Comment on why the auth events are passed separately from the event

src/github.com/matrix-org/dendrite/roomserver/api/input.go

@@ -31,6 +31,10 @@ type InputRoomEvent struct {
 	// The event JSON for the event to add.
 	Event []byte
 	// List of state event IDs that authenticate this event.
+	// These are likely derived from the "auth_events" JSON key of the event.
+	// But can be different because the "auth_events" key can be incomplete or wrong.
+	// For example many matrix events forget to reference the m.room.create event even though it is needed for auth.
+	// (since synapse allows this to happen we have to allow it as well.)
 	AuthEventIDs []string
 	// Optional list of state event IDs forming the state before this event.
 	// These state events must have already been persisted.

src/github.com/matrix-org/dendrite/roomserver/input/events.go

@@ -31,7 +31,7 @@ func processRoomEvent(db RoomEventDatabase, input api.InputRoomEvent) error {
 		return err
 	}
 
-	// Check that the event passes authentication checks.
+	// Check that the event passes authentication checks and work out the numeric IDs for the auth events.
 	authEventNIDs, err := checkAuthEvents(db, event, input.AuthEventIDs)
 	if err != nil {
 		return err