matrix-nodejs-homeserver 0.0.0-stage → 0.3.1

package/dist/api/threadsubs.js

@@ -0,0 +1,140 @@
+import { isObject } from "../core/json.js";
+import { M } from "../core/m.js";
+import { MatrixError, errors } from "../core/errors.js";
+import { procedure } from "../http/procedure.js";
+//#region src/api/threadsubs.ts
+const VERSIONS = ["unstable/io.element.msc4306"];
+const notInThread = () => new MatrixError(400, "IO.ELEMENT.MSC4306.M_NOT_IN_THREAD", "Event is not in this thread");
+const conflicting = () => new MatrixError(409, "IO.ELEMENT.MSC4306.M_CONFLICTING_UNSUBSCRIPTION", "The thread was unsubscribed after this event");
+function key(userId, roomId, threadId) {
+	return [
+		{
+			field: "user_id",
+			value: userId
+		},
+		{
+			field: "room_id",
+			value: roomId
+		},
+		{
+			field: "thread_id",
+			value: threadId
+		}
+	];
+}
+/** Whether the user is subscribed to a thread: true, false (explicitly unsubscribed or never subscribed). */
+async function isSubscribed(hs, userId, roomId, threadId) {
+	return !!(await hs.db.findOne("thread_subscriptions", key(userId, roomId, threadId)))?.subscribed;
+}
+async function visibleEvent(ctx, userId, roomId, eventId) {
+	const ev = await ctx.hs.rooms.getEvent(eventId);
+	if (!ev || ev.pdu.room_id !== roomId) return null;
+	const [visible] = await ctx.hs.rooms.filterVisible(userId, roomId, [ev]);
+	return visible ?? null;
+}
+async function threadRoot(ctx, userId) {
+	const { roomId, threadId } = ctx.params;
+	const root = await visibleEvent(ctx, userId, roomId, threadId);
+	if (!root) throw errors.notFound("Unknown thread root");
+	return root;
+}
+function registerThreadSubscriptionRoutes(r) {
+	const path = "/rooms/:roomId/thread/:threadId/subscription";
+	r.client("GET", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await threadRoot(ctx, s.userId);
+			const row = await ctx.hs.db.findOne("thread_subscriptions", key(s.userId, ctx.params.roomId, ctx.params.threadId));
+			if (!row?.subscribed) throw errors.notFound("Not subscribed to this thread");
+			return { automatic: !!row.automatic };
+		}
+	}), VERSIONS);
+	r.client("PUT", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const { roomId, threadId } = ctx.params;
+			await threadRoot(ctx, s.userId);
+			const body = await ctx.json();
+			const cause = isObject(body) ? body.automatic : void 0;
+			if (cause !== void 0 && typeof cause !== "string") throw errors.badJson("automatic must be an event ID");
+			let causeStream = null;
+			if (typeof cause === "string") {
+				const ev = await visibleEvent(ctx, s.userId, roomId, cause);
+				const rel = ev?.pdu.content?.[M.RELATES_TO];
+				if (!ev || !isObject(rel) || rel.rel_type !== M.THREAD || rel.event_id !== threadId) throw notInThread();
+				causeStream = ev.stream;
+			}
+			await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
+				const row = await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId));
+				if (causeStream !== null) {
+					if (row && row.unsubscribed_after !== null && causeStream <= row.unsubscribed_after) throw conflicting();
+					if (row?.subscribed) return;
+				} else if (row?.subscribed && !row.automatic) return;
+				await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
+					user_id: s.userId,
+					room_id: roomId,
+					thread_id: threadId,
+					subscribed: true,
+					automatic: causeStream !== null,
+					unsubscribed_after: row?.unsubscribed_after ?? null,
+					stream
+				}));
+			});
+			hs.notifier.notify([s.userId]);
+			return {};
+		}
+	}), VERSIONS);
+	r.client("DELETE", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const { roomId, threadId } = ctx.params;
+			await threadRoot(ctx, s.userId);
+			await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
+				if (!(await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId)))?.subscribed) return;
+				const position = await hs.streams.position();
+				await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
+					user_id: s.userId,
+					room_id: roomId,
+					thread_id: threadId,
+					subscribed: false,
+					automatic: false,
+					unsubscribed_after: position,
+					stream
+				}));
+			});
+			hs.notifier.notify([s.userId]);
+			return {};
+		}
+	}), VERSIONS);
+}
+/** MSC4308 sliding sync extension: subscription changes in (since, to]. */
+async function threadSubscriptionsExtension(hs, userId, ext, since, to) {
+	const limit = Math.min(Math.max(Number(ext.limit ?? 100) || 100, 1), 1e3);
+	const where = [{
+		field: "user_id",
+		value: userId
+	}];
+	if (since !== null) where.push({
+		field: "stream",
+		operator: "gt",
+		value: since
+	});
+	const rows = (await hs.db.findMany("thread_subscriptions", { where })).filter((r) => r.stream <= to && (since !== null || r.subscribed)).sort((a, b) => b.stream - a.stream);
+	const out = {};
+	for (const row of rows.slice(0, limit)) {
+		const section = row.subscribed ? "subscribed" : "unsubscribed";
+		((out[section] ??= {})[row.room_id] ??= {})[row.thread_id] = row.subscribed ? {
+			automatic: !!row.automatic,
+			bump_stamp: row.stream
+		} : { bump_stamp: row.stream };
+	}
+	if (rows.length > limit) out.prev_batch = String(rows[limit - 1].stream);
+	return out;
+}
+//#endregion
+export { isSubscribed, registerThreadSubscriptionRoutes, threadSubscriptionsExtension };

package/dist/api/threepid.js

@@ -0,0 +1,155 @@
+import { M } from "../core/m.js";
+import { MatrixError, errors } from "../core/errors.js";
+import { canonicalAddress, isMedium } from "../core/threepid.js";
+import { enum as _enum, string } from "../vendor/zod/v4/classic/schemas.js";
+import { body, fail, lenient } from "../http/input.js";
+import { procedure } from "../http/procedure.js";
+import { requireUia } from "./uia.js";
+//#region src/api/threepid.ts
+const submitField = string(fail("M_MISSING_PARAM", "sid, client_secret and token are required"));
+const submitBody = body({
+	sid: submitField,
+	client_secret: submitField,
+	token: submitField
+});
+const bindField = (name) => string(fail("M_MISSING_PARAM", `Missing ${name}`));
+const bindBody = body({
+	client_secret: bindField("client_secret"),
+	id_access_token: bindField("id_access_token"),
+	id_server: bindField("id_server"),
+	sid: bindField("sid")
+});
+const threepidBody = body({
+	medium: _enum(["email", "msisdn"], fail("M_INVALID_PARAM", "Unsupported medium")),
+	address: string(fail("M_INVALID_PARAM", "Invalid address")),
+	id_server: string(fail("M_INVALID_PARAM", "id_server must be a string")).optional()
+});
+function notDelegated(ctx) {
+	if (ctx.hs.oauth) throw errors.unrecognized("Managed by the OAuth provider");
+}
+function registerThreepidRoutes(r) {
+	const requestToken = (purpose, medium) => async (ctx) => {
+		notDelegated(ctx);
+		await ctx.rateLimit(purpose === "register" ? "register" : "login");
+		return ctx.hs.threepids.requestToken(purpose, medium, ctx.input);
+	};
+	for (const medium of ["email", "msisdn"]) {
+		r.client("POST", `/register/${medium}/requestToken`, procedure({
+			input: body({}),
+			handler: requestToken("register", medium)
+		}));
+		r.client("POST", `/account/password/${medium}/requestToken`, procedure({
+			input: body({}),
+			handler: requestToken("password_reset", medium)
+		}));
+		r.client("POST", `/account/3pid/${medium}/requestToken`, procedure({
+			input: body({}),
+			handler: requestToken("add_threepid", medium)
+		}));
+	}
+	const submitPath = "/_matrix/client/unstable/threepid/submit_token";
+	r.get(submitPath, procedure({ handler: async (ctx) => {
+		const q = ctx.query;
+		let nextLink = null;
+		let message = "Your address has been validated. You can return to your Matrix client.";
+		let status = 200;
+		try {
+			nextLink = await ctx.hs.threepids.submitToken(q.get("sid") ?? "", q.get("client_secret") ?? "", q.get("token") ?? "");
+		} catch (err) {
+			message = err instanceof MatrixError ? `Validation failed: ${err.message}.` : "Validation failed.";
+			status = 400;
+		}
+		if (nextLink && status === 200) return Response.redirect(nextLink, 302);
+		return new Response(`<!doctype html><meta charset="utf-8"><title>${ctx.hs.serverName}</title><p>${message}</p>`, {
+			status,
+			headers: { "content-type": "text/html; charset=utf-8" }
+		});
+	} }));
+	r.post(submitPath, procedure({
+		input: submitBody,
+		handler: async (ctx) => {
+			const body = ctx.input;
+			await ctx.hs.threepids.submitToken(body.sid, body.client_secret, body.token);
+			return { success: true };
+		}
+	}));
+	r.client("GET", "/account/3pid", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return { threepids: await ctx.hs.threepids.list(s.userId) };
+		}
+	}));
+	r.client("POST", "/account/3pid/add", procedure({
+		input: body({
+			sid: lenient(string()),
+			client_secret: lenient(string())
+		}),
+		handler: async (ctx) => {
+			notDelegated(ctx);
+			const s = await ctx.auth();
+			const body = ctx.input;
+			await requireUia(ctx.hs, body, [[M.LOGIN.PASSWORD]], s.userId);
+			const validated = await ctx.hs.threepids.validated({
+				sid: body.sid,
+				client_secret: body.client_secret
+			});
+			if (!validated) throw new MatrixError(400, "M_THREEPID_AUTH_FAILED", "The address has not been validated");
+			await ctx.hs.threepids.add(s.userId, validated);
+			return {};
+		}
+	}));
+	r.client("POST", "/account/3pid/bind", procedure({
+		auth: "user",
+		input: bindBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			const res = await ctx.hs.identityServers.bind(body.id_server, body.id_access_token, body.sid, body.client_secret, s.userId);
+			if (res && isMedium(res.medium) && typeof res.address === "string") await ctx.hs.db.upsert("threepid_bindings", {
+				user_id: s.userId,
+				medium: res.medium,
+				address: res.address,
+				id_server: body.id_server
+			});
+			return {};
+		}
+	}));
+	const parseThreepid = (body) => {
+		const address = canonicalAddress(body.medium, body.address);
+		if (!address) throw errors.invalidParam("Invalid address");
+		return {
+			medium: body.medium,
+			address,
+			idServer: body.id_server
+		};
+	};
+	r.client("POST", "/account/3pid/delete", procedure({
+		input: threepidBody,
+		handler: async (ctx) => {
+			notDelegated(ctx);
+			const s = await ctx.auth();
+			const { medium, address, idServer } = parseThreepid(ctx.input);
+			const result = await ctx.hs.threepids.unbindAll(s.userId, medium, address, idServer);
+			await ctx.hs.threepids.remove(s.userId, medium, address);
+			return { id_server_unbind_result: result };
+		}
+	}));
+	r.client("POST", "/account/3pid/unbind", procedure({
+		auth: "user",
+		input: threepidBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const { medium, address, idServer } = parseThreepid(ctx.input);
+			return { id_server_unbind_result: await ctx.hs.threepids.unbindAll(s.userId, medium, address, idServer) };
+		}
+	}));
+	r.client("POST", "/account/3pid", procedure({
+		auth: "user",
+		handler: async () => {
+			throw errors.threepidDenied();
+		}
+	}));
+}
+//#endregion
+export { registerThreepidRoutes };

package/dist/api/uia.js

@@ -0,0 +1,127 @@
+import { isObject } from "../core/json.js";
+import { randomString } from "../core/crypto.js";
+import { M, UNSTABLE } from "../core/m.js";
+import { MatrixError, errors } from "../core/errors.js";
+//#region src/api/uia.ts
+const UIA_TTL_MS = 6e5;
+/**
+* User-interactive authentication. Resolves when one of `flows` has been
+* completed; otherwise throws the 401 response describing what is required.
+* `userId` binds password stages to an already-authenticated user.
+*/
+async function requireUia(hs, body, flows, userId) {
+	if (hs.oauth && flows.some((f) => f.includes(M.LOGIN.PASSWORD))) flows = [[M.OAUTH], [UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET]];
+	const auth = isObject(body.auth) ? body.auth : null;
+	let sessionId = typeof auth?.session === "string" ? auth.session : void 0;
+	const stored = sessionId ? await hs.cluster.get(`uia:${sessionId}`) : null;
+	const session = {
+		completed: new Set(stored?.completed ?? []),
+		userId: stored ? stored.userId : userId,
+		threepids: stored?.threepids ?? []
+	};
+	if (!stored) sessionId = randomString(24);
+	const save = () => hs.cluster.set(`uia:${sessionId}`, {
+		completed: [...session.completed],
+		userId: session.userId,
+		threepids: session.threepids
+	}, UIA_TTL_MS);
+	const oauthUrl = hs.oauth?.options.accountManagementUrl ?? hs.oauth?.options.issuer;
+	const params = hs.oauth ? {
+		[M.OAUTH]: { url: oauthUrl },
+		[UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET]: { url: oauthUrl }
+	} : {};
+	const challenge = (extra = {}) => new MatrixError(401, extra.errcode ? String(extra.errcode) : "M_FORBIDDEN", String(extra.error ?? "Authentication required"), {
+		flows: flows.map((stages) => ({ stages })),
+		params,
+		session: sessionId,
+		completed: [...session.completed],
+		...extra
+	});
+	if (auth?.type === M.LOGIN.DUMMY && !auth.session && typeof body.username === "string" && !userId) {
+		if (await hs.cluster.get(`uia-register:${body.username.toLowerCase()}`)) throw challenge({
+			errcode: "M_FORBIDDEN",
+			error: "Missing session"
+		});
+	}
+	if (auth?.type) switch (auth.type) {
+		case M.LOGIN.DUMMY:
+			session.completed.add(M.LOGIN.DUMMY);
+			break;
+		case M.OAUTH:
+		case UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET:
+			if (!hs.oauth) throw challenge({
+				errcode: "M_UNRECOGNIZED",
+				error: "OAuth is not enabled"
+			});
+			session.completed.add(auth.type);
+			break;
+		case M.LOGIN.REGISTRATION_TOKEN: {
+			const { registrationTokenValid } = await import("./account.js");
+			if (typeof auth.token !== "string" || !await registrationTokenValid(hs, auth.token)) throw challenge({
+				errcode: "M_FORBIDDEN",
+				error: "Invalid registration token"
+			});
+			session.completed.add(M.LOGIN.REGISTRATION_TOKEN);
+			break;
+		}
+		case M.LOGIN.PASSWORD: {
+			const identifier = isObject(auth.identifier) ? auth.identifier : {
+				type: M.ID.USER,
+				user: auth.user
+			};
+			const user = typeof identifier.user === "string" ? identifier.user : "";
+			const target = user.startsWith("@") ? user : `@${user.toLowerCase()}:${hs.serverName}`;
+			if (userId && target !== userId) throw errors.forbidden("Credentials do not match the authenticated user");
+			const row = await hs.db.findOne("users", [{
+				field: "user_id",
+				value: target
+			}]);
+			if (!(row && !row.deactivated && typeof auth.password === "string" && await hs.userAuth.checkPassword({
+				userId: target,
+				localpart: target.slice(1).split(":")[0],
+				password: auth.password,
+				storedHash: row.password_hash
+			}))) throw challenge({
+				errcode: "M_FORBIDDEN",
+				error: "Invalid password"
+			});
+			session.completed.add(M.LOGIN.PASSWORD);
+			break;
+		}
+		case M.LOGIN.EMAIL.IDENTITY:
+		case M.LOGIN.MSISDN: {
+			const validated = await hs.threepids.validated(auth.threepid_creds ?? auth.threepidCreds);
+			const medium = auth.type === M.LOGIN.EMAIL.IDENTITY ? "email" : "msisdn";
+			if (!validated || validated.medium !== medium) throw challenge({
+				errcode: "M_UNAUTHORIZED",
+				error: "The address has not been validated"
+			});
+			if (session.userId && await hs.threepids.userFor(validated.medium, validated.address) !== session.userId) throw challenge({
+				errcode: "M_FORBIDDEN",
+				error: "This address does not belong to your account"
+			});
+			session.threepids = [...session.threepids.filter((t) => t.medium !== medium), validated];
+			session.completed.add(auth.type);
+			break;
+		}
+		default: throw challenge({
+			errcode: "M_UNRECOGNIZED",
+			error: `Unsupported auth type ${auth.type}`
+		});
+	}
+	if (!flows.some((stages) => stages.every((s) => session.completed.has(s)))) {
+		await save();
+		if (!userId && typeof body.username === "string") await hs.cluster.set(`uia-register:${body.username.toLowerCase()}`, sessionId, UIA_TTL_MS);
+		if (auth?.type) throw challenge();
+		const e = challenge();
+		throw new MatrixError(401, "M_FORBIDDEN", "", {
+			...e.extra,
+			errcode: void 0,
+			error: void 0
+		});
+	}
+	await hs.cluster.delete(`uia:${sessionId}`);
+	return { threepids: session.threepids };
+}
+//#endregion
+export { requireUia };