matrix-nodejs-homeserver 0.0.0-stage → 0.3.1

package/dist/api/preview.js

@@ -0,0 +1,201 @@
+import { randomString } from "../core/crypto.js";
+import { errors } from "../core/errors.js";
+import { procedure } from "../http/procedure.js";
+import { lookup } from "node:dns/promises";
+import { BlockList, isIP } from "node:net";
+//#region src/api/preview.ts
+const MAX_BYTES = 1048576;
+const privateRanges = new BlockList();
+for (const [net, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) privateRanges.addSubnet(net, prefix, "ipv4");
+for (const [net, prefix] of [
+	["::", 128],
+	["::1", 128],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8],
+	["::ffff:0:0", 96]
+]) privateRanges.addSubnet(net, prefix, "ipv6");
+async function assertPublicHost(hostname) {
+	const host = hostname.replace(/^\[|\]$/g, "");
+	const addresses = isIP(host) ? [{
+		address: host,
+		family: isIP(host)
+	}] : await lookup(host, { all: true });
+	for (const { address, family } of addresses) if (privateRanges.check(address, family === 6 ? "ipv6" : "ipv4")) throw errors.forbidden("URL resolves to a private address");
+}
+function decodeEntities(s) {
+	return s.replace(/&(amp|lt|gt|quot|#39|#x27);/g, (m) => ({
+		"&": "&",
+		"&lt;": "<",
+		"&gt;": ">",
+		"&quot;": "\"",
+		"&#39;": "'",
+		"&#x27;": "'"
+	})[m] ?? m);
+}
+function parseOpenGraph(html) {
+	const og = {};
+	for (const tag of html.match(/<meta\s[^>]*>/gi) ?? []) {
+		const attr = (name) => new RegExp(`${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)')`, "i").exec(tag);
+		const key = attr("property") ?? attr("name");
+		const content = attr("content");
+		if (!key || !content) continue;
+		const k = (key[1] ?? key[2]).toLowerCase();
+		if (k.startsWith("og:") && !(k in og)) og[k] = decodeEntities(content[1] ?? content[2]);
+		if (k === "description" && !og["og:description"]) og["og:description"] = decodeEntities(content[1] ?? content[2]);
+	}
+	if (!og["og:title"]) {
+		const title = /<title[^>]*>([^<]*)<\/title>/i.exec(html);
+		if (title) og["og:title"] = decodeEntities(title[1].trim());
+	}
+	return og;
+}
+async function preview(hs, rawUrl) {
+	const opts = hs.config.urlPreviews;
+	if (!opts) throw errors.notFound("URL previews are disabled");
+	let url;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		throw errors.invalidParam("Invalid URL");
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw errors.invalidParam("Only http(s) URLs can be previewed");
+	for (let redirects = 0; redirects < 5; redirects++) {
+		if (!opts.allowPrivateAddresses) await assertPublicHost(url.hostname);
+		const res = await fetch(url, {
+			redirect: "manual",
+			signal: AbortSignal.timeout(1e4),
+			headers: { "user-agent": "matrix-nodejs-homeserver" }
+		});
+		if (res.status >= 300 && res.status < 400 && res.headers.get("location")) {
+			url = new URL(res.headers.get("location"), url);
+			continue;
+		}
+		if (!res.ok || !res.body) throw errors.notFound("Could not fetch URL");
+		const type = res.headers.get("content-type") ?? "";
+		if (type.startsWith("image/")) return {
+			...await storeImage(hs, res, type),
+			"og:url": url.href
+		};
+		if (!type.includes("html")) return {};
+		let size = 0;
+		const chunks = [];
+		for await (const chunk of res.body) {
+			size += chunk.length;
+			if (size > MAX_BYTES) break;
+			chunks.push(chunk);
+		}
+		const og = parseOpenGraph(Buffer.concat(chunks).toString("utf8"));
+		if (og["og:image"]) try {
+			const imageUrl = new URL(og["og:image"], url);
+			if (!opts.allowPrivateAddresses) await assertPublicHost(imageUrl.hostname);
+			const img = await fetch(imageUrl, { signal: AbortSignal.timeout(1e4) });
+			const imgType = img.headers.get("content-type") ?? "";
+			if (img.ok && imgType.startsWith("image/")) Object.assign(og, await storeImage(hs, img, imgType));
+		} catch {}
+		return og;
+	}
+	throw errors.notFound("Too many redirects");
+}
+/** Read width/height from PNG, GIF, JPEG or WebP headers. */
+function imageSize(data) {
+	const b = Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+	if (b.length >= 24 && b.readUInt32BE(0) === 2303741511) return {
+		width: b.readUInt32BE(16),
+		height: b.readUInt32BE(20)
+	};
+	if (b.length >= 10 && b.toString("ascii", 0, 3) === "GIF") return {
+		width: b.readUInt16LE(6),
+		height: b.readUInt16LE(8)
+	};
+	if (b.length >= 30 && b.toString("ascii", 0, 4) === "RIFF" && b.toString("ascii", 8, 12) === "WEBP") {
+		const chunk = b.toString("ascii", 12, 16);
+		if (chunk === "VP8 ") return {
+			width: b.readUInt16LE(26) & 16383,
+			height: b.readUInt16LE(28) & 16383
+		};
+		if (chunk === "VP8L") {
+			const bits = b.readUInt32LE(21);
+			return {
+				width: (bits & 16383) + 1,
+				height: (bits >> 14 & 16383) + 1
+			};
+		}
+		if (chunk === "VP8X") return {
+			width: b.readUIntLE(24, 3) + 1,
+			height: b.readUIntLE(27, 3) + 1
+		};
+	}
+	if (b.length >= 4 && b[0] === 255 && b[1] === 216) {
+		let i = 2;
+		while (i + 9 < b.length) {
+			if (b[i] !== 255) {
+				i++;
+				continue;
+			}
+			const marker = b[i + 1];
+			const len = b.readUInt16BE(i + 2);
+			if (marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204) return {
+				height: b.readUInt16BE(i + 5),
+				width: b.readUInt16BE(i + 7)
+			};
+			i += 2 + len;
+		}
+	}
+	return null;
+}
+/** Store a fetched image in the media repository and describe it for a preview. */
+async function storeImage(hs, res, type) {
+	const data = new Uint8Array(await res.arrayBuffer());
+	if (data.length > MAX_BYTES * 10) return {};
+	const mediaId = randomString(24);
+	await hs.media.put(mediaId, data, {
+		contentType: type,
+		filename: null,
+		size: data.length
+	});
+	await hs.db.create("media", {
+		media_id: mediaId,
+		content_type: type,
+		filename: null,
+		size: data.length,
+		uploader: "",
+		created_ts: Date.now(),
+		pending: false
+	});
+	const size = imageSize(data);
+	return {
+		"og:image": `mxc://${hs.serverName}/${mediaId}`,
+		"og:image:type": type,
+		"matrix:image:size": data.length,
+		...size ? {
+			"og:image:width": size.width,
+			"og:image:height": size.height
+		} : {}
+	};
+}
+function registerPreviewRoutes(r) {
+	const handler = async (ctx) => {
+		await ctx.auth();
+		const url = ctx.query.get("url");
+		if (!url) throw errors.missingParam("Missing url");
+		return preview(ctx.hs, url);
+	};
+	r.get("/_matrix/media/v3/preview_url", procedure({ handler }));
+	r.get("/_matrix/media/r0/preview_url", procedure({ handler }));
+	r.get("/_matrix/client/v1/media/preview_url", procedure({ handler }));
+}
+//#endregion
+export { imageSize, parseOpenGraph, registerPreviewRoutes };

package/dist/api/profile.js

@@ -0,0 +1,176 @@
+import { isObject } from "../core/json.js";
+import { M } from "../core/m.js";
+import { MatrixError, errors } from "../core/errors.js";
+import { isValidUserId } from "../core/ids.js";
+import { getState } from "../core/authrules.js";
+import { assertNotSuspended } from "../core/auth.js";
+import { number, string } from "../vendor/zod/v4/classic/schemas.js";
+import { body, fail, lenient } from "../http/input.js";
+import { procedure } from "../http/procedure.js";
+import { BUILTIN_FIELDS, fullProfile, profileSize, setProfileField } from "../core/profile.js";
+//#region src/api/profile.ts
+async function remoteProfile(ctx, field) {
+	if (!isValidUserId(ctx.params.userId)) throw errors.invalidParam("Invalid user ID");
+	try {
+		const res = await ctx.hs.federation.queryProfile(ctx.params.userId, field);
+		return isObject(res) ? res : {};
+	} catch (err) {
+		if (err instanceof MatrixError && err.status === 404) throw errors.notFound("Profile not found");
+		throw err;
+	}
+}
+async function localProfile(ctx) {
+	const profile = await fullProfile(ctx.hs, ctx.params.userId);
+	if (!profile) throw errors.notFound("Profile not found");
+	return profile;
+}
+function checkField(field) {
+	if (!field || Buffer.byteLength(field) > 255) throw new MatrixError(400, "M_KEY_TOO_LARGE", "Profile key too long");
+}
+function registerProfileRoutes(r) {
+	r.client("GET", "/profile/:userId", procedure({ handler: async (ctx) => {
+		if (!ctx.hs.isLocalUser(ctx.params.userId)) return remoteProfile(ctx);
+		return localProfile(ctx);
+	} }));
+	r.client("GET", "/profile/:userId/:field", procedure({ handler: async (ctx) => {
+		const field = ctx.params.field;
+		checkField(field);
+		const profile = ctx.hs.isLocalUser(ctx.params.userId) ? await localProfile(ctx) : await remoteProfile(ctx, field);
+		if (profile[field] === void 0 || profile[field] === null) throw errors.notFound("Profile field not set");
+		return { [field]: profile[field] };
+	} }));
+	async function owner(ctx) {
+		const s = await ctx.auth();
+		if (!isValidUserId(ctx.params.userId) || ctx.params.userId !== s.userId) throw errors.forbidden("Cannot change another user's profile");
+		checkField(ctx.params.field);
+		await assertNotSuspended(ctx.hs, s);
+		return s;
+	}
+	r.client("PUT", "/profile/:userId/:field", procedure({ handler: async (ctx) => {
+		const s = await owner(ctx);
+		const field = ctx.params.field;
+		const body = await ctx.json();
+		if (!isObject(body) || !(field in body)) throw errors.badJson(`Body must contain ${field}`);
+		if (Object.keys(body).length !== 1) throw errors.badJson("Body must contain only the profile field");
+		const value = body[field];
+		if (BUILTIN_FIELDS.has(field)) {
+			if (value !== null && typeof value !== "string") throw errors.badJson(`${field} must be a string`);
+			if (typeof value === "string" && value.length > 1024) throw errors.tooLarge(`${field} too long`);
+		}
+		const profile = await fullProfile(ctx.hs, s.userId) ?? {};
+		profile[field] = value;
+		if (profileSize(profile) > 65536) throw new MatrixError(400, "M_PROFILE_TOO_LARGE", "Profile too large");
+		await setProfileField(ctx.hs, s.userId, field, value);
+		return {};
+	} }));
+	r.client("DELETE", "/profile/:userId/:field", procedure({ handler: async (ctx) => {
+		const s = await owner(ctx);
+		await setProfileField(ctx.hs, s.userId, ctx.params.field, null);
+		return {};
+	} }));
+	const directoryBody = body({
+		search_term: string(fail("M_MISSING_PARAM", "Missing search_term")),
+		limit: lenient(number().int())
+	});
+	r.client("POST", "/user_directory/search", procedure({
+		auth: "user",
+		input: directoryBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			const term = body.search_term.toLowerCase();
+			const limit = body.limit !== void 0 ? Math.min(body.limit, 50) : 10;
+			const visible = await ctx.hs.rooms.usersSharingRooms(s.userId);
+			visible.delete(s.userId);
+			for (const room of await ctx.hs.db.findMany("rooms", {})) {
+				const state = await ctx.hs.rooms.currentState(room.room_id);
+				if (room.is_public || getState(state, M.ROOM.JOIN_RULES)?.content?.join_rule === "public" || getState(state, M.ROOM.HISTORY_VISIBILITY)?.content?.history_visibility === "world_readable") for (const u of await ctx.hs.rooms.joinedMembers(room.room_id)) visible.add(u);
+			}
+			const candidates = (await ctx.hs.db.findMany("users", { where: [{
+				field: "user_id",
+				operator: "in",
+				value: [...visible].filter((u) => ctx.hs.isLocalUser(u))
+			}] })).filter((u) => !u.deactivated).map((u) => ({
+				user_id: u.user_id,
+				displayname: u.displayname,
+				avatar_url: u.avatar_url
+			}));
+			for (const userId of visible) {
+				if (ctx.hs.isLocalUser(userId)) continue;
+				const row = (await ctx.hs.db.findMany("memberships", {
+					where: [{
+						field: "user_id",
+						value: userId
+					}, {
+						field: "membership",
+						value: "join"
+					}],
+					limit: 1
+				}))[0];
+				const member = row ? await ctx.hs.rooms.getPdu(row.event_id) : null;
+				candidates.push({
+					user_id: userId,
+					displayname: member?.content?.displayname,
+					avatar_url: member?.content?.avatar_url
+				});
+			}
+			const results = candidates.filter((u) => u.user_id.toLowerCase().includes(term) || typeof u.displayname === "string" && u.displayname.toLowerCase().includes(term)).map((u) => ({
+				user_id: u.user_id,
+				display_name: u.displayname ?? void 0,
+				avatar_url: u.avatar_url ?? void 0
+			}));
+			return {
+				results: results.slice(0, limit),
+				limited: results.length > limit
+			};
+		}
+	}));
+	r.client("GET", "/presence/:userId/status", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const row = await ctx.hs.db.findOne("presence", [{
+				field: "user_id",
+				value: ctx.params.userId
+			}]);
+			if (!row) {
+				if (!await ctx.hs.db.findOne("users", [{
+					field: "user_id",
+					value: ctx.params.userId
+				}])) throw errors.notFound("Unknown user");
+				return { presence: "offline" };
+			}
+			const out = {
+				presence: row.presence,
+				last_active_ago: Date.now() - row.last_active_ts
+			};
+			if (row.status_msg) out.status_msg = row.status_msg;
+			if (row.presence === "online") out.currently_active = true;
+			return out;
+		}
+	}));
+	r.client("PUT", "/presence/:userId/status", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot set another user's presence");
+			const body = await ctx.json();
+			if (![
+				"online",
+				"offline",
+				"unavailable"
+			].includes(body.presence)) throw errors.invalidParam("Invalid presence");
+			await ctx.hs.streams.write((stream) => ctx.hs.db.upsert("presence", {
+				user_id: s.userId,
+				presence: body.presence,
+				status_msg: typeof body.status_msg === "string" ? body.status_msg : null,
+				last_active_ts: Date.now(),
+				stream
+			}));
+			await ctx.hs.federation.onPresence(s.userId, body.presence, typeof body.status_msg === "string" ? body.status_msg : null).catch(() => {});
+			ctx.hs.notifier.notify(await ctx.hs.rooms.usersSharingRooms(s.userId));
+			return {};
+		}
+	}));
+}
+//#endregion
+export { registerProfileRoutes };

package/dist/api/push.js

@@ -0,0 +1,202 @@
+import { M } from "../core/m.js";
+import { errors } from "../core/errors.js";
+import { KINDS, loadRules, saveRules, withRulesLock } from "../core/pushrules.js";
+import { looseObject, string, unknown } from "../vendor/zod/v4/classic/schemas.js";
+import { body, fail, lenient } from "../http/input.js";
+import { procedure } from "../http/procedure.js";
+//#region src/api/push.ts
+const pusherKey = string(fail("M_MISSING_PARAM", "Missing app_id or pushkey"));
+const pusherBody = body({
+	app_id: pusherKey,
+	pushkey: pusherKey,
+	kind: lenient(string().nullable()),
+	app_display_name: lenient(string()),
+	device_display_name: lenient(string()),
+	lang: lenient(string()),
+	data: lenient(looseObject({ url: lenient(string()) })),
+	append: unknown().optional()
+});
+function findRule(rules, kind, ruleId) {
+	if (!KINDS.includes(kind)) throw errors.invalidParam("Unknown rule kind");
+	const rule = rules[kind]?.find((r) => r.rule_id === ruleId);
+	if (!rule) throw errors.notFound("Unknown push rule");
+	return rule;
+}
+async function ruleCtx(ctx) {
+	const s = await ctx.auth();
+	if (ctx.params.scope !== "global") throw errors.invalidParam("Unknown scope");
+	return {
+		s,
+		rules: await loadRules(ctx.hs, s.userId)
+	};
+}
+function registerPushRoutes(r) {
+	r.client("GET", "/pushrules", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return { global: await loadRules(ctx.hs, s.userId) };
+		}
+	}));
+	r.client("GET", "/pushrules/:scope", procedure({ handler: async (ctx) => {
+		const { rules } = await ruleCtx(ctx);
+		return rules;
+	} }));
+	r.client("GET", "/pushrules/:scope/:kind/:ruleId", procedure({ handler: async (ctx) => {
+		const { rules } = await ruleCtx(ctx);
+		return findRule(rules, ctx.params.kind, ctx.params.ruleId);
+	} }));
+	r.client("DELETE", "/pushrules/:scope/:kind/:ruleId", procedure({ handler: async (ctx) => withRulesLock(ctx.hs, (await ctx.auth()).userId, async () => {
+		const { s, rules } = await ruleCtx(ctx);
+		const rule = findRule(rules, ctx.params.kind, ctx.params.ruleId);
+		if (rule.default) throw errors.forbidden("Cannot delete a default rule");
+		rules[ctx.params.kind] = rules[ctx.params.kind].filter((x) => x !== rule);
+		await saveRules(ctx.hs, s.userId, rules);
+		return {};
+	}) }));
+	r.client("PUT", "/pushrules/:scope/:kind/:ruleId", procedure({ handler: async (ctx) => withRulesLock(ctx.hs, (await ctx.auth()).userId, async () => {
+		const { s, rules } = await ruleCtx(ctx);
+		const { kind, ruleId } = ctx.params;
+		if (!KINDS.includes(kind)) throw errors.invalidParam("Unknown rule kind");
+		if (ruleId.startsWith(".")) throw errors.invalidParam("Rule IDs starting with '.' are reserved");
+		const body = await ctx.json();
+		if (!Array.isArray(body.actions)) throw errors.badJson("actions must be a list");
+		const rule = {
+			rule_id: ruleId,
+			default: false,
+			enabled: true,
+			actions: body.actions
+		};
+		if (kind === "content") {
+			if (typeof body.pattern !== "string") throw errors.missingParam("Missing pattern");
+			rule.pattern = body.pattern;
+		}
+		if (kind === "override" || kind === "underride") rule.conditions = Array.isArray(body.conditions) ? body.conditions : [];
+		const list = (rules[kind] ??= []).filter((x) => x.rule_id !== ruleId);
+		const before = ctx.query.get("before");
+		const after = ctx.query.get("after");
+		let index = list.findIndex((x) => x.default && x.rule_id !== M.RULE.MASTER);
+		if (index === -1) index = list.length;
+		if (before) {
+			index = list.findIndex((x) => x.rule_id === before);
+			if (index === -1) throw errors.notFound("Unknown 'before' rule");
+		} else if (after) {
+			index = list.findIndex((x) => x.rule_id === after);
+			if (index === -1) throw errors.notFound("Unknown 'after' rule");
+			index++;
+		}
+		list.splice(index, 0, rule);
+		rules[kind] = list;
+		await saveRules(ctx.hs, s.userId, rules);
+		return {};
+	}) }));
+	for (const attr of ["enabled", "actions"]) {
+		r.client("GET", `/pushrules/:scope/:kind/:ruleId/${attr}`, procedure({ handler: async (ctx) => {
+			const { rules } = await ruleCtx(ctx);
+			return { [attr]: findRule(rules, ctx.params.kind, ctx.params.ruleId)[attr] };
+		} }));
+		r.client("PUT", `/pushrules/:scope/:kind/:ruleId/${attr}`, procedure({ handler: async (ctx) => withRulesLock(ctx.hs, (await ctx.auth()).userId, async () => {
+			const { s, rules } = await ruleCtx(ctx);
+			const rule = findRule(rules, ctx.params.kind, ctx.params.ruleId);
+			const body = await ctx.json();
+			if (attr === "enabled" && typeof body.enabled !== "boolean") throw errors.badJson("enabled must be a boolean");
+			if (attr === "actions" && !Array.isArray(body.actions)) throw errors.badJson("actions must be a list");
+			rule[attr] = body[attr];
+			await saveRules(ctx.hs, s.userId, rules);
+			return {};
+		}) }));
+	}
+	r.client("GET", "/pushers", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return { pushers: (await ctx.hs.db.findMany("pushers", { where: [{
+				field: "user_id",
+				value: s.userId
+			}] })).map((r) => r.pusher) };
+		}
+	}));
+	r.client("POST", "/pushers/set", procedure({
+		auth: "user",
+		input: pusherBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			if (body.kind === null) {
+				await ctx.hs.db.delete("pushers", [
+					{
+						field: "user_id",
+						value: s.userId
+					},
+					{
+						field: "app_id",
+						value: body.app_id
+					},
+					{
+						field: "pushkey",
+						value: body.pushkey
+					}
+				]);
+				return {};
+			}
+			for (const k of [
+				"kind",
+				"app_display_name",
+				"device_display_name",
+				"lang"
+			]) if (body[k] === void 0) throw errors.missingParam(`Missing ${k}`);
+			if (!body.data) throw errors.missingParam("Missing data");
+			if (body.kind === "http" && body.data.url === void 0) throw errors.invalidParam("data.url is required for http pushers");
+			if (!body.append) {
+				const others = await ctx.hs.db.findMany("pushers", { where: [{
+					field: "app_id",
+					value: body.app_id
+				}, {
+					field: "pushkey",
+					value: body.pushkey
+				}] });
+				for (const o of others) await ctx.hs.db.delete("pushers", [
+					{
+						field: "user_id",
+						value: o.user_id
+					},
+					{
+						field: "app_id",
+						value: o.app_id
+					},
+					{
+						field: "pushkey",
+						value: o.pushkey
+					}
+				]);
+			}
+			const { append, ...pusher } = body;
+			await ctx.hs.db.upsert("pushers", {
+				user_id: s.userId,
+				app_id: body.app_id,
+				pushkey: body.pushkey,
+				device_id: s.deviceId,
+				pusher
+			});
+			return {};
+		}
+	}));
+	r.client("GET", "/notifications", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const from = ctx.query.get("from");
+			const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "20", 10) || 20, 1), 100);
+			const rows = await ctx.hs.push.list(s.userId, {
+				from: from ? Number.parseInt(from, 10) : null,
+				limit,
+				onlyHighlight: ctx.query.get("only") === "highlight"
+			});
+			const out = { notifications: rows.map(({ stream, ...n }) => n) };
+			if (rows.length === limit) out.next_token = String(rows[rows.length - 1].stream);
+			return out;
+		}
+	}));
+}
+//#endregion
+export { registerPushRoutes };