matrix-nodejs-homeserver 0.3.3 → 0.3.5

package/README.md

@@ -4,7 +4,7 @@
 [![Load test: SQLite](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fk18k%2Fmatrix-nodejs-homeserver%2Floadtest-results%2Fbadges%2Fsqlite.json)](https://github.com/k18k/matrix-nodejs-homeserver/actions/workflows/loadtest.yml)
 [![Load test: Postgres](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fk18k%2Fmatrix-nodejs-homeserver%2Floadtest-results%2Fbadges%2Fpg-nocluster.json)](https://github.com/k18k/matrix-nodejs-homeserver/actions/workflows/loadtest.yml)
 [![Load test: Postgres cluster, 1 node](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fk18k%2Fmatrix-nodejs-homeserver%2Floadtest-results%2Fbadges%2Fpg-cluster-1.json)](https://github.com/k18k/matrix-nodejs-homeserver/actions/workflows/loadtest.yml)
-[![Load test: Postgres cluster, 5 nodes](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fk18k%2Fmatrix-nodejs-homeserver%2Floadtest-results%2Fbadges%2Fpg-cluster-5.json)](https://github.com/k18k/matrix-nodejs-homeserver/actions/workflows/loadtest.yml)
+[![Load test: Postgres cluster, 2 nodes](https://img.shields.io/endpoint?url=https%3A%2F%2Fraw.githubusercontent.com%2Fk18k%2Fmatrix-nodejs-homeserver%2Floadtest-results%2Fbadges%2Fpg-cluster-2.json)](https://github.com/k18k/matrix-nodejs-homeserver/actions/workflows/loadtest.yml)
 
 A [Matrix](https://matrix.org) homeserver as an importable Node.js library. It isn't
 tied to any HTTP framework, database, auth system or deployment shape. You can use
@@ -137,8 +137,9 @@ createHomeserver({
   `await hs.auth.createLoginToken(userId)` and let the client exchange the token via
   `m.login.token`. You can also call `hs.auth.createSession(userId)` to issue an
   access token directly.
-- **SSO with upstream OpenID Connect providers** (Google, GitHub via an OIDC
-  bridge, Keycloak, Authentik, …). Users can sign in with `m.login.sso`:
+- **SSO with upstream providers:** OpenID Connect (Google, Keycloak,
+  Authentik, Better Auth, …) or plain OAuth 2.0 such as GitHub
+  (`githubProvider({ clientId, clientSecret })`). Users can sign in with `m.login.sso`:
   ```ts
   sso: { providers: [{ id: "google", name: "Google", issuer: "https://accounts.google.com",
     clientId, clientSecret, mapUser: (claims) => ({ localpart: claims.email.split("@")[0] }) }] },
@@ -147,6 +148,37 @@ createHomeserver({
   After signing in, users confirm the client the login token goes to, on a page
   that names it. Clients you trust skip that page:
   `sso: { providers, clientAllowlist: ["https://app.element.io/"] }`.
+- **The OAuth 2.0 API, served by the homeserver** (spec v1.15–v1.18). Clients
+  such as Element X register themselves, and users sign in, register, approve
+  the client and manage their account on the server's own web pages. Those pages
+  offer the password and the providers of `sso`. Login only with GitHub:
+  ```ts
+  import { createHomeserver, githubProvider } from "matrix-nodejs-homeserver";
+
+  createHomeserver({
+    homeserver: "example.com",
+    publicBaseUrl: "https://matrix.example.com",
+    oauthServer: { termsUrl: "https://example.com/terms", policyUrl: "https://example.com/privacy" },
+    userAuthAdapter: { passwordLoginEnabled: false },
+    sso: { providers: [githubProvider({ clientId, clientSecret })] },
+  });
+  ```
+  The GitHub OAuth app's callback URL is
+  `https://matrix.example.com/_matrix/client/v3/login/sso/callback/github`. The first
+  login creates the account. Users are matched by their GitHub ID, so a renamed
+  GitHub account keeps its Matrix account.
+
+  What is served: dynamic client registration with the spec's redirect URI
+  rules, the authorization code grant with PKCE (S256), the device authorization
+  grant (for CLIs and TVs), refresh tokens and revocation. It also covers
+  `prompt=create`, the account management page with every action the spec
+  lists, `m.oauth` for cross-signing resets, and ID tokens for clients that ask
+  for `openid`. Access tokens live 5 minutes (`accessTokenLifetimeMs`). Refresh
+  tokens rotate: a client whose response got lost can retry, and a refresh
+  token used again after it was replaced logs the device out. The pages are
+  under `/_synapse/client/oauth2/`. The legacy API stays available
+  (`legacyApi: false` turns it off), and its `m.login.sso` goes through the same
+  pages.
 - **Delegated OAuth 2.0** (the Matrix OAuth API, e.g. with
   matrix-authentication-service, Keycloak or Authentik). The provider owns the
   accounts, and the homeserver validates its access tokens by introspection:
@@ -342,8 +374,9 @@ paths (server admins only), so existing tools keep working.
 | `cluster` | Cluster adapter for running several instances. |
 | `adminRoom` | `true` or `{ firstUserIsAdmin, firstUserCanRegister, botLocalpart, … }`. Disabled by default. |
 | `audit` | `{ enabled, database, sink, actions, retentionDays }`. Disabled by default. |
-| `publicBaseUrl` | Advertised via `/.well-known/matrix/client`. Required for SSO. |
-| `oauth`, `sso` | Delegated OAuth or upstream OIDC SSO. |
+| `publicBaseUrl` | Advertised via `/.well-known/matrix/client`. Required for SSO and `oauthServer`. |
+| `oauthServer` | `true` or `{ legacyApi, accessTokenLifetimeMs, termsUrl, policyUrl, webSessionLifetimeMs }`: the OAuth 2.0 API, served by the homeserver. |
+| `oauth`, `sso` | Delegated OAuth, and upstream identity providers (OIDC or OAuth 2.0, e.g. `githubProvider`). |
 | `federation` | `{ enabled, verifyTls, allowedServers, blockedServers, fasterJoins }`. Off unless `enabled: true`. |
 | `allowPrivateAddresses` | Lets requests to addresses that users or remote servers choose (federation, push gateways, identity servers, URL previews, remote media) reach private addresses: `true`, or ranges such as `["127.0.0.1/32"]`. Blocked by default. |
 | `rtc` | `{ turn, transports }` |
@@ -377,13 +410,14 @@ available for integration and metrics.
 - **Media:** legacy and authenticated endpoints, async uploads, thumbnails, the remote media proxy, URL previews
 - **Federation, VoIP/MatrixRTC, admin, server notices**
 
-Not implemented: third-party identifiers (email/phone), application services,
-and a built-in OAuth authorization server. For OAuth, delegate to an existing provider.
-
 ## Development
 
+The repository is an npm workspace: this package is `packages/core`, and `apps/` holds the
+public server built on it (see the repository's README). Install from the repository root;
+the commands below run in `packages/core`.
+
 ```sh
-npm install
+npm install                      # at the repository root
 npm run typecheck                # tsc only type-checks (noEmit)
 npm run build                    # tsdown → dist/ (what the published package contains)
 node examples/node-http.ts       # development runs the TypeScript sources directly (type stripping)
@@ -493,7 +527,7 @@ CI runs the whole suite with the same script. `complement/passing.txt` lists the
 
 ### Load testing
 
-Tuning and investigation runs are local; a [workflow](.github/workflows/loadtest.yml) runs the same scenarios on main for the badges. [loadtest/](loadtest/) holds a k6 scenario and a
+Tuning and investigation runs are local; a [workflow](https://github.com/k18k/matrix-nodejs-homeserver/blob/main/.github/workflows/loadtest.yml) runs the same scenarios on main for the badges. [loadtest/](loadtest/) holds a k6 scenario and a
 homeserver that reports, every 10 s, requests per second, memory, event-loop delay and
 (with Postgres) how many queries wait for a pool connection and how long locks are held.
 
@@ -516,42 +550,53 @@ BASE_URL=http://localhost:8008 ONLINE_USERS=1000 MESSAGES_PER_SECOND=50 ROOMS=25
 
 <!-- loadtest-results:start -->
 The badges at the top come from the [Load test workflow](https://github.com/k18k/matrix-nodejs-homeserver/actions/workflows/loadtest.yml) on main: the same
-scenario on one GitHub runner (4 CPUs), with k6 on the same machine. Each run's job summary has
+scenario on one GitHub runner (4 CPUs), with k6 on the same machine, and clusters of two nodes
+(five nodes would compete with Postgres and k6 for four CPUs). Each run's job summary has
 the full table.
 
-Latest results: 1000 users online in 25 rooms (40 per room), 50 messages/s, 30 s ramp-up then
-30 s at full load, on one developer machine (WSL2, Docker Desktop). Times are p50 / p95.
-
-| Setup | req/s | send | /sync | join | delivery | messages delivered | failed |
-|---|---|---|---|---|---|---|---|
-| SQLite, 1 process | 662 | 97 ms / 0.16 s | 0.87 s / 1.6 s | 10 ms / 91 ms | 1.64 s / 2.70 s | 53,935 | 0% |
-| Postgres, no cluster | 670 | 15 ms / 19 ms | 1.1 s / 1.8 s | 14 ms / 23 ms | 1.76 s / 2.31 s | 58,667 | 0% |
-| Postgres, cluster, 1 node | 593 | 27 ms / 38 ms | 1.3 s / 2.0 s | 36 ms / 51 ms | 1.96 s / 2.57 s | 58,493 | 0% |
-| Postgres, cluster, 5 nodes | 871 | 60 ms / 88 ms | 0.50 s / 1.1 s | 62 ms / 119 ms | 0.70 s / 1.09 s | 59,298 | 0% |
-
-What the load tests found and fixed so far: presence written on every `/sync` (#26), one commit
-per push notification (#27), a missing index (#28), Postgres cluster locks that could deadlock
-the pool (#29), stream writes serialized per instance (#30), `/sync` reading every change on the
-server (#31) and every joined room (#33), lock handover by polling (#32). Then `/sync` reads were batched
-(#34) and a process builds at most four sync responses at once (#35), so sends no longer queue
-behind the syncs a message wakes.
-
-Since 0.3.2 (#38–#45), Postgres delivery time fell by about 55% on one node and 50% on five:
-- changed rooms are built concurrently, with fewer reads each (#38);
-- push notifications of a message are written in one statement (#39);
-- Postgres statements are prepared once per connection (#40);
-- push rules are no longer copied per member (#41);
-- to-device acknowledgements run only when needed (#42);
-- reads issued at the same moment by concurrent requests share one statement (#43);
-- presence and device-list changes are found through a stream index (#44);
-- batched reads take half as long to plan (#45).
-
-On SQLite, commits no longer wait for an fsync (#46). Database calls also yield to the event
-loop (#47): before that, a wave of syncs could hold it for seconds, sends took 0.74 s and the
-server took in only about 40% of the messages the scenario sends.
-
-With every user receiving about two messages a second, delivery time is how long it takes a
-process to rebuild every user's `/sync` in turn: about 750 per second per Postgres node here.
+Latest results, on one developer machine (WSL2, Docker Desktop): 1000 users online in 25 rooms
+(40 per room), 30 s ramp-up, then 30 s of messages. Times are p50 / p95; "sent" is the share of
+the messages the scenario asks for that the server accepted (a server that falls behind takes
+fewer, and then looks faster than it is).
+
+At 10 messages/s (every user receiving one message every 2.5 s):
+
+| Setup | send | delivery | sent | failed |
+|---|---|---|---|---|
+| SQLite, 1 process | 5 ms / 15 ms | 14 ms / 0.18 s | 100% | 0% |
+| Postgres, no cluster | 9 ms / 30 ms | 29 ms / 0.60 s | 100% | 0% |
+
+At 50 messages/s (every user receiving two messages a second, 59,000 deliveries in 30 s):
+
+| Setup | req/s | send | /sync | delivery | sent | failed |
+|---|---|---|---|---|---|---|
+| SQLite, 1 process | 722 | 11 ms / 25 ms | 0.77 s / 1.3 s | 1.2 s / 1.6 s | 100% | 0% |
+| Postgres, no cluster | 687 | 35 ms / 49 ms | 0.79 s / 1.2 s | 1.2 s / 1.6 s | 100% | 0% |
+| Postgres, cluster, 1 node | 766 | 72 ms / 98 ms | 1.1 s / 1.5 s | 1.7 s / 2.2 s | 100% | 0% |
+| Postgres, cluster, 5 nodes | 910 | 146 ms / 233 ms | 0.42 s / 1.6 s | 0.37 s / 1.5 s | 100% | 0% |
+
+At 50 messages/s, delivery time is how long a process takes to rebuild the `/sync` of every
+user in turn, since every user has something new in nearly every rebuild.
+
+What the load tests found and fixed:
+- presence written on every `/sync` (#26), one commit per push notification (#27), a missing
+  index (#28), Postgres cluster locks that could deadlock the pool (#29), stream writes
+  serialized per instance (#30), `/sync` reading every change on the server (#31) and every
+  joined room (#33), lock handover by polling (#32), unbatched `/sync` reads (#34), syncs
+  crowding out sends (#35);
+- in 0.3.3 (#38–#47): rooms built one after another (#38), a statement per push notification
+  (#39), Postgres re-planning every statement (#40), push rules copied per member (#41),
+  needless to-device deletes (#42), concurrent reads as separate statements (#43), presence and
+  device lists looked up per user (#44), costly batched reads (#45), an fsync per SQLite commit
+  (#46), a blocked event loop (#47);
+- since 0.3.3: waiting `/sync` requests rebuilt whenever anything on the server changed, and
+  about two thirds of all rebuilds found nothing new (#50); a single instance now keeps track of
+  where data last changed, so `/sync` skips reads that would find nothing, like Synapse's stream
+  change caches (#51); queued syncs held the event loop, and yielding per statement made sends
+  slow (#52).
+
+The load test itself was fixed too: its senders registered during the measurement, so a slow
+server was sent fewer messages, and nginx could start after k6 (a red badge with "100% failed").
 <!-- loadtest-results:end -->
 
 ## License

package/dist/api/account.js

@@ -9,8 +9,10 @@ import { canonicalAddress, isMedium } from "../core/threepid.js";
 import { boolean, looseObject, string } from "../vendor/zod/v4/classic/schemas.js";
 import { body, fail, lenient } from "../http/input.js";
 import { procedure } from "../http/procedure.js";
+import { OAUTH_PREFIX } from "../core/oauthserver.js";
 import { requireUia } from "./uia.js";
-import { checkRedirectUrl } from "../core/sso.js";
+import { checkRedirectUrl, legacyClientRedirect } from "../core/sso.js";
+import { readWebSession, setWebUser } from "./oauthserver.js";
 import { createHmac, randomInt, timingSafeEqual } from "node:crypto";
 //#region src/api/account.ts
 const deviceFields = {
@@ -46,16 +48,18 @@ const sharedSecretRegisterBody = body({
 });
 function loginFlows(hs) {
 	if (hs.oauth) return [];
+	if (hs.oauthServer && !hs.oauthServer.legacyApi) throw errors.unrecognized("Log in with the OAuth 2.0 API");
 	const flows = [];
 	if (hs.userAuth.passwordLoginEnabled) flows.push({ type: M.LOGIN.PASSWORD });
-	if (hs.sso) flows.push({
+	if (hs.sso || hs.oauthServer) flows.push({
 		type: M.LOGIN.SSO,
-		identity_providers: hs.sso.providers.map((p) => ({
+		identity_providers: (hs.sso?.providers ?? []).map((p) => ({
 			id: p.id,
 			name: p.name,
 			icon: p.icon,
 			brand: p.brand
-		}))
+		})),
+		...hs.oauthServer ? { oauth_aware_preferred: true } : {}
 	});
 	flows.push({
 		type: M.LOGIN.TOKEN,
@@ -65,6 +69,7 @@ function loginFlows(hs) {
 }
 /** Endpoints that manage passwords are unavailable when an OAuth provider owns the accounts. */
 function rejectIfDelegated(hs) {
+	if (hs.oauthServer && !hs.oauthServer.legacyApi) throw errors.unrecognized("Use the OAuth 2.0 API");
 	if (hs.oauth) throw new MatrixError(403, "M_FORBIDDEN", "Accounts are managed by the OAuth provider", hs.oauth.options.accountManagementUrl ? { account_management_uri: hs.oauth.options.accountManagementUrl } : {});
 }
 async function validateNewUsername(hs, raw) {
@@ -105,6 +110,42 @@ async function createUser(hs, localpart, opts) {
 	await hs.adminRoom?.onUserCreated(userId).catch((err) => hs.logger.error("Admin room setup failed", err));
 	return userId;
 }
+/**
+* Check a password login, with the audit entries and automatic provisioning of `/login`; returns
+* the user ID. Shared with the OAuth server's login page.
+*/
+async function checkPasswordLogin(hs, userId, password, request) {
+	let user = await hs.db.findOne("users", [{
+		field: "user_id",
+		value: userId
+	}]);
+	if (!await hs.userAuth.checkPassword({
+		userId,
+		localpart: userId.slice(1).split(":")[0],
+		password,
+		storedHash: user?.password_hash ?? null
+	})) {
+		await hs.audit.record({
+			action: "login_failed",
+			actor: userId,
+			ip: request.ip,
+			userAgent: request.userAgent,
+			outcome: "failure",
+			details: { type: M.LOGIN.PASSWORD }
+		});
+		throw errors.forbidden("Invalid username or password");
+	}
+	if (!user) {
+		if (!await hs.userAuth.autoProvision(userId)) throw errors.forbidden("Invalid username or password");
+		await createUser(hs, userId.slice(1).split(":")[0], {});
+		user = await hs.db.findOne("users", [{
+			field: "user_id",
+			value: userId
+		}]);
+	}
+	if (user.deactivated) throw errors.userDeactivated();
+	return userId;
+}
 async function resolveLoginUser(hs, body) {
 	let user;
 	const id = isObject(body.identifier) ? body.identifier : null;
@@ -138,45 +179,63 @@ async function resolveLoginUser(hs, body) {
 	}
 	return `@${user.toLowerCase()}:${hs.serverName}`;
 }
+const ssoConfirmPage = (serverName, result) => {
+	const client = escapeHtml(result.client);
+	const html = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Continue to ${client}</title>
+<style>body{font:16px system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem}a.button{display:inline-block;padding:.6rem 1.2rem;background:#0b7a55;color:#fff;border-radius:6px;text-decoration:none}</style>
+<h1>Continue to ${client}?</h1>
+<p>You signed in to <b>${escapeHtml(serverName)}</b>. <b>${client}</b> will get access to your account.</p>
+<p>If you did not just sign in with this app, close this page.</p>
+<p><a class="button" href="${escapeHtml(result.url)}">Continue to ${client}</a></p>`;
+	return new Response(html, { headers: {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"referrer-policy": "no-referrer",
+		"x-frame-options": "DENY",
+		"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
+	} });
+};
+const OAUTH_DISCOVERY_VERSIONS = ["v1", "unstable/org.matrix.msc2965"];
 function registerAccountRoutes(r) {
 	r.client("GET", "/login", procedure({ handler: (ctx) => ({ flows: loginFlows(ctx.hs) }) }));
 	r.client("GET", "/auth_metadata", procedure({ handler: async (ctx) => {
+		if (ctx.hs.oauthServer) return ctx.hs.oauthServer.metadata();
 		if (!ctx.hs.oauth) throw errors.unrecognized("OAuth is not enabled");
 		return ctx.hs.oauth.serverMetadata();
-	} }), ["v1"]);
+	} }), OAUTH_DISCOVERY_VERSIONS);
 	r.client("GET", "/auth_issuer", procedure({ handler: (ctx) => {
+		if (ctx.hs.oauthServer) return { issuer: ctx.hs.oauthServer.issuer };
 		if (!ctx.hs.oauth) throw errors.unrecognized("OAuth is not enabled");
 		return { issuer: ctx.hs.oauth.options.issuer };
-	} }), ["v1"]);
-	const ssoConfirmPage = (serverName, result) => {
-		const client = escapeHtml(result.client);
-		const html = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Continue to ${client}</title>
-<style>body{font:16px system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem}a.button{display:inline-block;padding:.6rem 1.2rem;background:#0b7a55;color:#fff;border-radius:6px;text-decoration:none}</style>
-<h1>Continue to ${client}?</h1>
-<p>You signed in to <b>${escapeHtml(serverName)}</b>. <b>${client}</b> will get access to your account.</p>
-<p>If you did not just sign in with this app, close this page.</p>
-<p><a class="button" href="${escapeHtml(result.url)}">Continue to ${client}</a></p>`;
-		return new Response(html, { headers: {
-			"content-type": "text/html; charset=utf-8",
-			"cache-control": "no-store",
-			"referrer-policy": "no-referrer",
-			"x-frame-options": "DENY",
-			"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
-		} });
-	};
+	} }), OAUTH_DISCOVERY_VERSIONS);
 	const ssoRedirect = async (ctx) => {
-		if (!ctx.hs.sso) throw errors.unrecognized("SSO is not enabled");
+		const hs = ctx.hs;
 		const redirectUrl = checkRedirectUrl(ctx.query.get("redirectUrl"));
+		if (hs.oauthServer) {
+			if (!hs.oauthServer.legacyApi) throw errors.unrecognized("Log in with the OAuth 2.0 API");
+			if (!redirectUrl) throw errors.missingParam("Missing or invalid redirectUrl");
+			const id = randomString(24);
+			await hs.cluster.set(`oauth:legacy:${id}`, redirectUrl, 18e5);
+			const next = `${OAUTH_PREFIX}/legacy/${id}`;
+			const idp = ctx.params.idpId;
+			if (idp && !hs.sso?.providers.some((p) => p.id === idp)) throw errors.notFound("Unknown identity provider");
+			const page = idp ? `/upstream/${encodeURIComponent(idp)}` : ctx.query.get("action") === "register" ? "/register-account" : "/login";
+			return Response.redirect(`${hs.oauthServer.url(page)}?next=${encodeURIComponent(next)}`, 302);
+		}
+		if (!hs.sso) throw errors.unrecognized("SSO is not enabled");
 		if (!redirectUrl) throw errors.missingParam("Missing or invalid redirectUrl");
-		return Response.redirect(await ctx.hs.sso.startLogin(ctx.params.idpId ?? null, redirectUrl), 302);
+		return Response.redirect(await hs.sso.startLogin(ctx.params.idpId ?? null, {
+			kind: "client",
+			redirectUrl
+		}), 302);
 	};
 	r.client("POST", "/login/get_token", procedure({
 		auth: "user",
 		handler: async (ctx) => {
 			const s = ctx.session;
-			if (!ctx.hs.config.loginViaExistingSession || ctx.hs.oauth || s.isGuest) throw errors.unrecognized();
+			if (!ctx.hs.config.loginViaExistingSession || ctx.hs.oauth || s.oauth || s.isGuest) throw errors.unrecognized();
 			await ctx.rateLimit("login");
-			await requireUia(ctx.hs, await ctx.json(), [[M.LOGIN.PASSWORD]], s.userId);
+			await requireUia(ctx.hs, await ctx.json(), [[M.LOGIN.PASSWORD]], s.userId, { session: s });
 			const ttl = 12e4;
 			return {
 				login_token: await ctx.hs.auth.createLoginToken(s.userId, ttl),
@@ -187,9 +246,17 @@ function registerAccountRoutes(r) {
 	r.client("GET", "/login/sso/redirect", procedure({ handler: ssoRedirect }));
 	r.client("GET", "/login/sso/redirect/:idpId", procedure({ handler: ssoRedirect }));
 	r.client("GET", "/login/sso/callback/:idpId", procedure({ handler: async (ctx) => {
-		if (!ctx.hs.sso) throw errors.unrecognized("SSO is not enabled");
-		const result = await ctx.hs.sso.finishLogin(ctx.params.idpId, ctx.query);
-		return result.confirm ? ssoConfirmPage(ctx.hs.serverName, result) : Response.redirect(result.url, 302);
+		const hs = ctx.hs;
+		if (!hs.sso) throw errors.unrecognized("SSO is not enabled");
+		const { userId, target } = await hs.sso.finishLogin(ctx.params.idpId, ctx.query);
+		if (target.kind === "web") {
+			const web = await readWebSession(ctx);
+			if (!web || web.sid !== target.sid) throw errors.forbidden("This login was started in another browser");
+			await setWebUser(hs, web, userId);
+			return Response.redirect(hs.oauthServer.url(target.next.slice(OAUTH_PREFIX.length)), 302);
+		}
+		const result = await legacyClientRedirect(hs, userId, target.redirectUrl);
+		return result.confirm ? ssoConfirmPage(hs.serverName, result) : Response.redirect(result.url, 302);
 	} }));
 	r.client("POST", "/login", procedure({
 		rateLimit: "login",
@@ -198,6 +265,7 @@ function registerAccountRoutes(r) {
 			const body = ctx.input;
 			const hs = ctx.hs;
 			if (hs.oauth) throw errors.unrecognized("Log in through the OAuth provider");
+			if (hs.oauthServer && !hs.oauthServer.legacyApi) throw errors.unrecognized("Log in with the OAuth 2.0 API");
 			if (body.type === M.LOGIN.APPLICATION_SERVICE) {
 				const reg = ctx.accessToken() ? hs.appservices.byToken(ctx.accessToken()) : null;
 				if (!reg) throw errors.unknownToken("An application service token is required");
@@ -254,37 +322,11 @@ function registerAccountRoutes(r) {
 			if (body.type !== M.LOGIN.PASSWORD || !hs.userAuth.passwordLoginEnabled) throw errors.unknown("Unsupported login type");
 			const userId = await resolveLoginUser(hs, body);
 			if (body.password === void 0) throw errors.missingParam("Missing password");
-			let user = await hs.db.findOne("users", [{
-				field: "user_id",
-				value: userId
-			}]);
-			const ok = await hs.userAuth.checkPassword({
-				userId,
-				localpart: userId.slice(1).split(":")[0],
-				password: body.password,
-				storedHash: user?.password_hash ?? null
-			});
 			const ua = ctx.request.headers.get("user-agent");
-			if (!ok) {
-				await hs.audit.record({
-					action: "login_failed",
-					actor: userId,
-					ip: ctx.ip,
-					userAgent: ua,
-					outcome: "failure",
-					details: { type: M.LOGIN.PASSWORD }
-				});
-				throw errors.forbidden("Invalid username or password");
-			}
-			if (!user) {
-				if (!await hs.userAuth.autoProvision(userId)) throw errors.forbidden("Invalid username or password");
-				await createUser(hs, userId.slice(1).split(":")[0], {});
-				user = await hs.db.findOne("users", [{
-					field: "user_id",
-					value: userId
-				}]);
-			}
-			if (user.deactivated) throw errors.userDeactivated();
+			await checkPasswordLogin(hs, userId, body.password, {
+				ip: ctx.ip,
+				userAgent: ua
+			});
 			const session = await hs.auth.createSession(userId, {
 				deviceId: body.device_id,
 				displayName: body.initial_device_display_name,
@@ -310,7 +352,7 @@ function registerAccountRoutes(r) {
 		handler: async (ctx) => {
 			const body = ctx.input;
 			if (body.refresh_token === void 0) throw errors.missingParam("Missing refresh_token");
-			const { access_token, refresh_token, expires_in_ms } = await ctx.hs.auth.refresh(body.refresh_token);
+			const { access_token, refresh_token, expires_in_ms } = await ctx.hs.auth.refresh(body.refresh_token, { clientId: null });
 			return {
 				access_token,
 				refresh_token,
@@ -464,7 +506,7 @@ function registerAccountRoutes(r) {
 			let s;
 			if (ctx.accessToken()) {
 				const session = await ctx.auth();
-				await requireUia(hs, body, [[M.LOGIN.PASSWORD]], session.userId);
+				await requireUia(hs, body, [[M.LOGIN.PASSWORD]], session.userId, { session });
 				s = {
 					userId: session.userId,
 					deviceId: session.deviceId
@@ -501,7 +543,7 @@ function registerAccountRoutes(r) {
 			const hs = ctx.hs;
 			rejectIfDelegated(hs);
 			const s = await ctx.auth();
-			await requireUia(hs, ctx.input, [[M.LOGIN.PASSWORD]], s.userId);
+			await requireUia(hs, ctx.input, [[M.LOGIN.PASSWORD]], s.userId, { session: s });
 			for (const membership of [
 				"join",
 				"invite",
@@ -593,7 +635,10 @@ async function registrationTokenValid(hs, token) {
 }
 async function consumeRegistrationToken(hs, body) {
 	if (body.auth?.type !== M.LOGIN.REGISTRATION_TOKEN) return;
-	const token = body.auth?.token;
+	await redeemRegistrationToken(hs, body.auth?.token);
+}
+/** Count one use of a registration token. */
+async function redeemRegistrationToken(hs, token) {
 	const row = await hs.db.findOne("registration_tokens", [{
 		field: "token",
 		value: token
@@ -610,4 +655,4 @@ function wellKnown(hs) {
 	return wk;
 }
 //#endregion
-export { createUser, registerAccountRoutes, registrationFlows, registrationTokenValid, wellKnown };
+export { checkPasswordLogin, createUser, redeemRegistrationToken, registerAccountRoutes, registrationFlows, registrationTokenValid, ssoConfirmPage, validateNewUsername, wellKnown };

package/dist/api/admin.js

@@ -2,6 +2,7 @@ import { errors } from "../core/errors.js";
 import { boolean, looseObject, number, string } from "../vendor/zod/v4/classic/schemas.js";
 import { body, fail, lenient } from "../http/input.js";
 import { procedure } from "../http/procedure.js";
+import { allowCrossSigningReset } from "../core/oauthserver.js";
 //#region src/api/admin.ts
 const required = fail("M_BAD_JSON", "user_id and content are required");
 const noticeBody = body({
@@ -132,6 +133,14 @@ function registerAdminRoutes(r) {
 		if (body.deactivated === true) await ctx.hs.admin.deactivateUser(userId);
 		return ctx.hs.admin.getUser(userId);
 	} }));
+	r.post("/_synapse/admin/v1/users/:userId/_allow_cross_signing_replacement_without_uia", procedure({
+		guard: adminGuard,
+		handler: async (ctx) => {
+			const userId = ctx.params.userId;
+			if (!ctx.hs.isLocalUser(userId) || !await ctx.hs.admin.getUser(userId)) throw errors.notFound("Unknown user");
+			return { updatable_without_uia_before_ms: await allowCrossSigningReset(ctx.hs, userId) };
+		}
+	}));
 	r.post("/_synapse/admin/v1/deactivate/:userId", procedure({
 		guard: adminGuard,
 		input: body({ erase: lenient(boolean()) }),

package/dist/api/federation.js

@@ -11,8 +11,8 @@ import { domainOf, serverAllowedByAcl } from "../federation/index.js";
 import { array, looseObject, record, string, unknown } from "../vendor/zod/v4/classic/schemas.js";
 import { body, lenient } from "../http/input.js";
 import { procedure } from "../http/procedure.js";
-import { roomDetails } from "./spaces.js";
 import { fullProfile } from "../core/profile.js";
+import { roomDetails } from "./spaces.js";
 import { relationshipsForServer } from "./relationships.js";
 import { canonicalJsonResponse } from "../http/handler.js";
 //#region src/api/federation.ts

package/dist/api/index.js

@@ -1,4 +1,5 @@
 import { registerThreadSubscriptionRoutes } from "./threadsubs.js";
+import { registerOAuthServerRoutes } from "./oauthserver.js";
 import { registerAccountRoutes } from "./account.js";
 import { registerBackupRoutes } from "./backup.js";
 import { registerRoomRoutes } from "./rooms.js";
@@ -23,6 +24,7 @@ import { registerUserRoutes } from "./user.js";
 function registerRoutes(r) {
 	registerMiscRoutes(r);
 	registerAccountRoutes(r);
+	registerOAuthServerRoutes(r);
 	registerProfileRoutes(r);
 	registerRoomRoutes(r);
 	registerLegacyRoutes(r);

package/dist/api/longpoll.js

@@ -0,0 +1,61 @@
+//#region src/api/longpoll.ts
+/**
+* The long-poll loop of `/sync` and sliding sync: build a response up to the current stream
+* position, and while it has nothing new, wait for a change for `userId` and build again.
+*
+* https://github.com/k18k/matrix-nodejs-homeserver/issues/50: after a build with nothing new, the
+* loop used to build again whenever the server-wide position had moved, which under load is
+* always, so waiting requests rebuilt back to back. Now it registers for the user's wake-ups
+* before reading the position, so none is missed during a build, and otherwise sleeps. A wake-up
+* says which position its change has; if the next build cannot see it yet (another write in
+* flight holds the position back), the loop waits for the position to get there.
+*
+* `build(to)` returns whether the response is final (`done`); returns the last built value, the
+* position it was built at, and whether the request was aborted while waiting.
+*/
+async function longPoll(hs, userId, timeoutMs, signal, build) {
+	const deadline = Date.now() + timeoutMs;
+	let pending = 0;
+	for (;;) {
+		const listener = hs.notifier.listen(userId);
+		pending = Math.max(pending, listener.recent);
+		let to;
+		let built;
+		try {
+			to = await hs.streams.position();
+			if (pending > to) to = await hs.streams.position(true);
+			built = await build(to);
+		} catch (err) {
+			listener.cancel();
+			throw err;
+		}
+		if (pending <= to) pending = 0;
+		const remaining = deadline - Date.now();
+		if (built.done || remaining <= 0 || signal?.aborted) {
+			listener.cancel();
+			return {
+				value: built.value,
+				to,
+				aborted: !!signal?.aborted
+			};
+		}
+		if (pending > to) {
+			listener.cancel();
+			if (await hs.streams.waitFor(pending, remaining, signal)) continue;
+			return {
+				value: built.value,
+				to,
+				aborted: !!signal?.aborted
+			};
+		}
+		const woke = await listener.wait(remaining, signal);
+		if (woke === null) return {
+			value: built.value,
+			to,
+			aborted: !!signal?.aborted
+		};
+		pending = Math.max(pending, woke);
+	}
+}
+//#endregion
+export { longPoll };

package/dist/api/misc.js

@@ -60,7 +60,7 @@ function registerMiscRoutes(r) {
 			const available = {};
 			for (const v of SUPPORTED_ROOM_VERSIONS) available[v] = /^\d+$/.test(v) ? "stable" : "unstable";
 			return { capabilities: {
-				[M.CHANGE_PASSWORD]: { enabled: !ctx.hs.oauth && ctx.hs.userAuth.passwordLoginEnabled },
+				[M.CHANGE_PASSWORD]: { enabled: !ctx.hs.oauth && !ctx.session.oauth && ctx.hs.userAuth.passwordLoginEnabled },
 				[M.ROOM_VERSIONS]: {
 					default: ctx.hs.config.defaultRoomVersion,
 					available
@@ -68,8 +68,8 @@ function registerMiscRoutes(r) {
 				[M.SET_DISPLAYNAME]: { enabled: true },
 				[M.SET_AVATAR_URL]: { enabled: true },
 				[M.PROFILE_FIELDS]: { enabled: true },
-				[M.THREEPID_CHANGES]: { enabled: ctx.hs.threepids.enabled && !ctx.hs.oauth },
-				[M.GET_LOGIN_TOKEN]: { enabled: ctx.hs.config.loginViaExistingSession && !ctx.hs.oauth }
+				[M.THREEPID_CHANGES]: { enabled: ctx.hs.threepids.enabled && !ctx.hs.oauth && !ctx.session.oauth },
+				[M.GET_LOGIN_TOKEN]: { enabled: ctx.hs.config.loginViaExistingSession && !ctx.hs.oauth && !ctx.session.oauth }
 			} };
 		}
 	}));