Auth rules spec conflicts with C-S API spec about what happens before the first power-levels event

[richvdh]

The auth rules say: 'If there is no previous m.room.power_levels event in the room, allow'. But the C-S API says: 'If the room contains no m.room.power_levels event, the room's creator has a power level of 100, and all other users have a power level of 0' - and makes no exception for power_levels. This is, at best, confusing.

My assumption, working from the C-S spec had been that power-levels above 100 were impossible. We should figure out if PLs above 100 are a supported thing.

[grinapo]

The latter would probably cover the exceptional case where a room has been created but there were no PL structures defined at creation. Apart from that probably all rooms is (and would be) created with m.room.power_level at creation, possibly by using power_level_content_override (c2s) which is specifically there to provide PL structure different from the defaults.

[richvdh]

@grinapo remember that all events have to follow the auth rules, even those created during the room-creation process. The first power-level event (ie, the one created by createRoom) is therefore authorised by other homeservers based on the default power-levels, which are, in theory, those written in the C-S API.

[richvdh]

I don't think there's a conflict here. #5 (comment) explains why it's possible to have PL>100.