matrix-nodejs-homeserver 0.0.0-stage → 0.2.0

package/dist/api/preview.js

@@ -0,0 +1,200 @@
+import { randomString } from "../core/crypto.js";
+import { errors } from "../core/errors.js";
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+//#region src/api/preview.ts
+const MAX_BYTES = 1048576;
+const privateRanges = new BlockList();
+for (const [net, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) privateRanges.addSubnet(net, prefix, "ipv4");
+for (const [net, prefix] of [
+	["::", 128],
+	["::1", 128],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8],
+	["::ffff:0:0", 96]
+]) privateRanges.addSubnet(net, prefix, "ipv6");
+async function assertPublicHost(hostname) {
+	const host = hostname.replace(/^\[|\]$/g, "");
+	const addresses = isIP(host) ? [{
+		address: host,
+		family: isIP(host)
+	}] : await lookup(host, { all: true });
+	for (const { address, family } of addresses) if (privateRanges.check(address, family === 6 ? "ipv6" : "ipv4")) throw errors.forbidden("URL resolves to a private address");
+}
+function decodeEntities(s) {
+	return s.replace(/&(amp|lt|gt|quot|#39|#x27);/g, (m) => ({
+		"&": "&",
+		"&lt;": "<",
+		"&gt;": ">",
+		"&quot;": "\"",
+		"&#39;": "'",
+		"&#x27;": "'"
+	})[m] ?? m);
+}
+function parseOpenGraph(html) {
+	const og = {};
+	for (const tag of html.match(/<meta\s[^>]*>/gi) ?? []) {
+		const attr = (name) => new RegExp(`${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`, "i").exec(tag);
+		const key = attr("property") ?? attr("name");
+		const content = attr("content");
+		if (!key || !content) continue;
+		const k = (key[1] ?? key[2]).toLowerCase();
+		if (k.startsWith("og:") && !(k in og)) og[k] = decodeEntities(content[1] ?? content[2]);
+		if (k === "description" && !og["og:description"]) og["og:description"] = decodeEntities(content[1] ?? content[2]);
+	}
+	if (!og["og:title"]) {
+		const title = /<title[^>]*>([^<]*)<\/title>/i.exec(html);
+		if (title) og["og:title"] = decodeEntities(title[1].trim());
+	}
+	return og;
+}
+async function preview(hs, rawUrl) {
+	const opts = hs.config.urlPreviews;
+	if (!opts) throw errors.notFound("URL previews are disabled");
+	let url;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		throw errors.invalidParam("Invalid URL");
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw errors.invalidParam("Only http(s) URLs can be previewed");
+	for (let redirects = 0; redirects < 5; redirects++) {
+		if (!opts.allowPrivateAddresses) await assertPublicHost(url.hostname);
+		const res = await fetch(url, {
+			redirect: "manual",
+			signal: AbortSignal.timeout(1e4),
+			headers: { "user-agent": "matrix-nodejs-homeserver" }
+		});
+		if (res.status >= 300 && res.status < 400 && res.headers.get("location")) {
+			url = new URL(res.headers.get("location"), url);
+			continue;
+		}
+		if (!res.ok || !res.body) throw errors.notFound("Could not fetch URL");
+		const type = res.headers.get("content-type") ?? "";
+		if (type.startsWith("image/")) return {
+			...await storeImage(hs, res, type),
+			"og:url": url.href
+		};
+		if (!type.includes("html")) return {};
+		let size = 0;
+		const chunks = [];
+		for await (const chunk of res.body) {
+			size += chunk.length;
+			if (size > MAX_BYTES) break;
+			chunks.push(chunk);
+		}
+		const og = parseOpenGraph(Buffer.concat(chunks).toString("utf8"));
+		if (og["og:image"]) try {
+			const imageUrl = new URL(og["og:image"], url);
+			if (!opts.allowPrivateAddresses) await assertPublicHost(imageUrl.hostname);
+			const img = await fetch(imageUrl, { signal: AbortSignal.timeout(1e4) });
+			const imgType = img.headers.get("content-type") ?? "";
+			if (img.ok && imgType.startsWith("image/")) Object.assign(og, await storeImage(hs, img, imgType));
+		} catch {}
+		return og;
+	}
+	throw errors.notFound("Too many redirects");
+}
+/** Read width/height from PNG, GIF, JPEG or WebP headers. */
+function imageSize(data) {
+	const b = Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+	if (b.length >= 24 && b.readUInt32BE(0) === 2303741511) return {
+		width: b.readUInt32BE(16),
+		height: b.readUInt32BE(20)
+	};
+	if (b.length >= 10 && b.toString("ascii", 0, 3) === "GIF") return {
+		width: b.readUInt16LE(6),
+		height: b.readUInt16LE(8)
+	};
+	if (b.length >= 30 && b.toString("ascii", 0, 4) === "RIFF" && b.toString("ascii", 8, 12) === "WEBP") {
+		const chunk = b.toString("ascii", 12, 16);
+		if (chunk === "VP8 ") return {
+			width: b.readUInt16LE(26) & 16383,
+			height: b.readUInt16LE(28) & 16383
+		};
+		if (chunk === "VP8L") {
+			const bits = b.readUInt32LE(21);
+			return {
+				width: (bits & 16383) + 1,
+				height: (bits >> 14 & 16383) + 1
+			};
+		}
+		if (chunk === "VP8X") return {
+			width: b.readUIntLE(24, 3) + 1,
+			height: b.readUIntLE(27, 3) + 1
+		};
+	}
+	if (b.length >= 4 && b[0] === 255 && b[1] === 216) {
+		let i = 2;
+		while (i + 9 < b.length) {
+			if (b[i] !== 255) {
+				i++;
+				continue;
+			}
+			const marker = b[i + 1];
+			const len = b.readUInt16BE(i + 2);
+			if (marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204) return {
+				height: b.readUInt16BE(i + 5),
+				width: b.readUInt16BE(i + 7)
+			};
+			i += 2 + len;
+		}
+	}
+	return null;
+}
+/** Store a fetched image in the media repository and describe it for a preview. */
+async function storeImage(hs, res, type) {
+	const data = new Uint8Array(await res.arrayBuffer());
+	if (data.length > MAX_BYTES * 10) return {};
+	const mediaId = randomString(24);
+	await hs.media.put(mediaId, data, {
+		contentType: type,
+		filename: null,
+		size: data.length
+	});
+	await hs.db.create("media", {
+		media_id: mediaId,
+		content_type: type,
+		filename: null,
+		size: data.length,
+		uploader: "",
+		created_ts: Date.now(),
+		pending: false
+	});
+	const size = imageSize(data);
+	return {
+		"og:image": `mxc://${hs.serverName}/${mediaId}`,
+		"og:image:type": type,
+		"matrix:image:size": data.length,
+		...size ? {
+			"og:image:width": size.width,
+			"og:image:height": size.height
+		} : {}
+	};
+}
+function registerPreviewRoutes(r) {
+	const handler = async (ctx) => {
+		await ctx.auth();
+		const url = ctx.query.get("url");
+		if (!url) throw errors.missingParam("Missing url");
+		return preview(ctx.hs, url);
+	};
+	r.get("/_matrix/media/v3/preview_url", handler);
+	r.get("/_matrix/media/r0/preview_url", handler);
+	r.get("/_matrix/client/v1/media/preview_url", handler);
+}
+//#endregion
+export { imageSize, parseOpenGraph, registerPreviewRoutes };

package/dist/api/profile.js

@@ -0,0 +1,165 @@
+import { isObject } from "../core/json.js";
+import { MatrixError, errors } from "../core/errors.js";
+import { isValidUserId } from "../core/ids.js";
+import { getState } from "../core/authrules.js";
+import { assertNotSuspended } from "../core/auth.js";
+import { body, fail, lenient } from "../http/input.js";
+import { BUILTIN_FIELDS, fullProfile, profileSize, setProfileField } from "../core/profile.js";
+import { z } from "zod";
+//#region src/api/profile.ts
+async function remoteProfile(ctx, field) {
+	if (!isValidUserId(ctx.params.userId)) throw errors.invalidParam("Invalid user ID");
+	try {
+		const res = await ctx.hs.federation.queryProfile(ctx.params.userId, field);
+		return isObject(res) ? res : {};
+	} catch (err) {
+		if (err instanceof MatrixError && err.status === 404) throw errors.notFound("Profile not found");
+		throw err;
+	}
+}
+async function localProfile(ctx) {
+	const profile = await fullProfile(ctx.hs, ctx.params.userId);
+	if (!profile) throw errors.notFound("Profile not found");
+	return profile;
+}
+function checkField(field) {
+	if (!field || Buffer.byteLength(field) > 255) throw new MatrixError(400, "M_KEY_TOO_LARGE", "Profile key too long");
+}
+function registerProfileRoutes(r) {
+	r.client("GET", "/profile/:userId", async (ctx) => {
+		if (!ctx.hs.isLocalUser(ctx.params.userId)) return remoteProfile(ctx);
+		return localProfile(ctx);
+	});
+	r.client("GET", "/profile/:userId/:field", async (ctx) => {
+		const field = ctx.params.field;
+		checkField(field);
+		const profile = ctx.hs.isLocalUser(ctx.params.userId) ? await localProfile(ctx) : await remoteProfile(ctx, field);
+		if (profile[field] === void 0 || profile[field] === null) throw errors.notFound("Profile field not set");
+		return { [field]: profile[field] };
+	});
+	async function owner(ctx) {
+		const s = await ctx.auth();
+		if (!isValidUserId(ctx.params.userId) || ctx.params.userId !== s.userId) throw errors.forbidden("Cannot change another user's profile");
+		checkField(ctx.params.field);
+		await assertNotSuspended(ctx.hs, s);
+		return s;
+	}
+	r.client("PUT", "/profile/:userId/:field", async (ctx) => {
+		const s = await owner(ctx);
+		const field = ctx.params.field;
+		const body = await ctx.json();
+		if (!isObject(body) || !(field in body)) throw errors.badJson(`Body must contain ${field}`);
+		if (Object.keys(body).length !== 1) throw errors.badJson("Body must contain only the profile field");
+		const value = body[field];
+		if (BUILTIN_FIELDS.has(field)) {
+			if (value !== null && typeof value !== "string") throw errors.badJson(`${field} must be a string`);
+			if (typeof value === "string" && value.length > 1024) throw errors.tooLarge(`${field} too long`);
+		}
+		const profile = await fullProfile(ctx.hs, s.userId) ?? {};
+		profile[field] = value;
+		if (profileSize(profile) > 65536) throw new MatrixError(400, "M_PROFILE_TOO_LARGE", "Profile too large");
+		await setProfileField(ctx.hs, s.userId, field, value);
+		return {};
+	});
+	r.client("DELETE", "/profile/:userId/:field", async (ctx) => {
+		const s = await owner(ctx);
+		await setProfileField(ctx.hs, s.userId, ctx.params.field, null);
+		return {};
+	});
+	const directoryBody = body({
+		search_term: z.string(fail("M_MISSING_PARAM", "Missing search_term")),
+		limit: lenient(z.number().int())
+	});
+	r.client("POST", "/user_directory/search", { input: directoryBody }, async (ctx) => {
+		const s = await ctx.auth();
+		const body = ctx.input;
+		const term = body.search_term.toLowerCase();
+		const limit = body.limit !== void 0 ? Math.min(body.limit, 50) : 10;
+		const visible = await ctx.hs.rooms.usersSharingRooms(s.userId);
+		visible.delete(s.userId);
+		for (const room of await ctx.hs.db.findMany("rooms", {})) {
+			const state = await ctx.hs.rooms.currentState(room.room_id);
+			if (room.is_public || getState(state, "m.room.join_rules")?.content?.join_rule === "public" || getState(state, "m.room.history_visibility")?.content?.history_visibility === "world_readable") for (const u of await ctx.hs.rooms.joinedMembers(room.room_id)) visible.add(u);
+		}
+		const candidates = (await ctx.hs.db.findMany("users", { where: [{
+			field: "user_id",
+			operator: "in",
+			value: [...visible].filter((u) => ctx.hs.isLocalUser(u))
+		}] })).filter((u) => !u.deactivated).map((u) => ({
+			user_id: u.user_id,
+			displayname: u.displayname,
+			avatar_url: u.avatar_url
+		}));
+		for (const userId of visible) {
+			if (ctx.hs.isLocalUser(userId)) continue;
+			const row = (await ctx.hs.db.findMany("memberships", {
+				where: [{
+					field: "user_id",
+					value: userId
+				}, {
+					field: "membership",
+					value: "join"
+				}],
+				limit: 1
+			}))[0];
+			const member = row ? await ctx.hs.rooms.getPdu(row.event_id) : null;
+			candidates.push({
+				user_id: userId,
+				displayname: member?.content?.displayname,
+				avatar_url: member?.content?.avatar_url
+			});
+		}
+		const results = candidates.filter((u) => u.user_id.toLowerCase().includes(term) || typeof u.displayname === "string" && u.displayname.toLowerCase().includes(term)).map((u) => ({
+			user_id: u.user_id,
+			display_name: u.displayname ?? void 0,
+			avatar_url: u.avatar_url ?? void 0
+		}));
+		return {
+			results: results.slice(0, limit),
+			limited: results.length > limit
+		};
+	});
+	r.client("GET", "/presence/:userId/status", async (ctx) => {
+		await ctx.auth();
+		const row = await ctx.hs.db.findOne("presence", [{
+			field: "user_id",
+			value: ctx.params.userId
+		}]);
+		if (!row) {
+			if (!await ctx.hs.db.findOne("users", [{
+				field: "user_id",
+				value: ctx.params.userId
+			}])) throw errors.notFound("Unknown user");
+			return { presence: "offline" };
+		}
+		const out = {
+			presence: row.presence,
+			last_active_ago: Date.now() - row.last_active_ts
+		};
+		if (row.status_msg) out.status_msg = row.status_msg;
+		if (row.presence === "online") out.currently_active = true;
+		return out;
+	});
+	r.client("PUT", "/presence/:userId/status", async (ctx) => {
+		const s = await ctx.auth();
+		if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot set another user's presence");
+		const body = await ctx.json();
+		if (![
+			"online",
+			"offline",
+			"unavailable"
+		].includes(body.presence)) throw errors.invalidParam("Invalid presence");
+		await ctx.hs.streams.write((stream) => ctx.hs.db.upsert("presence", {
+			user_id: s.userId,
+			presence: body.presence,
+			status_msg: typeof body.status_msg === "string" ? body.status_msg : null,
+			last_active_ts: Date.now(),
+			stream
+		}));
+		await ctx.hs.federation.onPresence(s.userId, body.presence, typeof body.status_msg === "string" ? body.status_msg : null).catch(() => {});
+		ctx.hs.notifier.notify(await ctx.hs.rooms.usersSharingRooms(s.userId));
+		return {};
+	});
+}
+//#endregion
+export { registerProfileRoutes };

package/dist/api/push.js

@@ -0,0 +1,187 @@
+import { errors } from "../core/errors.js";
+import { KINDS, loadRules, saveRules, withRulesLock } from "../core/pushrules.js";
+import { body, fail, lenient } from "../http/input.js";
+import { z } from "zod";
+//#region src/api/push.ts
+const pusherKey = z.string(fail("M_MISSING_PARAM", "Missing app_id or pushkey"));
+const pusherBody = body({
+	app_id: pusherKey,
+	pushkey: pusherKey,
+	kind: lenient(z.string().nullable()),
+	app_display_name: lenient(z.string()),
+	device_display_name: lenient(z.string()),
+	lang: lenient(z.string()),
+	data: lenient(z.looseObject({ url: lenient(z.string()) })),
+	append: z.unknown().optional()
+});
+function findRule(rules, kind, ruleId) {
+	if (!KINDS.includes(kind)) throw errors.invalidParam("Unknown rule kind");
+	const rule = rules[kind]?.find((r) => r.rule_id === ruleId);
+	if (!rule) throw errors.notFound("Unknown push rule");
+	return rule;
+}
+async function ruleCtx(ctx) {
+	const s = await ctx.auth();
+	if (ctx.params.scope !== "global") throw errors.invalidParam("Unknown scope");
+	return {
+		s,
+		rules: await loadRules(ctx.hs, s.userId)
+	};
+}
+function registerPushRoutes(r) {
+	r.client("GET", "/pushrules", async (ctx) => {
+		const s = await ctx.auth();
+		return { global: await loadRules(ctx.hs, s.userId) };
+	});
+	r.client("GET", "/pushrules/:scope", async (ctx) => {
+		const { rules } = await ruleCtx(ctx);
+		return rules;
+	});
+	r.client("GET", "/pushrules/:scope/:kind/:ruleId", async (ctx) => {
+		const { rules } = await ruleCtx(ctx);
+		return findRule(rules, ctx.params.kind, ctx.params.ruleId);
+	});
+	r.client("DELETE", "/pushrules/:scope/:kind/:ruleId", async (ctx) => withRulesLock(ctx.hs, (await ctx.auth()).userId, async () => {
+		const { s, rules } = await ruleCtx(ctx);
+		const rule = findRule(rules, ctx.params.kind, ctx.params.ruleId);
+		if (rule.default) throw errors.forbidden("Cannot delete a default rule");
+		rules[ctx.params.kind] = rules[ctx.params.kind].filter((x) => x !== rule);
+		await saveRules(ctx.hs, s.userId, rules);
+		return {};
+	}));
+	r.client("PUT", "/pushrules/:scope/:kind/:ruleId", async (ctx) => withRulesLock(ctx.hs, (await ctx.auth()).userId, async () => {
+		const { s, rules } = await ruleCtx(ctx);
+		const { kind, ruleId } = ctx.params;
+		if (!KINDS.includes(kind)) throw errors.invalidParam("Unknown rule kind");
+		if (ruleId.startsWith(".")) throw errors.invalidParam("Rule IDs starting with '.' are reserved");
+		const body = await ctx.json();
+		if (!Array.isArray(body.actions)) throw errors.badJson("actions must be a list");
+		const rule = {
+			rule_id: ruleId,
+			default: false,
+			enabled: true,
+			actions: body.actions
+		};
+		if (kind === "content") {
+			if (typeof body.pattern !== "string") throw errors.missingParam("Missing pattern");
+			rule.pattern = body.pattern;
+		}
+		if (kind === "override" || kind === "underride") rule.conditions = Array.isArray(body.conditions) ? body.conditions : [];
+		const list = (rules[kind] ??= []).filter((x) => x.rule_id !== ruleId);
+		const before = ctx.query.get("before");
+		const after = ctx.query.get("after");
+		let index = list.findIndex((x) => x.default && x.rule_id !== ".m.rule.master");
+		if (index === -1) index = list.length;
+		if (before) {
+			index = list.findIndex((x) => x.rule_id === before);
+			if (index === -1) throw errors.notFound("Unknown 'before' rule");
+		} else if (after) {
+			index = list.findIndex((x) => x.rule_id === after);
+			if (index === -1) throw errors.notFound("Unknown 'after' rule");
+			index++;
+		}
+		list.splice(index, 0, rule);
+		rules[kind] = list;
+		await saveRules(ctx.hs, s.userId, rules);
+		return {};
+	}));
+	for (const attr of ["enabled", "actions"]) {
+		r.client("GET", `/pushrules/:scope/:kind/:ruleId/${attr}`, async (ctx) => {
+			const { rules } = await ruleCtx(ctx);
+			return { [attr]: findRule(rules, ctx.params.kind, ctx.params.ruleId)[attr] };
+		});
+		r.client("PUT", `/pushrules/:scope/:kind/:ruleId/${attr}`, async (ctx) => withRulesLock(ctx.hs, (await ctx.auth()).userId, async () => {
+			const { s, rules } = await ruleCtx(ctx);
+			const rule = findRule(rules, ctx.params.kind, ctx.params.ruleId);
+			const body = await ctx.json();
+			if (attr === "enabled" && typeof body.enabled !== "boolean") throw errors.badJson("enabled must be a boolean");
+			if (attr === "actions" && !Array.isArray(body.actions)) throw errors.badJson("actions must be a list");
+			rule[attr] = body[attr];
+			await saveRules(ctx.hs, s.userId, rules);
+			return {};
+		}));
+	}
+	r.client("GET", "/pushers", async (ctx) => {
+		const s = await ctx.auth();
+		return { pushers: (await ctx.hs.db.findMany("pushers", { where: [{
+			field: "user_id",
+			value: s.userId
+		}] })).map((r) => r.pusher) };
+	});
+	r.client("POST", "/pushers/set", { input: pusherBody }, async (ctx) => {
+		const s = await ctx.auth();
+		const body = ctx.input;
+		if (body.kind === null) {
+			await ctx.hs.db.delete("pushers", [
+				{
+					field: "user_id",
+					value: s.userId
+				},
+				{
+					field: "app_id",
+					value: body.app_id
+				},
+				{
+					field: "pushkey",
+					value: body.pushkey
+				}
+			]);
+			return {};
+		}
+		for (const k of [
+			"kind",
+			"app_display_name",
+			"device_display_name",
+			"lang"
+		]) if (body[k] === void 0) throw errors.missingParam(`Missing ${k}`);
+		if (!body.data) throw errors.missingParam("Missing data");
+		if (body.kind === "http" && body.data.url === void 0) throw errors.invalidParam("data.url is required for http pushers");
+		if (!body.append) {
+			const others = await ctx.hs.db.findMany("pushers", { where: [{
+				field: "app_id",
+				value: body.app_id
+			}, {
+				field: "pushkey",
+				value: body.pushkey
+			}] });
+			for (const o of others) await ctx.hs.db.delete("pushers", [
+				{
+					field: "user_id",
+					value: o.user_id
+				},
+				{
+					field: "app_id",
+					value: o.app_id
+				},
+				{
+					field: "pushkey",
+					value: o.pushkey
+				}
+			]);
+		}
+		const { append, ...pusher } = body;
+		await ctx.hs.db.upsert("pushers", {
+			user_id: s.userId,
+			app_id: body.app_id,
+			pushkey: body.pushkey,
+			device_id: s.deviceId,
+			pusher
+		});
+		return {};
+	});
+	r.client("GET", "/notifications", async (ctx) => {
+		const s = await ctx.auth();
+		const from = ctx.query.get("from");
+		const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "20", 10) || 20, 1), 100);
+		const rows = await ctx.hs.push.list(s.userId, {
+			from: from ? Number.parseInt(from, 10) : null,
+			limit,
+			onlyHighlight: ctx.query.get("only") === "highlight"
+		});
+		const out = { notifications: rows.map(({ stream, ...n }) => n) };
+		if (rows.length === limit) out.next_token = String(rows[rows.length - 1].stream);
+		return out;
+	});
+}
+//#endregion
+export { registerPushRoutes };