@vex-chat/spire 3.0.1 → 4.1.0

package/src/server/index.ts

@@ -13,12 +13,16 @@ import * as fsp from "node:fs/promises";
 import express from "express";
 
 import { type KeyPair, XUtils } from "@vex-chat/crypto";
-import { PreKeysWSSchema, TokenScopes, UserSchema } from "@vex-chat/types";
+import {
+    MAX_FILE_UPLOAD_ENCODED_BODY_BYTES,
+    PreKeysWSSchema,
+    TokenScopes,
+    UserSchema,
+} from "@vex-chat/types";
 
 import cors from "cors";
 import { fileTypeFromBuffer, fileTypeFromFile } from "file-type";
 import helmet from "helmet";
-import jwt from "jsonwebtoken";
 import multer from "multer";
 import parseDuration from "parse-duration";
 import { stringify as uuidStringify } from "uuid";
@@ -26,7 +30,7 @@ import { z } from "zod/v4";
 
 import { POWER_LEVELS } from "../ClientManager.ts";
 import { JWT_EXPIRY } from "../Spire.ts";
-import { getJwtSecret } from "../utils/jwtSecret.ts";
+import { signAuthJwt, verifyAuthJwt } from "../utils/authJwt.ts";
 import { msgpack } from "../utils/msgpack.ts";
 import { verifyPreKeyWsSignature } from "../utils/preKeySignature.ts";
 import { spireXSignOpenAsync } from "../utils/spireXSignOpenAsync.ts";
@@ -41,12 +45,15 @@ import { getInviteRouter } from "./invite.ts";
 import { setupDocs } from "./openapi.ts";
 import { getPasskeyRouter } from "./passkey.ts";
 import { getPasskeyDeviceRouter } from "./passkeyDevices.ts";
+import { getPasswordRouter } from "./password.ts";
 import {
+    canDeletePermission,
     hasAnyPermission,
     hasPermission,
     userHasPermission,
 } from "./permissions.ts";
-import { globalLimiter, keyBundleLimiter } from "./rateLimit.ts";
+import { globalLimiter, keyBundleLimiter, uploadLimiter } from "./rateLimit.ts";
+import { deleteServerIconFile, getServerIconRouter } from "./serverIcon.ts";
 import { getUserRouter } from "./user.ts";
 import { censorUser, getParam, getUser } from "./utils.ts";
 import { getWellKnownRouter } from "./wellKnown.ts";
@@ -60,34 +67,59 @@ export const ALLOWED_IMAGE_TYPES = [
     "image/gif",
     "image/apng",
     "image/avif",
+    "image/webp",
 ];
 
 // ── Zod schemas for trust-boundary validation ──────────────────────────
 const invitePayload = z.object({
-    duration: z.string().min(1),
-    serverID: z.string().min(1),
+    duration: z.string().min(1).max(32),
+    serverID: z.string().min(1).max(128),
 });
 
 const channelPayload = z.object({
-    name: z.string().min(1).max(255),
+    name: z.string().trim().min(1).max(100),
+});
+
+const serverUpdatePayload = z.object({
+    name: z.string().trim().min(1).max(100),
+});
+
+const permissionRolePayload = z.object({
+    powerLevel: z.union([z.literal(0), z.literal(50), z.literal(100)]),
 });
 
-const deviceListPayload = z.array(z.string());
+const deviceListPayload = z.array(z.string().min(1).max(128)).max(256);
 
 const connectPayload = z.object({
-    signed: z.custom<Uint8Array>((val) => val instanceof Uint8Array),
+    signed: z.custom<Uint8Array>(
+        (val) => val instanceof Uint8Array && val.byteLength <= 16_384,
+    ),
 });
 
 const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
 
 const emojiPayload = z.object({
-    file: z.string().optional(),
-    name: z.string().min(1),
-    signed: z.string().optional(),
+    file: z.string().max(350_000).optional(),
+    name: z.string().trim().min(1).max(64),
+    signed: z.string().max(8192).optional(),
 });
+const emojiUpload = multer({
+    limits: { fields: 3, files: 1, fileSize: 256_000, parts: 4 },
+});
+
+const DEVELOPMENT_CORS_ORIGINS: Array<RegExp | string> = [
+    /^https?:\/\/localhost(?::\d{1,5})?$/,
+    /^https?:\/\/127\.0\.0\.1(?::\d{1,5})?$/,
+    /^https?:\/\/\[::1\](?::\d{1,5})?$/,
+    "capacitor://localhost",
+    "http://tauri.localhost",
+    "https://tauri.localhost",
+    "tauri://localhost",
+];
 
 const jwtUserPayload = z.object({
     exp: z.number().optional(),
+    scope: z.literal("user"),
     user: UserSchema,
 });
 
@@ -100,6 +132,7 @@ const jwtDevicePayload = z.object({
         owner: z.string(),
         signKey: z.string(),
     }),
+    scope: z.literal("device"),
 });
 
 const jwtPasskeyPayload = z.object({
@@ -121,7 +154,7 @@ const checkAuth: express.RequestHandler = (req, _res, next) => {
     const token = extractBearer(req);
     if (token) {
         try {
-            const result = jwt.verify(token, getJwtSecret());
+            const result = verifyAuthJwt(token);
             // Passkey-scoped JWTs share the bearer slot with regular
             // user JWTs but carry a `scope: "passkey"` discriminator
             // and a `passkey` claim. Populate `req.passkey` and the
@@ -158,7 +191,7 @@ export function createCheckDevice(
         const token = req.headers["x-device-token"];
         if (typeof token === "string" && token) {
             try {
-                const result = jwt.verify(token, getJwtSecret());
+                const result = verifyAuthJwt(token);
                 const parsed = jwtDevicePayload.safeParse(result);
                 if (parsed.success) {
                     const device = await currentTokenDevice(
@@ -180,6 +213,29 @@ export function createCheckDevice(
     };
 }
 
+/**
+ * Revalidate the credential behind a passkey-scoped bearer on every request.
+ * Passkey JWTs are short-lived, but removing a credential must revoke its
+ * recovery and account-administration access immediately.
+ */
+export function createCheckPasskey(
+    db: Pick<Database, "retrievePasskeyInternal">,
+): express.RequestHandler {
+    return async (req, _res, next) => {
+        if (req.passkey) {
+            const passkey = await db.retrievePasskeyInternal(
+                req.passkey.passkeyID,
+            );
+            if (!passkey || !req.user || passkey.userID !== req.user.userID) {
+                delete req.bearerToken;
+                delete req.passkey;
+                delete req.user;
+            }
+        }
+        next();
+    };
+}
+
 async function currentTokenDevice(
     db: Pick<Database, "retrieveDevice">,
     tokenDevice: Device,
@@ -192,7 +248,7 @@ async function currentTokenDevice(
 }
 
 export const protect: express.RequestHandler = (req, res, next) => {
-    if (!req.user) {
+    if (!req.user || req.passkey) {
         res.sendStatus(401);
         return;
     }
@@ -200,6 +256,15 @@ export const protect: express.RequestHandler = (req, res, next) => {
     next();
 };
 
+/** Require either an approved device or a fresh passkey session. */
+export const protectAnyAuth: express.RequestHandler = (req, res, next) => {
+    if (!req.user || (!req.device && !req.passkey)) {
+        res.sendStatus(401);
+        return;
+    }
+    next();
+};
+
 /**
  * Restrict a route to passkey-scoped JWTs (used by the parallel
  * `/user/:id/passkey/devices/...` admin/recovery routes). A
@@ -228,7 +293,7 @@ export const msgpackParser: express.RequestHandler = (req, res, next) => {
     next();
 };
 
-const directories = ["files", "avatars"];
+const directories = ["files", "avatars", "server-icons"];
 for (const dir of directories) {
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir);
@@ -249,14 +314,35 @@ export const initApp = (
     ) => void,
     disconnectDevices?: (deviceIDs: string[]) => void,
 ) => {
+    const notifyServerChange = async (
+        serverID: string,
+        additionalUserIDs: readonly string[] = [],
+    ): Promise<void> => {
+        const affectedUsers = await db.retrieveAffectedUsers(serverID);
+        const userIDs = new Set([
+            ...affectedUsers.map((user) => user.userID),
+            ...additionalUserIDs,
+        ]);
+        for (const userID of userIDs) {
+            notify(userID, "serverChange", crypto.randomUUID(), serverID);
+        }
+    };
+
     // INIT ROUTERS
-    const userRouter = getUserRouter(db, tokenValidator, notify);
+    const userRouter = getUserRouter(
+        db,
+        tokenValidator,
+        notify,
+        disconnectDevices,
+    );
     const fileRouter = getFileRouter(db);
     const avatarRouter = getAvatarRouter();
     const billingRouter = getBillingRouter(db, notify);
     const entitlementRouter = getEntitlementRouter(db, notify);
     const inviteRouter = getInviteRouter(db, tokenValidator, notify);
     const passkeyRouter = getPasskeyRouter(db);
+    const passwordRouter = getPasswordRouter(db);
+    const serverIconRouter = getServerIconRouter(db, notifyServerChange);
     const passkeyDeviceRouter = getPasskeyDeviceRouter(
         db,
         notify,
@@ -277,6 +363,17 @@ export const initApp = (
     // spends any cycles on body parsing, helmet, or auth. See
     // src/server/rateLimit.ts.
     api.use(globalLimiter);
+    // Base64 expands a 25 MiB encrypted upload to about 33.4 MiB. Give only
+    // the JSON fallback route enough room for that encoded payload and its
+    // JSON/msgpack envelope; unrelated routes keep the tighter global cap.
+    api.use(
+        "/file/json",
+        express.json({ limit: MAX_FILE_UPLOAD_ENCODED_BODY_BYTES }),
+        express.raw({
+            limit: MAX_FILE_UPLOAD_ENCODED_BODY_BYTES,
+            type: "application/msgpack",
+        }),
+    );
     api.use(express.json({ limit: "20mb" }));
     api.use(
         express.raw({
@@ -310,7 +407,9 @@ export const initApp = (
             origin:
                 corsOrigins.length > 0
                     ? corsOrigins
-                    : true /* reflect request Origin */,
+                    : process.env["NODE_ENV"] === "production"
+                      ? false
+                      : DEVELOPMENT_CORS_ORIGINS,
         }),
     );
 
@@ -323,10 +422,20 @@ export const initApp = (
 
     api.use(msgpackParser);
     api.use(checkAuth);
+    api.use(createCheckPasskey(db));
     api.use(createCheckDevice(db));
 
     api.get("/server/:id", protect, async (req, res) => {
-        const server = await db.retrieveServer(getParam(req, "id"));
+        const serverID = getParam(req, "id");
+        const userDetails = getUser(req);
+        const permissions = await db.retrievePermissions(
+            userDetails.userID,
+            "server",
+        );
+        if (!hasAnyPermission(permissions, serverID)) {
+            return res.sendStatus(403);
+        }
+        const server = await db.retrieveServer(serverID);
 
         if (server) {
             return res.send(msgpack.encode(server));
@@ -335,11 +444,83 @@ export const initApp = (
         }
     });
 
+    api.patch("/server/:id", protect, async (req, res) => {
+        const parsed = serverUpdatePayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid server update",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+
+        const serverID = getParam(req, "id");
+        const permissions = await db.retrievePermissions(
+            getUser(req).userID,
+            "server",
+        );
+        if (!hasPermission(permissions, serverID, POWER_LEVELS.CREATE)) {
+            res.sendStatus(403);
+            return;
+        }
+
+        const server = await db.updateServer(serverID, parsed.data);
+        if (!server) {
+            res.sendStatus(404);
+            return;
+        }
+        await notifyServerChange(serverID);
+        res.send(msgpack.encode(server));
+    });
+
+    api.post("/servers", protect, async (req, res) => {
+        const parsed = serverUpdatePayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid server",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+
+        const server = await db.createServer(
+            parsed.data.name,
+            getUser(req).userID,
+        );
+        res.send(msgpack.encode(server));
+    });
+
+    // Compatibility route for clients released before server names moved into
+    // the request body. New clients use POST /servers so Unicode names work.
     api.post("/server/:name", protect, async (req, res) => {
         const userDetails = getUser(req);
-        const serverName = atob(getParam(req, "name"));
+        const encodedName = getParam(req, "name");
+        if (encodedName.length > 256) {
+            res.sendStatus(400);
+            return;
+        }
+        let decodedName: string;
+        try {
+            decodedName = atob(encodedName);
+        } catch {
+            res.sendStatus(400);
+            return;
+        }
+        const parsedName = z
+            .string()
+            .trim()
+            .min(1)
+            .max(100)
+            .safeParse(decodedName);
+        if (!parsedName.success) {
+            res.sendStatus(400);
+            return;
+        }
 
-        const server = await db.createServer(serverName, userDetails.userID);
+        const server = await db.createServer(
+            parsedName.data,
+            userDetails.userID,
+        );
         res.send(msgpack.encode(server));
     });
 
@@ -429,11 +610,22 @@ export const initApp = (
             "server",
         );
         if (hasPermission(permissions, serverID, POWER_LEVELS.DELETE)) {
+            const server = await db.retrieveServer(serverID);
+            if (!server) {
+                res.sendStatus(404);
+                return;
+            }
+            const affectedUsers = await db.retrieveAffectedUsers(serverID);
             await db.deleteServer(serverID);
+            if (server.icon) await deleteServerIconFile(server.icon);
+            await notifyServerChange(
+                serverID,
+                affectedUsers.map((user) => user.userID),
+            );
             res.sendStatus(200);
             return;
         }
-        res.sendStatus(401);
+        res.sendStatus(403);
     });
 
     api.post("/server/:id/channels", protect, async (req, res) => {
@@ -456,20 +648,10 @@ export const initApp = (
         if (hasPermission(permissions, serverID, POWER_LEVELS.CREATE)) {
             const channel = await db.createChannel(name, serverID);
             res.send(msgpack.encode(channel));
-
-            const affectedUsers = await db.retrieveAffectedUsers(serverID);
-            // tell everyone about server change
-            for (const user of affectedUsers) {
-                notify(
-                    user.userID,
-                    "serverChange",
-                    crypto.randomUUID(),
-                    serverID,
-                );
-            }
+            await notifyServerChange(serverID);
             return;
         }
-        res.sendStatus(401);
+        res.sendStatus(403);
     });
 
     api.get("/server/:id/channels", protect, async (req, res) => {
@@ -488,7 +670,16 @@ export const initApp = (
     });
 
     api.get("/server/:serverID/emoji", protect, async (req, res) => {
-        const rows = await db.retrieveEmojiList(getParam(req, "serverID"));
+        const serverID = getParam(req, "serverID");
+        const permissions = await db.retrievePermissions(
+            getUser(req).userID,
+            "server",
+        );
+        if (!hasAnyPermission(permissions, serverID)) {
+            res.sendStatus(403);
+            return;
+        }
+        const rows = await db.retrieveEmojiList(serverID);
         res.send(msgpack.encode(rows));
     });
 
@@ -506,6 +697,42 @@ export const initApp = (
         res.send(msgpack.encode(permissions));
     });
 
+    api.patch("/channel/:id", protect, async (req, res) => {
+        const parsed = channelPayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid channel update",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+
+        const channelID = getParam(req, "id");
+        const channel = await db.retrieveChannel(channelID);
+        if (!channel) {
+            res.sendStatus(404);
+            return;
+        }
+        const permissions = await db.retrievePermissions(
+            getUser(req).userID,
+            "server",
+        );
+        if (
+            !hasPermission(permissions, channel.serverID, POWER_LEVELS.DELETE)
+        ) {
+            res.sendStatus(403);
+            return;
+        }
+
+        const updated = await db.updateChannel(channelID, parsed.data.name);
+        if (!updated) {
+            res.sendStatus(404);
+            return;
+        }
+        await notifyServerChange(channel.serverID);
+        res.send(msgpack.encode(updated));
+    });
+
     api.delete("/channel/:id", protect, async (req, res) => {
         const channelID = getParam(req, "id");
         const userDetails = getUser(req);
@@ -524,40 +751,90 @@ export const initApp = (
         for (const permission of permissions) {
             if (
                 permission.resourceID === channel.serverID &&
-                permission.powerLevel > 50
+                permission.powerLevel >= POWER_LEVELS.DELETE
             ) {
-                await db.deleteChannel(channelID);
-
-                res.sendStatus(200);
-
-                const affectedUsers = await db.retrieveAffectedUsers(
-                    channel.serverID,
-                );
-                // tell everyone about server change
-                for (const user of affectedUsers) {
-                    notify(
-                        user.userID,
-                        "serverChange",
-                        crypto.randomUUID(),
-                        channel.serverID,
-                    );
+                const deleted = await db.deleteChannelIfNotLast(channelID);
+                if (!deleted) {
+                    res.status(409).json({
+                        error: "A server must have at least one channel.",
+                    });
+                    return;
                 }
+                await notifyServerChange(channel.serverID);
+                res.sendStatus(200);
                 return;
             }
         }
-        res.sendStatus(401);
+        res.sendStatus(403);
     });
 
     api.get("/channel/:id", protect, async (req, res) => {
         const channel = await db.retrieveChannel(getParam(req, "id"));
 
         if (channel) {
+            const permissions = await db.retrievePermissions(
+                getUser(req).userID,
+                "server",
+            );
+            if (!hasAnyPermission(permissions, channel.serverID)) {
+                return res.sendStatus(403);
+            }
             return res.send(msgpack.encode(channel));
         } else {
             return res.sendStatus(404);
         }
     });
 
+    api.patch("/permission/:permissionID", protect, async (req, res) => {
+        const parsed = permissionRolePayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid role",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+
+        const target = await db.retrievePermission(
+            getParam(req, "permissionID"),
+        );
+        if (!target) {
+            res.sendStatus(404);
+            return;
+        }
+        if (target.resourceType !== "server") {
+            res.sendStatus(400);
+            return;
+        }
+
+        const actor = getUser(req);
+        if (target.userID === actor.userID) {
+            res.status(400).json({
+                error: "Use another owner to change your role.",
+            });
+            return;
+        }
+        const actorPermissions = await db.retrievePermissions(
+            actor.userID,
+            "server",
+        );
+        if (!hasPermission(actorPermissions, target.resourceID, 100)) {
+            res.sendStatus(403);
+            return;
+        }
+
+        const updated = await db.updatePermissionPowerLevel(
+            target.permissionID,
+            parsed.data.powerLevel,
+        );
+        if (!updated) {
+            res.sendStatus(404);
+            return;
+        }
+        await notifyServerChange(target.resourceID);
+        res.send(msgpack.encode(updated));
+    });
+
     api.delete("/permission/:permissionID", protect, async (req, res) => {
         const permissionID = getParam(req, "permissionID");
         const userDetails = getUser(req);
@@ -572,19 +849,44 @@ export const initApp = (
             permToDelete.resourceType,
         );
 
-        for (const perm of permissions) {
+        if (
+            canDeletePermission(
+                permissions,
+                userDetails.userID,
+                permToDelete,
+                POWER_LEVELS.DELETE,
+            )
+        ) {
             if (
-                perm.resourceID === permToDelete.resourceID &&
-                (perm.userID === userDetails.userID ||
-                    (perm.powerLevel > POWER_LEVELS.DELETE &&
-                        perm.powerLevel > permToDelete.powerLevel))
+                permToDelete.resourceType === "server" &&
+                permToDelete.powerLevel >= 100
             ) {
-                await db.deletePermission(permToDelete.permissionID);
-                res.sendStatus(200);
-                return;
+                const resourcePermissions =
+                    await db.retrievePermissionsByResourceID(
+                        permToDelete.resourceID,
+                    );
+                const hasAnotherOwner = resourcePermissions.some(
+                    (permission) =>
+                        permission.permissionID !== permToDelete.permissionID &&
+                        permission.powerLevel >= 100,
+                );
+                if (!hasAnotherOwner) {
+                    res.status(409).json({
+                        error: "Delete the server instead of leaving it without an owner.",
+                    });
+                    return;
+                }
             }
+            await db.deletePermission(permToDelete.permissionID);
+            if (permToDelete.resourceType === "server") {
+                await notifyServerChange(permToDelete.resourceID, [
+                    permToDelete.userID,
+                ]);
+            }
+            res.sendStatus(200);
+            return;
         }
-        res.sendStatus(401);
+        res.sendStatus(403);
     });
 
     api.post("/userList/:channelID", protect, async (req, res) => {
@@ -661,6 +963,10 @@ export const initApp = (
             res.sendStatus(401);
             return;
         }
+        if (deviceDetails.deviceID !== getParam(req, "id")) {
+            res.sendStatus(403);
+            return;
+        }
         const inbox = await db.retrieveMail(deviceDetails.deviceID);
         res.send(msgpack.encode(inbox));
     });
@@ -692,10 +998,7 @@ export const initApp = (
             regKey &&
             tokenValidator(uuidStringify(regKey), TokenScopes.Connect)
         ) {
-            const token = jwt.sign({ device }, getJwtSecret(), {
-                expiresIn: JWT_EXPIRY,
-            });
-            jwt.verify(token, getJwtSecret());
+            const token = signAuthJwt({ device, scope: "device" }, JWT_EXPIRY);
 
             res.send(msgpack.encode({ deviceToken: token }));
         } else {
@@ -709,6 +1012,10 @@ export const initApp = (
             res.sendStatus(401);
             return;
         }
+        if (deviceDetails.deviceID !== getParam(req, "id")) {
+            res.sendStatus(403);
+            return;
+        }
         const count = await db.getOTKCount(deviceDetails.deviceID);
         res.send(msgpack.encode({ count }));
     });
@@ -747,7 +1054,9 @@ export const initApp = (
             res.status(400).send({ error: "Prekey deviceID mismatch." });
             return;
         }
-        if (!(await verifyPreKeyWsSignature(preKey, device.signKey))) {
+        if (
+            !(await verifyPreKeyWsSignature(preKey, device.signKey, "signed"))
+        ) {
             res.status(401).send({ error: "Prekey signature invalid." });
             return;
         }
@@ -796,7 +1105,11 @@ export const initApp = (
                 return;
             }
             if (
-                !(await verifyPreKeyWsSignature(submittedOTK, device.signKey))
+                !(await verifyPreKeyWsSignature(
+                    submittedOTK,
+                    device.signKey,
+                    "one-time",
+                ))
             ) {
                 res.status(401).send({ error: "OTK signature invalid." });
                 return;
@@ -809,6 +1122,18 @@ export const initApp = (
 
     api.get("/emoji/:emojiID/details", protect, async (req, res) => {
         const emoji = await db.retrieveEmoji(getParam(req, "emojiID"));
+        if (!emoji) {
+            res.sendStatus(404);
+            return;
+        }
+        const permissions = await db.retrievePermissions(
+            getUser(req).userID,
+            "server",
+        );
+        if (!hasAnyPermission(permissions, emoji.owner)) {
+            res.sendStatus(403);
+            return;
+        }
         res.send(msgpack.encode(emoji));
     });
 
@@ -818,6 +1143,19 @@ export const initApp = (
             res.sendStatus(400);
             return;
         }
+        const emoji = await db.retrieveEmoji(safeId.data);
+        if (!emoji) {
+            res.sendStatus(404);
+            return;
+        }
+        const permissions = await db.retrievePermissions(
+            getUser(req).userID,
+            "server",
+        );
+        if (!hasAnyPermission(permissions, emoji.owner)) {
+            res.sendStatus(403);
+            return;
+        }
         const filePath = "./emoji/" + safeId.data;
         const typeDetails = await fileTypeFromFile(filePath).catch(() => null);
         if (!typeDetails) {
@@ -835,92 +1173,106 @@ export const initApp = (
         stream.pipe(res);
     });
 
-    api.post("/emoji/:serverID/json", protect, async (req, res) => {
-        const parsedPayload = emojiPayload.safeParse(req.body);
-        if (!parsedPayload.success) {
-            res.status(400).json({
-                error: "Invalid emoji payload",
-                issues: parsedPayload.error.issues,
-            });
-            return;
-        }
-        const payload = parsedPayload.data;
+    api.post(
+        "/emoji/:serverID/json",
+        uploadLimiter,
+        protect,
+        async (req, res) => {
+            const parsedPayload = emojiPayload.safeParse(req.body);
+            if (!parsedPayload.success) {
+                res.status(400).json({
+                    error: "Invalid emoji payload",
+                    issues: parsedPayload.error.issues,
+                });
+                return;
+            }
+            const payload = parsedPayload.data;
 
-        const userDetails = getUser(req);
-        const device = req.device;
+            const userDetails = getUser(req);
+            const device = req.device;
 
-        if (!device) {
-            res.sendStatus(401);
-            return;
-        }
+            if (!device) {
+                res.sendStatus(401);
+                return;
+            }
 
-        if (!payload.file) {
-            res.sendStatus(400);
-            return;
-        }
+            if (!payload.file) {
+                res.sendStatus(400);
+                return;
+            }
 
-        const buf = Buffer.from(XUtils.decodeBase64(payload.file));
-        const serverEntry = await db.retrieveServer(getParam(req, "serverID"));
+            let buf: Buffer;
+            try {
+                buf = Buffer.from(XUtils.decodeBase64(payload.file));
+            } catch {
+                res.status(400).send({ error: "Emoji must be valid base64." });
+                return;
+            }
+            const serverEntry = await db.retrieveServer(
+                getParam(req, "serverID"),
+            );
 
-        const permissionList = await db.retrievePermissionsByResourceID(
-            getParam(req, "serverID"),
-        );
+            const permissionList = await db.retrievePermissionsByResourceID(
+                getParam(req, "serverID"),
+            );
 
-        if (
-            !userHasPermission(
-                permissionList,
-                userDetails.userID,
-                POWER_LEVELS.EMOJI,
-            )
-        ) {
-            res.sendStatus(401);
-            return;
-        }
-        if (!serverEntry) {
-            res.sendStatus(404);
-            return;
-        }
-        if (!payload.name) {
-            res.sendStatus(400);
-            return;
-        }
-        if (Buffer.byteLength(buf) > 256000) {
-            res.sendStatus(413);
-            return;
-        }
+            if (
+                !userHasPermission(
+                    permissionList,
+                    userDetails.userID,
+                    POWER_LEVELS.EMOJI,
+                )
+            ) {
+                res.sendStatus(401);
+                return;
+            }
+            if (!serverEntry) {
+                res.sendStatus(404);
+                return;
+            }
+            if (!payload.name) {
+                res.sendStatus(400);
+                return;
+            }
+            if (Buffer.byteLength(buf) > 256000) {
+                res.sendStatus(413);
+                return;
+            }
 
-        const mimeType = await fileTypeFromBuffer(buf);
-        if (!ALLOWED_IMAGE_TYPES.includes(mimeType?.mime || "no/type")) {
-            res.status(400).send({
-                error:
-                    "Unsupported file type. Expected jpeg, png, gif, apng, or avif but received " +
-                    String(mimeType?.ext),
-            });
-            return;
-        }
+            const mimeType = await fileTypeFromBuffer(buf);
+            if (!ALLOWED_IMAGE_TYPES.includes(mimeType?.mime || "no/type")) {
+                res.status(400).send({
+                    error:
+                        "Unsupported file type. Expected jpeg, png, gif, apng, or avif but received " +
+                        String(mimeType?.ext),
+                });
+                return;
+            }
 
-        const emoji: Emoji = {
-            emojiID: crypto.randomUUID(),
-            name: payload.name,
-            owner: getParam(req, "serverID"),
-        };
+            const emoji: Emoji = {
+                emojiID: crypto.randomUUID(),
+                name: payload.name,
+                owner: getParam(req, "serverID"),
+            };
 
-        await db.createEmoji(emoji);
+            await db.createEmoji(emoji);
 
-        try {
-            // write the file to disk
-            await fsp.writeFile("emoji/" + emoji.emojiID, buf);
-            res.send(msgpack.encode(emoji));
-        } catch (_err: unknown) {
-            // debugger: emoji write failed
-            res.sendStatus(500);
-        }
-    });
+            try {
+                // write the file to disk
+                await fsp.writeFile("emoji/" + emoji.emojiID, buf);
+                res.send(msgpack.encode(emoji));
+            } catch (_err: unknown) {
+                // debugger: emoji write failed
+                res.sendStatus(500);
+            }
+        },
+    );
 
     api.post(
         "/emoji/:serverID",
+        uploadLimiter,
         protect,
-        multer().single("emoji"),
+        emojiUpload.single("emoji"),
         async (req, res) => {
             const parsedPayload = emojiPayload.safeParse(req.body);
             if (!parsedPayload.success) {
@@ -1017,6 +1369,7 @@ export const initApp = (
     api.use(entitlementRouter);
     api.use(passkeyRouter);
     api.use(passkeyDeviceRouter);
+    api.use(passwordRouter);
 
     api.use("/user", userRouter);
 
@@ -1024,6 +1377,8 @@ export const initApp = (
 
     api.use("/avatar", avatarRouter);
 
+    api.use("/server-icon", serverIconRouter);
+
     api.use("/invite", inviteRouter);
 
     setupDocs(api);