matrix-nodejs-homeserver 0.2.0 → 0.3.2

package/dist/api/legacy.js

@@ -1,6 +1,7 @@
 import { toClientEvent } from "../core/events.js";
 import { errors } from "../core/errors.js";
 import { isValidRoomId } from "../core/ids.js";
+import { procedure } from "../http/procedure.js";
 import { paginate, visibleState } from "./rooms.js";
 //#region src/api/legacy.ts
 const viewerOf = (s) => ({
@@ -83,88 +84,100 @@ async function eventsSince(hs, s, roomIds, from, limit) {
 	return all.sort((a, b) => a.stream - b.stream).slice(0, limit);
 }
 function registerLegacyRoutes(r) {
-	r.client("GET", "/initialSync", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 0), 100);
-		const memberships = [
-			"join",
-			"invite",
-			...ctx.query.get("archived") === "true" ? ["leave", "ban"] : []
-		];
-		const rooms = [];
-		for (const membership of memberships) for (const roomId of await hs.rooms.roomsForUser(s.userId, membership)) {
-			if (membership === "invite") {
-				const invite = await hs.rooms.membershipEvent(roomId, s.userId);
-				rooms.push({
-					room_id: roomId,
-					membership,
-					...invite ? { invite: hs.rooms.formatEvent(invite, viewerOf(s)) } : {}
-				});
-				continue;
+	r.client("GET", "/initialSync", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 0), 100);
+			const memberships = [
+				"join",
+				"invite",
+				...ctx.query.get("archived") === "true" ? ["leave", "ban"] : []
+			];
+			const rooms = [];
+			for (const membership of memberships) for (const roomId of await hs.rooms.roomsForUser(s.userId, membership)) {
+				if (membership === "invite") {
+					const invite = await hs.rooms.membershipEvent(roomId, s.userId);
+					rooms.push({
+						room_id: roomId,
+						membership,
+						...invite ? { invite: hs.rooms.formatEvent(invite, viewerOf(s)) } : {}
+					});
+					continue;
+				}
+				try {
+					rooms.push(await roomInfo(hs, s, roomId, limit));
+				} catch {}
 			}
-			try {
-				rooms.push(await roomInfo(hs, s, roomId, limit));
-			} catch {}
+			const account = await hs.db.findMany("account_data", { where: [{
+				field: "user_id",
+				value: s.userId
+			}, {
+				field: "room_id",
+				value: ""
+			}] });
+			return {
+				end: `s${await hs.streams.position()}`,
+				rooms,
+				presence: [],
+				account_data: account.map((a) => ({
+					type: a.type,
+					content: a.content
+				}))
+			};
 		}
-		const account = await hs.db.findMany("account_data", { where: [{
-			field: "user_id",
-			value: s.userId
-		}, {
-			field: "room_id",
-			value: ""
-		}] });
-		return {
-			end: `s${await hs.streams.position()}`,
-			rooms,
-			presence: [],
-			account_data: account.map((a) => ({
-				type: a.type,
-				content: a.content
-			}))
-		};
-	});
-	r.client("GET", "/rooms/:roomId/initialSync", async (ctx) => {
-		const s = await ctx.auth();
-		if (!isValidRoomId(ctx.params.roomId)) throw errors.invalidParam("Invalid room ID");
-		const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 0), 100);
-		return roomInfo(ctx.hs, s, ctx.params.roomId, limit);
-	});
-	r.client("GET", "/events/:eventId", async (ctx) => {
-		const s = await ctx.auth();
-		const ev = await ctx.hs.rooms.getEvent(ctx.params.eventId);
-		if (!ev || !(await ctx.hs.rooms.filterVisible(s.userId, ev.pdu.room_id, [ev])).length) throw errors.notFound("Event not found");
-		return ctx.hs.rooms.formatEvent(ev, viewerOf(s), { includeRoomId: true });
-	});
-	r.client("GET", "/events", async (ctx) => {
-		const s = await ctx.auth();
-		const hs = ctx.hs;
-		const now = await hs.streams.position();
-		const from = parseStreamToken(ctx.query.get("from"), now);
-		const timeout = Math.min(Math.max(Number(ctx.query.get("timeout") ?? 3e4) || 0, 0), hs.config.maxSyncTimeoutMs);
-		const peekRoom = ctx.query.get("room_id");
-		let roomIds;
-		if (peekRoom !== null) {
-			if (!isValidRoomId(peekRoom)) throw errors.invalidParam("Invalid room ID");
-			const { joined, worldReadable } = await hs.rooms.canPeek(peekRoom, s.userId);
-			if (!joined && !worldReadable) throw errors.forbidden("You cannot peek into this room");
-			roomIds = [peekRoom];
-		} else roomIds = await hs.rooms.roomsForUser(s.userId);
-		const deadline = Date.now() + timeout;
-		for (;;) {
-			const events = await eventsSince(hs, s, roomIds, from, 100);
-			const remaining = deadline - Date.now();
-			if (events.length || remaining <= 0 || ctx.request.signal.aborted) {
-				const end = events.length ? events[events.length - 1].stream : Math.max(from, await hs.streams.position());
-				return {
-					start: `s${from}`,
-					end: `s${end}`,
-					chunk: events.map((e) => hs.rooms.formatEvent(e, viewerOf(s), { includeRoomId: true }))
-				};
+	}));
+	r.client("GET", "/rooms/:roomId/initialSync", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (!isValidRoomId(ctx.params.roomId)) throw errors.invalidParam("Invalid room ID");
+			const limit = Math.min(Math.max(Number.parseInt(ctx.query.get("limit") ?? "10", 10) || 10, 0), 100);
+			return roomInfo(ctx.hs, s, ctx.params.roomId, limit);
+		}
+	}));
+	r.client("GET", "/events/:eventId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const ev = await ctx.hs.rooms.getEvent(ctx.params.eventId);
+			if (!ev || !(await ctx.hs.rooms.filterVisible(s.userId, ev.pdu.room_id, [ev])).length) throw errors.notFound("Event not found");
+			return ctx.hs.rooms.formatEvent(ev, viewerOf(s), { includeRoomId: true });
+		}
+	}));
+	r.client("GET", "/events", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const hs = ctx.hs;
+			const now = await hs.streams.position();
+			const from = parseStreamToken(ctx.query.get("from"), now);
+			const timeout = Math.min(Math.max(Number(ctx.query.get("timeout") ?? 3e4) || 0, 0), hs.config.maxSyncTimeoutMs);
+			const peekRoom = ctx.query.get("room_id");
+			let roomIds;
+			if (peekRoom !== null) {
+				if (!isValidRoomId(peekRoom)) throw errors.invalidParam("Invalid room ID");
+				const { joined, worldReadable } = await hs.rooms.canPeek(peekRoom, s.userId);
+				if (!joined && !worldReadable) throw errors.forbidden("You cannot peek into this room");
+				roomIds = [peekRoom];
+			} else roomIds = await hs.rooms.roomsForUser(s.userId);
+			const deadline = Date.now() + timeout;
+			for (;;) {
+				const events = await eventsSince(hs, s, roomIds, from, 100);
+				const remaining = deadline - Date.now();
+				if (events.length || remaining <= 0 || ctx.request.signal.aborted) {
+					const end = events.length ? events[events.length - 1].stream : Math.max(from, await hs.streams.position());
+					return {
+						start: `s${from}`,
+						end: `s${end}`,
+						chunk: events.map((e) => hs.rooms.formatEvent(e, viewerOf(s), { includeRoomId: true }))
+					};
+				}
+				await Promise.race([hs.notifier.wait(s.userId, remaining, ctx.request.signal), new Promise((resolve) => setTimeout(resolve, Math.min(remaining, peekRoom !== null ? 1e3 : remaining)).unref?.())]);
 			}
-			await Promise.race([hs.notifier.wait(s.userId, remaining, ctx.request.signal), new Promise((resolve) => setTimeout(resolve, Math.min(remaining, peekRoom !== null ? 1e3 : remaining)).unref?.())]);
 		}
-	});
+	}));
 }
 //#endregion
 export { registerLegacyRoutes };

package/dist/api/media.js

@@ -1,5 +1,7 @@
 import { randomString } from "../core/crypto.js";
+import { M } from "../core/m.js";
 import { MatrixError, errors } from "../core/errors.js";
+import { procedure } from "../http/procedure.js";
 //#region src/api/media.ts
 const DEFAULT_MAX_UPLOAD = 52428800;
 const INLINE_TYPES = /^(image\/(png|jpeg|gif|webp|avif|apng)|video\/(mp4|webm|ogg)|audio\/(mpeg|ogg|wav|webm|mp4|aac|flac)|text\/plain)$/;
@@ -51,7 +53,7 @@ async function remoteMedia(ctx) {
 	}
 	let fetched;
 	try {
-		fetched = await hs.federation.fetchMedia(serverName, mediaId);
+		fetched = await hs.federation.fetchMedia(serverName, mediaId, maxUpload(hs));
 	} catch (err) {
 		if (err instanceof MatrixError) throw err;
 		throw new MatrixError(502, "M_UNKNOWN", "Could not fetch remote media");
@@ -183,19 +185,25 @@ async function thumbnail(ctx) {
 	});
 }
 function registerMediaRoutes(r) {
-	const config = (ctx) => ({ "m.upload.size": maxUpload(ctx.hs) });
-	r.get("/_matrix/media/v3/config", async (ctx) => {
-		await ctx.auth();
-		return config(ctx);
-	});
-	r.get("/_matrix/media/r0/config", async (ctx) => {
-		await ctx.auth();
-		return config(ctx);
-	});
-	r.get("/_matrix/client/v1/media/config", async (ctx) => {
-		await ctx.auth();
-		return config(ctx);
-	});
+	const config = (ctx) => ({ [M.UPLOAD.SIZE]: maxUpload(ctx.hs) });
+	r.get("/_matrix/media/v3/config", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			return config(ctx);
+		}
+	}));
+	r.get("/_matrix/media/r0/config", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			return config(ctx);
+		}
+	}));
+	r.get("/_matrix/client/v1/media/config", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			return config(ctx);
+		}
+	}));
 	const upload = async (ctx) => {
 		await ctx.auth();
 		await ctx.rateLimit("upload");
@@ -203,53 +211,61 @@ function registerMediaRoutes(r) {
 		await storeUpload(ctx, mediaId);
 		return { content_uri: `mxc://${ctx.hs.serverName}/${mediaId}` };
 	};
-	r.post("/_matrix/media/v3/upload", upload);
-	r.post("/_matrix/media/r0/upload", upload);
-	r.post("/_matrix/media/v1/create", async (ctx) => {
-		const s = await ctx.auth();
-		const mediaId = randomString(24);
-		await ctx.hs.db.create("media", {
-			media_id: mediaId,
-			content_type: null,
-			filename: null,
-			size: 0,
-			uploader: s.userId,
-			created_ts: Date.now(),
-			pending: true
-		});
-		return {
-			content_uri: `mxc://${ctx.hs.serverName}/${mediaId}`,
-			unused_expires_at: Date.now() + 864e5
-		};
-	});
-	r.put("/_matrix/media/v3/upload/:serverName/:mediaId", async (ctx) => {
-		const s = await ctx.auth();
-		if (ctx.params.serverName !== ctx.hs.serverName) throw errors.notFound("Unknown media");
-		const meta = await ctx.hs.db.findOne("media", [{
-			field: "media_id",
-			value: ctx.params.mediaId
-		}]);
-		if (!meta) throw errors.notFound("Unknown media");
-		if (meta.uploader !== s.userId) throw errors.forbidden("You did not create this media ID");
-		if (!meta.pending) throw new MatrixError(409, "M_CANNOT_OVERWRITE_MEDIA", "Media already uploaded");
-		await storeUpload(ctx, ctx.params.mediaId);
-		return {};
-	});
+	r.post("/_matrix/media/v3/upload", procedure({ handler: upload }));
+	r.post("/_matrix/media/r0/upload", procedure({ handler: upload }));
+	r.post("/_matrix/media/v1/create", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			const mediaId = randomString(24);
+			await ctx.hs.db.create("media", {
+				media_id: mediaId,
+				content_type: null,
+				filename: null,
+				size: 0,
+				uploader: s.userId,
+				created_ts: Date.now(),
+				pending: true
+			});
+			return {
+				content_uri: `mxc://${ctx.hs.serverName}/${mediaId}`,
+				unused_expires_at: Date.now() + 864e5
+			};
+		}
+	}));
+	r.put("/_matrix/media/v3/upload/:serverName/:mediaId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const s = ctx.session;
+			if (ctx.params.serverName !== ctx.hs.serverName) throw errors.notFound("Unknown media");
+			const meta = await ctx.hs.db.findOne("media", [{
+				field: "media_id",
+				value: ctx.params.mediaId
+			}]);
+			if (!meta) throw errors.notFound("Unknown media");
+			if (meta.uploader !== s.userId) throw errors.forbidden("You did not create this media ID");
+			if (!meta.pending) throw new MatrixError(409, "M_CANNOT_OVERWRITE_MEDIA", "Media already uploaded");
+			await storeUpload(ctx, ctx.params.mediaId);
+			return {};
+		}
+	}));
 	for (const prefix of ["/_matrix/media/v3", "/_matrix/media/r0"]) {
-		r.get(`${prefix}/download/:serverName/:mediaId`, download);
-		r.get(`${prefix}/download/:serverName/:mediaId/:fileName`, download);
-		r.get(`${prefix}/thumbnail/:serverName/:mediaId`, thumbnail);
+		r.get(`${prefix}/download/:serverName/:mediaId`, procedure({ handler: download }));
+		r.get(`${prefix}/download/:serverName/:mediaId/:fileName`, procedure({ handler: download }));
+		r.get(`${prefix}/thumbnail/:serverName/:mediaId`, procedure({ handler: thumbnail }));
 	}
 	const authed = async (ctx) => {
 		await ctx.auth();
 		return download(ctx);
 	};
-	r.get("/_matrix/client/v1/media/download/:serverName/:mediaId", authed);
-	r.get("/_matrix/client/v1/media/download/:serverName/:mediaId/:fileName", authed);
-	r.get("/_matrix/client/v1/media/thumbnail/:serverName/:mediaId", async (ctx) => {
-		await ctx.auth();
-		return thumbnail(ctx);
-	});
+	r.get("/_matrix/client/v1/media/download/:serverName/:mediaId", procedure({ handler: authed }));
+	r.get("/_matrix/client/v1/media/download/:serverName/:mediaId/:fileName", procedure({ handler: authed }));
+	r.get("/_matrix/client/v1/media/thumbnail/:serverName/:mediaId", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			return thumbnail(ctx);
+		}
+	}));
 }
 //#endregion
 export { registerMediaRoutes };

package/dist/api/misc.js

@@ -1,9 +1,13 @@
 import { signJson } from "../core/crypto.js";
+import { M, UNSTABLE } from "../core/m.js";
 import { SUPPORTED_ROOM_VERSIONS } from "../core/events.js";
 import { errors } from "../core/errors.js";
+import { procedure } from "../http/procedure.js";
 import { wellKnown } from "./account.js";
 import { canonicalJsonResponse } from "../http/handler.js";
+import { readFileSync } from "node:fs";
 //#region src/api/misc.ts
+const PACKAGE = JSON.parse(readFileSync(new URL("../../package.json", import.meta.url), "utf8"));
 const SPEC_VERSIONS = [
 	"r0.0.1",
 	"r0.1.0",
@@ -26,48 +30,50 @@ const SPEC_VERSIONS = [
 	"v1.11"
 ];
 function registerMiscRoutes(r) {
-	r.get("/_matrix/client/versions", () => ({
+	r.get("/_matrix/client/versions", procedure({ handler: () => ({
 		versions: SPEC_VERSIONS,
 		unstable_features: {
-			"org.matrix.simplified_msc3575": true,
-			"org.matrix.msc3916.stable": true,
-			"org.matrix.msc4140": true,
-			"org.matrix.msc4143": true,
-			"org.matrix.msc4222": true,
-			"org.matrix.msc4306": true
+			[UNSTABLE.ORG.MATRIX.SIMPLIFIED_MSC3575]: true,
+			[UNSTABLE.ORG.MATRIX.MSC3916.STABLE]: true,
+			[UNSTABLE.ORG.MATRIX.MSC4140._]: true,
+			[UNSTABLE.ORG.MATRIX.MSC4143._]: true,
+			[UNSTABLE.ORG.MATRIX.MSC4222._]: true,
+			[UNSTABLE.ORG.MATRIX.MSC4306]: true
 		}
-	}));
-	r.get("/.well-known/matrix/client", (ctx) => {
+	}) }));
+	r.get("/.well-known/matrix/client", procedure({ handler: (ctx) => {
 		const wk = wellKnown(ctx.hs);
 		if (!wk) throw errors.notFound("No well-known configured");
 		return wk;
-	});
-	r.get("/.well-known/matrix/server", (ctx) => {
+	} }));
+	r.get("/.well-known/matrix/server", procedure({ handler: (ctx) => {
 		if (!ctx.hs.config.federationAddress) throw errors.notFound("No delegation configured");
-		return { "m.server": ctx.hs.config.federationAddress };
-	});
-	r.get("/.well-known/matrix/support", (ctx) => {
+		return { [M.SERVER]: ctx.hs.config.federationAddress };
+	} }));
+	r.get("/.well-known/matrix/support", procedure({ handler: (ctx) => {
 		if (!ctx.hs.config.support) throw errors.notFound("No support information configured");
 		return ctx.hs.config.support;
-	});
-	r.client("GET", "/capabilities", async (ctx) => {
-		await ctx.auth();
-		const available = {};
-		for (const v of SUPPORTED_ROOM_VERSIONS) available[v] = /^\d+$/.test(v) ? "stable" : "unstable";
-		return { capabilities: {
-			"m.change_password": { enabled: !ctx.hs.oauth && ctx.hs.userAuth.passwordLoginEnabled },
-			"m.room_versions": {
-				default: ctx.hs.config.defaultRoomVersion,
-				available
-			},
-			"m.set_displayname": { enabled: true },
-			"m.set_avatar_url": { enabled: true },
-			"m.profile_fields": { enabled: true },
-			"m.3pid_changes": { enabled: ctx.hs.threepids.enabled && !ctx.hs.oauth },
-			"m.get_login_token": { enabled: ctx.hs.config.loginViaExistingSession && !ctx.hs.oauth }
-		} };
-	});
-	r.get("/_matrix/key/v2/server", (ctx) => {
+	} }));
+	r.client("GET", "/capabilities", procedure({
+		auth: "user",
+		handler: async (ctx) => {
+			const available = {};
+			for (const v of SUPPORTED_ROOM_VERSIONS) available[v] = /^\d+$/.test(v) ? "stable" : "unstable";
+			return { capabilities: {
+				[M.CHANGE_PASSWORD]: { enabled: !ctx.hs.oauth && ctx.hs.userAuth.passwordLoginEnabled },
+				[M.ROOM_VERSIONS]: {
+					default: ctx.hs.config.defaultRoomVersion,
+					available
+				},
+				[M.SET_DISPLAYNAME]: { enabled: true },
+				[M.SET_AVATAR_URL]: { enabled: true },
+				[M.PROFILE_FIELDS]: { enabled: true },
+				[M.THREEPID_CHANGES]: { enabled: ctx.hs.threepids.enabled && !ctx.hs.oauth },
+				[M.GET_LOGIN_TOKEN]: { enabled: ctx.hs.config.loginViaExistingSession && !ctx.hs.oauth }
+			} };
+		}
+	}));
+	r.get("/_matrix/key/v2/server", procedure({ handler: (ctx) => {
 		const hs = ctx.hs;
 		const key = hs.signingKey;
 		return canonicalJsonResponse(signJson({
@@ -76,10 +82,13 @@ function registerMiscRoutes(r) {
 			verify_keys: { [`ed25519:${key.keyId}`]: { key: key.publicKeyBase64 } },
 			old_verify_keys: {}
 		}, hs.serverName, key));
-	});
-	r.get("/_matrix/federation/v1/version", () => ({ server: {
-		name: "matrix-nodejs-homeserver",
-		version: "0.1.0"
+	} }));
+	r.get("/_matrix/federation/v1/version", procedure({ handler: (ctx) => {
+		if (!ctx.hs.federation.enabled) throw errors.unrecognized("Federation is disabled");
+		return { server: {
+			name: PACKAGE.name,
+			version: PACKAGE.version
+		} };
 	} }));
 }
 //#endregion

package/dist/api/preview.js

@@ -1,39 +1,9 @@
 import { randomString } from "../core/crypto.js";
-import { errors } from "../core/errors.js";
-import { lookup } from "node:dns/promises";
-import { BlockList, isIP } from "node:net";
+import { MatrixError, errors } from "../core/errors.js";
+import { publicGet } from "../core/outbound.js";
+import { procedure } from "../http/procedure.js";
 //#region src/api/preview.ts
 const MAX_BYTES = 1048576;
-const privateRanges = new BlockList();
-for (const [net, prefix] of [
-	["0.0.0.0", 8],
-	["10.0.0.0", 8],
-	["100.64.0.0", 10],
-	["127.0.0.0", 8],
-	["169.254.0.0", 16],
-	["172.16.0.0", 12],
-	["192.0.0.0", 24],
-	["192.168.0.0", 16],
-	["198.18.0.0", 15],
-	["224.0.0.0", 4],
-	["240.0.0.0", 4]
-]) privateRanges.addSubnet(net, prefix, "ipv4");
-for (const [net, prefix] of [
-	["::", 128],
-	["::1", 128],
-	["fc00::", 7],
-	["fe80::", 10],
-	["ff00::", 8],
-	["::ffff:0:0", 96]
-]) privateRanges.addSubnet(net, prefix, "ipv6");
-async function assertPublicHost(hostname) {
-	const host = hostname.replace(/^\[|\]$/g, "");
-	const addresses = isIP(host) ? [{
-		address: host,
-		family: isIP(host)
-	}] : await lookup(host, { all: true });
-	for (const { address, family } of addresses) if (privateRanges.check(address, family === 6 ? "ipv6" : "ipv4")) throw errors.forbidden("URL resolves to a private address");
-}
 function decodeEntities(s) {
 	return s.replace(/&(amp|lt|gt|quot|#39|#x27);/g, (m) => ({
 		"&": "&",
@@ -71,42 +41,37 @@ async function preview(hs, rawUrl) {
 		throw errors.invalidParam("Invalid URL");
 	}
 	if (url.protocol !== "http:" && url.protocol !== "https:") throw errors.invalidParam("Only http(s) URLs can be previewed");
-	for (let redirects = 0; redirects < 5; redirects++) {
-		if (!opts.allowPrivateAddresses) await assertPublicHost(url.hostname);
-		const res = await fetch(url, {
-			redirect: "manual",
-			signal: AbortSignal.timeout(1e4),
-			headers: { "user-agent": "matrix-nodejs-homeserver" }
-		});
-		if (res.status >= 300 && res.status < 400 && res.headers.get("location")) {
-			url = new URL(res.headers.get("location"), url);
-			continue;
-		}
-		if (!res.ok || !res.body) throw errors.notFound("Could not fetch URL");
-		const type = res.headers.get("content-type") ?? "";
-		if (type.startsWith("image/")) return {
-			...await storeImage(hs, res, type),
-			"og:url": url.href
+	const get = opts.allowPrivateAddresses ? hs.fetch : hs.publicFetch;
+	const headers = { "user-agent": "matrix-nodejs-homeserver" };
+	const res = await publicGet(get, url, {
+		maxBytes: MAX_BYTES * 10,
+		truncate: true,
+		timeoutMs: 1e4,
+		headers
+	}).catch((err) => {
+		throw err instanceof MatrixError ? err : errors.notFound("Could not fetch URL");
+	});
+	if (res.status !== 200) throw errors.notFound("Could not fetch URL");
+	const type = res.headers.get("content-type") ?? "";
+	if (type.startsWith("image/")) {
+		if (res.body.length >= MAX_BYTES * 10) return {};
+		return {
+			...await storeImage(hs, res.body, type),
+			"og:url": res.url.href
 		};
-		if (!type.includes("html")) return {};
-		let size = 0;
-		const chunks = [];
-		for await (const chunk of res.body) {
-			size += chunk.length;
-			if (size > MAX_BYTES) break;
-			chunks.push(chunk);
-		}
-		const og = parseOpenGraph(Buffer.concat(chunks).toString("utf8"));
-		if (og["og:image"]) try {
-			const imageUrl = new URL(og["og:image"], url);
-			if (!opts.allowPrivateAddresses) await assertPublicHost(imageUrl.hostname);
-			const img = await fetch(imageUrl, { signal: AbortSignal.timeout(1e4) });
-			const imgType = img.headers.get("content-type") ?? "";
-			if (img.ok && imgType.startsWith("image/")) Object.assign(og, await storeImage(hs, img, imgType));
-		} catch {}
-		return og;
 	}
-	throw errors.notFound("Too many redirects");
+	if (!type.includes("html")) return {};
+	const og = parseOpenGraph(res.body.subarray(0, MAX_BYTES).toString("utf8"));
+	if (og["og:image"]) try {
+		const img = await publicGet(get, new URL(og["og:image"], res.url), {
+			maxBytes: MAX_BYTES * 10,
+			timeoutMs: 1e4,
+			headers
+		});
+		const imgType = img.headers.get("content-type") ?? "";
+		if (img.status === 200 && imgType.startsWith("image/")) Object.assign(og, await storeImage(hs, img.body, imgType));
+	} catch {}
+	return og;
 }
 /** Read width/height from PNG, GIF, JPEG or WebP headers. */
 function imageSize(data) {
@@ -156,9 +121,8 @@ function imageSize(data) {
 	return null;
 }
 /** Store a fetched image in the media repository and describe it for a preview. */
-async function storeImage(hs, res, type) {
-	const data = new Uint8Array(await res.arrayBuffer());
-	if (data.length > MAX_BYTES * 10) return {};
+async function storeImage(hs, body, type) {
+	const data = new Uint8Array(body);
 	const mediaId = randomString(24);
 	await hs.media.put(mediaId, data, {
 		contentType: type,
@@ -192,9 +156,9 @@ function registerPreviewRoutes(r) {
 		if (!url) throw errors.missingParam("Missing url");
 		return preview(ctx.hs, url);
 	};
-	r.get("/_matrix/media/v3/preview_url", handler);
-	r.get("/_matrix/media/r0/preview_url", handler);
-	r.get("/_matrix/client/v1/media/preview_url", handler);
+	r.get("/_matrix/media/v3/preview_url", procedure({ handler }));
+	r.get("/_matrix/media/r0/preview_url", procedure({ handler }));
+	r.get("/_matrix/client/v1/media/preview_url", procedure({ handler }));
 }
 //#endregion
 export { imageSize, parseOpenGraph, registerPreviewRoutes };