matrix-nodejs-homeserver 0.0.0-stage → 0.2.0

package/dist/core/keys.js

@@ -0,0 +1,449 @@
+import { isObject } from "./json.js";
+import { errors } from "./errors.js";
+//#region src/core/keys.ts
+/** End-to-end encryption key storage (device keys, one-time keys, cross-signing). */
+var KeyService = class {
+	hs;
+	constructor(hs) {
+		this.hs = hs;
+	}
+	/** A local user's devices or device keys changed: update local clients and remote servers. */
+	async deviceChanged(userId, deletedDeviceId) {
+		await this.markDeviceListChanged(userId);
+		await this.hs.federation.onDeviceListChange(userId, deletedDeviceId).catch((err) => this.hs.logger.warn("Device list EDU failed", err));
+	}
+	async markDeviceListChanged(userId, notify = true) {
+		await this.hs.streams.write((stream) => this.hs.db.upsert("device_list_changes", {
+			user_id: userId,
+			stream
+		}));
+		if (notify) this.hs.notifier.notify(await this.hs.rooms.usersSharingRooms(userId));
+	}
+	/**
+	* A partial-state room got its full state (MSC3902): device list updates received meanwhile for
+	* users we could not place count as changes now, if those users turned out to be members.
+	*/
+	async onPartialStateComplete(roomId, pendingUsers) {
+		const members = new Set(await this.hs.rooms.joinedMembers(roomId));
+		for (const userId of pendingUsers) if (members.has(userId)) await this.markDeviceListChanged(userId, false);
+		this.hs.notifier.notify([...members].filter((u) => this.hs.isLocalUser(u)));
+	}
+	async upload(userId, deviceId, body) {
+		if (body.device_keys !== void 0) {
+			const dk = body.device_keys;
+			if (!isObject(dk) || dk.user_id !== userId || dk.device_id !== deviceId) throw errors.invalidParam("device_keys do not match this device");
+			if (!Array.isArray(dk.algorithms) || !isObject(dk.keys) || !isObject(dk.signatures)) throw errors.badJson("device_keys must contain algorithms, keys and signatures");
+			const existing = await this.hs.db.findOne("device_keys", [{
+				field: "user_id",
+				value: userId
+			}, {
+				field: "device_id",
+				value: deviceId
+			}]);
+			if (!existing || JSON.stringify(existing.keys) !== JSON.stringify(dk)) {
+				await this.hs.streams.write((stream) => this.hs.db.upsert("device_keys", {
+					user_id: userId,
+					device_id: deviceId,
+					keys: dk,
+					stream
+				}));
+				await this.deviceChanged(userId);
+			}
+		}
+		const device = [{
+			field: "user_id",
+			value: userId
+		}, {
+			field: "device_id",
+			value: deviceId
+		}];
+		if (isObject(body.one_time_keys)) for (const [fullId, key] of Object.entries(body.one_time_keys)) {
+			const [algorithm] = fullId.split(":");
+			const existing = await this.hs.db.findOne("one_time_keys", [...device, {
+				field: "key_id",
+				value: fullId
+			}]);
+			if (existing) {
+				if (JSON.stringify(existing.key) !== JSON.stringify(key)) throw errors.invalidParam(`One time key ${fullId} already exists`);
+				continue;
+			}
+			await this.hs.streams.write((seq) => this.hs.db.create("one_time_keys", {
+				user_id: userId,
+				device_id: deviceId,
+				key_id: fullId,
+				algorithm,
+				key,
+				fallback: false,
+				used: false,
+				seq
+			}));
+		}
+		const fallbackKeys = body.fallback_keys ?? body["org.matrix.msc2732.fallback_keys"];
+		if (isObject(fallbackKeys)) for (const [fullId, key] of Object.entries(fallbackKeys)) {
+			const [algorithm] = fullId.split(":");
+			const existing = await this.hs.db.findOne("fallback_keys", [...device, {
+				field: "algorithm",
+				value: algorithm
+			}]);
+			if (existing && existing.key_id === fullId && JSON.stringify(existing.key) === JSON.stringify(key)) continue;
+			await this.hs.db.upsert("fallback_keys", {
+				user_id: userId,
+				device_id: deviceId,
+				algorithm,
+				key_id: fullId,
+				key,
+				used: false
+			});
+		}
+		return this.oneTimeKeyCounts(userId, deviceId);
+	}
+	async oneTimeKeyCounts(userId, deviceId) {
+		const rows = await this.hs.db.findMany("one_time_keys", { where: [
+			{
+				field: "user_id",
+				value: userId
+			},
+			{
+				field: "device_id",
+				value: deviceId
+			},
+			{
+				field: "fallback",
+				value: false
+			}
+		] });
+		const counts = { signed_curve25519: 0 };
+		for (const r of rows) counts[r.algorithm] = (counts[r.algorithm] ?? 0) + 1;
+		return counts;
+	}
+	async unusedFallbackKeyTypes(userId, deviceId) {
+		const rows = await this.hs.db.findMany("fallback_keys", { where: [
+			{
+				field: "user_id",
+				value: userId
+			},
+			{
+				field: "device_id",
+				value: deviceId
+			},
+			{
+				field: "used",
+				value: false
+			}
+		] });
+		return [...new Set(rows.map((r) => r.algorithm))];
+	}
+	async query(requester, deviceKeys, timeoutMs = 1e4) {
+		const result = {
+			device_keys: {},
+			failures: {},
+			master_keys: {},
+			self_signing_keys: {},
+			user_signing_keys: {}
+		};
+		const remote = {};
+		for (const [userId, devices] of Object.entries(deviceKeys ?? {})) {
+			if (!this.hs.isLocalUser(userId)) {
+				remote[userId] = devices;
+				continue;
+			}
+			const rows = await this.hs.db.findMany("device_keys", { where: [{
+				field: "user_id",
+				value: userId
+			}] });
+			const deviceRows = await this.hs.db.findMany("devices", { where: [{
+				field: "user_id",
+				value: userId
+			}] });
+			const names = new Map(deviceRows.map((d) => [d.device_id, d.display_name]));
+			const wanted = Array.isArray(devices) && devices.length ? new Set(devices) : null;
+			const out = {};
+			for (const row of rows) {
+				if (wanted && !wanted.has(row.device_id)) continue;
+				if (!names.has(row.device_id)) continue;
+				const keys = await this.withSignatures(userId, `${row.device_id}`, row.keys);
+				const name = names.get(row.device_id);
+				keys.unsigned = {
+					...keys.unsigned,
+					...name ? { device_display_name: name } : {}
+				};
+				out[row.device_id] = keys;
+			}
+			result.device_keys[userId] = out;
+			const csRows = await this.hs.db.findMany("cross_signing_keys", { where: [{
+				field: "user_id",
+				value: userId
+			}] });
+			for (const cs of csRows) {
+				if (cs.key_type === "user_signing" && userId !== requester) continue;
+				const pub = Object.values(cs.key.keys ?? {})[0];
+				result[`${cs.key_type}_keys`][userId] = await this.withSignatures(userId, pub, cs.key);
+			}
+		}
+		if (Object.keys(remote).length && requester) {
+			const fetch = {};
+			const tracked = /* @__PURE__ */ new Set();
+			for (const [userId, devices] of Object.entries(remote)) {
+				if (!await this.isTracked(userId)) {
+					await this.dropRemoteCache(userId);
+					fetch[userId] = devices;
+					continue;
+				}
+				tracked.add(userId);
+				const list = await this.hs.db.findOne("remote_device_lists", [{
+					field: "user_id",
+					value: userId
+				}]);
+				if (!list || list.stale) {
+					fetch[userId] = [];
+					continue;
+				}
+				await this.fromRemoteCache(userId, devices, result);
+			}
+			if (Object.keys(fetch).length) {
+				const { results, failures } = await this.hs.federation.queryKeys(fetch, timeoutMs);
+				Object.assign(result.failures, failures);
+				const fetched = {
+					device_keys: {},
+					master_keys: {},
+					self_signing_keys: {}
+				};
+				for (const res of results) for (const kind of [
+					"device_keys",
+					"master_keys",
+					"self_signing_keys"
+				]) for (const [userId, value] of Object.entries(isObject(res[kind]) ? res[kind] : {})) if (fetch[userId] !== void 0) fetched[kind][userId] = value;
+				for (const userId of Object.keys(fetch)) {
+					if (tracked.has(userId) && isObject(fetched.device_keys[userId])) {
+						await this.storeRemoteCache(userId, fetched.device_keys[userId], fetched.master_keys[userId], fetched.self_signing_keys[userId]);
+						await this.fromRemoteCache(userId, remote[userId], result);
+						continue;
+					}
+					for (const kind of [
+						"device_keys",
+						"master_keys",
+						"self_signing_keys"
+					]) if (fetched[kind][userId] !== void 0) result[kind][userId] = fetched[kind][userId];
+				}
+			}
+		}
+		return result;
+	}
+	/** Whether a remote user shares a room with a local user (by known membership). */
+	async isTracked(userId) {
+		const rows = await this.hs.db.findMany("memberships", { where: [{
+			field: "user_id",
+			value: userId
+		}, {
+			field: "membership",
+			value: "join"
+		}] });
+		for (const row of rows) if ((await this.hs.rooms.joinedMembers(row.room_id)).some((u) => this.hs.isLocalUser(u))) return true;
+		return false;
+	}
+	async dropRemoteCache(userId) {
+		await this.hs.db.delete("remote_devices", [{
+			field: "user_id",
+			value: userId
+		}]);
+		await this.hs.db.delete("remote_device_lists", [{
+			field: "user_id",
+			value: userId
+		}]);
+	}
+	/** A tracked user's device list changed: refetch it on the next query. */
+	async markRemoteStale(userId) {
+		if (await this.isTracked(userId)) await this.hs.db.upsert("remote_device_lists", {
+			user_id: userId,
+			stream_id: 0,
+			stale: true
+		});
+		else await this.dropRemoteCache(userId);
+	}
+	async storeRemoteCache(userId, devices, master, selfSigning) {
+		await this.hs.db.delete("remote_devices", [{
+			field: "user_id",
+			value: userId
+		}]);
+		for (const [deviceId, keys] of Object.entries(devices)) {
+			if (!isObject(keys)) continue;
+			const name = keys.unsigned?.device_display_name;
+			await this.hs.db.upsert("remote_devices", {
+				user_id: userId,
+				device_id: deviceId,
+				keys,
+				display_name: typeof name === "string" ? name : null,
+				stream_id: 0
+			});
+		}
+		for (const [type, key] of [["master", master], ["self_signing", selfSigning]]) if (isObject(key)) await this.hs.streams.write((stream) => this.hs.db.upsert("cross_signing_keys", {
+			user_id: userId,
+			key_type: type,
+			key,
+			stream
+		}));
+		await this.hs.db.upsert("remote_device_lists", {
+			user_id: userId,
+			stream_id: 0,
+			stale: false
+		});
+	}
+	async fromRemoteCache(userId, devices, result) {
+		const wanted = Array.isArray(devices) && devices.length ? new Set(devices) : null;
+		const out = {};
+		for (const row of await this.hs.db.findMany("remote_devices", { where: [{
+			field: "user_id",
+			value: userId
+		}] })) if (!wanted || wanted.has(row.device_id)) out[row.device_id] = row.keys;
+		result.device_keys[userId] = out;
+		for (const cs of await this.hs.db.findMany("cross_signing_keys", { where: [{
+			field: "user_id",
+			value: userId
+		}] })) if (cs.key_type === "master" || cs.key_type === "self_signing") result[`${cs.key_type}_keys`][userId] = cs.key;
+	}
+	async withSignatures(userId, keyId, key) {
+		const sigs = await this.hs.db.findMany("key_signatures", { where: [{
+			field: "user_id",
+			value: userId
+		}, {
+			field: "key_id",
+			value: keyId
+		}] });
+		if (sigs.length === 0) return structuredClone(key);
+		const out = structuredClone(key);
+		out.signatures ??= {};
+		for (const s of sigs) out.signatures[s.signer] = {
+			...out.signatures[s.signer],
+			[s.signer_key_id]: s.signature
+		};
+		return out;
+	}
+	async claim(request) {
+		const result = {};
+		for (const [userId, devices] of Object.entries(request ?? {})) for (const [deviceId, algorithm] of Object.entries(devices ?? {})) {
+			const base = [
+				{
+					field: "user_id",
+					value: userId
+				},
+				{
+					field: "device_id",
+					value: deviceId
+				},
+				{
+					field: "algorithm",
+					value: algorithm
+				}
+			];
+			let key = (await this.hs.db.findMany("one_time_keys", {
+				where: [...base, {
+					field: "fallback",
+					value: false
+				}],
+				sortBy: {
+					field: "seq",
+					direction: "asc"
+				},
+				limit: 1
+			}))[0] ?? null;
+			if (key) await this.hs.db.delete("one_time_keys", [...base, {
+				field: "key_id",
+				value: key.key_id
+			}]);
+			else {
+				key = await this.hs.db.findOne("fallback_keys", base);
+				if (key && !key.used) await this.hs.db.update("fallback_keys", base, { used: true });
+			}
+			if (!key) continue;
+			result[userId] ??= {};
+			result[userId][deviceId] = { [key.key_id]: key.key };
+		}
+		return result;
+	}
+	async uploadCrossSigning(userId, body) {
+		for (const type of [
+			"master",
+			"self_signing",
+			"user_signing"
+		]) {
+			const key = body[`${type}_key`];
+			if (key === void 0) continue;
+			if (!isObject(key) || key.user_id !== userId || !isObject(key.keys)) throw errors.invalidParam(`Invalid ${type}_key`);
+			await this.hs.streams.write((stream) => this.hs.db.upsert("cross_signing_keys", {
+				user_id: userId,
+				key_type: type,
+				key,
+				stream
+			}));
+		}
+		await this.markDeviceListChanged(userId);
+		await this.hs.federation.onSigningKeyUpdate(userId).catch(() => {});
+	}
+	async uploadSignatures(signer, body) {
+		const failures = {};
+		const changed = /* @__PURE__ */ new Set();
+		for (const [userId, keys] of Object.entries(body ?? {})) {
+			if (!isObject(keys)) continue;
+			for (const [keyId, signed] of Object.entries(keys)) {
+				const sigs = signed?.signatures?.[signer];
+				if (!isObject(sigs)) {
+					failures[userId] = {
+						...failures[userId],
+						[keyId]: {
+							errcode: "M_INVALID_SIGNATURE",
+							error: "No signature from signer"
+						}
+					};
+					continue;
+				}
+				for (const [signerKeyId, signature] of Object.entries(sigs)) await this.hs.db.upsert("key_signatures", {
+					user_id: userId,
+					key_id: keyId,
+					signer,
+					signer_key_id: signerKeyId,
+					signature: String(signature)
+				});
+				changed.add(userId);
+			}
+		}
+		for (const u of changed) if (this.hs.isLocalUser(u)) await this.deviceChanged(u);
+		else await this.markDeviceListChanged(u);
+		if (changed.has(signer)) await this.hs.federation.onSigningKeyUpdate(signer).catch(() => {});
+		return { failures };
+	}
+	/** Users (sharing a room with `userId`) whose device lists changed after `since`. */
+	async changesSince(userId, since, upTo) {
+		const sharing = await this.hs.rooms.usersSharingRooms(userId);
+		const rows = await this.hs.db.findMany("device_list_changes", { where: [{
+			field: "stream",
+			operator: "gt",
+			value: since
+		}] });
+		const changed = /* @__PURE__ */ new Set();
+		for (const r of rows) if (r.stream <= upTo && sharing.has(r.user_id)) changed.add(r.user_id);
+		const left = /* @__PURE__ */ new Set();
+		const memberRows = await this.hs.db.findMany("memberships", { where: [{
+			field: "stream",
+			operator: "gt",
+			value: since
+		}] });
+		const myRooms = /* @__PURE__ */ new Set([...await this.hs.rooms.roomsForUser(userId), ...memberRows.filter((m) => m.user_id === userId).map((m) => m.room_id)]);
+		for (const m of memberRows) {
+			if (m.stream > upTo || !myRooms.has(m.room_id)) continue;
+			if (m.user_id === userId) {
+				const members = await this.hs.rooms.joinedMembers(m.room_id);
+				if (m.membership === "join") {
+					for (const u of members) if (u !== userId) changed.add(u);
+				} else for (const u of members) if (!sharing.has(u)) left.add(u);
+			} else if (m.membership === "join") changed.add(m.user_id);
+			else if (!sharing.has(m.user_id)) left.add(m.user_id);
+		}
+		for (const u of left) changed.delete(u);
+		return {
+			changed: [...changed],
+			left: [...left]
+		};
+	}
+};
+//#endregion
+export { KeyService };

package/dist/core/notifier.d.ts

@@ -0,0 +1,17 @@
+import { ClusterAdapter } from "./cluster.js";
+//#region src/core/notifier.d.ts
+/**
+ * Wakes long-polling `/sync` requests when something relevant happens. Notifications
+ * are broadcast through the cluster adapter so waiters on other instances wake too.
+ */
+export declare class Notifier {
+  private waiters;
+  private cluster;
+  private instanceId;
+  constructor(cluster: ClusterAdapter, instanceId: string);
+  notify(userIds: Iterable<string>): void;
+  private wakeLocal;
+  notifyAll(): void;
+  wait(userId: string, timeoutMs: number, signal?: AbortSignal): Promise<void>;
+}
+//#endregion

package/dist/core/notifier.js

@@ -0,0 +1,54 @@
+//#region src/core/notifier.ts
+/**
+* Wakes long-polling `/sync` requests when something relevant happens. Notifications
+* are broadcast through the cluster adapter so waiters on other instances wake too.
+*/
+var Notifier = class {
+	waiters = /* @__PURE__ */ new Map();
+	cluster;
+	instanceId;
+	constructor(cluster, instanceId) {
+		this.cluster = cluster;
+		this.instanceId = instanceId;
+		cluster.subscribe("notify", (msg) => {
+			if (msg?.from !== this.instanceId && Array.isArray(msg?.users)) this.wakeLocal(msg.users);
+		});
+	}
+	notify(userIds) {
+		const users = [...userIds];
+		if (!users.length) return;
+		this.wakeLocal(users);
+		this.cluster.publish("notify", {
+			from: this.instanceId,
+			users
+		}).catch(() => {});
+	}
+	wakeLocal(userIds) {
+		for (const u of userIds) {
+			const set = this.waiters.get(u);
+			if (!set) continue;
+			this.waiters.delete(u);
+			for (const wake of set) wake();
+		}
+	}
+	notifyAll() {
+		this.wakeLocal([...this.waiters.keys()]);
+	}
+	wait(userId, timeoutMs, signal) {
+		return new Promise((resolve) => {
+			let set = this.waiters.get(userId);
+			if (!set) this.waiters.set(userId, set = /* @__PURE__ */ new Set());
+			const done = () => {
+				clearTimeout(timer);
+				set.delete(done);
+				signal?.removeEventListener("abort", done);
+				resolve();
+			};
+			const timer = setTimeout(done, timeoutMs);
+			signal?.addEventListener("abort", done, { once: true });
+			set.add(done);
+		});
+	}
+};
+//#endregion
+export { Notifier };

package/dist/core/oauth.d.ts

@@ -0,0 +1,38 @@
+import { Session } from "./auth.js";
+import { Homeserver } from "../homeserver.js";
+//#region src/core/oauth.d.ts
+/**
+ * Delegate authentication to an external OAuth 2.0 / OpenID Connect provider
+ * (Matrix "OAuth 2.0 API", e.g. matrix-authentication-service, Keycloak, Authentik).
+ */
+export interface OAuthDelegationOptions {
+  /** Issuer URL of the authorization server. */
+  issuer: string;
+  /** Client credentials the homeserver uses for token introspection. */
+  clientId: string;
+  clientSecret: string;
+  /** Override the introspection endpoint instead of discovering it. */
+  introspectionEndpoint?: string;
+  /** Where users manage their account (advertised to clients). */
+  accountManagementUrl?: string;
+  /** Map introspection claims to a Matrix localpart. Default: `username`, then `sub`. */
+  localpartFromClaims?: (claims: Record<string, any>) => string | null;
+  /** Scope granting server admin rights. Default: "urn:synapse:admin:*". */
+  adminScope?: string;
+  /** How long successful introspections are cached, in ms. Default: 60 000. */
+  cacheTtlMs?: number;
+}
+export declare class OAuthDelegation {
+  private hs;
+  readonly options: OAuthDelegationOptions;
+  private metadata;
+  private metadataFetched;
+  private cache;
+  constructor(hs: Homeserver, options: OAuthDelegationOptions);
+  /** Authorization server metadata (RFC 8414 / OIDC discovery), cached for an hour. */
+  serverMetadata(): Promise<Record<string, any>>;
+  /** Validate an access token by introspection, provisioning the user and device on first use. */
+  authenticate(token: string): Promise<Session>;
+  forget(token: string): void;
+}
+//#endregion

package/dist/core/oauth.js

@@ -0,0 +1,108 @@
+import { errors } from "./errors.js";
+import { LOCALPART_RE } from "./ids.js";
+//#region src/core/oauth.ts
+const API_SCOPES = ["urn:matrix:client:api:*", "urn:matrix:org.matrix.msc2967.client:api:*"];
+const DEVICE_SCOPE_PREFIXES = ["urn:matrix:client:device:", "urn:matrix:org.matrix.msc2967.client:device:"];
+var OAuthDelegation = class {
+	hs;
+	options;
+	metadata = null;
+	metadataFetched = 0;
+	cache = /* @__PURE__ */ new Map();
+	constructor(hs, options) {
+		this.hs = hs;
+		this.options = options;
+	}
+	/** Authorization server metadata (RFC 8414 / OIDC discovery), cached for an hour. */
+	async serverMetadata() {
+		if (this.metadata && Date.now() - this.metadataFetched < 36e5) return this.metadata;
+		const base = this.options.issuer.replace(/\/$/, "");
+		let res = await this.hs.fetch(`${base}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(1e4) });
+		if (!res.ok) res = await this.hs.fetch(`${base}/.well-known/oauth-authorization-server`, { signal: AbortSignal.timeout(1e4) });
+		if (!res.ok) throw new Error(`OAuth discovery failed with ${res.status}`);
+		const meta = await res.json();
+		if (this.options.accountManagementUrl) meta.account_management_uri = this.options.accountManagementUrl;
+		this.metadata = meta;
+		this.metadataFetched = Date.now();
+		return meta;
+	}
+	/** Validate an access token by introspection, provisioning the user and device on first use. */
+	async authenticate(token) {
+		const cached = this.cache.get(token);
+		if (cached && cached.expires > Date.now()) return cached.session;
+		const endpoint = this.options.introspectionEndpoint ?? (await this.serverMetadata()).introspection_endpoint;
+		if (!endpoint) throw new Error("Authorization server has no introspection endpoint");
+		const res = await this.hs.fetch(endpoint, {
+			method: "POST",
+			headers: {
+				"content-type": "application/x-www-form-urlencoded",
+				authorization: `Basic ${Buffer.from(`${encodeURIComponent(this.options.clientId)}:${encodeURIComponent(this.options.clientSecret)}`).toString("base64")}`
+			},
+			body: new URLSearchParams({
+				token,
+				token_type_hint: "access_token"
+			}),
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!res.ok) throw errors.unknownToken("Token introspection failed");
+		const claims = await res.json();
+		if (!claims.active) throw errors.unknownToken();
+		const scopes = String(claims.scope ?? "").split(" ");
+		if (!scopes.some((s) => API_SCOPES.includes(s))) throw errors.unknownToken("Token lacks the Matrix API scope");
+		let deviceId = null;
+		for (const s of scopes) for (const p of DEVICE_SCOPE_PREFIXES) if (s.startsWith(p)) deviceId = s.slice(p.length);
+		if (!deviceId) throw errors.unknownToken("Token lacks a device scope");
+		const localpart = (this.options.localpartFromClaims?.(claims) ?? claims.username ?? claims.sub ?? "").toLowerCase();
+		if (!LOCALPART_RE.test(localpart)) throw errors.unknownToken("Token subject cannot be mapped to a Matrix user");
+		const userId = `@${localpart}:${this.hs.serverName}`;
+		let user = await this.hs.db.findOne("users", [{
+			field: "user_id",
+			value: userId
+		}]);
+		if (!user) {
+			await this.hs.admin.createUser(localpart, { displayname: claims.name ?? localpart });
+			user = await this.hs.db.findOne("users", [{
+				field: "user_id",
+				value: userId
+			}]);
+		}
+		if (user.deactivated) throw errors.userDeactivated();
+		const deviceWhere = [{
+			field: "user_id",
+			value: userId
+		}, {
+			field: "device_id",
+			value: deviceId
+		}];
+		if (!await this.hs.db.findOne("devices", deviceWhere)) {
+			await this.hs.db.create("devices", {
+				user_id: userId,
+				device_id: deviceId,
+				display_name: null,
+				last_seen_ts: Date.now(),
+				last_seen_ip: null
+			});
+			await this.hs.keys.markDeviceListChanged(userId);
+		}
+		const session = {
+			userId,
+			deviceId,
+			accessToken: token,
+			isGuest: false,
+			isAdmin: !!user.is_admin || scopes.includes(this.options.adminScope ?? "urn:synapse:admin:*")
+		};
+		const ttl = this.options.cacheTtlMs ?? 6e4;
+		const exp = typeof claims.exp === "number" ? claims.exp * 1e3 : Infinity;
+		if (this.cache.size > 5e4) this.cache.clear();
+		this.cache.set(token, {
+			session,
+			expires: Math.min(Date.now() + ttl, exp)
+		});
+		return session;
+	}
+	forget(token) {
+		this.cache.delete(token);
+	}
+};
+//#endregion
+export { OAuthDelegation };

package/dist/core/partialstate.d.ts

@@ -0,0 +1,32 @@
+import { Homeserver } from "../homeserver.js";
+//#region src/core/partialstate.d.ts
+export declare class PartialStateService {
+  private readonly hs;
+  private readonly partial;
+  private readonly completed;
+  private readonly running;
+  private readonly completedStreams;
+  private stopped;
+  constructor(hs: Homeserver);
+  isPartial(roomId: string): Promise<boolean>;
+  /** Servers the joining server told us were in the room (used as destinations and resync sources). */
+  servers(roomId: string): Promise<string[]>;
+  /** Stream position at which the room got its full state (null if it never was partial). */
+  completedAt(roomId: string): Promise<number | null>;
+  /**
+   * A device list update for a user we do not share a (known) room with: if they may be a member
+   * of a partial-state room hosted by the sender, remember them for when the state is complete.
+   */
+  notePendingDeviceUpdate(userId: string, origin: string): Promise<void>;
+  markPartial(roomId: string, joinEventId: string, origin: string, servers: string[]): Promise<void>;
+  /** Resolve once the room has its full state (or the signal aborts / the server closes). */
+  waitForFullState(roomId: string, signal?: AbortSignal): Promise<void>;
+  /** Resume resyncs of rooms left partial (e.g. by a restart). */
+  resume(): Promise<void>;
+  stop(): void;
+  startResync(roomId: string): void;
+  private resync;
+  private tryResync;
+  private finish;
+}
+//#endregion