Add comments

synapse/api/auth.py

@@ -103,6 +103,9 @@ class Auth(object):
 
                 # Check the sender's domain has signed the event
                 if not event.signatures.get(sender_domain):
+                    # We allow invites via 3pid to have a sender from a differnt
+                    # HS, as the sender must match the sender of the original
+                    # 3pid invite. This is checked further down.
                     if not is_invite_via_3pid:
                         raise AuthError(403, "Event not signed by sender's server")
 

synapse/handlers/federation.py

@@ -1930,6 +1930,9 @@ class FederationHandler(BaseHandler):
                 "Could not find invite event for third_party_invite: %r",
                 event_dict
             )
+            # We don't discard here as this is not the appropriate place to do
+            # auth checks. If we need the invite and don't have it then the
+            # auth check code will explode appropriately.
 
         builder = self.event_builder_factory.new(event_dict)
         EventValidator().validate_new(builder)