matrix-nodejs-homeserver 0.0.0-stage → 0.2.0

package/dist/api/threadsubs.js

@@ -0,0 +1,129 @@
+import { isObject } from "../core/json.js";
+import { MatrixError, errors } from "../core/errors.js";
+//#region src/api/threadsubs.ts
+const VERSIONS = ["unstable/io.element.msc4306"];
+const notInThread = () => new MatrixError(400, "IO.ELEMENT.MSC4306.M_NOT_IN_THREAD", "Event is not in this thread");
+const conflicting = () => new MatrixError(409, "IO.ELEMENT.MSC4306.M_CONFLICTING_UNSUBSCRIPTION", "The thread was unsubscribed after this event");
+function key(userId, roomId, threadId) {
+	return [
+		{
+			field: "user_id",
+			value: userId
+		},
+		{
+			field: "room_id",
+			value: roomId
+		},
+		{
+			field: "thread_id",
+			value: threadId
+		}
+	];
+}
+/** Whether the user is subscribed to a thread: true, false (explicitly unsubscribed or never subscribed). */
+async function isSubscribed(hs, userId, roomId, threadId) {
+	return !!(await hs.db.findOne("thread_subscriptions", key(userId, roomId, threadId)))?.subscribed;
+}
+async function visibleEvent(ctx, userId, roomId, eventId) {
+	const ev = await ctx.hs.rooms.getEvent(eventId);
+	if (!ev || ev.pdu.room_id !== roomId) return null;
+	const [visible] = await ctx.hs.rooms.filterVisible(userId, roomId, [ev]);
+	return visible ?? null;
+}
+async function threadRoot(ctx, userId) {
+	const { roomId, threadId } = ctx.params;
+	const root = await visibleEvent(ctx, userId, roomId, threadId);
+	if (!root) throw errors.notFound("Unknown thread root");
+	return root;
+}
+function registerThreadSubscriptionRoutes(r) {
+	const path = "/rooms/:roomId/thread/:threadId/subscription";
+	r.client("GET", path, async (ctx) => {
+		const s = await ctx.auth();
+		await threadRoot(ctx, s.userId);
+		const row = await ctx.hs.db.findOne("thread_subscriptions", key(s.userId, ctx.params.roomId, ctx.params.threadId));
+		if (!row?.subscribed) throw errors.notFound("Not subscribed to this thread");
+		return { automatic: !!row.automatic };
+	}, VERSIONS);
+	r.client("PUT", path, async (ctx) => {
+		const s = await ctx.auth();
+		const hs = ctx.hs;
+		const { roomId, threadId } = ctx.params;
+		await threadRoot(ctx, s.userId);
+		const body = await ctx.json();
+		const cause = isObject(body) ? body.automatic : void 0;
+		if (cause !== void 0 && typeof cause !== "string") throw errors.badJson("automatic must be an event ID");
+		let causeStream = null;
+		if (typeof cause === "string") {
+			const ev = await visibleEvent(ctx, s.userId, roomId, cause);
+			const rel = ev?.pdu.content?.["m.relates_to"];
+			if (!ev || !isObject(rel) || rel.rel_type !== "m.thread" || rel.event_id !== threadId) throw notInThread();
+			causeStream = ev.stream;
+		}
+		await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
+			const row = await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId));
+			if (causeStream !== null) {
+				if (row && row.unsubscribed_after !== null && causeStream <= row.unsubscribed_after) throw conflicting();
+				if (row?.subscribed) return;
+			} else if (row?.subscribed && !row.automatic) return;
+			await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
+				user_id: s.userId,
+				room_id: roomId,
+				thread_id: threadId,
+				subscribed: true,
+				automatic: causeStream !== null,
+				unsubscribed_after: row?.unsubscribed_after ?? null,
+				stream
+			}));
+		});
+		hs.notifier.notify([s.userId]);
+		return {};
+	}, VERSIONS);
+	r.client("DELETE", path, async (ctx) => {
+		const s = await ctx.auth();
+		const hs = ctx.hs;
+		const { roomId, threadId } = ctx.params;
+		await threadRoot(ctx, s.userId);
+		await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
+			if (!(await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId)))?.subscribed) return;
+			const position = await hs.streams.position();
+			await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
+				user_id: s.userId,
+				room_id: roomId,
+				thread_id: threadId,
+				subscribed: false,
+				automatic: false,
+				unsubscribed_after: position,
+				stream
+			}));
+		});
+		hs.notifier.notify([s.userId]);
+		return {};
+	}, VERSIONS);
+}
+/** MSC4308 sliding sync extension: subscription changes in (since, to]. */
+async function threadSubscriptionsExtension(hs, userId, ext, since, to) {
+	const limit = Math.min(Math.max(Number(ext.limit ?? 100) || 100, 1), 1e3);
+	const where = [{
+		field: "user_id",
+		value: userId
+	}];
+	if (since !== null) where.push({
+		field: "stream",
+		operator: "gt",
+		value: since
+	});
+	const rows = (await hs.db.findMany("thread_subscriptions", { where })).filter((r) => r.stream <= to && (since !== null || r.subscribed)).sort((a, b) => b.stream - a.stream);
+	const out = {};
+	for (const row of rows.slice(0, limit)) {
+		const section = row.subscribed ? "subscribed" : "unsubscribed";
+		((out[section] ??= {})[row.room_id] ??= {})[row.thread_id] = row.subscribed ? {
+			automatic: !!row.automatic,
+			bump_stamp: row.stream
+		} : { bump_stamp: row.stream };
+	}
+	if (rows.length > limit) out.prev_batch = String(rows[limit - 1].stream);
+	return out;
+}
+//#endregion
+export { isSubscribed, registerThreadSubscriptionRoutes, threadSubscriptionsExtension };

package/dist/api/threepid.js

@@ -0,0 +1,122 @@
+import { MatrixError, errors } from "../core/errors.js";
+import { canonicalAddress, isMedium } from "../core/threepid.js";
+import { requireUia } from "./uia.js";
+import { body, fail, lenient } from "../http/input.js";
+import { z } from "zod";
+//#region src/api/threepid.ts
+const submitField = z.string(fail("M_MISSING_PARAM", "sid, client_secret and token are required"));
+const submitBody = body({
+	sid: submitField,
+	client_secret: submitField,
+	token: submitField
+});
+const bindField = (name) => z.string(fail("M_MISSING_PARAM", `Missing ${name}`));
+const bindBody = body({
+	client_secret: bindField("client_secret"),
+	id_access_token: bindField("id_access_token"),
+	id_server: bindField("id_server"),
+	sid: bindField("sid")
+});
+const threepidBody = body({
+	medium: z.enum(["email", "msisdn"], fail("M_INVALID_PARAM", "Unsupported medium")),
+	address: z.string(fail("M_INVALID_PARAM", "Invalid address")),
+	id_server: z.string(fail("M_INVALID_PARAM", "id_server must be a string")).optional()
+});
+function notDelegated(ctx) {
+	if (ctx.hs.oauth) throw errors.unrecognized("Managed by the OAuth provider");
+}
+function registerThreepidRoutes(r) {
+	const requestToken = (purpose, medium) => async (ctx) => {
+		notDelegated(ctx);
+		await ctx.rateLimit(purpose === "register" ? "register" : "login");
+		return ctx.hs.threepids.requestToken(purpose, medium, ctx.input);
+	};
+	for (const medium of ["email", "msisdn"]) {
+		r.client("POST", `/register/${medium}/requestToken`, { input: body({}) }, requestToken("register", medium));
+		r.client("POST", `/account/password/${medium}/requestToken`, { input: body({}) }, requestToken("password_reset", medium));
+		r.client("POST", `/account/3pid/${medium}/requestToken`, { input: body({}) }, requestToken("add_threepid", medium));
+	}
+	const submitPath = "/_matrix/client/unstable/threepid/submit_token";
+	r.get(submitPath, async (ctx) => {
+		const q = ctx.query;
+		let nextLink = null;
+		let message = "Your address has been validated. You can return to your Matrix client.";
+		let status = 200;
+		try {
+			nextLink = await ctx.hs.threepids.submitToken(q.get("sid") ?? "", q.get("client_secret") ?? "", q.get("token") ?? "");
+		} catch (err) {
+			message = err instanceof MatrixError ? `Validation failed: ${err.message}.` : "Validation failed.";
+			status = 400;
+		}
+		if (nextLink && status === 200) return Response.redirect(nextLink, 302);
+		return new Response(`<!doctype html><meta charset="utf-8"><title>${ctx.hs.serverName}</title><p>${message}</p>`, {
+			status,
+			headers: { "content-type": "text/html; charset=utf-8" }
+		});
+	});
+	r.post(submitPath, { input: submitBody }, async (ctx) => {
+		const body = ctx.input;
+		await ctx.hs.threepids.submitToken(body.sid, body.client_secret, body.token);
+		return { success: true };
+	});
+	r.client("GET", "/account/3pid", async (ctx) => {
+		const s = await ctx.auth();
+		return { threepids: await ctx.hs.threepids.list(s.userId) };
+	});
+	r.client("POST", "/account/3pid/add", { input: body({
+		sid: lenient(z.string()),
+		client_secret: lenient(z.string())
+	}) }, async (ctx) => {
+		notDelegated(ctx);
+		const s = await ctx.auth();
+		const body = ctx.input;
+		await requireUia(ctx.hs, body, [["m.login.password"]], s.userId);
+		const validated = await ctx.hs.threepids.validated({
+			sid: body.sid,
+			client_secret: body.client_secret
+		});
+		if (!validated) throw new MatrixError(400, "M_THREEPID_AUTH_FAILED", "The address has not been validated");
+		await ctx.hs.threepids.add(s.userId, validated);
+		return {};
+	});
+	r.client("POST", "/account/3pid/bind", { input: bindBody }, async (ctx) => {
+		const s = await ctx.auth();
+		const body = ctx.input;
+		const res = await ctx.hs.identityServers.bind(body.id_server, body.id_access_token, body.sid, body.client_secret, s.userId);
+		if (res && isMedium(res.medium) && typeof res.address === "string") await ctx.hs.db.upsert("threepid_bindings", {
+			user_id: s.userId,
+			medium: res.medium,
+			address: res.address,
+			id_server: body.id_server
+		});
+		return {};
+	});
+	const parseThreepid = (body) => {
+		const address = canonicalAddress(body.medium, body.address);
+		if (!address) throw errors.invalidParam("Invalid address");
+		return {
+			medium: body.medium,
+			address,
+			idServer: body.id_server
+		};
+	};
+	r.client("POST", "/account/3pid/delete", { input: threepidBody }, async (ctx) => {
+		notDelegated(ctx);
+		const s = await ctx.auth();
+		const { medium, address, idServer } = parseThreepid(ctx.input);
+		const result = await ctx.hs.threepids.unbindAll(s.userId, medium, address, idServer);
+		await ctx.hs.threepids.remove(s.userId, medium, address);
+		return { id_server_unbind_result: result };
+	});
+	r.client("POST", "/account/3pid/unbind", { input: threepidBody }, async (ctx) => {
+		const s = await ctx.auth();
+		const { medium, address, idServer } = parseThreepid(ctx.input);
+		return { id_server_unbind_result: await ctx.hs.threepids.unbindAll(s.userId, medium, address, idServer) };
+	});
+	r.client("POST", "/account/3pid", async (ctx) => {
+		await ctx.auth();
+		throw errors.threepidDenied();
+	});
+}
+//#endregion
+export { registerThreepidRoutes };

package/dist/api/uia.js

@@ -0,0 +1,126 @@
+import { isObject } from "../core/json.js";
+import { randomString } from "../core/crypto.js";
+import { MatrixError, errors } from "../core/errors.js";
+//#region src/api/uia.ts
+const UIA_TTL_MS = 6e5;
+/**
+* User-interactive authentication. Resolves when one of `flows` has been
+* completed; otherwise throws the 401 response describing what is required.
+* `userId` binds password stages to an already-authenticated user.
+*/
+async function requireUia(hs, body, flows, userId) {
+	if (hs.oauth && flows.some((f) => f.includes("m.login.password"))) flows = [["m.oauth"], ["org.matrix.cross_signing_reset"]];
+	const auth = isObject(body.auth) ? body.auth : null;
+	let sessionId = typeof auth?.session === "string" ? auth.session : void 0;
+	const stored = sessionId ? await hs.cluster.get(`uia:${sessionId}`) : null;
+	const session = {
+		completed: new Set(stored?.completed ?? []),
+		userId: stored ? stored.userId : userId,
+		threepids: stored?.threepids ?? []
+	};
+	if (!stored) sessionId = randomString(24);
+	const save = () => hs.cluster.set(`uia:${sessionId}`, {
+		completed: [...session.completed],
+		userId: session.userId,
+		threepids: session.threepids
+	}, UIA_TTL_MS);
+	const oauthUrl = hs.oauth?.options.accountManagementUrl ?? hs.oauth?.options.issuer;
+	const params = hs.oauth ? {
+		"m.oauth": { url: oauthUrl },
+		"org.matrix.cross_signing_reset": { url: oauthUrl }
+	} : {};
+	const challenge = (extra = {}) => new MatrixError(401, extra.errcode ? String(extra.errcode) : "M_FORBIDDEN", String(extra.error ?? "Authentication required"), {
+		flows: flows.map((stages) => ({ stages })),
+		params,
+		session: sessionId,
+		completed: [...session.completed],
+		...extra
+	});
+	if (auth?.type === "m.login.dummy" && !auth.session && typeof body.username === "string" && !userId) {
+		if (await hs.cluster.get(`uia-register:${body.username.toLowerCase()}`)) throw challenge({
+			errcode: "M_FORBIDDEN",
+			error: "Missing session"
+		});
+	}
+	if (auth?.type) switch (auth.type) {
+		case "m.login.dummy":
+			session.completed.add("m.login.dummy");
+			break;
+		case "m.oauth":
+		case "org.matrix.cross_signing_reset":
+			if (!hs.oauth) throw challenge({
+				errcode: "M_UNRECOGNIZED",
+				error: "OAuth is not enabled"
+			});
+			session.completed.add(auth.type);
+			break;
+		case "m.login.registration_token": {
+			const { registrationTokenValid } = await import("./account.js");
+			if (typeof auth.token !== "string" || !await registrationTokenValid(hs, auth.token)) throw challenge({
+				errcode: "M_FORBIDDEN",
+				error: "Invalid registration token"
+			});
+			session.completed.add("m.login.registration_token");
+			break;
+		}
+		case "m.login.password": {
+			const identifier = isObject(auth.identifier) ? auth.identifier : {
+				type: "m.id.user",
+				user: auth.user
+			};
+			const user = typeof identifier.user === "string" ? identifier.user : "";
+			const target = user.startsWith("@") ? user : `@${user.toLowerCase()}:${hs.serverName}`;
+			if (userId && target !== userId) throw errors.forbidden("Credentials do not match the authenticated user");
+			const row = await hs.db.findOne("users", [{
+				field: "user_id",
+				value: target
+			}]);
+			if (!(row && !row.deactivated && typeof auth.password === "string" && await hs.userAuth.checkPassword({
+				userId: target,
+				localpart: target.slice(1).split(":")[0],
+				password: auth.password,
+				storedHash: row.password_hash
+			}))) throw challenge({
+				errcode: "M_FORBIDDEN",
+				error: "Invalid password"
+			});
+			session.completed.add("m.login.password");
+			break;
+		}
+		case "m.login.email.identity":
+		case "m.login.msisdn": {
+			const validated = await hs.threepids.validated(auth.threepid_creds ?? auth.threepidCreds);
+			const medium = auth.type === "m.login.email.identity" ? "email" : "msisdn";
+			if (!validated || validated.medium !== medium) throw challenge({
+				errcode: "M_UNAUTHORIZED",
+				error: "The address has not been validated"
+			});
+			if (session.userId && await hs.threepids.userFor(validated.medium, validated.address) !== session.userId) throw challenge({
+				errcode: "M_FORBIDDEN",
+				error: "This address does not belong to your account"
+			});
+			session.threepids = [...session.threepids.filter((t) => t.medium !== medium), validated];
+			session.completed.add(auth.type);
+			break;
+		}
+		default: throw challenge({
+			errcode: "M_UNRECOGNIZED",
+			error: `Unsupported auth type ${auth.type}`
+		});
+	}
+	if (!flows.some((stages) => stages.every((s) => session.completed.has(s)))) {
+		await save();
+		if (!userId && typeof body.username === "string") await hs.cluster.set(`uia-register:${body.username.toLowerCase()}`, sessionId, UIA_TTL_MS);
+		if (auth?.type) throw challenge();
+		const e = challenge();
+		throw new MatrixError(401, "M_FORBIDDEN", "", {
+			...e.extra,
+			errcode: void 0,
+			error: void 0
+		});
+	}
+	await hs.cluster.delete(`uia:${sessionId}`);
+	return { threepids: session.threepids };
+}
+//#endregion
+export { requireUia };

package/dist/api/user.js

@@ -0,0 +1,286 @@
+import { canonicalJson, isObject } from "../core/json.js";
+import { errors } from "../core/errors.js";
+import { requireUia } from "./uia.js";
+import { body, fail } from "../http/input.js";
+import { z } from "zod";
+//#region src/api/user.ts
+const deleteDevicesBody = body({ devices: z.array(z.unknown(), fail("M_BAD_JSON", "devices must be a list")) });
+const keysQueryBody = body({
+	device_keys: z.record(z.string(), z.array(z.string(), fail("M_BAD_JSON", "device_keys values must be lists of device IDs")), fail("M_BAD_JSON", "device_keys must be an object")),
+	timeout: z.unknown().optional()
+});
+const keysClaimBody = body({ one_time_keys: z.record(z.string(), z.unknown(), fail("M_BAD_JSON", "one_time_keys must be an object")) });
+const SERVER_MANAGED_TYPES = ["m.fully_read", "m.push_rules"];
+async function setAccountData(hs, userId, roomId, type, content) {
+	await hs.streams.write((stream) => hs.db.upsert("account_data", {
+		user_id: userId,
+		room_id: roomId,
+		type,
+		content,
+		stream
+	}));
+	hs.notifier.notify([userId]);
+}
+async function getAccountData(hs, userId, roomId, type) {
+	const row = await hs.db.findOne("account_data", [
+		{
+			field: "user_id",
+			value: userId
+		},
+		{
+			field: "room_id",
+			value: roomId
+		},
+		{
+			field: "type",
+			value: type
+		}
+	]);
+	if (!row || Object.keys(row.content ?? {}).length === 0) throw errors.notFound("Account data not found");
+	return row.content;
+}
+async function checkUser(ctx) {
+	const s = await ctx.auth();
+	if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot access another user's data");
+	return s;
+}
+async function checkRoom(ctx) {
+	if (!ctx.params.roomId.startsWith("!")) throw errors.invalidParam("Invalid room ID");
+}
+function registerUserRoutes(r) {
+	r.client("PUT", "/user/:userId/account_data/:type", async (ctx) => {
+		const s = await checkUser(ctx);
+		if (SERVER_MANAGED_TYPES.includes(ctx.params.type)) throw errors.badJson("This type is managed by the server");
+		await setAccountData(ctx.hs, s.userId, "", ctx.params.type, await ctx.json());
+		return {};
+	});
+	r.client("GET", "/user/:userId/account_data/:type", async (ctx) => {
+		const s = await checkUser(ctx);
+		return getAccountData(ctx.hs, s.userId, "", ctx.params.type);
+	});
+	r.client("PUT", "/user/:userId/rooms/:roomId/account_data/:type", async (ctx) => {
+		const s = await checkUser(ctx);
+		await checkRoom(ctx);
+		if (SERVER_MANAGED_TYPES.includes(ctx.params.type)) throw errors.badJson("This type is managed by the server");
+		await setAccountData(ctx.hs, s.userId, ctx.params.roomId, ctx.params.type, await ctx.json());
+		return {};
+	});
+	r.client("GET", "/user/:userId/rooms/:roomId/account_data/:type", async (ctx) => {
+		const s = await checkUser(ctx);
+		await checkRoom(ctx);
+		return getAccountData(ctx.hs, s.userId, ctx.params.roomId, ctx.params.type);
+	});
+	const del = "/_matrix/client/unstable/org.matrix.msc3391";
+	r.delete(`${del}/user/:userId/account_data/:type`, async (ctx) => {
+		const s = await checkUser(ctx);
+		await setAccountData(ctx.hs, s.userId, "", ctx.params.type, {});
+		return {};
+	});
+	r.delete(`${del}/user/:userId/rooms/:roomId/account_data/:type`, async (ctx) => {
+		const s = await checkUser(ctx);
+		await setAccountData(ctx.hs, s.userId, ctx.params.roomId, ctx.params.type, {});
+		return {};
+	});
+	const readTags = async (hs, userId, roomId) => {
+		const row = await hs.db.findOne("account_data", [
+			{
+				field: "user_id",
+				value: userId
+			},
+			{
+				field: "room_id",
+				value: roomId
+			},
+			{
+				field: "type",
+				value: "m.tag"
+			}
+		]);
+		return isObject(row?.content?.tags) ? row.content.tags : {};
+	};
+	r.client("GET", "/user/:userId/rooms/:roomId/tags", async (ctx) => {
+		const s = await checkUser(ctx);
+		return { tags: await readTags(ctx.hs, s.userId, ctx.params.roomId) };
+	});
+	r.client("PUT", "/user/:userId/rooms/:roomId/tags/:tag", async (ctx) => {
+		const s = await checkUser(ctx);
+		const body = await ctx.json();
+		if (body.order !== void 0 && typeof body.order !== "number") throw errors.badJson("order must be a number");
+		const tags = await readTags(ctx.hs, s.userId, ctx.params.roomId);
+		tags[ctx.params.tag] = body;
+		await setAccountData(ctx.hs, s.userId, ctx.params.roomId, "m.tag", { tags });
+		return {};
+	});
+	r.client("DELETE", "/user/:userId/rooms/:roomId/tags/:tag", async (ctx) => {
+		const s = await checkUser(ctx);
+		const tags = await readTags(ctx.hs, s.userId, ctx.params.roomId);
+		delete tags[ctx.params.tag];
+		await setAccountData(ctx.hs, s.userId, ctx.params.roomId, "m.tag", { tags });
+		return {};
+	});
+	const formatDevice = (d) => ({
+		device_id: d.device_id,
+		display_name: d.display_name ?? void 0,
+		last_seen_ip: d.last_seen_ip ?? void 0,
+		last_seen_ts: d.last_seen_ts ?? void 0
+	});
+	r.client("GET", "/devices", async (ctx) => {
+		const s = await ctx.auth();
+		return { devices: (await ctx.hs.db.findMany("devices", { where: [{
+			field: "user_id",
+			value: s.userId
+		}] })).map(formatDevice) };
+	});
+	r.client("GET", "/devices/:deviceId", async (ctx) => {
+		const s = await ctx.auth();
+		const row = await ctx.hs.db.findOne("devices", [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "device_id",
+			value: ctx.params.deviceId
+		}]);
+		if (!row) throw errors.notFound("Device not found");
+		return formatDevice(row);
+	});
+	r.client("PUT", "/devices/:deviceId", async (ctx) => {
+		const s = await ctx.auth();
+		const body = await ctx.json();
+		const where = [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "device_id",
+			value: ctx.params.deviceId
+		}];
+		if (!await ctx.hs.db.findOne("devices", where)) throw errors.notFound("Device not found");
+		if (body.display_name !== void 0) {
+			if (typeof body.display_name !== "string") throw errors.badJson("display_name must be a string");
+			await ctx.hs.db.update("devices", where, { display_name: body.display_name });
+			await ctx.hs.keys.deviceChanged(s.userId);
+		}
+		return {};
+	});
+	r.client("DELETE", "/devices/:deviceId", async (ctx) => {
+		const s = await ctx.auth();
+		const body = await ctx.json();
+		const where = [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "device_id",
+			value: ctx.params.deviceId
+		}];
+		if (!await ctx.hs.db.findOne("devices", where)) throw errors.notFound("Device not found");
+		await requireUia(ctx.hs, body, [["m.login.password"]], s.userId);
+		await ctx.hs.auth.deleteDevice(s.userId, ctx.params.deviceId);
+		return {};
+	});
+	r.client("POST", "/delete_devices", { input: deleteDevicesBody }, async (ctx) => {
+		const s = await ctx.auth();
+		const body = ctx.input;
+		await requireUia(ctx.hs, body, [["m.login.password"]], s.userId);
+		for (const d of body.devices) if (typeof d === "string") await ctx.hs.auth.deleteDevice(s.userId, d);
+		return {};
+	});
+	r.client("POST", "/keys/upload", { input: body({}) }, async (ctx) => {
+		const s = await ctx.auth();
+		return { one_time_key_counts: await ctx.hs.keys.upload(s.userId, s.deviceId, ctx.input) };
+	});
+	r.client("POST", "/keys/query", { input: keysQueryBody }, async (ctx) => {
+		const s = await ctx.auth();
+		await ctx.rateLimit("keyQuery");
+		const body = ctx.input;
+		return ctx.hs.keys.query(s.userId, body.device_keys, Math.min(Number(body.timeout ?? 1e4) || 1e4, 3e4));
+	});
+	r.client("POST", "/keys/claim", { input: keysClaimBody }, async (ctx) => {
+		await ctx.auth();
+		const body = ctx.input;
+		const local = {};
+		const remote = {};
+		for (const [userId, devices] of Object.entries(body.one_time_keys)) (ctx.hs.isLocalUser(userId) ? local : remote)[userId] = devices;
+		const claimed = await ctx.hs.keys.claim(local);
+		const fed = Object.keys(remote).length ? await ctx.hs.federation.claimKeys(remote) : {
+			results: {},
+			failures: {}
+		};
+		return {
+			one_time_keys: {
+				...claimed,
+				...fed.results
+			},
+			failures: fed.failures
+		};
+	});
+	r.client("GET", "/keys/changes", async (ctx) => {
+		const s = await ctx.auth();
+		const parse = (v) => {
+			const m = /^s?(\d+)/.exec(v ?? "");
+			if (!m) throw errors.invalidParam("Invalid token");
+			return Number(m[1]);
+		};
+		return ctx.hs.keys.changesSince(s.userId, parse(ctx.query.get("from")), parse(ctx.query.get("to")));
+	});
+	r.client("POST", "/keys/device_signing/upload", { input: body({}) }, async (ctx) => {
+		const s = await ctx.auth();
+		const body = ctx.input;
+		if (await ctx.hs.db.findOne("cross_signing_keys", [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "key_type",
+			value: "master"
+		}])) {
+			const stored = new Map((await ctx.hs.db.findMany("cross_signing_keys", { where: [{
+				field: "user_id",
+				value: s.userId
+			}] })).map((row) => [row.key_type, canonicalJson(row.key)]));
+			if ([
+				"master",
+				"self_signing",
+				"user_signing"
+			].filter((type) => body[`${type}_key`] !== void 0).every((type) => stored.get(type) === canonicalJson(body[`${type}_key`]))) return {};
+			await requireUia(ctx.hs, body, [["m.login.password"]], s.userId);
+		}
+		await ctx.hs.keys.uploadCrossSigning(s.userId, body);
+		return {};
+	});
+	r.client("POST", "/keys/signatures/upload", { input: body({}) }, async (ctx) => {
+		const s = await ctx.auth();
+		return ctx.hs.keys.uploadSignatures(s.userId, ctx.input);
+	});
+	r.client("PUT", "/sendToDevice/:eventType/:txnId", async (ctx) => {
+		const s = await ctx.auth();
+		const hs = ctx.hs;
+		const body = await ctx.json();
+		if (!isObject(body.messages)) throw errors.badJson("messages must be an object");
+		const txnKey = `${s.userId}|${s.deviceId}|${ctx.params.txnId}`;
+		if (!await hs.cluster.setIfAbsent(`todevice-txn:${txnKey}`, true, 864e5)) return {};
+		const recipients = /* @__PURE__ */ new Set();
+		for (const [userId, devices] of Object.entries(body.messages)) {
+			if (!isObject(devices) || !hs.isLocalUser(userId)) continue;
+			let targets = Object.keys(devices);
+			if (targets.includes("*")) targets = (await hs.db.findMany("devices", { where: [{
+				field: "user_id",
+				value: userId
+			}] })).map((d) => d.device_id);
+			for (const deviceId of targets) {
+				const content = devices[deviceId] ?? devices["*"];
+				await hs.streams.write((stream) => hs.db.create("to_device", {
+					stream,
+					user_id: userId,
+					device_id: deviceId,
+					sender: s.userId,
+					type: ctx.params.eventType,
+					content
+				}));
+			}
+			recipients.add(userId);
+		}
+		hs.notifier.notify(recipients);
+		await hs.federation.sendToDevice(s.userId, ctx.params.eventType, body.messages, `${s.deviceId}-${ctx.params.txnId}`);
+		return {};
+	});
+}
+//#endregion
+export { registerUserRoutes };