Stop synapse from saving messages in device_inbox for hidden devices.

changelog.d/10097.bugfix

@@ -0,0 +1 @@
+Fix a bug which allowed hidden devices to receive send-to-device events.

synapse/storage/databases/main/deviceinbox.py

@@ -487,10 +487,12 @@ def _add_messages_to_local_device_inbox_txn(
             devices = list(messages_by_device.keys())
             if len(devices) == 1 and devices[0] == "*":
                 # Handle wildcard device_ids.
+                # We exclude hidden devices (such as cross-signing keys) here as they are
+                # not expected to receive send-to-device events.
                 devices = self.db_pool.simple_select_onecol_txn(
                     txn,
                     table="devices",
-                    keyvalues={"user_id": user_id},
+                    keyvalues={"user_id": user_id, "hidden": False},
                     retcol="device_id",
                 )
 
@@ -503,10 +505,12 @@ def _add_messages_to_local_device_inbox_txn(
                 if not devices:
                     continue
 
+                # We exclude hidden devices (such as cross-signing keys) here as they are
+                # not expected to receive send-to-device events.
                 rows = self.db_pool.simple_select_many_txn(
                     txn,
                     table="devices",
-                    keyvalues={"user_id": user_id},
+                    keyvalues={"user_id": user_id, "hidden": False},
                     column="device_id",
                     iterable=devices,
                     retcols=("device_id",),

synapse/storage/schema/main/delta/59/14remove_hidden_devices_from_device_inbox.sql

@@ -0,0 +1,20 @@
+/* Copyright 2021 The Matrix.org Foundation C.I.C
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+--- Remove messages to hidden devices from the device_inbox table.
+--- This schould run as the last task, it may take a little bit longer
+--- to finish.
+
+DELETE FROM device_inbox WHERE device_id IN (SELECT device_id FROM devices WHERE hidden = TRUE);