@openclaw/matrix 2026.8.1-beta.2 → 2026.8.1

package/node_modules/matrix-js-sdk/src/models/room-state.ts

@@ -62,11 +62,8 @@ export interface IPowerLevelsContent {
     users?: Record<string, number>;
     events?: Record<string, number>;
     notifications?: Partial<Record<"room", number>>;
-    // eslint-disable-next-line camelcase
     users_default?: number;
-    // eslint-disable-next-line camelcase
     events_default?: number;
-    // eslint-disable-next-line camelcase
     state_default?: number;
     ban?: number;
     invite?: number;

package/node_modules/matrix-js-sdk/src/models/room.ts

@@ -640,7 +640,9 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         let capabilities: Capabilities = {};
         try {
             capabilities = await this.client.getCapabilities();
-        } catch {}
+        } catch {
+            // Ignore errors - we'll just use the default safe room version
+        }
         let versionCap = capabilities["m.room_versions"];
         if (!versionCap) {
             versionCap = {
@@ -937,7 +939,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
     private getFunctionalMembers(): string[] {
         const mFunctionalMembers = this.currentState.getStateEvents(UNSTABLE_ELEMENT_FUNCTIONAL_USERS.name, "");
         if (Array.isArray(mFunctionalMembers?.getContent().service_members)) {
-            return mFunctionalMembers!.getContent().service_members;
+            return mFunctionalMembers.getContent().service_members;
         }
         return [];
     }
@@ -947,7 +949,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
 
         // Only generate a fallback avatar if the conversation is with a single specific other user (a "DM").
         let nonFunctionalMemberCount = 0;
-        this.getMembers()!.forEach((m) => {
+        this.getMembers().forEach((m) => {
             if (m.membership !== "join" && m.membership !== "invite") return;
             if (functionalMembers.includes(m.userId)) return;
             nonFunctionalMemberCount++;
@@ -1068,7 +1070,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         if (rawMembersEvents === null || this.hasEncryptionStateEvent()) {
             fromServer = true;
             rawMembersEvents = await this.loadMembersFromServer();
-            logger.log(`LL: got ${rawMembersEvents.length} ` + `members from server for room ${this.roomId}`);
+            logger.log(`LL: got ${rawMembersEvents.length} members from server for room ${this.roomId}`);
         }
         const memberEvents = rawMembersEvents.filter(noUnsafeEventProps).map(this.client.getEventMapper());
         return { memberEvents, fromServer };
@@ -1127,7 +1129,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                         .getMembers()
                         .filter((m) => m.isOutOfBand())
                         .map((m) => m.events.member?.event as IStateEventWithRoomId);
-                    logger.log(`LL: telling store to write ${oobMembers.length}` + ` members for room ${this.roomId}`);
+                    logger.log(`LL: telling store to write ${oobMembers.length} members for room ${this.roomId}`);
                     const store = this.client.store;
                     return (
                         store
@@ -1169,7 +1171,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      */
     private cleanupAfterLeaving(): void {
         this.clearLoadedMembersIfNeeded().catch((err) => {
-            logger.error(`error after clearing loaded members from ` + `room ${this.roomId} after leaving`);
+            logger.error(`error after clearing loaded members from room ${this.roomId} after leaving`);
             logger.log(err);
         });
     }
@@ -2076,7 +2078,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         };
 
         if (filterType === ThreadFilterType.My) {
-            definition!.room!.timeline![FILTER_RELATED_BY_SENDERS.name] = [myUserId];
+            definition.room!.timeline![FILTER_RELATED_BY_SENDERS.name] = [myUserId];
         }
 
         filter.setDefinition(definition);
@@ -2276,7 +2278,9 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
                 event.once(MatrixEventEvent.BeforeRedaction, (redactedEvent: MatrixEvent) => {
                     this.polls.delete(redactedEvent.getId()!);
                 });
-            } catch {}
+            } catch {
+                // Do nothing
+            }
             // poll creation can fail for malformed poll start events
             return;
         }
@@ -2406,7 +2410,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         const threadRootId = event.threadRootId;
 
         // Where the parent is the thread root and this is a non-thread relation this should live only in the main timeline
-        if (!!parentEventId && !isThreadRelation && (threadRootId === parentEventId || roots?.has(parentEventId!))) {
+        if (!!parentEventId && !isThreadRelation && (threadRootId === parentEventId || roots?.has(parentEventId))) {
             return {
                 shouldLiveInRoom: true,
                 shouldLiveInThread: false,
@@ -3204,7 +3208,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
             );
         } else {
             // When `threadSupport` is disabled treat all events as timelineEvents
-            return [events as MatrixEvent[], [] as MatrixEvent[], [] as MatrixEvent[]];
+            return [events, [] as MatrixEvent[], [] as MatrixEvent[]];
         }
     }
 
@@ -3236,7 +3240,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
         Object.keys(content).forEach((eventId: string) => {
             Object.keys(content[eventId]).forEach((receiptType: ReceiptType | string) => {
                 Object.keys(content[eventId][receiptType]).forEach((userId: string) => {
-                    const receipt = content[eventId][receiptType][userId] as Receipt;
+                    const receipt = content[eventId][receiptType][userId];
                     const receiptForMainTimeline = !receipt.thread_id || receipt.thread_id === MAIN_ROOM_TIMELINE;
                     const receiptDestination: Thread | this | undefined = receiptForMainTimeline
                         ? this
@@ -3444,7 +3448,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
     /**
      * Get an iterator of currently active sticky events.
      */
-    // eslint-disable-next-line
     public _unstable_getStickyEvents(): ReturnType<RoomStickyEventsStore["getStickyEvents"]> {
         return this.stickyEvents.getStickyEvents();
     }
@@ -3456,7 +3459,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * @param stickyKey The sticky key used by the event.
      * @returns A matching active sticky event, or undefined.
      */
-    // eslint-disable-next-line
     public _unstable_getKeyedStickyEvent(
         sender: string,
         type: string,
@@ -3471,7 +3473,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * @param sender The sender of the sticky event.
      * @returns An array of matching sticky events.
      */
-    // eslint-disable-next-line
     public _unstable_getUnkeyedStickyEvent(
         sender: string,
         type: string,
@@ -3485,7 +3486,6 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
      * @param events A set of new sticky events.
      * @internal
      */
-    // eslint-disable-next-line
     public _unstable_addStickyEvents(events: MatrixEvent[]): ReturnType<RoomStickyEventsStore["addStickyEvents"]> {
         // ALWAYS filter out any events that are past retention
         events = events.filter((e) => this.retention?.shouldEventBeRetained(e) ?? true);

package/node_modules/matrix-js-sdk/src/models/thread.ts

@@ -132,6 +132,8 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
      */
     public initialEventsFetched = !Thread.hasServerSideSupport;
     private initalEventFetchProm: Promise<boolean> | undefined;
+    private preInitEventTargets = new Map<string, MatrixEvent>();
+    private preInitObserverState = { active: true };
 
     /**
      * An array of events to add to the timeline once the thread has been initialised
@@ -170,6 +172,9 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
         this.reEmitter = new TypedReEmitter(this);
 
         this.reEmitter.reEmit(this.timelineSet, [RoomEvent.Timeline, RoomEvent.TimelineReset]);
+        this.once(ThreadEvent.Delete, () => {
+            this.preInitObserverState.active = false;
+        });
 
         this.room.on(MatrixEventEvent.BeforeRedaction, this.onBeforeRedaction);
         this.room.on(RoomEvent.Redaction, this.onRedaction);
@@ -364,10 +369,19 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
         // Modify this event to point at our room's state, and mark its thread
         // as this.
         this.setEventMetadata(event);
+        const eventId = event.getId();
+        if (
+            !this.initialEventsFetched &&
+            eventId &&
+            !event.isRelation(RelationType.Annotation) &&
+            !event.isRelation(RelationType.Replace)
+        ) {
+            this.preInitEventTargets.set(eventId, event);
+        }
 
         // Decide whether this event is going to be added at the end of the timeline.
         const lastReply = this.lastReply();
-        const isNewestReply = !lastReply || event.localTimestamp >= lastReply!.localTimestamp;
+        const isNewestReply = !lastReply || event.localTimestamp >= lastReply.localTimestamp;
 
         if (!Thread.hasServerSideSupport) {
             // When there's no server-side support, just add it to the end of the timeline.
@@ -438,12 +452,33 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
              */
             this.replayEvents?.push(event);
 
-            // For annotations (reactions), aggregate immediately (pre-init) to keep
-            // reaction counts/summary visible while the thread is still initialising.
-            // Only aggregate as child: parent aggregation is unnecessary here.
+            // Aggregate annotations immediately to keep reaction counts visible.
             if (event.isRelation(RelationType.Annotation)) {
                 this.timelineSet.relations?.aggregateChildEvent(event, this.timelineSet);
             }
+
+            // Edits can also be aggregated immediately when their target is already
+            // known. If it is not known yet, replay still handles them after pagination.
+            if (event.isRelation(RelationType.Replace)) {
+                const targetEventId = event.getRelation()?.event_id;
+                const targetEvent = targetEventId ? this.findPreInitTargetEvent(targetEventId) : undefined;
+                if (targetEvent && targetEventId) {
+                    const weakThread = new WeakRef(this);
+                    const observerState = this.preInitObserverState;
+                    const eventId = event.getId();
+                    void this.timelineSet.relations
+                        .aggregateChildEvent(event, this.timelineSet, targetEvent)
+                        .then(() => {
+                            const thread = weakThread.deref();
+                            if (!thread || !observerState.active) return;
+                            const effectiveTarget = thread.findPreInitTargetEvent(targetEventId);
+                            if (effectiveTarget?.replacingEvent()?.getId() === eventId) {
+                                thread.emit(ThreadEvent.Update, thread);
+                            }
+                        })
+                        .catch((error) => logger.error("Failed to aggregate pre-initialization thread edit: ", error));
+                }
+            }
         } else {
             // Case 2: this is happening later, and we have a timeline. In
             // this case, these events might be out-of order.
@@ -474,6 +509,15 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
         }
     }
 
+    private findPreInitTargetEvent(eventId: string): MatrixEvent | undefined {
+        return (
+            this.timelineSet.findEventById(eventId) ??
+            this.room.findEventById(eventId) ??
+            this.preInitEventTargets.get(eventId) ??
+            (this.lastEvent?.getId() === eventId ? this.lastEvent : undefined)
+        );
+    }
+
     public async processEvent(event: MatrixEvent | null | undefined): Promise<void> {
         if (event) {
             this.setEventMetadata(event);
@@ -642,6 +686,7 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
                         this.addEvent(event, false);
                     }
                     this.replayEvents = null;
+                    this.preInitEventTargets.clear();
                     // just to make sure that, if we've created a timeline window for this thread before the thread itself
                     // existed (e.g. when creating a new thread), we'll make sure the panel is force refreshed correctly.
                     this.emit(RoomEvent.TimelineReset, this.room, this.timelineSet, true);
@@ -914,8 +959,8 @@ export const FILTER_RELATED_BY_REL_TYPES = new ServerControlledNamespacedValue(
 export const THREAD_RELATION_TYPE = new ServerControlledNamespacedValue("m.thread", "io.element.thread");
 
 export enum ThreadFilterType {
-    "My",
-    "All",
+    My,
+    All,
 }
 
 export function threadFilterTypeToFilter(type: ThreadFilterType | null): "all" | "participated" {

package/node_modules/matrix-js-sdk/src/oauth/authorize.ts

@@ -0,0 +1,274 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { secureRandomString } from "../randomstring.ts";
+import { OAuth2Error } from "./error.ts";
+import { type ValidatedAuthMetadata } from "./discover.ts";
+import {
+    hasOptionalNumberProperty,
+    hasOptionalStringProperty,
+    hasRequiredNumberProperty,
+    hasRequiredStringProperty,
+    isRecord,
+} from "../@types/type-guards.ts";
+import { Method } from "../http-api/index.ts";
+import { OAuthGrantType } from "./register.ts";
+import { sleep } from "../utils.ts";
+
+/**
+ * The expected response type from the token endpoint during authorization code flow
+ * Normalized to always use capitalized 'Bearer' for token_type
+ *
+ * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4
+ */
+export type BearerTokenResponse = Omit<ValidTokenResponse, "token_type"> & {
+    token_type: "Bearer";
+};
+
+/**
+ * Metadata from OAuth 2.0 token_endpoint as per
+ * https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+ * With validated properties required in type
+ *
+ * This response is expected for the authorization code grant and refresh token grant,
+ * as defined in the Matrix spec.
+ */
+interface ValidTokenResponse {
+    token_type: "Bearer" | "bearer";
+    access_token: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+}
+
+/**
+ * Validate the given response matches the format expected for a {@link ValidTokenResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function validateBearerTokenResponse(response: unknown): asserts response is ValidTokenResponse {
+    if (
+        !isRecord(response) ||
+        !hasRequiredStringProperty(response, "token_type") ||
+        // token_type is case-insensitive, some OPs return `token_type: "bearer"`
+        response["token_type"].toLowerCase() !== "bearer" ||
+        !hasRequiredStringProperty(response, "access_token") ||
+        !hasOptionalNumberProperty(response, "expires_in") ||
+        !hasOptionalStringProperty(response, "refresh_token") ||
+        !hasOptionalStringProperty(response, "scope")
+    ) {
+        throw new Error(OAuth2Error.InvalidBearerTokenResponse);
+    }
+}
+
+/**
+ * Generate the scope used in authorization request with OAuth2 IdP
+ * @returns scope
+ */
+export const generateScope = (deviceId?: string): string => {
+    const safeDeviceId = deviceId ?? secureRandomString(10);
+    return `urn:matrix:client:api:* urn:matrix:client:device:${safeDeviceId}`;
+};
+
+/**
+ * Normalize token_type to use capital case to make consuming the token response easier
+ * token_type is case insensitive, and it is spec-compliant for OPs to return token_type: "bearer"
+ * Later, when used in auth headers it is case sensitive and must be Bearer
+ * See: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4
+ *
+ * @param response - validated token response
+ * @returns response with token_type set to 'Bearer'
+ */
+export const normalizeBearerTokenResponseTokenType = (response: ValidTokenResponse): BearerTokenResponse => ({
+    ...response,
+    token_type: "Bearer",
+});
+
+/**
+ * Response from the OAuth2 token endpoint when exchanging a token for grant_type device_code.
+ */
+export interface DeviceAccessTokenResponse {
+    access_token: string;
+    token_type: string;
+    refresh_token?: string;
+    scope?: string;
+    expires_in?: number;
+}
+
+/**
+ * Validate the given response matches the format expected for a {@link DeviceAccessTokenResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function isValidDeviceAccessTokenResponse(response: unknown): response is DeviceAccessTokenResponse {
+    return (
+        isRecord(response) &&
+        hasRequiredStringProperty(response, "access_token") &&
+        hasRequiredStringProperty(response, "token_type") &&
+        hasOptionalStringProperty(response, "refresh_token") &&
+        hasOptionalStringProperty(response, "scope") &&
+        hasOptionalNumberProperty(response, "expires_in")
+    );
+}
+
+/**
+ * Error from the OAuth2 token endpoint when exchanging a token for grant_type device_code.
+ */
+export interface DeviceAccessTokenError {
+    error: string;
+    error_description?: string;
+    error_uri?: string;
+    session_state?: string;
+}
+
+/**
+ * Response from the OAuth2 device authorization endpoint.
+ * As specified in https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+ */
+export interface DeviceAuthorizationResponse {
+    /** The device verification code. */
+    device_code: string;
+    /** The end-user verification code. */
+    user_code: string;
+    /**
+     * The end-user verification URI on the authorization server.
+     * The URI should be short and easy to remember as end users will be asked to manually type it into their user agent.
+     */
+    verification_uri: string;
+    /**
+     * The URI which doesn’t require the user to manually type the user_code, designed for non-textual transmission.
+     */
+    verification_uri_complete?: string;
+    /** The lifetime in seconds of the "device_code" and "user_code". */
+    expires_in: number;
+    /**
+     * The minimum amount of time in seconds that the client SHOULD wait between polling requests to the token endpoint.
+     * If no value is provided, clients MUST use 5 as the default.
+     */
+    interval?: number;
+}
+
+/**
+ * Validate the given response matches the format expected for a {@link DeviceAuthorizationResponse}
+ * @param response - the response to validate
+ * @throws if the response does not match the expected format
+ */
+export function validateDeviceAuthorizationResponse(
+    response: unknown,
+): asserts response is DeviceAuthorizationResponse {
+    if (
+        !isRecord(response) ||
+        !hasRequiredStringProperty(response, "device_code") ||
+        !hasRequiredStringProperty(response, "user_code") ||
+        !hasRequiredStringProperty(response, "verification_uri") ||
+        !hasRequiredNumberProperty(response, "expires_in") ||
+        !hasOptionalStringProperty(response, "verification_uri_complete") ||
+        !hasOptionalNumberProperty(response, "interval")
+    ) {
+        throw new Error(OAuth2Error.InvalidDeviceAuthorizationResponse);
+    }
+}
+
+/**
+ * Begin OAuth2 device authorization flow.
+ * @param options - The device authorization parameters.
+ * @param options.clientId - the client ID returned from client registration.
+ * @param options.scope - the scope to request for authorization.
+ * @param options.metadata - the validated OAuth2 metadata for the Identity Provider.
+ * @returns a promise that resolves to a device access token response,
+ *   or an error response if the user denies authorization or the device code expires.
+ */
+export const startDeviceAuthorization = async ({
+    clientId,
+    scope,
+    metadata,
+}: {
+    clientId: string;
+    scope: string;
+    metadata: ValidatedAuthMetadata;
+}): Promise<DeviceAuthorizationResponse> => {
+    const body = new URLSearchParams({ client_id: clientId, scope: scope }).toString();
+
+    const url = metadata.device_authorization_endpoint;
+    if (!url) {
+        throw new Error("No device_authorization_endpoint given");
+    }
+
+    const response = await fetch(url, {
+        method: Method.Post,
+        headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+
+    const data = await response.json();
+    validateDeviceAuthorizationResponse(data);
+    return data;
+};
+
+/**
+ * Polls the OAuth2 token endpoint until we get a device access token response, or encounter an unrecoverable error.
+ * @param options - The device authorization parameters.
+ * @param options.session - The session returned from a previous call to {@link startDeviceAuthorization}.
+ * @param options.metadata - The validated OAuth2 metadata for the Identity Provider.
+ * @param options.clientId - The client ID returned from client registration.
+ * @returns a promise that resolves to a device access token response,
+ *   or an error response if the user denies authorization or the device code expires.
+ */
+export const waitForDeviceAuthorization = async ({
+    session,
+    metadata,
+    clientId,
+}: {
+    session: DeviceAuthorizationResponse;
+    metadata: ValidatedAuthMetadata;
+    clientId: string;
+}): Promise<DeviceAccessTokenResponse | DeviceAccessTokenError> => {
+    let interval = (session.interval ?? 5) * 1000; // poll interval
+    const expiration = Date.now() + session.expires_in * 1000;
+    do {
+        const body = new URLSearchParams({
+            device_code: session.device_code,
+            grant_type: OAuthGrantType.DeviceAuthorization,
+            client_id: clientId,
+        }).toString();
+        const response = await fetch(metadata.token_endpoint, {
+            method: Method.Post,
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body,
+        });
+
+        const data = await response.json();
+
+        if (response.ok && isValidDeviceAccessTokenResponse(data)) {
+            return data;
+        }
+        const errorResponse = data as DeviceAccessTokenError;
+        switch (errorResponse.error) {
+            case "authorization_pending":
+                break;
+            case "slow_down":
+                interval += 5000;
+                break;
+            case "access_denied":
+            case "expired_token":
+                return errorResponse;
+        }
+        await sleep(interval);
+    } while (Date.now() < expiration);
+    return { error: "expired" };
+};

package/node_modules/matrix-js-sdk/src/oauth/discover.ts

@@ -0,0 +1,102 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import {
+    hasOptionalStringProperty,
+    hasRequiredStringProperty,
+    isRecord,
+    optionalStringArrayProperty,
+    requiredArrayValue,
+} from "../@types/type-guards.ts";
+import { OAuthGrantType } from "./index.ts";
+
+/**
+ * Metadata from OAuth 2.0 client authentication API as per
+ * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata
+ * With validated properties required in type
+ */
+export interface ValidatedAuthMetadata {
+    /** List of actions that the account management URL supports. */
+    account_management_actions_supported?: string[];
+    /** The URL where the user is able to access the account management capabilities of the homeserver. */
+    account_management_uri?: string;
+    /** URL of the authorization endpoint, necessary to use the authorization code grant. */
+    authorization_endpoint: string;
+    /**
+     * List of OAuth 2.0 Proof Key for Code Exchange (PKCE) code challenge methods that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the S256 value, for improved security in the authorization code grant.
+     */
+    code_challenge_methods_supported: string[];
+    /** URL of the device authorization endpoint, as defined in RFC 8628, necessary to use the device authorization grant. */
+    device_authorization_endpoint?: string;
+    /**
+     * List of OAuth 2.0 grant type strings that the server supports at the token endpoint.
+     *
+     * This array MUST contain at least the authorization_code and refresh_token values,
+     * for clients to be able to use the authorization code grant and refresh token grant, respectively.
+     */
+    grant_types_supported: string[];
+    /** The authorization server’s issuer identifier, which is a URL that uses the https scheme and has no query or fragment components. */
+    issuer: string;
+    /** List of OpenID Connect prompt values that the server supports at the authorization endpoint. */
+    prompt_values_supported?: string[];
+    /** URL of the client registration endpoint, necessary to perform dynamic registration of a client. */
+    registration_endpoint: string;
+    /**
+     * List of OAuth 2.0 response mode strings that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the query and fragment values, for improved security in the authorization code grant.
+     */
+    response_modes_supported: string[];
+    /**
+     * List of OAuth 2.0 response type strings that the server supports at the authorization endpoint.
+     *
+     * This array MUST contain at least the code value, for clients to be able to use the authorization code grant.
+     */
+    response_types_supported: string[];
+    /** URL of the revocation endpoint, necessary to log out a client by invalidating its access and refresh tokens. */
+    revocation_endpoint: string;
+    /** URL of the token endpoint, used by the grants. */
+    token_endpoint: string;
+}
+
+/**
+ * Validates OAuth 2.0 auth metadata as defined by
+ * https://spec.matrix.org/v1.18/client-server-api/#get_matrixclientv1auth_metadata
+ * @param authMetadata - json object
+ * @returns boolean of whether the input is valid
+ */
+export const isValidAuthMetadata = (authMetadata: unknown): authMetadata is ValidatedAuthMetadata => {
+    return (
+        isRecord(authMetadata) &&
+        hasRequiredStringProperty(authMetadata, "issuer") &&
+        hasRequiredStringProperty(authMetadata, "authorization_endpoint") &&
+        hasRequiredStringProperty(authMetadata, "token_endpoint") &&
+        hasRequiredStringProperty(authMetadata, "revocation_endpoint") &&
+        hasRequiredStringProperty(authMetadata, "registration_endpoint") &&
+        hasOptionalStringProperty(authMetadata, "account_management_uri") &&
+        hasOptionalStringProperty(authMetadata, "device_authorization_endpoint") &&
+        optionalStringArrayProperty(authMetadata, "account_management_actions_supported") &&
+        optionalStringArrayProperty(authMetadata, "prompt_values_supported") &&
+        requiredArrayValue(authMetadata, "response_modes_supported", "query") &&
+        requiredArrayValue(authMetadata, "response_modes_supported", "fragment") &&
+        requiredArrayValue(authMetadata, "response_types_supported", "code") &&
+        requiredArrayValue(authMetadata, "grant_types_supported", OAuthGrantType.AuthorizationCode) &&
+        requiredArrayValue(authMetadata, "grant_types_supported", OAuthGrantType.RefreshToken) &&
+        requiredArrayValue(authMetadata, "code_challenge_methods_supported", "S256")
+    );
+};

package/node_modules/matrix-js-sdk/src/{oidc → oauth}/error.ts

@@ -15,19 +15,20 @@ limitations under the License.
 */
 
 /**
- * Errors expected to be encountered during OIDC discovery, client registration, and authentication.
+ * Errors expected to be encountered during OAuth2 discovery, client registration, and authentication.
  * Not intended to be displayed directly to the user.
  */
-export enum OidcError {
-    NotSupported = "OIDC authentication not supported",
-    Misconfigured = "OIDC is misconfigured",
-    General = "Something went wrong with OIDC discovery",
-    OpSupport = "Configured OIDC OP does not support required functions",
+export enum OAuth2Error {
+    General = "Something went wrong with OAuth2 discovery",
+    OpSupport = "Configured OAuth2 OP does not support required functions",
     DynamicRegistrationNotSupported = "Dynamic registration not supported",
     DynamicRegistrationFailed = "Dynamic registration failed",
     DynamicRegistrationInvalid = "Dynamic registration invalid response",
     CodeExchangeFailed = "Failed to exchange code for token",
     InvalidBearerTokenResponse = "Invalid bearer token response",
-    InvalidIdToken = "Invalid ID token",
+    InvalidDeviceAuthorizationResponse = "Invalid device authorization response",
     MissingOrInvalidStoredState = "State required to finish logging in is not found in storage.",
+    RefreshTokenFailed = "Failed to refresh token",
+    RevokeTokenFailed = "Failed to revoke token",
+    DeviceAuthorizationGrantFailed = "Failed to perform device authorization grant",
 }