@openclaw/crabline 0.1.11 → 0.1.13

package/dist/src/servers/mattermost.js

@@ -1,7 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import path from "node:path";
 import { WebSocket, WebSocketServer } from "ws";
-import { adminAuthError, drainRequestBody, hasAdminToken, InvalidJsonBodyError, isJsonObject, isLoopbackHost, jsonResponse, parseUnknownRequestBody, queryRecord, readTrimmedString, RequestBodyTooLargeError, startHttpJsonServer, } from "./http.js";
+import { adminAuthError, constantTimeTokenEqual, drainRequestBody, hasAdminToken, InvalidJsonBodyError, isJsonObject, isJsonMediaType, isLoopbackHost, jsonResponse, parseUnknownRequestBody, queryRecord, RequestBodyTooLargeError, startHttpJsonServer, } from "./http.js";
 import { recordCommittedServerEvent, recordServerEvent, } from "./recorder.js";
 import { resolveMaxPendingInboundEvents } from "./pending-events.js";
 import { closeWebSocketServer } from "./websocket.js";
@@ -9,6 +9,15 @@ const DEFAULT_WEBSOCKET_AUTHENTICATION_TIMEOUT_MS = 5_000;
 const DEFAULT_MAX_WEBSOCKET_BUFFERED_BYTES = 1024 * 1024;
 const DEFAULT_MAX_WEBSOCKET_MESSAGE_BYTES = 64 * 1024;
 const DEFAULT_MAX_UNAUTHENTICATED_WEBSOCKET_CLIENTS = 32;
+const DEFAULT_MAX_COMMITTED_CHANNELS = 1_000;
+const DEFAULT_MAX_COMMITTED_POSTS = 1_000;
+const DEFAULT_MAX_COMMITTED_STATE_BYTES = 64 * 1024 * 1024;
+const DEFAULT_MAX_COMMITTED_USERS = 1_000;
+const DEFAULT_MAX_PENDING_INBOUND_BYTES = 64 * 1024 * 1024;
+const MATTERMOST_ID_PATTERN = /^[a-z0-9]{26}(?![\s\S])/u;
+const MATTERMOST_USERNAME_PATTERN = /^[a-z0-9._-]{1,64}$/u;
+const MATTERMOST_CHANNEL_TYPES = new Set(["D", "G", "O", "P"]);
+const MATTERMOST_RESTRICTED_USERNAMES = new Set(["all", "channel", "matterbot", "system"]);
 function resolvePositiveLimit(value, name, fallback) {
     if (value === undefined) {
         return fallback;
@@ -26,17 +35,51 @@ async function appendEvent(state, event, committed = false) {
     await (committed ? recordCommittedServerEvent(params) : recordServerEvent(params));
 }
 function authorized(request, token) {
-    const [scheme, value] = request.headers.authorization?.trim().split(/\s+/, 2) ?? [];
-    return scheme?.toLowerCase() === "bearer" && value === token;
+    const providedToken = /^Bearer ([^\s]+)$/iu.exec(request.headers.authorization ?? "")?.[1];
+    return providedToken ? constantTimeTokenEqual(providedToken, token) : false;
 }
-function mattermostError(message, status) {
+function mattermostError(message, status, options = {}) {
     return jsonResponse({
-        id: `api.context.${status}`,
+        detailed_error: "",
+        id: options.id ?? `api.context.${status}.app_error`,
         message,
-        request_id: "",
+        request_id: options.requestId ??
+            mattermostId(`request-${Date.now()}-${Math.random()}-${message}-${status}`),
         status_code: status,
     }, status);
 }
+function readMattermostString(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+function readMattermostMessage(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value : undefined;
+}
+function readMattermostId(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function isMattermostId(value) {
+    return MATTERMOST_ID_PATTERN.test(value);
+}
+function normalizeMattermostUsername(value) {
+    if (typeof value !== "string" || value !== value.trim()) {
+        return undefined;
+    }
+    const normalized = value.toLowerCase();
+    return MATTERMOST_USERNAME_PATTERN.test(normalized) &&
+        !MATTERMOST_RESTRICTED_USERNAMES.has(normalized)
+        ? normalized
+        : undefined;
+}
+function requestHasJsonMediaType(request) {
+    const contentType = request.headers["content-type"];
+    return Array.isArray(contentType)
+        ? contentType.some(isJsonMediaType)
+        : typeof contentType === "string" && isJsonMediaType(contentType);
+}
 function decodeMattermostPathSegment(value) {
     try {
         return decodeURIComponent(value);
@@ -53,22 +96,48 @@ function eventBroadcast(params) {
         user_id: params.userId ?? "",
     };
 }
-function postEvent(event, post, senderName, channelType) {
+function postEvent(event, post, senderName, channel) {
     return {
         event,
-        data: {
-            channel_display_name: post.channel_id,
-            channel_id: post.channel_id,
-            channel_name: post.channel_id,
-            channel_type: channelType,
-            post: JSON.stringify(post),
-            sender_name: senderName,
-        },
-        broadcast: eventBroadcast({ channelId: post.channel_id, userId: post.user_id }),
+        data: event === "posted"
+            ? {
+                channel_display_name: channel.display_name,
+                channel_name: channel.name,
+                channel_type: channel.type,
+                post: JSON.stringify(post),
+                sender_name: senderName,
+                set_online: true,
+                team_id: "",
+            }
+            : { post: JSON.stringify(post) },
+        broadcast: eventBroadcast({ channelId: post.channel_id }),
     };
 }
 function webSocketEventBytes(event) {
-    return Buffer.byteLength(JSON.stringify({ ...event, seq: 0 }), "utf8");
+    return Buffer.byteLength(JSON.stringify({ ...event, seq: Number.MAX_SAFE_INTEGER }), "utf8");
+}
+function retainedValueBytes(value) {
+    const serialized = JSON.stringify(value);
+    return serialized === undefined ? 0 : Buffer.byteLength(serialized, "utf8");
+}
+function retainedValueDelta(previous, next) {
+    return retainedValueBytes(next) - retainedValueBytes(previous);
+}
+function canRetainCommittedValues(state, replacements) {
+    const delta = replacements.reduce((total, [previous, next]) => total + retainedValueDelta(previous, next), 0);
+    return state.committedStateBytes + delta <= state.maxCommittedStateBytes;
+}
+function setCommittedValue(state, values, key, value) {
+    state.committedStateBytes += retainedValueDelta(values.get(key), value);
+    values.set(key, value);
+}
+function deleteCommittedValue(state, values, key) {
+    const previous = values.get(key);
+    if (previous === undefined) {
+        return;
+    }
+    state.committedStateBytes -= retainedValueBytes(previous);
+    values.delete(key);
 }
 function sendEvent(state, client, event) {
     const seq = state.websocketClients.get(client);
@@ -77,8 +146,11 @@ function sendEvent(state, client, event) {
         return false;
     }
     const payload = JSON.stringify({ ...event, seq });
-    if (client.bufferedAmount + Buffer.byteLength(payload, "utf8") >
-        state.maxWebSocketBufferedBytes) {
+    const payloadBytes = Buffer.byteLength(payload, "utf8");
+    if (payloadBytes > state.maxWebSocketBufferedBytes) {
+        return false;
+    }
+    if (client.bufferedAmount + payloadBytes > state.maxWebSocketBufferedBytes) {
         state.websocketClients.delete(client);
         client.close(1013, "client too slow");
         return false;
@@ -121,10 +193,6 @@ function broadcast(state, event, queueIfUndelivered = true) {
         return true;
     }
     if (webSocketEventBytes(event) > state.maxWebSocketBufferedBytes) {
-        for (const client of state.websocketClients.keys()) {
-            state.websocketClients.delete(client);
-            client.close(1013, "client too slow");
-        }
         return false;
     }
     let delivered = false;
@@ -140,7 +208,12 @@ function broadcast(state, event, queueIfUndelivered = true) {
     if (state.pendingEvents.length >= state.maxPendingInboundEvents) {
         return false;
     }
+    const eventBytes = retainedValueBytes(event);
+    if (state.pendingEventBytes + eventBytes > state.maxPendingInboundBytes) {
+        return false;
+    }
     state.pendingEvents.push(event);
+    state.pendingEventBytes += eventBytes;
     return true;
 }
 function pendingQueueFullResponse(state) {
@@ -149,71 +222,207 @@ function pendingQueueFullResponse(state) {
         ok: false,
     }, 503);
 }
-function createPost(params) {
-    const id = mattermostId(`post-${params.state.nextPost++}`);
-    const post = {
+function committedStateFullResponse(resource) {
+    return jsonResponse({
+        error: `Committed Mattermost ${resource} limit reached`,
+        ok: false,
+    }, 503);
+}
+function buildPost(params) {
+    const now = Date.now();
+    return {
         channel_id: params.channelId,
-        create_at: Date.now(),
-        id,
+        create_at: now,
+        delete_at: 0,
+        edit_at: 0,
+        id: params.id,
         message: params.message,
         root_id: params.rootId ?? "",
         type: "",
+        update_at: now,
         user_id: params.userId,
     };
-    params.state.posts.set(id, post);
-    return post;
+}
+function buildNextPost(state, params, reservedId) {
+    let nextPost = state.nextPost;
+    let id;
+    do {
+        id = mattermostId(`post-${nextPost++}`);
+    } while (id === reservedId || state.posts.has(id));
+    return { nextPost, post: buildPost({ ...params, id }) };
+}
+function commitNextPost(state, pending) {
+    state.nextPost = pending.nextPost;
+    setCommittedValue(state, state.posts, pending.post.id, pending.post);
+}
+function commitNextPostIfCapacity(state, pending) {
+    if (!canRetainCommittedValues(state, [[undefined, pending.post]])) {
+        return false;
+    }
+    commitNextPost(state, pending);
+    return true;
+}
+function nextDirectChannelId(state, seed) {
+    let collision = 0;
+    let channelId;
+    do {
+        channelId = mattermostId(collision === 0 ? seed : `${seed}:${collision}`);
+        collision += 1;
+    } while (state.channels.has(channelId));
+    return channelId;
+}
+function webSocketEventTooLargeResponse() {
+    return mattermostError("WebSocket event is too large", 413);
 }
 function handleAdminInbound(params) {
-    const channelId = readTrimmedString(params.body.channelId ?? params.body.channel_id);
-    const senderId = readTrimmedString(params.body.senderId ?? params.body.user_id);
-    const text = readTrimmedString(params.body.text ?? params.body.message);
+    for (const field of ["senderName", "channelType", "rootId", "root_id"]) {
+        if (params.body[field] !== undefined && typeof params.body[field] !== "string") {
+            return jsonResponse({ error: `${field} must be a string`, ok: false }, 400);
+        }
+    }
+    const channelId = readMattermostId(params.body.channelId ?? params.body.channel_id);
+    const senderId = readMattermostId(params.body.senderId ?? params.body.user_id);
+    const text = readMattermostMessage(params.body.text ?? params.body.message);
     if (!channelId || !senderId || !text) {
         return jsonResponse({ error: "channelId, senderId, and text are required", ok: false }, 400);
     }
+    if (!isMattermostId(channelId)) {
+        return jsonResponse({ error: "channelId must be a 26-character Mattermost ID", ok: false }, 400);
+    }
+    if (!isMattermostId(senderId)) {
+        return jsonResponse({ error: "senderId must be a 26-character Mattermost ID", ok: false }, 400);
+    }
+    const rootId = readMattermostId(params.body.rootId ?? params.body.root_id);
+    if (rootId && !isMattermostId(rootId)) {
+        return jsonResponse({ error: "rootId must be a 26-character Mattermost ID", ok: false }, 400);
+    }
+    for (const field of [
+        "channelName",
+        "channel_name",
+        "channelDisplayName",
+        "channel_display_name",
+    ]) {
+        if (params.body[field] !== undefined && typeof params.body[field] !== "string") {
+            return jsonResponse({ error: `${field} must be a string`, ok: false }, 400);
+        }
+    }
     if (params.state.websocketClients.size === 0 &&
         params.state.pendingEvents.length >= params.state.maxPendingInboundEvents) {
         return pendingQueueFullResponse(params.state);
     }
     const previousUser = params.state.users.get(senderId);
     const previousChannel = params.state.channels.get(channelId);
-    const senderName = readTrimmedString(params.body.senderName) ?? previousUser?.username ?? senderId;
-    const channelType = readTrimmedString(params.body.channelType) ?? previousChannel?.type ?? "D";
-    const previousNextPost = params.state.nextPost;
-    params.state.users.set(senderId, { id: senderId, update_at: Date.now(), username: senderName });
-    params.state.channels.set(channelId, {
-        display_name: previousChannel?.display_name ?? channelId,
+    const senderName = params.body.senderName === undefined
+        ? (previousUser?.username ?? senderId)
+        : normalizeMattermostUsername(params.body.senderName);
+    if (!senderName) {
+        return jsonResponse({ error: "senderName must be a valid Mattermost username", ok: false }, 400);
+    }
+    if (senderId === params.state.botUserId && senderName !== params.state.botUsername) {
+        return jsonResponse({ error: "senderName must match the configured bot username", ok: false }, 400);
+    }
+    const usernameOwner = params.state.userIdsByUsername.get(senderName);
+    if (usernameOwner && usernameOwner !== senderId) {
+        return jsonResponse({ error: "senderName is already in use", ok: false }, 400);
+    }
+    const channelType = params.body.channelType === undefined
+        ? (previousChannel?.type ?? "D")
+        : readMattermostString(params.body.channelType);
+    if (!channelType || !MATTERMOST_CHANNEL_TYPES.has(channelType)) {
+        return jsonResponse({ error: "channelType is not supported", ok: false }, 400);
+    }
+    const channelName = readMattermostString(params.body.channelName ?? params.body.channel_name) ??
+        previousChannel?.name ??
+        channelId;
+    const channelDisplayName = readMattermostString(params.body.channelDisplayName ?? params.body.channel_display_name) ??
+        previousChannel?.display_name ??
+        channelName;
+    const channel = {
+        display_name: channelDisplayName,
         id: channelId,
-        name: previousChannel?.name ?? channelId,
+        name: channelName,
         type: channelType,
-    });
-    const post = createPost({
+    };
+    const existingRoot = rootId ? params.state.posts.get(rootId) : undefined;
+    if (existingRoot && existingRoot.channel_id !== channelId) {
+        return jsonResponse({ error: "Root post belongs to another channel", ok: false }, 400);
+    }
+    if (existingRoot?.root_id) {
+        return jsonResponse({ error: "Root post is itself a reply", ok: false }, 400);
+    }
+    if (!previousUser && params.state.users.size >= params.state.maxCommittedUsers) {
+        return committedStateFullResponse("users");
+    }
+    if (!previousChannel && params.state.channels.size >= params.state.maxCommittedChannels) {
+        return committedStateFullResponse("channels");
+    }
+    // buildNextPost always allocates a fresh ID, including against a synthesized root.
+    const requiredPostSlots = 1 + (rootId && !existingRoot ? 1 : 0);
+    if (params.state.posts.size + requiredPostSlots > params.state.maxCommittedPosts) {
+        return committedStateFullResponse("posts");
+    }
+    const rootPost = rootId && !existingRoot
+        ? buildPost({
+            channelId,
+            id: rootId,
+            message: "",
+            userId: senderId,
+        })
+        : undefined;
+    const pendingPost = buildNextPost(params.state, {
         channelId,
         message: text,
-        rootId: readTrimmedString(params.body.rootId ?? params.body.root_id),
-        state: params.state,
+        rootId,
         userId: senderId,
-    });
+    }, rootPost?.id);
+    const { post } = pendingPost;
+    const user = { id: senderId, update_at: Date.now(), username: senderName };
+    if (!canRetainCommittedValues(params.state, [
+        [previousUser, user],
+        [previousChannel, channel],
+        [undefined, rootPost],
+        [undefined, post],
+    ])) {
+        return committedStateFullResponse("state");
+    }
+    const event = postEvent("posted", post, senderName, channel);
+    if (webSocketEventBytes(event) > params.state.maxWebSocketBufferedBytes) {
+        return jsonResponse({ error: "Inbound event is too large", ok: false }, 413);
+    }
+    const previousNextPost = params.state.nextPost;
+    if (previousUser?.username !== senderName) {
+        params.state.userIdsByUsername.delete(previousUser?.username ?? "");
+    }
+    params.state.userIdsByUsername.set(senderName, senderId);
+    setCommittedValue(params.state, params.state.users, senderId, user);
+    setCommittedValue(params.state, params.state.channels, channelId, channel);
+    if (rootPost) {
+        setCommittedValue(params.state, params.state.posts, rootPost.id, rootPost);
+    }
+    commitNextPost(params.state, pendingPost);
     const rollback = () => {
-        params.state.posts.delete(post.id);
+        deleteCommittedValue(params.state, params.state.posts, post.id);
+        if (rootPost) {
+            deleteCommittedValue(params.state, params.state.posts, rootPost.id);
+        }
         params.state.nextPost = previousNextPost;
         if (previousUser) {
-            params.state.users.set(senderId, previousUser);
+            setCommittedValue(params.state, params.state.users, senderId, previousUser);
+            params.state.userIdsByUsername.set(previousUser.username, senderId);
         }
         else {
-            params.state.users.delete(senderId);
+            deleteCommittedValue(params.state, params.state.users, senderId);
+        }
+        if (previousUser?.username !== senderName) {
+            params.state.userIdsByUsername.delete(senderName);
         }
         if (previousChannel) {
-            params.state.channels.set(channelId, previousChannel);
+            setCommittedValue(params.state, params.state.channels, channelId, previousChannel);
         }
         else {
-            params.state.channels.delete(channelId);
+            deleteCommittedValue(params.state, params.state.channels, channelId);
         }
     };
-    const event = postEvent("posted", post, senderName, channelType);
-    if (webSocketEventBytes(event) > params.state.maxWebSocketBufferedBytes) {
-        rollback();
-        return jsonResponse({ error: "Inbound event is too large", ok: false }, 413);
-    }
     if (!broadcast(params.state, event)) {
         rollback();
         return pendingQueueFullResponse(params.state);
@@ -231,7 +440,8 @@ async function handleApi(params) {
         if (username instanceof Response) {
             return username;
         }
-        const user = [...state.users.values()].find((entry) => entry.username === username);
+        const userId = state.userIdsByUsername.get(username.toLowerCase());
+        const user = userId ? state.users.get(userId) : undefined;
         return user ? jsonResponse(user) : mattermostError("User not found", 404);
     }
     const userMatch = /^\/users\/([^/]+)$/u.exec(apiPath);
@@ -245,7 +455,7 @@ async function handleApi(params) {
         return channel ? jsonResponse(channel) : mattermostError("Channel not found", 404);
     }
     if (method === "POST" && apiPath === "/channels/direct") {
-        const userIds = Array.isArray(body) ? body.map(readTrimmedString) : [];
+        const userIds = Array.isArray(body) ? body.map(readMattermostId) : [];
         if (userIds.length !== 2 || userIds.some((value) => !value)) {
             return mattermostError("Two user IDs are required", 400);
         }
@@ -259,22 +469,38 @@ async function handleApi(params) {
         if (firstUserId !== state.botUserId && secondUserId !== state.botUserId) {
             return mattermostError("Authenticated user must belong to the direct channel", 403);
         }
-        const channelId = mattermostId(`dm:${userIds.sort().join(":")}`);
-        const channel = { display_name: "", id: channelId, name: channelId, type: "D" };
-        state.channels.set(channelId, channel);
+        const participantIds = [...userIds].sort();
+        const channelName = participantIds.join("__");
+        const existingChannel = [...state.channels.values()].find((channel) => channel.type === "D" && channel.name === channelName);
+        if (existingChannel) {
+            return jsonResponse(existingChannel, 201);
+        }
+        if (state.channels.size >= state.maxCommittedChannels) {
+            return mattermostError("Too many retained channels", 503);
+        }
+        const channelId = nextDirectChannelId(state, `dm:${participantIds.join(":")}`);
+        const channel = { display_name: "", id: channelId, name: channelName, type: "D" };
+        if (!canRetainCommittedValues(state, [[undefined, channel]])) {
+            return mattermostError("Too much retained state", 503);
+        }
+        setCommittedValue(state, state.channels, channelId, channel);
         return jsonResponse(channel, 201);
     }
     if (!isJsonObject(body)) {
         return mattermostError("Request body must be a JSON object", 400);
     }
     if (method === "POST" && apiPath === "/users/me/typing") {
-        const channelId = readTrimmedString(body.channel_id);
+        const channelId = readMattermostId(body.channel_id);
         if (!channelId) {
             return mattermostError("channel_id is required", 400);
         }
+        if (body.parent_id !== undefined && typeof body.parent_id !== "string") {
+            return mattermostError("parent_id must be a string", 400);
+        }
         if (!state.channels.has(channelId)) {
             return mattermostError("Channel not found", 404);
         }
+        const parentId = readMattermostId(body.parent_id);
         broadcast(state, {
             broadcast: eventBroadcast({
                 channelId,
@@ -282,9 +508,7 @@ async function handleApi(params) {
             }),
             data: {
                 channel_id: channelId,
-                ...(readTrimmedString(body.parent_id)
-                    ? { parent_id: readTrimmedString(body.parent_id) }
-                    : {}),
+                ...(parentId ? { parent_id: parentId } : {}),
                 user_id: state.botUserId,
             },
             event: "typing",
@@ -292,16 +516,19 @@ async function handleApi(params) {
         return jsonResponse({ status: "OK" });
     }
     if (method === "POST" && apiPath === "/posts") {
-        const channelId = readTrimmedString(body.channel_id);
-        const message = readTrimmedString(body.message);
+        const channelId = readMattermostId(body.channel_id);
+        const message = readMattermostMessage(body.message);
         if (!channelId || !message) {
             return mattermostError("channel_id and message are required", 400);
         }
+        const rootId = readMattermostId(body.root_id);
+        if (body.root_id !== undefined && typeof body.root_id !== "string") {
+            return mattermostError("root_id must be a string", 400);
+        }
         const channel = state.channels.get(channelId);
         if (!channel) {
             return mattermostError("Channel not found", 404);
         }
-        const rootId = readTrimmedString(body.root_id);
         if (rootId) {
             const rootPost = state.posts.get(rootId);
             if (!rootPost) {
@@ -310,15 +537,25 @@ async function handleApi(params) {
             if (rootPost.channel_id !== channelId) {
                 return mattermostError("Root post belongs to another channel", 400);
             }
+            if (rootPost.root_id) {
+                return mattermostError("Root post is itself a reply", 400);
+            }
         }
-        const post = createPost({
+        if (state.posts.size >= state.maxCommittedPosts) {
+            return mattermostError("Too many retained posts", 503);
+        }
+        const pendingPost = buildNextPost(state, {
             channelId,
             message,
             rootId,
-            state,
             userId: state.botUserId,
         });
-        broadcast(state, postEvent("posted", post, state.botUsername, channel.type), false);
+        const { post } = pendingPost;
+        if (!commitNextPostIfCapacity(state, pendingPost)) {
+            return mattermostError("Too much retained state", 503);
+        }
+        const event = postEvent("posted", post, state.botUsername, channel);
+        broadcast(state, event, false);
         return jsonResponse(post, 201);
     }
     const postMatch = /^\/posts\/([^/]+)$/u.exec(apiPath);
@@ -330,9 +567,21 @@ async function handleApi(params) {
         if (post.user_id !== state.botUserId) {
             return mattermostError("You do not have permission to edit this post", 403);
         }
-        const updated = { ...post, message: readTrimmedString(body.message) ?? post.message };
-        state.posts.set(updated.id, updated);
-        broadcast(state, postEvent("post_edited", updated, state.botUsername, state.channels.get(updated.channel_id)?.type ?? "O"), false);
+        const message = body.message === undefined ? post.message : readMattermostMessage(body.message);
+        if (!message) {
+            return mattermostError("message must be a string", 400);
+        }
+        const editedAt = Math.max(Date.now(), post.update_at + 1);
+        const updated = { ...post, edit_at: editedAt, message, update_at: editedAt };
+        if (!canRetainCommittedValues(state, [[post, updated]])) {
+            return mattermostError("Too much retained state", 503);
+        }
+        const event = postEvent("post_edited", updated, state.botUsername, state.channels.get(updated.channel_id));
+        if (webSocketEventBytes(event) > state.maxWebSocketBufferedBytes) {
+            return webSocketEventTooLargeResponse();
+        }
+        setCommittedValue(state, state.posts, updated.id, updated);
+        broadcast(state, event, false);
         return jsonResponse(updated);
     }
     if (postMatch?.[1] && method === "DELETE") {
@@ -343,8 +592,14 @@ async function handleApi(params) {
         if (post.user_id !== state.botUserId) {
             return mattermostError("You do not have permission to delete this post", 403);
         }
-        state.posts.delete(post.id);
-        broadcast(state, postEvent("post_deleted", post, state.botUsername, state.channels.get(post.channel_id)?.type ?? "O"), false);
+        const deletedAt = Math.max(Date.now(), post.update_at + 1);
+        const deletedPost = { ...post, delete_at: deletedAt, update_at: deletedAt };
+        const event = postEvent("post_deleted", deletedPost, state.botUsername, state.channels.get(deletedPost.channel_id));
+        if (webSocketEventBytes(event) > state.maxWebSocketBufferedBytes) {
+            return webSocketEventTooLargeResponse();
+        }
+        deleteCommittedValue(state, state.posts, post.id);
+        broadcast(state, event, false);
         return jsonResponse({ status: "OK" });
     }
     return mattermostError("Not found", 404);
@@ -352,6 +607,7 @@ async function handleApi(params) {
 async function handleRequest(request, state) {
     const url = new URL(request.url ?? "/", "http://localhost");
     const method = request.method ?? "GET";
+    const requestId = mattermostId(`request-${Date.now()}-${Math.random()}`);
     if (url.pathname === "/crabline/mattermost/inbound" && method === "POST") {
         if (!hasAdminToken(request, state.adminToken)) {
             drainRequestBody(request);
@@ -371,14 +627,29 @@ async function handleRequest(request, state) {
         });
         return handleAdminInbound({ body, state });
     }
-    if (!url.pathname.startsWith("/api/v4/")) {
-        return new Response("not found", { status: 404 });
+    if (url.pathname !== "/api/v4" && !url.pathname.startsWith("/api/v4/")) {
+        drainRequestBody(request);
+        return mattermostError("Sorry, we could not find the page.", 404, {
+            id: "api.context.404.app_error",
+            requestId,
+        });
     }
     if (!authorized(request, state.botToken)) {
         drainRequestBody(request);
-        return mattermostError("Invalid or missing token", 401);
+        return mattermostError("Invalid or expired session, please login again.", 401, {
+            id: "api.context.session_expired.app_error",
+            requestId,
+        });
+    }
+    const bodylessMethod = method === "GET" || method === "DELETE";
+    if (bodylessMethod) {
+        drainRequestBody(request);
     }
-    const body = method === "GET" || method === "DELETE" ? {} : await parseUnknownRequestBody(request);
+    const requiresJsonPost = method === "POST" && url.pathname === "/api/v4/posts" && !requestHasJsonMediaType(request);
+    if (requiresJsonPost) {
+        drainRequestBody(request);
+    }
+    const body = bodylessMethod || requiresJsonPost ? {} : await parseUnknownRequestBody(request);
     const event = {
         at: new Date().toISOString(),
         ...(typeof body === "object" && body !== null && Object.keys(body).length > 0 ? { body } : {}),
@@ -387,15 +658,21 @@ async function handleRequest(request, state) {
         query: queryRecord(url),
         type: "api",
     };
-    const response = await handleApi({
-        body,
-        method,
-        path: url.pathname.slice("/api/v4".length),
-        state,
-    });
+    const response = requiresJsonPost
+        ? mattermostError("Content-Type must be application/json.", 415, {
+            id: "api.context.unsupported_content_type.app_error",
+            requestId,
+        })
+        : await handleApi({
+            body,
+            method,
+            path: url.pathname.slice("/api/v4".length),
+            state,
+        });
     if (method === "POST" && url.pathname === "/api/v4/posts") {
         event.accepted = response.status === 201;
     }
+    event.accepted ??= response.ok;
     await appendEvent(state, event, response.ok && method !== "GET");
     return response;
 }
@@ -450,7 +727,8 @@ function attachWebSocketServer(params) {
                     return;
                 }
                 if (message.action !== "authentication_challenge" ||
-                    message.data?.token !== params.state.botToken) {
+                    typeof message.data?.token !== "string" ||
+                    !constantTimeTokenEqual(message.data.token, params.state.botToken)) {
                     sendControlMessage(params.state, client, {
                         error: { id: "api.context.unauthorized", message: "Authentication failed" },
                         seq_reply: seq,
@@ -474,16 +752,19 @@ function attachWebSocketServer(params) {
                     event: "hello",
                 });
                 const pending = params.state.pendingEvents.splice(0);
+                params.state.pendingEventBytes = 0;
                 for (const [index, event] of pending.entries()) {
                     if (!sendEvent(params.state, client, event)) {
-                        params.state.pendingEvents.unshift(...pending.slice(index));
+                        const remaining = pending.slice(index);
+                        params.state.pendingEvents.unshift(...remaining);
+                        params.state.pendingEventBytes = remaining.reduce((total, queuedEvent) => total + retainedValueBytes(queuedEvent), 0);
                         break;
                     }
                 }
                 return;
             }
             if (message.action === "user_typing") {
-                const channelId = readTrimmedString(message.data?.channel_id);
+                const channelId = readMattermostId(message.data?.channel_id);
                 if (!channelId || !params.state.channels.has(channelId)) {
                     sendControlMessage(params.state, client, {
                         error: {
@@ -502,7 +783,7 @@ function attachWebSocketServer(params) {
                     }),
                     data: {
                         channel_id: channelId,
-                        parent_id: readTrimmedString(message.data?.parent_id) ?? "",
+                        parent_id: readMattermostId(message.data?.parent_id) ?? "",
                         user_id: params.state.botUserId,
                     },
                     event: "typing",
@@ -539,9 +820,18 @@ function attachWebSocketServer(params) {
 export async function startMattermostServer(params = {}) {
     const host = params.host ?? "127.0.0.1";
     const botUserId = params.botUserId ?? mattermostId("crabline-mattermost-bot");
-    const botUsername = params.botUsername ?? "crabline_bot";
+    const botUsername = normalizeMattermostUsername(params.botUsername ?? "crabline_bot");
+    if (!botUsername) {
+        throw new Error("botUsername must be a valid Mattermost username.");
+    }
     const maxWebSocketMessageBytes = resolvePositiveLimit(params.maxWebSocketMessageBytes, "maxWebSocketMessageBytes", DEFAULT_MAX_WEBSOCKET_MESSAGE_BYTES);
     const maxUnauthenticatedWebSocketClients = resolvePositiveLimit(params.maxUnauthenticatedWebSocketClients, "maxUnauthenticatedWebSocketClients", DEFAULT_MAX_UNAUTHENTICATED_WEBSOCKET_CLIENTS);
+    const maxCommittedStateBytes = resolvePositiveLimit(params.maxCommittedStateBytes, "maxCommittedStateBytes", DEFAULT_MAX_COMMITTED_STATE_BYTES);
+    const botUser = { id: botUserId, update_at: Date.now(), username: botUsername };
+    const initialCommittedStateBytes = retainedValueBytes(botUser);
+    if (initialCommittedStateBytes > maxCommittedStateBytes) {
+        throw new Error("maxCommittedStateBytes cannot retain the configured bot user.");
+    }
     const state = {
         adminToken: params.adminToken ?? randomBytes(24).toString("base64url"),
         botToken: params.botToken ??
@@ -549,14 +839,22 @@ export async function startMattermostServer(params = {}) {
         botUserId,
         botUsername,
         channels: new Map(),
+        committedStateBytes: initialCommittedStateBytes,
+        maxCommittedChannels: resolvePositiveLimit(params.maxCommittedChannels, "maxCommittedChannels", DEFAULT_MAX_COMMITTED_CHANNELS),
+        maxCommittedPosts: resolvePositiveLimit(params.maxCommittedPosts, "maxCommittedPosts", DEFAULT_MAX_COMMITTED_POSTS),
+        maxCommittedStateBytes,
+        maxCommittedUsers: resolvePositiveLimit(params.maxCommittedUsers, "maxCommittedUsers", DEFAULT_MAX_COMMITTED_USERS),
+        maxPendingInboundBytes: resolvePositiveLimit(params.maxPendingInboundBytes, "maxPendingInboundBytes", DEFAULT_MAX_PENDING_INBOUND_BYTES),
         maxPendingInboundEvents: resolveMaxPendingInboundEvents(params.maxPendingInboundEvents),
         maxWebSocketBufferedBytes: resolvePositiveLimit(params.maxWebSocketBufferedBytes, "maxWebSocketBufferedBytes", DEFAULT_MAX_WEBSOCKET_BUFFERED_BYTES),
         nextPost: 1,
         onEvent: params.onEvent,
+        pendingEventBytes: 0,
         pendingEvents: [],
         posts: new Map(),
         recorderPath: params.recorderPath ?? path.resolve(".crabline", "servers", "mattermost.jsonl"),
-        users: new Map([[botUserId, { id: botUserId, update_at: Date.now(), username: botUsername }]]),
+        userIdsByUsername: new Map([[botUsername, botUserId]]),
+        users: new Map([[botUserId, botUser]]),
         websocketClients: new Map(),
     };
     const httpServer = await startHttpJsonServer({