Module fed_rooms 

Federation F1/F2 room layer (storage side, no network).

Profile (documented in the project plan as m4a-fed-1):

• every server that has members in a room keeps a full replica of it and pushes its own users’ events to every other participating server (full mesh), so there is no home-server sequencer and no event DAG;
• a PDU carries an explicit event_id, a content hash and the origin’s signature over the redacted form, so the stored PDU stays verifiable after the ciphertext is dropped (skeleton);
• remote users are rows in matrix_users with negative ids and their real mxids, so membership, sync, receipts and key visibility work unchanged;
• authorization is a minimal membership/power-level check against the local replica; there is no state resolution (concurrent conflicting state changes are last-write-wins per server).

Structs

Ingested

Result of one ingest.

Enums

Mode

How strictly an incoming PDU is authorized.

Functions

create_fed_schema

Tables owned by this layer.

create_replica_room

Create the local replica row for a remote room. No-op if present.

domain_of

Domain part of an mxid (@u:d gives d, ports included).

enqueue

Queue an item for a destination.

ensure_remote_user

Proxy row for a remote user (negative id, real mxid). Idempotent.

export_local_events

Turn new local-sender events in federated rooms into outbox items. Returns how many events were exported.

finalize_pdu

Add hashes and the origin’s signature (over the redacted form).

ingest_pdu

Store one verified PDU into the local replica.

is_remote_mxid

An mxid addressed to another server.

local_state_pdus

State PDUs of the room that this server can vouch for (its own senders’).

pdu_for_event

Signed PDU for a locally created event; stored so it is served unchanged later.

pdu_signer

(signing server, key id) named by a PDU: the sender’s server, first key listed.

redact_pdu

The signed/hash-stable subset of a PDU (Matrix redaction rules, room v11 shape).

relay_pdu

Queue pdu as a normal transaction item for every remote server of the room except exclude.

remote_domains

Domains of remote users that have any membership row in the room.

room_info

Room metadata a remote replica needs (the part that is not event content).

room_is_federated

Whether the room has remote members (federated closed rooms get skeleton redaction).

skeletonize_event

Drop the content of an event but keep its place in the room: the row stays with empty content and the stored PDU becomes its redacted form (which still verifies). Used by retention for federated closed rooms.

store_own_pdu

Store a PDU that a local user created (their own join in a remote room), keeping its id.

users_visible_to_origin

Local users whose keys origin may see: members/invitees of rooms that also have a member on origin.

verify_pdu_with_key

Check a PDU against the signer’s public key. Ok(true): signature and content hash good; Ok(false): signature good but content does not match the hash (caller must drop the content, i.e. keep only the redacted form).