matrix-nodejs-homeserver 0.2.0 → 0.3.2

package/dist/api/threadsubs.js

@@ -1,5 +1,7 @@
 import { isObject } from "../core/json.js";
+import { M } from "../core/m.js";
 import { MatrixError, errors } from "../core/errors.js";
+import { procedure } from "../http/procedure.js";
 //#region src/api/threadsubs.ts
 const VERSIONS = ["unstable/io.element.msc4306"];
 const notInThread = () => new MatrixError(400, "IO.ELEMENT.MSC4306.M_NOT_IN_THREAD", "Event is not in this thread");
@@ -38,68 +40,77 @@ async function threadRoot(ctx, userId) {
 }
 function registerThreadSubscriptionRoutes(r) {
 	const path = "/rooms/:roomId/thread/:threadId/subscription";
-	r.client("GET", path, async (ctx) => {
-		const s = await ctx.auth();
-		await threadRoot(ctx, s.userId);
-		const row = await ctx.hs.db.findOne("thread_subscriptions", key(s.userId, ctx.params.roomId, ctx.params.threadId));
-		if (!row?.subscribed) throw errors.notFound("Not subscribed to this thread");
-		return { automatic: !!row.automatic };
-	}, VERSIONS);
-	r.client("PUT", path, async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const { roomId, threadId } = ctx.params;
-		await threadRoot(ctx, s.userId);
-		const body = await ctx.json();
-		const cause = isObject(body) ? body.automatic : void 0;
-		if (cause !== void 0 && typeof cause !== "string") throw errors.badJson("automatic must be an event ID");
-		let causeStream = null;
-		if (typeof cause === "string") {
-			const ev = await visibleEvent(ctx, s.userId, roomId, cause);
-			const rel = ev?.pdu.content?.["m.relates_to"];
-			if (!ev || !isObject(rel) || rel.rel_type !== "m.thread" || rel.event_id !== threadId) throw notInThread();
-			causeStream = ev.stream;
+	r.client("GET", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await threadRoot(ctx, s.userId);
+			const row = await ctx.hs.db.findOne("thread_subscriptions", key(s.userId, ctx.params.roomId, ctx.params.threadId));
+			if (!row?.subscribed) throw errors.notFound("Not subscribed to this thread");
+			return { automatic: !!row.automatic };
 		}
-		await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
-			const row = await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId));
-			if (causeStream !== null) {
-				if (row && row.unsubscribed_after !== null && causeStream <= row.unsubscribed_after) throw conflicting();
-				if (row?.subscribed) return;
-			} else if (row?.subscribed && !row.automatic) return;
-			await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
-				user_id: s.userId,
-				room_id: roomId,
-				thread_id: threadId,
-				subscribed: true,
-				automatic: causeStream !== null,
-				unsubscribed_after: row?.unsubscribed_after ?? null,
-				stream
-			}));
-		});
-		hs.notifier.notify([s.userId]);
-		return {};
-	}, VERSIONS);
-	r.client("DELETE", path, async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const { roomId, threadId } = ctx.params;
-		await threadRoot(ctx, s.userId);
-		await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
-			if (!(await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId)))?.subscribed) return;
-			const position = await hs.streams.position();
-			await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
-				user_id: s.userId,
-				room_id: roomId,
-				thread_id: threadId,
-				subscribed: false,
-				automatic: false,
-				unsubscribed_after: position,
-				stream
-			}));
-		});
-		hs.notifier.notify([s.userId]);
-		return {};
-	}, VERSIONS);
+	}), VERSIONS);
+	r.client("PUT", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const { roomId, threadId } = ctx.params;
+			await threadRoot(ctx, s.userId);
+			const body = await ctx.json();
+			const cause = isObject(body) ? body.automatic : void 0;
+			if (cause !== void 0 && typeof cause !== "string") throw errors.badJson("automatic must be an event ID");
+			let causeStream = null;
+			if (typeof cause === "string") {
+				const ev = await visibleEvent(ctx, s.userId, roomId, cause);
+				const rel = ev?.pdu.content?.[M.RELATES_TO];
+				if (!ev || !isObject(rel) || rel.rel_type !== M.THREAD || rel.event_id !== threadId) throw notInThread();
+				causeStream = ev.stream;
+			}
+			await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
+				const row = await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId));
+				if (causeStream !== null) {
+					if (row && row.unsubscribed_after !== null && causeStream <= row.unsubscribed_after) throw conflicting();
+					if (row?.subscribed) return;
+				} else if (row?.subscribed && !row.automatic) return;
+				await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
+					user_id: s.userId,
+					room_id: roomId,
+					thread_id: threadId,
+					subscribed: true,
+					automatic: causeStream !== null,
+					unsubscribed_after: row?.unsubscribed_after ?? null,
+					stream
+				}));
+			});
+			hs.notifier.notify([s.userId]);
+			return {};
+		}
+	}), VERSIONS);
+	r.client("DELETE", path, procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const { roomId, threadId } = ctx.params;
+			await threadRoot(ctx, s.userId);
+			await hs.cluster.lock(`threadsub:${s.userId}:${roomId}:${threadId}`, async () => {
+				if (!(await hs.db.findOne("thread_subscriptions", key(s.userId, roomId, threadId)))?.subscribed) return;
+				const position = await hs.streams.position();
+				await hs.streams.write((stream) => hs.db.upsert("thread_subscriptions", {
+					user_id: s.userId,
+					room_id: roomId,
+					thread_id: threadId,
+					subscribed: false,
+					automatic: false,
+					unsubscribed_after: position,
+					stream
+				}));
+			});
+			hs.notifier.notify([s.userId]);
+			return {};
+		}
+	}), VERSIONS);
 }
 /** MSC4308 sliding sync extension: subscription changes in (since, to]. */
 async function threadSubscriptionsExtension(hs, userId, ext, since, to) {

package/dist/api/threepid.js

@@ -1,16 +1,18 @@
+import { M } from "../core/m.js";
 import { MatrixError, errors } from "../core/errors.js";
 import { canonicalAddress, isMedium } from "../core/threepid.js";
-import { requireUia } from "./uia.js";
+import { enum as _enum, string } from "../vendor/zod/v4/classic/schemas.js";
 import { body, fail, lenient } from "../http/input.js";
-import { z } from "zod";
+import { procedure } from "../http/procedure.js";
+import { requireUia } from "./uia.js";
 //#region src/api/threepid.ts
-const submitField = z.string(fail("M_MISSING_PARAM", "sid, client_secret and token are required"));
+const submitField = string(fail("M_MISSING_PARAM", "sid, client_secret and token are required"));
 const submitBody = body({
 	sid: submitField,
 	client_secret: submitField,
 	token: submitField
 });
-const bindField = (name) => z.string(fail("M_MISSING_PARAM", `Missing ${name}`));
+const bindField = (name) => string(fail("M_MISSING_PARAM", `Missing ${name}`));
 const bindBody = body({
 	client_secret: bindField("client_secret"),
 	id_access_token: bindField("id_access_token"),
@@ -18,9 +20,9 @@ const bindBody = body({
 	sid: bindField("sid")
 });
 const threepidBody = body({
-	medium: z.enum(["email", "msisdn"], fail("M_INVALID_PARAM", "Unsupported medium")),
-	address: z.string(fail("M_INVALID_PARAM", "Invalid address")),
-	id_server: z.string(fail("M_INVALID_PARAM", "id_server must be a string")).optional()
+	medium: _enum(["email", "msisdn"], fail("M_INVALID_PARAM", "Unsupported medium")),
+	address: string(fail("M_INVALID_PARAM", "Invalid address")),
+	id_server: string(fail("M_INVALID_PARAM", "id_server must be a string")).optional()
 });
 function notDelegated(ctx) {
 	if (ctx.hs.oauth) throw errors.unrecognized("Managed by the OAuth provider");
@@ -32,12 +34,21 @@ function registerThreepidRoutes(r) {
 		return ctx.hs.threepids.requestToken(purpose, medium, ctx.input);
 	};
 	for (const medium of ["email", "msisdn"]) {
-		r.client("POST", `/register/${medium}/requestToken`, { input: body({}) }, requestToken("register", medium));
-		r.client("POST", `/account/password/${medium}/requestToken`, { input: body({}) }, requestToken("password_reset", medium));
-		r.client("POST", `/account/3pid/${medium}/requestToken`, { input: body({}) }, requestToken("add_threepid", medium));
+		r.client("POST", `/register/${medium}/requestToken`, procedure({
+			input: body({}),
+			handler: requestToken("register", medium)
+		}));
+		r.client("POST", `/account/password/${medium}/requestToken`, procedure({
+			input: body({}),
+			handler: requestToken("password_reset", medium)
+		}));
+		r.client("POST", `/account/3pid/${medium}/requestToken`, procedure({
+			input: body({}),
+			handler: requestToken("add_threepid", medium)
+		}));
 	}
 	const submitPath = "/_matrix/client/unstable/threepid/submit_token";
-	r.get(submitPath, async (ctx) => {
+	r.get(submitPath, procedure({ handler: async (ctx) => {
 		const q = ctx.query;
 		let nextLink = null;
 		let message = "Your address has been validated. You can return to your Matrix client.";
@@ -53,44 +64,57 @@ function registerThreepidRoutes(r) {
 			status,
 			headers: { "content-type": "text/html; charset=utf-8" }
 		});
-	});
-	r.post(submitPath, { input: submitBody }, async (ctx) => {
-		const body = ctx.input;
-		await ctx.hs.threepids.submitToken(body.sid, body.client_secret, body.token);
-		return { success: true };
-	});
-	r.client("GET", "/account/3pid", async (ctx) => {
-		const s = await ctx.auth();
-		return { threepids: await ctx.hs.threepids.list(s.userId) };
-	});
-	r.client("POST", "/account/3pid/add", { input: body({
-		sid: lenient(z.string()),
-		client_secret: lenient(z.string())
-	}) }, async (ctx) => {
-		notDelegated(ctx);
-		const s = await ctx.auth();
-		const body = ctx.input;
-		await requireUia(ctx.hs, body, [["m.login.password"]], s.userId);
-		const validated = await ctx.hs.threepids.validated({
-			sid: body.sid,
-			client_secret: body.client_secret
-		});
-		if (!validated) throw new MatrixError(400, "M_THREEPID_AUTH_FAILED", "The address has not been validated");
-		await ctx.hs.threepids.add(s.userId, validated);
-		return {};
-	});
-	r.client("POST", "/account/3pid/bind", { input: bindBody }, async (ctx) => {
-		const s = await ctx.auth();
-		const body = ctx.input;
-		const res = await ctx.hs.identityServers.bind(body.id_server, body.id_access_token, body.sid, body.client_secret, s.userId);
-		if (res && isMedium(res.medium) && typeof res.address === "string") await ctx.hs.db.upsert("threepid_bindings", {
-			user_id: s.userId,
-			medium: res.medium,
-			address: res.address,
-			id_server: body.id_server
-		});
-		return {};
-	});
+	} }));
+	r.post(submitPath, procedure({
+		input: submitBody,
+		handler: async (ctx) => {
+			const body = ctx.input;
+			await ctx.hs.threepids.submitToken(body.sid, body.client_secret, body.token);
+			return { success: true };
+		}
+	}));
+	r.client("GET", "/account/3pid", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return { threepids: await ctx.hs.threepids.list(s.userId) };
+		}
+	}));
+	r.client("POST", "/account/3pid/add", procedure({
+		input: body({
+			sid: lenient(string()),
+			client_secret: lenient(string())
+		}),
+		handler: async (ctx) => {
+			notDelegated(ctx);
+			const s = await ctx.auth();
+			const body = ctx.input;
+			await requireUia(ctx.hs, body, [[M.LOGIN.PASSWORD]], s.userId);
+			const validated = await ctx.hs.threepids.validated({
+				sid: body.sid,
+				client_secret: body.client_secret
+			});
+			if (!validated) throw new MatrixError(400, "M_THREEPID_AUTH_FAILED", "The address has not been validated");
+			await ctx.hs.threepids.add(s.userId, validated);
+			return {};
+		}
+	}));
+	r.client("POST", "/account/3pid/bind", procedure({
+		auth: "user",
+		input: bindBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const body = ctx.input;
+			const res = await ctx.hs.identityServers.bind(body.id_server, body.id_access_token, body.sid, body.client_secret, s.userId);
+			if (res && isMedium(res.medium) && typeof res.address === "string") await ctx.hs.db.upsert("threepid_bindings", {
+				user_id: s.userId,
+				medium: res.medium,
+				address: res.address,
+				id_server: body.id_server
+			});
+			return {};
+		}
+	}));
 	const parseThreepid = (body) => {
 		const address = canonicalAddress(body.medium, body.address);
 		if (!address) throw errors.invalidParam("Invalid address");
@@ -100,23 +124,32 @@ function registerThreepidRoutes(r) {
 			idServer: body.id_server
 		};
 	};
-	r.client("POST", "/account/3pid/delete", { input: threepidBody }, async (ctx) => {
-		notDelegated(ctx);
-		const s = await ctx.auth();
-		const { medium, address, idServer } = parseThreepid(ctx.input);
-		const result = await ctx.hs.threepids.unbindAll(s.userId, medium, address, idServer);
-		await ctx.hs.threepids.remove(s.userId, medium, address);
-		return { id_server_unbind_result: result };
-	});
-	r.client("POST", "/account/3pid/unbind", { input: threepidBody }, async (ctx) => {
-		const s = await ctx.auth();
-		const { medium, address, idServer } = parseThreepid(ctx.input);
-		return { id_server_unbind_result: await ctx.hs.threepids.unbindAll(s.userId, medium, address, idServer) };
-	});
-	r.client("POST", "/account/3pid", async (ctx) => {
-		await ctx.auth();
-		throw errors.threepidDenied();
-	});
+	r.client("POST", "/account/3pid/delete", procedure({
+		input: threepidBody,
+		handler: async (ctx) => {
+			notDelegated(ctx);
+			const s = await ctx.auth();
+			const { medium, address, idServer } = parseThreepid(ctx.input);
+			const result = await ctx.hs.threepids.unbindAll(s.userId, medium, address, idServer);
+			await ctx.hs.threepids.remove(s.userId, medium, address);
+			return { id_server_unbind_result: result };
+		}
+	}));
+	r.client("POST", "/account/3pid/unbind", procedure({
+		auth: "user",
+		input: threepidBody,
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const { medium, address, idServer } = parseThreepid(ctx.input);
+			return { id_server_unbind_result: await ctx.hs.threepids.unbindAll(s.userId, medium, address, idServer) };
+		}
+	}));
+	r.client("POST", "/account/3pid", procedure({
+		auth: "user",
+		handler: async () => {
+			throw errors.threepidDenied();
+		}
+	}));
 }
 //#endregion
 export { registerThreepidRoutes };

package/dist/api/uia.js

@@ -1,5 +1,6 @@
 import { isObject } from "../core/json.js";
 import { randomString } from "../core/crypto.js";
+import { M, UNSTABLE } from "../core/m.js";
 import { MatrixError, errors } from "../core/errors.js";
 //#region src/api/uia.ts
 const UIA_TTL_MS = 6e5;
@@ -9,7 +10,7 @@ const UIA_TTL_MS = 6e5;
 * `userId` binds password stages to an already-authenticated user.
 */
 async function requireUia(hs, body, flows, userId) {
-	if (hs.oauth && flows.some((f) => f.includes("m.login.password"))) flows = [["m.oauth"], ["org.matrix.cross_signing_reset"]];
+	if (hs.oauth && flows.some((f) => f.includes(M.LOGIN.PASSWORD))) flows = [[M.OAUTH], [UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET]];
 	const auth = isObject(body.auth) ? body.auth : null;
 	let sessionId = typeof auth?.session === "string" ? auth.session : void 0;
 	const stored = sessionId ? await hs.cluster.get(`uia:${sessionId}`) : null;
@@ -26,8 +27,8 @@ async function requireUia(hs, body, flows, userId) {
 	}, UIA_TTL_MS);
 	const oauthUrl = hs.oauth?.options.accountManagementUrl ?? hs.oauth?.options.issuer;
 	const params = hs.oauth ? {
-		"m.oauth": { url: oauthUrl },
-		"org.matrix.cross_signing_reset": { url: oauthUrl }
+		[M.OAUTH]: { url: oauthUrl },
+		[UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET]: { url: oauthUrl }
 	} : {};
 	const challenge = (extra = {}) => new MatrixError(401, extra.errcode ? String(extra.errcode) : "M_FORBIDDEN", String(extra.error ?? "Authentication required"), {
 		flows: flows.map((stages) => ({ stages })),
@@ -36,36 +37,36 @@ async function requireUia(hs, body, flows, userId) {
 		completed: [...session.completed],
 		...extra
 	});
-	if (auth?.type === "m.login.dummy" && !auth.session && typeof body.username === "string" && !userId) {
+	if (auth?.type === M.LOGIN.DUMMY && !auth.session && typeof body.username === "string" && !userId) {
 		if (await hs.cluster.get(`uia-register:${body.username.toLowerCase()}`)) throw challenge({
 			errcode: "M_FORBIDDEN",
 			error: "Missing session"
 		});
 	}
 	if (auth?.type) switch (auth.type) {
-		case "m.login.dummy":
-			session.completed.add("m.login.dummy");
+		case M.LOGIN.DUMMY:
+			session.completed.add(M.LOGIN.DUMMY);
 			break;
-		case "m.oauth":
-		case "org.matrix.cross_signing_reset":
+		case M.OAUTH:
+		case UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET:
 			if (!hs.oauth) throw challenge({
 				errcode: "M_UNRECOGNIZED",
 				error: "OAuth is not enabled"
 			});
 			session.completed.add(auth.type);
 			break;
-		case "m.login.registration_token": {
+		case M.LOGIN.REGISTRATION_TOKEN: {
 			const { registrationTokenValid } = await import("./account.js");
 			if (typeof auth.token !== "string" || !await registrationTokenValid(hs, auth.token)) throw challenge({
 				errcode: "M_FORBIDDEN",
 				error: "Invalid registration token"
 			});
-			session.completed.add("m.login.registration_token");
+			session.completed.add(M.LOGIN.REGISTRATION_TOKEN);
 			break;
 		}
-		case "m.login.password": {
+		case M.LOGIN.PASSWORD: {
 			const identifier = isObject(auth.identifier) ? auth.identifier : {
-				type: "m.id.user",
+				type: M.ID.USER,
 				user: auth.user
 			};
 			const user = typeof identifier.user === "string" ? identifier.user : "";
@@ -84,13 +85,13 @@ async function requireUia(hs, body, flows, userId) {
 				errcode: "M_FORBIDDEN",
 				error: "Invalid password"
 			});
-			session.completed.add("m.login.password");
+			session.completed.add(M.LOGIN.PASSWORD);
 			break;
 		}
-		case "m.login.email.identity":
-		case "m.login.msisdn": {
+		case M.LOGIN.EMAIL.IDENTITY:
+		case M.LOGIN.MSISDN: {
 			const validated = await hs.threepids.validated(auth.threepid_creds ?? auth.threepidCreds);
-			const medium = auth.type === "m.login.email.identity" ? "email" : "msisdn";
+			const medium = auth.type === M.LOGIN.EMAIL.IDENTITY ? "email" : "msisdn";
 			if (!validated || validated.medium !== medium) throw challenge({
 				errcode: "M_UNAUTHORIZED",
 				error: "The address has not been validated"