matrix-nodejs-homeserver 0.2.0 → 0.3.1

package/dist/api/spaces.js

@@ -1,6 +1,8 @@
+import { M } from "../core/m.js";
 import { splitStateKey, stripState } from "../core/events.js";
 import { errors } from "../core/errors.js";
 import { getState, membershipOf } from "../core/authrules.js";
+import { procedure } from "../http/procedure.js";
 //#region src/api/spaces.ts
 /** Room-level details shared by /hierarchy, /room_summary and /publicRooms. */
 async function roomDetails(hs, roomId) {
@@ -9,16 +11,16 @@ async function roomDetails(hs, roomId) {
 	const out = {
 		room_id: roomId,
 		num_joined_members: (await hs.rooms.joinedMembers(roomId)).length,
-		world_readable: get("m.room.history_visibility")?.history_visibility === "world_readable",
-		guest_can_join: get("m.room.guest_access")?.guest_access === "can_join",
-		join_rule: get("m.room.join_rules")?.join_rule ?? "invite"
+		world_readable: get(M.ROOM.HISTORY_VISIBILITY)?.history_visibility === "world_readable",
+		guest_can_join: get(M.ROOM.GUEST_ACCESS)?.guest_access === "can_join",
+		join_rule: get(M.ROOM.JOIN_RULES)?.join_rule ?? "invite"
 	};
 	const str = (v) => typeof v === "string" ? v : void 0;
-	if (str(get("m.room.name")?.name)) out.name = get("m.room.name").name;
-	if (str(get("m.room.topic")?.topic)) out.topic = get("m.room.topic").topic;
-	if (str(get("m.room.canonical_alias")?.alias)) out.canonical_alias = get("m.room.canonical_alias").alias;
-	if (str(get("m.room.avatar")?.url)) out.avatar_url = get("m.room.avatar").url;
-	if (str(get("m.room.create")?.type)) out.room_type = get("m.room.create").type;
+	if (str(get(M.ROOM.NAME)?.name)) out.name = get(M.ROOM.NAME).name;
+	if (str(get(M.ROOM.TOPIC)?.topic)) out.topic = get(M.ROOM.TOPIC).topic;
+	if (str(get(M.ROOM.CANONICAL_ALIAS)?.alias)) out.canonical_alias = get(M.ROOM.CANONICAL_ALIAS).alias;
+	if (str(get(M.ROOM.AVATAR)?.url)) out.avatar_url = get(M.ROOM.AVATAR).url;
+	if (str(get(M.ROOM.CREATE)?.type)) out.room_type = get(M.ROOM.CREATE).type;
 	return out;
 }
 /** Whether a user may see a room's summary (spec: "accessible" rooms). */
@@ -29,13 +31,13 @@ async function canAccess(hs, roomId, userId) {
 		"invite",
 		"knock"
 	].includes(membershipOf(state, userId))) return true;
-	if (getState(state, "m.room.history_visibility")?.content?.history_visibility === "world_readable") return true;
-	const joinRules = getState(state, "m.room.join_rules")?.content;
+	if (getState(state, M.ROOM.HISTORY_VISIBILITY)?.content?.history_visibility === "world_readable") return true;
+	const joinRules = getState(state, M.ROOM.JOIN_RULES)?.content;
 	const rule = joinRules?.join_rule ?? "invite";
 	if (rule === "public" || rule === "knock") return true;
 	if ((rule === "restricted" || rule === "knock_restricted") && userId) {
 		if (rule === "knock_restricted") return true;
-		for (const allow of Array.isArray(joinRules?.allow) ? joinRules.allow : []) if (allow?.type === "m.room_membership" && typeof allow.room_id === "string" && await hs.rooms.exists(allow.room_id)) {
+		for (const allow of Array.isArray(joinRules?.allow) ? joinRules.allow : []) if (allow?.type === M.ROOM_MEMBERSHIP && typeof allow.room_id === "string" && await hs.rooms.exists(allow.room_id)) {
 			if (await hs.rooms.membership(allow.room_id, userId) === "join") return true;
 		}
 	}
@@ -43,7 +45,7 @@ async function canAccess(hs, roomId, userId) {
 }
 function allowedRoomIds(joinRules) {
 	if (!joinRules || !["restricted", "knock_restricted"].includes(joinRules.join_rule)) return void 0;
-	return (Array.isArray(joinRules.allow) ? joinRules.allow : []).filter((a) => a?.type === "m.room_membership" && typeof a.room_id === "string").map((a) => a.room_id);
+	return (Array.isArray(joinRules.allow) ? joinRules.allow : []).filter((a) => a?.type === M.ROOM_MEMBERSHIP && typeof a.room_id === "string").map((a) => a.room_id);
 }
 /** Spec ordering of space children: valid `order` strings first, then child event timestamp, then room ID. */
 function childOrder(a, b) {
@@ -78,73 +80,76 @@ async function remoteSummary(hs, roomId, via, suggestedOnly, userId) {
 	return null;
 }
 function registerSpaceRoutes(r) {
-	r.client("GET", "/rooms/:roomId/hierarchy", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const rootId = ctx.params.roomId;
-		if (!await hs.rooms.exists(rootId) || !await canAccess(hs, rootId, s.userId)) throw errors.forbidden("You cannot view this room");
-		const suggestedOnly = ctx.query.get("suggested_only") === "true";
-		const maxDepth = ctx.query.has("max_depth") ? Number.parseInt(ctx.query.get("max_depth"), 10) : Infinity;
-		const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "50", 10) || 50, 1), 100);
-		const from = ctx.query.get("from");
-		let offset = 0;
-		if (from) {
-			const m = /^(\d+)_(.+)$/.exec(from);
-			if (!m || m[2] !== `${rootId}|${suggestedOnly}|${ctx.query.get("max_depth") ?? ""}`) throw errors.invalidParam("Invalid pagination token");
-			offset = Number(m[1]);
-		}
-		const rooms = [];
-		const seen = /* @__PURE__ */ new Set();
-		const queue = [{
-			roomId: rootId,
-			depth: 0,
-			via: []
-		}];
-		while (queue.length) {
-			const { roomId, depth, via } = queue.pop();
-			if (seen.has(roomId)) continue;
-			seen.add(roomId);
-			if (!await hs.rooms.serverIsJoined(roomId)) {
-				const remote = await remoteSummary(hs, roomId, via, suggestedOnly, s.userId);
-				if (!remote) continue;
-				rooms.push(remote);
-				const remoteChildren = (remote.room_type === "m.space" ? remote.children_state ?? [] : []).filter((c) => Array.isArray(c.content?.via) && c.content.via.length).sort(childOrder);
-				if (depth < maxDepth) for (const child of [...remoteChildren].reverse()) queue.push({
+	r.client("GET", "/rooms/:roomId/hierarchy", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const rootId = ctx.params.roomId;
+			if (!await hs.rooms.exists(rootId) || !await canAccess(hs, rootId, s.userId)) throw errors.forbidden("You cannot view this room");
+			const suggestedOnly = ctx.query.get("suggested_only") === "true";
+			const maxDepth = ctx.query.has("max_depth") ? Number.parseInt(ctx.query.get("max_depth"), 10) : Infinity;
+			const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "50", 10) || 50, 1), 100);
+			const from = ctx.query.get("from");
+			let offset = 0;
+			if (from) {
+				const m = /^(\d+)_(.+)$/.exec(from);
+				if (!m || m[2] !== `${rootId}|${suggestedOnly}|${ctx.query.get("max_depth") ?? ""}`) throw errors.invalidParam("Invalid pagination token");
+				offset = Number(m[1]);
+			}
+			const rooms = [];
+			const seen = /* @__PURE__ */ new Set();
+			const queue = [{
+				roomId: rootId,
+				depth: 0,
+				via: []
+			}];
+			while (queue.length) {
+				const { roomId, depth, via } = queue.pop();
+				if (seen.has(roomId)) continue;
+				seen.add(roomId);
+				if (!await hs.rooms.serverIsJoined(roomId)) {
+					const remote = await remoteSummary(hs, roomId, via, suggestedOnly, s.userId);
+					if (!remote) continue;
+					rooms.push(remote);
+					const remoteChildren = (remote.room_type === M.SPACE._ ? remote.children_state ?? [] : []).filter((c) => Array.isArray(c.content?.via) && c.content.via.length).sort(childOrder);
+					if (depth < maxDepth) for (const child of [...remoteChildren].reverse()) queue.push({
+						roomId: child.state_key,
+						depth: depth + 1,
+						via: child.content.via
+					});
+					continue;
+				}
+				if (roomId !== rootId && !await canAccess(hs, roomId, s.userId)) continue;
+				const state = await hs.rooms.currentState(roomId);
+				const children = [];
+				const isSpace = getState(state, M.ROOM.CREATE)?.content?.type === M.SPACE._;
+				for (const [key, ev] of isSpace ? state : []) {
+					const [type] = splitStateKey(key);
+					if (type !== M.SPACE.CHILD || !Array.isArray(ev.content?.via) || ev.content.via.length === 0) continue;
+					if (suggestedOnly && ev.content.suggested !== true) continue;
+					children.push({
+						...stripState(ev),
+						origin_server_ts: ev.origin_server_ts
+					});
+				}
+				children.sort(childOrder);
+				if (depth < maxDepth) for (const child of [...children].reverse()) queue.push({
 					roomId: child.state_key,
 					depth: depth + 1,
 					via: child.content.via
 				});
-				continue;
+				const details = await roomDetails(hs, roomId);
+				const allowed = allowedRoomIds(getState(state, M.ROOM.JOIN_RULES)?.content);
+				if (allowed) details.allowed_room_ids = allowed;
+				details.children_state = children;
+				rooms.push(details);
 			}
-			if (roomId !== rootId && !await canAccess(hs, roomId, s.userId)) continue;
-			const state = await hs.rooms.currentState(roomId);
-			const children = [];
-			const isSpace = getState(state, "m.room.create")?.content?.type === "m.space";
-			for (const [key, ev] of isSpace ? state : []) {
-				const [type] = splitStateKey(key);
-				if (type !== "m.space.child" || !Array.isArray(ev.content?.via) || ev.content.via.length === 0) continue;
-				if (suggestedOnly && ev.content.suggested !== true) continue;
-				children.push({
-					...stripState(ev),
-					origin_server_ts: ev.origin_server_ts
-				});
-			}
-			children.sort(childOrder);
-			if (depth < maxDepth) for (const child of [...children].reverse()) queue.push({
-				roomId: child.state_key,
-				depth: depth + 1,
-				via: child.content.via
-			});
-			const details = await roomDetails(hs, roomId);
-			const allowed = allowedRoomIds(getState(state, "m.room.join_rules")?.content);
-			if (allowed) details.allowed_room_ids = allowed;
-			details.children_state = children;
-			rooms.push(details);
+			const out = { rooms: rooms.slice(offset, offset + limit) };
+			if (offset + limit < rooms.length) out.next_batch = `${offset + limit}_${rootId}|${suggestedOnly}|${ctx.query.get("max_depth") ?? ""}`;
+			return out;
 		}
-		const out = { rooms: rooms.slice(offset, offset + limit) };
-		if (offset + limit < rooms.length) out.next_batch = `${offset + limit}_${rootId}|${suggestedOnly}|${ctx.query.get("max_depth") ?? ""}`;
-		return out;
-	}, ["v1"]);
+	}), ["v1"]);
 	const summary = async (ctx) => {
 		const s = await ctx.optionalAuth();
 		const hs = ctx.hs;
@@ -158,15 +163,15 @@ function registerSpaceRoutes(r) {
 		const state = await hs.rooms.currentState(roomId);
 		const out = await roomDetails(hs, roomId);
 		out.room_version = await hs.rooms.roomVersion(roomId);
-		const enc = getState(state, "m.room.encryption")?.content?.algorithm;
+		const enc = getState(state, M.ROOM.ENCRYPTION)?.content?.algorithm;
 		if (typeof enc === "string") out.encryption = enc;
 		if (s) out.membership = membershipOf(state, s.userId);
-		const allowed = allowedRoomIds(getState(state, "m.room.join_rules")?.content);
+		const allowed = allowedRoomIds(getState(state, M.ROOM.JOIN_RULES)?.content);
 		if (allowed) out.allowed_room_ids = allowed;
 		return out;
 	};
-	r.client("GET", "/room_summary/:roomIdOrAlias", summary, ["v1"]);
-	r.get("/_matrix/client/unstable/im.nheko.summary/summary/:roomIdOrAlias", summary);
+	r.client("GET", "/room_summary/:roomIdOrAlias", procedure({ handler: summary }), ["v1"]);
+	r.get("/_matrix/client/unstable/im.nheko.summary/summary/:roomIdOrAlias", procedure({ handler: summary }));
 }
 //#endregion
 export { registerSpaceRoutes, roomDetails };

package/dist/api/sync.js

@@ -1,9 +1,11 @@
+import { M, UNSTABLE } from "../core/m.js";
 import { eventIdOf, splitStateKey, stateKey, toClientEvent } from "../core/events.js";
 import { errors } from "../core/errors.js";
 import { getState } from "../core/authrules.js";
 import { loadRules } from "../core/pushrules.js";
 import { inviteDecision } from "../core/invitefilter.js";
 import { body } from "../http/input.js";
+import { procedure } from "../http/procedure.js";
 import { matchesFilter, roomAllowed, validateSyncFilter } from "./filters.js";
 import { fullProfile } from "../core/profile.js";
 //#region src/api/sync.ts
@@ -163,13 +165,13 @@ async function roomTimeline(hs, p, roomId, since, upTo) {
 		if (sinceIds[key] === ev.event_id) continue;
 		const [type, sk] = splitStateKey(key);
 		if (!matchesFilter(sf, ev)) continue;
-		if (lazy && type === "m.room.member" && !senders.has(sk)) continue;
+		if (lazy && type === M.ROOM.MEMBER && !senders.has(sk)) continue;
 		state.push(ev);
 	}
 	if (lazy) for (const e of events) {
-		const key = stateKey("m.room.member", e.pdu.sender);
-		if (startState.has(key) || state.some((s) => s.type === "m.room.member" && s.state_key === e.pdu.sender)) continue;
-		const member = [...(await hs.rooms.getPdus((e.pdu.auth_events ?? []).map(eventIdOf))).values()].find((a) => a.type === "m.room.member" && a.state_key === e.pdu.sender);
+		const key = stateKey(M.ROOM.MEMBER, e.pdu.sender);
+		if (startState.has(key) || state.some((s) => s.type === M.ROOM.MEMBER && s.state_key === e.pdu.sender)) continue;
+		const member = [...(await hs.rooms.getPdus((e.pdu.auth_events ?? []).map(eventIdOf))).values()].find((a) => a.type === M.ROOM.MEMBER && a.state_key === e.pdu.sender);
 		if (member && matchesFilter(sf, member)) state.push(member);
 	}
 	const stateAfter = [];
@@ -179,7 +181,7 @@ async function roomTimeline(hs, p, roomId, since, upTo) {
 			if (sinceIds[key] === ev.event_id) continue;
 			const [type, sk] = splitStateKey(key);
 			if (!matchesFilter(sf, ev)) continue;
-			if (lazy && type === "m.room.member" && !senders.has(sk)) continue;
+			if (lazy && type === M.ROOM.MEMBER && !senders.has(sk)) continue;
 			stateAfter.push(ev);
 		}
 	}
@@ -199,7 +201,7 @@ async function roomEphemeral(hs, p, roomId) {
 	const out = [];
 	const typing = hs.typing.typingSince(roomId, since);
 	if (typing !== null && (since !== null || typing.length > 0)) out.push({
-		type: "m.typing",
+		type: M.TYPING,
 		content: { user_ids: typing }
 	});
 	const where = [{
@@ -214,7 +216,7 @@ async function roomEphemeral(hs, p, roomId) {
 	const receipts = (await hs.db.findMany("receipts", { where })).filter((r) => r.stream <= p.to);
 	const content = {};
 	for (const r of receipts) {
-		if (r.receipt_type === "m.read.private" && r.user_id !== p.session.userId) continue;
+		if (r.receipt_type === M.READ.PRIVATE && r.user_id !== p.session.userId) continue;
 		content[r.event_id] ??= {};
 		content[r.event_id][r.receipt_type] ??= {};
 		if (r.thread_id && content[r.event_id][r.receipt_type][r.user_id] && !content[r.event_id][r.receipt_type][r.user_id].thread_id) continue;
@@ -224,7 +226,7 @@ async function roomEphemeral(hs, p, roomId) {
 		};
 	}
 	if (Object.keys(content).length) out.push({
-		type: "m.receipt",
+		type: M.RECEIPT,
 		content
 	});
 	return out.filter((e) => matchesFilter(p.filter.room?.ephemeral, e));
@@ -256,17 +258,17 @@ async function roomSummary(hs, roomId, userId) {
 	const heroes = [];
 	for (const [key, ev] of state) {
 		const [type, sk] = splitStateKey(key);
-		if (type !== "m.room.member") continue;
+		if (type !== M.ROOM.MEMBER) continue;
 		const m = ev.content?.membership;
 		if (m === "join") joined++;
 		if (m === "invite") invited++;
 		if ((m === "join" || m === "invite") && sk !== userId && heroes.length < 5) heroes.push(sk);
 	}
 	const summary = {
-		"m.joined_member_count": joined,
-		"m.invited_member_count": invited
+		[M.JOINED_MEMBER_COUNT]: joined,
+		[M.INVITED_MEMBER_COUNT]: invited
 	};
-	if (!getState(state, "m.room.name")?.content?.name && !getState(state, "m.room.canonical_alias")?.content?.alias) summary["m.heroes"] = heroes.sort();
+	if (!getState(state, M.ROOM.NAME)?.content?.name && !getState(state, M.ROOM.CANONICAL_ALIAS)?.content?.alias) summary[M.HEROES] = heroes.sort();
 	return summary;
 }
 async function buildSync(hs, p) {
@@ -345,8 +347,8 @@ async function buildSync(hs, p) {
 		}
 	}
 	const globalAccountData = await accountData(hs, p, "");
-	if (since === null && !globalAccountData.some((e) => e.type === "m.push_rules")) globalAccountData.push({
-		type: "m.push_rules",
+	if (since === null && !globalAccountData.some((e) => e.type === M.PUSH_RULES)) globalAccountData.push({
+		type: M.PUSH_RULES,
 		content: { global: await loadRules(hs, userId) }
 	});
 	if (globalAccountData.length) empty = false;
@@ -408,7 +410,7 @@ async function buildSync(hs, p) {
 			if (row.status_msg) content.status_msg = row.status_msg;
 			if (row.presence === "online") content.currently_active = true;
 			const ev = {
-				type: "m.presence",
+				type: M.PRESENCE,
 				sender: row.user_id,
 				content
 			};
@@ -439,7 +441,7 @@ async function buildSync(hs, p) {
 		device_one_time_keys_count: await hs.keys.oneTimeKeyCounts(userId, p.session.deviceId),
 		device_unused_fallback_key_types: await hs.keys.unusedFallbackKeyTypes(userId, p.session.deviceId)
 	};
-	if (profileUpdates) body["org.matrix.msc4429.users"] = profileUpdates;
+	if (profileUpdates) body[UNSTABLE.ORG.MATRIX.MSC4429.USERS] = profileUpdates;
 	if (since !== null) {
 		const lists = await hs.keys.changesSince(userId, since, p.to);
 		body.device_lists = lists;
@@ -474,12 +476,12 @@ async function sync(ctx) {
 			},
 			{
 				field: "type",
-				value: "m.ignored_user_list"
+				value: M.IGNORED_USER_LIST
 			}
 		]);
 		const ignored = new Set(Object.keys(ignoredRow?.content?.ignored_users ?? {}));
 		const stable = ctx.query.get("use_state_after") === "true";
-		const unstable = ctx.query.get("org.matrix.msc4222.use_state_after") === "true";
+		const unstable = ctx.query.get(UNSTABLE.ORG.MATRIX.MSC4222.USE_STATE_AFTER) === "true";
 		const { body, empty } = await buildSync(hs, {
 			session,
 			ignored,
@@ -488,7 +490,7 @@ async function sync(ctx) {
 			filter,
 			fullState,
 			useStateAfter: stable || unstable,
-			stateAfterKey: stable ? "state_after" : "org.matrix.msc4222.state_after"
+			stateAfterKey: stable ? "state_after" : UNSTABLE.ORG.MATRIX.MSC4222.STATE_AFTER
 		});
 		const remaining = deadline - Date.now();
 		if (!since || !empty || remaining <= 0 || fullState) return body;
@@ -520,43 +522,50 @@ async function touchPresence(hs, userId, presence) {
 	await hs.federation.onPresence(userId, state, row?.status_msg ?? null).catch(() => {});
 }
 function registerSyncRoutes(r) {
-	r.client("GET", "/sync", sync);
-	r.client("POST", "/user/:userId/filter", { input: body({}) }, async (ctx) => {
-		const s = await ctx.auth();
-		if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot create filters for other users");
-		const filter = validateSyncFilter(ctx.input);
-		const existing = await ctx.hs.db.findMany("filters", { where: [{
-			field: "user_id",
-			value: s.userId
-		}] });
-		const filterId = String(existing.reduce((max, f) => Math.max(max, Number(f.filter_id) || 0), 0) + 1);
-		await ctx.hs.db.create("filters", {
-			user_id: s.userId,
-			filter_id: filterId,
-			filter
-		});
-		return { filter_id: filterId };
-	});
-	r.client("GET", "/user/:userId/filter/:filterId", async (ctx) => {
-		const s = await ctx.auth();
-		if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot read filters of other users");
-		const row = await ctx.hs.db.findOne("filters", [{
-			field: "user_id",
-			value: s.userId
-		}, {
-			field: "filter_id",
-			value: ctx.params.filterId
-		}]);
-		if (!row) throw errors.notFound("Unknown filter");
-		return row.filter;
-	});
+	r.client("GET", "/sync", procedure({ handler: sync }));
+	r.client("POST", "/user/:userId/filter", procedure({
+		auth: "user",
+		input: body({}),
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot create filters for other users");
+			const filter = validateSyncFilter(ctx.input);
+			const existing = await ctx.hs.db.findMany("filters", { where: [{
+				field: "user_id",
+				value: s.userId
+			}] });
+			const filterId = String(existing.reduce((max, f) => Math.max(max, Number(f.filter_id) || 0), 0) + 1);
+			await ctx.hs.db.create("filters", {
+				user_id: s.userId,
+				filter_id: filterId,
+				filter
+			});
+			return { filter_id: filterId };
+		}
+	}));
+	r.client("GET", "/user/:userId/filter/:filterId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (ctx.params.userId !== s.userId) throw errors.forbidden("Cannot read filters of other users");
+			const row = await ctx.hs.db.findOne("filters", [{
+				field: "user_id",
+				value: s.userId
+			}, {
+				field: "filter_id",
+				value: ctx.params.filterId
+			}]);
+			if (!row) throw errors.notFound("Unknown filter");
+			return row.filter;
+		}
+	}));
 }
 /**
 * MSC4429: profile changes of users sharing a room, limited to the fields the filter asks for.
 * The initial sync carries current values; users we no longer share any room with get `null`.
 */
 async function profileUpdatesFor(hs, p, memberships) {
-	const ids = (p.filter.profile_fields ?? p.filter["org.matrix.msc4429.profile_fields"])?.ids;
+	const ids = (p.filter.profile_fields ?? p.filter[UNSTABLE.ORG.MATRIX.MSC4429.PROFILE_FIELDS])?.ids;
 	if (!Array.isArray(ids) || !ids.length) return null;
 	const wanted = new Set(ids.filter((x) => typeof x === "string"));
 	const since = p.since?.pos ?? null;

package/dist/api/threadsubs.js

@@ -1,5 +1,7 @@
 import { isObject } from "../core/json.js";
+import { M } from "../core/m.js";
 import { MatrixError, errors } from "../core/errors.js";
+import { procedure } from "../http/procedure.js";
 //#region src/api/threadsubs.ts
 const VERSIONS = ["unstable/io.element.msc4306"];
 const notInThread = () => new MatrixError(400, "IO.ELEMENT.MSC4306.M_NOT_IN_THREAD", "Event is not in this thread");
@@ -38,68 +40,77 @@ async function threadRoot(ctx, userId) {
 }
 function registerThreadSubscriptionRoutes(r) {
 	const path = "/rooms/:roomId/thread/:threadId/subscription";
-	r.client("GET", path, async (ctx) => {
-		const s = await ctx.auth();
-		await threadRoot(ctx, s.userId);
-		const row = await ctx.hs.db.findOne("thread_subscriptions", key(s.userId, ctx.params.roomId, ctx.params.threadId));
-		if (!row?.subscribed) throw errors.notFound("Not subscribed to this thread");
-		return { automatic: !!row.automatic };
-	}, VERSIONS);
-	r.client("PUT", path, async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const { roomId, threadId } = ctx.params;
-		await threadRoot(ctx, s.userId);
-		const body = await ctx.json();
-		const cause = isObject(body) ? body.automatic : void 0;
-		if (cause !== void 0 && typeof cause !== "string") throw errors.badJson("automatic must be an event ID");
-		let causeStream = null;
-		if (typeof cause === "string") {
-			const ev = await visibleEvent(ctx, s.userId, roomId, cause);
-			const rel = ev?.pdu.content?.["m.relates_to"];
-			if (!ev || !isObject(rel) || rel.rel_type !== "m.thread" || rel.event_id !== threadId) throw notInThread();
-			causeStream = ev.stream;
+	r.client("GET", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await threadRoot(ctx, s.userId);
+			const row = await ctx.hs.db.findOne("thread_subscriptions", key(s.userId, ctx.params.roomId, ctx.params.threadId));
+			if (!row?.subscribed) throw errors.notFound("Not subscribed to this thread");
+			return { automatic: !!row.automatic };
 		}
-		await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
-			const row = await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId));
-			if (causeStream !== null) {
-				if (row && row.unsubscribed_after !== null && causeStream <= row.unsubscribed_after) throw conflicting();
-				if (row?.subscribed) return;
-			} else if (row?.subscribed && !row.automatic) return;
-			await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
-				user_id: s.userId,
-				room_id: roomId,
-				thread_id: threadId,
-				subscribed: true,
-				automatic: causeStream !== null,
-				unsubscribed_after: row?.unsubscribed_after ?? null,
-				stream
-			}));
-		});
-		hs.notifier.notify([s.userId]);
-		return {};
-	}, VERSIONS);
-	r.client("DELETE", path, async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const { roomId, threadId } = ctx.params;
-		await threadRoot(ctx, s.userId);
-		await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
-			if (!(await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId)))?.subscribed) return;
-			const position = await hs.streams.position();
-			await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
-				user_id: s.userId,
-				room_id: roomId,
-				thread_id: threadId,
-				subscribed: false,
-				automatic: false,
-				unsubscribed_after: position,
-				stream
-			}));
-		});
-		hs.notifier.notify([s.userId]);
-		return {};
-	}, VERSIONS);
+	}), VERSIONS);
+	r.client("PUT", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const { roomId, threadId } = ctx.params;
+			await threadRoot(ctx, s.userId);
+			const body = await ctx.json();
+			const cause = isObject(body) ? body.automatic : void 0;
+			if (cause !== void 0 && typeof cause !== "string") throw errors.badJson("automatic must be an event ID");
+			let causeStream = null;
+			if (typeof cause === "string") {
+				const ev = await visibleEvent(ctx, s.userId, roomId, cause);
+				const rel = ev?.pdu.content?.[M.RELATES_TO];
+				if (!ev || !isObject(rel) || rel.rel_type !== M.THREAD || rel.event_id !== threadId) throw notInThread();
+				causeStream = ev.stream;
+			}
+			await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
+				const row = await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId));
+				if (causeStream !== null) {
+					if (row && row.unsubscribed_after !== null && causeStream <= row.unsubscribed_after) throw conflicting();
+					if (row?.subscribed) return;
+				} else if (row?.subscribed && !row.automatic) return;
+				await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
+					user_id: s.userId,
+					room_id: roomId,
+					thread_id: threadId,
+					subscribed: true,
+					automatic: causeStream !== null,
+					unsubscribed_after: row?.unsubscribed_after ?? null,
+					stream
+				}));
+			});
+			hs.notifier.notify([s.userId]);
+			return {};
+		}
+	}), VERSIONS);
+	r.client("DELETE", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const { roomId, threadId } = ctx.params;
+			await threadRoot(ctx, s.userId);
+			await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
+				if (!(await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId)))?.subscribed) return;
+				const position = await hs.streams.position();
+				await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
+					user_id: s.userId,
+					room_id: roomId,
+					thread_id: threadId,
+					subscribed: false,
+					automatic: false,
+					unsubscribed_after: position,
+					stream
+				}));
+			});
+			hs.notifier.notify([s.userId]);
+			return {};
+		}
+	}), VERSIONS);
 }
 /** MSC4308 sliding sync extension: subscription changes in (since, to]. */
 async function threadSubscriptionsExtension(hs, userId, ext, since, to) {