matrix-nodejs-homeserver 0.3.1 → 0.3.2

package/dist/core/json.js

@@ -1,4 +1,13 @@
 //#region src/core/json.ts
+function byCodePoint(a, b) {
+	for (let i = 0; i < a.length && i < b.length;) {
+		const ca = a.codePointAt(i);
+		const cb = b.codePointAt(i);
+		if (ca !== cb) return ca - cb;
+		i += ca > 65535 ? 2 : 1;
+	}
+	return a.length - b.length;
+}
 /** Matrix canonical JSON: sorted keys, no whitespace, UTF-8, integers only. */
 function canonicalJson(value) {
 	if (value === null || typeof value !== "object") {
@@ -7,7 +16,7 @@ function canonicalJson(value) {
 	}
 	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
 	const obj = value;
-	return `{${Object.keys(obj).filter((k) => obj[k] !== void 0).sort().map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
+	return `{${Object.keys(obj).filter((k) => obj[k] !== void 0).sort(byCodePoint).map((k) => `${JSON.stringify(k)}:${canonicalJson(obj[k])}`).join(",")}}`;
 }
 function isObject(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);

package/dist/core/keys.d.ts

@@ -1,3 +1,4 @@
+import { Row } from "../storage/types.js";
 import { Homeserver } from "../homeserver.js";
 //#region src/core/keys.d.ts
 /** End-to-end encryption key storage (device keys, one-time keys, cross-signing). */
@@ -28,7 +29,15 @@ export declare class KeyService {
   uploadCrossSigning(userId: string, body: Record<string, any>): Promise<void>;
   uploadSignatures(signer: string, body: Record<string, any>): Promise<Record<string, any>>;
   /** Users (sharing a room with `userId`) whose device lists changed after `since`. */
-  changesSince(userId: string, since: number, upTo: number): Promise<{
+  /**
+   * Device-list changes for /sync and /keys/changes. /sync passes what it has already read (the
+   * membership changes, the device-list rows, the user's joined rooms) to save the queries.
+   */
+  changesSince(userId: string, since: number, upTo: number, known?: {
+    memberChanges?: Row[];
+    deviceRows?: Row[];
+    joinedRooms?: string[];
+  }): Promise<{
     changed: string[];
     left: string[];
   }>;

package/dist/core/keys.js

@@ -99,39 +99,45 @@ var KeyService = class {
 		return this.oneTimeKeyCounts(userId, deviceId);
 	}
 	async oneTimeKeyCounts(userId, deviceId) {
-		const rows = await this.hs.db.findMany("one_time_keys", { where: [
-			{
-				field: "user_id",
-				value: userId
-			},
-			{
-				field: "device_id",
-				value: deviceId
-			},
-			{
-				field: "fallback",
-				value: false
-			}
-		] });
+		const rows = await this.hs.db.findMany("one_time_keys", {
+			where: [
+				{
+					field: "user_id",
+					value: userId
+				},
+				{
+					field: "device_id",
+					value: deviceId
+				},
+				{
+					field: "fallback",
+					value: false
+				}
+			],
+			fields: ["algorithm"]
+		});
 		const counts = { signed_curve25519: 0 };
 		for (const r of rows) counts[r.algorithm] = (counts[r.algorithm] ?? 0) + 1;
 		return counts;
 	}
 	async unusedFallbackKeyTypes(userId, deviceId) {
-		const rows = await this.hs.db.findMany("fallback_keys", { where: [
-			{
-				field: "user_id",
-				value: userId
-			},
-			{
-				field: "device_id",
-				value: deviceId
-			},
-			{
-				field: "used",
-				value: false
-			}
-		] });
+		const rows = await this.hs.db.findMany("fallback_keys", {
+			where: [
+				{
+					field: "user_id",
+					value: userId
+				},
+				{
+					field: "device_id",
+					value: deviceId
+				},
+				{
+					field: "used",
+					value: false
+				}
+			],
+			fields: ["algorithm"]
+		});
 		return [...new Set(rows.map((r) => r.algorithm))];
 	}
 	async query(requester, deviceKeys, timeoutMs = 1e4) {
@@ -413,22 +419,18 @@ var KeyService = class {
 		return { failures };
 	}
 	/** Users (sharing a room with `userId`) whose device lists changed after `since`. */
-	async changesSince(userId, since, upTo) {
+	/**
+	* Device-list changes for /sync and /keys/changes. /sync passes what it has already read (the
+	* membership changes, the device-list rows, the user's joined rooms) to save the queries.
+	*/
+	async changesSince(userId, since, upTo, known = {}) {
 		const sharing = await this.hs.rooms.usersSharingRooms(userId);
-		const rows = await this.hs.db.findMany("device_list_changes", { where: [{
-			field: "stream",
-			operator: "gt",
-			value: since
-		}] });
+		const rows = known.deviceRows ?? await this.hs.db.findMany("device_list_changes", deviceListChangesQuery(sharing, since));
 		const changed = /* @__PURE__ */ new Set();
 		for (const r of rows) if (r.stream <= upTo && sharing.has(r.user_id)) changed.add(r.user_id);
 		const left = /* @__PURE__ */ new Set();
-		const memberRows = await this.hs.db.findMany("memberships", { where: [{
-			field: "stream",
-			operator: "gt",
-			value: since
-		}] });
-		const myRooms = /* @__PURE__ */ new Set([...await this.hs.rooms.roomsForUser(userId), ...memberRows.filter((m) => m.user_id === userId).map((m) => m.room_id)]);
+		const memberRows = known.memberChanges ?? await this.hs.rooms.membershipChangesSince(userId, since);
+		const myRooms = /* @__PURE__ */ new Set([...known.joinedRooms ?? await this.hs.rooms.roomsForUser(userId), ...memberRows.filter((m) => m.user_id === userId).map((m) => m.room_id)]);
 		for (const m of memberRows) {
 			if (m.stream > upTo || !myRooms.has(m.room_id)) continue;
 			if (m.user_id === userId) {
@@ -446,5 +448,22 @@ var KeyService = class {
 		};
 	}
 };
+/**
+* The device-list changes after `since` of the users sharing a room with someone.
+* https://github.com/k18k/matrix-nodejs-homeserver/issues/31: this read every device-list change
+* on the server since `since`; it asks for the users sharing a room only (up to a size where an IN
+* list stays reasonable for the database).
+*/
+function deviceListChangesQuery(sharing, since) {
+	return { where: [{
+		field: "stream",
+		operator: "gt",
+		value: since
+	}, ...sharing.size <= 5e3 ? [{
+		field: "user_id",
+		operator: "in",
+		value: [...sharing]
+	}] : []] };
+}
 //#endregion
-export { KeyService };
+export { KeyService, deviceListChangesQuery };

package/dist/core/outbound.d.ts

@@ -0,0 +1,16 @@
+import { LookupAddress, LookupOptions } from "node:dns";
+//#region src/core/outbound.d.ts
+type LookupCallback = (err: NodeJS.ErrnoException | null, address: string | LookupAddress[], family?: number) => void;
+/** Which addresses outbound requests to user- or remote-chosen destinations may connect to. */
+export interface AddressPolicy {
+  allows(address: string): boolean;
+  /**
+   * A `dns.lookup` for http(s) requests that refuses disallowed addresses. It runs when the
+   * connection is made, so the address checked is the one connected to: a name cannot resolve to
+   * a public address for a check and to a private one for the request (DNS rebinding).
+   * Undefined when every address is allowed.
+   */
+  lookup?: (hostname: string, options: LookupOptions, callback: LookupCallback) => void;
+}
+//#endregion
+export {};

package/dist/core/outbound.js

@@ -0,0 +1,172 @@
+import { errors } from "./errors.js";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { BlockList, isIP } from "node:net";
+import { lookup as lookup$1 } from "node:dns";
+import { request as request$1 } from "node:http";
+import { Readable } from "node:stream";
+//#region src/core/outbound.ts
+const privateRanges = new BlockList();
+for (const [net, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) privateRanges.addSubnet(net, prefix, "ipv4");
+for (const [net, prefix] of [
+	["::", 128],
+	["::1", 128],
+	["fc00::", 7],
+	["fe80::", 10],
+	["ff00::", 8]
+]) privateRanges.addSubnet(net, prefix, "ipv6");
+/** Whether an IP address is loopback, private, link-local, multicast or otherwise not public. */
+function isPrivateAddress(address) {
+	const family = isIP(address);
+	return family !== 0 && privateRanges.check(address, family === 6 ? "ipv6" : "ipv4");
+}
+/** The policy for the `allowPrivateAddresses` option. */
+function addressPolicy(allowPrivate) {
+	if (allowPrivate === true) return { allows: () => true };
+	const allowed = new BlockList();
+	for (const entry of Array.isArray(allowPrivate) ? allowPrivate : []) {
+		const [address, prefix] = entry.split("/");
+		const family = isIP(address);
+		if (family === 0) throw new Error(`allowPrivateAddresses: not an IP address or range: ${entry}`);
+		allowed.addSubnet(address, prefix === void 0 ? family === 6 ? 128 : 32 : Number(prefix), family === 6 ? "ipv6" : "ipv4");
+	}
+	const allows = (address) => !isPrivateAddress(address) || allowed.check(address, isIP(address) === 6 ? "ipv6" : "ipv4");
+	return {
+		allows,
+		lookup: (hostname, options, callback) => {
+			lookup$1(hostname, {
+				...options,
+				all: true
+			}, (err, addresses) => {
+				if (err) return callback(err, []);
+				if (addresses.length === 0 || !addresses.every((a) => allows(a.address))) return callback(privateAddressError(hostname), []);
+				if (options.all) callback(null, addresses);
+				else callback(null, addresses[0].address, addresses[0].family);
+			});
+		}
+	};
+}
+function privateAddressError(host) {
+	return Object.assign(/* @__PURE__ */ new Error(`${host} resolves to a private address`), { code: "EPRIVATE" });
+}
+/** Refuse an IP literal the policy does not allow (literals are connected to without a lookup). */
+function checkLiteral(policy, host) {
+	const literal = host.replace(/^\[|\]$/g, "");
+	if (isIP(literal) && !policy.allows(literal)) throw errors.forbidden("Address is private");
+}
+/**
+* A `fetch` for user- or remote-chosen URLs that connects only to addresses `policy` allows.
+* Redirects are never followed: callers that follow them send the next request through this
+* function again, so each target is checked. Only http(s) URLs are accepted.
+*
+* With a custom `fetch` (the `fetch` option, e.g. for a proxy), the host is resolved and checked
+* before the request instead. That leaves the DNS-rebinding window open; the custom client is the
+* operator's to secure.
+*/
+function policyFetch(policy, custom) {
+	return async (input, init = {}) => {
+		const url = new URL(input instanceof Request ? input.url : String(input));
+		if (url.protocol !== "http:" && url.protocol !== "https:") throw errors.forbidden("Only http and https URLs can be fetched");
+		checkLiteral(policy, url.hostname);
+		if (custom) {
+			if (policy.lookup && !isIP(url.hostname.replace(/^\[|\]$/g, ""))) {
+				if (!(await lookup(url.hostname, { all: true })).every((a) => policy.allows(a.address))) throw errors.forbidden("Address is private");
+			}
+			return custom(input, {
+				...init,
+				redirect: "manual"
+			});
+		}
+		return nodeFetch(url, init, policy);
+	};
+}
+const NULL_BODY = /* @__PURE__ */ new Set([
+	101,
+	103,
+	204,
+	205,
+	304
+]);
+function nodeFetch(url, init, policy) {
+	const method = (init.method ?? "GET").toUpperCase();
+	const headers = new Headers(init.headers);
+	const body = init.body === void 0 || init.body === null ? void 0 : typeof init.body === "string" || init.body instanceof URLSearchParams ? Buffer.from(String(init.body)) : Buffer.from(init.body);
+	if (body && init.body instanceof URLSearchParams && !headers.has("content-type")) headers.set("content-type", "application/x-www-form-urlencoded;charset=UTF-8");
+	const request$2 = url.protocol === "https:" ? request : request$1;
+	return new Promise((resolve, reject) => {
+		const req = request$2(url, {
+			method,
+			headers: Object.fromEntries(headers),
+			lookup: policy.lookup,
+			signal: init.signal ?? void 0
+		}, (res) => {
+			const out = new Headers();
+			for (let i = 0; i < res.rawHeaders.length; i += 2) out.append(res.rawHeaders[i], res.rawHeaders[i + 1]);
+			const status = res.statusCode ?? 502;
+			const nullBody = NULL_BODY.has(status) || method === "HEAD";
+			if (nullBody) res.resume();
+			resolve(new Response(nullBody ? null : Readable.toWeb(res), {
+				status,
+				statusText: res.statusMessage,
+				headers: out
+			}));
+		});
+		req.on("error", (err) => reject(err.code === "EPRIVATE" ? errors.forbidden("Address is private") : err));
+		req.end(body);
+	});
+}
+/** GET a URL through a `policyFetch`, following redirects (each one checked again) and capping the body. */
+async function publicGet(fetchFn, rawUrl, options) {
+	let url = new URL(rawUrl);
+	const signal = AbortSignal.timeout(options.timeoutMs ?? 3e4);
+	for (let redirects = 0;; redirects++) {
+		const res = await fetchFn(url, {
+			redirect: "manual",
+			signal,
+			headers: options.headers
+		});
+		const location = res.headers.get("location");
+		if (res.status >= 300 && res.status < 400 && location) {
+			await res.body?.cancel();
+			if (redirects >= (options.maxRedirects ?? 5)) throw errors.notFound("Too many redirects");
+			url = new URL(location, url);
+			continue;
+		}
+		if (Number(res.headers.get("content-length")) > options.maxBytes && !options.truncate) {
+			await res.body?.cancel();
+			throw errors.tooLarge("Remote response is too large");
+		}
+		const chunks = [];
+		let size = 0;
+		for await (const chunk of res.body ?? []) {
+			size += chunk.length;
+			if (size > options.maxBytes) {
+				await res.body?.cancel().catch(() => {});
+				if (!options.truncate) throw errors.tooLarge("Remote response is too large");
+				chunks.push(chunk.subarray(0, chunk.length - (size - options.maxBytes)));
+				break;
+			}
+			chunks.push(chunk);
+		}
+		return {
+			status: res.status,
+			headers: res.headers,
+			body: Buffer.concat(chunks),
+			url
+		};
+	}
+}
+//#endregion
+export { addressPolicy, checkLiteral, isPrivateAddress, policyFetch, publicGet };

package/dist/core/push.js

@@ -106,6 +106,7 @@ var PushService = class {
 		const pl = powerLevels(state, version);
 		const senderLevel = userLevel(pl, event.sender);
 		const thread = threadIdOf(event);
+		const notified = [];
 		for (const userId of members) {
 			if (userId === event.sender || !this.hs.isLocalUser(userId)) continue;
 			const actions = evaluateRules(await loadRules(this.hs, userId), {
@@ -119,17 +120,33 @@ var PushService = class {
 			});
 			if (!actions || !actions.includes("notify")) continue;
 			const tweaks = tweaksOf(actions);
-			await this.hs.db.upsert("notifications", {
-				user_id: userId,
-				room_id: event.room_id,
-				event_id: event.event_id,
-				stream: ev.stream,
-				highlight: tweaks.highlight === true,
-				thread_id: threadIdOf(event),
-				actions,
-				ts: Date.now()
+			notified.push({
+				userId,
+				tweaks,
+				row: {
+					user_id: userId,
+					room_id: event.room_id,
+					event_id: event.event_id,
+					stream: ev.stream,
+					highlight: tweaks.highlight === true,
+					thread_id: thread,
+					actions,
+					ts: Date.now()
+				}
 			});
-			this.deliver(userId, ev, state, tweaks).catch((err) => this.hs.logger.warn("Push delivery failed", err));
+		}
+		if (notified.length === 0) return;
+		await this.hs.transaction(async (db) => {
+			for (const n of notified) await db.upsert("notifications", n.row);
+		});
+		const pushers = await this.hs.db.findMany("pushers", { where: [{
+			field: "user_id",
+			operator: "in",
+			value: notified.map((n) => n.userId)
+		}] });
+		for (const n of notified) {
+			const own = pushers.filter((p) => p.user_id === n.userId);
+			if (own.length) this.deliver(n.userId, ev, state, n.tweaks, own).catch((err) => this.hs.logger.warn("Push delivery failed", err));
 		}
 	}
 	/** Unread notification counts since the user's read receipts. */
@@ -196,12 +213,7 @@ var PushService = class {
 			threads
 		};
 	}
-	async deliver(userId, ev, state, tweaks) {
-		const pushers = await this.hs.db.findMany("pushers", { where: [{
-			field: "user_id",
-			value: userId
-		}] });
-		if (pushers.length === 0) return;
+	async deliver(userId, ev, state, tweaks, pushers) {
 		const event = ev.pdu;
 		const unread = (await this.unreadCounts(userId, event.room_id)).room.notification_count;
 		for (const row of pushers) {
@@ -234,7 +246,7 @@ var PushService = class {
 					notification.user_is_target = event.state_key === userId;
 				}
 			}
-			const res = await this.hs.fetch(url, {
+			const res = await this.hs.publicFetch(url, {
 				method: "POST",
 				headers: { "content-type": "application/json" },
 				body: JSON.stringify({ notification }),

package/dist/core/ratelimit.d.ts

@@ -1,5 +1,5 @@
 //#region src/core/ratelimit.d.ts
-/** A rate limiter keyed by an arbitrary string. Implement this to share limits across instances (e.g. Redis). */
+/** A rate limiter keyed by an arbitrary string. Implement this to share limits across instances. */
 export interface RateLimiter {
   /** Consume one unit for `key` under `rule`; resolve with the delay to wait (0 when allowed). */
   consume(key: string, rule: RateLimitRule): Promise<number>;

package/dist/core/rooms.d.ts

@@ -1,7 +1,7 @@
 import { ClientEvent, PDU } from "./events.js";
 import { StateMap } from "./authrules.js";
-import { StateIds } from "./stateres.js";
 import { Row } from "../storage/types.js";
+import { StateIds } from "./stateres.js";
 import { Homeserver } from "../homeserver.js";
 //#region src/core/rooms.d.ts
 export interface StoredEvent {
@@ -140,6 +140,15 @@ export declare class RoomService {
   /** Users that should be woken up for events in this room. */
   private interestedUsers;
   roomsForUser(userId: string, membership?: string): Promise<string[]>;
+  /**
+   * Membership changes after `since` in the rooms where `userId` has a membership (in any state),
+   * given the user's own membership rows if the caller has them.
+   *
+   * https://github.com/k18k/matrix-nodejs-homeserver/issues/31: /sync and device-list tracking
+   * read every membership change on the server since their token and kept those in the user's
+   * rooms; while many users joined, each sync parsed thousands of rows. This reads those rooms only.
+   */
+  membershipChangesSince(userId: string, since: number, mine?: Row[]): Promise<Row[]>;
   /** All users sharing at least one joined room with `userId` (including themselves). */
   usersSharingRooms(userId: string): Promise<Set<string>>;
   private prepareRedaction;

package/dist/core/rooms.js

@@ -1053,6 +1053,31 @@ var RoomService = class {
 			value: membership
 		}] })).map((r) => r.room_id);
 	}
+	/**
+	* Membership changes after `since` in the rooms where `userId` has a membership (in any state),
+	* given the user's own membership rows if the caller has them.
+	*
+	* https://github.com/k18k/matrix-nodejs-homeserver/issues/31: /sync and device-list tracking
+	* read every membership change on the server since their token and kept those in the user's
+	* rooms; while many users joined, each sync parsed thousands of rows. This reads those rooms only.
+	*/
+	async membershipChangesSince(userId, since, mine) {
+		const own = mine ?? await this.hs.db.findMany("memberships", { where: [{
+			field: "user_id",
+			value: userId
+		}] });
+		const rooms = [...new Set(own.map((m) => m.room_id))];
+		if (rooms.length === 0) return [];
+		return this.hs.db.findMany("memberships", { where: [{
+			field: "room_id",
+			operator: "in",
+			value: rooms
+		}, {
+			field: "stream",
+			operator: "gt",
+			value: since
+		}] });
+	}
 	/** All users sharing at least one joined room with `userId` (including themselves). */
 	async usersSharingRooms(userId) {
 		const cached = this.sharingCache.get(userId);

package/dist/core/semaphore.js

@@ -0,0 +1,23 @@
+//#region src/core/semaphore.ts
+/** Runs at most `limit` tasks at once; the others wait their turn, first come first served. */
+var Semaphore = class {
+	limit;
+	active = 0;
+	waiting = [];
+	constructor(limit) {
+		this.limit = limit;
+	}
+	async run(fn) {
+		if (this.active >= this.limit) await new Promise((resolve) => this.waiting.push(resolve));
+		else this.active++;
+		try {
+			return await fn();
+		} finally {
+			const next = this.waiting.shift();
+			if (next) next();
+			else this.active--;
+		}
+	}
+};
+//#endregion
+export { Semaphore };

package/dist/core/sso.d.ts

@@ -28,11 +28,25 @@ export interface SsoProvider {
 }
 export interface SsoOptions {
   providers: SsoProvider[];
+  /**
+   * Clients that receive the login token straight away, as URL prefixes such as
+   * `"https://app.element.io/"` (same scheme and host, path starting with the prefix's path).
+   * Other clients get a page naming them, where the user confirms before the token is sent.
+   */
+  clientAllowlist?: string[];
+}
+/** Where the browser goes after login, and whether the user has to confirm that client first. */
+export interface SsoResult {
+  url: string;
+  confirm: boolean;
+  /** The client as shown to the user: its host, or its scheme for app links. */
+  client: string;
 }
 /** Upstream OIDC login (authorization code + PKCE) issuing Matrix login tokens. */
 export declare class SsoService {
   private hs;
   readonly providers: SsoProvider[];
+  private clientAllowlist;
   private discovery;
   constructor(hs: Homeserver, options: SsoOptions);
   private callbackUrl;
@@ -40,7 +54,7 @@ export declare class SsoService {
   /** URL to send the user's browser to. */
   startLogin(providerId: string | null, redirectUrl: string): Promise<string>;
   /** Handle the provider's redirect; returns the client URL carrying a login token. */
-  finishLogin(providerId: string, params: URLSearchParams): Promise<string>;
+  finishLogin(providerId: string, params: URLSearchParams): Promise<SsoResult>;
   private resolveUser;
 }
 //#endregion

package/dist/core/sso.js

@@ -3,6 +3,34 @@ import { errors } from "./errors.js";
 import { LOCALPART_RE } from "./ids.js";
 import { createHash, randomBytes } from "node:crypto";
 //#region src/core/sso.ts
+const UNSAFE_SCHEMES = /* @__PURE__ */ new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"file:",
+	"blob:",
+	"about:"
+]);
+/** The client's redirect URL, if it is one the server may send a login token to. */
+function checkRedirectUrl(raw) {
+	if (!raw) return null;
+	try {
+		return UNSAFE_SCHEMES.has(new URL(raw).protocol) ? null : raw;
+	} catch {
+		return null;
+	}
+}
+function clientMatches(raw, entry) {
+	try {
+		const url = new URL(raw);
+		const allowed = new URL(entry);
+		if (allowed.host) return url.protocol === allowed.protocol && url.host === allowed.host && url.pathname.startsWith(allowed.pathname);
+		return raw.startsWith(entry);
+	} catch {
+		return false;
+	}
+}
+const sameIssuer = (a, b) => typeof a === "string" && a.replace(/\/$/, "") === b.replace(/\/$/, "");
 function sanitizeLocalpart(raw) {
 	return raw.toLowerCase().replace(/[^a-z0-9._=\-/+]/g, "_").slice(0, 200);
 }
@@ -15,10 +43,12 @@ function decodeJwtPayload(jwt) {
 var SsoService = class {
 	hs;
 	providers;
+	clientAllowlist;
 	discovery = /* @__PURE__ */ new Map();
 	constructor(hs, options) {
 		this.hs = hs;
 		this.providers = options.providers;
+		this.clientAllowlist = options.clientAllowlist ?? [];
 	}
 	callbackUrl(provider) {
 		const base = this.hs.config.publicBaseUrl;
@@ -31,6 +61,7 @@ var SsoService = class {
 		const res = await this.hs.fetch(`${provider.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(1e4) });
 		if (!res.ok) throw new Error(`OIDC discovery for ${provider.id} failed with ${res.status}`);
 		const meta = await res.json();
+		if (!sameIssuer(meta.issuer, provider.issuer)) throw new Error(`OIDC discovery for ${provider.id} returned another issuer`);
 		this.discovery.set(provider.id, meta);
 		return meta;
 	}
@@ -96,6 +127,7 @@ var SsoService = class {
 		if (!res.ok) throw errors.forbidden("Code exchange failed");
 		const tokens = await res.json();
 		let claims = {};
+		if ((provider.scopes ?? ["openid"]).includes("openid") && typeof tokens.id_token !== "string") throw errors.forbidden("The provider returned no ID token");
 		if (typeof tokens.id_token === "string") {
 			claims = decodeJwtPayload(tokens.id_token);
 			const aud = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
@@ -130,7 +162,11 @@ var SsoService = class {
 		});
 		const redirect = new URL(pending.redirectUrl);
 		redirect.searchParams.set("loginToken", loginToken);
-		return redirect.toString();
+		return {
+			url: redirect.toString(),
+			confirm: !this.clientAllowlist.some((entry) => clientMatches(pending.redirectUrl, entry)),
+			client: redirect.host || redirect.protocol.replace(/:$/, "")
+		};
 	}
 	async resolveUser(provider, claims) {
 		const link = await this.hs.db.findOne("sso_identities", [{
@@ -162,4 +198,4 @@ var SsoService = class {
 	}
 };
 //#endregion
-export { SsoService };
+export { SsoService, checkRedirectUrl };

package/dist/core/threepid.js

@@ -1,6 +1,7 @@
 import { randomString } from "./crypto.js";
 import { MatrixError, errors } from "./errors.js";
 import { toMsisdn } from "./phone.js";
+import { escapeHtml } from "./html.js";
 import { randomInt } from "node:crypto";
 //#region src/core/threepid.ts
 const CLIENT_SECRET_RE = /^[0-9a-zA-Z.=_-]{1,255}$/;
@@ -262,14 +263,5 @@ var ThreepidService = class {
 		};
 	}
 };
-function escapeHtml(s) {
-	return s.replace(/[&<>"']/g, (c) => ({
-		"&": "&amp;",
-		"<": "&lt;",
-		">": "&gt;",
-		"\"": "&quot;",
-		"'": "&#39;"
-	})[c]);
-}
 //#endregion
 export { ThreepidService, canonicalAddress, isMedium };