matrix-nodejs-homeserver 0.2.0 → 0.3.2

package/dist/api/account.js

@@ -1,51 +1,55 @@
 import { isObject } from "../core/json.js";
 import { randomString } from "../core/crypto.js";
+import { M, UNSTABLE } from "../core/m.js";
 import { MatrixError, errors } from "../core/errors.js";
 import { LOCALPART_RE } from "../core/ids.js";
 import { toMsisdn } from "../core/phone.js";
+import { escapeHtml } from "../core/html.js";
 import { canonicalAddress, isMedium } from "../core/threepid.js";
-import { requireUia } from "./uia.js";
+import { boolean, looseObject, string } from "../vendor/zod/v4/classic/schemas.js";
 import { body, fail, lenient } from "../http/input.js";
+import { procedure } from "../http/procedure.js";
+import { requireUia } from "./uia.js";
+import { checkRedirectUrl } from "../core/sso.js";
 import { createHmac, randomInt, timingSafeEqual } from "node:crypto";
-import { z } from "zod";
 //#region src/api/account.ts
 const deviceFields = {
-	device_id: lenient(z.string()),
-	initial_device_display_name: lenient(z.string()),
-	refresh_token: lenient(z.boolean()),
-	inhibit_login: lenient(z.boolean())
+	device_id: lenient(string()),
+	initial_device_display_name: lenient(string()),
+	refresh_token: lenient(boolean()),
+	inhibit_login: lenient(boolean())
 };
 const loginBody = body({
-	type: lenient(z.string()),
-	token: lenient(z.string()),
-	password: lenient(z.string()),
+	type: lenient(string()),
+	token: lenient(string()),
+	password: lenient(string()),
 	...deviceFields
 });
 const registerBody = body({
-	type: lenient(z.string()),
-	auth: lenient(z.looseObject({ type: lenient(z.string()) })),
-	username: z.string(fail("M_INVALID_PARAM", "username must be a string")).optional(),
-	password: z.string(fail("M_INVALID_PARAM", "password must be a string")).optional(),
+	type: lenient(string()),
+	auth: lenient(looseObject({ type: lenient(string()) })),
+	username: string(fail("M_INVALID_PARAM", "username must be a string")).optional(),
+	password: string(fail("M_INVALID_PARAM", "password must be a string")).optional(),
 	...deviceFields
 });
 const passwordBody = body({
-	new_password: lenient(z.string()),
-	logout_devices: lenient(z.boolean())
+	new_password: lenient(string()),
+	logout_devices: lenient(boolean())
 });
 const sharedSecretRegisterBody = body({
-	nonce: lenient(z.string()),
-	username: z.string(fail("M_INVALID_PARAM", "Invalid username/password")),
-	password: z.string(fail("M_INVALID_PARAM", "Invalid username/password")),
-	admin: lenient(z.boolean()),
-	mac: lenient(z.string()),
-	displayname: lenient(z.string())
+	nonce: lenient(string()),
+	username: string(fail("M_INVALID_PARAM", "Invalid username/password")),
+	password: string(fail("M_INVALID_PARAM", "Invalid username/password")),
+	admin: lenient(boolean()),
+	mac: lenient(string()),
+	displayname: lenient(string())
 });
 function loginFlows(hs) {
 	if (hs.oauth) return [];
 	const flows = [];
-	if (hs.userAuth.passwordLoginEnabled) flows.push({ type: "m.login.password" });
+	if (hs.userAuth.passwordLoginEnabled) flows.push({ type: M.LOGIN.PASSWORD });
 	if (hs.sso) flows.push({
-		type: "m.login.sso",
+		type: M.LOGIN.SSO,
 		identity_providers: hs.sso.providers.map((p) => ({
 			id: p.id,
 			name: p.name,
@@ -54,7 +58,7 @@ function loginFlows(hs) {
 		}))
 	});
 	flows.push({
-		type: "m.login.token",
+		type: M.LOGIN.TOKEN,
 		...hs.config.loginViaExistingSession ? { get_login_token: true } : {}
 	});
 	return flows;
@@ -105,11 +109,11 @@ async function resolveLoginUser(hs, body) {
 	let user;
 	const id = isObject(body.identifier) ? body.identifier : null;
 	let threepid = null;
-	if (id?.type === "m.id.thirdparty" && typeof id.medium === "string" && typeof id.address === "string") threepid = {
+	if (id?.type === M.ID.THIRDPARTY && typeof id.medium === "string" && typeof id.address === "string") threepid = {
 		medium: id.medium,
 		address: isMedium(id.medium) ? canonicalAddress(id.medium, id.address) : null
 	};
-	else if (id?.type === "m.id.phone" && typeof id.country === "string" && typeof id.phone === "string") threepid = {
+	else if (id?.type === M.ID.PHONE && typeof id.country === "string" && typeof id.phone === "string") threepid = {
 		medium: "msisdn",
 		address: toMsisdn(id.country, id.phone)
 	};
@@ -123,7 +127,7 @@ async function resolveLoginUser(hs, body) {
 		return owner;
 	}
 	if (id) {
-		if (id.type !== "m.id.user") throw errors.unknown("Unsupported identifier type");
+		if (id.type !== M.ID.USER) throw errors.unknown("Unsupported identifier type");
 		user = id.user;
 	} else user = body.user;
 	if (typeof user !== "string" || !user) throw errors.missingParam("Missing user identifier");
@@ -135,77 +139,152 @@ async function resolveLoginUser(hs, body) {
 	return `@${user.toLowerCase()}:${hs.serverName}`;
 }
 function registerAccountRoutes(r) {
-	r.client("GET", "/login", (ctx) => ({ flows: loginFlows(ctx.hs) }));
-	r.client("GET", "/auth_metadata", async (ctx) => {
+	r.client("GET", "/login", procedure({ handler: (ctx) => ({ flows: loginFlows(ctx.hs) }) }));
+	r.client("GET", "/auth_metadata", procedure({ handler: async (ctx) => {
 		if (!ctx.hs.oauth) throw errors.unrecognized("OAuth is not enabled");
 		return ctx.hs.oauth.serverMetadata();
-	}, ["v1"]);
-	r.client("GET", "/auth_issuer", (ctx) => {
+	} }), ["v1"]);
+	r.client("GET", "/auth_issuer", procedure({ handler: (ctx) => {
 		if (!ctx.hs.oauth) throw errors.unrecognized("OAuth is not enabled");
 		return { issuer: ctx.hs.oauth.options.issuer };
-	}, ["v1"]);
+	} }), ["v1"]);
+	const ssoConfirmPage = (serverName, result) => {
+		const client = escapeHtml(result.client);
+		const html = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Continue to ${client}</title>
+<style>body{font:16px system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem}a.button{display:inline-block;padding:.6rem 1.2rem;background:#0b7a55;color:#fff;border-radius:6px;text-decoration:none}</style>
+<h1>Continue to ${client}?</h1>
+<p>You signed in to <b>${escapeHtml(serverName)}</b>. <b>${client}</b> will get access to your account.</p>
+<p>If you did not just sign in with this app, close this page.</p>
+<p><a class="button" href="${escapeHtml(result.url)}">Continue to ${client}</a></p>`;
+		return new Response(html, { headers: {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store",
+			"referrer-policy": "no-referrer",
+			"x-frame-options": "DENY",
+			"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
+		} });
+	};
 	const ssoRedirect = async (ctx) => {
 		if (!ctx.hs.sso) throw errors.unrecognized("SSO is not enabled");
-		const redirectUrl = ctx.query.get("redirectUrl");
-		if (!redirectUrl || !/^https?:\/\/|^[a-z][a-z0-9+.-]*:/i.test(redirectUrl)) throw errors.missingParam("Missing or invalid redirectUrl");
+		const redirectUrl = checkRedirectUrl(ctx.query.get("redirectUrl"));
+		if (!redirectUrl) throw errors.missingParam("Missing or invalid redirectUrl");
 		return Response.redirect(await ctx.hs.sso.startLogin(ctx.params.idpId ?? null, redirectUrl), 302);
 	};
-	r.client("POST", "/login/get_token", async (ctx) => {
-		const s = await ctx.auth();
-		if (!ctx.hs.config.loginViaExistingSession || ctx.hs.oauth || s.isGuest) throw errors.unrecognized();
-		await ctx.rateLimit("login");
-		await requireUia(ctx.hs, await ctx.json(), [["m.login.password"]], s.userId);
-		const ttl = 12e4;
-		return {
-			login_token: await ctx.hs.auth.createLoginToken(s.userId, ttl),
-			expires_in_ms: ttl
-		};
-	}, ["v1"]);
-	r.client("GET", "/login/sso/redirect", ssoRedirect);
-	r.client("GET", "/login/sso/redirect/:idpId", ssoRedirect);
-	r.client("GET", "/login/sso/callback/:idpId", async (ctx) => {
-		if (!ctx.hs.sso) throw errors.unrecognized("SSO is not enabled");
-		return Response.redirect(await ctx.hs.sso.finishLogin(ctx.params.idpId, ctx.query), 302);
-	});
-	r.client("POST", "/login", { input: loginBody }, async (ctx) => {
-		await ctx.rateLimit("login");
-		const body = ctx.input;
-		const hs = ctx.hs;
-		if (hs.oauth) throw errors.unrecognized("Log in through the OAuth provider");
-		if (body.type === "m.login.application_service") {
-			const reg = ctx.accessToken() ? hs.appservices.byToken(ctx.accessToken()) : null;
-			if (!reg) throw errors.unknownToken("An application service token is required");
-			const userId = await resolveLoginUser(hs, body);
-			if (!hs.appservices.isInterestedUser(reg, userId)) throw errors.forbidden("User is not in the application service's namespace");
-			if (!await hs.db.findOne("users", [{
-				field: "user_id",
-				value: userId
-			}])) throw errors.forbidden("Unknown user");
+	r.client("POST", "/login/get_token", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (!ctx.hs.config.loginViaExistingSession || ctx.hs.oauth || s.isGuest) throw errors.unrecognized();
+			await ctx.rateLimit("login");
+			await requireUia(ctx.hs, await ctx.json(), [[M.LOGIN.PASSWORD]], s.userId);
+			const ttl = 12e4;
 			return {
-				...await hs.auth.createSession(userId, {
-					deviceId: body.device_id,
-					displayName: body.initial_device_display_name
-				}),
-				home_server: hs.serverName
+				login_token: await ctx.hs.auth.createLoginToken(s.userId, ttl),
+				expires_in_ms: ttl
 			};
 		}
-		if (body.type === "m.login.token") {
-			if (body.token === void 0) throw errors.missingParam("Missing token");
-			const userId = await hs.auth.consumeLoginToken(body.token).catch(async (err) => {
+	}), ["v1"]);
+	r.client("GET", "/login/sso/redirect", procedure({ handler: ssoRedirect }));
+	r.client("GET", "/login/sso/redirect/:idpId", procedure({ handler: ssoRedirect }));
+	r.client("GET", "/login/sso/callback/:idpId", procedure({ handler: async (ctx) => {
+		if (!ctx.hs.sso) throw errors.unrecognized("SSO is not enabled");
+		const result = await ctx.hs.sso.finishLogin(ctx.params.idpId, ctx.query);
+		return result.confirm ? ssoConfirmPage(ctx.hs.serverName, result) : Response.redirect(result.url, 302);
+	} }));
+	r.client("POST", "/login", procedure({
+		rateLimit: "login",
+		input: loginBody,
+		handler: async (ctx) => {
+			const body = ctx.input;
+			const hs = ctx.hs;
+			if (hs.oauth) throw errors.unrecognized("Log in through the OAuth provider");
+			if (body.type === M.LOGIN.APPLICATION_SERVICE) {
+				const reg = ctx.accessToken() ? hs.appservices.byToken(ctx.accessToken()) : null;
+				if (!reg) throw errors.unknownToken("An application service token is required");
+				const userId = await resolveLoginUser(hs, body);
+				if (!hs.appservices.isInterestedUser(reg, userId)) throw errors.forbidden("User is not in the application service's namespace");
+				if (!await hs.db.findOne("users", [{
+					field: "user_id",
+					value: userId
+				}])) throw errors.forbidden("Unknown user");
+				return {
+					...await hs.auth.createSession(userId, {
+						deviceId: body.device_id,
+						displayName: body.initial_device_display_name
+					}),
+					home_server: hs.serverName
+				};
+			}
+			if (body.type === M.LOGIN.TOKEN) {
+				if (body.token === void 0) throw errors.missingParam("Missing token");
+				const userId = await hs.auth.consumeLoginToken(body.token).catch(async (err) => {
+					await hs.audit.record({
+						action: "login_failed",
+						actor: null,
+						ip: ctx.ip,
+						outcome: "failure",
+						details: { type: M.LOGIN.TOKEN }
+					});
+					throw err;
+				});
+				const user = await hs.db.findOne("users", [{
+					field: "user_id",
+					value: userId
+				}]);
+				if (!user || user.deactivated) throw errors.userDeactivated();
+				const session = await hs.auth.createSession(userId, {
+					deviceId: body.device_id,
+					displayName: body.initial_device_display_name,
+					refreshToken: body.refresh_token === true
+				});
 				await hs.audit.record({
-					action: "login_failed",
-					actor: null,
+					action: "login",
+					actor: userId,
+					target: session.device_id,
 					ip: ctx.ip,
-					outcome: "failure",
-					details: { type: "m.login.token" }
+					userAgent: ctx.request.headers.get("user-agent"),
+					details: { type: M.LOGIN.TOKEN }
 				});
-				throw err;
-			});
-			const user = await hs.db.findOne("users", [{
+				return {
+					...session,
+					home_server: hs.serverName,
+					well_known: wellKnown(hs) ?? void 0
+				};
+			}
+			if (body.type !== M.LOGIN.PASSWORD || !hs.userAuth.passwordLoginEnabled) throw errors.unknown("Unsupported login type");
+			const userId = await resolveLoginUser(hs, body);
+			if (body.password === void 0) throw errors.missingParam("Missing password");
+			let user = await hs.db.findOne("users", [{
 				field: "user_id",
 				value: userId
 			}]);
-			if (!user || user.deactivated) throw errors.userDeactivated();
+			const ok = await hs.userAuth.checkPassword({
+				userId,
+				localpart: userId.slice(1).split(":")[0],
+				password: body.password,
+				storedHash: user?.password_hash ?? null
+			});
+			const ua = ctx.request.headers.get("user-agent");
+			if (!ok) {
+				await hs.audit.record({
+					action: "login_failed",
+					actor: userId,
+					ip: ctx.ip,
+					userAgent: ua,
+					outcome: "failure",
+					details: { type: M.LOGIN.PASSWORD }
+				});
+				throw errors.forbidden("Invalid username or password");
+			}
+			if (!user) {
+				if (!await hs.userAuth.autoProvision(userId)) throw errors.forbidden("Invalid username or password");
+				await createUser(hs, userId.slice(1).split(":")[0], {});
+				user = await hs.db.findOne("users", [{
+					field: "user_id",
+					value: userId
+				}]);
+			}
+			if (user.deactivated) throw errors.userDeactivated();
 			const session = await hs.auth.createSession(userId, {
 				deviceId: body.device_id,
 				displayName: body.initial_device_display_name,
@@ -216,8 +295,8 @@ function registerAccountRoutes(r) {
 				actor: userId,
 				target: session.device_id,
 				ip: ctx.ip,
-				userAgent: ctx.request.headers.get("user-agent"),
-				details: { type: "m.login.token" }
+				userAgent: ua,
+				details: { type: M.LOGIN.PASSWORD }
 			});
 			return {
 				...session,
@@ -225,141 +304,143 @@ function registerAccountRoutes(r) {
 				well_known: wellKnown(hs) ?? void 0
 			};
 		}
-		if (body.type !== "m.login.password" || !hs.userAuth.passwordLoginEnabled) throw errors.unknown("Unsupported login type");
-		const userId = await resolveLoginUser(hs, body);
-		if (body.password === void 0) throw errors.missingParam("Missing password");
-		let user = await hs.db.findOne("users", [{
-			field: "user_id",
-			value: userId
-		}]);
-		const ok = await hs.userAuth.checkPassword({
-			userId,
-			localpart: userId.slice(1).split(":")[0],
-			password: body.password,
-			storedHash: user?.password_hash ?? null
-		});
-		const ua = ctx.request.headers.get("user-agent");
-		if (!ok) {
-			await hs.audit.record({
-				action: "login_failed",
-				actor: userId,
+	}));
+	r.client("POST", "/refresh", procedure({
+		input: body({ refresh_token: lenient(string()) }),
+		handler: async (ctx) => {
+			const body = ctx.input;
+			if (body.refresh_token === void 0) throw errors.missingParam("Missing refresh_token");
+			const { access_token, refresh_token, expires_in_ms } = await ctx.hs.auth.refresh(body.refresh_token);
+			return {
+				access_token,
+				refresh_token,
+				expires_in_ms
+			};
+		}
+	}));
+	r.client("POST", "/logout", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await ctx.hs.auth.deleteDevice(s.userId, s.deviceId);
+			await ctx.hs.audit.record({
+				action: "logout",
+				actor: s.userId,
+				target: s.deviceId,
+				ip: ctx.ip
+			});
+			return {};
+		}
+	}));
+	r.client("POST", "/logout/all", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			await ctx.hs.auth.deleteAllDevices(s.userId);
+			await ctx.hs.audit.record({
+				action: "logout",
+				actor: s.userId,
 				ip: ctx.ip,
-				userAgent: ua,
-				outcome: "failure",
-				details: { type: "m.login.password" }
+				details: { all: true }
 			});
-			throw errors.forbidden("Invalid username or password");
+			return {};
 		}
-		if (!user) {
-			if (!await hs.userAuth.autoProvision(userId)) throw errors.forbidden("Invalid username or password");
-			await createUser(hs, userId.slice(1).split(":")[0], {});
-			user = await hs.db.findOne("users", [{
-				field: "user_id",
-				value: userId
-			}]);
+	}));
+	r.client("GET", "/account/whoami", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			return {
+				user_id: s.userId,
+				...s.deviceId ? { device_id: s.deviceId } : {},
+				is_guest: s.isGuest
+			};
 		}
-		if (user.deactivated) throw errors.userDeactivated();
-		const session = await hs.auth.createSession(userId, {
-			deviceId: body.device_id,
-			displayName: body.initial_device_display_name,
-			refreshToken: body.refresh_token === true
-		});
-		await hs.audit.record({
-			action: "login",
-			actor: userId,
-			target: session.device_id,
-			ip: ctx.ip,
-			userAgent: ua,
-			details: { type: "m.login.password" }
-		});
-		return {
-			...session,
-			home_server: hs.serverName,
-			well_known: wellKnown(hs) ?? void 0
-		};
-	});
-	r.client("POST", "/refresh", { input: body({ refresh_token: lenient(z.string()) }) }, async (ctx) => {
-		const body = ctx.input;
-		if (body.refresh_token === void 0) throw errors.missingParam("Missing refresh_token");
-		const { access_token, refresh_token, expires_in_ms } = await ctx.hs.auth.refresh(body.refresh_token);
-		return {
-			access_token,
-			refresh_token,
-			expires_in_ms
-		};
-	});
-	r.client("POST", "/logout", async (ctx) => {
-		const s = await ctx.auth();
-		await ctx.hs.auth.deleteDevice(s.userId, s.deviceId);
-		await ctx.hs.audit.record({
-			action: "logout",
-			actor: s.userId,
-			target: s.deviceId,
-			ip: ctx.ip
-		});
-		return {};
-	});
-	r.client("POST", "/logout/all", async (ctx) => {
-		const s = await ctx.auth();
-		await ctx.hs.auth.deleteAllDevices(s.userId);
-		await ctx.hs.audit.record({
-			action: "logout",
-			actor: s.userId,
-			ip: ctx.ip,
-			details: { all: true }
-		});
-		return {};
-	});
-	r.client("GET", "/account/whoami", async (ctx) => {
-		const s = await ctx.auth();
-		return {
-			user_id: s.userId,
-			...s.deviceId ? { device_id: s.deviceId } : {},
-			is_guest: s.isGuest
-		};
-	});
-	r.client("GET", "/register/available", async (ctx) => {
+	}));
+	r.client("GET", "/register/available", procedure({ handler: async (ctx) => {
 		const username = ctx.query.get("username");
 		if (!username) throw errors.missingParam("Missing username");
 		await validateNewUsername(ctx.hs, username);
 		return { available: true };
-	});
-	r.client("GET", "/register", async (ctx) => ({
+	} }));
+	r.client("GET", "/register", procedure({ handler: async (ctx) => ({
 		flows: (await registrationFlows(ctx.hs)).map((stages) => ({ stages })),
 		params: {}
-	}));
-	r.client("GET", "/register/m.login.registration_token/validity", async (ctx) => {
-		await ctx.rateLimit("register");
-		const token = ctx.query.get("token");
-		if (!token) throw errors.missingParam("Missing token");
-		return { valid: await registrationTokenValid(ctx.hs, token) };
-	}, ["v1"]);
-	r.client("POST", "/register", { input: registerBody }, async (ctx) => {
-		const hs = ctx.hs;
-		const body = ctx.input;
-		const kind = ctx.query.get("kind") ?? "user";
-		if (kind === "guest") {
-			if (!hs.userAuth.guestAccessEnabled) throw errors.forbidden("Guest access is disabled");
-			const userId = await createUser(hs, await generateLocalpart(hs), { guest: true });
-			return {
-				...await hs.auth.createSession(userId, { displayName: body.initial_device_display_name }),
-				home_server: hs.serverName
-			};
+	}) }));
+	r.client("GET", "/register/m.login.registration_token/validity", procedure({
+		rateLimit: "register",
+		handler: async (ctx) => {
+			const token = ctx.query.get("token");
+			if (!token) throw errors.missingParam("Missing token");
+			return { valid: await registrationTokenValid(ctx.hs, token) };
 		}
-		if (kind !== "user") throw errors.invalidParam("Unknown kind");
-		if (body.type === "m.login.application_service" || body.auth?.type === "m.login.application_service") {
-			const s = await ctx.auth();
-			if (!s.appservice) throw errors.forbidden("An application service token is required");
-			if (body.username === void 0) throw errors.missingParam("Missing username");
-			const localpart = body.username.toLowerCase();
-			const userId = `@${localpart}:${hs.serverName}`;
-			if (!hs.appservices.isInterestedUser(s.appservice, userId)) throw errors.exclusive("User is not in the application service's namespace");
-			if (!LOCALPART_RE.test(localpart)) throw errors.invalidUsername();
+	}), ["v1"]);
+	r.client("POST", "/register", procedure({
+		input: registerBody,
+		handler: async (ctx) => {
+			const hs = ctx.hs;
+			const body = ctx.input;
+			const kind = ctx.query.get("kind") ?? "user";
+			if (kind === "guest") {
+				if (!hs.userAuth.guestAccessEnabled) throw errors.forbidden("Guest access is disabled");
+				const userId = await createUser(hs, await generateLocalpart(hs), { guest: true });
+				return {
+					...await hs.auth.createSession(userId, { displayName: body.initial_device_display_name }),
+					home_server: hs.serverName
+				};
+			}
+			if (kind !== "user") throw errors.invalidParam("Unknown kind");
+			if (body.type === M.LOGIN.APPLICATION_SERVICE || body.auth?.type === M.LOGIN.APPLICATION_SERVICE) {
+				const s = await ctx.auth();
+				if (!s.appservice) throw errors.forbidden("An application service token is required");
+				if (body.username === void 0) throw errors.missingParam("Missing username");
+				const localpart = body.username.toLowerCase();
+				const userId = `@${localpart}:${hs.serverName}`;
+				if (!hs.appservices.isInterestedUser(s.appservice, userId)) throw errors.exclusive("User is not in the application service's namespace");
+				if (!LOCALPART_RE.test(localpart)) throw errors.invalidUsername();
+				if (await hs.db.findOne("users", [{
+					field: "user_id",
+					value: userId
+				}])) throw errors.userInUse();
+				await createUser(hs, localpart, {});
+				if (body.inhibit_login === true) return {
+					user_id: userId,
+					home_server: hs.serverName
+				};
+				return {
+					...await hs.auth.createSession(userId, {
+						deviceId: body.device_id,
+						displayName: body.initial_device_display_name
+					}),
+					home_server: hs.serverName
+				};
+			}
+			if (ctx.accessToken() && hs.appservices.byToken(ctx.accessToken())) throw errors.missingParam("Application services must use type m.login.application_service");
+			rejectIfDelegated(hs);
+			if (!await hs.registrationAllowed()) throw errors.forbidden("Registration is disabled");
+			await ctx.rateLimit("register");
+			const localpart = body.username !== void 0 ? await validateNewUsername(hs, body.username.toLowerCase()) : await generateLocalpart(hs);
+			if (hs.appservices.exclusiveUserOwner(`@${localpart}:${hs.serverName}`)) throw errors.exclusive("This user ID is reserved by an application service");
+			if (body.password !== void 0) {
+				const problem = await hs.userAuth.validatePassword(body.password);
+				if (problem) throw new MatrixError(400, "M_WEAK_PASSWORD", problem);
+			}
+			const flows = await registrationFlows(hs);
+			const { threepids } = await requireUia(hs, body, flows, null);
+			await consumeRegistrationToken(hs, body);
 			if (await hs.db.findOne("users", [{
-				field: "user_id",
-				value: userId
+				field: "localpart",
+				value: localpart
 			}])) throw errors.userInUse();
-			await createUser(hs, localpart, {});
+			const userId = await createUser(hs, localpart, { password: body.password });
+			for (const t of threepids) await hs.threepids.add(userId, t).catch((err) => hs.logger.warn("Could not attach", t.medium, "to", userId, err));
+			await hs.audit.record({
+				action: "register",
+				actor: userId,
+				ip: ctx.ip,
+				userAgent: ctx.request.headers.get("user-agent"),
+				details: { token: body.auth?.type === M.LOGIN.REGISTRATION_TOKEN }
+			});
 			if (body.inhibit_login === true) return {
 				user_id: userId,
 				home_server: hs.serverName
@@ -367,166 +448,138 @@ function registerAccountRoutes(r) {
 			return {
 				...await hs.auth.createSession(userId, {
 					deviceId: body.device_id,
-					displayName: body.initial_device_display_name
+					displayName: body.initial_device_display_name,
+					refreshToken: body.refresh_token === true
 				}),
 				home_server: hs.serverName
 			};
 		}
-		if (ctx.accessToken() && hs.appservices.byToken(ctx.accessToken())) throw errors.missingParam("Application services must use type m.login.application_service");
-		rejectIfDelegated(hs);
-		if (!await hs.registrationAllowed()) throw errors.forbidden("Registration is disabled");
-		await ctx.rateLimit("register");
-		const localpart = body.username !== void 0 ? await validateNewUsername(hs, body.username.toLowerCase()) : await generateLocalpart(hs);
-		if (hs.appservices.exclusiveUserOwner(`@${localpart}:${hs.serverName}`)) throw errors.exclusive("This user ID is reserved by an application service");
-		if (body.password !== void 0) {
-			const problem = await hs.userAuth.validatePassword(body.password);
+	}));
+	r.client("POST", "/account/password", procedure({
+		input: passwordBody,
+		handler: async (ctx) => {
+			const hs = ctx.hs;
+			rejectIfDelegated(hs);
+			const body = ctx.input;
+			let s;
+			if (ctx.accessToken()) {
+				const session = await ctx.auth();
+				await requireUia(hs, body, [[M.LOGIN.PASSWORD]], session.userId);
+				s = {
+					userId: session.userId,
+					deviceId: session.deviceId
+				};
+			} else {
+				const { threepids } = await requireUia(hs, body, [[M.LOGIN.EMAIL.IDENTITY], [M.LOGIN.MSISDN]], null);
+				const owner = threepids.length ? await hs.threepids.userFor(threepids[0].medium, threepids[0].address) : null;
+				if (!owner) throw new MatrixError(400, "M_THREEPID_NOT_FOUND", "No account uses this address");
+				s = {
+					userId: owner,
+					deviceId: null
+				};
+			}
+			if (!body.new_password) throw errors.missingParam("Missing new_password");
+			const problem = await hs.userAuth.validatePassword(body.new_password);
 			if (problem) throw new MatrixError(400, "M_WEAK_PASSWORD", problem);
+			await hs.db.update("users", [{
+				field: "user_id",
+				value: s.userId
+			}], { password_hash: await hs.userAuth.hashPassword(body.new_password) });
+			await hs.audit.record({
+				action: "password_change",
+				actor: s.userId,
+				ip: ctx.ip,
+				details: { logout_devices: body.logout_devices !== false }
+			});
+			if (body.logout_devices !== false) await hs.auth.deleteAllDevices(s.userId, s.deviceId ?? void 0);
+			return {};
 		}
-		const flows = await registrationFlows(hs);
-		const { threepids } = await requireUia(hs, body, flows, null);
-		await consumeRegistrationToken(hs, body);
-		if (await hs.db.findOne("users", [{
-			field: "localpart",
-			value: localpart
-		}])) throw errors.userInUse();
-		const userId = await createUser(hs, localpart, { password: body.password });
-		for (const t of threepids) await hs.threepids.add(userId, t).catch((err) => hs.logger.warn("Could not attach", t.medium, "to", userId, err));
-		await hs.audit.record({
-			action: "register",
-			actor: userId,
-			ip: ctx.ip,
-			userAgent: ctx.request.headers.get("user-agent"),
-			details: { token: body.auth?.type === "m.login.registration_token" }
-		});
-		if (body.inhibit_login === true) return {
-			user_id: userId,
-			home_server: hs.serverName
-		};
-		return {
-			...await hs.auth.createSession(userId, {
-				deviceId: body.device_id,
-				displayName: body.initial_device_display_name,
-				refreshToken: body.refresh_token === true
-			}),
-			home_server: hs.serverName
-		};
-	});
-	r.client("POST", "/account/password", { input: passwordBody }, async (ctx) => {
-		const hs = ctx.hs;
-		rejectIfDelegated(hs);
-		const body = ctx.input;
-		let s;
-		if (ctx.accessToken()) {
-			const session = await ctx.auth();
-			await requireUia(hs, body, [["m.login.password"]], session.userId);
-			s = {
-				userId: session.userId,
-				deviceId: session.deviceId
-			};
-		} else {
-			const { threepids } = await requireUia(hs, body, [["m.login.email.identity"], ["m.login.msisdn"]], null);
-			const owner = threepids.length ? await hs.threepids.userFor(threepids[0].medium, threepids[0].address) : null;
-			if (!owner) throw new MatrixError(400, "M_THREEPID_NOT_FOUND", "No account uses this address");
-			s = {
-				userId: owner,
-				deviceId: null
-			};
+	}));
+	r.client("POST", "/account/deactivate", procedure({
+		input: body({}),
+		handler: async (ctx) => {
+			const hs = ctx.hs;
+			rejectIfDelegated(hs);
+			const s = await ctx.auth();
+			await requireUia(hs, ctx.input, [[M.LOGIN.PASSWORD]], s.userId);
+			for (const membership of [
+				"join",
+				"invite",
+				"knock"
+			]) for (const roomId of await hs.rooms.roomsForUser(s.userId, membership)) try {
+				await hs.rooms.setMembership(roomId, s.userId, s.userId, "leave");
+			} catch {}
+			await hs.auth.deleteAllDevices(s.userId);
+			await hs.db.update("users", [{
+				field: "user_id",
+				value: s.userId
+			}], {
+				deactivated: true,
+				password_hash: null,
+				displayname: null,
+				avatar_url: null
+			});
+			await hs.db.delete("profile_fields", [{
+				field: "user_id",
+				value: s.userId
+			}]);
+			const unbind = await hs.threepids.removeAll(s.userId);
+			await hs.audit.record({
+				action: "deactivate",
+				actor: s.userId,
+				target: s.userId,
+				ip: ctx.ip
+			});
+			return { id_server_unbind_result: unbind };
 		}
-		if (!body.new_password) throw errors.missingParam("Missing new_password");
-		const problem = await hs.userAuth.validatePassword(body.new_password);
-		if (problem) throw new MatrixError(400, "M_WEAK_PASSWORD", problem);
-		await hs.db.update("users", [{
-			field: "user_id",
-			value: s.userId
-		}], { password_hash: await hs.userAuth.hashPassword(body.new_password) });
-		await hs.audit.record({
-			action: "password_change",
-			actor: s.userId,
-			ip: ctx.ip,
-			details: { logout_devices: body.logout_devices !== false }
-		});
-		if (body.logout_devices !== false) await hs.auth.deleteAllDevices(s.userId, s.deviceId ?? void 0);
-		return {};
-	});
-	r.client("POST", "/account/deactivate", { input: body({}) }, async (ctx) => {
-		const hs = ctx.hs;
-		rejectIfDelegated(hs);
-		const s = await ctx.auth();
-		await requireUia(hs, ctx.input, [["m.login.password"]], s.userId);
-		for (const membership of [
-			"join",
-			"invite",
-			"knock"
-		]) for (const roomId of await hs.rooms.roomsForUser(s.userId, membership)) try {
-			await hs.rooms.setMembership(roomId, s.userId, s.userId, "leave");
-		} catch {}
-		await hs.auth.deleteAllDevices(s.userId);
-		await hs.db.update("users", [{
-			field: "user_id",
-			value: s.userId
-		}], {
-			deactivated: true,
-			password_hash: null,
-			displayname: null,
-			avatar_url: null
-		});
-		await hs.db.delete("profile_fields", [{
-			field: "user_id",
-			value: s.userId
-		}]);
-		const unbind = await hs.threepids.removeAll(s.userId);
-		await hs.audit.record({
-			action: "deactivate",
-			actor: s.userId,
-			target: s.userId,
-			ip: ctx.ip
-		});
-		return { id_server_unbind_result: unbind };
-	});
-	r.get("/_synapse/admin/v1/register", async (ctx) => {
+	}));
+	r.get("/_synapse/admin/v1/register", procedure({ handler: async (ctx) => {
 		if (!ctx.hs.config.registrationSharedSecret) throw errors.unrecognized();
 		const nonce = randomString(32);
 		await ctx.hs.cluster.set(`regnonce:${nonce}`, true, 6e4);
 		return { nonce };
-	});
-	r.post("/_synapse/admin/v1/register", { input: sharedSecretRegisterBody }, async (ctx) => {
-		const hs = ctx.hs;
-		const secret = hs.config.registrationSharedSecret;
-		if (!secret) throw errors.unrecognized();
-		const body = ctx.input;
-		if (body.nonce === void 0 || !await hs.cluster.get(`regnonce:${body.nonce}`)) throw errors.unknown("Unrecognised nonce");
-		await hs.cluster.delete(`regnonce:${body.nonce}`);
-		const admin = body.admin === true;
-		const expected = createHmac("sha1", secret).update(`${body.nonce}\u0000${body.username}\u0000${body.password}\u0000${admin ? "admin" : "notadmin"}`).digest("hex");
-		const given = Buffer.from(body.mac ?? "", "utf8");
-		if (given.length !== expected.length || !timingSafeEqual(given, Buffer.from(expected, "utf8"))) throw errors.forbidden("HMAC incorrect");
-		const userId = await createUser(hs, await validateNewUsername(hs, body.username.toLowerCase()), {
-			password: body.password,
-			admin,
-			displayname: body.displayname
-		});
-		const session = await hs.auth.createSession(userId);
-		await hs.audit.record({
-			action: "register",
-			actor: "server",
-			target: userId,
-			ip: ctx.ip,
-			details: {
-				shared_secret: true,
-				admin
-			}
-		});
-		return {
-			...session,
-			home_server: hs.serverName
-		};
-	});
+	} }));
+	r.post("/_synapse/admin/v1/register", procedure({
+		input: sharedSecretRegisterBody,
+		handler: async (ctx) => {
+			const hs = ctx.hs;
+			const secret = hs.config.registrationSharedSecret;
+			if (!secret) throw errors.unrecognized();
+			const body = ctx.input;
+			if (body.nonce === void 0 || !await hs.cluster.get(`regnonce:${body.nonce}`)) throw errors.unknown("Unrecognised nonce");
+			await hs.cluster.delete(`regnonce:${body.nonce}`);
+			const admin = body.admin === true;
+			const expected = createHmac("sha1", secret).update(`${body.nonce}\u0000${body.username}\u0000${body.password}\u0000${admin ? "admin" : "notadmin"}`).digest("hex");
+			const given = Buffer.from(body.mac ?? "", "utf8");
+			if (given.length !== expected.length || !timingSafeEqual(given, Buffer.from(expected, "utf8"))) throw errors.forbidden("HMAC incorrect");
+			const userId = await createUser(hs, await validateNewUsername(hs, body.username.toLowerCase()), {
+				password: body.password,
+				admin,
+				displayname: body.displayname
+			});
+			const session = await hs.auth.createSession(userId);
+			await hs.audit.record({
+				action: "register",
+				actor: "server",
+				target: userId,
+				ip: ctx.ip,
+				details: {
+					shared_secret: true,
+					admin
+				}
+			});
+			return {
+				...session,
+				home_server: hs.serverName
+			};
+		}
+	}));
 }
 async function registrationFlows(hs) {
-	if (hs.adminRoom?.options.firstUserCanRegister && await hs.adminRoom.noUsersYet()) return [["m.login.dummy"]];
-	const base = await hs.registrationMode() === "token" ? ["m.login.registration_token"] : ["m.login.dummy"];
+	if (hs.adminRoom?.options.firstUserCanRegister && await hs.adminRoom.noUsersYet()) return [[M.LOGIN.DUMMY]];
+	const base = await hs.registrationMode() === "token" ? [M.LOGIN.REGISTRATION_TOKEN] : [M.LOGIN.DUMMY];
 	if (!hs.threepids.canValidate("email")) return [base];
-	const withEmail = [...base.filter((s) => s !== "m.login.dummy"), "m.login.email.identity"];
+	const withEmail = [...base.filter((s) => s !== M.LOGIN.DUMMY), M.LOGIN.EMAIL.IDENTITY];
 	return hs.config.threepid.requireEmailForRegistration ? [withEmail] : [base, withEmail];
 }
 async function registrationTokenValid(hs, token) {
@@ -539,7 +592,7 @@ async function registrationTokenValid(hs, token) {
 	return row.uses_allowed === null || row.completed < row.uses_allowed;
 }
 async function consumeRegistrationToken(hs, body) {
-	if (body.auth?.type !== "m.login.registration_token") return;
+	if (body.auth?.type !== M.LOGIN.REGISTRATION_TOKEN) return;
 	const token = body.auth?.token;
 	const row = await hs.db.findOne("registration_tokens", [{
 		field: "token",
@@ -552,8 +605,8 @@ async function consumeRegistrationToken(hs, body) {
 }
 function wellKnown(hs) {
 	if (!hs.config.publicBaseUrl) return null;
-	const wk = { "m.homeserver": { base_url: hs.config.publicBaseUrl } };
-	if (hs.config.rtc.transports?.length) wk["org.matrix.msc4143.rtc_foci"] = hs.config.rtc.transports;
+	const wk = { [M.HOMESERVER]: { base_url: hs.config.publicBaseUrl } };
+	if (hs.config.rtc.transports?.length) wk[UNSTABLE.ORG.MATRIX.MSC4143.RTC_FOCI] = hs.config.rtc.transports;
 	return wk;
 }
 //#endregion