matrix-nodejs-homeserver 0.0.0-stage → 0.2.0

package/dist/api/admin.js

@@ -0,0 +1,251 @@
+import { errors } from "../core/errors.js";
+import { body, fail, lenient } from "../http/input.js";
+import { z } from "zod";
+//#region src/api/admin.ts
+const required = fail("M_BAD_JSON", "user_id and content are required");
+const noticeBody = body({
+	user_id: z.string(required),
+	content: z.looseObject({}, required),
+	type: lenient(z.string())
+});
+const optionalInt = (name) => z.number(fail("M_INVALID_PARAM", `${name} must be an integer`)).int(`M_INVALID_PARAM: ${name} must be an integer`);
+const registrationTokenBody = body({
+	token: z.string(fail("M_INVALID_PARAM", "Invalid token")).optional(),
+	uses_allowed: optionalInt("uses_allowed").nullable().optional(),
+	expiry_time: optionalInt("expiry_time").nullable().optional(),
+	length: optionalInt("length").optional()
+});
+async function requireAdmin(ctx) {
+	const s = await ctx.auth();
+	if (!s.isAdmin) throw errors.forbidden("You are not a server admin");
+	if (ctx.method !== "GET") await ctx.hs.audit.record({
+		action: "admin_action",
+		actor: s.userId,
+		ip: ctx.ip,
+		details: {
+			method: ctx.method,
+			path: ctx.url.pathname
+		}
+	});
+	return s;
+}
+/** Admin HTTP API using Synapse-compatible paths, so existing tooling keeps working. */
+function registerAdminRoutes(r) {
+	const notice = async (ctx) => {
+		await requireAdmin(ctx);
+		const body = ctx.input;
+		return { event_id: await ctx.hs.admin.sendServerNotice(body.user_id, body.content, {
+			type: body.type,
+			txnId: ctx.params.txnId
+		}) };
+	};
+	const moderation = (field) => {
+		const target = async (ctx) => {
+			await requireAdmin(ctx);
+			const userId = ctx.params.userId;
+			if (!ctx.hs.isLocalUser(userId)) throw errors.invalidParam("Not a local user");
+			const user = await ctx.hs.db.findOne("users", [{
+				field: "user_id",
+				value: userId
+			}]);
+			if (!user) throw errors.notFound("Unknown user");
+			return user;
+		};
+		return {
+			get: async (ctx) => ({ [field]: !!(await target(ctx))[field] }),
+			put: async (ctx) => {
+				await target(ctx);
+				const s = await ctx.auth();
+				const body = await ctx.json();
+				if (typeof body[field] !== "boolean") throw errors.badJson(`${field} must be a boolean`);
+				if (field === "locked") await ctx.hs.admin.setLocked(ctx.params.userId, body.locked, s.userId);
+				else await ctx.hs.admin.setSuspended(ctx.params.userId, body.suspended, s.userId);
+				return { [field]: body[field] };
+			}
+		};
+	};
+	const lock = moderation("locked"), suspend = moderation("suspended");
+	r.get("/_matrix/client/v1/admin/lock/:userId", lock.get);
+	r.put("/_matrix/client/v1/admin/lock/:userId", lock.put);
+	r.get("/_matrix/client/v1/admin/suspend/:userId", suspend.get);
+	r.put("/_matrix/client/v1/admin/suspend/:userId", suspend.put);
+	r.post("/_synapse/admin/v1/send_server_notice", { input: noticeBody }, notice);
+	r.put("/_synapse/admin/v1/send_server_notice/:txnId", { input: noticeBody }, notice);
+	r.get("/_synapse/admin/v2/users", async (ctx) => {
+		await requireAdmin(ctx);
+		const from = Number(ctx.query.get("from") ?? 0) || 0;
+		const res = await ctx.hs.admin.listUsers({
+			from,
+			limit: Number(ctx.query.get("limit") ?? 100) || 100,
+			search: ctx.query.get("name") ?? void 0,
+			includeDeactivated: ctx.query.get("deactivated") === "true"
+		});
+		return {
+			users: res.users,
+			total: res.total,
+			...res.next !== null ? { next_token: String(res.next) } : {}
+		};
+	});
+	r.get("/_synapse/admin/v2/users/:userId", async (ctx) => {
+		await requireAdmin(ctx);
+		const user = await ctx.hs.admin.getUser(ctx.params.userId);
+		if (!user) throw errors.notFound("Unknown user");
+		return user;
+	});
+	r.put("/_synapse/admin/v2/users/:userId", async (ctx) => {
+		await requireAdmin(ctx);
+		const body = await ctx.json();
+		const userId = ctx.params.userId;
+		if (!ctx.hs.isLocalUser(userId)) throw errors.invalidParam("Can only manage local users");
+		if (!await ctx.hs.admin.getUser(userId)) {
+			await ctx.hs.admin.createUser(userId.slice(1).split(":")[0], {
+				password: body.password,
+				admin: body.admin === true,
+				displayname: body.displayname
+			});
+			return new Response(JSON.stringify(await ctx.hs.admin.getUser(userId)), {
+				status: 201,
+				headers: { "content-type": "application/json" }
+			});
+		}
+		if (typeof body.password === "string") await ctx.hs.admin.resetPassword(userId, body.password, body.logout_devices !== false);
+		if (typeof body.admin === "boolean") await ctx.hs.admin.setAdmin(userId, body.admin);
+		if (typeof body.displayname === "string") {
+			await ctx.hs.db.update("users", [{
+				field: "user_id",
+				value: userId
+			}], { displayname: body.displayname });
+			await ctx.hs.rooms.propagateProfile(userId);
+		}
+		if (body.deactivated === true) await ctx.hs.admin.deactivateUser(userId);
+		return ctx.hs.admin.getUser(userId);
+	});
+	r.post("/_synapse/admin/v1/deactivate/:userId", { input: body({ erase: lenient(z.boolean()) }) }, async (ctx) => {
+		await requireAdmin(ctx);
+		const body = ctx.input;
+		await ctx.hs.admin.deactivateUser(ctx.params.userId, { erase: body.erase === true });
+		return { id_server_unbind_result: "no-support" };
+	});
+	const resetPasswordBody = body({
+		new_password: z.string(fail("M_MISSING_PARAM", "Missing new_password")),
+		logout_devices: lenient(z.boolean())
+	});
+	r.post("/_synapse/admin/v1/reset_password/:userId", { input: resetPasswordBody }, async (ctx) => {
+		await requireAdmin(ctx);
+		const body = ctx.input;
+		await ctx.hs.admin.resetPassword(ctx.params.userId, body.new_password, body.logout_devices !== false);
+		return {};
+	});
+	r.get("/_synapse/admin/v1/registration_tokens", async (ctx) => {
+		await requireAdmin(ctx);
+		return { registration_tokens: await ctx.hs.admin.listRegistrationTokens() };
+	});
+	r.post("/_synapse/admin/v1/registration_tokens/new", { input: registrationTokenBody }, async (ctx) => {
+		await requireAdmin(ctx);
+		const body = ctx.input;
+		return ctx.hs.admin.createRegistrationToken({
+			token: body.token,
+			usesAllowed: body.uses_allowed,
+			expiryTime: body.expiry_time,
+			length: body.length
+		});
+	});
+	r.delete("/_synapse/admin/v1/registration_tokens/:token", async (ctx) => {
+		await requireAdmin(ctx);
+		await ctx.hs.admin.deleteRegistrationToken(ctx.params.token);
+		return {};
+	});
+	r.get("/_synapse/admin/v1/audit_log", async (ctx) => {
+		await requireAdmin(ctx);
+		if (!ctx.hs.audit.enabled) throw errors.unrecognized("The audit log is disabled");
+		const rows = await ctx.hs.audit.query({
+			actor: ctx.query.get("actor") ?? void 0,
+			target: ctx.query.get("target") ?? void 0,
+			action: ctx.query.get("action") ?? void 0,
+			since: Number(ctx.query.get("since")) || void 0,
+			before: Number(ctx.query.get("from")) || void 0,
+			limit: Number(ctx.query.get("limit")) || 100
+		});
+		const out = { entries: rows };
+		if (rows.length) out.next_token = String(rows[rows.length - 1].id);
+		return out;
+	});
+	r.get("/_synapse/admin/v1/event_reports", async (ctx) => {
+		await requireAdmin(ctx);
+		const rows = await ctx.hs.db.findMany("event_reports", {
+			sortBy: {
+				field: "id",
+				direction: "desc"
+			},
+			limit: Number(ctx.query.get("limit")) || 100
+		});
+		return {
+			event_reports: rows.map((r) => ({
+				id: r.id,
+				received_ts: r.ts,
+				room_id: r.room_id,
+				event_id: r.event_id,
+				user_id: r.reporter,
+				reason: r.reason,
+				score: r.score,
+				resolved: r.resolved
+			})),
+			total: rows.length
+		};
+	});
+	r.post("/_synapse/admin/v1/event_reports/:id/resolve", async (ctx) => {
+		await requireAdmin(ctx);
+		if (!await ctx.hs.db.update("event_reports", [{
+			field: "id",
+			value: Number(ctx.params.id)
+		}], { resolved: true })) throw errors.notFound("Unknown report");
+		return {};
+	});
+	r.get("/_synapse/admin/v1/rooms", async (ctx) => {
+		await requireAdmin(ctx);
+		const res = await ctx.hs.admin.listRooms({
+			from: Number(ctx.query.get("from") ?? 0) || 0,
+			limit: Number(ctx.query.get("limit") ?? 100) || 100
+		});
+		return {
+			rooms: res.rooms,
+			total_rooms: res.total
+		};
+	});
+	r.delete("/_synapse/admin/v1/rooms/:roomId", async (ctx) => {
+		const s = await requireAdmin(ctx);
+		const body = await ctx.json();
+		const { kicked } = await ctx.hs.admin.deleteRoom(ctx.params.roomId, {
+			actor: s.userId,
+			reason: body.message,
+			purge: body.purge !== false
+		});
+		return {
+			kicked_users: kicked,
+			failed_to_kick_users: [],
+			local_aliases: [],
+			new_room_id: null
+		};
+	});
+	r.delete("/_synapse/admin/v1/media/:serverName/:mediaId", async (ctx) => {
+		await requireAdmin(ctx);
+		if (ctx.params.serverName !== ctx.hs.serverName) throw errors.notFound("Remote media");
+		await ctx.hs.admin.deleteMedia(ctx.params.mediaId);
+		return {
+			deleted_media: [ctx.params.mediaId],
+			total: 1
+		};
+	});
+	r.post("/_synapse/admin/v1/media/delete", async (ctx) => {
+		await requireAdmin(ctx);
+		const before = Number(ctx.query.get("before_ts"));
+		if (!Number.isFinite(before)) throw errors.missingParam("Missing before_ts");
+		const deleted = await ctx.hs.admin.purgeMediaBefore(before);
+		return {
+			deleted_media: deleted,
+			total: deleted.length
+		};
+	});
+}
+//#endregion
+export { registerAdminRoutes };

package/dist/api/appservice.js

@@ -0,0 +1,33 @@
+import { errors } from "../core/errors.js";
+//#region src/api/appservice.ts
+function registerAppServiceRoutes(r) {
+	r.client("POST", "/appservice/:appserviceId/ping", async (ctx) => {
+		const s = await ctx.auth();
+		if (!s.appservice) throw errors.forbidden("An application service token is required");
+		if (s.appservice.id !== ctx.params.appserviceId) throw errors.forbidden("Token does not belong to this application service");
+		const body = await ctx.json();
+		return { duration_ms: await ctx.hs.appservices.ping(s.appservice, typeof body.transaction_id === "string" ? body.transaction_id : void 0) };
+	}, ["v1"]);
+	r.client("GET", "/thirdparty/protocols", async (ctx) => {
+		await ctx.auth();
+		return ctx.hs.appservices.protocols();
+	});
+	r.client("GET", "/thirdparty/protocol/:protocol", async (ctx) => {
+		await ctx.auth();
+		const p = (await ctx.hs.appservices.protocols())[ctx.params.protocol];
+		if (!p) throw errors.notFound("Unknown protocol");
+		return p;
+	});
+	for (const kind of ["location", "user"]) {
+		r.client("GET", `/thirdparty/${kind}/:protocol`, async (ctx) => {
+			await ctx.auth();
+			return ctx.hs.appservices.thirdParty(`${kind}/${encodeURIComponent(ctx.params.protocol)}`, ctx.query);
+		});
+		r.client("GET", `/thirdparty/${kind}`, async (ctx) => {
+			await ctx.auth();
+			return ctx.hs.appservices.thirdParty(kind, ctx.query);
+		});
+	}
+}
+//#endregion
+export { registerAppServiceRoutes };

package/dist/api/backup.js

@@ -0,0 +1,269 @@
+import { isObject } from "../core/json.js";
+import { MatrixError, errors } from "../core/errors.js";
+import { body, fail } from "../http/input.js";
+import { z } from "zod";
+//#region src/api/backup.ts
+const required = fail("M_BAD_JSON", "algorithm and auth_data are required");
+const createVersionBody = body({
+	algorithm: z.string(required),
+	auth_data: z.looseObject({}, required)
+});
+/** Server-side room key backups (`/room_keys`). */
+async function latestVersion(hs, userId) {
+	return (await hs.db.findMany("backup_versions", {
+		where: [{
+			field: "user_id",
+			value: userId
+		}, {
+			field: "deleted",
+			value: false
+		}],
+		sortBy: {
+			field: "version",
+			direction: "desc"
+		},
+		limit: 1
+	}))[0] ?? null;
+}
+async function getVersion(hs, userId, version) {
+	if (version === null) return latestVersion(hs, userId);
+	const n = Number(version);
+	if (!Number.isInteger(n)) return null;
+	const row = await hs.db.findOne("backup_versions", [{
+		field: "user_id",
+		value: userId
+	}, {
+		field: "version",
+		value: n
+	}]);
+	return row && !row.deleted ? row : null;
+}
+async function countKeys(hs, userId, version) {
+	return (await hs.db.findMany("backup_keys", { where: [{
+		field: "user_id",
+		value: userId
+	}, {
+		field: "version",
+		value: version
+	}] })).length;
+}
+async function describe(hs, row) {
+	return {
+		algorithm: row.algorithm,
+		auth_data: row.auth_data,
+		version: String(row.version),
+		etag: String(row.etag),
+		count: await countKeys(hs, row.user_id, row.version)
+	};
+}
+/** Whether `incoming` should replace `existing` according to the spec's key-selection rules. */
+function better(incoming, existing) {
+	if (!existing) return true;
+	if (!!incoming.is_verified !== !!existing.is_verified) return !!incoming.is_verified;
+	if (incoming.first_message_index !== existing.first_message_index) return incoming.first_message_index < existing.first_message_index;
+	return incoming.forwarded_count < existing.forwarded_count;
+}
+async function requireCurrentVersion(ctx, userId) {
+	const version = ctx.query.get("version");
+	if (!version) throw errors.missingParam("Missing version");
+	const row = await getVersion(ctx.hs, userId, version);
+	if (!row) throw errors.notFound("Unknown backup version");
+	return {
+		row,
+		isLatest: (await latestVersion(ctx.hs, userId))?.version === row.version
+	};
+}
+function registerBackupRoutes(r) {
+	r.client("POST", "/room_keys/version", { input: createVersionBody }, async (ctx) => {
+		const s = await ctx.auth();
+		const body = ctx.input;
+		const max = (await ctx.hs.db.findMany("backup_versions", { where: [{
+			field: "user_id",
+			value: s.userId
+		}] })).reduce((m, v) => Math.max(m, v.version), 0);
+		await ctx.hs.db.create("backup_versions", {
+			user_id: s.userId,
+			version: max + 1,
+			algorithm: body.algorithm,
+			auth_data: body.auth_data,
+			etag: 0,
+			deleted: false
+		});
+		return { version: String(max + 1) };
+	});
+	const getVersionHandler = async (ctx) => {
+		const s = await ctx.auth();
+		const row = await getVersion(ctx.hs, s.userId, ctx.params.version ?? null);
+		if (!row) throw errors.notFound("No backup found");
+		return describe(ctx.hs, row);
+	};
+	r.client("GET", "/room_keys/version", getVersionHandler);
+	r.client("GET", "/room_keys/version/:version", getVersionHandler);
+	r.client("PUT", "/room_keys/version/:version", async (ctx) => {
+		const s = await ctx.auth();
+		const body = await ctx.json();
+		const row = await getVersion(ctx.hs, s.userId, ctx.params.version);
+		if (!row) throw errors.notFound("Unknown backup version");
+		if (body.version !== void 0 && String(body.version) !== ctx.params.version) throw errors.invalidParam("Version mismatch");
+		if (body.algorithm !== row.algorithm) throw errors.invalidParam("Algorithm cannot be changed");
+		if (!isObject(body.auth_data)) throw errors.badJson("auth_data is required");
+		await ctx.hs.db.update("backup_versions", [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "version",
+			value: row.version
+		}], { auth_data: body.auth_data });
+		return {};
+	});
+	r.client("DELETE", "/room_keys/version/:version", async (ctx) => {
+		const s = await ctx.auth();
+		const row = await getVersion(ctx.hs, s.userId, ctx.params.version);
+		if (!row) throw errors.notFound("Unknown backup version");
+		await ctx.hs.db.update("backup_versions", [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "version",
+			value: row.version
+		}], { deleted: true });
+		await ctx.hs.db.delete("backup_keys", [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "version",
+			value: row.version
+		}]);
+		return {};
+	});
+	const putKeys = async (ctx) => {
+		const s = await ctx.auth();
+		const hs = ctx.hs;
+		const { row, isLatest } = await requireCurrentVersion(ctx, s.userId);
+		if (!isLatest) {
+			const latest = await latestVersion(hs, s.userId);
+			throw new MatrixError(403, "M_WRONG_ROOM_KEYS_VERSION", "Wrong backup version", { current_version: String(latest?.version ?? "") });
+		}
+		const body = await ctx.json();
+		let rooms;
+		if (ctx.params.sessionId) rooms = { [ctx.params.roomId]: { sessions: { [ctx.params.sessionId]: body } } };
+		else if (ctx.params.roomId) rooms = { [ctx.params.roomId]: body };
+		else rooms = body.rooms ?? {};
+		let changed = false;
+		for (const [roomId, room] of Object.entries(rooms)) {
+			if (!isObject(room) || !isObject(room.sessions)) continue;
+			for (const [sessionId, data] of Object.entries(room.sessions)) {
+				const where = [
+					{
+						field: "user_id",
+						value: s.userId
+					},
+					{
+						field: "version",
+						value: row.version
+					},
+					{
+						field: "room_id",
+						value: roomId
+					},
+					{
+						field: "session_id",
+						value: sessionId
+					}
+				];
+				if (!better(data, (await hs.db.findOne("backup_keys", where))?.data ?? null)) continue;
+				await hs.db.upsert("backup_keys", {
+					user_id: s.userId,
+					version: row.version,
+					room_id: roomId,
+					session_id: sessionId,
+					data
+				});
+				changed = true;
+			}
+		}
+		const etag = changed ? row.etag + 1 : row.etag;
+		if (changed) await hs.db.update("backup_versions", [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "version",
+			value: row.version
+		}], { etag });
+		return {
+			etag: String(etag),
+			count: await countKeys(hs, s.userId, row.version)
+		};
+	};
+	const getKeys = async (ctx) => {
+		const s = await ctx.auth();
+		const { row } = await requireCurrentVersion(ctx, s.userId);
+		const where = [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "version",
+			value: row.version
+		}];
+		if (ctx.params.roomId) where.push({
+			field: "room_id",
+			value: ctx.params.roomId
+		});
+		if (ctx.params.sessionId) where.push({
+			field: "session_id",
+			value: ctx.params.sessionId
+		});
+		const keys = await ctx.hs.db.findMany("backup_keys", { where });
+		if (ctx.params.sessionId) {
+			if (!keys[0]) throw errors.notFound("Key not found");
+			return keys[0].data;
+		}
+		const rooms = {};
+		for (const k of keys) (rooms[k.room_id] ??= { sessions: {} }).sessions[k.session_id] = k.data;
+		if (ctx.params.roomId) return rooms[ctx.params.roomId] ?? { sessions: {} };
+		return { rooms };
+	};
+	const deleteKeys = async (ctx) => {
+		const s = await ctx.auth();
+		const { row } = await requireCurrentVersion(ctx, s.userId);
+		const where = [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "version",
+			value: row.version
+		}];
+		if (ctx.params.roomId) where.push({
+			field: "room_id",
+			value: ctx.params.roomId
+		});
+		if (ctx.params.sessionId) where.push({
+			field: "session_id",
+			value: ctx.params.sessionId
+		});
+		await ctx.hs.db.delete("backup_keys", where);
+		const etag = row.etag + 1;
+		await ctx.hs.db.update("backup_versions", [{
+			field: "user_id",
+			value: s.userId
+		}, {
+			field: "version",
+			value: row.version
+		}], { etag });
+		return {
+			etag: String(etag),
+			count: await countKeys(ctx.hs, s.userId, row.version)
+		};
+	};
+	for (const path of [
+		"/room_keys/keys",
+		"/room_keys/keys/:roomId",
+		"/room_keys/keys/:roomId/:sessionId"
+	]) {
+		r.client("PUT", path, putKeys);
+		r.client("GET", path, getKeys);
+		r.client("DELETE", path, deleteKeys);
+	}
+}
+//#endregion
+export { registerBackupRoutes };