),
+            stderrFile: path.join(dendriteLogsPath, "stderr.log"),
+        });
+
+        await this.docker.stop();
+
+        await fse.remove(this.config.configDir);
+
+        console.log(`Stopped dendrite id ${this.config.serverId}.`);
+
+        return [path.join(dendriteLogsPath, "stdout.log"), path.join(dendriteLogsPath, "stderr.log")];
+    }
+}
+
+export class Pinecone extends Dendrite {
+    protected image = "matrixdotorg/dendrite-demo-pinecone:main";
+    protected entrypoint = "/usr/bin/dendrite-demo-pinecone";
+}
+
+async function cfgDirFromTemplate(
+    dendriteImage: string,
+    opts: StartHomeserverOpts,
+): Promise<Omit<HomeserverConfig, "dockerUrl">> {
+    const template = "default"; // XXX: for now we only have one template
+    const templateDir = path.join(__dirname, "templates", template);
+
+    const stats = await fse.stat(templateDir);
+    if (!stats?.isDirectory) {
+        throw new Error(`No such template: ${template}`);
+    }
+    const tempDir = await fse.mkdtemp(path.join(os.tmpdir(), "react-sdk-dendritedocker-"));
+
+    // copy the contents of the template dir, omitting homeserver.yaml as we'll template that
+    console.log(`Copy ${templateDir} -> ${tempDir}`);
+    await fse.copy(templateDir, tempDir, { filter: (f) => path.basename(f) !== dendriteConfigFile });
+
+    const registrationSecret = randB64Bytes(16);
+
+    const port = await getFreePort();
+    const baseUrl = `http://localhost:${port}`;
+
+    // now copy homeserver.yaml, applying substitutions
+    console.log(`Gen ${path.join(templateDir, dendriteConfigFile)}`);
+    let hsYaml = await fse.readFile(path.join(templateDir, dendriteConfigFile), "utf8");
+    hsYaml = hsYaml.replace(/{{REGISTRATION_SECRET}}/g, registrationSecret);
+    await fse.writeFile(path.join(tempDir, dendriteConfigFile), hsYaml);
+
+    const docker = new Docker();
+    await docker.run({
+        image: dendriteImage,
+        params: ["--entrypoint=", "-v", `${tempDir}:/mnt`],
+        containerName: `react-sdk-playwright-dendrite-keygen`,
+        cmd: ["/usr/bin/generate-keys", "-private-key", "/mnt/matrix_key.pem"],
+    });
+
+    return {
+        port,
+        baseUrl,
+        configDir: tempDir,
+        registrationSecret,
+    };
+}
+
+export function isDendrite(): boolean {
+    return process.env["PLAYWRIGHT_HOMESERVER"] === "dendrite" || process.env["PLAYWRIGHT_HOMESERVER"] === "pinecone";
+}

playwright/plugins/homeserver/dendrite/templates/default/dendrite.yaml

@@ -0,0 +1,378 @@
+# This is the Dendrite configuration file.
+#
+# The configuration is split up into sections - each Dendrite component has a
+# configuration section, in addition to the "global" section which applies to
+# all components.
+
+# The version of the configuration file.
+version: 2
+
+# Global Matrix configuration. This configuration applies to all components.
+global:
+    # The domain name of this homeserver.
+    server_name: localhost
+
+    # The path to the signing private key file, used to sign requests and events.
+    # Note that this is NOT the same private key as used for TLS! To generate a
+    # signing key, use "./bin/generate-keys --private-key matrix_key.pem".
+    private_key: matrix_key.pem
+
+    # The paths and expiry timestamps (as a UNIX timestamp in millisecond precision)
+    # to old signing keys that were formerly in use on this domain name. These
+    # keys will not be used for federation request or event signing, but will be
+    # provided to any other homeserver that asks when trying to verify old events.
+    old_private_keys:
+    #  If the old private key file is available:
+    #  - private_key: old_matrix_key.pem
+    #    expired_at: 1601024554498
+    #  If only the public key (in base64 format) and key ID are known:
+    #  - public_key: mn59Kxfdq9VziYHSBzI7+EDPDcBS2Xl7jeUdiiQcOnM=
+    #    key_id: ed25519:mykeyid
+    #    expired_at: 1601024554498
+
+    # How long a remote server can cache our server signing key before requesting it
+    # again. Increasing this number will reduce the number of requests made by other
+    # servers for our key but increases the period that a compromised key will be
+    # considered valid by other homeservers.
+    key_validity_period: 168h0m0s
+
+    # Global database connection pool, for PostgreSQL monolith deployments only. If
+    # this section is populated then you can omit the "database" blocks in all other
+    # sections. For polylith deployments, or monolith deployments using SQLite databases,
+    # you must configure the "database" block for each component instead.
+    # database:
+    #   connection_string: postgresql://username:password@hostname/dendrite?sslmode=disable
+    #   max_open_conns: 90
+    #   max_idle_conns: 5
+    #   conn_max_lifetime: -1
+
+    # Configuration for in-memory caches. Caches can often improve performance by
+    # keeping frequently accessed items (like events, identifiers etc.) in memory
+    # rather than having to read them from the database.
+    cache:
+        # The estimated maximum size for the global cache in bytes, or in terabytes,
+        # gigabytes, megabytes or kilobytes when the appropriate 'tb', 'gb', 'mb' or
+        # 'kb' suffix is specified. Note that this is not a hard limit, nor is it a
+        # memory limit for the entire process. A cache that is too small may ultimately
+        # provide little or no benefit.
+        max_size_estimated: 1gb
+
+        # The maximum amount of time that a cache entry can live for in memory before
+        # it will be evicted and/or refreshed from the database. Lower values result in
+        # easier admission of new cache entries but may also increase database load in
+        # comparison to higher values, so adjust conservatively. Higher values may make
+        # it harder for new items to make it into the cache, e.g. if new rooms suddenly
+        # become popular.
+        max_age: 1h
+
+    # The server name to delegate server-server communications to, with optional port
+    # e.g. localhost:443
+    well_known_server_name: ""
+
+    # The server name to delegate client-server communications to, with optional port
+    # e.g. localhost:443
+    well_known_client_name: ""
+
+    # Lists of domains that the server will trust as identity servers to verify third
+    # party identifiers such as phone numbers and email addresses.
+    trusted_third_party_id_servers:
+        - matrix.org
+        - vector.im
+
+    # Disables federation. Dendrite will not be able to communicate with other servers
+    # in the Matrix federation and the federation API will not be exposed.
+    disable_federation: false
+
+    # Configures the handling of presence events. Inbound controls whether we receive
+    # presence events from other servers, outbound controls whether we send presence
+    # events for our local users to other servers.
+    presence:
+        enable_inbound: false
+        enable_outbound: false
+
+    # Configures phone-home statistics reporting. These statistics contain the server
+    # name, number of active users and some information on your deployment config.
+    # We use this information to understand how Dendrite is being used in the wild.
+    report_stats:
+        enabled: false
+        endpoint: https://matrix.org/report-usage-stats/push
+
+    # Server notices allows server admins to send messages to all users on the server.
+    server_notices:
+        enabled: false
+        # The local part, display name and avatar URL (as a mxc:// URL) for the user that
+        # will send the server notices. These are visible to all users on the deployment.
+        local_part: "_server"
+        display_name: "Server Alerts"
+        avatar_url: ""
+        # The room name to be used when sending server notices. This room name will
+        # appear in user clients.
+        room_name: "Server Alerts"
+
+    # Configuration for NATS JetStream
+    jetstream:
+        # A list of NATS Server addresses to connect to. If none are specified, an
+        # internal NATS server will be started automatically when running Dendrite in
+        # monolith mode. For polylith deployments, it is required to specify the address
+        # of at least one NATS Server node.
+        addresses:
+        # - localhost:4222
+
+        # Disable the validation of TLS certificates of NATS. This is
+        # not recommended in production since it may allow NATS traffic
+        # to be sent to an insecure endpoint.
+        disable_tls_validation: false
+
+        # Persistent directory to store JetStream streams in. This directory should be
+        # preserved across Dendrite restarts.
+        storage_path: ./
+
+        # The prefix to use for stream names for this homeserver - really only useful
+        # if you are running more than one Dendrite server on the same NATS deployment.
+        topic_prefix: Dendrite
+
+    # Configuration for Prometheus metric collection.
+    metrics:
+        enabled: false
+        basic_auth:
+            username: metrics
+            password: metrics
+
+    # Optional DNS cache. The DNS cache may reduce the load on DNS servers if there
+    # is no local caching resolver available for use.
+    dns_cache:
+        enabled: false
+        cache_size: 256
+        cache_lifetime: "5m" # 5 minutes; https://pkg.go.dev/time@master#ParseDuration
+
+# Configuration for the Appservice API.
+app_service_api:
+    # Disable the validation of TLS certificates of appservices. This is
+    # not recommended in production since it may allow appservice traffic
+    # to be sent to an insecure endpoint.
+    disable_tls_validation: false
+
+    # Appservice configuration files to load into this homeserver.
+    config_files:
+    #  - /path/to/appservice_registration.yaml
+
+# Configuration for the Client API.
+client_api:
+    # Prevents new users from being able to register on this homeserver, except when
+    # using the registration shared secret below.
+    registration_disabled: false
+
+    # Prevents new guest accounts from being created. Guest registration is also
+    # disabled implicitly by setting 'registration_disabled' above.
+    guests_disabled: true
+
+    # If set, allows registration by anyone who knows the shared secret, regardless
+    # of whether registration is otherwise disabled.
+    registration_shared_secret: "{{REGISTRATION_SECRET}}"
+
+    # Whether to require reCAPTCHA for registration. If you have enabled registration
+    # then this is HIGHLY RECOMMENDED to reduce the risk of your homeserver being used
+    # for coordinated spam attacks.
+    enable_registration_captcha: false
+
+    # Settings for ReCAPTCHA.
+    recaptcha_public_key: ""
+    recaptcha_private_key: ""
+    recaptcha_bypass_secret: ""
+
+    # To use hcaptcha.com instead of ReCAPTCHA, set the following parameters, otherwise just keep them empty.
+    # recaptcha_siteverify_api: "https://hcaptcha.com/siteverify"
+    # recaptcha_api_js_url: "https://js.hcaptcha.com/1/api.js"
+    # recaptcha_form_field: "h-captcha-response"
+    # recaptcha_sitekey_class: "h-captcha"
+
+    # TURN server information that this homeserver should send to clients.
+    turn:
+        turn_user_lifetime: "5m"
+        turn_uris:
+        #  - turn:turn.server.org?transport=udp
+        #  - turn:turn.server.org?transport=tcp
+        turn_shared_secret: ""
+        # If your TURN server requires static credentials, then you will need to enter
+        # them here instead of supplying a shared secret. Note that these credentials
+        # will be visible to clients!
+        # turn_username: ""
+        # turn_password: ""
+
+    # Settings for rate-limited endpoints. Rate limiting kicks in after the threshold
+    # number of "slots" have been taken by requests from a specific host. Each "slot"
+    # will be released after the cooloff time in milliseconds. Server administrators
+    # and appservice users are exempt from rate limiting by default.
+    rate_limiting:
+        enabled: true
+        threshold: 20
+        cooloff_ms: 500
+        exempt_user_ids:
+        #  - "@user:domain.com"
+
+# Configuration for the Federation API.
+federation_api:
+    # How many times we will try to resend a failed transaction to a specific server. The
+    # backoff is 2**x seconds, so 1 = 2 seconds, 2 = 4 seconds, 3 = 8 seconds etc. Once
+    # the max retries are exceeded, Dendrite will no longer try to send transactions to
+    # that server until it comes back to life and connects to us again.
+    send_max_retries: 16
+
+    # Disable the validation of TLS certificates of remote federated homeservers. Do not
+    # enable this option in production as it presents a security risk!
+    disable_tls_validation: false
+
+    # Disable HTTP keepalives, which also prevents connection reuse. Dendrite will typically
+    # keep HTTP connections open to remote hosts for 5 minutes as they can be reused much
+    # more quickly than opening new connections each time. Disabling keepalives will close
+    # HTTP connections immediately after a successful request but may result in more CPU and
+    # memory being used on TLS handshakes for each new connection instead.
+    disable_http_keepalives: false
+
+    # Perspective keyservers to use as a backup when direct key fetches fail. This may
+    # be required to satisfy key requests for servers that are no longer online when
+    # joining some rooms.
+    key_perspectives:
+        - server_name: matrix.org
+          keys:
+              - key_id: ed25519:auto
+                public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw
+              - key_id: ed25519:a_RXGa
+                public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ
+
+    # This option will control whether Dendrite will prefer to look up keys directly
+    # or whether it should try perspective servers first, using direct fetches as a
+    # last resort.
+    prefer_direct_fetch: false
+
+    database:
+        connection_string: file:dendrite-federationapi.db
+
+# Configuration for the Media API.
+media_api:
+    # Storage path for uploaded media. May be relative or absolute.
+    base_path: ./media_store
+
+    # The maximum allowed file size (in bytes) for media uploads to this homeserver
+    # (0 = unlimited). If using a reverse proxy, ensure it allows requests at least
+    #this large (e.g. the client_max_body_size setting in nginx).
+    max_file_size_bytes: 10485760
+
+    # Whether to dynamically generate thumbnails if needed.
+    dynamic_thumbnails: false
+
+    # The maximum number of simultaneous thumbnail generators to run.
+    max_thumbnail_generators: 10
+
+    # A list of thumbnail sizes to be generated for media content.
+    thumbnail_sizes:
+        - width: 32
+          height: 32
+          method: crop
+        - width: 96
+          height: 96
+          method: crop
+        - width: 640
+          height: 480
+          method: scale
+
+    database:
+        connection_string: file:dendrite-mediaapi.db
+
+# Configuration for enabling experimental MSCs on this homeserver.
+mscs:
+    mscs:
+    #  - msc2836  # (Threading, see https://github.com/matrix-org/matrix-doc/pull/2836)
+    #  - msc2946  # (Spaces Summary, see https://github.com/matrix-org/matrix-doc/pull/2946)
+
+    database:
+        connection_string: file:dendrite-msc.db
+
+# Configuration for the Sync API.
+sync_api:
+    # This option controls which HTTP header to inspect to find the real remote IP
+    # address of the client. This is likely required if Dendrite is running behind
+    # a reverse proxy server.
+    # real_ip_header: X-Real-IP
+
+    # Configuration for the full-text search engine.
+    search:
+        # Whether or not search is enabled.
+        enabled: false
+
+        # The path where the search index will be created in.
+        index_path: "./searchindex"
+
+        # The language most likely to be used on the server - used when indexing, to
+        # ensure the returned results match expectations. A full list of possible languages
+        # can be found at https://github.com/blevesearch/bleve/tree/master/analysis/lang
+        language: "en"
+
+    database:
+        connection_string: file:dendrite-syncapi.db
+
+# Configuration for the User API.
+user_api:
+    # The cost when hashing passwords on registration/login. Default: 10. Min: 4, Max: 31
+    # See https://pkg.go.dev/golang.org/x/crypto/bcrypt for more information.
+    # Setting this lower makes registration/login consume less CPU resources at the cost
+    # of security should the database be compromised. Setting this higher makes registration/login
+    # consume more CPU resources but makes it harder to brute force password hashes. This value
+    # can be lowered if performing tests or on embedded Dendrite instances (e.g WASM builds).
+    bcrypt_cost: 10
+
+    # The length of time that a token issued for a relying party from
+    # /_matrix/client/r0/user/{userId}/openid/request_token endpoint
+    # is considered to be valid in milliseconds.
+    # The default lifetime is 3600000ms (60 minutes).
+    # openid_token_lifetime_ms: 3600000
+
+    # Users who register on this homeserver will automatically be joined to the rooms listed under "auto_join_rooms" option.
+    # By default, any room aliases included in this list will be created as a publicly joinable room
+    # when the first user registers for the homeserver. If the room already exists,
+    # make certain it is a publicly joinable room, i.e. the join rule of the room must be set to 'public'.
+    # As Spaces are just rooms under the hood, Space aliases may also be used.
+    auto_join_rooms:
+    #  - "#main:matrix.org"
+
+    account_database:
+        connection_string: file:dendrite-userapi.db
+
+room_server:
+    database:
+        connection_string: file:dendrite-roomserverapi.db
+
+key_server:
+    database:
+        connection_string: file:dendrite-keyserverapi.db
+
+relay_api:
+    database:
+        connection_string: file:dendrite-relayapi.db
+
+# Configuration for Opentracing.
+# See https://github.com/matrix-org/dendrite/tree/master/docs/tracing for information on
+# how this works and how to set it up.
+tracing:
+    enabled: false
+    jaeger:
+        serviceName: ""
+        disabled: false
+        rpc_metrics: false
+        tags: []
+        sampler: null
+        reporter: null
+        headers: null
+        baggage_restrictions: null
+        throttler: null
+
+# Logging configuration. The "std" logging type controls the logs being sent to
+# stdout. The "file" logging type controls logs being written to a log folder on
+# the disk. Supported log levels are "debug", "info", "warn", "error".
+logging:
+    - type: std
+      level: debug
+    - type: file
+      level: debug
+      params:
+          path: ./logs

playwright/plugins/homeserver/index.ts

@@ -0,0 +1,73 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+export interface HomeserverConfig {
+    readonly configDir: string;
+    readonly baseUrl: string;
+    readonly port: number;
+    readonly registrationSecret: string;
+    readonly dockerUrl: string;
+}
+
+export interface HomeserverInstance {
+    readonly config: HomeserverConfig;
+
+    /**
+     * Register a user on the given Homeserver using the shared registration secret.
+     * @param username the username of the user to register
+     * @param password the password of the user to register
+     * @param displayName optional display name to set on the newly registered user
+     */
+    registerUser(username: string, password: string, displayName?: string): Promise<Credentials>;
+
+    /**
+     * Logs into synapse with the given username/password
+     * @param userId login username
+     * @param password login password
+     */
+    loginUser(userId: string, password: string): Promise<Credentials>;
+
+    /**
+     * Sets a third party identifier for the given user. This only supports setting a single 3pid and will
+     * replace any others.
+     * @param userId The full ID of the user to edit (as returned from registerUser)
+     * @param medium The medium of the 3pid to set
+     * @param address The address of the 3pid to set
+     */
+    setThreepid(userId: string, medium: string, address: string): Promise<void>;
+}
+
+export interface StartHomeserverOpts {
+    /** path to template within playwright/plugins/{homeserver}docker/template/ directory. */
+    template: string;
+
+    /** Port of an OAuth server to configure the homeserver to use */
+    oAuthServerPort?: number;
+
+    /** Additional variables to inject into the configuration template **/
+    variables?: Record<string, string | number>;
+}
+
+export interface Homeserver {
+    start(opts: StartHomeserverOpts): Promise<HomeserverInstance>;
+    /**
+     * Stop this test homeserver instance.
+     *
+     * @returns A list of paths relative to the cwd for logfiles generated during this test run.
+     */
+    stop(): Promise<string[]>;
+}
+
+export interface Credentials {
+    accessToken: string;
+    userId: string;
+    deviceId: string;
+    homeServer: string;
+    password: string | null; // null for password-less users
+    displayName?: string;
+}

playwright/plugins/homeserver/synapse/index.ts

@@ -0,0 +1,239 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import * as path from "node:path";
+import * as os from "node:os";
+import * as crypto from "node:crypto";
+import * as fse from "fs-extra";
+import { APIRequestContext } from "@playwright/test";
+
+import { getFreePort } from "../../utils/port";
+import { Docker } from "../../docker";
+import { HomeserverConfig, HomeserverInstance, Homeserver, StartHomeserverOpts, Credentials } from "..";
+import { randB64Bytes } from "../../utils/rand";
+
+// Docker tag to use for synapse docker image.
+// We target a specific digest as every now and then a Synapse update will break our CI.
+// This digest is updated by the playwright-image-updates.yaml workflow periodically.
+const DOCKER_TAG = "develop@sha256:78091e205adcd94ff42a0db688c83289a1d56c17b928f04d11b5b87a52cd2083";
+
+async function cfgDirFromTemplate(opts: StartHomeserverOpts): Promise<Omit<HomeserverConfig, "dockerUrl">> {
+    const templateDir = path.join(__dirname, "templates", opts.template);
+
+    const stats = await fse.stat(templateDir);
+    if (!stats?.isDirectory) {
+        throw new Error(`No such template: ${opts.template}`);
+    }
+    const tempDir = await fse.mkdtemp(path.join(os.tmpdir(), "react-sdk-synapsedocker-"));
+
+    // copy the contents of the template dir, omitting homeserver.yaml as we'll template that
+    console.log(`Copy ${templateDir} -> ${tempDir}`);
+    await fse.copy(templateDir, tempDir, { filter: (f) => path.basename(f) !== "homeserver.yaml" });
+
+    const registrationSecret = randB64Bytes(16);
+    const macaroonSecret = randB64Bytes(16);
+    const formSecret = randB64Bytes(16);
+
+    const port = await getFreePort();
+    const baseUrl = `http://localhost:${port}`;
+
+    // now copy homeserver.yaml, applying substitutions
+    const templateHomeserver = path.join(templateDir, "homeserver.yaml");
+    const outputHomeserver = path.join(tempDir, "homeserver.yaml");
+    console.log(`Gen ${templateHomeserver} -> ${outputHomeserver}`);
+    let hsYaml = await fse.readFile(templateHomeserver, "utf8");
+    hsYaml = hsYaml.replace(/{{REGISTRATION_SECRET}}/g, registrationSecret);
+    hsYaml = hsYaml.replace(/{{MACAROON_SECRET_KEY}}/g, macaroonSecret);
+    hsYaml = hsYaml.replace(/{{FORM_SECRET}}/g, formSecret);
+    hsYaml = hsYaml.replace(/{{PUBLIC_BASEURL}}/g, baseUrl);
+    if (opts.oAuthServerPort) {
+        hsYaml = hsYaml.replace(/{{OAUTH_SERVER_PORT}}/g, opts.oAuthServerPort.toString());
+    }
+    if (opts.variables) {
+        for (const key in opts.variables) {
+            hsYaml = hsYaml.replace(new RegExp("%" + key + "%", "g"), String(opts.variables[key]));
+        }
+    }
+
+    await fse.writeFile(outputHomeserver, hsYaml);
+
+    // now generate a signing key (we could use synapse's config generation for
+    // this, or we could just do this...)
+    // NB. This assumes the homeserver.yaml specifies the key in this location
+    const signingKey = randB64Bytes(32);
+    const outputSigningKey = path.join(tempDir, "localhost.signing.key");
+    console.log(`Gen -> ${outputSigningKey}`);
+    await fse.writeFile(outputSigningKey, `ed25519 x ${signingKey}`);
+
+    // Allow anyone to read, write and execute in the /temp/react-sdk-synapsedocker-xxx directory
+    // so that the DIND setup that we use to update the playwright screenshots work without any issues.
+    await fse.chmod(tempDir, 0o757);
+
+    return {
+        port,
+        baseUrl,
+        configDir: tempDir,
+        registrationSecret,
+    };
+}
+
+export class Synapse implements Homeserver, HomeserverInstance {
+    protected docker: Docker = new Docker();
+    public config: HomeserverConfig & { serverId: string };
+
+    private adminToken?: string;
+
+    public constructor(private readonly request: APIRequestContext) {}
+
+    /**
+     * Start a synapse instance: the template must be the name of
+     * one of the templates in the playwright/plugins/synapsedocker/templates
+     * directory.
+     */
+    public async start(opts: StartHomeserverOpts): Promise<HomeserverInstance> {
+        if (this.config) await this.stop();
+
+        const synCfg = await cfgDirFromTemplate(opts);
+        console.log(`Starting synapse with config dir ${synCfg.configDir}...`);
+        const dockerSynapseParams = ["-v", `${synCfg.configDir}:/data`, "-p", `${synCfg.port}:8008/tcp`];
+        const synapseId = await this.docker.run({
+            image: `ghcr.io/element-hq/synapse:${DOCKER_TAG}`,
+            containerName: `react-sdk-playwright-synapse`,
+            params: dockerSynapseParams,
+            cmd: ["run"],
+        });
+        console.log(`Started synapse with id ${synapseId} on port ${synCfg.port}.`);
+        // Await Synapse healthcheck
+        await this.docker.exec([
+            "curl",
+            "--connect-timeout",
+            "30",
+            "--retry",
+            "30",
+            "--retry-delay",
+            "1",
+            "--retry-all-errors",
+            "--silent",
+            "http://localhost:8008/health",
+        ]);
+        const dockerUrl = `http://${await this.docker.getContainerIp()}:8008`;
+        this.config = {
+            ...synCfg,
+            serverId: synapseId,
+            dockerUrl,
+        };
+        return this;
+    }
+
+    public async stop(): Promise<string[]> {
+        if (!this.config) throw new Error("Missing existing synapse instance, did you call stop() before start()?");
+        const id = this.config.serverId;
+        const synapseLogsPath = path.join("playwright", "logs", "synapse", id);
+        await fse.ensureDir(synapseLogsPath);
+        await this.docker.persistLogsToFile({
+            stdoutFile: path.join(synapseLogsPath, "stdout.log"),
+            stderrFile: path.join(synapseLogsPath, "stderr.log"),
+        });
+        await this.docker.stop();
+        await fse.remove(this.config.configDir);
+        console.log(`Stopped synapse id ${id}.`);
+
+        return [path.join(synapseLogsPath, "stdout.log"), path.join(synapseLogsPath, "stderr.log")];
+    }
+
+    private async registerUserInternal(
+        username: string,
+        password: string,
+        displayName?: string,
+        admin = false,
+    ): Promise<Credentials> {
+        const url = `${this.config.baseUrl}/_synapse/admin/v1/register`;
+        const { nonce } = await this.request.get(url).then((r) => r.json());
+        const mac = crypto
+            .createHmac("sha1", this.config.registrationSecret)
+            .update(`${nonce}\0${username}\0${password}\0${admin ? "" : "not"}admin`)
+            .digest("hex");
+        const res = await this.request.post(url, {
+            data: {
+                nonce,
+                username,
+                password,
+                mac,
+                admin,
+                displayname: displayName,
+            },
+        });
+
+        if (!res.ok()) {
+            throw await res.json();
+        }
+
+        const data = await res.json();
+        return {
+            homeServer: data.home_server,
+            accessToken: data.access_token,
+            userId: data.user_id,
+            deviceId: data.device_id,
+            password,
+            displayName,
+        };
+    }
+
+    public registerUser(username: string, password: string, displayName?: string): Promise<Credentials> {
+        return this.registerUserInternal(username, password, displayName, false);
+    }
+
+    public async loginUser(userId: string, password: string): Promise<Credentials> {
+        const url = `${this.config.baseUrl}/_matrix/client/v3/login`;
+        const res = await this.request.post(url, {
+            data: {
+                type: "m.login.password",
+                identifier: {
+                    type: "m.id.user",
+                    user: userId,
+                },
+                password: password,
+            },
+        });
+        const json = await res.json();
+
+        return {
+            password,
+            accessToken: json.access_token,
+            userId: json.user_id,
+            deviceId: json.device_id,
+            homeServer: json.home_server,
+        };
+    }
+
+    public async setThreepid(userId: string, medium: string, address: string): Promise<void> {
+        if (this.adminToken === undefined) {
+            const result = await this.registerUserInternal("admin", "totalyinsecureadminpassword", undefined, true);
+            this.adminToken = result.accessToken;
+        }
+
+        const url = `${this.config.baseUrl}/_synapse/admin/v2/users/${userId}`;
+        const res = await this.request.put(url, {
+            data: {
+                threepids: [
+                    {
+                        medium,
+                        address,
+                    },
+                ],
+            },
+            headers: {
+                Authorization: `Bearer ${this.adminToken}`,
+            },
+        });
+
+        if (!res.ok()) {
+            throw await res.json();
+        }
+    }
+}

playwright/plugins/homeserver/synapse/templates/COPYME/README.md

@@ -0,0 +1,3 @@
+# Meta-template for synapse templates
+
+To make another template, you can copy this directory

playwright/plugins/homeserver/synapse/templates/COPYME/homeserver.yaml

@@ -0,0 +1,72 @@
+server_name: "localhost"
+pid_file: /data/homeserver.pid
+# XXX: This won't actually be right: it lets docker allocate an ephemeral port,
+# so we have a chicken-and-egg problem
+public_baseurl: http://localhost:8008/
+# Listener is always port 8008 (configured in the container)
+listeners:
+    - port: 8008
+      tls: false
+      bind_addresses: ["::"]
+      type: http
+      x_forwarded: true
+
+      resources:
+          - names: [client, federation, consent]
+            compress: false
+
+# An sqlite in-memory database is fast & automatically wipes each time
+database:
+    name: "sqlite3"
+    args:
+        database: ":memory:"
+
+# Needs to be configured to log to the console like a good docker process
+log_config: "/data/log.config"
+
+rc_messages_per_second: 10000
+rc_message_burst_count: 10000
+rc_registration:
+    per_second: 10000
+    burst_count: 10000
+
+rc_login:
+    address:
+        per_second: 10000
+        burst_count: 10000
+    account:
+        per_second: 10000
+        burst_count: 10000
+    failed_attempts:
+        per_second: 10000
+        burst_count: 10000
+
+media_store_path: "/data/media_store"
+uploads_path: "/data/uploads"
+enable_registration: true
+enable_registration_without_verification: true
+disable_msisdn_registration: false
+# These placeholders will be be replaced with values generated at start
+registration_shared_secret: "{{REGISTRATION_SECRET}}"
+report_stats: false
+macaroon_secret_key: "{{MACAROON_SECRET_KEY}}"
+form_secret: "{{FORM_SECRET}}"
+# Signing key must be here: it will be generated to this file
+signing_key_path: "/data/localhost.signing.key"
+email:
+    enable_notifs: false
+    smtp_host: "localhost"
+    smtp_port: 25
+    smtp_user: "exampleusername"
+    smtp_pass: "examplepassword"
+    require_transport_security: False
+    notif_from: "Your Friendly %(app)s homeserver <noreply@example.com>"
+    app_name: Matrix
+    notif_template_html: notif_mail.html
+    notif_template_text: notif_mail.txt
+    notif_for_new_users: True
+    client_base_url: "http://localhost/element"
+
+trusted_key_servers:
+    - server_name: "matrix.org"
+suppress_key_server_warning: true

playwright/plugins/homeserver/synapse/templates/COPYME/log.config

@@ -0,0 +1,50 @@
+# Log configuration for Synapse.
+#
+# This is a YAML file containing a standard Python logging configuration
+# dictionary. See [1] for details on the valid settings.
+#
+# Synapse also supports structured logging for machine readable logs which can
+# be ingested by ELK stacks. See [2] for details.
+#
+# [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+# [2]: https://matrix-org.github.io/synapse/latest/structured_logging.html
+
+version: 1
+
+formatters:
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+    # A handler that writes logs to stderr. Unused by default, but can be used
+    # instead of "buffer" and "file" in the logger handlers.
+    console:
+        class: logging.StreamHandler
+        formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+
+    twisted:
+        # We send the twisted logging directly to the file handler,
+        # to work around https://github.com/matrix-org/synapse/issues/3471
+        # when using "buffer" logger. Use "console" to log to stderr instead.
+        handlers: [console]
+        propagate: false
+
+root:
+    level: INFO
+
+    # Write logs to the `buffer` handler, which will buffer them together in memory,
+    # then write them to a file.
+    #
+    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
+    # also need to update the configuration for the `twisted` logger above, in
+    # this case.)
+    #
+    handlers: [console]
+
+disable_existing_loggers: false

playwright/plugins/homeserver/synapse/templates/consent/README.md

@@ -0,0 +1 @@
+A synapse configured with user privacy consent enabled

playwright/plugins/homeserver/synapse/templates/consent/homeserver.yaml

@@ -0,0 +1,84 @@
+server_name: "localhost"
+pid_file: /data/homeserver.pid
+public_baseurl: "{{PUBLIC_BASEURL}}"
+listeners:
+    - port: 8008
+      tls: false
+      bind_addresses: ["::"]
+      type: http
+      x_forwarded: true
+
+      resources:
+          - names: [client, federation, consent]
+            compress: false
+
+database:
+    name: "sqlite3"
+    args:
+        database: ":memory:"
+
+log_config: "/data/log.config"
+
+rc_messages_per_second: 10000
+rc_message_burst_count: 10000
+rc_registration:
+    per_second: 10000
+    burst_count: 10000
+
+rc_login:
+    address:
+        per_second: 10000
+        burst_count: 10000
+    account:
+        per_second: 10000
+        burst_count: 10000
+    failed_attempts:
+        per_second: 10000
+        burst_count: 10000
+
+media_store_path: "/data/media_store"
+uploads_path: "/data/uploads"
+enable_registration: true
+enable_registration_without_verification: true
+disable_msisdn_registration: false
+registration_shared_secret: "{{REGISTRATION_SECRET}}"
+report_stats: false
+macaroon_secret_key: "{{MACAROON_SECRET_KEY}}"
+form_secret: "{{FORM_SECRET}}"
+signing_key_path: "/data/localhost.signing.key"
+email:
+    enable_notifs: false
+    smtp_host: "localhost"
+    smtp_port: 25
+    smtp_user: "exampleusername"
+    smtp_pass: "examplepassword"
+    require_transport_security: False
+    notif_from: "Your Friendly %(app)s homeserver <noreply@example.com>"
+    app_name: Matrix
+    notif_template_html: notif_mail.html
+    notif_template_text: notif_mail.txt
+    notif_for_new_users: True
+    client_base_url: "http://localhost/element"
+
+user_consent:
+    template_dir: /data/res/templates/privacy
+    version: 1.0
+    server_notice_content:
+        msgtype: m.text
+        body: >-
+            To continue using this homeserver you must review and agree to the
+            terms and conditions at %(consent_uri)s
+    send_server_notice_to_guests: True
+    block_events_error: >-
+        To continue using this homeserver you must review and agree to the
+        terms and conditions at %(consent_uri)s
+    require_at_registration: true
+
+server_notices:
+    system_mxid_localpart: notices
+    system_mxid_display_name: "Server Notices"
+    system_mxid_avatar_url: "mxc://localhost:5005/oumMVlgDnLYFaPVkExemNVVZ"
+    room_name: "Server Notices"
+trusted_key_servers:
+    - server_name: "matrix.org"
+suppress_key_server_warning: true

playwright/plugins/homeserver/synapse/templates/consent/log.config

@@ -0,0 +1,50 @@
+# Log configuration for Synapse.
+#
+# This is a YAML file containing a standard Python logging configuration
+# dictionary. See [1] for details on the valid settings.
+#
+# Synapse also supports structured logging for machine readable logs which can
+# be ingested by ELK stacks. See [2] for details.
+#
+# [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+# [2]: https://matrix-org.github.io/synapse/latest/structured_logging.html
+
+version: 1
+
+formatters:
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+    # A handler that writes logs to stderr. Unused by default, but can be used
+    # instead of "buffer" and "file" in the logger handlers.
+    console:
+        class: logging.StreamHandler
+        formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: DEBUG
+
+    twisted:
+        # We send the twisted logging directly to the file handler,
+        # to work around https://github.com/matrix-org/synapse/issues/3471
+        # when using "buffer" logger. Use "console" to log to stderr instead.
+        handlers: [console]
+        propagate: false
+
+root:
+    level: DEBUG
+
+    # Write logs to the `buffer` handler, which will buffer them together in memory,
+    # then write them to a file.
+    #
+    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
+    # also need to update the configuration for the `twisted` logger above, in
+    # this case.)
+    #
+    handlers: [console]
+
+disable_existing_loggers: false

playwright/plugins/homeserver/synapse/templates/consent/res/templates/privacy/en/1.0.html

@@ -0,0 +1,19 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <title>Test Privacy policy</title>
+    </head>
+    <body>
+        {% if has_consented %}
+        <p>Thank you, you've already accepted the license.</p>
+        {% else %}
+        <p>Please accept the license!</p>
+        <form method="post" action="consent">
+            <input type="hidden" name="v" value="{{version}}" />
+            <input type="hidden" name="u" value="{{user}}" />
+            <input type="hidden" name="h" value="{{userhmac}}" />
+            <input type="submit" value="Sure thing!" />
+        </form>
+        {% endif %}
+    </body>
+</html>

playwright/plugins/homeserver/synapse/templates/consent/res/templates/privacy/en/success.html

@@ -0,0 +1,9 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <title>Test Privacy policy</title>
+    </head>
+    <body>
+        <p>Danke schoen</p>
+    </body>
+</html>

playwright/plugins/homeserver/synapse/templates/default/README.md

@@ -0,0 +1 @@
+A synapse configured with user privacy consent disabled

playwright/plugins/homeserver/synapse/templates/default/homeserver.yaml

@@ -0,0 +1,104 @@
+server_name: "localhost"
+pid_file: /data/homeserver.pid
+public_baseurl: "{{PUBLIC_BASEURL}}"
+listeners:
+    - port: 8008
+      tls: false
+      bind_addresses: ["::"]
+      type: http
+      x_forwarded: true
+
+      resources:
+          - names: [client]
+            compress: false
+
+database:
+    name: "sqlite3"
+    args:
+        database: ":memory:"
+
+log_config: "/data/log.config"
+
+rc_messages_per_second: 10000
+rc_message_burst_count: 10000
+rc_registration:
+    per_second: 10000
+    burst_count: 10000
+rc_joins:
+    local:
+        per_second: 9999
+        burst_count: 9999
+    remote:
+        per_second: 9999
+        burst_count: 9999
+rc_joins_per_room:
+    per_second: 9999
+    burst_count: 9999
+rc_3pid_validation:
+    per_second: 1000
+    burst_count: 1000
+
+rc_invites:
+    per_room:
+        per_second: 1000
+        burst_count: 1000
+    per_user:
+        per_second: 1000
+        burst_count: 1000
+
+rc_login:
+    address:
+        per_second: 10000
+        burst_count: 10000
+    account:
+        per_second: 10000
+        burst_count: 10000
+    failed_attempts:
+        per_second: 10000
+        burst_count: 10000
+
+media_store_path: "/data/media_store"
+uploads_path: "/data/uploads"
+enable_registration: true
+enable_registration_without_verification: true
+disable_msisdn_registration: false
+registration_shared_secret: "{{REGISTRATION_SECRET}}"
+report_stats: false
+macaroon_secret_key: "{{MACAROON_SECRET_KEY}}"
+form_secret: "{{FORM_SECRET}}"
+signing_key_path: "/data/localhost.signing.key"
+
+trusted_key_servers:
+    - server_name: "matrix.org"
+suppress_key_server_warning: true
+
+ui_auth:
+    session_timeout: "300s"
+
+oidc_providers:
+    - idp_id: test
+      idp_name: "OAuth test"
+      issuer: "http://localhost:{{OAUTH_SERVER_PORT}}/oauth"
+      authorization_endpoint: "http://localhost:{{OAUTH_SERVER_PORT}}/oauth/auth.html"
+      # the token endpoint receives requests from synapse, rather than the webapp, so needs to escape the docker container.
+      token_endpoint: "http://host.containers.internal:{{OAUTH_SERVER_PORT}}/oauth/token"
+      userinfo_endpoint: "http://host.containers.internal:{{OAUTH_SERVER_PORT}}/oauth/userinfo"
+      client_id: "synapse"
+      discover: false
+      scopes: ["profile"]
+      skip_verification: true
+      client_auth_method: none
+      user_mapping_provider:
+          config:
+              display_name_template: "{{ user.name }}"
+
+# Inhibit background updates as this Synapse isn't long-lived
+background_updates:
+    min_batch_size: 100000
+    sleep_duration_ms: 100000
+
+experimental_features:
+    # Needed for e2e/crypto/crypto.spec.ts > Cryptography > decryption failure
+    # messages > non-joined historical messages.
+    # Can be removed after Synapse enables it by default
+    msc4115_membership_on_events: true

playwright/plugins/homeserver/synapse/templates/default/log.config

@@ -0,0 +1,50 @@
+# Log configuration for Synapse.
+#
+# This is a YAML file containing a standard Python logging configuration
+# dictionary. See [1] for details on the valid settings.
+#
+# Synapse also supports structured logging for machine readable logs which can
+# be ingested by ELK stacks. See [2] for details.
+#
+# [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+# [2]: https://matrix-org.github.io/synapse/latest/structured_logging.html
+
+version: 1
+
+formatters:
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+    # A handler that writes logs to stderr. Unused by default, but can be used
+    # instead of "buffer" and "file" in the logger handlers.
+    console:
+        class: logging.StreamHandler
+        formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: DEBUG
+
+    twisted:
+        # We send the twisted logging directly to the file handler,
+        # to work around https://github.com/matrix-org/synapse/issues/3471
+        # when using "buffer" logger. Use "console" to log to stderr instead.
+        handlers: [console]
+        propagate: false
+
+root:
+    level: DEBUG
+
+    # Write logs to the `buffer` handler, which will buffer them together in memory,
+    # then write them to a file.
+    #
+    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
+    # also need to update the configuration for the `twisted` logger above, in
+    # this case.)
+    #
+    handlers: [console]
+
+disable_existing_loggers: false

playwright/plugins/homeserver/synapse/templates/dehydration/README.md

@@ -0,0 +1 @@
+A synapse configured with device dehydration v2 enabled

playwright/plugins/homeserver/synapse/templates/dehydration/homeserver.yaml

@@ -0,0 +1,102 @@
+server_name: "localhost"
+pid_file: /data/homeserver.pid
+public_baseurl: "{{PUBLIC_BASEURL}}"
+listeners:
+    - port: 8008
+      tls: false
+      bind_addresses: ["::"]
+      type: http
+      x_forwarded: true
+
+      resources:
+          - names: [client]
+            compress: false
+
+database:
+    name: "sqlite3"
+    args:
+        database: ":memory:"
+
+log_config: "/data/log.config"
+
+rc_messages_per_second: 10000
+rc_message_burst_count: 10000
+rc_registration:
+    per_second: 10000
+    burst_count: 10000
+rc_joins:
+    local:
+        per_second: 9999
+        burst_count: 9999
+    remote:
+        per_second: 9999
+        burst_count: 9999
+rc_joins_per_room:
+    per_second: 9999
+    burst_count: 9999
+rc_3pid_validation:
+    per_second: 1000
+    burst_count: 1000
+
+rc_invites:
+    per_room:
+        per_second: 1000
+        burst_count: 1000
+    per_user:
+        per_second: 1000
+        burst_count: 1000
+
+rc_login:
+    address:
+        per_second: 10000
+        burst_count: 10000
+    account:
+        per_second: 10000
+        burst_count: 10000
+    failed_attempts:
+        per_second: 10000
+        burst_count: 10000
+
+media_store_path: "/data/media_store"
+uploads_path: "/data/uploads"
+enable_registration: true
+enable_registration_without_verification: true
+disable_msisdn_registration: false
+registration_shared_secret: "{{REGISTRATION_SECRET}}"
+report_stats: false
+macaroon_secret_key: "{{MACAROON_SECRET_KEY}}"
+form_secret: "{{FORM_SECRET}}"
+signing_key_path: "/data/localhost.signing.key"
+
+trusted_key_servers:
+    - server_name: "matrix.org"
+suppress_key_server_warning: true
+
+ui_auth:
+    session_timeout: "300s"
+
+oidc_providers:
+    - idp_id: test
+      idp_name: "OAuth test"
+      issuer: "http://localhost:{{OAUTH_SERVER_PORT}}/oauth"
+      authorization_endpoint: "http://localhost:{{OAUTH_SERVER_PORT}}/oauth/auth.html"
+      # the token endpoint receives requests from synapse, rather than the webapp, so needs to escape the docker container.
+      token_endpoint: "http://host.containers.internal:{{OAUTH_SERVER_PORT}}/oauth/token"
+      userinfo_endpoint: "http://host.containers.internal:{{OAUTH_SERVER_PORT}}/oauth/userinfo"
+      client_id: "synapse"
+      discover: false
+      scopes: ["profile"]
+      skip_verification: true
+      client_auth_method: none
+      user_mapping_provider:
+          config:
+              display_name_template: "{{ user.name }}"
+
+# Inhibit background updates as this Synapse isn't long-lived
+background_updates:
+    min_batch_size: 100000
+    sleep_duration_ms: 100000
+
+experimental_features:
+    msc2697_enabled: false
+    msc3814_enabled: true

playwright/plugins/homeserver/synapse/templates/dehydration/log.config

@@ -0,0 +1,50 @@
+# Log configuration for Synapse.
+#
+# This is a YAML file containing a standard Python logging configuration
+# dictionary. See [1] for details on the valid settings.
+#
+# Synapse also supports structured logging for machine readable logs which can
+# be ingested by ELK stacks. See [2] for details.
+#
+# [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+# [2]: https://matrix-org.github.io/synapse/latest/structured_logging.html
+
+version: 1
+
+formatters:
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+    # A handler that writes logs to stderr. Unused by default, but can be used
+    # instead of "buffer" and "file" in the logger handlers.
+    console:
+        class: logging.StreamHandler
+        formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: DEBUG
+
+    twisted:
+        # We send the twisted logging directly to the file handler,
+        # to work around https://github.com/matrix-org/synapse/issues/3471
+        # when using "buffer" logger. Use "console" to log to stderr instead.
+        handlers: [console]
+        propagate: false
+
+root:
+    level: DEBUG
+
+    # Write logs to the `buffer` handler, which will buffer them together in memory,
+    # then write them to a file.
+    #
+    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
+    # also need to update the configuration for the `twisted` logger above, in
+    # this case.)
+    #
+    handlers: [console]
+
+disable_existing_loggers: false

playwright/plugins/homeserver/synapse/templates/email/README.md

@@ -0,0 +1 @@
+A synapse configured to require an email for registration

playwright/plugins/homeserver/synapse/templates/email/homeserver.yaml

@@ -0,0 +1,44 @@
+server_name: "localhost"
+pid_file: /data/homeserver.pid
+public_baseurl: "{{PUBLIC_BASEURL}}"
+listeners:
+    - port: 8008
+      tls: false
+      bind_addresses: ["::"]
+      type: http
+      x_forwarded: true
+
+      resources:
+          - names: [client]
+            compress: false
+
+database:
+    name: "sqlite3"
+    args:
+        database: ":memory:"
+
+log_config: "/data/log.config"
+
+media_store_path: "/data/media_store"
+uploads_path: "/data/uploads"
+enable_registration: true
+registrations_require_3pid:
+    - email
+registration_shared_secret: "{{REGISTRATION_SECRET}}"
+report_stats: false
+macaroon_secret_key: "{{MACAROON_SECRET_KEY}}"
+form_secret: "{{FORM_SECRET}}"
+signing_key_path: "/data/localhost.signing.key"
+
+trusted_key_servers:
+    - server_name: "matrix.org"
+suppress_key_server_warning: true
+
+ui_auth:
+    session_timeout: "300s"
+
+email:
+    smtp_host: "%SMTP_HOST%"
+    smtp_port: %SMTP_PORT%
+    notif_from: "Your Friendly %(app)s homeserver <noreply@example.com>"
+    app_name: my_branded_matrix_server

playwright/plugins/homeserver/synapse/templates/email/log.config

@@ -0,0 +1,50 @@
+# Log configuration for Synapse.
+#
+# This is a YAML file containing a standard Python logging configuration
+# dictionary. See [1] for details on the valid settings.
+#
+# Synapse also supports structured logging for machine readable logs which can
+# be ingested by ELK stacks. See [2] for details.
+#
+# [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+# [2]: https://matrix-org.github.io/synapse/latest/structured_logging.html
+
+version: 1
+
+formatters:
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+    # A handler that writes logs to stderr. Unused by default, but can be used
+    # instead of "buffer" and "file" in the logger handlers.
+    console:
+        class: logging.StreamHandler
+        formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+
+    twisted:
+        # We send the twisted logging directly to the file handler,
+        # to work around https://github.com/matrix-org/synapse/issues/3471
+        # when using "buffer" logger. Use "console" to log to stderr instead.
+        handlers: [console]
+        propagate: false
+
+root:
+    level: INFO
+
+    # Write logs to the `buffer` handler, which will buffer them together in memory,
+    # then write them to a file.
+    #
+    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
+    # also need to update the configuration for the `twisted` logger above, in
+    # this case.)
+    #
+    handlers: [console]
+
+disable_existing_loggers: false

playwright/plugins/homeserver/synapse/templates/guest-enabled/README.md

@@ -0,0 +1 @@
+A synapse configured with guest registration enabled.

playwright/plugins/homeserver/synapse/templates/guest-enabled/homeserver.yaml

@@ -0,0 +1,105 @@
+server_name: "localhost"
+pid_file: /data/homeserver.pid
+public_baseurl: "{{PUBLIC_BASEURL}}"
+listeners:
+    - port: 8008
+      tls: false
+      bind_addresses: ["::"]
+      type: http
+      x_forwarded: true
+
+      resources:
+          - names: [client]
+            compress: false
+
+database:
+    name: "sqlite3"
+    args:
+        database: ":memory:"
+
+log_config: "/data/log.config"
+
+rc_messages_per_second: 10000
+rc_message_burst_count: 10000
+rc_registration:
+    per_second: 10000
+    burst_count: 10000
+rc_joins:
+    local:
+        per_second: 9999
+        burst_count: 9999
+    remote:
+        per_second: 9999
+        burst_count: 9999
+rc_joins_per_room:
+    per_second: 9999
+    burst_count: 9999
+rc_3pid_validation:
+    per_second: 1000
+    burst_count: 1000
+
+rc_invites:
+    per_room:
+        per_second: 1000
+        burst_count: 1000
+    per_user:
+        per_second: 1000
+        burst_count: 1000
+
+rc_login:
+    address:
+        per_second: 10000
+        burst_count: 10000
+    account:
+        per_second: 10000
+        burst_count: 10000
+    failed_attempts:
+        per_second: 10000
+        burst_count: 10000
+
+media_store_path: "/data/media_store"
+uploads_path: "/data/uploads"
+allow_guest_access: true
+enable_registration: true
+enable_registration_without_verification: true
+disable_msisdn_registration: false
+registration_shared_secret: "{{REGISTRATION_SECRET}}"
+report_stats: false
+macaroon_secret_key: "{{MACAROON_SECRET_KEY}}"
+form_secret: "{{FORM_SECRET}}"
+signing_key_path: "/data/localhost.signing.key"
+
+trusted_key_servers:
+    - server_name: "matrix.org"
+suppress_key_server_warning: true
+
+ui_auth:
+    session_timeout: "300s"
+
+oidc_providers:
+    - idp_id: test
+      idp_name: "OAuth test"
+      issuer: "http://localhost:{{OAUTH_SERVER_PORT}}/oauth"
+      authorization_endpoint: "http://localhost:{{OAUTH_SERVER_PORT}}/oauth/auth.html"
+      # the token endpoint receives requests from synapse, rather than the webapp, so needs to escape the docker container.
+      token_endpoint: "http://host.containers.internal:{{OAUTH_SERVER_PORT}}/oauth/token"
+      userinfo_endpoint: "http://host.containers.internal:{{OAUTH_SERVER_PORT}}/oauth/userinfo"
+      client_id: "synapse"
+      discover: false
+      scopes: ["profile"]
+      skip_verification: true
+      client_auth_method: none
+      user_mapping_provider:
+          config:
+              display_name_template: "{{ user.name }}"
+
+# Inhibit background updates as this Synapse isn't long-lived
+background_updates:
+    min_batch_size: 100000
+    sleep_duration_ms: 100000
+
+experimental_features:
+    # Needed for e2e/crypto/crypto.spec.ts > Cryptography > decryption failure
+    # messages > non-joined historical messages.
+    # Can be removed after Synapse enables it by default
+    msc4115_membership_on_events: true

playwright/plugins/homeserver/synapse/templates/guest-enabled/log.config

@@ -0,0 +1,50 @@
+# Log configuration for Synapse.
+#
+# This is a YAML file containing a standard Python logging configuration
+# dictionary. See [1] for details on the valid settings.
+#
+# Synapse also supports structured logging for machine readable logs which can
+# be ingested by ELK stacks. See [2] for details.
+#
+# [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+# [2]: https://matrix-org.github.io/synapse/latest/structured_logging.html
+
+version: 1
+
+formatters:
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+    # A handler that writes logs to stderr. Unused by default, but can be used
+    # instead of "buffer" and "file" in the logger handlers.
+    console:
+        class: logging.StreamHandler
+        formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: INFO
+
+    twisted:
+        # We send the twisted logging directly to the file handler,
+        # to work around https://github.com/matrix-org/synapse/issues/3471
+        # when using "buffer" logger. Use "console" to log to stderr instead.
+        handlers: [console]
+        propagate: false
+
+root:
+    level: INFO
+
+    # Write logs to the `buffer` handler, which will buffer them together in memory,
+    # then write them to a file.
+    #
+    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
+    # also need to update the configuration for the `twisted` logger above, in
+    # this case.)
+    #
+    handlers: [console]
+
+disable_existing_loggers: false

playwright/plugins/homeserver/synapse/templates/mas-oidc/README.md

@@ -0,0 +1 @@
+A synapse configured with auth delegated to via matrix authentication service

playwright/plugins/homeserver/synapse/templates/mas-oidc/homeserver.yaml

@@ -0,0 +1,194 @@
+server_name: "localhost"
+pid_file: /data/homeserver.pid
+public_baseurl: "{{PUBLIC_BASEURL}}"
+listeners:
+    - port: 8008
+      tls: false
+      bind_addresses: ["::"]
+      type: http
+      x_forwarded: true
+
+      resources:
+          - names: [client]
+            compress: false
+
+database:
+    name: "sqlite3"
+    args:
+        database: ":memory:"
+
+log_config: "/data/log.config"
+
+rc_messages_per_second: 10000
+rc_message_burst_count: 10000
+rc_registration:
+    per_second: 10000
+    burst_count: 10000
+rc_joins:
+    local:
+        per_second: 9999
+        burst_count: 9999
+    remote:
+        per_second: 9999
+        burst_count: 9999
+rc_joins_per_room:
+    per_second: 9999
+    burst_count: 9999
+rc_3pid_validation:
+    per_second: 1000
+    burst_count: 1000
+
+rc_invites:
+    per_room:
+        per_second: 1000
+        burst_count: 1000
+    per_user:
+        per_second: 1000
+        burst_count: 1000
+
+rc_login:
+    address:
+        per_second: 10000
+        burst_count: 10000
+    account:
+        per_second: 10000
+        burst_count: 10000
+    failed_attempts:
+        per_second: 10000
+        burst_count: 10000
+
+media_store_path: "/data/media_store"
+uploads_path: "/data/uploads"
+registration_shared_secret: "{{REGISTRATION_SECRET}}"
+report_stats: false
+macaroon_secret_key: "{{MACAROON_SECRET_KEY}}"
+form_secret: "{{FORM_SECRET}}"
+signing_key_path: "/data/localhost.signing.key"
+
+trusted_key_servers:
+    - server_name: "matrix.org"
+suppress_key_server_warning: true
+
+ui_auth:
+    session_timeout: "300s"
+
+# Inhibit background updates as this Synapse isn't long-lived
+background_updates:
+    min_batch_size: 100000
+    sleep_duration_ms: 100000
+
+serve_server_wellknown: true
+experimental_features:
+    msc3861:
+        enabled: true
+
+        issuer: http://localhost:%MAS_PORT%/
+        # We have to bake in the metadata here as we need to override `introspection_endpoint`
+        issuer_metadata: {
+                "issuer": "http://localhost:%MAS_PORT%/",
+                "authorization_endpoint": "http://localhost:%MAS_PORT%/authorize",
+                "token_endpoint": "http://localhost:%MAS_PORT%/oauth2/token",
+                "jwks_uri": "http://localhost:%MAS_PORT%/oauth2/keys.json",
+                "registration_endpoint": "http://localhost:%MAS_PORT%/oauth2/registration",
+                "scopes_supported": ["openid", "email"],
+                "response_types_supported": ["code", "id_token", "code id_token"],
+                "response_modes_supported": ["form_post", "query", "fragment"],
+                "grant_types_supported":
+                    [
+                        "authorization_code",
+                        "refresh_token",
+                        "client_credentials",
+                        "urn:ietf:params:oauth:grant-type:device_code",
+                    ],
+                "token_endpoint_auth_methods_supported":
+                    ["client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none"],
+                "token_endpoint_auth_signing_alg_values_supported":
+                    [
+                        "HS256",
+                        "HS384",
+                        "HS512",
+                        "RS256",
+                        "RS384",
+                        "RS512",
+                        "PS256",
+                        "PS384",
+                        "PS512",
+                        "ES256",
+                        "ES384",
+                        "ES256K",
+                    ],
+                "revocation_endpoint": "http://localhost:%MAS_PORT%/oauth2/revoke",
+                "revocation_endpoint_auth_methods_supported":
+                    ["client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none"],
+                "revocation_endpoint_auth_signing_alg_values_supported":
+                    [
+                        "HS256",
+                        "HS384",
+                        "HS512",
+                        "RS256",
+                        "RS384",
+                        "RS512",
+                        "PS256",
+                        "PS384",
+                        "PS512",
+                        "ES256",
+                        "ES384",
+                        "ES256K",
+                    ],
+                # This is the only changed value
+                "introspection_endpoint": "http://host.containers.internal:%MAS_PORT%/oauth2/introspect",
+                "introspection_endpoint_auth_methods_supported":
+                    ["client_secret_basic", "client_secret_post", "client_secret_jwt", "private_key_jwt", "none"],
+                "introspection_endpoint_auth_signing_alg_values_supported":
+                    [
+                        "HS256",
+                        "HS384",
+                        "HS512",
+                        "RS256",
+                        "RS384",
+                        "RS512",
+                        "PS256",
+                        "PS384",
+                        "PS512",
+                        "ES256",
+                        "ES384",
+                        "ES256K",
+                    ],
+                "code_challenge_methods_supported": ["plain", "S256"],
+                "userinfo_endpoint": "http://localhost:%MAS_PORT%/oauth2/userinfo",
+                "subject_types_supported": ["public"],
+                "id_token_signing_alg_values_supported":
+                    ["RS256", "RS384", "RS512", "ES256", "ES384", "PS256", "PS384", "PS512", "ES256K"],
+                "userinfo_signing_alg_values_supported":
+                    ["RS256", "RS384", "RS512", "ES256", "ES384", "PS256", "PS384", "PS512", "ES256K"],
+                "display_values_supported": ["page"],
+                "claim_types_supported": ["normal"],
+                "claims_supported": ["iss", "sub", "aud", "iat", "exp", "nonce", "auth_time", "at_hash", "c_hash"],
+                "claims_parameter_supported": false,
+                "request_parameter_supported": false,
+                "request_uri_parameter_supported": false,
+                "prompt_values_supported": ["none", "login", "create"],
+                "device_authorization_endpoint": "http://localhost:%MAS_PORT%/oauth2/device",
+                "org.matrix.matrix-authentication-service.graphql_endpoint": "http://localhost:%MAS_PORT%/graphql",
+                "account_management_uri": "http://localhost:%MAS_PORT%/account/",
+                "account_management_actions_supported":
+                    [
+                        "org.matrix.profile",
+                        "org.matrix.sessions_list",
+                        "org.matrix.session_view",
+                        "org.matrix.session_end",
+                    ],
+            }
+
+        # Matches the `client_id` in the auth service config
+        client_id: 0000000000000000000SYNAPSE
+        # Matches the `client_auth_method` in the auth service config
+        client_auth_method: client_secret_basic
+        # Matches the `client_secret` in the auth service config
+        client_secret: "SomeRandomSecret"
+
+        # Matches the `matrix.secret` in the auth service config
+        admin_token: "AnotherRandomSecret"
+
+        # URL to advertise to clients where users can self-manage their account
+        account_management_url: "http://localhost:%MAS_PORT%/account"

playwright/plugins/homeserver/synapse/templates/mas-oidc/log.config

@@ -0,0 +1,50 @@
+# Log configuration for Synapse.
+#
+# This is a YAML file containing a standard Python logging configuration
+# dictionary. See [1] for details on the valid settings.
+#
+# Synapse also supports structured logging for machine readable logs which can
+# be ingested by ELK stacks. See [2] for details.
+#
+# [1]: https://docs.python.org/3.7/library/logging.config.html#configuration-dictionary-schema
+# [2]: https://matrix-org.github.io/synapse/latest/structured_logging.html
+
+version: 1
+
+formatters:
+    precise:
+        format: '%(asctime)s - %(name)s - %(lineno)d - %(levelname)s - %(request)s - %(message)s'
+
+handlers:
+    # A handler that writes logs to stderr. Unused by default, but can be used
+    # instead of "buffer" and "file" in the logger handlers.
+    console:
+        class: logging.StreamHandler
+        formatter: precise
+
+loggers:
+    synapse.storage.SQL:
+        # beware: increasing this to DEBUG will make synapse log sensitive
+        # information such as access tokens.
+        level: DEBUG
+
+    twisted:
+        # We send the twisted logging directly to the file handler,
+        # to work around https://github.com/matrix-org/synapse/issues/3471
+        # when using "buffer" logger. Use "console" to log to stderr instead.
+        handlers: [console]
+        propagate: false
+
+root:
+    level: DEBUG
+
+    # Write logs to the `buffer` handler, which will buffer them together in memory,
+    # then write them to a file.
+    #
+    # Replace "buffer" with "console" to log to stderr instead. (Note that you'll
+    # also need to update the configuration for the `twisted` logger above, in
+    # this case.)
+    #
+    handlers: [console]
+
+disable_existing_loggers: false

playwright/plugins/mailhog/index.ts

@@ -0,0 +1,47 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import mailhog from "mailhog";
+
+import { getFreePort } from "../utils/port";
+import { Docker } from "../docker";
+
+export interface Instance {
+    host: string;
+    smtpPort: number;
+    httpPort: number;
+    containerId: string;
+}
+
+export class MailHogServer {
+    private readonly docker: Docker = new Docker();
+    private instance?: Instance;
+
+    async start(): Promise<{ api: mailhog.API; instance: Instance }> {
+        if (this.instance) throw new Error("Mailhog server is already running!");
+        const smtpPort = await getFreePort();
+        const httpPort = await getFreePort();
+        console.log(`Starting mailhog...`);
+        const containerId = await this.docker.run({
+            image: "mailhog/mailhog:latest",
+            containerName: `react-sdk-playwright-mailhog`,
+            params: ["-p", `${smtpPort}:1025/tcp`, "-p", `${httpPort}:8025/tcp`],
+        });
+        console.log(`Started mailhog on ports smtp=${smtpPort} http=${httpPort}.`);
+        const host = await this.docker.getContainerIp();
+        this.instance = { smtpPort, httpPort, containerId, host };
+        return { api: mailhog({ host: "localhost", port: httpPort }), instance: this.instance };
+    }
+
+    async stop(): Promise<void> {
+        if (!this.instance) throw new Error("Missing existing mailhog instance, did you call stop() before start()?");
+        await this.docker.stop();
+        console.log(`Stopped mailhog id ${this.instance.containerId}.`);
+        this.instance = undefined;
+    }
+}

playwright/plugins/matrix-authentication-service/config.yaml

@@ -0,0 +1,153 @@
+clients:
+    - client_id: 0000000000000000000SYNAPSE
+      client_auth_method: client_secret_basic
+      client_secret: "SomeRandomSecret"
+http:
+    listeners:
+        - name: web
+          resources:
+              - name: discovery
+              - name: human
+              - name: oauth
+              - name: compat
+              - name: graphql
+                playground: true
+              - name: assets
+                path: /usr/local/share/mas-cli/assets/
+          binds:
+              - address: "[::]:8080"
+          proxy_protocol: false
+        - name: internal
+          resources:
+              - name: health
+          binds:
+              - host: localhost
+                port: 8081
+          proxy_protocol: false
+    trusted_proxies:
+        - 192.128.0.0/16
+        - 172.16.0.0/12
+        - 10.0.0.0/10
+        - 127.0.0.1/8
+        - fd00::/8
+        - ::1/128
+    public_base: "http://localhost:{{MAS_PORT}}/"
+    issuer: http://localhost:{{MAS_PORT}}/
+database:
+    host: "{{POSTGRES_HOST}}"
+    port: 5432
+    database: postgres
+    username: postgres
+    password: "{{POSTGRES_PASSWORD}}"
+    max_connections: 10
+    min_connections: 0
+    connect_timeout: 30
+    idle_timeout: 600
+    max_lifetime: 1800
+telemetry:
+    tracing:
+        exporter: none
+        propagators: []
+    metrics:
+        exporter: none
+    sentry:
+        dsn: null
+templates:
+    path: /usr/local/share/mas-cli/templates/
+    assets_manifest: /usr/local/share/mas-cli/manifest.json
+    translations_path: /usr/local/share/mas-cli/translations/
+email:
+    from: '"Authentication Service" <root@localhost>'
+    reply_to: '"Authentication Service" <root@localhost>'
+    transport: smtp
+    mode: plain
+    hostname: "host.containers.internal"
+    port: %{{SMTP_PORT}}
+    username: username
+    password: password
+
+secrets:
+    encryption: 984b18e207c55ad5fbb2a49b217481a722917ee87b2308d4cf314c83fed8e3b5
+    keys:
+        - kid: YEAhzrKipJ
+          key: |
+              -----BEGIN RSA PRIVATE KEY-----
+              MIIEowIBAAKCAQEAuIV+AW5vx52I4CuumgSxp6yvKfIAnRdALeZZCoFkIGxUli1B
+              S79NJ3ls46oLh1pSD9RrhaMp6HTNoi4K3hnP9Q9v77pD7KwdFKG3UdG1zksIB0s/
+              +/Ey/DmX4LPluwBBS7r/LkQ1jk745lENA++oiDqZf2D/uP8jCHlvaSNyVKTqi1ki
+              OXPd4T4xBUjzuas9ze5jQVSYtfOidgnv1EzUipbIxgvH1jNt4raRlmP8mOq7xEnW
+              R+cF5x6n/g17PdSEfrwO4kz6aKGZuMP5lVlDEEnMHKabFSQDBl7+Mpok6jXutbtA
+              uiBnsKEahF9eoj4na4fpbRNPdIVyoaN5eGvm5wIDAQABAoIBAApyFCYEmHNWaa83
+              CdVSOrRhRDE9r+c0r79pcNT1ajOjrk4qFa4yEC4R46YntCtfY5Hd1pBkIjU0l4d8
+              z8Su9WTMEOwjQUEepS7L0NLi6kXZXYT8L40VpGs+32grBvBFHW0qEtQNrHJ36gMv
+              x2rXoFTF7HaXiSJx3wvVxAbRqOE9tBXLsmNHaWaAdWQG5o77V9+zvMri3cAeEg2w
+              VkKokb0dza7es7xG3tqS26k69SrwGeeuKo7qCHPH2cfyWmY5Yhv8iOoA59JzzbiK
+              UdxyzCHskrPSpRKVkVVwmY3RBt282TmSRG7td7e5ESSj50P2e5BI5uu1Hp/dvU4F
+              vYjV7kECgYEA6WqYoUpVsgQiqhvJwJIc/8gRm0mUy8TenI36z4Iim01Nt7fibWH7
+              XnsFqLGjXtYNVWvBcCrUl9doEnRbJeG2eRGbGKYAWVrOeFvwM4fYvw9GoOiJdDj4
+              cgWDe7eHbHE+UTqR7Nnr/UBfipoNWDh6X68HRBuXowh0Q6tOfxsrRFECgYEAyl/V
+              4b8bFp3pKZZCb+KPSYsQf793cRmrBexPcLWcDPYbMZQADEZ/VLjbrNrpTOWxUWJT
+              hr8MrWswnHO+l5AFu5CNO+QgV2dHLk+2w8qpdpFRPJCfXfo2D3wZ0c4cv3VCwv1V
+              5y7f6XWVjDWZYV4wj6c3shxZJjZ+9Hbhf3/twbcCgYA6fuRRR3fCbRbi2qPtBrEN
+              yO3gpMgNaQEA6vP4HPzfPrhDWmn8T5nXS61XYW03zxz4U1De81zj0K/cMBzHmZFJ
+              NghQXQmpWwBzWVcREvJWr1Vb7erEnaJlsMwKrSvbGWYspSj82oAxr3hCG+lMOpsw
+              b4S6pM+TpAK/EqdRY1WsgQKBgQCGoMaaTRXqL9bC0bEU2XVVCWxKb8c3uEmrwQ7/
+              /fD4NmjUzI5TnDps1CVfkqoNe+hAKddDFqmKXHqUOfOaxDbsFje+lf5l5tDVoDYH
+              fjTKKdYPIm7CiAeauYY7qpA5Vfq52Opixy4yEwUPp0CII67OggFtPaqY3zwJyWQt
+              +57hdQKBgGCXM/KKt7ceUDcNJxSGjvu0zD9D5Sv2ihYlEBT/JLaTCCJdvzREevaJ
+              1d+mpUAt0Lq6A8NWOMq8HPaxAik3rMQ0WtM5iG+XgsUqvTSb7NcshArDLuWGnW3m
+              MC4rM0UBYAS4QweduUSH1imrwH/1Gu5+PxbiecceRMMggWpzu0Bq
+              -----END RSA PRIVATE KEY-----
+        - kid: 8J1AxrlNZT
+          key: |
+              -----BEGIN EC PRIVATE KEY-----
+              MHcCAQEEIF1cjfIOEdy3BXJ72x6fKpEB8WP1ddZAUJAaqqr/6CpToAoGCCqGSM49
+              AwEHoUQDQgAEfHdNuI1Yeh3/uOq2PlnW2vymloOVpwBYebbw4VVsna9xhnutIdQW
+              dE8hkX8Yb0pIDasrDiwllVLzSvsWJAI0Kw==
+              -----END EC PRIVATE KEY-----
+        - kid: 3BW6un1EBi
+          key: |
+              -----BEGIN EC PRIVATE KEY-----
+              MIGkAgEBBDA+3ZV17r8TsiMdw1cpbTSNbyEd5SMy3VS1Mk/kz6O2Ev/3QZut8GE2
+              q3eGtLBoVQigBwYFK4EEACKhZANiAASs8Wxjk/uRimRKXnPr2/wDaXkN9wMDjYQK
+              mZULb+0ZP1/cXmuXuri8hUGhQvIU8KWY9PkpV+LMPEdpE54mHPKSLjq5CDXoSZ/P
+              9f7cdRaOZ000KQPZfIFR9ujJTtDN7Vs=
+              -----END EC PRIVATE KEY-----
+        - kid: pkZ0pTKK0X
+          key: |
+              -----BEGIN EC PRIVATE KEY-----
+              MHQCAQEEIHenfsXYPc5yzjZKUfvmydDR1YRwdsfZYvwHf/2wsYxooAcGBSuBBAAK
+              oUQDQgAEON1x7Vlu+nA0KvC5vYSOHhDUkfLYNZwYSLPFVT02h9E13yFFMIJegIBl
+              Aer+6PMZpPc8ycyeH9N+U9NAyliBhQ==
+              -----END EC PRIVATE KEY-----
+passwords:
+    enabled: true
+    schemes:
+        - version: 1
+          algorithm: argon2id
+matrix:
+    homeserver: localhost
+    secret: AnotherRandomSecret
+    endpoint: "{{SYNAPSE_URL}}"
+policy:
+    wasm_module: /usr/local/share/mas-cli/policy.wasm
+    client_registration_entrypoint: client_registration/violation
+    register_entrypoint: register/violation
+    authorization_grant_entrypoint: authorization_grant/violation
+    password_entrypoint: password/violation
+    email_entrypoint: email/violation
+    data:
+        client_registration:
+            allow_insecure_uris: true # allow non-SSL and localhost URIs
+            allow_missing_contacts: true # EW doesn't have contacts at this time
+upstream_oauth2:
+    providers: []
+branding:
+    service_name: null
+    policy_uri: null
+    tos_uri: null
+    imprint: null
+    logo_uri: null
+experimental:
+    access_token_ttl: 300
+    compat_token_ttl: 300

playwright/plugins/matrix-authentication-service/index.ts

@@ -0,0 +1,151 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import path, { basename } from "node:path";
+import os from "node:os";
+import * as fse from "fs-extra";
+import { BrowserContext, TestInfo } from "@playwright/test";
+
+import { getFreePort } from "../utils/port";
+import { Docker } from "../docker";
+import { PG_PASSWORD, PostgresDocker } from "../postgres";
+import { HomeserverInstance } from "../homeserver";
+import { Instance as MailhogInstance } from "../mailhog";
+
+// Docker tag to use for `ghcr.io/matrix-org/matrix-authentication-service` image.
+// We use a debug tag so that we have a shell and can run all 3 necessary commands in one run.
+const TAG = "0.8.0-debug";
+
+export interface ProxyInstance {
+    containerId: string;
+    postgresId: string;
+    configDir: string;
+    port: number;
+}
+
+async function cfgDirFromTemplate(opts: {
+    postgresHost: string;
+    synapseUrl: string;
+    masPort: string;
+    smtpPort: string;
+}): Promise<{
+    configDir: string;
+}> {
+    const configPath = path.join(__dirname, "config.yaml");
+    const tempDir = await fse.mkdtemp(path.join(os.tmpdir(), "react-sdk-mas-"));
+
+    const outputHomeserver = path.join(tempDir, "config.yaml");
+    console.log(`Gen ${configPath} -> ${outputHomeserver}`);
+    let config = await fse.readFile(configPath, "utf8");
+    config = config.replace(/{{MAS_PORT}}/g, opts.masPort);
+    config = config.replace(/{{POSTGRES_HOST}}/g, opts.postgresHost);
+    config = config.replace(/{{POSTGRES_PASSWORD}}/g, PG_PASSWORD);
+    config = config.replace(/%{{SMTP_PORT}}/g, opts.smtpPort);
+    config = config.replace(/{{SYNAPSE_URL}}/g, opts.synapseUrl);
+
+    await fse.writeFile(outputHomeserver, config);
+
+    // Allow anyone to read, write and execute in the temp directory
+    // so that the DIND setup that we use to update the playwright screenshots work without any issues.
+    await fse.chmod(tempDir, 0o757);
+
+    return {
+        configDir: tempDir,
+    };
+}
+
+export class MatrixAuthenticationService {
+    private readonly masDocker = new Docker();
+    private readonly postgresDocker = new PostgresDocker("mas");
+    private instance: ProxyInstance;
+    public port: number;
+
+    constructor(private context: BrowserContext) {}
+
+    async prepare(): Promise<{ port: number }> {
+        this.port = await getFreePort();
+        return { port: this.port };
+    }
+
+    async start(homeserver: HomeserverInstance, mailhog: MailhogInstance): Promise<ProxyInstance> {
+        console.log(new Date(), "Starting mas...");
+
+        if (!this.port) await this.prepare();
+        const port = this.port;
+        const { containerId: postgresId, ipAddress: postgresIp } = await this.postgresDocker.start();
+        const { configDir } = await cfgDirFromTemplate({
+            masPort: port.toString(),
+            postgresHost: postgresIp,
+            synapseUrl: homeserver.config.dockerUrl,
+            smtpPort: mailhog.smtpPort.toString(),
+        });
+
+        console.log(new Date(), "starting mas container...", TAG);
+        const containerId = await this.masDocker.run({
+            image: "ghcr.io/matrix-org/matrix-authentication-service:" + TAG,
+            containerName: "react-sdk-playwright-mas",
+            params: ["-p", `${port}:8080/tcp`, "-v", `${configDir}:/config`, "--entrypoint", "sh"],
+            cmd: [
+                "-c",
+                "mas-cli database migrate --config /config/config.yaml && " +
+                    "mas-cli config sync --config /config/config.yaml && " +
+                    "mas-cli server --config /config/config.yaml",
+            ],
+        });
+        console.log(new Date(), "started!");
+
+        // Set up redirects
+        const baseUrl = `http://localhost:${port}`;
+        for (const path of [
+            "**/_matrix/client/*/login",
+            "**/_matrix/client/*/login/**",
+            "**/_matrix/client/*/logout",
+            "**/_matrix/client/*/refresh",
+        ]) {
+            await this.context.route(path, async (route) => {
+                await route.continue({
+                    url: new URL(route.request().url().split("/").slice(3).join("/"), baseUrl).href,
+                });
+            });
+        }
+
+        this.instance = { containerId, postgresId, port, configDir };
+        return this.instance;
+    }
+
+    async stop(testInfo: TestInfo): Promise<void> {
+        if (!this.instance) return; // nothing to stop
+        const id = this.instance.containerId;
+        const logPath = path.join("playwright", "logs", "matrix-authentication-service", id);
+        await fse.ensureDir(logPath);
+        await this.masDocker.persistLogsToFile({
+            stdoutFile: path.join(logPath, "stdout.log"),
+            stderrFile: path.join(logPath, "stderr.log"),
+        });
+
+        await this.masDocker.stop();
+        await this.postgresDocker.stop();
+
+        if (testInfo.status !== "passed") {
+            const logs = [path.join(logPath, "stdout.log"), path.join(logPath, "stderr.log")];
+            for (const path of logs) {
+                await testInfo.attach(`mas-${basename(path)}`, {
+                    path,
+                    contentType: "text/plain",
+                });
+            }
+            await testInfo.attach("mas-config.yaml", {
+                path: path.join(this.instance.configDir, "config.yaml"),
+                contentType: "text/plain",
+            });
+        }
+
+        await fse.remove(this.instance.configDir);
+        console.log(new Date(), "Stopped mas.");
+    }
+}

playwright/plugins/oauth_server/README.md

@@ -0,0 +1,24 @@
+# oauth_server
+
+A very simple OAuth identity provider server.
+
+The following endpoints are exposed:
+
+-   `/oauth/auth.html`: An OAuth2 [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).
+    In a proper OAuth2 system, this would prompt the user to log in; we just give a big "Submit" button (and an
+    auth code that can be changed if we want the next step to fail). It redirects back to the calling application
+    with a "code".
+
+-   `/oauth/token`: An OAuth2 [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
+    Receives the code issued by "auth.html" and, if it is valid, exchanges it for an OAuth2 access token.
+
+-   `/oauth/userinfo`: An OAuth2 [userinfo endpoint](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo).
+    Returns details about the owner of the offered access token.
+
+To start the server, do:
+
+```javascript
+cy.task("startOAuthServer").then((port) => {
+    // now we can configure Synapse or Element to talk to the OAuth2 server.
+});
+```

playwright/plugins/oauth_server/index.ts

@@ -0,0 +1,64 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import http from "http";
+import express from "express";
+import { AddressInfo } from "net";
+
+export class OAuthServer {
+    private server?: http.Server;
+
+    public start(): number {
+        if (this.server) this.stop();
+
+        const app = express();
+
+        // static files. This includes the "authorization endpoint".
+        app.use(express.static(__dirname + "/res"));
+
+        // token endpoint (see https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint)
+        app.use("/oauth/token", express.urlencoded({ extended: true }));
+        app.post("/oauth/token", (req, res) => {
+            // if the code is valid, accept it. Otherwise, return an error.
+            const code = req.body.code;
+            if (code === "valid_auth_code") {
+                res.send({
+                    access_token: "oauth_access_token",
+                    token_type: "Bearer",
+                    expires_in: "3600",
+                });
+            } else {
+                res.send({ error: "bad auth code" });
+            }
+        });
+
+        // userinfo endpoint (see https://openid.net/specs/openid-connect-core-1_0.html#UserInfo)
+        app.get("/oauth/userinfo", (req, res) => {
+            // TODO: validate that the request carries an auth header which matches the access token we issued above
+
+            // return an OAuth2 user info object
+            res.send({
+                sub: "alice",
+                name: "Alice",
+            });
+        });
+
+        this.server = http.createServer(app);
+        this.server.listen();
+        const address = this.server.address() as AddressInfo;
+        console.log(`Started OAuth server at ${address.address}:${address.port}`);
+        return address.port;
+    }
+
+    public stop(): void {
+        console.log("Stopping OAuth server");
+        const address = this.server.address() as AddressInfo;
+        this.server.close();
+        console.log(`Stopped OAuth server at ${address.address}:${address.port}`);
+    }
+}

playwright/plugins/oauth_server/res/oauth/auth.html

@@ -0,0 +1,34 @@
+<!--
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+-->
+
+<!--
+A dummy OAuth2 authorization endpoint (see https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint)
+
+Mostly, it just redirects back to the `redirect_uri` in the query params.
+-->
+
+<html lang="en">
+    <body>
+        <h1>Test OAuth page</h1>
+
+        <form id="auth_form">
+            <input type="hidden" id="state" name="state" />
+            <label for="code">Auth Code:</label>
+            <input type="text" id="code" name="code" value="valid_auth_code" />
+            <input type="submit" value="Submit" />
+        </form>
+
+        <script>
+            // process the query params, and set up the form
+            const urlParams = new URLSearchParams(window.location.search);
+            console.log("Test OAuth page: query params:", new Map(urlParams.entries()));
+            document.getElementById("auth_form").action = urlParams.get("redirect_uri");
+            document.getElementById("state").value = urlParams.get("state");
+        </script>
+    </body>
+</html>

playwright/plugins/postgres/index.ts

@@ -0,0 +1,64 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { Docker } from "../docker";
+
+export const PG_PASSWORD = "p4S5w0rD";
+
+/**
+ * Class to manage a postgres database in docker
+ */
+export class PostgresDocker extends Docker {
+    /**
+     * @param key an opaque string to use when naming the docker containers instantiated by this class
+     */
+    public constructor(private key: string) {
+        super();
+    }
+
+    private async waitForPostgresReady(): Promise<void> {
+        const waitTimeMillis = 30000;
+        const startTime = new Date().getTime();
+        let lastErr: Error | null = null;
+        while (new Date().getTime() - startTime < waitTimeMillis) {
+            try {
+                await this.exec(["pg_isready", "-U", "postgres"], true);
+                lastErr = null;
+                break;
+            } catch (err) {
+                console.log("pg_isready: failed");
+                lastErr = err;
+            }
+        }
+        if (lastErr) {
+            console.log("rethrowing");
+            throw lastErr;
+        }
+    }
+
+    public async start(): Promise<{
+        ipAddress: string;
+        containerId: string;
+    }> {
+        console.log(new Date(), "starting postgres container");
+        const containerId = await this.run({
+            image: "postgres",
+            containerName: `react-sdk-playwright-postgres-${this.key}`,
+            params: ["--tmpfs=/pgtmpfs", "-e", "PGDATA=/pgtmpfs", "-e", `POSTGRES_PASSWORD=${PG_PASSWORD}`],
+            // Optimise for testing - https://www.postgresql.org/docs/current/non-durability.html
+            cmd: ["-c", `fsync=off`, "-c", `synchronous_commit=off`, "-c", `full_page_writes=off`],
+        });
+
+        const ipAddress = await this.getContainerIp();
+        console.log(new Date(), "postgres container up");
+
+        await this.waitForPostgresReady();
+        console.log(new Date(), "postgres container ready");
+        return { ipAddress, containerId };
+    }
+}

playwright/plugins/sliding-sync-proxy/index.ts

@@ -0,0 +1,61 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import { getFreePort } from "../utils/port";
+import { Docker } from "../docker";
+import { PG_PASSWORD, PostgresDocker } from "../postgres";
+
+// Docker tag to use for `ghcr.io/matrix-org/sliding-sync` image.
+const SLIDING_SYNC_PROXY_TAG = "v0.99.3";
+
+export interface ProxyInstance {
+    containerId: string;
+    postgresId: string;
+    port: number;
+}
+
+export class SlidingSyncProxy {
+    private readonly proxyDocker = new Docker();
+    private readonly postgresDocker = new PostgresDocker("sliding-sync");
+    private instance: ProxyInstance;
+
+    constructor(private synapseIp: string) {}
+
+    async start(): Promise<ProxyInstance> {
+        console.log(new Date(), "Starting sliding sync proxy...");
+
+        const { ipAddress: postgresIp, containerId: postgresId } = await this.postgresDocker.start();
+
+        const port = await getFreePort();
+        console.log(new Date(), "starting proxy container...", SLIDING_SYNC_PROXY_TAG);
+        const containerId = await this.proxyDocker.run({
+            image: "ghcr.io/matrix-org/sliding-sync:" + SLIDING_SYNC_PROXY_TAG,
+            containerName: "react-sdk-playwright-sliding-sync-proxy",
+            params: [
+                "-p",
+                `${port}:8008/tcp`,
+                "-e",
+                "SYNCV3_SECRET=bwahahaha",
+                "-e",
+                `SYNCV3_SERVER=${this.synapseIp}`,
+                "-e",
+                `SYNCV3_DB=user=postgres dbname=postgres password=${PG_PASSWORD} host=${postgresIp} sslmode=disable`,
+            ],
+        });
+        console.log(new Date(), "started!");
+
+        this.instance = { containerId, postgresId, port };
+        return this.instance;
+    }
+
+    async stop(): Promise<void> {
+        await this.postgresDocker.stop();
+        await this.proxyDocker.stop();
+        console.log(new Date(), "Stopped sliding sync proxy.");
+    }
+}

playwright/plugins/utils/port.ts

@@ -0,0 +1,19 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2022 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import * as net from "net";
+
+export async function getFreePort(): Promise<number> {
+    return new Promise<number>((resolve) => {
+        const srv = net.createServer();
+        srv.listen(0, () => {
+            const port = (<net.AddressInfo>srv.address()).port;
+            srv.close(() => resolve(port));
+        });
+    });
+}

playwright/plugins/utils/rand.ts

@@ -0,0 +1,13 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import crypto from "node:crypto";
+
+export function randB64Bytes(numBytes: number): string {
+    return crypto.randomBytes(numBytes).toString("base64").replace(/=*$/, "");
+}

playwright/plugins/webserver/index.ts

@@ -0,0 +1,38 @@
+/*
+Copyright 2024 New Vector Ltd.
+Copyright 2022 The Matrix.org Foundation C.I.C.
+
+SPDX-License-Identifier: AGPL-3.0-only OR GPL-3.0-only
+Please see LICENSE files in the repository root for full details.
+*/
+
+import * as http from "http";
+import { AddressInfo } from "net";
+
+export class Webserver {
+    private server?: http.Server;
+
+    public start(html: string): string {
+        if (this.server) this.stop();
+
+        this.server = http.createServer((req, res) => {
+            res.writeHead(200, {
+                "Content-Type": "text/html",
+            });
+            res.end(html);
+        });
+        this.server.listen();
+
+        const address = this.server.address() as AddressInfo;
+        console.log(`Started webserver at ${address.address}:${address.port}`);
+        return `http://localhost:${address.port}`;
+    }
+
+    public stop(): void {
+        if (!this.server) return;
+        console.log("Stopping webserver");
+        const address = this.server.address() as AddressInfo;
+        this.server.close();
+        console.log(`Stopped webserver at ${address.address}:${address.port}`);
+    }
+}