Return 403 when GETing /joined_members after leaving

changelog.d/13374.bugfix

@@ -0,0 +1 @@
+Fixed bug when user tries getting joined_members after already having left the room. Contributed by @andrewdoh.

synapse/handlers/message.py

@@ -319,8 +319,10 @@ async def get_joined_members(self, requester: Requester, room_id: str) -> dict:
                 room_id, user_id, allow_departed_users=True
             )
             if membership != Membership.JOIN:
-                raise NotImplementedError(
-                    "Getting joined members after leaving is not implemented"
+                raise SynapseError(
+                    code=403,
+                    errcode=Codes.FORBIDDEN,
+                    msg="Getting joined members after leaving is forbidden.",
                 )
 
         users_with_profile = await self.store.get_users_in_room_with_profiles(room_id)

tests/rest/admin/test_room.py

@@ -1772,6 +1772,21 @@ def _set_canonical_alias(
             tok=admin_user_tok,
         )
 
+    def test_get_joined_members_after_leave_room(self) -> None:
+        """Test that room members can be requested correctly"""
+
+        # create the room
+        user_1 = self.register_user("foo", "pass")
+        user_tok_1 = self.login("foo", "pass")
+        room_id_1 = self.helper.create_room_as(user_1, tok=user_tok_1)
+        self.helper.leave(room_id_1, user_1, tok=user_tok_1)
+
+        # delete the rooms and get joined roomed membership
+        url = f"/_matrix/client/r0/rooms/{room_id_1}/joined_members"
+        channel = self.make_request("GET", url.encode("ascii"), access_token=user_tok_1)
+        self.assertEqual(HTTPStatus.FORBIDDEN, channel.code, msg=channel.json_body)
+        self.assertEqual(Codes.FORBIDDEN, channel.json_body["errcode"])
+
 
 class JoinAliasRoomTestCase(unittest.HomeserverTestCase):