@vex-chat/spire 3.0.1 → 4.1.0

package/dist/server/index.js

@@ -7,18 +7,17 @@ import * as fs from "node:fs";
 import * as fsp from "node:fs/promises";
 import express from "express";
 import { XUtils } from "@vex-chat/crypto";
-import { PreKeysWSSchema, TokenScopes, UserSchema } from "@vex-chat/types";
+import { MAX_FILE_UPLOAD_ENCODED_BODY_BYTES, PreKeysWSSchema, TokenScopes, UserSchema, } from "@vex-chat/types";
 import cors from "cors";
 import { fileTypeFromBuffer, fileTypeFromFile } from "file-type";
 import helmet from "helmet";
-import jwt from "jsonwebtoken";
 import multer from "multer";
 import parseDuration from "parse-duration";
 import { stringify as uuidStringify } from "uuid";
 import { z } from "zod/v4";
 import { POWER_LEVELS } from "../ClientManager.js";
 import { JWT_EXPIRY } from "../Spire.js";
-import { getJwtSecret } from "../utils/jwtSecret.js";
+import { signAuthJwt, verifyAuthJwt } from "../utils/authJwt.js";
 import { msgpack } from "../utils/msgpack.js";
 import { verifyPreKeyWsSignature } from "../utils/preKeySignature.js";
 import { spireXSignOpenAsync } from "../utils/spireXSignOpenAsync.js";
@@ -32,8 +31,10 @@ import { getInviteRouter } from "./invite.js";
 import { setupDocs } from "./openapi.js";
 import { getPasskeyRouter } from "./passkey.js";
 import { getPasskeyDeviceRouter } from "./passkeyDevices.js";
-import { hasAnyPermission, hasPermission, userHasPermission, } from "./permissions.js";
-import { globalLimiter, keyBundleLimiter } from "./rateLimit.js";
+import { getPasswordRouter } from "./password.js";
+import { canDeletePermission, hasAnyPermission, hasPermission, userHasPermission, } from "./permissions.js";
+import { globalLimiter, keyBundleLimiter, uploadLimiter } from "./rateLimit.js";
+import { deleteServerIconFile, getServerIconRouter } from "./serverIcon.js";
 import { getUserRouter } from "./user.js";
 import { censorUser, getParam, getUser } from "./utils.js";
 import { getWellKnownRouter } from "./wellKnown.js";
@@ -45,27 +46,47 @@ export const ALLOWED_IMAGE_TYPES = [
     "image/gif",
     "image/apng",
     "image/avif",
+    "image/webp",
 ];
 // ── Zod schemas for trust-boundary validation ──────────────────────────
 const invitePayload = z.object({
-    duration: z.string().min(1),
-    serverID: z.string().min(1),
+    duration: z.string().min(1).max(32),
+    serverID: z.string().min(1).max(128),
 });
 const channelPayload = z.object({
-    name: z.string().min(1).max(255),
+    name: z.string().trim().min(1).max(100),
 });
-const deviceListPayload = z.array(z.string());
+const serverUpdatePayload = z.object({
+    name: z.string().trim().min(1).max(100),
+});
+const permissionRolePayload = z.object({
+    powerLevel: z.union([z.literal(0), z.literal(50), z.literal(100)]),
+});
+const deviceListPayload = z.array(z.string().min(1).max(128)).max(256);
 const connectPayload = z.object({
-    signed: z.custom((val) => val instanceof Uint8Array),
+    signed: z.custom((val) => val instanceof Uint8Array && val.byteLength <= 16_384),
 });
 const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
 const emojiPayload = z.object({
-    file: z.string().optional(),
-    name: z.string().min(1),
-    signed: z.string().optional(),
+    file: z.string().max(350_000).optional(),
+    name: z.string().trim().min(1).max(64),
+    signed: z.string().max(8192).optional(),
+});
+const emojiUpload = multer({
+    limits: { fields: 3, files: 1, fileSize: 256_000, parts: 4 },
 });
+const DEVELOPMENT_CORS_ORIGINS = [
+    /^https?:\/\/localhost(?::\d{1,5})?$/,
+    /^https?:\/\/127\.0\.0\.1(?::\d{1,5})?$/,
+    /^https?:\/\/\[::1\](?::\d{1,5})?$/,
+    "capacitor://localhost",
+    "http://tauri.localhost",
+    "https://tauri.localhost",
+    "tauri://localhost",
+];
 const jwtUserPayload = z.object({
     exp: z.number().optional(),
+    scope: z.literal("user"),
     user: UserSchema,
 });
 const jwtDevicePayload = z.object({
@@ -77,6 +98,7 @@ const jwtDevicePayload = z.object({
         owner: z.string(),
         signKey: z.string(),
     }),
+    scope: z.literal("device"),
 });
 const jwtPasskeyPayload = z.object({
     passkey: z.object({
@@ -96,7 +118,7 @@ const checkAuth = (req, _res, next) => {
     const token = extractBearer(req);
     if (token) {
         try {
-            const result = jwt.verify(token, getJwtSecret());
+            const result = verifyAuthJwt(token);
             // Passkey-scoped JWTs share the bearer slot with regular
             // user JWTs but carry a `scope: "passkey"` discriminator
             // and a `passkey` claim. Populate `req.passkey` and the
@@ -132,7 +154,7 @@ export function createCheckDevice(db) {
         const token = req.headers["x-device-token"];
         if (typeof token === "string" && token) {
             try {
-                const result = jwt.verify(token, getJwtSecret());
+                const result = verifyAuthJwt(token);
                 const parsed = jwtDevicePayload.safeParse(result);
                 if (parsed.success) {
                     const device = await currentTokenDevice(db, parsed.data.device);
@@ -149,6 +171,24 @@ export function createCheckDevice(db) {
         next();
     };
 }
+/**
+ * Revalidate the credential behind a passkey-scoped bearer on every request.
+ * Passkey JWTs are short-lived, but removing a credential must revoke its
+ * recovery and account-administration access immediately.
+ */
+export function createCheckPasskey(db) {
+    return async (req, _res, next) => {
+        if (req.passkey) {
+            const passkey = await db.retrievePasskeyInternal(req.passkey.passkeyID);
+            if (!passkey || !req.user || passkey.userID !== req.user.userID) {
+                delete req.bearerToken;
+                delete req.passkey;
+                delete req.user;
+            }
+        }
+        next();
+    };
+}
 async function currentTokenDevice(db, tokenDevice) {
     const device = await db.retrieveDevice(tokenDevice.deviceID);
     if (!device || device.signKey !== tokenDevice.signKey) {
@@ -157,7 +197,15 @@ async function currentTokenDevice(db, tokenDevice) {
     return device;
 }
 export const protect = (req, res, next) => {
-    if (!req.user) {
+    if (!req.user || req.passkey) {
+        res.sendStatus(401);
+        return;
+    }
+    next();
+};
+/** Require either an approved device or a fresh passkey session. */
+export const protectAnyAuth = (req, res, next) => {
+    if (!req.user || (!req.device && !req.passkey)) {
         res.sendStatus(401);
         return;
     }
@@ -189,21 +237,33 @@ export const msgpackParser = (req, res, next) => {
     }
     next();
 };
-const directories = ["files", "avatars"];
+const directories = ["files", "avatars", "server-icons"];
 for (const dir of directories) {
     if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir);
     }
 }
 export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDevices) => {
+    const notifyServerChange = async (serverID, additionalUserIDs = []) => {
+        const affectedUsers = await db.retrieveAffectedUsers(serverID);
+        const userIDs = new Set([
+            ...affectedUsers.map((user) => user.userID),
+            ...additionalUserIDs,
+        ]);
+        for (const userID of userIDs) {
+            notify(userID, "serverChange", crypto.randomUUID(), serverID);
+        }
+    };
     // INIT ROUTERS
-    const userRouter = getUserRouter(db, tokenValidator, notify);
+    const userRouter = getUserRouter(db, tokenValidator, notify, disconnectDevices);
     const fileRouter = getFileRouter(db);
     const avatarRouter = getAvatarRouter();
     const billingRouter = getBillingRouter(db, notify);
     const entitlementRouter = getEntitlementRouter(db, notify);
     const inviteRouter = getInviteRouter(db, tokenValidator, notify);
     const passkeyRouter = getPasskeyRouter(db);
+    const passwordRouter = getPasswordRouter(db);
+    const serverIconRouter = getServerIconRouter(db, notifyServerChange);
     const passkeyDeviceRouter = getPasskeyDeviceRouter(db, notify, disconnectDevices);
     // MIDDLEWARE
     // WebAuthn well-known association files (AASA, assetlinks.json)
@@ -217,6 +277,13 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
     // spends any cycles on body parsing, helmet, or auth. See
     // src/server/rateLimit.ts.
     api.use(globalLimiter);
+    // Base64 expands a 25 MiB encrypted upload to about 33.4 MiB. Give only
+    // the JSON fallback route enough room for that encoded payload and its
+    // JSON/msgpack envelope; unrelated routes keep the tighter global cap.
+    api.use("/file/json", express.json({ limit: MAX_FILE_UPLOAD_ENCODED_BODY_BYTES }), express.raw({
+        limit: MAX_FILE_UPLOAD_ENCODED_BODY_BYTES,
+        type: "application/msgpack",
+    }));
     api.use(express.json({ limit: "20mb" }));
     api.use(express.raw({
         limit: "20mb",
@@ -245,7 +312,9 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
         ],
         origin: corsOrigins.length > 0
             ? corsOrigins
-            : true /* reflect request Origin */,
+            : process.env["NODE_ENV"] === "production"
+                ? false
+                : DEVELOPMENT_CORS_ORIGINS,
     }));
     api.use(helmet());
     // Browser bridge used by the CLI to run WebAuthn ceremonies at the same
@@ -254,9 +323,16 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
     api.use(getCliPasskeyPageRouter());
     api.use(msgpackParser);
     api.use(checkAuth);
+    api.use(createCheckPasskey(db));
     api.use(createCheckDevice(db));
     api.get("/server/:id", protect, async (req, res) => {
-        const server = await db.retrieveServer(getParam(req, "id"));
+        const serverID = getParam(req, "id");
+        const userDetails = getUser(req);
+        const permissions = await db.retrievePermissions(userDetails.userID, "server");
+        if (!hasAnyPermission(permissions, serverID)) {
+            return res.sendStatus(403);
+        }
+        const server = await db.retrieveServer(serverID);
         if (server) {
             return res.send(msgpack.encode(server));
         }
@@ -264,10 +340,69 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
             return res.sendStatus(404);
         }
     });
+    api.patch("/server/:id", protect, async (req, res) => {
+        const parsed = serverUpdatePayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid server update",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const serverID = getParam(req, "id");
+        const permissions = await db.retrievePermissions(getUser(req).userID, "server");
+        if (!hasPermission(permissions, serverID, POWER_LEVELS.CREATE)) {
+            res.sendStatus(403);
+            return;
+        }
+        const server = await db.updateServer(serverID, parsed.data);
+        if (!server) {
+            res.sendStatus(404);
+            return;
+        }
+        await notifyServerChange(serverID);
+        res.send(msgpack.encode(server));
+    });
+    api.post("/servers", protect, async (req, res) => {
+        const parsed = serverUpdatePayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid server",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const server = await db.createServer(parsed.data.name, getUser(req).userID);
+        res.send(msgpack.encode(server));
+    });
+    // Compatibility route for clients released before server names moved into
+    // the request body. New clients use POST /servers so Unicode names work.
     api.post("/server/:name", protect, async (req, res) => {
         const userDetails = getUser(req);
-        const serverName = atob(getParam(req, "name"));
-        const server = await db.createServer(serverName, userDetails.userID);
+        const encodedName = getParam(req, "name");
+        if (encodedName.length > 256) {
+            res.sendStatus(400);
+            return;
+        }
+        let decodedName;
+        try {
+            decodedName = atob(encodedName);
+        }
+        catch {
+            res.sendStatus(400);
+            return;
+        }
+        const parsedName = z
+            .string()
+            .trim()
+            .min(1)
+            .max(100)
+            .safeParse(decodedName);
+        if (!parsedName.success) {
+            res.sendStatus(400);
+            return;
+        }
+        const server = await db.createServer(parsedName.data, userDetails.userID);
         res.send(msgpack.encode(server));
     });
     api.post("/server/:serverID/invites", protect, async (req, res) => {
@@ -315,11 +450,20 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
         const serverID = getParam(req, "id");
         const permissions = await db.retrievePermissions(userDetails.userID, "server");
         if (hasPermission(permissions, serverID, POWER_LEVELS.DELETE)) {
+            const server = await db.retrieveServer(serverID);
+            if (!server) {
+                res.sendStatus(404);
+                return;
+            }
+            const affectedUsers = await db.retrieveAffectedUsers(serverID);
             await db.deleteServer(serverID);
+            if (server.icon)
+                await deleteServerIconFile(server.icon);
+            await notifyServerChange(serverID, affectedUsers.map((user) => user.userID));
             res.sendStatus(200);
             return;
         }
-        res.sendStatus(401);
+        res.sendStatus(403);
     });
     api.post("/server/:id/channels", protect, async (req, res) => {
         const userDetails = getUser(req);
@@ -338,14 +482,10 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
         if (hasPermission(permissions, serverID, POWER_LEVELS.CREATE)) {
             const channel = await db.createChannel(name, serverID);
             res.send(msgpack.encode(channel));
-            const affectedUsers = await db.retrieveAffectedUsers(serverID);
-            // tell everyone about server change
-            for (const user of affectedUsers) {
-                notify(user.userID, "serverChange", crypto.randomUUID(), serverID);
-            }
+            await notifyServerChange(serverID);
             return;
         }
-        res.sendStatus(401);
+        res.sendStatus(403);
     });
     api.get("/server/:id/channels", protect, async (req, res) => {
         const serverID = getParam(req, "id");
@@ -359,7 +499,13 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
         res.sendStatus(401);
     });
     api.get("/server/:serverID/emoji", protect, async (req, res) => {
-        const rows = await db.retrieveEmojiList(getParam(req, "serverID"));
+        const serverID = getParam(req, "serverID");
+        const permissions = await db.retrievePermissions(getUser(req).userID, "server");
+        if (!hasAnyPermission(permissions, serverID)) {
+            res.sendStatus(403);
+            return;
+        }
+        const rows = await db.retrieveEmojiList(serverID);
         res.send(msgpack.encode(rows));
     });
     api.get("/server/:serverID/permissions", protect, async (req, res) => {
@@ -373,6 +519,34 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
         }
         res.send(msgpack.encode(permissions));
     });
+    api.patch("/channel/:id", protect, async (req, res) => {
+        const parsed = channelPayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid channel update",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const channelID = getParam(req, "id");
+        const channel = await db.retrieveChannel(channelID);
+        if (!channel) {
+            res.sendStatus(404);
+            return;
+        }
+        const permissions = await db.retrievePermissions(getUser(req).userID, "server");
+        if (!hasPermission(permissions, channel.serverID, POWER_LEVELS.DELETE)) {
+            res.sendStatus(403);
+            return;
+        }
+        const updated = await db.updateChannel(channelID, parsed.data.name);
+        if (!updated) {
+            res.sendStatus(404);
+            return;
+        }
+        await notifyServerChange(channel.serverID);
+        res.send(msgpack.encode(updated));
+    });
     api.delete("/channel/:id", protect, async (req, res) => {
         const channelID = getParam(req, "id");
         const userDetails = getUser(req);
@@ -384,28 +558,72 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
         const permissions = await db.retrievePermissions(userDetails.userID, "server");
         for (const permission of permissions) {
             if (permission.resourceID === channel.serverID &&
-                permission.powerLevel > 50) {
-                await db.deleteChannel(channelID);
-                res.sendStatus(200);
-                const affectedUsers = await db.retrieveAffectedUsers(channel.serverID);
-                // tell everyone about server change
-                for (const user of affectedUsers) {
-                    notify(user.userID, "serverChange", crypto.randomUUID(), channel.serverID);
+                permission.powerLevel >= POWER_LEVELS.DELETE) {
+                const deleted = await db.deleteChannelIfNotLast(channelID);
+                if (!deleted) {
+                    res.status(409).json({
+                        error: "A server must have at least one channel.",
+                    });
+                    return;
                 }
+                await notifyServerChange(channel.serverID);
+                res.sendStatus(200);
                 return;
             }
         }
-        res.sendStatus(401);
+        res.sendStatus(403);
     });
     api.get("/channel/:id", protect, async (req, res) => {
         const channel = await db.retrieveChannel(getParam(req, "id"));
         if (channel) {
+            const permissions = await db.retrievePermissions(getUser(req).userID, "server");
+            if (!hasAnyPermission(permissions, channel.serverID)) {
+                return res.sendStatus(403);
+            }
             return res.send(msgpack.encode(channel));
         }
         else {
             return res.sendStatus(404);
         }
     });
+    api.patch("/permission/:permissionID", protect, async (req, res) => {
+        const parsed = permissionRolePayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid role",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        const target = await db.retrievePermission(getParam(req, "permissionID"));
+        if (!target) {
+            res.sendStatus(404);
+            return;
+        }
+        if (target.resourceType !== "server") {
+            res.sendStatus(400);
+            return;
+        }
+        const actor = getUser(req);
+        if (target.userID === actor.userID) {
+            res.status(400).json({
+                error: "Use another owner to change your role.",
+            });
+            return;
+        }
+        const actorPermissions = await db.retrievePermissions(actor.userID, "server");
+        if (!hasPermission(actorPermissions, target.resourceID, 100)) {
+            res.sendStatus(403);
+            return;
+        }
+        const updated = await db.updatePermissionPowerLevel(target.permissionID, parsed.data.powerLevel);
+        if (!updated) {
+            res.sendStatus(404);
+            return;
+        }
+        await notifyServerChange(target.resourceID);
+        res.send(msgpack.encode(updated));
+    });
     api.delete("/permission/:permissionID", protect, async (req, res) => {
         const permissionID = getParam(req, "permissionID");
         const userDetails = getUser(req);
@@ -415,17 +633,29 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
             return;
         }
         const permissions = await db.retrievePermissions(userDetails.userID, permToDelete.resourceType);
-        for (const perm of permissions) {
-            if (perm.resourceID === permToDelete.resourceID &&
-                (perm.userID === userDetails.userID ||
-                    (perm.powerLevel > POWER_LEVELS.DELETE &&
-                        perm.powerLevel > permToDelete.powerLevel))) {
-                await db.deletePermission(permToDelete.permissionID);
-                res.sendStatus(200);
-                return;
+        if (canDeletePermission(permissions, userDetails.userID, permToDelete, POWER_LEVELS.DELETE)) {
+            if (permToDelete.resourceType === "server" &&
+                permToDelete.powerLevel >= 100) {
+                const resourcePermissions = await db.retrievePermissionsByResourceID(permToDelete.resourceID);
+                const hasAnotherOwner = resourcePermissions.some((permission) => permission.permissionID !== permToDelete.permissionID &&
+                    permission.powerLevel >= 100);
+                if (!hasAnotherOwner) {
+                    res.status(409).json({
+                        error: "Delete the server instead of leaving it without an owner.",
+                    });
+                    return;
+                }
+            }
+            await db.deletePermission(permToDelete.permissionID);
+            if (permToDelete.resourceType === "server") {
+                await notifyServerChange(permToDelete.resourceID, [
+                    permToDelete.userID,
+                ]);
             }
+            res.sendStatus(200);
+            return;
         }
-        res.sendStatus(401);
+        res.sendStatus(403);
     });
     api.post("/userList/:channelID", protect, async (req, res) => {
         const userDetails = getUser(req);
@@ -486,6 +716,10 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
             res.sendStatus(401);
             return;
         }
+        if (deviceDetails.deviceID !== getParam(req, "id")) {
+            res.sendStatus(403);
+            return;
+        }
         const inbox = await db.retrieveMail(deviceDetails.deviceID);
         res.send(msgpack.encode(inbox));
     });
@@ -511,10 +745,7 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
         const regKey = await spireXSignOpenAsync(signed, XUtils.decodeHex(device.signKey));
         if (regKey &&
             tokenValidator(uuidStringify(regKey), TokenScopes.Connect)) {
-            const token = jwt.sign({ device }, getJwtSecret(), {
-                expiresIn: JWT_EXPIRY,
-            });
-            jwt.verify(token, getJwtSecret());
+            const token = signAuthJwt({ device, scope: "device" }, JWT_EXPIRY);
             res.send(msgpack.encode({ deviceToken: token }));
         }
         else {
@@ -527,6 +758,10 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
             res.sendStatus(401);
             return;
         }
+        if (deviceDetails.deviceID !== getParam(req, "id")) {
+            res.sendStatus(403);
+            return;
+        }
         const count = await db.getOTKCount(deviceDetails.deviceID);
         res.send(msgpack.encode({ count }));
     });
@@ -560,7 +795,7 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
             res.status(400).send({ error: "Prekey deviceID mismatch." });
             return;
         }
-        if (!(await verifyPreKeyWsSignature(preKey, device.signKey))) {
+        if (!(await verifyPreKeyWsSignature(preKey, device.signKey, "signed"))) {
             res.status(401).send({ error: "Prekey signature invalid." });
             return;
         }
@@ -601,7 +836,7 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
                 res.status(400).send({ error: "OTK deviceID mismatch." });
                 return;
             }
-            if (!(await verifyPreKeyWsSignature(submittedOTK, device.signKey))) {
+            if (!(await verifyPreKeyWsSignature(submittedOTK, device.signKey, "one-time"))) {
                 res.status(401).send({ error: "OTK signature invalid." });
                 return;
             }
@@ -611,6 +846,15 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
     });
     api.get("/emoji/:emojiID/details", protect, async (req, res) => {
         const emoji = await db.retrieveEmoji(getParam(req, "emojiID"));
+        if (!emoji) {
+            res.sendStatus(404);
+            return;
+        }
+        const permissions = await db.retrievePermissions(getUser(req).userID, "server");
+        if (!hasAnyPermission(permissions, emoji.owner)) {
+            res.sendStatus(403);
+            return;
+        }
         res.send(msgpack.encode(emoji));
     });
     api.get("/emoji/:emojiID", protect, async (req, res) => {
@@ -619,6 +863,16 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
             res.sendStatus(400);
             return;
         }
+        const emoji = await db.retrieveEmoji(safeId.data);
+        if (!emoji) {
+            res.sendStatus(404);
+            return;
+        }
+        const permissions = await db.retrievePermissions(getUser(req).userID, "server");
+        if (!hasAnyPermission(permissions, emoji.owner)) {
+            res.sendStatus(403);
+            return;
+        }
         const filePath = "./emoji/" + safeId.data;
         const typeDetails = await fileTypeFromFile(filePath).catch(() => null);
         if (!typeDetails) {
@@ -634,7 +888,7 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
         });
         stream.pipe(res);
     });
-    api.post("/emoji/:serverID/json", protect, async (req, res) => {
+    api.post("/emoji/:serverID/json", uploadLimiter, protect, async (req, res) => {
         const parsedPayload = emojiPayload.safeParse(req.body);
         if (!parsedPayload.success) {
             res.status(400).json({
@@ -654,7 +908,14 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
             res.sendStatus(400);
             return;
         }
-        const buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        let buf;
+        try {
+            buf = Buffer.from(XUtils.decodeBase64(payload.file));
+        }
+        catch {
+            res.status(400).send({ error: "Emoji must be valid base64." });
+            return;
+        }
         const serverEntry = await db.retrieveServer(getParam(req, "serverID"));
         const permissionList = await db.retrievePermissionsByResourceID(getParam(req, "serverID"));
         if (!userHasPermission(permissionList, userDetails.userID, POWER_LEVELS.EMOJI)) {
@@ -697,7 +958,7 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
             res.sendStatus(500);
         }
     });
-    api.post("/emoji/:serverID", protect, multer().single("emoji"), async (req, res) => {
+    api.post("/emoji/:serverID", uploadLimiter, protect, emojiUpload.single("emoji"), async (req, res) => {
         const parsedPayload = emojiPayload.safeParse(req.body);
         if (!parsedPayload.success) {
             res.status(400).json({
@@ -774,9 +1035,11 @@ export const initApp = (api, db, tokenValidator, signKeys, notify, disconnectDev
     api.use(entitlementRouter);
     api.use(passkeyRouter);
     api.use(passkeyDeviceRouter);
+    api.use(passwordRouter);
     api.use("/user", userRouter);
     api.use("/file", fileRouter);
     api.use("/avatar", avatarRouter);
+    api.use("/server-icon", serverIconRouter);
     api.use("/invite", inviteRouter);
     setupDocs(api);
     // Central error handler MUST be last. Handles both thrown AppErrors