matrix-nodejs-homeserver 0.2.0 → 0.3.2

package/dist/core/sso.js

@@ -3,6 +3,34 @@ import { errors } from "./errors.js";
 import { LOCALPART_RE } from "./ids.js";
 import { createHash, randomBytes } from "node:crypto";
 //#region src/core/sso.ts
+const UNSAFE_SCHEMES = /* @__PURE__ */ new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"file:",
+	"blob:",
+	"about:"
+]);
+/** The client's redirect URL, if it is one the server may send a login token to. */
+function checkRedirectUrl(raw) {
+	if (!raw) return null;
+	try {
+		return UNSAFE_SCHEMES.has(new URL(raw).protocol) ? null : raw;
+	} catch {
+		return null;
+	}
+}
+function clientMatches(raw, entry) {
+	try {
+		const url = new URL(raw);
+		const allowed = new URL(entry);
+		if (allowed.host) return url.protocol === allowed.protocol && url.host === allowed.host && url.pathname.startsWith(allowed.pathname);
+		return raw.startsWith(entry);
+	} catch {
+		return false;
+	}
+}
+const sameIssuer = (a, b) => typeof a === "string" && a.replace(/\/$/, "") === b.replace(/\/$/, "");
 function sanitizeLocalpart(raw) {
 	return raw.toLowerCase().replace(/[^a-z0-9._=\-/+]/g, "_").slice(0, 200);
 }
@@ -15,10 +43,12 @@ function decodeJwtPayload(jwt) {
 var SsoService = class {
 	hs;
 	providers;
+	clientAllowlist;
 	discovery = /* @__PURE__ */ new Map();
 	constructor(hs, options) {
 		this.hs = hs;
 		this.providers = options.providers;
+		this.clientAllowlist = options.clientAllowlist ?? [];
 	}
 	callbackUrl(provider) {
 		const base = this.hs.config.publicBaseUrl;
@@ -31,6 +61,7 @@ var SsoService = class {
 		const res = await this.hs.fetch(`${provider.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(1e4) });
 		if (!res.ok) throw new Error(`OIDC discovery for ${provider.id} failed with ${res.status}`);
 		const meta = await res.json();
+		if (!sameIssuer(meta.issuer, provider.issuer)) throw new Error(`OIDC discovery for ${provider.id} returned another issuer`);
 		this.discovery.set(provider.id, meta);
 		return meta;
 	}
@@ -96,6 +127,7 @@ var SsoService = class {
 		if (!res.ok) throw errors.forbidden("Code exchange failed");
 		const tokens = await res.json();
 		let claims = {};
+		if ((provider.scopes ?? ["openid"]).includes("openid") && typeof tokens.id_token !== "string") throw errors.forbidden("The provider returned no ID token");
 		if (typeof tokens.id_token === "string") {
 			claims = decodeJwtPayload(tokens.id_token);
 			const aud = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
@@ -130,7 +162,11 @@ var SsoService = class {
 		});
 		const redirect = new URL(pending.redirectUrl);
 		redirect.searchParams.set("loginToken", loginToken);
-		return redirect.toString();
+		return {
+			url: redirect.toString(),
+			confirm: !this.clientAllowlist.some((entry) => clientMatches(pending.redirectUrl, entry)),
+			client: redirect.host || redirect.protocol.replace(/:$/, "")
+		};
 	}
 	async resolveUser(provider, claims) {
 		const link = await this.hs.db.findOne("sso_identities", [{
@@ -162,4 +198,4 @@ var SsoService = class {
 	}
 };
 //#endregion
-export { SsoService };
+export { SsoService, checkRedirectUrl };

package/dist/core/stateres.js

@@ -1,7 +1,8 @@
+import { M } from "./m.js";
 import { eventIdOf, roomVersionFeatures, stateKey } from "./events.js";
 import { authEventKeys, checkAuth, powerLevels, userLevel } from "./authrules.js";
 //#region src/core/stateres.ts
-const isPowerEvent = (ev) => ev.type === "m.room.power_levels" && ev.state_key === "" || ev.type === "m.room.join_rules" && ev.state_key === "" || ev.type === "m.room.create" && ev.state_key === "" || ev.type === "m.room.member" && ["leave", "ban"].includes(ev.content?.membership) && ev.sender !== ev.state_key;
+const isPowerEvent = (ev) => ev.type === M.ROOM.POWER_LEVELS && ev.state_key === "" || ev.type === M.ROOM.JOIN_RULES && ev.state_key === "" || ev.type === M.ROOM.CREATE && ev.state_key === "" || ev.type === M.ROOM.MEMBER && ["leave", "ban"].includes(ev.content?.membership) && ev.sender !== ev.state_key;
 const authIds = (ev) => (ev.auth_events ?? []).map(eventIdOf);
 var EventCache = class {
 	events = /* @__PURE__ */ new Map();
@@ -66,7 +67,7 @@ async function resolveState(stateSets, roomVersion, source, createEvent) {
 	for (const id of await cache.authChain(powerEvents)) if (full.has(id)) control.add(id);
 	let resolved = await iterativeAuthChecks(cache, await reverseTopologicalPowerSort(cache, control, roomVersion, createEvent), v21 ? {} : { ...unconflicted }, roomVersion, createEvent);
 	const remaining = [...full].filter((id) => !control.has(id));
-	const mainline = await mainlineOf(cache, resolved[stateKey("m.room.power_levels", "")]);
+	const mainline = await mainlineOf(cache, resolved[stateKey(M.ROOM.POWER_LEVELS, "")]);
 	const positions = /* @__PURE__ */ new Map();
 	for (const id of remaining) positions.set(id, await mainlinePosition(cache, id, mainline));
 	remaining.sort((a, b) => {
@@ -107,7 +108,7 @@ async function senderPowerLevel(cache, ev, roomVersion, createEvent) {
 		const a = cache.get(id);
 		if (a && a.state_key !== void 0) state.set(stateKey(a.type, a.state_key), a);
 	}
-	if (createEvent) state.set(stateKey("m.room.create", ""), createEvent);
+	if (createEvent) state.set(stateKey(M.ROOM.CREATE, ""), createEvent);
 	const level = userLevel(powerLevels(state, roomVersion), ev.sender);
 	return Number.isFinite(level) ? level : Number.MAX_SAFE_INTEGER;
 }
@@ -160,7 +161,7 @@ async function iterativeAuthChecks(cache, ids, base, roomVersion, createEvent) {
 			const sev = sid ? cache.get(sid) : void 0;
 			if (sev) authState.set(k, sev);
 		}
-		if (createEvent) authState.set(stateKey("m.room.create", ""), createEvent);
+		if (createEvent) authState.set(stateKey(M.ROOM.CREATE, ""), createEvent);
 		try {
 			checkAuth(ev, authState, roomVersion);
 			state[stateKey(ev.type, ev.state_key)] = id;
@@ -179,7 +180,7 @@ async function mainlineOf(cache, plId) {
 		await cache.load(authIds(ev));
 		current = authIds(ev).find((a) => {
 			const e = cache.get(a);
-			return e?.type === "m.room.power_levels" && e.state_key === "";
+			return e?.type === M.ROOM.POWER_LEVELS && e.state_key === "";
 		});
 	}
 	const positions = /* @__PURE__ */ new Map();
@@ -199,7 +200,7 @@ async function mainlinePosition(cache, id, mainline) {
 		await cache.load(authIds(ev));
 		current = authIds(ev).find((a) => {
 			const e = cache.get(a);
-			return e?.type === "m.room.power_levels" && e.state_key === "";
+			return e?.type === M.ROOM.POWER_LEVELS && e.state_key === "";
 		});
 	}
 	return 0;

package/dist/core/threepid.js

@@ -1,6 +1,7 @@
 import { randomString } from "./crypto.js";
 import { MatrixError, errors } from "./errors.js";
 import { toMsisdn } from "./phone.js";
+import { escapeHtml } from "./html.js";
 import { randomInt } from "node:crypto";
 //#region src/core/threepid.ts
 const CLIENT_SECRET_RE = /^[0-9a-zA-Z.=_-]{1,255}$/;
@@ -262,14 +263,5 @@ var ThreepidService = class {
 		};
 	}
 };
-function escapeHtml(s) {
-	return s.replace(/[&<>"']/g, (c) => ({
-		"&": "&amp;",
-		"<": "&lt;",
-		">": "&gt;",
-		"\"": "&quot;",
-		"'": "&#39;"
-	})[c]);
-}
 //#endregion
 export { ThreepidService, canonicalAddress, isMedium };

package/dist/federation/client.js

@@ -1,6 +1,8 @@
 import { canonicalJson } from "../core/json.js";
 import { unpaddedBase64 } from "../core/crypto.js";
+import { M } from "../core/m.js";
 import { MatrixError } from "../core/errors.js";
+import { checkLiteral } from "../core/outbound.js";
 import { sign } from "node:crypto";
 import { resolveSrv } from "node:dns/promises";
 import { Agent, request } from "node:https";
@@ -149,7 +151,7 @@ var FederationClient = class {
 			}, "GET", "/.well-known/matrix/server", void 0, {}, 5e3);
 			if (res.status !== 200) return null;
 			const body = JSON.parse(res.body.toString("utf8"));
-			return typeof body["m.server"] === "string" && body["m.server"] ? body["m.server"] : null;
+			return typeof body[M.SERVER] === "string" && body[M.SERVER] ? body[M.SERVER] : null;
 		} catch {
 			return null;
 		}
@@ -168,6 +170,11 @@ var FederationClient = class {
 		return null;
 	}
 	raw(target, method, pathWithQuery, body, headers, timeoutMs, poolKey = target.hostHeader) {
+		try {
+			checkLiteral(this.hs.addressPolicy, target.host);
+		} catch (err) {
+			return Promise.reject(err);
+		}
 		return new Promise((resolve, reject) => {
 			let connectTimer = null;
 			const req = request({
@@ -177,6 +184,7 @@ var FederationClient = class {
 				path: pathWithQuery,
 				servername: isIP(target.tlsName) ? void 0 : target.tlsName,
 				agent: this.agentFor(poolKey),
+				lookup: this.hs.addressPolicy.lookup,
 				headers: {
 					host: target.hostHeader,
 					...headers,

package/dist/federation/index.d.ts

@@ -7,7 +7,7 @@ import { TransactionSender } from "./sender.js";
 import { Homeserver } from "../homeserver.js";
 //#region src/federation/index.d.ts
 export interface FederationOptions {
-  /** Enable federation. Default: true. */
+  /** Enable federation (talking to other homeservers). Default: false, so that a server only joins the network on purpose. */
   enabled?: boolean;
   /** Join remote rooms with partial state first (MSC3902 "faster joins"). Default true. */
   fasterJoins?: boolean;
@@ -136,7 +136,7 @@ export declare class FederationService {
    */
   backfill(roomId: string, fromEventIds: string[], limit?: number): Promise<number>;
   /** Download remote media (authenticated federation endpoint, falling back to the legacy one). */
-  fetchMedia(server: string, mediaId: string): Promise<{
+  fetchMedia(server: string, mediaId: string, maxBytes: number): Promise<{
     data: Uint8Array;
     contentType: string | null;
     filename: string | null;

package/dist/federation/index.js

@@ -1,5 +1,6 @@
 import { isObject } from "../core/json.js";
 import { unpaddedBase64, urlSafeBase64 } from "../core/crypto.js";
+import { M } from "../core/m.js";
 import { SUPPORTED_ROOM_VERSIONS, computeContentHash, computeReferenceHash, eventIdOf, finalisePdu, redact, roomVersionFeatures, splitStateKey, stateKey, stripState } from "../core/events.js";
 import { MatrixError, errors } from "../core/errors.js";
 import { parseId } from "../core/ids.js";
@@ -7,6 +8,7 @@ import { authStateFromAuthEvents, checkAuth, getState, membershipOf } from "../c
 import { globMatch } from "../core/glob.js";
 import { resolveState } from "../core/stateres.js";
 import { MissingStateError } from "../core/rooms.js";
+import { publicGet } from "../core/outbound.js";
 import { FederationClient } from "./client.js";
 import { KeyRing } from "./keyring.js";
 import { TransactionSender } from "./sender.js";
@@ -14,7 +16,7 @@ import { TransactionSender } from "./sender.js";
 const domainOf = (id) => id.slice(id.indexOf(":") + 1);
 /** Server ACL check (m.room.server_acl). */
 function serverAllowedByAcl(state, serverName) {
-	const acl = getState(state, "m.room.server_acl")?.content;
+	const acl = getState(state, M.ROOM.SERVER_ACL)?.content;
 	if (!isObject(acl)) return true;
 	const host = serverName.replace(/:\d+$/, "").replace(/^\[|\]$/g, "");
 	if (acl.allow_ip_literals === false && (/^\d+\.\d+\.\d+\.\d+$/.test(host) || host.includes(":"))) return false;
@@ -37,7 +39,7 @@ var FederationService = class {
 	constructor(hs, options = {}) {
 		this.hs = hs;
 		this.options = options;
-		this.enabled = options.enabled !== false;
+		this.enabled = options.enabled === true;
 		this.fasterJoins = options.fasterJoins !== false;
 		this.client = new FederationClient(hs, { rejectUnauthorized: options.verifyTls !== false });
 		this.keyring = new KeyRing(hs);
@@ -57,7 +59,7 @@ var FederationService = class {
 		const out = { ...rest };
 		const f = roomVersionFeatures(version);
 		if (!f.legacyEventIds) delete out.event_id;
-		if (f.v12 && out.type === "m.room.create") delete out.room_id;
+		if (f.v12 && out.type === M.ROOM.CREATE) delete out.room_id;
 		return out;
 	}
 	computeEventId(raw, version) {
@@ -73,7 +75,7 @@ var FederationService = class {
 	async verifyPdu(raw, version, roomId) {
 		if (!isObject(raw) || typeof raw.type !== "string" || typeof raw.sender !== "string" || !isObject(raw.content)) throw errors.badJson("Malformed PDU");
 		const f = roomVersionFeatures(version);
-		if (!f.v12 || raw.type !== "m.room.create") {
+		if (!f.v12 || raw.type !== M.ROOM.CREATE) {
 			if (raw.room_id !== roomId) throw errors.badJson("PDU room_id mismatch");
 		}
 		const eventId = this.computeEventId(raw, version);
@@ -84,7 +86,7 @@ var FederationService = class {
 		if (f.legacyEventIds && domainOf(eventId) !== senderDomain && !await this.keyring.verifySignedBy(redacted, domainOf(eventId))) throw errors.forbidden(`Event ${eventId} is not signed by its origin`);
 		let joinAuthorisedSignatureValid;
 		const via = raw.content?.join_authorised_via_users_server;
-		if (f.restricted && raw.type === "m.room.member" && raw.content?.membership === "join" && typeof via === "string" && via.includes(":")) joinAuthorisedSignatureValid = await this.keyring.verifySignedBy(redacted, domainOf(via));
+		if (f.restricted && raw.type === M.ROOM.MEMBER && raw.content?.membership === "join" && typeof via === "string" && via.includes(":")) joinAuthorisedSignatureValid = await this.keyring.verifySignedBy(redacted, domainOf(via));
 		let pdu = {
 			...raw,
 			event_id: eventId
@@ -93,7 +95,7 @@ var FederationService = class {
 			...redact(raw, version),
 			event_id: eventId
 		};
-		if (f.v12 && pdu.type === "m.room.create") pdu.room_id = roomId;
+		if (f.v12 && pdu.type === M.ROOM.CREATE) pdu.room_id = roomId;
 		return {
 			pdu,
 			joinAuthorisedSignatureValid
@@ -104,7 +106,7 @@ var FederationService = class {
 		const servers = /* @__PURE__ */ new Set();
 		for (const [key, ev] of state) {
 			const [type, userId] = splitStateKey(key);
-			if (type === "m.room.member" && ev.content?.membership === "join") servers.add(domainOf(userId));
+			if (type === M.ROOM.MEMBER && ev.content?.membership === "join") servers.add(domainOf(userId));
 		}
 		servers.delete(this.hs.serverName);
 		for (const s of servers) if (!this.serverAllowed(s) || applyAcl && !serverAllowedByAcl(state, s)) servers.delete(s);
@@ -123,8 +125,8 @@ var FederationService = class {
 	onLocalEvent(pdu, state) {
 		if (!this.enabled) return;
 		(async () => {
-			const destinations = await this.roomDestinations(pdu.room_id, state, pdu.type !== "m.room.server_acl");
-			if (pdu.type === "m.room.member" && typeof pdu.state_key === "string" && !this.hs.isLocalUser(pdu.state_key)) destinations.add(domainOf(pdu.state_key));
+			const destinations = await this.roomDestinations(pdu.room_id, state, pdu.type !== M.ROOM.SERVER_ACL);
+			if (pdu.type === M.ROOM.MEMBER && typeof pdu.state_key === "string" && !this.hs.isLocalUser(pdu.state_key)) destinations.add(domainOf(pdu.state_key));
 			if (!destinations.size) return;
 			const version = await this.hs.rooms.roomVersion(pdu.room_id) ?? "10";
 			await this.sender.sendPdu(destinations, this.toFederationPdu(pdu, version));
@@ -147,17 +149,17 @@ var FederationService = class {
 		return out;
 	}
 	async onTyping(roomId, userId, typing) {
-		if (this.hs.isLocalUser(userId)) await this.sendEduToRooms([roomId], "m.typing", {
+		if (this.hs.isLocalUser(userId)) await this.sendEduToRooms([roomId], M.TYPING, {
 			room_id: roomId,
 			user_id: userId,
 			typing
 		}, false);
 	}
 	async onReceipt(roomId, userId, receiptType, eventId, ts, threadId) {
-		if (!this.hs.isLocalUser(userId) || receiptType === "m.read.private") return;
+		if (!this.hs.isLocalUser(userId) || receiptType === M.READ.PRIVATE) return;
 		const data = { ts };
 		if (threadId) data.thread_id = threadId;
-		await this.sendEduToRooms([roomId], "m.receipt", { [roomId]: { [receiptType]: { [userId]: {
+		await this.sendEduToRooms([roomId], M.RECEIPT, { [roomId]: { [receiptType]: { [userId]: {
 			event_ids: [eventId],
 			data
 		} } } });
@@ -166,7 +168,7 @@ var FederationService = class {
 		if (!this.enabled || !this.hs.isLocalUser(userId)) return;
 		const servers = await this.serversSharingRooms(userId);
 		if (!servers.size) return;
-		await this.sender.sendEdu(servers, "m.presence", { push: [{
+		await this.sender.sendEdu(servers, M.PRESENCE, { push: [{
 			user_id: userId,
 			presence,
 			last_active_ago: 0,
@@ -217,7 +219,7 @@ var FederationService = class {
 				const d = devices.find((x) => x.device_id === u.deviceId);
 				if (d?.display_name) content.device_display_name = d.display_name;
 			}
-			await this.sender.sendEdu(servers, "m.device_list_update", content);
+			await this.sender.sendEdu(servers, M.DEVICE_LIST_UPDATE, content);
 		}
 	}
 	async onSigningKeyUpdate(userId) {
@@ -230,7 +232,7 @@ var FederationService = class {
 		}] });
 		const content = { user_id: userId };
 		for (const r of rows) if (r.key_type !== "user_signing") content[`${r.key_type}_key`] = r.key;
-		await this.sender.sendEdu(servers, "m.signing_key_update", content);
+		await this.sender.sendEdu(servers, M.SIGNING_KEY_UPDATE, content);
 	}
 	/** Deliver to-device messages addressed to remote users. */
 	async sendToDevice(sender, type, messages, messageId) {
@@ -241,7 +243,7 @@ var FederationService = class {
 			if (server === this.hs.serverName || !this.serverAllowed(server)) continue;
 			(byServer.get(server) ?? byServer.set(server, {}).get(server))[userId] = devices;
 		}
-		for (const [server, msgs] of byServer) await this.sender.sendEdu([server], "m.direct_to_device", {
+		for (const [server, msgs] of byServer) await this.sender.sendEdu([server], M.DIRECT_TO_DEVICE, {
 			sender,
 			type,
 			message_id: `${messageId}-${server}`,
@@ -301,7 +303,7 @@ var FederationService = class {
 	* rescinded or their knock being accepted/rejected.
 	*/
 	async handleOutOfRoomMembership(origin, roomId, raw) {
-		if (raw?.type !== "m.room.member" || typeof raw.state_key !== "string" || !this.hs.isLocalUser(raw.state_key)) throw errors.notFound("Unknown room");
+		if (raw?.type !== M.ROOM.MEMBER || typeof raw.state_key !== "string" || !this.hs.isLocalUser(raw.state_key)) throw errors.notFound("Unknown room");
 		const row = await this.hs.db.findOne("memberships", [{
 			field: "room_id",
 			value: roomId
@@ -311,7 +313,7 @@ var FederationService = class {
 		}]);
 		if (!row) throw errors.notFound("Unknown room");
 		const previous = await this.hs.rooms.getPdu(row.event_id);
-		const create = (previous?.unsigned?.invite_room_state ?? previous?.unsigned?.knock_room_state ?? []).find((e) => e?.type === "m.room.create");
+		const create = (previous?.unsigned?.invite_room_state ?? previous?.unsigned?.knock_room_state ?? []).find((e) => e?.type === M.ROOM.CREATE);
 		const version = typeof create?.content?.room_version === "string" ? create.content.room_version : "1";
 		const { pdu } = await this.verifyPdu(raw, version, roomId);
 		if (domainOf(pdu.sender) !== origin && domainOf(pdu.sender) !== domainOf(raw.state_key)) throw errors.forbidden("Unexpected sender");
@@ -571,7 +573,7 @@ var FederationService = class {
 			authPdus.push(p);
 		}
 		try {
-			const create = roomVersionFeatures(version).v12 && pdu.type !== "m.room.create" ? await this.hs.rooms.getPdu(`$${roomId.slice(1)}`) ?? void 0 : void 0;
+			const create = roomVersionFeatures(version).v12 && pdu.type !== M.ROOM.CREATE ? await this.hs.rooms.getPdu(`$${roomId.slice(1)}`) ?? void 0 : void 0;
 			checkAuth(pdu, authStateFromAuthEvents(pdu, authPdus, version, create), version);
 			return null;
 		} catch (err) {
@@ -592,7 +594,7 @@ var FederationService = class {
 		const content = edu?.content;
 		if (!isObject(content)) return;
 		switch (edu.edu_type) {
-			case "m.typing": {
+			case M.TYPING: {
 				const { room_id, user_id, typing } = content;
 				if (typeof user_id !== "string" || domainOf(user_id) !== origin || typeof room_id !== "string") return;
 				if (!await this.hs.rooms.exists(room_id) || !await this.mayActInRoom(room_id, user_id, origin)) return;
@@ -600,12 +602,12 @@ var FederationService = class {
 				await this.hs.typing.setTyping(room_id, user_id, !!typing, typeof content.timeout === "number" ? content.timeout : 3e4);
 				return;
 			}
-			case "m.receipt":
+			case M.RECEIPT:
 				for (const [roomId, byType] of Object.entries(content)) {
 					if (!isObject(byType) || !await this.hs.rooms.exists(roomId)) continue;
 					if (!serverAllowedByAcl(await this.hs.rooms.currentState(roomId), origin)) continue;
 					for (const [receiptType, byUser] of Object.entries(byType)) {
-						if (!["m.read", "m.read.private"].includes(receiptType) || !isObject(byUser)) continue;
+						if (receiptType !== M.READ._ && receiptType !== M.READ.PRIVATE || !isObject(byUser)) continue;
 						for (const [userId, r] of Object.entries(byUser)) {
 							if (domainOf(userId) !== origin || !isObject(r) || !Array.isArray(r.event_ids)) continue;
 							if (!await this.mayActInRoom(roomId, userId, origin)) continue;
@@ -625,7 +627,7 @@ var FederationService = class {
 					this.hs.notifier.notify(await this.hs.rooms.joinedMembers(roomId));
 				}
 				return;
-			case "m.presence":
+			case M.PRESENCE:
 				for (const p of Array.isArray(content.push) ? content.push : []) {
 					if (!isObject(p) || typeof p.user_id !== "string" || domainOf(p.user_id) !== origin) continue;
 					if (![
@@ -643,7 +645,7 @@ var FederationService = class {
 					this.hs.notifier.notify(await this.hs.rooms.usersSharingRooms(p.user_id));
 				}
 				return;
-			case "m.device_list_update": {
+			case M.DEVICE_LIST_UPDATE: {
 				const userId = content.user_id;
 				if (typeof userId !== "string" || domainOf(userId) !== origin || typeof content.device_id !== "string") return;
 				const known = await this.hs.db.findOne("remote_device_lists", [{
@@ -655,7 +657,7 @@ var FederationService = class {
 				if (known || content.deleted || isObject(content.keys)) await this.hs.keys.markDeviceListChanged(userId);
 				return;
 			}
-			case "m.signing_key_update": {
+			case M.SIGNING_KEY_UPDATE: {
 				const userId = content.user_id;
 				if (typeof userId !== "string" || domainOf(userId) !== origin) return;
 				for (const type of ["master", "self_signing"]) {
@@ -671,7 +673,7 @@ var FederationService = class {
 				await this.hs.keys.markDeviceListChanged(userId);
 				return;
 			}
-			case "m.direct_to_device": {
+			case M.DIRECT_TO_DEVICE: {
 				const { sender, type, message_id, messages } = content;
 				if (typeof sender !== "string" || domainOf(sender) !== origin || typeof type !== "string" || !isObject(messages)) return;
 				if (!await this.hs.cluster.setIfAbsent(`fedtodevice:${origin}|${message_id}`, true, 864e5)) return;
@@ -751,7 +753,7 @@ var FederationService = class {
 			const pdu = await this.hs.rooms.getPdu(id);
 			if (!pdu) continue;
 			stateIds[stateKey(pdu.type, pdu.state_key)] = id;
-			if (pdu.type === "m.room.create") create = pdu;
+			if (pdu.type === M.ROOM.CREATE) create = pdu;
 		}
 		if (!create) throw errors.badJson("send_join response lacks the create event");
 		if (!await this.hs.rooms.exists(roomId)) await this.hs.db.upsert("rooms", {
@@ -960,13 +962,16 @@ var FederationService = class {
 		return 0;
 	}
 	/** Download remote media (authenticated federation endpoint, falling back to the legacy one). */
-	async fetchMedia(server, mediaId) {
+	async fetchMedia(server, mediaId, maxBytes) {
 		this.requireEnabled();
 		const res = await this.client.requestRaw(server, "GET", `/_matrix/federation/v1/media/download/${encodeURIComponent(mediaId)}`, { timeoutMs: 6e4 });
 		if (res.status === 200) {
 			const ct = String(res.headers["content-type"] ?? "");
 			const m = /boundary=("?)([^";]+)\1/.exec(ct);
-			if (ct.startsWith("multipart/") && m) return parseMultipartMedia(res.body, m[2], this);
+			if (ct.startsWith("multipart/") && m) return parseMultipartMedia(res.body, m[2], {
+				maxBytes,
+				fetch: this.hs.publicFetch
+			});
 		}
 		const legacy = await this.client.requestRaw(server, "GET", `/_matrix/media/v3/download/${encodeURIComponent(server)}/${encodeURIComponent(mediaId)}`, {
 			query: { allow_remote: "false" },
@@ -993,14 +998,14 @@ var FederationService = class {
 		const out = /* @__PURE__ */ new Set();
 		for (const [key, ev] of state) {
 			const [type, userId] = splitStateKey(key);
-			if (type === "m.room.member" && ev.content?.membership === "join") out.add(domainOf(userId));
+			if (type === M.ROOM.MEMBER && ev.content?.membership === "join") out.add(domainOf(userId));
 		}
 		return [...out];
 	}
 	isMembershipVisibleTo(state, server) {
 		for (const [key] of state) {
 			const [type, userId] = splitStateKey(key);
-			if (type === "m.room.member" && domainOf(userId) === server && membershipOf(state, userId) === "join") return true;
+			if (type === M.ROOM.MEMBER && domainOf(userId) === server && membershipOf(state, userId) === "join") return true;
 		}
 		return false;
 	}
@@ -1019,7 +1024,7 @@ function filenameFromDisposition(header) {
 	return plain ? plain[1] : null;
 }
 /** Parse a federation media multipart/mixed response: a JSON part then the file (or a redirect). */
-async function parseMultipartMedia(body, boundary, fed) {
+async function parseMultipartMedia(body, boundary, limits) {
 	const delimiter = Buffer.from(`--${boundary}`);
 	const parts = [];
 	let idx = body.indexOf(delimiter);
@@ -1040,10 +1045,13 @@ async function parseMultipartMedia(body, boundary, fed) {
 		if (i > 0) headers[line.slice(0, i).trim().toLowerCase()] = line.slice(i + 1).trim();
 	}
 	if (headers.location) {
-		const res = await fetch(headers.location, { signal: AbortSignal.timeout(6e4) });
-		if (!res.ok) throw errors.notFound("Remote media redirect failed");
+		const res = await publicGet(limits.fetch, headers.location, {
+			maxBytes: limits.maxBytes,
+			timeoutMs: 6e4
+		});
+		if (res.status !== 200) throw errors.notFound("Remote media redirect failed");
 		return {
-			data: new Uint8Array(await res.arrayBuffer()),
+			data: new Uint8Array(res.body),
 			contentType: res.headers.get("content-type"),
 			filename: filenameFromDisposition(res.headers.get("content-disposition") ?? void 0)
 		};

package/dist/homeserver.d.ts

@@ -3,12 +3,13 @@ import { SigningKey } from "./core/crypto.js";
 import { PolicyServers } from "./core/policy.js";
 import { ThreepidOptions, ThreepidService } from "./core/threepid.js";
 import { IdentityServers } from "./core/identity.js";
+import { M } from "./core/m.js";
 import { AppServiceRegistration, AppServiceService } from "./core/appservices.js";
 import { AuthService } from "./core/auth.js";
+import { DatabaseAdapter } from "./storage/types.js";
 import { KeyService } from "./core/keys.js";
 import { ClusterAdapter, StreamManager } from "./core/cluster.js";
 import { Notifier } from "./core/notifier.js";
-import { DatabaseAdapter } from "./storage/types.js";
 import { RoomService } from "./core/rooms.js";
 import { TypingService } from "./core/typing.js";
 import { PushService } from "./core/push.js";
@@ -25,6 +26,7 @@ import { SettingsService } from "./core/settings.js";
 import { AdminRoomOptions, AdminRoomService } from "./core/adminroom.js";
 import { ResolvedUserAuth, UserAuthAdapter } from "./adapters/auth.js";
 import { MediaAdapter, Thumbnailer } from "./adapters/media.js";
+import { AddressPolicy } from "./core/outbound.js";
 import { EventEmitter } from "node:events";
 //#region src/homeserver.d.ts
 export interface Logger {
@@ -52,7 +54,7 @@ export interface HomeserverOptions {
   /** Contacts and page served at `/.well-known/matrix/support` (e.g. to appeal a locked account). */
   support?: {
     contacts?: {
-      role: "m.role.admin" | "m.role.security" | (string & {});
+      role: typeof M.ROLE.ADMIN | typeof M.ROLE.SECURITY | (string & {});
       matrix_id?: string;
       email_address?: string;
     }[];
@@ -81,6 +83,11 @@ export interface HomeserverOptions {
   accessTokenLifetimeMs?: number;
   /** Maximum `/sync` long-poll duration in ms. Default: 30000. */
   maxSyncTimeoutMs?: number;
+  /**
+   * How many `/sync` responses one process builds at once (default 4). Requests woken together
+   * wait in the process instead of queueing their database reads ahead of everything else.
+   */
+  maxConcurrentSyncs?: number;
   /**
    * Enables `/preview_url`. Off by default because it makes the server fetch arbitrary URLs.
    * Private/internal addresses stay blocked unless `allowPrivateAddresses` is set.
@@ -91,6 +98,13 @@ export interface HomeserverOptions {
   logger?: Logger;
   /** Custom `fetch` for outgoing HTTP requests. */
   fetch?: typeof globalThis.fetch;
+  /**
+   * Let requests to addresses that users or remote servers choose (federation, push gateways,
+   * identity servers, URL previews, remote media) reach private addresses: localhost, LAN and
+   * other non-public ranges. `true` allows all of them, a list allows those ranges only (e.g.
+   * `["127.0.0.1/32"]` for a push gateway on the same machine). Default: none.
+   */
+  allowPrivateAddresses?: boolean | string[];
   /**
    * Rate limiting. `false` disables it; otherwise per-action overrides and an optional
    * shared limiter (defaults to an in-memory token bucket). Admins are never limited.
@@ -101,7 +115,7 @@ export interface HomeserverOptions {
   sso?: SsoOptions;
   /**
    * Coordination between instances. The default (`localCluster()`) supports one process;
-   * use `postgresCluster()` / `redisCluster()` to scale horizontally.
+   * use `postgresCluster()` to scale horizontally.
    */
   cluster?: ClusterAdapter;
   /**
@@ -150,6 +164,7 @@ export interface ResolvedConfig {
   defaultRoomVersion: string;
   accessTokenLifetimeMs: number | null;
   maxSyncTimeoutMs: number;
+  maxConcurrentSyncs: number;
   urlPreviews: {
     allowPrivateAddresses: boolean;
   } | null;
@@ -188,8 +203,12 @@ export declare class Homeserver extends EventEmitter {
   readonly policyServers: PolicyServers;
   readonly threepids: ThreepidService;
   readonly identityServers: IdentityServers;
-  /** `fetch` used for outgoing requests (push gateways, URL previews, OAuth). Overridable for testing. */
+  /** `fetch` for requests to addresses the operator configured (OAuth, SSO, application services). */
   readonly fetch: typeof globalThis.fetch;
+  /** Which addresses requests to user- or remote-chosen destinations may reach (see `allowPrivateAddresses`). */
+  readonly addressPolicy: AddressPolicy;
+  /** `fetch` for user- or remote-chosen URLs: refuses private addresses unless allowed, never follows redirects. */
+  readonly publicFetch: typeof globalThis.fetch;
   /** Resolves once storage is migrated and the server is ready to serve requests. */
   readonly ready: Promise<void>;
   private _signingKey;