matrix-nodejs-homeserver 0.0.0-stage → 0.3.1

package/dist/core/admin.js

@@ -0,0 +1,308 @@
+import { randomString } from "./crypto.js";
+import { M } from "./m.js";
+import { errors } from "./errors.js";
+import { LOCALPART_RE, isValidUserId } from "./ids.js";
+import { createUser } from "../api/account.js";
+//#region src/core/admin.ts
+/** Programmatic administration, for embedding applications and the admin HTTP API. */
+var AdminService = class {
+	hs;
+	constructor(hs) {
+		this.hs = hs;
+	}
+	async createUser(localpart, opts = {}) {
+		const lp = localpart.toLowerCase();
+		if (!LOCALPART_RE.test(lp)) throw errors.invalidUsername();
+		if (await this.getUser(`@${lp}:${this.hs.serverName}`)) throw errors.userInUse();
+		return createUser(this.hs, lp, opts);
+	}
+	async getUser(userId) {
+		const row = await this.hs.db.findOne("users", [{
+			field: "user_id",
+			value: userId
+		}]);
+		if (!row) return null;
+		const { password_hash, ...rest } = row;
+		return rest;
+	}
+	async listUsers(opts = {}) {
+		let rows = await this.hs.db.findMany("users", { sortBy: {
+			field: "created_ts",
+			direction: "asc"
+		} });
+		if (!opts.includeDeactivated) rows = rows.filter((r) => !r.deactivated);
+		if (opts.search) {
+			const term = opts.search.toLowerCase();
+			rows = rows.filter((r) => r.user_id.toLowerCase().includes(term) || (r.displayname ?? "").toLowerCase().includes(term));
+		}
+		const from = opts.from ?? 0;
+		const limit = opts.limit ?? 100;
+		return {
+			users: rows.slice(from, from + limit).map(({ password_hash, ...u }) => u),
+			total: rows.length,
+			next: from + limit < rows.length ? from + limit : null
+		};
+	}
+	async setAdmin(userId, admin) {
+		if (!await this.hs.db.update("users", [{
+			field: "user_id",
+			value: userId
+		}], { is_admin: admin })) throw errors.notFound("Unknown user");
+		await this.hs.auth.invalidateUser(userId);
+		if (admin) await this.hs.adminRoom?.addAdmin(userId);
+		else await this.hs.adminRoom?.removeAdmin(userId);
+	}
+	/** Lock or unlock an account (reversible; sessions are kept but unusable while locked). */
+	async setLocked(userId, locked, actor = "server") {
+		if (!await this.hs.db.update("users", [{
+			field: "user_id",
+			value: userId
+		}], { locked })) throw errors.notFound("Unknown user");
+		await this.hs.auth.invalidateUser(userId);
+		await this.hs.audit.record({
+			action: locked ? "user_lock" : "user_unlock",
+			actor,
+			target: userId
+		});
+	}
+	/** Suspend or unsuspend an account (reversible; the user can still read, leave and log out). */
+	async setSuspended(userId, suspended, actor = "server") {
+		if (!await this.hs.db.update("users", [{
+			field: "user_id",
+			value: userId
+		}], { suspended })) throw errors.notFound("Unknown user");
+		await this.hs.auth.invalidateUser(userId);
+		await this.hs.audit.record({
+			action: suspended ? "user_suspend" : "user_unsuspend",
+			actor,
+			target: userId
+		});
+	}
+	async resetPassword(userId, password, logoutDevices = true) {
+		const hash = await this.hs.userAuth.hashPassword(password);
+		if (!await this.hs.db.update("users", [{
+			field: "user_id",
+			value: userId
+		}], { password_hash: hash })) throw errors.notFound("Unknown user");
+		if (logoutDevices) await this.hs.auth.deleteAllDevices(userId);
+	}
+	/** Deactivate an account: leave all rooms, log out everywhere and (optionally) erase the profile. */
+	async deactivateUser(userId, opts = {}) {
+		if (!await this.hs.db.findOne("users", [{
+			field: "user_id",
+			value: userId
+		}])) throw errors.notFound("Unknown user");
+		for (const membership of [
+			"join",
+			"invite",
+			"knock"
+		]) for (const roomId of await this.hs.rooms.roomsForUser(userId, membership)) try {
+			await this.hs.rooms.setMembership(roomId, userId, userId, "leave");
+		} catch {}
+		await this.hs.auth.deleteAllDevices(userId);
+		await this.hs.threepids.removeAll(userId);
+		await this.hs.db.delete("pushers", [{
+			field: "user_id",
+			value: userId
+		}]);
+		const update = {
+			deactivated: true,
+			password_hash: null
+		};
+		if (opts.erase !== false) Object.assign(update, {
+			displayname: null,
+			avatar_url: null
+		});
+		await this.hs.db.update("users", [{
+			field: "user_id",
+			value: userId
+		}], update);
+		await this.hs.auth.invalidateUser(userId);
+	}
+	async createRegistrationToken(opts = {}) {
+		const token = opts.token ?? randomString(opts.length ?? 16);
+		if (!/^[A-Za-z0-9._~-]{1,64}$/.test(token)) throw errors.invalidParam("Invalid token");
+		if (await this.hs.db.findOne("registration_tokens", [{
+			field: "token",
+			value: token
+		}])) throw errors.invalidParam("Token already exists");
+		const row = {
+			token,
+			uses_allowed: opts.usesAllowed ?? null,
+			pending: 0,
+			completed: 0,
+			expiry_time: opts.expiryTime ?? null
+		};
+		await this.hs.db.create("registration_tokens", row);
+		return row;
+	}
+	listRegistrationTokens() {
+		return this.hs.db.findMany("registration_tokens");
+	}
+	async deleteRegistrationToken(token) {
+		if (!await this.hs.db.delete("registration_tokens", [{
+			field: "token",
+			value: token
+		}])) throw errors.notFound("Unknown token");
+	}
+	async listRooms(opts = {}) {
+		const rows = await this.hs.db.findMany("rooms", { sortBy: {
+			field: "created_ts",
+			direction: "asc"
+		} });
+		const from = opts.from ?? 0;
+		const page = rows.slice(from, from + (opts.limit ?? 100));
+		return {
+			rooms: await Promise.all(page.map(async (r) => ({
+				...r,
+				joined_members: (await this.hs.rooms.joinedMembers(r.room_id)).length
+			}))),
+			total: rows.length
+		};
+	}
+	/** Remove everyone from a room, delist it and drop its aliases. With `purge`, also delete its history. */
+	async deleteRoom(roomId, opts = {}) {
+		if (!await this.hs.rooms.exists(roomId)) throw errors.notFound("Unknown room");
+		const kicked = [];
+		for (const membership of [
+			"join",
+			"invite",
+			"knock"
+		]) for (const row of await this.hs.db.findMany("memberships", { where: [{
+			field: "room_id",
+			value: roomId
+		}, {
+			field: "membership",
+			value: membership
+		}] })) {
+			if (!this.hs.isLocalUser(row.user_id)) continue;
+			try {
+				await this.hs.rooms.setMembership(roomId, row.user_id, row.user_id, "leave", opts.reason);
+				kicked.push(row.user_id);
+			} catch (err) {
+				this.hs.logger.warn("Could not remove", row.user_id, "from", roomId, err);
+			}
+		}
+		await this.hs.db.update("rooms", [{
+			field: "room_id",
+			value: roomId
+		}], { is_public: false });
+		await this.hs.db.delete("room_aliases", [{
+			field: "room_id",
+			value: roomId
+		}]);
+		if (opts.purge) {
+			const where = [{
+				field: "room_id",
+				value: roomId
+			}];
+			await this.hs.transaction(async (db) => {
+				for (const table of [
+					"events",
+					"state_snapshots",
+					"current_state",
+					"memberships",
+					"receipts",
+					"relations",
+					"notifications",
+					"rooms"
+				]) await db.delete(table, where);
+			});
+			this.hs.rooms.forgetRoom(roomId);
+		}
+		return { kicked };
+	}
+	async deleteMedia(mediaId) {
+		await this.hs.media.delete?.(mediaId);
+		await this.hs.db.delete("media", [{
+			field: "media_id",
+			value: mediaId
+		}]);
+	}
+	/** Delete local media uploaded before `beforeTs`. Returns the deleted media IDs. */
+	async purgeMediaBefore(beforeTs) {
+		const rows = await this.hs.db.findMany("media", { where: [{
+			field: "created_ts",
+			operator: "lt",
+			value: beforeTs
+		}] });
+		for (const r of rows) await this.deleteMedia(r.media_id);
+		return rows.map((r) => r.media_id);
+	}
+	get noticeUserId() {
+		return `@${this.hs.config.serverNotices.localpart}:${this.hs.serverName}`;
+	}
+	/** Whether `roomId` is a server notices room (members may not reject or leave its invites). */
+	async isNoticeRoom(roomId) {
+		return (await this.hs.db.findOne("rooms", [{
+			field: "room_id",
+			value: roomId
+		}]))?.creator === this.noticeUserId;
+	}
+	/** Send a message to a user in their server notices room, creating or re-inviting as needed. */
+	async sendServerNotice(userId, content, opts = {}) {
+		if (!isValidUserId(userId) || !this.hs.isLocalUser(userId)) throw errors.invalidParam("Server notices can only be sent to local users");
+		if (!await this.hs.db.findOne("users", [{
+			field: "user_id",
+			value: userId
+		}])) throw errors.notFound("Unknown user");
+		const txnKey = opts.txnId ? `notice-txn:${userId}|${opts.txnId}` : null;
+		if (txnKey) {
+			const existing = await this.hs.cluster.get(txnKey);
+			if (existing) return existing;
+		}
+		const noticeUser = this.noticeUserId;
+		if (!await this.hs.db.findOne("users", [{
+			field: "user_id",
+			value: noticeUser
+		}])) await createUser(this.hs, noticeUser.slice(1).split(":")[0], { displayname: this.hs.config.serverNotices.displayName });
+		const roomId = await this.noticeRoomFor(userId);
+		const membership = await this.hs.rooms.membership(roomId, userId);
+		if (membership !== "join" && membership !== "invite") await this.hs.rooms.invite(roomId, noticeUser, userId);
+		const eventId = await this.hs.rooms.sendEvent(roomId, noticeUser, {
+			type: opts.type ?? M.ROOM.MESSAGE,
+			content
+		});
+		if (txnKey) await this.hs.cluster.set(txnKey, eventId, 864e5);
+		return eventId;
+	}
+	async noticeRoomFor(userId) {
+		const noticeUser = this.noticeUserId;
+		const rooms = await this.hs.db.findMany("rooms", { where: [{
+			field: "creator",
+			value: noticeUser
+		}] });
+		for (const room of rooms) if ((await this.hs.db.findOne("account_data", [
+			{
+				field: "user_id",
+				value: userId
+			},
+			{
+				field: "room_id",
+				value: room.room_id
+			},
+			{
+				field: "type",
+				value: M.TAG
+			}
+		]))?.content?.tags?.[M.SERVER_NOTICE]) return room.room_id;
+		const { room_id } = await this.hs.rooms.createRoom(noticeUser, {
+			preset: "private_chat",
+			name: this.hs.config.serverNotices.roomName,
+			power_level_content_override: {
+				users: { [noticeUser]: 100 },
+				events_default: 100
+			}
+		});
+		await this.hs.streams.write((stream) => this.hs.db.upsert("account_data", {
+			user_id: userId,
+			room_id,
+			type: M.TAG,
+			content: { tags: { [M.SERVER_NOTICE]: { order: .5 } } },
+			stream
+		}));
+		return room_id;
+	}
+};
+//#endregion
+export { AdminService };

package/dist/core/adminroom.d.ts

@@ -0,0 +1,49 @@
+import { PDU } from "./events.js";
+import { Homeserver } from "../homeserver.js";
+//#region src/core/adminroom.d.ts
+export interface AdminRoomOptions {
+  /** Enable the admin room and admin bot. Default: true when the option object is given. */
+  enabled?: boolean;
+  /** The first account registered on the server becomes a server admin. Default: true. */
+  firstUserIsAdmin?: boolean;
+  /** Let the very first account register even when registration is closed. Default: true. */
+  firstUserCanRegister?: boolean;
+  /** Localpart of the admin bot. Default: "admin". */
+  botLocalpart?: string;
+  botDisplayName?: string;
+  roomName?: string;
+  /** Localpart of the admin room alias (#admins:server). Default: "admins". */
+  aliasLocalpart?: string;
+}
+/**
+ * A tuwunel-style admin room: server admins chat with an admin bot to manage the
+ * server. The first registered account becomes an admin and is put in the room.
+ */
+export declare class AdminRoomService {
+  private hs;
+  readonly options: Required<AdminRoomOptions>;
+  private roomIdCache;
+  constructor(hs: Homeserver, options: AdminRoomOptions);
+  get botUserId(): string;
+  get alias(): string;
+  /** Whether no real (non-bot) account exists yet. */
+  noUsersYet(): Promise<boolean>;
+  roomId(): Promise<string | null>;
+  /** Create the admin bot and room if needed. */
+  ensureRoom(): Promise<string>;
+  /** Called after an account was created. */
+  onUserCreated(userId: string): Promise<void>;
+  /** Put an admin into the admin room. */
+  addAdmin(userId: string): Promise<void>;
+  /** Remove a former admin from the admin room. */
+  removeAdmin(userId: string): Promise<void>;
+  /** Post a message from the admin bot. */
+  say(text: string, replyTo?: string): Promise<void>;
+  /** Called for every new event; handles commands posted in the admin room. */
+  onEvent(event: PDU): Promise<void>;
+  private resolveUser;
+  private resolveRoom;
+  /** Run one admin command; returns the reply text. */
+  execute(actor: string, args: string[]): Promise<string>;
+}
+//#endregion