Add Admin API endpoints to list, fetch and delete room reports by H-Shay · Pull Request #19648 · element-hq/synapse

H-Shay · 2026-04-03T22:28:17Z

Adds Admin API endpoints to manage room reports. Follow on from #17270, which added the endpoints to report rooms.

H-Shay · 2026-04-14T19:25:05Z

test failure looks to be flake

MadLittleMods

Not a full review

MadLittleMods · 2026-05-27T17:02:36Z

+        }
+    ],
+    "next_batch": 2,
+    "total": 4


We should consider if total is worth returning (probably not) given the COUNT(*) will have to scan the whole table.

I'm guessing this was done to match the event reports endpoint (introduced in matrix-org/synapse#8217).

It's useful to know the total number of reports associated with a given room or user id. The speed of the query is much less of a concern.

It's useful (same reason offset pagination is useful) but it paints ourselves into a corner. At some scale, this gets too slow to use (on top of the resource strain on the database).

See https://wiki.postgresql.org/wiki/Count_estimate

In this case, we can get our own count estimate by just looking at the stream id. Overall, I think we should just skip. If it's something necessary, it can be introduced in its own PR with its own justifications and analysis.

Looking at the id does not give the number of reports a given user has submitted or are against a given room, which the current count does (when provided the relevant filter). These are both signals that are actively used in production (for events, but we would use them for rooms as soon as this endpoint is available) so I guess this needs to be moved to another PR if it's an absolute blocker for this PR.

Removed in a935f33

MadLittleMods · 2026-06-02T19:40:47Z

            "get_event_reports_paginate", _get_event_reports_paginate_txn
        )

+    async def delete_room_report(self, report_id: int) -> bool:


fixed in bbf7ad9

MadLittleMods · 2026-06-02T20:35:23Z

+        self.assertEqual(400, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.INVALID_PARAM, channel.json_body["errcode"])
+        self.assertEqual(
+            "The report_id parameter must be a string representing a positive integer.",


Suggested change

"The report_id parameter must be a string representing a positive integer.",

"The report_id parameter must be a string representing a room report ID (positive integer).",

Ohh, this is checking the human readable error. I thought this was the assertion message when this failed.

We should shy away from asserting human readable messages as they change over time, can be translated, etc.

MadLittleMods · 2026-06-02T20:37:05Z

+        # first created room report gets `id`=2
+        self.url = "/_synapse/admin/v1/room_reports/2"


Suggested change

# first created room report gets `id`=2

self.url = "/_synapse/admin/v1/room_reports/2"

# first created room report gets `id`=2

self.fetch_report_url = "/_synapse/admin/v1/room_reports/2"

Updated ✅

H-Shay · 2026-06-03T21:37:30Z

Test failure is surprising but not related to this PR AFAICT. The test changes are split over two commits so I am not going to link them in each comment, but everything else should have a response.

MadLittleMods · 2026-06-03T22:06:22Z

+    ) -> tuple[int, JsonDict]:
+        await assert_requester_is_admin(self._auth, request)
+
+        message = "The report_id parameter must be a string representing a room report ID (positive integer)."


Might as well inline this or at-least move this to where its used

MadLittleMods · 2026-06-03T22:13:54Z

+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+
+    def _check_fields(self, content: list[JsonDict]) -> None:


It looks like there is an update but it's not quite what I had in mind.

I'd expect to just match the report ID's in order.

And then _check_expected_room_report_fields(...) would be like the previous _check_fields(...) which checked the shape.

And we would have:

def _check_expected_room_reports_response(self, response_json: JsonDict) -> None: for room_report in todo: _check_expected_room_report_fields(room_report)

MadLittleMods · 2026-06-03T22:26:53Z

+        self._check_expected_room_report_fields(
+            channel.json_body["room_reports"], [self.room_reports[3]]
+        )
+


Sanity check reports returned are for the room

MadLittleMods · 2026-06-03T22:27:13Z

+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        second_page = channel.json_body["room_reports"]
+        self.assertEqual(len(second_page), 5)
+        self.assertNotIn("next_batch", channel.json_body)


Suggested change

self.assertNotIn("next_batch", channel.json_body)

# Nothing more to paginate

self.assertNotIn("next_batch", channel.json_body)

MadLittleMods · 2026-06-03T22:28:49Z

+            shorthand=False,
+        )
+        self.assertEqual(200, channel.code, msg=channel.json_body)
+        # there is no endpoint to get the id of a room report, so we fetch it from the db


This is a bit unfortunate. I assumed that submitting a report would return some sort of ID.

synapse/synapse/rest/client/reporting.py

Line 164 in 003febe

return 200, {}

MadLittleMods · 2026-06-03T22:31:19Z

+            self.hs.get_datastores().main.db_pool.simple_select_one(
+                table="room_reports",
+                keyvalues={"room_id": room_id},
+                retcols=("id",),
+                allow_none=False,
+            )


This looks sketchy as it doesn't define a ORDER.

If sorting is not chosen, the rows will be returned in an unspecified order

-- https://www.postgresql.org/docs/current/queries-order.html

is this a concern if there are no duplicate rows? each room_id reported is unique, and the underlying transaction raises an error if more than one row matches, eg:

synapse/synapse/storage/database.py

Line 2294 in 003febe

raise StoreError(500, "More than one row matched (%s)" % (table,))

As far as I can tell, you can have multiple reports per room and per user.

We should have a query that makes sure we grab the latest report from the given user/room.

MadLittleMods · 2026-06-03T22:32:08Z

+            self.hs.get_datastores().main.db_pool.simple_delete(
+                "room_stats_state",
+                {"room_id": self.room_reports[1]["room_id"]},
+                desc="_",


We can have a good description like test_delete_room_from_room_stats_state

H-Shay added 3 commits April 3, 2026 15:22

add database calls to fetch/delete room reports

558d08f

add admin endpoints to fetch/delete room reports

8987534

tests

2634ed3

H-Shay requested a review from a team as a code owner April 3, 2026 22:28

newsfragment

28c35fb

H-Shay changed the title ~~Add admin endpoints to list, fetch and delete room reports~~ Add Admin API endpoints to list, fetch and delete room reports Apr 3, 2026

MadLittleMods added A-Admin-API A-Abuse Reports, media quarantine, policy servers, etc labels Apr 7, 2026

small fixes

d5742d5

MadLittleMods reviewed May 15, 2026

View reviewed changes

Comment thread synapse/storage/databases/main/room.py Outdated

Comment thread synapse/rest/admin/room_reports.py

H-Shay added 2 commits May 18, 2026 10:59

add documentation for endpoint

eaea03f

Merge branch 'develop' into shay/room_report_endpoint

5984e08

H-Shay requested a review from MadLittleMods May 18, 2026 18:47

MadLittleMods reviewed May 19, 2026

View reviewed changes

H-Shay added 5 commits May 26, 2026 13:27

use next_batch

1d1ca66

don't check for ids less than 0

58e2c04

align pagination with spec and don't use offset

38debcf

add indexes on room_reports for columns we filter on

80e4ceb

update tests

0f1c2ef

H-Shay requested a review from MadLittleMods May 26, 2026 21:42

MadLittleMods reviewed May 27, 2026

View reviewed changes

turt2live mentioned this pull request Jun 1, 2026

Add admin API for fetching room reports #18253

Closed

3 tasks

H-Shay added 7 commits June 1, 2026 11:57

add comment on total room report count returned

d5edac4

paginate with id vs timestamp

2fe0a9b

force keyword args

e0061ed

remove extra trainling slashes

0f89f24

use exact matches rather than LIKE

e1896fb

remove deletion endpoint

63f3632

fix docs

081610c

H-Shay requested a review from MadLittleMods June 1, 2026 22:02

remove total count

a935f33

MadLittleMods reviewed Jun 2, 2026

View reviewed changes

H-Shay added 4 commits June 3, 2026 12:33

endpoint and database changes

bbf7ad9

changes to docs and newsfragment

52af00b

changes to tests

2a78664

more test cleanup

64c3023

H-Shay requested a review from MadLittleMods June 3, 2026 21:37

MadLittleMods reviewed Jun 3, 2026

View reviewed changes

	"The report_id parameter must be a string representing a positive integer.",
	"The report_id parameter must be a string representing a room report ID (positive integer).",

		# first created room report gets `id`=2
		self.url = "/_synapse/admin/v1/room_reports/2"

	self.assertNotIn("next_batch", channel.json_body)
	# Nothing more to paginate
	self.assertNotIn("next_batch", channel.json_body)

Uh oh!

Conversation

H-Shay commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

H-Shay commented Apr 14, 2026

Uh oh!

MadLittleMods left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MadLittleMods Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

H-Shay commented Jun 3, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

H-Shay commented Apr 3, 2026 •

edited

Loading

MadLittleMods Jun 2, 2026 •

edited

Loading