Use NPM Trusted Publishers over token (#2239)

* Use NPM Trusted Publishers over token

due to security changes being enacted next month by npm

* Add changelog entry

* Update npm

.github/workflows/release.yaml

@@ -12,6 +12,9 @@ jobs:
     defaults:
       run:
         working-directory: packages/npm
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: 🧮 Checkout code
         uses: actions/checkout@v4
@@ -23,6 +26,10 @@ jobs:
           cache-dependency-path: packages/npm/yarn.lock
           registry-url: "https://registry.npmjs.org"
 
+      # Ensure npm 11.5.1 or later is installed
+      - name: Update npm
+        run: npm install -g npm@latest
+
       - name: 🔨 Install dependencies
         run: "yarn install --frozen-lockfile"
 
@@ -33,10 +40,4 @@ jobs:
           VERSION: ${{ github.event.release.tag_name }}.0
 
       - name: 🚀 Publish to npm
-        id: npm-publish
+        run: npm publish --provenance --access public --tag latest
-        uses: JS-DevTools/npm-publish@19c28f1ef146469e409470805ea4279d47c3d35c # v3.1.1
-        with:
-          token: ${{ secrets.NPM_TOKEN }}
-          package: packages/npm
-          access: public
-          ignore-scripts: false

changelogs/client_server/newsfragments/2231.clarification

@@ -0,0 +1 @@
+Clarify the special casing of membership events and redactions in power levels.

changelogs/internal/newsfragments/2239.clarification

@@ -0,0 +1 @@
+Use NPM Trusted Publishers for publishing `@matrix-org/spec` to npm.

data/api/client-server/redaction.yaml

@@ -26,9 +26,9 @@ paths:
         This cannot be undone.
 
         Any user with a power level greater than or equal to the `m.room.redaction`
-        event power level may send redaction events in the room. If the user's power
+        event power level may send redactions for their own events in the room. If
-        level is also greater than or equal to the `redact` power level of the room,
+        the user's power level is also greater than or equal to the `redact` power
-        the user may redact events sent by other users.
+        level of the room, the user may redact events sent by other users.
 
         Server administrators may redact events sent by users on their server.
       operationId: redactEvent

data/event-schemas/schema/m.room.power_levels.yaml

@@ -13,24 +13,34 @@ description: |-
   0. If the room contains no `m.room.power_levels` event, the room's creator has
   a power level of 100, and all other users have a power level of 0.
 
-  The level required to send a certain event is governed by `events`,
+  Except for membership events and redactions, the level required to
-  `state_default` and `events_default`. If an event type is specified in
+  send a certain event is governed purely by `events`, `state_default`
-  `events`, then the user must have at least the level specified in order to
+  and `events_default`. If an event type is specified in `events`, then
-  send that event. If the event type is not supplied, it defaults to
+  the user must have at least the level specified in order to send that
-  `events_default` for Message Events and `state_default` for State
+  event. If the event type is not supplied, it defaults to `events_default`
-  Events.
+  for message events and `state_default` for state events.
 
   If there is no `state_default` in the `m.room.power_levels` event, or
   there is no `m.room.power_levels` event, the `state_default` is 50.
   If there is no `events_default` in the `m.room.power_levels` event,
   or there is no `m.room.power_levels` event, the `events_default` is 0.
 
-  The power level required to invite a user to the room, kick a user from the
+  Membership events are not subject to `events`, `events_default`, or
-  room, ban a user from the room, or redact an event sent by another user, is
+  `state_default`. Instead, the power level required to invite a user
-  defined by `invite`, `kick`, `ban`, and `redact`, respectively.  The levels
+  to the room, kick a user from the room, or ban a user from the room
-  for `kick`, `ban` and `redact` default to 50 if they are not specified in the
+  is defined by `invite`, `kick`, and `ban`, respectively. The levels
-  `m.room.power_levels` event, or if the room contains no `m.room.power_levels`
+  for `kick` and `ban` default to 50 if they are not specified in the
-  event. `invite` defaults to 0 in either case.
+  `m.room.power_levels` event, or if the room contains no
+  `m.room.power_levels` event. `invite` defaults to 0 in either case.
+  Other membership values are handled during event authorization. See
+  the authorization rules in [room versions](/rooms) for further details.
+
+  For redactions of a user's own events, the required power level is
+  determined by the `m.room.redaction` event power level, as per `events`
+  and `events_default`. The power level required to redact an event sent
+  by another user is _additionally_ governed by `redact`. The level for
+  `redact` defaults to 50 if it is not specified in the `m.room.power_levels`
+  event, or if the room contains no `m.room.power_levels` event.
 
   **Note:**