Allow rejecting invites

This is done by using the same /leave flow as you would use if you had
already accepted the invite and wanted to leave.

1 files changed, 5 insertions, 1 deletions

diff --git a/synapse/api/auth.py b/synapse/api/auth.py

index cf19eda4e9..494c8ac3d4 100644
--- a/synapse/api/auth.py
+++ b/synapse/api/auth.py
@@ -308,7 +308,11 @@ class Auth(object):
         )
 
         if Membership.JOIN != membership:
-            # JOIN is the only action you can perform if you're not in the room
+            if (caller_invited
+                    and Membership.LEAVE == membership
+                    and target_user_id == event.user_id):
+                return True
+
             if not caller_in_room:  # caller isn't joined
                 raise AuthError(
                     403,