Bot crashes with duplicate auth_events when rejoining a federated room after being removed

[milad2golnia]

Describe the bug
When a bot built with @vector-im/matrix-bot-sdk attempts to re-join a federated room it was previously removed from, the join request fails with a M_FORBIDDEN error from Synapse:

Event <event_id> has duplicate auth_events for ('m.room.member', '<bot_user>')

This causes the bot to crash and remain stuck in an invited state within the room.
This issue occurs in federated rooms across different accounts and bots.

---

To Reproduce

1. Log in to a Matrix account on a federated server (e.g., @vilmil:matrix.org).
2. Create a new room (e.g., join-test) and send a few messages.
3. Invite the bot user (@mybot3:matrix.borna.golgolniamilad.ir).
4. The bot joins successfully.
5. Remove the bot from the room using /remove @mybot3:matrix.borna.golgolniamilad.ir.
6. Re-invite the same bot again.
7. The bot receives the m.room.member invite event but fails to join.
8. The bot exits with the following error:

M_FORBIDDEN: Event <event_id> has duplicate auth_events for ('m.room.member', '@mybot3:matrix.borna.golgolniamilad.ir')

The room membership for the bot remains stuck at "invite".

---

Expected behavior
The bot should cleanly re-join the room after being re-invited, without crashing or hitting duplicate auth_events.
Membership state should transition from invite → join normally, even after previous removal.

---

Log snippet

MatrixError: M_FORBIDDEN: Event $dDSCZSvvUSbiV6luVF2OJ207xjyXzsu91g1dFy9kYsA has duplicate auth_events for ('m.room.member', '@mybot3:matrix.borna.golgolniamilad.ir'): $f75tYW0pWwMNpM7PUUubQWY4vYv9uOQ8Qp1KtS-Zuew and $WVmSrGDOia6JFTs-19Fq1pUDNeVkEKxbaLdCdEnzhZw
    at Object.defaultErrorHandler (/node_modules/@vector-im/matrix-bot-sdk/src/http.ts:9:9)
    at doHttpRequest (/node_modules/@vector-im/matrix-bot-sdk/src/http.ts:119:31)

The bot receives an invite, logs room.invite, then immediately throws this error on join.

---

Code used

import { Logger } from '@nestjs/common'
import {
  AutojoinRoomsMixin,
  MatrixAuth,
  MatrixClient,
  RustSdkCryptoStorageProvider,
  RustSdkCryptoStoreType,
  SimpleFsStorageProvider,
} from '@vector-im/matrix-bot-sdk'
import { mkdir } from 'fs/promises'

function sleep(seconds: number) {
  return new Promise((resolve) => setTimeout(resolve, seconds * 1000))
}

async function authenticate() {
  const auth = new MatrixAuth('https://matrix.borna.golgolniamilad.ir')
  const result = await auth.passwordLogin('mybot3', '34lskFjf_Jfdfsl')
  return result.accessToken
}

async function bootstrap() {
  const accessToken = await authenticate()
  await mkdir('crypto', { recursive: true })

  const storage = new SimpleFsStorageProvider('bot-storage.json')
  const crypto = new RustSdkCryptoStorageProvider('crypto', RustSdkCryptoStoreType.Sqlite)
  const client = new MatrixClient(
    'https://matrix.borna.golgolniamilad.ir',
    accessToken,
    storage,
    crypto,
  )

  AutojoinRoomsMixin.setupOnClient(client)
  await client.start()
  console.log('Bot started')
  await sleep(3600)
}

bootstrap()

---

Additional context

• Homeserver: Synapse 1.126.0 (on matrix.borna.golgolniamilad.ir)
• Client SDK: @vector-im/matrix-bot-sdk v0.7.1-element.8
• Node.js: v22.17.1
• The issue only occurs in federated rooms (rooms hosted on matrix.org, not locally).
• The bot uses persistent SimpleFsStorageProvider and RustSdkCryptoStorageProvider.

---

Suspected cause

It appears that Synapse or the SDK constructs an invalid membership event DAG during re-join in a federated context, producing two conflicting auth chains for the same (m.room.member, user_id) tuple.
The remote server rejects the join event due to this duplication, leaving the membership unresolved.

---

Workarounds attempted

• Clearing bot-storage.json and crypto store (no effect).
• Testing with another bot user (same issue).