@vex-chat/spire 3.0.1 → 4.1.0

package/dist/server/passkeyDevices.js

@@ -58,6 +58,7 @@ export const getPasskeyDeviceRouter = (db, notify, disconnectDevices) => {
         // "I lost my phone, sign in with the passkey, wipe the
         // old device, then recover onto a new one."
         await db.deleteDevice(deviceID);
+        disconnectDevices?.([deviceID]);
         // Tell whoever's online that the device-list shape
         // changed; clients use this to refresh the Settings →
         // Devices view in real time.

package/dist/server/passkeyDevices.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkeyDevices.js","sourceRoot":"","sources":["../../src/server/passkeyDevices.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACH,8BAA8B,EAC9B,8BAA8B,GACjC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAClC,EAAY,EACZ,MAMS,EACT,iBAAiD,EACnD,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACN,2BAA2B,EAC3B,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,MAAM,CACT,qCAAqC,EACrC,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,uDAAuD;QACvD,qDAAqD;QACrD,uDAAuD;QACvD,yDAAyD;QACzD,uDAAuD;QACvD,4CAA4C;QAC5C,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,mDAAmD;QACnD,sDAAsD;QACtD,6BAA6B;QAC7B,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,uDAAuD,EACvD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,oDAAoD;QACpD,0DAA0D;QAC1D,4DAA4D;QAC5D,yDAAyD;QACzD,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,mBAAmB,EAAE,SAAS;YAC9B,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACzD,iBAAiB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7C,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,sDAAsD,EACtD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}
+{"version":3,"file":"passkeyDevices.js","sourceRoot":"","sources":["../../src/server/passkeyDevices.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EACH,8BAA8B,EAC9B,8BAA8B,GACjC,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAClC,EAAY,EACZ,MAMS,EACT,iBAAiD,EACnD,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACN,2BAA2B,EAC3B,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,MAAM,CACT,qCAAqC,EACrC,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,uDAAuD;QACvD,qDAAqD;QACrD,uDAAuD;QACvD,yDAAyD;QACzD,uDAAuD;QACvD,4CAA4C;QAC5C,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,mDAAmD;QACnD,sDAAsD;QACtD,6BAA6B;QAC7B,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACzD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,uDAAuD,EACvD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QACzC,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,oDAAoD;QACpD,0DAA0D;QAC1D,4DAA4D;QAC5D,yDAAyD;QACzD,yDAAyD;QACzD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,mBAAmB,EAAE,SAAS;YAC9B,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACzD,iBAAiB,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC7C,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CACP,sDAAsD,EACtD,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7C,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAChC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC;YAChD,MAAM,EAAE,QAAQ;YAChB,EAAE;YACF,MAAM;YACN,SAAS;YACT,MAAM;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/server/password.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import type { Database } from "../Database.ts";
+export declare const getPasswordRouter: (db: Database) => import("express-serve-static-core").Router;

package/dist/server/password.js

@@ -0,0 +1,58 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import express from "express";
+import { PasswordUpdatePayloadSchema } from "@vex-chat/types";
+import { hashPasswordArgon2, validateAccountPassword, verifyPassword, } from "../Database.js";
+import { AppError } from "./errors.js";
+import { passwordUpdateLimiter } from "./rateLimit.js";
+import { getParam, getUser } from "./utils.js";
+import { protectAnyAuth } from "./index.js";
+export const getPasswordRouter = (db) => {
+    const router = express.Router();
+    router.patch("/user/:id/password", protectAnyAuth, passwordUpdateLimiter, async (req, res) => {
+        const authenticatedUser = getUser(req);
+        const userID = getParam(req, "id");
+        if (authenticatedUser.userID !== userID) {
+            throw new AppError(403, "Not authorized for this account");
+        }
+        const payload = PasswordUpdatePayloadSchema.parse(req.body);
+        const user = await db.retrieveUser(userID);
+        if (!user) {
+            throw new AppError(404, "Account not found");
+        }
+        const passwordError = validateAccountPassword(payload.newPassword, user.username);
+        if (passwordError) {
+            throw new AppError(400, passwordError);
+        }
+        if (req.passkey) {
+            const passkey = await db.retrievePasskeyInternal(req.passkey.passkeyID);
+            if (!passkey || passkey.userID !== userID) {
+                throw new AppError(401, "Passkey authentication required");
+            }
+        }
+        else {
+            if (!req.device ||
+                req.device.owner !== userID ||
+                !payload.currentPassword) {
+                throw new AppError(401, "Current-password authentication required");
+            }
+            const current = await verifyPassword(payload.currentPassword, user);
+            if (!current.valid) {
+                throw new AppError(401, "Current password is incorrect");
+            }
+        }
+        const reused = await verifyPassword(payload.newPassword, user);
+        if (reused.valid) {
+            throw new AppError(409, "New password must be different from the current password");
+        }
+        const passwordHash = await hashPasswordArgon2(payload.newPassword);
+        await db.rehashPassword(userID, passwordHash);
+        res.setHeader("Cache-Control", "no-store");
+        res.sendStatus(204);
+    });
+    return router;
+};
+//# sourceMappingURL=password.js.map

package/dist/server/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/server/password.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAE9D,OAAO,EACH,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,GACjB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAY,EAAE,EAAE;IAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,KAAK,CACR,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,iBAAiB,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,2BAA2B,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,aAAa,GAAG,uBAAuB,CACzC,OAAO,CAAC,WAAW,EACnB,IAAI,CAAC,QAAQ,CAChB,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC3C,CAAC;QAED,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAC5C,GAAG,CAAC,OAAO,CAAC,SAAS,CACxB,CAAC;YACF,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACxC,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC;YAC/D,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,IACI,CAAC,GAAG,CAAC,MAAM;gBACX,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM;gBAC3B,CAAC,OAAO,CAAC,eAAe,EAC1B,CAAC;gBACC,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,0CAA0C,CAC7C,CAAC;YACN,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAChC,OAAO,CAAC,eAAe,EACvB,IAAI,CACP,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;YAC7D,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CACd,GAAG,EACH,0DAA0D,CAC7D,CAAC;QACN,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC9C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC3C,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CACJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/server/permissions.d.ts

@@ -4,6 +4,7 @@
  * Commercial licenses available at vex.wtf
  */
 import type { Permission } from "@vex-chat/types";
+export declare function canDeletePermission(permissions: Permission[], actorUserID: string, target: Permission, adminPowerLevel: number): boolean;
 /**
  * Check whether any permission in the list covers the given resource
  * (any power level).

package/dist/server/permissions.js

@@ -3,6 +3,15 @@
  * Licensed under AGPL-3.0. See LICENSE for details.
  * Commercial licenses available at vex.wtf
  */
+export function canDeletePermission(permissions, actorUserID, target, adminPowerLevel) {
+    if (target.userID === actorUserID) {
+        return true;
+    }
+    return permissions.some((permission) => permission.userID === actorUserID &&
+        permission.resourceID === target.resourceID &&
+        permission.powerLevel >= adminPowerLevel &&
+        permission.powerLevel > target.powerLevel);
+}
 /**
  * Check whether any permission in the list covers the given resource
  * (any power level).
@@ -15,13 +24,13 @@ export function hasAnyPermission(permissions, resourceID) {
  * on the given resource.
  */
 export function hasPermission(permissions, resourceID, minPowerLevel) {
-    return permissions.some((p) => p.resourceID === resourceID && p.powerLevel > minPowerLevel);
+    return permissions.some((p) => p.resourceID === resourceID && p.powerLevel >= minPowerLevel);
 }
 /**
  * Check whether any permission in the list grants at least `minPowerLevel`
  * on the given resource AND belongs to the specified user.
  */
 export function userHasPermission(permissions, userID, minPowerLevel) {
-    return permissions.some((p) => p.userID === userID && p.powerLevel > minPowerLevel);
+    return permissions.some((p) => p.userID === userID && p.powerLevel >= minPowerLevel);
 }
 //# sourceMappingURL=permissions.js.map

package/dist/server/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC5B,WAAyB,EACzB,UAAkB;IAElB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CACzB,WAAyB,EACzB,UAAkB,EAClB,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,GAAG,aAAa,CACrE,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC7B,WAAyB,EACzB,MAAc,EACd,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,GAAG,aAAa,CAC7D,CAAC;AACN,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/server/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,UAAU,mBAAmB,CAC/B,WAAyB,EACzB,WAAmB,EACnB,MAAkB,EAClB,eAAuB;IAEvB,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,UAAU,EAAE,EAAE,CACX,UAAU,CAAC,MAAM,KAAK,WAAW;QACjC,UAAU,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;QAC3C,UAAU,CAAC,UAAU,IAAI,eAAe;QACxC,UAAU,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAChD,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC5B,WAAyB,EACzB,UAAkB;IAElB,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CACzB,WAAyB,EACzB,UAAkB,EAClB,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC,UAAU,IAAI,aAAa,CACtE,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC7B,WAAyB,EACzB,MAAc,EACd,aAAqB;IAErB,OAAO,WAAW,CAAC,IAAI,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,IAAI,aAAa,CAC9D,CAAC;AACN,CAAC"}

package/dist/server/rateLimit.d.ts

@@ -34,6 +34,17 @@ export declare const globalLimiter: import("express-rate-limit").RateLimitReques
  * (CWE-307) without harming UX.
  */
 export declare const authLimiter: import("express-rate-limit").RateLimitRequestHandler;
+/**
+ * Cross-IP password defense. This account bucket complements the IP bucket so
+ * a distributed password spray cannot make unlimited guesses at one account.
+ */
+export declare const accountAuthLimiter: import("express-rate-limit").RateLimitRequestHandler;
+/**
+ * Limit repeated password replacement attempts per authenticated account.
+ * This is intentionally tighter than sign-in because each failed request has
+ * already passed bearer/device validation and still consumes an Argon2 check.
+ */
+export declare const passwordUpdateLimiter: import("express-rate-limit").RateLimitRequestHandler;
 /**
  * Upload endpoint limiter. Applied per-route to /file and /avatar
  * POSTs, BEFORE multer parses the multipart body. Caps the number of

package/dist/server/rateLimit.js

@@ -59,14 +59,13 @@ function disableRateLimitsByEnv() {
  * versions silently collapsed all IPv4-mapped IPv6 addresses into
  * one bucket, which let attackers bypass the limiter).
  *
- * `trust proxy` must be set on the Express app (see Spire.ts) so
- * `req.ip` returns the real client address, not the immediate proxy.
+ * `trust proxy` must match the real deployment topology (see Spire.ts) so
+ * `req.ip` cannot be spoofed and does not collapse all traffic onto a proxy.
  */
 /**
  * Bucket requests by the real client IP, IPv6-safe.
  *
- * `req.ip` is already populated correctly because `trust proxy` is
- * set to `1` in Spire's constructor. We still run it through
+ * `req.ip` reflects the explicitly configured proxy hop count. We still run it through
  * `ipKeyGenerator` so IPv4-mapped IPv6 (`::ffff:1.2.3.4`) doesn't
  * collide with unrelated IPv6 addresses in the same /56.
  */
@@ -104,6 +103,46 @@ export const authLimiter = rateLimit({
     standardHeaders: "draft-7",
     windowMs: 15 * 60 * 1000,
 });
+/**
+ * Cross-IP password defense. This account bucket complements the IP bucket so
+ * a distributed password spray cannot make unlimited guesses at one account.
+ */
+export const accountAuthLimiter = rateLimit({
+    keyGenerator: (req) => {
+        const body = req.body;
+        const username = typeof body === "object" &&
+            body !== null &&
+            "username" in body &&
+            typeof body.username === "string"
+            ? body.username.trim().toLowerCase().slice(0, 64)
+            : "";
+        return username.length > 0
+            ? `account:${username}`
+            : `invalid:${keyByIp(req)}`;
+    },
+    legacyHeaders: false,
+    limit: 100,
+    skip: devApiKeySkipsRateLimits,
+    skipSuccessfulRequests: true,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});
+/**
+ * Limit repeated password replacement attempts per authenticated account.
+ * This is intentionally tighter than sign-in because each failed request has
+ * already passed bearer/device validation and still consumes an Argon2 check.
+ */
+export const passwordUpdateLimiter = rateLimit({
+    keyGenerator: (req) => req.user?.userID
+        ? `password:${req.user.userID}`
+        : `invalid:${keyByIp(req)}`,
+    legacyHeaders: false,
+    limit: 10,
+    skip: devApiKeySkipsRateLimits,
+    skipSuccessfulRequests: true,
+    standardHeaders: "draft-7",
+    windowMs: 15 * 60 * 1000,
+});
 /**
  * Upload endpoint limiter. Applied per-route to /file and /avatar
  * POSTs, BEFORE multer parses the multipart body. Caps the number of

package/dist/server/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/server/rateLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAMlD,MAAM,UAAU,gBAAgB,CAAC,GAAiB;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,eAAe,CAClB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAClC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAiB;IACtD,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,sBAAsB;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACtC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;QAClB,MAAM,MAAM,GACR,GAAG,CAAC,IAAI,EAAE,MAAM;YAChB,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GACR,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/server/rateLimit.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAMlD,MAAM,UAAU,gBAAgB,CAAC,GAAiB;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,eAAe,CAClB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAC9B,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAClC,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAiB;IACtD,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,sBAAsB;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,MAAM,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;GAMG;AACH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAU,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;IACxC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;QAClB,MAAM,IAAI,GAAY,GAAG,CAAC,IAAI,CAAC;QAC/B,MAAM,QAAQ,GACV,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACb,UAAU,IAAI,IAAI;YAClB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YAC7B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACjD,CAAC,CAAC,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;YACtB,CAAC,CAAC,WAAW,QAAQ,EAAE;YACvB,CAAC,CAAC,WAAW,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;IACpC,CAAC;IACD,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;IAC3C,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE,CAClB,GAAG,CAAC,IAAI,EAAE,MAAM;QACZ,CAAC,CAAC,YAAY,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE;QAC/B,CAAC,CAAC,WAAW,OAAO,CAAC,GAAG,CAAC,EAAE;IACnC,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,sBAAsB,EAAE,IAAI;IAC5B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;IACnC,YAAY,EAAE,OAAO;IACrB,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,IAAI;CACtB,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACtC,YAAY,EAAE,CAAC,GAAG,EAAE,EAAE;QAClB,MAAM,MAAM,GACR,GAAG,CAAC,IAAI,EAAE,MAAM;YAChB,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GACR,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;IACjC,CAAC;IACD,aAAa,EAAE,KAAK;IACpB,KAAK,EAAE,EAAE;IACT,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,SAAS;IAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;CAC3B,CAAC,CAAC"}

package/dist/server/serverIcon.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import type { Database } from "../Database.ts";
+type NotifyServerChange = (serverID: string) => Promise<void>;
+export declare function deleteServerIconFile(iconID: string): Promise<void>;
+export declare const getServerIconRouter: (db: Database, notifyServerChange: NotifyServerChange) => import("express-serve-static-core").Router;
+export {};

package/dist/server/serverIcon.js

@@ -0,0 +1,158 @@
+/**
+ * Copyright (c) 2020-2026 Vex Heavy Industries LLC
+ * Licensed under AGPL-3.0. See LICENSE for details.
+ * Commercial licenses available at vex.wtf
+ */
+import * as fs from "node:fs";
+import * as fsp from "node:fs/promises";
+import express from "express";
+import { XUtils } from "@vex-chat/crypto";
+import { fileTypeFromBuffer, fileTypeFromFile } from "file-type";
+import multer from "multer";
+import { z } from "zod/v4";
+import { POWER_LEVELS } from "../ClientManager.js";
+import { msgpack } from "../utils/msgpack.js";
+import { hasPermission } from "./permissions.js";
+import { uploadLimiter } from "./rateLimit.js";
+import { getParam, getUser } from "./utils.js";
+import { ALLOWED_IMAGE_TYPES, protect } from "./index.js";
+const SERVER_ICON_DIR = "server-icons";
+const MAX_SERVER_ICON_BYTES = 5 * 1024 * 1024;
+const safePathParam = z.string().regex(/^[a-zA-Z0-9._-]+$/);
+const serverIconUpload = multer({
+    limits: { fields: 1, files: 1, fileSize: MAX_SERVER_ICON_BYTES, parts: 2 },
+});
+const serverIconJsonPayload = z.object({
+    file: z
+        .string()
+        .min(1)
+        .max(Math.ceil((MAX_SERVER_ICON_BYTES * 4) / 3) + 4),
+});
+export async function deleteServerIconFile(iconID) {
+    const safeID = safePathParam.safeParse(iconID);
+    if (!safeID.success)
+        return;
+    await fsp
+        .unlink(`${SERVER_ICON_DIR}/${safeID.data}`)
+        .catch(() => undefined);
+}
+export const getServerIconRouter = (db, notifyServerChange) => {
+    const router = express.Router();
+    router.get("/:iconID", async (req, res) => {
+        const safeID = safePathParam.safeParse(getParam(req, "iconID"));
+        if (!safeID.success) {
+            res.sendStatus(400);
+            return;
+        }
+        const filePath = `${SERVER_ICON_DIR}/${safeID.data}`;
+        const typeDetails = await fileTypeFromFile(filePath).catch(() => null);
+        if (!typeDetails) {
+            res.sendStatus(404);
+            return;
+        }
+        res.set("Content-Type", typeDetails.mime);
+        res.set("Cache-Control", "public, max-age=31536000, immutable");
+        res.set("Cross-Origin-Resource-Policy", "cross-origin");
+        const stream = fs.createReadStream(filePath);
+        stream.on("error", () => {
+            if (!res.headersSent)
+                res.sendStatus(500);
+            else
+                res.destroy();
+        });
+        stream.pipe(res);
+    });
+    router.post("/:serverID/json", uploadLimiter, protect, async (req, res) => {
+        const parsed = serverIconJsonPayload.safeParse(req.body);
+        if (!parsed.success) {
+            res.status(400).json({
+                error: "Invalid server icon payload",
+                issues: parsed.error.issues,
+            });
+            return;
+        }
+        let buffer;
+        try {
+            buffer = Buffer.from(XUtils.decodeBase64(parsed.data.file));
+        }
+        catch {
+            res.status(400).json({ error: "Icon must be valid base64." });
+            return;
+        }
+        await saveIcon(req, res, db, notifyServerChange, buffer);
+    });
+    router.post("/:serverID", uploadLimiter, protect, serverIconUpload.single("icon"), async (req, res) => {
+        if (!req.file) {
+            res.sendStatus(400);
+            return;
+        }
+        await saveIcon(req, res, db, notifyServerChange, req.file.buffer);
+    });
+    router.delete("/:serverID", protect, async (req, res) => {
+        const serverID = getParam(req, "serverID");
+        if (!(await canManageServer(db, getUser(req).userID, serverID))) {
+            res.sendStatus(403);
+            return;
+        }
+        const existing = await db.retrieveServer(serverID);
+        if (!existing) {
+            res.sendStatus(404);
+            return;
+        }
+        const updated = await db.updateServer(serverID, { icon: null });
+        if (!updated) {
+            res.sendStatus(404);
+            return;
+        }
+        if (existing.icon)
+            await deleteServerIconFile(existing.icon);
+        await notifyServerChange(serverID);
+        res.send(msgpack.encode(updated));
+    });
+    return router;
+};
+async function canManageServer(db, userID, serverID) {
+    const permissions = await db.retrievePermissions(userID, "server");
+    return hasPermission(permissions, serverID, POWER_LEVELS.CREATE);
+}
+async function saveIcon(req, res, db, notifyServerChange, buffer) {
+    const serverID = getParam(req, "serverID");
+    if (!(await canManageServer(db, getUser(req).userID, serverID))) {
+        res.sendStatus(403);
+        return;
+    }
+    if (buffer.byteLength > MAX_SERVER_ICON_BYTES) {
+        res.sendStatus(413);
+        return;
+    }
+    const typeDetails = await fileTypeFromBuffer(buffer);
+    if (!ALLOWED_IMAGE_TYPES.includes(typeDetails?.mime ?? "")) {
+        res.status(400).json({
+            error: "Unsupported icon type. Use JPEG, PNG, GIF, APNG, AVIF, or WebP.",
+        });
+        return;
+    }
+    const existing = await db.retrieveServer(serverID);
+    if (!existing) {
+        res.sendStatus(404);
+        return;
+    }
+    const iconID = crypto.randomUUID();
+    const filePath = `${SERVER_ICON_DIR}/${iconID}`;
+    try {
+        await fsp.writeFile(filePath, buffer, { flag: "wx" });
+        const updated = await db.updateServer(serverID, { icon: iconID });
+        if (!updated) {
+            throw new Error("Server disappeared while its icon was updating.");
+        }
+        if (existing.icon)
+            await deleteServerIconFile(existing.icon);
+        await notifyServerChange(serverID);
+        res.send(msgpack.encode(updated));
+    }
+    catch (error) {
+        await fsp.unlink(filePath).catch(() => undefined);
+        throw error;
+    }
+}
+//# sourceMappingURL=serverIcon.js.map

package/dist/server/serverIcon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverIcon.js","sourceRoot":"","sources":["../../src/server/serverIcon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AAExC,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,eAAe,GAAG,cAAc,CAAC;AACvC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9C,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAC5D,MAAM,gBAAgB,GAAG,MAAM,CAAC;IAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE;CAC7E,CAAC,CAAC;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;CAC3D,CAAC,CAAC;AAIH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO;IAC5B,MAAM,GAAG;SACJ,MAAM,CAAC,GAAG,eAAe,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;SAC3C,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAC/B,EAAY,EACZ,kBAAsC,EACxC,EAAE;IACA,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,eAAe,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;;gBACrC,GAAG,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,KAAK,EAAE,6BAA6B;gBACpC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC9B,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC9D,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CACP,YAAY,EACZ,aAAa,EACb,OAAO,EACP,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAC/B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACf,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACZ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC,CACJ,CAAC;IAEF,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI;YAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC;AAEF,KAAK,UAAU,eAAe,CAC1B,EAAY,EACZ,MAAc,EACd,QAAgB;IAEhB,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACnE,OAAO,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,QAAQ,CACnB,GAAoB,EACpB,GAAqB,EACrB,EAAY,EACZ,kBAAsC,EACtC,MAAc;IAEd,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO;IACX,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC5C,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACjB,KAAK,EAAE,iEAAiE;SAC3E,CAAC,CAAC;QACH,OAAO;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO;IACX,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,GAAG,eAAe,IAAI,MAAM,EAAE,CAAC;IAChD,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI;YAAE,MAAM,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAwB,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACtB,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC"}

package/dist/server/user.d.ts

@@ -56,4 +56,4 @@ export declare function resolveDeviceEnrollmentRequest(args: {
     kind: "err";
     status: number;
 }>;
-export declare const getUserRouter: (db: Database, tokenValidator: (key: string, scope: TokenScopes) => boolean, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void) => import("express-serve-static-core").Router;
+export declare const getUserRouter: (db: Database, tokenValidator: (key: string, scope: TokenScopes) => boolean, notify: (userID: string, event: string, transmissionID: string, data?: unknown, deviceID?: string) => void, disconnectDevices?: (deviceIDs: string[]) => void) => import("express-serve-static-core").Router;

package/dist/server/user.js

@@ -10,7 +10,9 @@ import { DevicePayloadSchema, TokenScopes } from "@vex-chat/types";
 import { generateRegistrationOptions, verifyRegistrationResponse, } from "@simplewebauthn/server";
 import { stringify } from "uuid";
 import { z } from "zod/v4";
+import { MAX_ACTIVE_DEVICES_PER_USER } from "../Database.js";
 import { msgpack } from "../utils/msgpack.js";
+import { verifyDevicePayloadPreKeySignature } from "../utils/preKeySignature.js";
 import { spireXSignOpenAsync } from "../utils/spireXSignOpenAsync.js";
 import { AppError } from "./errors.js";
 import { censorUser, getParam, getUser } from "./utils.js";
@@ -312,7 +314,7 @@ async function tryGetVerifiedPendingEnrollmentForSigned(req, signed) {
     }
     return { ok: true, pending };
 }
-export const getUserRouter = (db, tokenValidator, notify) => {
+export const getUserRouter = (db, tokenValidator, notify, disconnectDevices) => {
     const router = express.Router();
     // Unauthenticated status poll for the *requesting* device on a pending
     // device-enrollment request. The new device cannot use the protected
@@ -390,7 +392,7 @@ export const getUserRouter = (db, tokenValidator, notify) => {
             authenticatorSelection: {
                 requireResidentKey: false,
                 residentKey: "preferred",
-                userVerification: "preferred",
+                userVerification: "required",
             },
             excludeCredentials: [],
             rpID,
@@ -467,16 +469,18 @@ export const getUserRouter = (db, tokenValidator, notify) => {
                 expectedChallenge: passkeyRegistration.challenge,
                 expectedOrigin,
                 expectedRPID: rpID,
-                requireUserVerification: false,
+                requireUserVerification: true,
                 // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- structurally validated by simplewebauthn below
                 response: parsed.data
                     .response,
             });
         }
         catch (err) {
+            const requestId = crypto.randomUUID();
             const message = err instanceof Error ? err.message : String(err);
+            console.warn(`[spire] pending-device WebAuthn registration failed requestId=${requestId} message=${message}`);
             res.status(400).send({
-                error: "Passkey attestation invalid: " + message,
+                error: "Passkey attestation could not be verified.",
             });
             return;
         }
@@ -589,16 +593,28 @@ export const getUserRouter = (db, tokenValidator, notify) => {
     });
     router.get("/:id/permissions", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const permissions = await db.retrievePermissions(userDetails.userID, "all");
         res.send(msgpack.encode(permissions));
     });
     router.get("/:id/servers", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const servers = await db.retrieveServers(userDetails.userID);
         res.send(msgpack.encode(servers));
     });
     router.get("/:id/servers/bootstrap", protect, async (req, res) => {
         const userDetails = getUser(req);
+        if (getParam(req, "id") !== userDetails.userID) {
+            res.sendStatus(403);
+            return;
+        }
         const payload = await db.retrieveServerChannelBootstrap(userDetails.userID);
         res.send(msgpack.encode(payload));
     });
@@ -609,8 +625,12 @@ export const getUserRouter = (db, tokenValidator, notify) => {
             return;
         }
         const userDetails = getUser(req);
-        if (userDetails.userID !== device.owner) {
-            res.sendStatus(401);
+        const currentDevice = req.device;
+        if (getParam(req, "userID") !== userDetails.userID ||
+            userDetails.userID !== device.owner ||
+            !currentDevice ||
+            currentDevice.owner !== userDetails.userID) {
+            res.sendStatus(403);
             return;
         }
         const deviceList = await db.retrieveUserDeviceList([
@@ -623,6 +643,7 @@ export const getUserRouter = (db, tokenValidator, notify) => {
             return;
         }
         await db.deleteDevice(device.deviceID);
+        disconnectDevices?.([device.deviceID]);
         res.sendStatus(200);
     });
     router.post("/:id/devices", protect, async (req, res) => {
@@ -652,9 +673,21 @@ export const getUserRouter = (db, tokenValidator, notify) => {
             return;
         }
         if (tokenValidator(stringify(token), TokenScopes.Device)) {
+            if (!(await verifyDevicePayloadPreKeySignature(deviceData))) {
+                res.status(400).send({
+                    error: "Signed prekey signature is invalid.",
+                });
+                return;
+            }
             const userDevices = await db.retrieveUserDeviceList([
                 userDetails.userID,
             ]);
+            if (userDevices.length >= MAX_ACTIVE_DEVICES_PER_USER) {
+                res.status(409).send({
+                    error: `Each account is limited to ${String(MAX_ACTIVE_DEVICES_PER_USER)} active devices. Remove an old device before adding another.`,
+                });
+                return;
+            }
             if (userDevices.length === 0) {
                 try {
                     const device = await db.createDevice(userDetails.userID, deviceData);
@@ -765,9 +798,7 @@ export const getUserRouter = (db, tokenValidator, notify) => {
             });
             return;
         }
-        // New clients put the passkey proof on the requesting device.
-        // Older clients may still satisfy this with an approval-side passkey.
-        const approvedByPasskeyID = pending.requesterPasskeyID ?? req.passkey?.passkeyID;
+        const approvedByPasskeyID = pending.requesterPasskeyID;
         if (approvedByPasskeyID) {
             const passkey = await db.retrievePasskeyInternal(approvedByPasskeyID);
             if (!passkey || passkey.userID !== userID) {