@unwanted/matrix-sdk-mini 34.13.0 → 36.0.0

package/lib/testing.js.map

@@ -1 +1 @@
-{"version":3,"file":"testing.js","names":["MatrixEvent","mkMatrixEvent","opts","_opts$eventId","_opts$ts","event","type","room_id","roomId","sender","content","event_id","eventId","Math","random","origin_server_ts","ts","unsigned","stateKey","undefined","state_key","mxEvent","userId","membership","name","rawDisplayName","getAvatarUrl","getMxcAvatarUrl"],"sources":["../src/testing.ts"],"sourcesContent":["/*\nCopyright 2024 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * This file is a secondary entrypoint for the js-sdk library, exposing utilities which might be useful for writing tests.\n *\n * In general, it should not be included in runtime applications.\n *\n * @packageDocumentation\n */\n\nimport { IContent, IEvent, IUnsigned, MatrixEvent } from \"./models/event.ts\";\nimport { RoomMember } from \"./models/room-member.ts\";\nimport { EventType } from \"./@types/event.ts\";\n\n/**\n * Create a {@link MatrixEvent}.\n *\n * @param opts - Values for the event.\n */\nexport function mkMatrixEvent(opts: {\n    /** Room ID of the event. */\n    roomId: string;\n\n    /** The sender of the event. */\n    sender: string;\n\n    /** The type of the event. */\n    type: EventType | string;\n\n    /** Optional `state_key` for the event. If unspecified, a non-state event is created. */\n    stateKey?: string;\n\n    /** Optional `origin_server_ts` for the event. If unspecified, the timestamp will be set to 0. */\n    ts?: number;\n\n    /** Optional `event_id` for the event. If provided will be used as event ID; else an ID is generated. */\n    eventId?: string;\n\n    /** Content of the event. */\n    content: IContent;\n\n    /** Optional `unsigned` data for the event. */\n    unsigned?: IUnsigned;\n}): MatrixEvent {\n    const event: Partial<IEvent> = {\n        type: opts.type,\n        room_id: opts.roomId,\n        sender: opts.sender,\n        content: opts.content,\n        event_id: opts.eventId ?? \"$\" + Math.random() + \"-\" + Math.random(),\n        origin_server_ts: opts.ts ?? 0,\n        unsigned: opts.unsigned,\n    };\n    if (opts.stateKey !== undefined) {\n        event.state_key = opts.stateKey;\n    }\n\n    const mxEvent = new MatrixEvent(event);\n    mxEvent.sender = {\n        userId: opts.sender,\n        membership: \"join\",\n        name: opts.sender,\n        rawDisplayName: opts.sender,\n        roomId: opts.sender,\n        getAvatarUrl: () => {},\n        getMxcAvatarUrl: () => {},\n    } as unknown as RoomMember;\n    return mxEvent;\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAsCA,WAAW,QAAQ,mBAAmB;AAI5E;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,aAAaA,CAACC,IAwB7B,EAAe;EAAA,IAAAC,aAAA,EAAAC,QAAA;EACZ,IAAMC,KAAsB,GAAG;IAC3BC,IAAI,EAAEJ,IAAI,CAACI,IAAI;IACfC,OAAO,EAAEL,IAAI,CAACM,MAAM;IACpBC,MAAM,EAAEP,IAAI,CAACO,MAAM;IACnBC,OAAO,EAAER,IAAI,CAACQ,OAAO;IACrBC,QAAQ,GAAAR,aAAA,GAAED,IAAI,CAACU,OAAO,cAAAT,aAAA,cAAAA,aAAA,GAAI,GAAG,GAAGU,IAAI,CAACC,MAAM,CAAC,CAAC,GAAG,GAAG,GAAGD,IAAI,CAACC,MAAM,CAAC,CAAC;IACnEC,gBAAgB,GAAAX,QAAA,GAAEF,IAAI,CAACc,EAAE,cAAAZ,QAAA,cAAAA,QAAA,GAAI,CAAC;IAC9Ba,QAAQ,EAAEf,IAAI,CAACe;EACnB,CAAC;EACD,IAAIf,IAAI,CAACgB,QAAQ,KAAKC,SAAS,EAAE;IAC7Bd,KAAK,CAACe,SAAS,GAAGlB,IAAI,CAACgB,QAAQ;EACnC;EAEA,IAAMG,OAAO,GAAG,IAAIrB,WAAW,CAACK,KAAK,CAAC;EACtCgB,OAAO,CAACZ,MAAM,GAAG;IACba,MAAM,EAAEpB,IAAI,CAACO,MAAM;IACnBc,UAAU,EAAE,MAAM;IAClBC,IAAI,EAAEtB,IAAI,CAACO,MAAM;IACjBgB,cAAc,EAAEvB,IAAI,CAACO,MAAM;IAC3BD,MAAM,EAAEN,IAAI,CAACO,MAAM;IACnBiB,YAAY,EAAEA,CAAA,KAAM,CAAC,CAAC;IACtBC,eAAe,EAAEA,CAAA,KAAM,CAAC;EAC5B,CAA0B;EAC1B,OAAON,OAAO;AAClB","ignoreList":[]}
+{"version":3,"file":"testing.js","names":["MatrixEvent","mkMatrixEvent","opts","_opts$eventId","_opts$ts","event","type","room_id","roomId","sender","content","event_id","eventId","Math","random","origin_server_ts","ts","unsigned","stateKey","undefined","state_key","mxEvent","userId","membership","name","rawDisplayName","getAvatarUrl","getMxcAvatarUrl","makeDelegatedAuthConfig","issuer","arguments","length","additionalGrantTypes","metadata","mockOpenIdConfiguration","_objectSpread","signingKeys","revocation_endpoint","token_endpoint","authorization_endpoint","registration_endpoint","device_authorization_endpoint","jwks_uri","response_types_supported","grant_types_supported","code_challenge_methods_supported"],"sources":["../src/testing.ts"],"sourcesContent":["/*\nCopyright 2024 The Matrix.org Foundation C.I.C.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n/**\n * This file is a secondary entrypoint for the js-sdk library, exposing utilities which might be useful for writing tests.\n *\n * In general, it should not be included in runtime applications.\n *\n * @packageDocumentation\n */\n\nimport { IContent, IEvent, IUnsigned, MatrixEvent } from \"./models/event.ts\";\nimport { RoomMember } from \"./models/room-member.ts\";\nimport { EventType } from \"./@types/event.ts\";\nimport { OidcClientConfig, ValidatedAuthMetadata } from \"./oidc/index.ts\";\n\n/**\n * Create a {@link MatrixEvent}.\n *\n * @param opts - Values for the event.\n */\nexport function mkMatrixEvent(opts: {\n    /** Room ID of the event. */\n    roomId: string;\n\n    /** The sender of the event. */\n    sender: string;\n\n    /** The type of the event. */\n    type: EventType | string;\n\n    /** Optional `state_key` for the event. If unspecified, a non-state event is created. */\n    stateKey?: string;\n\n    /** Optional `origin_server_ts` for the event. If unspecified, the timestamp will be set to 0. */\n    ts?: number;\n\n    /** Optional `event_id` for the event. If provided will be used as event ID; else an ID is generated. */\n    eventId?: string;\n\n    /** Content of the event. */\n    content: IContent;\n\n    /** Optional `unsigned` data for the event. */\n    unsigned?: IUnsigned;\n}): MatrixEvent {\n    const event: Partial<IEvent> = {\n        type: opts.type,\n        room_id: opts.roomId,\n        sender: opts.sender,\n        content: opts.content,\n        event_id: opts.eventId ?? \"$\" + Math.random() + \"-\" + Math.random(),\n        origin_server_ts: opts.ts ?? 0,\n        unsigned: opts.unsigned,\n    };\n    if (opts.stateKey !== undefined) {\n        event.state_key = opts.stateKey;\n    }\n\n    const mxEvent = new MatrixEvent(event);\n    mxEvent.sender = {\n        userId: opts.sender,\n        membership: \"join\",\n        name: opts.sender,\n        rawDisplayName: opts.sender,\n        roomId: opts.sender,\n        getAvatarUrl: () => {},\n        getMxcAvatarUrl: () => {},\n    } as unknown as RoomMember;\n    return mxEvent;\n}\n\n/**\n * Makes a valid OidcClientConfig with minimum valid values\n * @param issuer used as the base for all other urls\n * @param additionalGrantTypes to add to the default grant types\n * @returns OidcClientConfig\n * @experimental\n */\nexport const makeDelegatedAuthConfig = (\n    issuer = \"https://auth.org/\",\n    additionalGrantTypes: string[] = [],\n): OidcClientConfig => {\n    const metadata = mockOpenIdConfiguration(issuer, additionalGrantTypes);\n    return {\n        ...metadata,\n        signingKeys: null,\n    };\n};\n/**\n * Useful for mocking <issuer>/.well-known/openid-configuration\n * @param issuer used as the base for all other urls\n * @param additionalGrantTypes to add to the default grant types\n * @returns ValidatedAuthMetadata\n * @experimental\n */\nexport const mockOpenIdConfiguration = (\n    issuer = \"https://auth.org/\",\n    additionalGrantTypes: string[] = [],\n): ValidatedAuthMetadata => ({\n    issuer,\n    revocation_endpoint: issuer + \"revoke\",\n    token_endpoint: issuer + \"token\",\n    authorization_endpoint: issuer + \"auth\",\n    registration_endpoint: issuer + \"registration\",\n    device_authorization_endpoint: issuer + \"device\",\n    jwks_uri: issuer + \"jwks\",\n    response_types_supported: [\"code\"],\n    grant_types_supported: [\"authorization_code\", \"refresh_token\", ...additionalGrantTypes],\n    code_challenge_methods_supported: [\"S256\"],\n});"],"mappings":";;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAAsCA,WAAW,QAAQ,mBAAmB;AAK5E;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,aAAaA,CAACC,IAwB7B,EAAe;EAAA,IAAAC,aAAA,EAAAC,QAAA;EACZ,IAAMC,KAAsB,GAAG;IAC3BC,IAAI,EAAEJ,IAAI,CAACI,IAAI;IACfC,OAAO,EAAEL,IAAI,CAACM,MAAM;IACpBC,MAAM,EAAEP,IAAI,CAACO,MAAM;IACnBC,OAAO,EAAER,IAAI,CAACQ,OAAO;IACrBC,QAAQ,GAAAR,aAAA,GAAED,IAAI,CAACU,OAAO,cAAAT,aAAA,cAAAA,aAAA,GAAI,GAAG,GAAGU,IAAI,CAACC,MAAM,CAAC,CAAC,GAAG,GAAG,GAAGD,IAAI,CAACC,MAAM,CAAC,CAAC;IACnEC,gBAAgB,GAAAX,QAAA,GAAEF,IAAI,CAACc,EAAE,cAAAZ,QAAA,cAAAA,QAAA,GAAI,CAAC;IAC9Ba,QAAQ,EAAEf,IAAI,CAACe;EACnB,CAAC;EACD,IAAIf,IAAI,CAACgB,QAAQ,KAAKC,SAAS,EAAE;IAC7Bd,KAAK,CAACe,SAAS,GAAGlB,IAAI,CAACgB,QAAQ;EACnC;EAEA,IAAMG,OAAO,GAAG,IAAIrB,WAAW,CAACK,KAAK,CAAC;EACtCgB,OAAO,CAACZ,MAAM,GAAG;IACba,MAAM,EAAEpB,IAAI,CAACO,MAAM;IACnBc,UAAU,EAAE,MAAM;IAClBC,IAAI,EAAEtB,IAAI,CAACO,MAAM;IACjBgB,cAAc,EAAEvB,IAAI,CAACO,MAAM;IAC3BD,MAAM,EAAEN,IAAI,CAACO,MAAM;IACnBiB,YAAY,EAAEA,CAAA,KAAM,CAAC,CAAC;IACtBC,eAAe,EAAEA,CAAA,KAAM,CAAC;EAC5B,CAA0B;EAC1B,OAAON,OAAO;AAClB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMO,uBAAuB,GAAG,SAA1BA,uBAAuBA,CAAA,EAGb;EAAA,IAFnBC,MAAM,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAX,SAAA,GAAAW,SAAA,MAAG,mBAAmB;EAAA,IAC5BE,oBAA8B,GAAAF,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAX,SAAA,GAAAW,SAAA,MAAG,EAAE;EAEnC,IAAMG,QAAQ,GAAGC,uBAAuB,CAACL,MAAM,EAAEG,oBAAoB,CAAC;EACtE,OAAAG,aAAA,CAAAA,aAAA,KACOF,QAAQ;IACXG,WAAW,EAAE;EAAI;AAEzB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,IAAMF,uBAAuB,GAAG,SAA1BA,uBAAuBA,CAAA;EAAA,IAChCL,MAAM,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAX,SAAA,GAAAW,SAAA,MAAG,mBAAmB;EAAA,IAC5BE,oBAA8B,GAAAF,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAX,SAAA,GAAAW,SAAA,MAAG,EAAE;EAAA,OACV;IACzBD,MAAM;IACNQ,mBAAmB,EAAER,MAAM,GAAG,QAAQ;IACtCS,cAAc,EAAET,MAAM,GAAG,OAAO;IAChCU,sBAAsB,EAAEV,MAAM,GAAG,MAAM;IACvCW,qBAAqB,EAAEX,MAAM,GAAG,cAAc;IAC9CY,6BAA6B,EAAEZ,MAAM,GAAG,QAAQ;IAChDa,QAAQ,EAAEb,MAAM,GAAG,MAAM;IACzBc,wBAAwB,EAAE,CAAC,MAAM,CAAC;IAClCC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,GAAGZ,oBAAoB,CAAC;IACvFa,gCAAgC,EAAE,CAAC,MAAM;EAC7C,CAAC;AAAA,CAAC","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@unwanted/matrix-sdk-mini",
-    "version": "34.13.0",
+    "version": "36.0.0",
     "description": "Matrix Client-Server mini SDK for Javascript",
     "engines": {
         "node": ">=20.0.0"
@@ -56,7 +56,7 @@
         "jwt-decode": "^4.0.0",
         "loglevel": "^1.7.1",
         "matrix-events-sdk": "0.0.1",
-        "matrix-widget-api": "^1.10.0",
+        "matrix-widget-api": "^1.12.0",
         "oidc-client-ts": "^3.0.1",
         "p-retry": "4",
         "sdp-transform": "^2.15.0",
@@ -68,7 +68,7 @@
         "@action-validator/core": "^0.6.0",
         "@babel/cli": "^7.12.10",
         "@babel/core": "^7.12.10",
-        "@babel/eslint-parser": "^7.12.10",
+        "@babel/eslint-parser": "^7.26.5",
         "@babel/eslint-plugin": "^7.12.10",
         "@babel/plugin-syntax-dynamic-import": "^7.8.3",
         "@babel/plugin-transform-class-properties": "^7.12.1",
@@ -87,7 +87,7 @@
         "@types/node": "18",
         "@types/sdp-transform": "^2.4.5",
         "@types/uuid": "10",
-        "@typescript-eslint/eslint-plugin": "^8.0.0",
+        "@typescript-eslint/eslint-plugin": "^8.21.0",
         "@typescript-eslint/parser": "^8.0.0",
         "babel-jest": "^29.0.0",
         "babel-plugin-search-and-replace": "^1.1.1",
@@ -122,7 +122,7 @@
         "typedoc-plugin-coverage": "^3.4.0",
         "typedoc-plugin-mdn-links": "^3.0.3",
         "typedoc-plugin-missing-exports": "^3.0.0",
-        "typescript": "^5.4.2"
+        "typescript": "^5.7.3"
     },
     "@casualbot/jest-sonar-reporter": {
         "outputDirectory": "coverage",

package/src/@types/event.ts

@@ -42,6 +42,9 @@ import { XOR } from "./common.ts";
 import { ReactionEventContent, RoomMessageEventContent, StickerEventContent } from "./events.ts";
 
 import { M_POLL_END, M_POLL_START, PollEndEventContent, PollStartEventContent } from "./polls.ts";
+import { LocalNotificationSettings } from "./local_notifications.ts";
+import { IPushRules } from "./PushRules.ts";
+import { POLICIES_ACCOUNT_EVENT_TYPE } from "../models/invites-ignorer-types.ts";
 
 export enum EventType {
     // Room state events
@@ -334,3 +337,17 @@ export interface StateEvents {
     // MSC3672
     [M_BEACON_INFO.name]: MBeaconInfoEventContent;
 }
+
+/**
+ * Mapped type from event type to content type for all specified global account_data events.
+ */
+export interface AccountDataEvents {
+    [EventType.PushRules]: IPushRules;
+    [EventType.Direct]: { [userId: string]: string[] };
+    [EventType.IgnoredUserList]: { [userId: string]: {} };
+    "m.identity_server": { base_url: string | null };
+    [key: `${typeof LOCAL_NOTIFICATION_SETTINGS_PREFIX.name}.${string}`]: LocalNotificationSettings;
+    // Invites-ignorer events
+    [POLICIES_ACCOUNT_EVENT_TYPE.name]: { [key: string]: any };
+    [POLICIES_ACCOUNT_EVENT_TYPE.altName]: { [key: string]: any };
+}

package/src/client.ts

@@ -101,6 +101,7 @@ import {
     UpdateDelayedEventAction,
 } from "./@types/requests.ts";
 import {
+    AccountDataEvents,
     EventType,
     LOCAL_NOTIFICATION_SETTINGS_PREFIX,
     MSC3912_RELATION_BASED_REDACTIONS_PROP,
@@ -124,7 +125,7 @@ import {
     Visibility,
 } from "./@types/partials.ts";
 import { EventMapper, eventMapperFor, MapperOpts } from "./event-mapper.ts";
-import { randomString } from "./randomstring.ts";
+import { secureRandomString } from "./randomstring.ts";
 import { DEFAULT_TREE_POWER_LEVELS_TEMPLATE, MSC3089TreeSpace } from "./models/MSC3089TreeSpace.ts";
 import { ISignatures } from "./@types/signed.ts";
 import { IStore } from "./store/index.ts";
@@ -184,6 +185,7 @@ import { RoomMessageEventContent, StickerEventContent } from "./@types/events.ts
 import { ImageInfo } from "./@types/media.ts";
 import { Capabilities, ServerCapabilities } from "./serverCapabilities.ts";
 import { sha256 } from "./digest.ts";
+import { discoverAndValidateOIDCIssuerWellKnown, OidcClientConfig, validateAuthMetadataAndKeys } from "./oidc/index.ts";
 
 export type Store = IStore;
 
@@ -1094,7 +1096,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         this.usingExternalCrypto = opts.usingExternalCrypto ?? false;
         this.store = opts.store || new StubStore();
         this.deviceId = opts.deviceId || null;
-        this.sessionId = randomString(10);
+        this.sessionId = secureRandomString(10);
 
         const userId = opts.userId || null;
         this.credentials = { userId };
@@ -1598,7 +1600,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns Promise which resolves: an empty object
      * @returns Rejects: with an error response.
      */
-    public setAccountData(eventType: EventType | string, content: IContent): Promise<{}> {
+    public setAccountData<K extends keyof AccountDataEvents>(
+        eventType: K,
+        content: AccountDataEvents[K] | Record<string, never>,
+    ): Promise<{}> {
         const path = utils.encodeUri("/user/$userId/account_data/$type", {
             $userId: this.credentials.userId!,
             $type: eventType,
@@ -1613,7 +1618,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @param eventType - The event type
      * @returns The contents of the given account data event
      */
-    public getAccountData(eventType: string): MatrixEvent | undefined {
+    public getAccountData<K extends keyof AccountDataEvents>(eventType: K): MatrixEvent | undefined {
         return this.store.getAccountData(eventType);
     }
 
@@ -1625,7 +1630,9 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns Promise which resolves: The contents of the given account data event.
      * @returns Rejects: with an error response.
      */
-    public async getAccountDataFromServer<T extends { [k: string]: any }>(eventType: string): Promise<T | null> {
+    public async getAccountDataFromServer<K extends keyof AccountDataEvents>(
+        eventType: K,
+    ): Promise<AccountDataEvents[K] | null> {
         if (this.isInitialSyncComplete()) {
             const event = this.store.getAccountData(eventType);
             if (!event) {
@@ -1633,7 +1640,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             }
             // The network version below returns just the content, so this branch
             // does the same to match.
-            return event.getContent<T>();
+            return event.getContent<AccountDataEvents[K]>();
         }
         const path = utils.encodeUri("/user/$userId/account_data/$type", {
             $userId: this.credentials.userId!,
@@ -1649,7 +1656,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         }
     }
 
-    public async deleteAccountData(eventType: string): Promise<void> {
+    public async deleteAccountData(eventType: keyof AccountDataEvents): Promise<void> {
         const msc3391DeleteAccountDataServerSupport = this.canSupport.get(Feature.AccountDataDeletion);
         // if deletion is not supported overwrite with empty content
         if (msc3391DeleteAccountDataServerSupport === ServerSupport.Unsupported) {
@@ -1672,7 +1679,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns The array of users that are ignored (empty if none)
      */
     public getIgnoredUsers(): string[] {
-        const event = this.getAccountData("m.ignored_user_list");
+        const event = this.getAccountData(EventType.IgnoredUserList);
         if (!event?.getContent()["ignored_users"]) return [];
         return Object.keys(event.getContent()["ignored_users"]);
     }
@@ -1688,7 +1695,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         userIds.forEach((u) => {
             content.ignored_users[u] = {};
         });
-        return this.setAccountData("m.ignored_user_list", content);
+        return this.setAccountData(EventType.IgnoredUserList, content);
     }
 
     /**
@@ -2352,7 +2359,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             if (this.canSupport.get(Feature.RelationBasedRedactions) === ServerSupport.Unsupported) {
                 throw new Error(
                     "Server does not support relation based redactions " +
-                    `roomId ${roomId} eventId ${eventId} txnId: ${txnId} threadId ${threadId}`,
+                    `roomId ${roomId} eventId ${eventId} txnId: ${txnId as string} threadId ${threadId}`,
                 );
             }
 
@@ -4630,8 +4637,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             if (room) {
                 // Copy over a known event sender if we can
                 for (const ev of sr.context.getTimeline()) {
-                    const sender = room.getMember(ev.getSender()!);
-                    if (!ev.sender && sender) ev.sender = sender;
+                    ev.setMetadata(room.currentState, false);
                 }
             }
             searchResults.results.push(sr);
@@ -5170,7 +5176,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns A new client secret
      */
     public generateClientSecret(): string {
-        return randomString(32);
+        return secureRandomString(32);
     }
 
     /**
@@ -5410,27 +5416,33 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     /**
      * @returns Promise which resolves to a LoginResponse object
      * @returns Rejects: with an error response.
+     *
+     * @deprecated This method has unintuitive behaviour: it updates the `MatrixClient` instance with *some* of the
+     *    returned credentials. Instead, call {@link loginRequest} and create a new `MatrixClient` instance using the
+     *    results. See https://github.com/matrix-org/matrix-js-sdk/issues/4502.
      */
     public login(loginType: LoginRequest["type"], data: Omit<LoginRequest, "type">): Promise<LoginResponse> {
-        return this.http
-            .authedRequest<LoginResponse>(Method.Post, "/login", undefined, {
-                ...data,
-                type: loginType,
-            })
-            .then((response) => {
-                if (response.access_token && response.user_id) {
-                    this.http.opts.accessToken = response.access_token;
-                    this.credentials = {
-                        userId: response.user_id,
-                    };
-                }
-                return response;
-            });
+        return this.loginRequest({
+            ...data,
+            type: loginType,
+        }).then((response) => {
+            if (response.access_token && response.user_id) {
+                this.http.opts.accessToken = response.access_token;
+                this.credentials = {
+                    userId: response.user_id,
+                };
+            }
+            return response;
+        });
     }
 
     /**
      * @returns Promise which resolves to a LoginResponse object
      * @returns Rejects: with an error response.
+     *
+     * @deprecated This method has unintuitive behaviour: it updates the `MatrixClient` instance with *some* of the
+     *   returned credentials. Instead, call {@link loginRequest} with `data.type: "m.login.password"`, and create a new
+     *   `MatrixClient` instance using the results. See https://github.com/matrix-org/matrix-js-sdk/issues/4502.
      */
     public loginWithPassword(user: string, password: string): Promise<LoginResponse> {
         return this.login("m.login.password", {
@@ -5475,6 +5487,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @param token - Login token previously received from homeserver
      * @returns Promise which resolves to a LoginResponse object
      * @returns Rejects: with an error response.
+     *
+     * @deprecated This method has unintuitive behaviour: it updates the `MatrixClient` instance with *some* of the
+     *   returned credentials. Instead, call {@link loginRequest} with `data.type: "m.login.token"`, and create a new
+     *   `MatrixClient` instance using the results. See https://github.com/matrix-org/matrix-js-sdk/issues/4502.
      */
     public loginWithToken(token: string): Promise<LoginResponse> {
         return this.login("m.login.token", {
@@ -5482,6 +5498,20 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         });
     }
 
+    /**
+     * Sends a `POST /login` request to the server.
+     *
+     * If successful, this will create a new device and access token for the user.
+     *
+     * @see {@link MatrixClient.loginFlows} which makes a `GET /login` request.
+     * @see https://spec.matrix.org/v1.13/client-server-api/#post_matrixclientv3login
+     *
+     * @param data - Credentials and other details for the login request.
+     */
+    public async loginRequest(data: LoginRequest): Promise<LoginResponse> {
+        return await this.http.authedRequest<LoginResponse>(Method.Post, "/login", undefined, data);
+    }
+
     /**
      * Logs out the current session.
      * Obviously, further calls that require authorisation should fail after this
@@ -6422,7 +6452,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
         deviceId: string,
         notificationSettings: LocalNotificationSettings,
     ): Promise<{}> {
-        const key = `${LOCAL_NOTIFICATION_SETTINGS_PREFIX.name}.${deviceId}`;
+        const key = `${LOCAL_NOTIFICATION_SETTINGS_PREFIX.name}.${deviceId}` as const;
         return this.setAccountData(key, notificationSettings);
     }
 
@@ -7384,6 +7414,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
      * @returns Resolves: A promise of an object containing the OIDC issuer if configured
      * @returns Rejects: when the request fails (module:http-api.MatrixError)
      * @experimental - part of MSC2965
+     * @deprecated in favour of getAuthMetadata
      */
     public async getAuthIssuer(): Promise<{
         issuer: string;
@@ -7392,6 +7423,33 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
             prefix: ClientPrefix.Unstable + "/org.matrix.msc2965",
         });
     }
+
+    /**
+     * Discover and validate delegated auth configuration
+     * - delegated auth issuer openid-configuration is reachable
+     * - delegated auth issuer openid-configuration is configured correctly for us
+     * Fetches /auth_metadata falling back to legacy implementation using /auth_issuer followed by
+     * https://oidc-issuer.example.com/.well-known/openid-configuration and other files linked therein.
+     * When successful, validated metadata is returned
+     * @returns validated authentication metadata and optionally signing keys
+     * @throws when delegated auth config is invalid or unreachable
+     * @experimental - part of MSC2965
+     */
+    public async getAuthMetadata(): Promise<OidcClientConfig> {
+        let authMetadata: unknown | undefined;
+        try {
+            authMetadata = await this.http.request<unknown>(Method.Get, "/auth_metadata", undefined, undefined, {
+                prefix: ClientPrefix.Unstable + "/org.matrix.msc2965",
+            });
+        } catch (e) {
+            if (e instanceof MatrixError && e.errcode === "M_UNRECOGNIZED") {
+                const { issuer } = await this.getAuthIssuer();
+                return discoverAndValidateOIDCIssuerWellKnown(issuer);
+            }
+            throw e;
+        }
+        return validateAuthMetadataAndKeys(authMetadata);
+    }
 }
 
 function getUnstableDelayQueryOpts(delayOpts: SendDelayedEventRequestOpts): QueryDict {

package/src/embedded.ts

@@ -28,6 +28,7 @@ import {
     WidgetApiAction,
     IWidgetApiResponse,
     IWidgetApiResponseData,
+    IUpdateStateToWidgetActionRequest,
 } from "matrix-widget-api";
 
 import { MatrixEvent, IEvent, IContent } from "./models/event.ts";
@@ -134,6 +135,7 @@ export type EventHandlerMap = { [RoomWidgetClientEvent.PendingEventsChanged]: ()
 export class RoomWidgetClient extends MatrixClient {
     private room?: Room;
     private readonly widgetApiReady: Promise<void>;
+    private readonly roomStateSynced: Promise<void>;
     private lifecycle?: AbortController;
     private syncState: SyncState | null = null;
 
@@ -152,7 +154,7 @@ export class RoomWidgetClient extends MatrixClient {
      */
     public constructor(
         private readonly widgetApi: WidgetApi,
-        private readonly capabilities: ICapabilities,
+        /*private readonly */capabilities: ICapabilities,
         private readonly roomId: string,
         opts: IMatrixClientCreateOpts,
         sendContentLoaded: boolean,
@@ -187,6 +189,11 @@ export class RoomWidgetClient extends MatrixClient {
         };
 
         this.widgetApiReady = new Promise<void>((resolve) => this.widgetApi.once("ready", resolve));
+        this.roomStateSynced = capabilities.receiveState?.length
+            ? new Promise<void>((resolve) =>
+                  this.widgetApi.once(`action:${WidgetApiToWidgetAction.UpdateState}`, resolve),
+              )
+            : Promise.resolve();
 
         // Request capabilities for the functionality this client needs to support
         if (
@@ -239,6 +246,7 @@ export class RoomWidgetClient extends MatrixClient {
 
         widgetApi.on(`action:${WidgetApiToWidgetAction.SendEvent}`, this.onEvent);
         widgetApi.on(`action:${WidgetApiToWidgetAction.SendToDevice}`, this.onToDevice);
+        widgetApi.on(`action:${WidgetApiToWidgetAction.UpdateState}`, this.onStateUpdate);
 
         // Open communication with the host
         widgetApi.start();
@@ -274,28 +282,6 @@ export class RoomWidgetClient extends MatrixClient {
 
         await this.widgetApiReady;
 
-        // Backfill the requested events
-        // We only get the most recent event for every type + state key combo,
-        // so it doesn't really matter what order we inject them in
-        await Promise.all(
-            this.capabilities.receiveState?.map(async ({ eventType, stateKey }) => {
-                const rawEvents = await this.widgetApi.readStateEvents(eventType, undefined, stateKey, [this.roomId]);
-                const events = rawEvents.map((rawEvent) => new MatrixEvent(rawEvent as Partial<IEvent>));
-
-                if (this.syncApi instanceof SyncApi) {
-                    // Passing undefined for `stateAfterEventList` allows will make `injectRoomEvents` run in legacy mode
-                    // -> state events in `timelineEventList` will update the state.
-                    await this.syncApi.injectRoomEvents(this.room!, undefined, events);
-                } else {
-                    await this.syncApi!.injectRoomEvents(this.room!, events); // Sliding Sync
-                }
-                events.forEach((event) => {
-                    this.emit(ClientEvent.Event, event);
-                    logger.info(`Backfilled event ${event.getId()} ${event.getType()} ${event.getStateKey()}`);
-                });
-            }) ?? [],
-        );
-
         if (opts.clientWellKnownPollPeriod !== undefined) {
             this.clientWellKnownIntervalID = setInterval(() => {
                 this.fetchClientWellKnown();
@@ -303,13 +289,15 @@ export class RoomWidgetClient extends MatrixClient {
             this.fetchClientWellKnown();
         }
 
+        await this.roomStateSynced;
         this.setSyncState(SyncState.Syncing);
-        logger.info("Finished backfilling events");
+        logger.info("Finished initial sync");
     }
 
     public stopClient(): void {
         this.widgetApi.off(`action:${WidgetApiToWidgetAction.SendEvent}`, this.onEvent);
         this.widgetApi.off(`action:${WidgetApiToWidgetAction.SendToDevice}`, this.onToDevice);
+        this.widgetApi.off(`action:${WidgetApiToWidgetAction.UpdateState}`, this.onStateUpdate);
 
         super.stopClient();
         this.lifecycle!.abort(); // Signal to other async tasks that the client has stopped
@@ -473,36 +461,15 @@ export class RoomWidgetClient extends MatrixClient {
             // Only inject once we have update the txId
             await this.updateTxId(event);
             
-            // The widget API does not tell us whether a state event came from `state_after` or not so we assume legacy behaviour for now.
             if (this.syncApi instanceof SyncApi) {
-                // The code will want to be something like:
-                // ```
-                // if (!params.addToTimeline && !params.addToState) {
-                // // Passing undefined for `stateAfterEventList` makes `injectRoomEvents` run in "legacy mode"
-                // // -> state events part of the `timelineEventList` parameter will update the state.
-                //     this.injectRoomEvents(this.room!, [], undefined, [event]);
-                // } else {
-                //     this.injectRoomEvents(this.room!, undefined, params.addToState ? [event] : [], params.addToTimeline ? [event] : []);
-                // }
-                // ```
-
-                // Passing undefined for `stateAfterEventList` allows will make `injectRoomEvents` run in legacy mode
-                // -> state events in `timelineEventList` will update the state.
-                await this.syncApi.injectRoomEvents(this.room!, [], undefined, [event]);
+                await this.syncApi.injectRoomEvents(this.room!, undefined, [], [event]);
             } else {
-                // The code will want to be something like:
-                // ```
-                // if (!params.addToTimeline && !params.addToState) {
-                //     this.injectRoomEvents(this.room!, [], [event]);
-                // } else {
-                //     this.injectRoomEvents(this.room!, params.addToState ? [event] : [], params.addToTimeline ? [event] : []);
-                // }
-                // ```
-                await this.syncApi!.injectRoomEvents(this.room!, [], [event]); // Sliding Sync
+                // Sliding Sync
+                await this.syncApi!.injectRoomEvents(this.room!, [], [event]);
             }
             this.emit(ClientEvent.Event, event);
             this.setSyncState(SyncState.Syncing);
-            logger.info(`Received event ${event.getId()} ${event.getType()} ${event.getStateKey()}`);
+            logger.info(`Received event ${event.getId()} ${event.getType()}`);
         } else {
             const { event_id: eventId, room_id: roomId } = ev.detail.data;
             logger.info(`Received event ${eventId} for a different room ${roomId}; discarding`);
@@ -524,6 +491,29 @@ export class RoomWidgetClient extends MatrixClient {
         this.setSyncState(SyncState.Syncing);
         await this.ack(ev);
     };
+
+    private onStateUpdate = async (ev: CustomEvent<IUpdateStateToWidgetActionRequest>): Promise<void> => {
+        ev.preventDefault();
+        for (const rawEvent of ev.detail.data.state) {
+            // Verify the room ID matches, since it's possible for the client to
+            // send us state updates from other rooms if this widget is always
+            // on screen
+            if (rawEvent.room_id === this.roomId) {
+                const event = new MatrixEvent(rawEvent as Partial<IEvent>);
+                if (this.syncApi instanceof SyncApi) {
+                    await this.syncApi.injectRoomEvents(this.room!, undefined, [event]);
+                } else {
+                    // Sliding Sync
+                    await this.syncApi!.injectRoomEvents(this.room!, [event]);
+                }
+                logger.info(`Updated state entry ${event.getType()} ${event.getStateKey()} to ${event.getId()}`);
+            } else {
+                const { event_id: eventId, room_id: roomId } = ev.detail.data;
+                logger.info(`Received state entry ${eventId} for a different room ${roomId}; discarding`);
+            }
+        }
+        await this.ack(ev);
+    };
 }
 
 function processAndThrow(error: unknown): never {

package/src/feature.ts

@@ -60,6 +60,7 @@ const featureSupportResolver: Record<string, FeatureSupportCondition> = {
     },
     [Feature.RelationsRecursion]: {
         unstablePrefixes: ["org.matrix.msc3981"],
+        matrixVersion: "v1.10",
     },
     [Feature.IntentionalMentions]: {
         unstablePrefixes: ["org.matrix.msc3952_intentional_mentions"],

package/src/http-api/errors.ts

@@ -167,9 +167,9 @@ export class MatrixError extends HTTPError {
 }
 
 /**
- * @returns The recommended delay in milliseconds to wait before retrying
- * the request that triggered {@link error}, or {@link defaultMs} if the
- * error was not due to rate-limiting or if no valid delay is recommended.
+ * @returns The recommended delay in milliseconds to wait before retrying the request.
+ * @param error - The error to check for a retry delay.
+ * @param defaultMs - The delay to use if the error was not due to rate-limiting or if no valid delay is recommended.
  */
 export function safeGetRetryAfterMs(error: unknown, defaultMs: number): number {
     if (!(error instanceof HTTPError) || !error.isRateLimitError()) {

package/src/http-api/utils.ts

@@ -180,8 +180,8 @@ export function calculateRetryBackoff(err: any, attempts: number, retryConnectio
         return -1;
     }
 
-    if (err.httpStatus && (err.httpStatus === 400 || err.httpStatus === 403 || err.httpStatus === 401)) {
-        // client error; no amount of retrying will save you now.
+    if (err.httpStatus && Math.floor(err.httpStatus / 100) === 4 && err.httpStatus !== 429) {
+        // client error; no amount of retrying will save you now (except for rate limiting which is handled below)
         return -1;
     }
 

package/src/models/event-timeline.ts

@@ -68,27 +68,7 @@ export class EventTimeline {
      * @param toStartOfTimeline -  if true the event's forwardLooking flag is set false
      */
     public static setEventMetadata(event: MatrixEvent, stateContext: RoomState, toStartOfTimeline: boolean): void {
-        // When we try to generate a sentinel member before we have that member
-        // in the members object, we still generate a sentinel but it doesn't
-        // have a membership event, so test to see if events.member is set. We
-        // check this to avoid overriding non-sentinel members by sentinel ones
-        // when adding the event to a filtered timeline
-        if (!event.sender?.events?.member) {
-            event.sender = stateContext.getSentinelMember(event.getSender()!);
-        }
-        if (!event.target?.events?.member && event.getType() === EventType.RoomMember) {
-            event.target = stateContext.getSentinelMember(event.getStateKey()!);
-        }
-
-        if (event.isState()) {
-            // room state has no concept of 'old' or 'current', but we want the
-            // room state to regress back to previous values if toStartOfTimeline
-            // is set, which means inspecting prev_content if it exists. This
-            // is done by toggling the forwardLooking flag.
-            if (toStartOfTimeline) {
-                event.forwardLooking = false;
-            }
-        }
+        event.setMetadata(stateContext, toStartOfTimeline);
     }
 
     private readonly roomId: string | null;