Ensure we check powerlevel/origin before redacting an event

roomserver/storage/shared/storage.go

@@ -823,13 +823,38 @@ func (d *Database) handleRedactions(
 		return nil, "", nil
 	}
 
+	// Get the power level from the database, so we can verify the user is allowed to redact the event
+	powerLevels, err := d.GetStateEvent(ctx, event.RoomID(), gomatrixserverlib.MRoomPowerLevels, "")
+	if err != nil {
+		return nil, "", fmt.Errorf("d.GetStateEvent: %w", err)
+	}
+	pl, err := powerLevels.PowerLevels()
+	if err != nil {
+		return nil, "", fmt.Errorf("unable to get powerlevels for room: %w", err)
+	}
+	redactPL := pl.Redact
+	redactUser := pl.Users[redactionEvent.Sender()]
+	// The power level of the redaction event’s sender is greater than or equal to the redact level.
+	userAllowed := redactUser >= redactPL
+	// The domain of the redaction event’s sender matches that of the original event’s sender.
+	originAllowed := redactedEvent.Origin() == redactionEvent.Origin()
+	if !originAllowed && !userAllowed {
+		return nil, "", nil
+	}
+
 	// mark the event as redacted
+	if redactionsArePermanent {
+		redactedEvent.Event = redactedEvent.Redact()
+	}
+
 	err = redactedEvent.SetUnsignedField("redacted_because", redactionEvent)
 	if err != nil {
 		return nil, "", fmt.Errorf("redactedEvent.SetUnsignedField: %w", err)
 	}
-	if redactionsArePermanent {
+	// NOTSPEC: sytest relies on this unspecced field existing :(
-		redactedEvent.Event = redactedEvent.Redact()
+	err = redactedEvent.SetUnsignedField("redacted_by", redactionEvent.EventID())
+	if err != nil {
+		return nil, "", fmt.Errorf("redactedEvent.SetUnsignedField: %w", err)
 	}
 	// overwrite the eventJSON table
 	err = d.EventJSONTable.InsertEventJSON(ctx, txn, redactedEvent.EventNID, redactedEvent.JSON())