matrix-nodejs-homeserver 0.3.4 → 0.3.6

package/AUDITBOT.md

@@ -0,0 +1,67 @@
+# Audit bot
+
+`matrix-nodejs-homeserver/auditbot` records the rooms of the server, end-to-end encrypted ones
+included, to an archive: an account of the server that is a member of every room (or every room
+but direct messages) and writes each event as one JSON line.
+
+It needs the crypto library, an optional peer dependency:
+
+```sh
+npm install matrix-nodejs-homeserver @matrix-org/matrix-sdk-crypto-nodejs
+```
+
+```ts
+import { createHomeserver } from "matrix-nodejs-homeserver";
+import { fileSink, startAuditBot } from "matrix-nodejs-homeserver/auditbot";
+
+const hs = createHomeserver({ /* … */ });
+const bot = await startAuditBot(hs, {
+  sink: fileSink("/data/audit"),          // {room ID}/{YYYY-MM-DD}.jsonl
+  dataDir: "/data/auditbot",              // crypto store and sync position: keep and back up
+  storePassphrase: process.env.AUDIT_STORE_PASSPHRASE!,
+  rooms: "groups",                        // or "all" (default): with direct messages
+});
+// await bot.stop() on shutdown, before hs.close()
+```
+
+## How it works
+
+- **It is a room member.** It joins new rooms on its own, and existing ones at start and every
+  10 minutes. Public rooms are joined directly. In other rooms, a local member who may invite
+  invites it (`hs.admin.joinUser`, Synapse's `POST /_synapse/admin/v1/join`). The invite shows in
+  the room, and the bot is in the member list as "Audit log (this room is recorded)", so everyone
+  can see that a room is recorded.
+- **End-to-end encryption.** It is a device like any other, with matrix-sdk-crypto (the Rust
+  crypto of the Element apps). Clients send it the room keys as they do to every member's device,
+  and it decrypts the events. Its device is signed by its own cross-signing identity. Keys live in
+  an encrypted SQLite store in `dataDir`, so it reads messages again after a restart.
+- **Direct messages** are left out with `rooms: "groups"`. It does not join rooms created with
+  `is_direct`, and it leaves a room that turns out to be one.
+- **In-process.** It runs in the homeserver's process and calls its API through the request
+  handler, with no network and no port.
+
+What it cannot read: anything sent before it joined a room. It also misses messages from
+clients set to share keys only with verified devices. A message whose key never arrives is
+recorded after an hour with `decryption_error` and its ciphertext.
+
+## Records
+
+```json
+{"recorded_at":1792270000000,"room_id":"!abc:example.com","event_id":"$…","type":"m.room.message",
+ "sender":"@alice:example.com","origin_server_ts":1792269999000,
+ "content":{"msgtype":"m.text","body":"hello"},"encrypted":true,"sender_device":"ABCDEFGHIJ"}
+```
+
+`state_key` and `redacts` appear when the event has them. `initial_state: true` marks state the
+room had when the bot joined. A sink is anything with `write(records)`: `fileSink(dir)`,
+`memorySink()`, or your own (S3, a SIEM, a database).
+
+## Before you turn it on
+
+Recording people's conversations, encrypted ones included, needs a legal basis and telling them:
+terms of use, a privacy policy, and in the EU the GDPR. The bot's name says it in every room, but
+it does not replace those.
+
+The crypto library is a native module (Linux, macOS, Windows; x64 and arm64). Its install script
+downloads it from the project's GitHub releases. With `--ignore-scripts`, run
+`node node_modules/@matrix-org/matrix-sdk-crypto-nodejs/download-lib.js`.

package/README.md

@@ -137,8 +137,9 @@ createHomeserver({
   `await hs.auth.createLoginToken(userId)` and let the client exchange the token via
   `m.login.token`. You can also call `hs.auth.createSession(userId)` to issue an
   access token directly.
-- **SSO with upstream OpenID Connect providers** (Google, GitHub via an OIDC
-  bridge, Keycloak, Authentik, …). Users can sign in with `m.login.sso`:
+- **SSO with upstream providers:** OpenID Connect (Google, Keycloak,
+  Authentik, Better Auth, …) or plain OAuth 2.0 such as GitHub
+  (`githubProvider({ clientId, clientSecret })`). Users can sign in with `m.login.sso`:
   ```ts
   sso: { providers: [{ id: "google", name: "Google", issuer: "https://accounts.google.com",
     clientId, clientSecret, mapUser: (claims) => ({ localpart: claims.email.split("@")[0] }) }] },
@@ -147,6 +148,37 @@ createHomeserver({
   After signing in, users confirm the client the login token goes to, on a page
   that names it. Clients you trust skip that page:
   `sso: { providers, clientAllowlist: ["https://app.element.io/"] }`.
+- **The OAuth 2.0 API, served by the homeserver** (spec v1.15–v1.18). Clients
+  such as Element X register themselves, and users sign in, register, approve
+  the client and manage their account on the server's own web pages. Those pages
+  offer the password and the providers of `sso`. Login only with GitHub:
+  ```ts
+  import { createHomeserver, githubProvider } from "matrix-nodejs-homeserver";
+
+  createHomeserver({
+    homeserver: "example.com",
+    publicBaseUrl: "https://matrix.example.com",
+    oauthServer: { termsUrl: "https://example.com/terms", policyUrl: "https://example.com/privacy" },
+    userAuthAdapter: { passwordLoginEnabled: false },
+    sso: { providers: [githubProvider({ clientId, clientSecret })] },
+  });
+  ```
+  The GitHub OAuth app's callback URL is
+  `https://matrix.example.com/_matrix/client/v3/login/sso/callback/github`. The first
+  login creates the account. Users are matched by their GitHub ID, so a renamed
+  GitHub account keeps its Matrix account.
+
+  What is served: dynamic client registration with the spec's redirect URI
+  rules, the authorization code grant with PKCE (S256), the device authorization
+  grant (for CLIs and TVs), refresh tokens and revocation. It also covers
+  `prompt=create`, the account management page with every action the spec
+  lists, `m.oauth` for cross-signing resets, and ID tokens for clients that ask
+  for `openid`. Access tokens live 5 minutes (`accessTokenLifetimeMs`). Refresh
+  tokens rotate: a client whose response got lost can retry, and a refresh
+  token used again after it was replaced logs the device out. The pages are
+  under `/_synapse/client/oauth2/`. The legacy API stays available
+  (`legacyApi: false` turns it off), and its `m.login.sso` goes through the same
+  pages.
 - **Delegated OAuth 2.0** (the Matrix OAuth API, e.g. with
   matrix-authentication-service, Keycloak or Authentik). The provider owns the
   accounts, and the homeserver validates its access tokens by introspection:
@@ -313,6 +345,18 @@ up for admins (`/_synapse/admin/v1/event_reports`, `reports list`), and the admi
 room is notified. `GET /_matrix/client/v3/admin/whois/{userId}` shows a user's
 devices and IP addresses.
 
+## Audit bot
+
+`matrix-nodejs-homeserver/auditbot` records every room of the server to an archive, end-to-end
+encrypted ones decrypted, like the Auditing of Element Server Suite Pro. The bot is a room
+member with its own device, visible in member lists. See [AUDITBOT.md](https://github.com/k18k/matrix-nodejs-homeserver/blob/main/packages/core/AUDITBOT.md).
+
+```ts
+import { fileSink, startAuditBot } from "matrix-nodejs-homeserver/auditbot";
+
+await startAuditBot(hs, { sink: fileSink("/data/audit"), dataDir: "/data/auditbot", storePassphrase, rooms: "groups" });
+```
+
 ## Administration
 
 You can use `hs.admin` from your own code:
@@ -342,8 +386,9 @@ paths (server admins only), so existing tools keep working.
 | `cluster` | Cluster adapter for running several instances. |
 | `adminRoom` | `true` or `{ firstUserIsAdmin, firstUserCanRegister, botLocalpart, … }`. Disabled by default. |
 | `audit` | `{ enabled, database, sink, actions, retentionDays }`. Disabled by default. |
-| `publicBaseUrl` | Advertised via `/.well-known/matrix/client`. Required for SSO. |
-| `oauth`, `sso` | Delegated OAuth or upstream OIDC SSO. |
+| `publicBaseUrl` | Advertised via `/.well-known/matrix/client`. Required for SSO and `oauthServer`. |
+| `oauthServer` | `true` or `{ legacyApi, accessTokenLifetimeMs, termsUrl, policyUrl, webSessionLifetimeMs }`: the OAuth 2.0 API, served by the homeserver. |
+| `oauth`, `sso` | Delegated OAuth, and upstream identity providers (OIDC or OAuth 2.0, e.g. `githubProvider`). |
 | `federation` | `{ enabled, verifyTls, allowedServers, blockedServers, fasterJoins }`. Off unless `enabled: true`. |
 | `allowPrivateAddresses` | Lets requests to addresses that users or remote servers choose (federation, push gateways, identity servers, URL previews, remote media) reach private addresses: `true`, or ranges such as `["127.0.0.1/32"]`. Blocked by default. |
 | `rtc` | `{ turn, transports }` |
@@ -377,13 +422,14 @@ available for integration and metrics.
 - **Media:** legacy and authenticated endpoints, async uploads, thumbnails, the remote media proxy, URL previews
 - **Federation, VoIP/MatrixRTC, admin, server notices**
 
-Not implemented: third-party identifiers (email/phone), application services,
-and a built-in OAuth authorization server. For OAuth, delegate to an existing provider.
-
 ## Development
 
+The repository is an npm workspace: this package is `packages/core`, and `apps/` holds the
+public server built on it (see the repository's README). Install from the repository root;
+the commands below run in `packages/core`.
+
 ```sh
-npm install
+npm install                      # at the repository root
 npm run typecheck                # tsc only type-checks (noEmit)
 npm run build                    # tsdown → dist/ (what the published package contains)
 node examples/node-http.ts       # development runs the TypeScript sources directly (type stripping)
@@ -493,7 +539,7 @@ CI runs the whole suite with the same script. `complement/passing.txt` lists the
 
 ### Load testing
 
-Tuning and investigation runs are local; a [workflow](.github/workflows/loadtest.yml) runs the same scenarios on main for the badges. [loadtest/](loadtest/) holds a k6 scenario and a
+Tuning and investigation runs are local; a [workflow](https://github.com/k18k/matrix-nodejs-homeserver/blob/main/.github/workflows/loadtest.yml) runs the same scenarios on main for the badges. [loadtest/](loadtest/) holds a k6 scenario and a
 homeserver that reports, every 10 s, requests per second, memory, event-loop delay and
 (with Postgres) how many queries wait for a pool connection and how long locks are held.
 

package/dist/api/account.js

@@ -9,8 +9,10 @@ import { canonicalAddress, isMedium } from "../core/threepid.js";
 import { boolean, looseObject, string } from "../vendor/zod/v4/classic/schemas.js";
 import { body, fail, lenient } from "../http/input.js";
 import { procedure } from "../http/procedure.js";
+import { OAUTH_PREFIX } from "../core/oauthserver.js";
 import { requireUia } from "./uia.js";
-import { checkRedirectUrl } from "../core/sso.js";
+import { checkRedirectUrl, legacyClientRedirect } from "../core/sso.js";
+import { readWebSession, setWebUser } from "./oauthserver.js";
 import { createHmac, randomInt, timingSafeEqual } from "node:crypto";
 //#region src/api/account.ts
 const deviceFields = {
@@ -46,16 +48,18 @@ const sharedSecretRegisterBody = body({
 });
 function loginFlows(hs) {
 	if (hs.oauth) return [];
+	if (hs.oauthServer && !hs.oauthServer.legacyApi) throw errors.unrecognized("Log in with the OAuth 2.0 API");
 	const flows = [];
 	if (hs.userAuth.passwordLoginEnabled) flows.push({ type: M.LOGIN.PASSWORD });
-	if (hs.sso) flows.push({
+	if (hs.sso || hs.oauthServer) flows.push({
 		type: M.LOGIN.SSO,
-		identity_providers: hs.sso.providers.map((p) => ({
+		identity_providers: (hs.sso?.providers ?? []).map((p) => ({
 			id: p.id,
 			name: p.name,
 			icon: p.icon,
 			brand: p.brand
-		}))
+		})),
+		...hs.oauthServer ? { oauth_aware_preferred: true } : {}
 	});
 	flows.push({
 		type: M.LOGIN.TOKEN,
@@ -65,6 +69,7 @@ function loginFlows(hs) {
 }
 /** Endpoints that manage passwords are unavailable when an OAuth provider owns the accounts. */
 function rejectIfDelegated(hs) {
+	if (hs.oauthServer && !hs.oauthServer.legacyApi) throw errors.unrecognized("Use the OAuth 2.0 API");
 	if (hs.oauth) throw new MatrixError(403, "M_FORBIDDEN", "Accounts are managed by the OAuth provider", hs.oauth.options.accountManagementUrl ? { account_management_uri: hs.oauth.options.accountManagementUrl } : {});
 }
 async function validateNewUsername(hs, raw) {
@@ -105,6 +110,42 @@ async function createUser(hs, localpart, opts) {
 	await hs.adminRoom?.onUserCreated(userId).catch((err) => hs.logger.error("Admin room setup failed", err));
 	return userId;
 }
+/**
+* Check a password login, with the audit entries and automatic provisioning of `/login`; returns
+* the user ID. Shared with the OAuth server's login page.
+*/
+async function checkPasswordLogin(hs, userId, password, request) {
+	let user = await hs.db.findOne("users", [{
+		field: "user_id",
+		value: userId
+	}]);
+	if (!await hs.userAuth.checkPassword({
+		userId,
+		localpart: userId.slice(1).split(":")[0],
+		password,
+		storedHash: user?.password_hash ?? null
+	})) {
+		await hs.audit.record({
+			action: "login_failed",
+			actor: userId,
+			ip: request.ip,
+			userAgent: request.userAgent,
+			outcome: "failure",
+			details: { type: M.LOGIN.PASSWORD }
+		});
+		throw errors.forbidden("Invalid username or password");
+	}
+	if (!user) {
+		if (!await hs.userAuth.autoProvision(userId)) throw errors.forbidden("Invalid username or password");
+		await createUser(hs, userId.slice(1).split(":")[0], {});
+		user = await hs.db.findOne("users", [{
+			field: "user_id",
+			value: userId
+		}]);
+	}
+	if (user.deactivated) throw errors.userDeactivated();
+	return userId;
+}
 async function resolveLoginUser(hs, body) {
 	let user;
 	const id = isObject(body.identifier) ? body.identifier : null;
@@ -138,45 +179,63 @@ async function resolveLoginUser(hs, body) {
 	}
 	return `@${user.toLowerCase()}:${hs.serverName}`;
 }
+const ssoConfirmPage = (serverName, result) => {
+	const client = escapeHtml(result.client);
+	const html = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Continue to ${client}</title>
+<style>body{font:16px system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem}a.button{display:inline-block;padding:.6rem 1.2rem;background:#0b7a55;color:#fff;border-radius:6px;text-decoration:none}</style>
+<h1>Continue to ${client}?</h1>
+<p>You signed in to <b>${escapeHtml(serverName)}</b>. <b>${client}</b> will get access to your account.</p>
+<p>If you did not just sign in with this app, close this page.</p>
+<p><a class="button" href="${escapeHtml(result.url)}">Continue to ${client}</a></p>`;
+	return new Response(html, { headers: {
+		"content-type": "text/html; charset=utf-8",
+		"cache-control": "no-store",
+		"referrer-policy": "no-referrer",
+		"x-frame-options": "DENY",
+		"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
+	} });
+};
+const OAUTH_DISCOVERY_VERSIONS = ["v1", "unstable/org.matrix.msc2965"];
 function registerAccountRoutes(r) {
 	r.client("GET", "/login", procedure({ handler: (ctx) => ({ flows: loginFlows(ctx.hs) }) }));
 	r.client("GET", "/auth_metadata", procedure({ handler: async (ctx) => {
+		if (ctx.hs.oauthServer) return ctx.hs.oauthServer.metadata();
 		if (!ctx.hs.oauth) throw errors.unrecognized("OAuth is not enabled");
 		return ctx.hs.oauth.serverMetadata();
-	} }), ["v1"]);
+	} }), OAUTH_DISCOVERY_VERSIONS);
 	r.client("GET", "/auth_issuer", procedure({ handler: (ctx) => {
+		if (ctx.hs.oauthServer) return { issuer: ctx.hs.oauthServer.issuer };
 		if (!ctx.hs.oauth) throw errors.unrecognized("OAuth is not enabled");
 		return { issuer: ctx.hs.oauth.options.issuer };
-	} }), ["v1"]);
-	const ssoConfirmPage = (serverName, result) => {
-		const client = escapeHtml(result.client);
-		const html = `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Continue to ${client}</title>
-<style>body{font:16px system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem}a.button{display:inline-block;padding:.6rem 1.2rem;background:#0b7a55;color:#fff;border-radius:6px;text-decoration:none}</style>
-<h1>Continue to ${client}?</h1>
-<p>You signed in to <b>${escapeHtml(serverName)}</b>. <b>${client}</b> will get access to your account.</p>
-<p>If you did not just sign in with this app, close this page.</p>
-<p><a class="button" href="${escapeHtml(result.url)}">Continue to ${client}</a></p>`;
-		return new Response(html, { headers: {
-			"content-type": "text/html; charset=utf-8",
-			"cache-control": "no-store",
-			"referrer-policy": "no-referrer",
-			"x-frame-options": "DENY",
-			"content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'"
-		} });
-	};
+	} }), OAUTH_DISCOVERY_VERSIONS);
 	const ssoRedirect = async (ctx) => {
-		if (!ctx.hs.sso) throw errors.unrecognized("SSO is not enabled");
+		const hs = ctx.hs;
 		const redirectUrl = checkRedirectUrl(ctx.query.get("redirectUrl"));
+		if (hs.oauthServer) {
+			if (!hs.oauthServer.legacyApi) throw errors.unrecognized("Log in with the OAuth 2.0 API");
+			if (!redirectUrl) throw errors.missingParam("Missing or invalid redirectUrl");
+			const id = randomString(24);
+			await hs.cluster.set(`oauth:legacy:${id}`, redirectUrl, 18e5);
+			const next = `${OAUTH_PREFIX}/legacy/${id}`;
+			const idp = ctx.params.idpId;
+			if (idp && !hs.sso?.providers.some((p) => p.id === idp)) throw errors.notFound("Unknown identity provider");
+			const page = idp ? `/upstream/${encodeURIComponent(idp)}` : ctx.query.get("action") === "register" ? "/register-account" : "/login";
+			return Response.redirect(`${hs.oauthServer.url(page)}?next=${encodeURIComponent(next)}`, 302);
+		}
+		if (!hs.sso) throw errors.unrecognized("SSO is not enabled");
 		if (!redirectUrl) throw errors.missingParam("Missing or invalid redirectUrl");
-		return Response.redirect(await ctx.hs.sso.startLogin(ctx.params.idpId ?? null, redirectUrl), 302);
+		return Response.redirect(await hs.sso.startLogin(ctx.params.idpId ?? null, {
+			kind: "client",
+			redirectUrl
+		}), 302);
 	};
 	r.client("POST", "/login/get_token", procedure({
 		auth: "user",
 		handler: async (ctx) => {
 			const s = ctx.session;
-			if (!ctx.hs.config.loginViaExistingSession || ctx.hs.oauth || s.isGuest) throw errors.unrecognized();
+			if (!ctx.hs.config.loginViaExistingSession || ctx.hs.oauth || s.oauth || s.isGuest) throw errors.unrecognized();
 			await ctx.rateLimit("login");
-			await requireUia(ctx.hs, await ctx.json(), [[M.LOGIN.PASSWORD]], s.userId);
+			await requireUia(ctx.hs, await ctx.json(), [[M.LOGIN.PASSWORD]], s.userId, { session: s });
 			const ttl = 12e4;
 			return {
 				login_token: await ctx.hs.auth.createLoginToken(s.userId, ttl),
@@ -187,9 +246,17 @@ function registerAccountRoutes(r) {
 	r.client("GET", "/login/sso/redirect", procedure({ handler: ssoRedirect }));
 	r.client("GET", "/login/sso/redirect/:idpId", procedure({ handler: ssoRedirect }));
 	r.client("GET", "/login/sso/callback/:idpId", procedure({ handler: async (ctx) => {
-		if (!ctx.hs.sso) throw errors.unrecognized("SSO is not enabled");
-		const result = await ctx.hs.sso.finishLogin(ctx.params.idpId, ctx.query);
-		return result.confirm ? ssoConfirmPage(ctx.hs.serverName, result) : Response.redirect(result.url, 302);
+		const hs = ctx.hs;
+		if (!hs.sso) throw errors.unrecognized("SSO is not enabled");
+		const { userId, target } = await hs.sso.finishLogin(ctx.params.idpId, ctx.query);
+		if (target.kind === "web") {
+			const web = await readWebSession(ctx);
+			if (!web || web.sid !== target.sid) throw errors.forbidden("This login was started in another browser");
+			await setWebUser(hs, web, userId);
+			return Response.redirect(hs.oauthServer.url(target.next.slice(OAUTH_PREFIX.length)), 302);
+		}
+		const result = await legacyClientRedirect(hs, userId, target.redirectUrl);
+		return result.confirm ? ssoConfirmPage(hs.serverName, result) : Response.redirect(result.url, 302);
 	} }));
 	r.client("POST", "/login", procedure({
 		rateLimit: "login",
@@ -198,6 +265,7 @@ function registerAccountRoutes(r) {
 			const body = ctx.input;
 			const hs = ctx.hs;
 			if (hs.oauth) throw errors.unrecognized("Log in through the OAuth provider");
+			if (hs.oauthServer && !hs.oauthServer.legacyApi) throw errors.unrecognized("Log in with the OAuth 2.0 API");
 			if (body.type === M.LOGIN.APPLICATION_SERVICE) {
 				const reg = ctx.accessToken() ? hs.appservices.byToken(ctx.accessToken()) : null;
 				if (!reg) throw errors.unknownToken("An application service token is required");
@@ -254,37 +322,11 @@ function registerAccountRoutes(r) {
 			if (body.type !== M.LOGIN.PASSWORD || !hs.userAuth.passwordLoginEnabled) throw errors.unknown("Unsupported login type");
 			const userId = await resolveLoginUser(hs, body);
 			if (body.password === void 0) throw errors.missingParam("Missing password");
-			let user = await hs.db.findOne("users", [{
-				field: "user_id",
-				value: userId
-			}]);
-			const ok = await hs.userAuth.checkPassword({
-				userId,
-				localpart: userId.slice(1).split(":")[0],
-				password: body.password,
-				storedHash: user?.password_hash ?? null
-			});
 			const ua = ctx.request.headers.get("user-agent");
-			if (!ok) {
-				await hs.audit.record({
-					action: "login_failed",
-					actor: userId,
-					ip: ctx.ip,
-					userAgent: ua,
-					outcome: "failure",
-					details: { type: M.LOGIN.PASSWORD }
-				});
-				throw errors.forbidden("Invalid username or password");
-			}
-			if (!user) {
-				if (!await hs.userAuth.autoProvision(userId)) throw errors.forbidden("Invalid username or password");
-				await createUser(hs, userId.slice(1).split(":")[0], {});
-				user = await hs.db.findOne("users", [{
-					field: "user_id",
-					value: userId
-				}]);
-			}
-			if (user.deactivated) throw errors.userDeactivated();
+			await checkPasswordLogin(hs, userId, body.password, {
+				ip: ctx.ip,
+				userAgent: ua
+			});
 			const session = await hs.auth.createSession(userId, {
 				deviceId: body.device_id,
 				displayName: body.initial_device_display_name,
@@ -310,7 +352,7 @@ function registerAccountRoutes(r) {
 		handler: async (ctx) => {
 			const body = ctx.input;
 			if (body.refresh_token === void 0) throw errors.missingParam("Missing refresh_token");
-			const { access_token, refresh_token, expires_in_ms } = await ctx.hs.auth.refresh(body.refresh_token);
+			const { access_token, refresh_token, expires_in_ms } = await ctx.hs.auth.refresh(body.refresh_token, { clientId: null });
 			return {
 				access_token,
 				refresh_token,
@@ -464,7 +506,7 @@ function registerAccountRoutes(r) {
 			let s;
 			if (ctx.accessToken()) {
 				const session = await ctx.auth();
-				await requireUia(hs, body, [[M.LOGIN.PASSWORD]], session.userId);
+				await requireUia(hs, body, [[M.LOGIN.PASSWORD]], session.userId, { session });
 				s = {
 					userId: session.userId,
 					deviceId: session.deviceId
@@ -501,7 +543,7 @@ function registerAccountRoutes(r) {
 			const hs = ctx.hs;
 			rejectIfDelegated(hs);
 			const s = await ctx.auth();
-			await requireUia(hs, ctx.input, [[M.LOGIN.PASSWORD]], s.userId);
+			await requireUia(hs, ctx.input, [[M.LOGIN.PASSWORD]], s.userId, { session: s });
 			for (const membership of [
 				"join",
 				"invite",
@@ -593,7 +635,10 @@ async function registrationTokenValid(hs, token) {
 }
 async function consumeRegistrationToken(hs, body) {
 	if (body.auth?.type !== M.LOGIN.REGISTRATION_TOKEN) return;
-	const token = body.auth?.token;
+	await redeemRegistrationToken(hs, body.auth?.token);
+}
+/** Count one use of a registration token. */
+async function redeemRegistrationToken(hs, token) {
 	const row = await hs.db.findOne("registration_tokens", [{
 		field: "token",
 		value: token
@@ -610,4 +655,4 @@ function wellKnown(hs) {
 	return wk;
 }
 //#endregion
-export { createUser, registerAccountRoutes, registrationFlows, registrationTokenValid, wellKnown };
+export { checkPasswordLogin, createUser, redeemRegistrationToken, registerAccountRoutes, registrationFlows, registrationTokenValid, ssoConfirmPage, validateNewUsername, wellKnown };

package/dist/api/admin.js

@@ -2,6 +2,7 @@ import { errors } from "../core/errors.js";
 import { boolean, looseObject, number, string } from "../vendor/zod/v4/classic/schemas.js";
 import { body, fail, lenient } from "../http/input.js";
 import { procedure } from "../http/procedure.js";
+import { allowCrossSigningReset } from "../core/oauthserver.js";
 //#region src/api/admin.ts
 const required = fail("M_BAD_JSON", "user_id and content are required");
 const noticeBody = body({
@@ -132,6 +133,19 @@ function registerAdminRoutes(r) {
 		if (body.deactivated === true) await ctx.hs.admin.deactivateUser(userId);
 		return ctx.hs.admin.getUser(userId);
 	} }));
+	r.post("/_synapse/admin/v1/join/:roomIdOrAlias", procedure({
+		guard: adminGuard,
+		input: body({ user_id: string(fail("M_MISSING_PARAM", "user_id is required", "user_id")) }),
+		handler: async (ctx) => ({ room_id: await ctx.hs.admin.joinUser(ctx.input.user_id, ctx.params.roomIdOrAlias) })
+	}));
+	r.post("/_synapse/admin/v1/users/:userId/_allow_cross_signing_replacement_without_uia", procedure({
+		guard: adminGuard,
+		handler: async (ctx) => {
+			const userId = ctx.params.userId;
+			if (!ctx.hs.isLocalUser(userId) || !await ctx.hs.admin.getUser(userId)) throw errors.notFound("Unknown user");
+			return { updatable_without_uia_before_ms: await allowCrossSigningReset(ctx.hs, userId) };
+		}
+	}));
 	r.post("/_synapse/admin/v1/deactivate/:userId", procedure({
 		guard: adminGuard,
 		input: body({ erase: lenient(boolean()) }),

package/dist/api/federation.js

@@ -11,8 +11,8 @@ import { domainOf, serverAllowedByAcl } from "../federation/index.js";
 import { array, looseObject, record, string, unknown } from "../vendor/zod/v4/classic/schemas.js";
 import { body, lenient } from "../http/input.js";
 import { procedure } from "../http/procedure.js";
-import { roomDetails } from "./spaces.js";
 import { fullProfile } from "../core/profile.js";
+import { roomDetails } from "./spaces.js";
 import { relationshipsForServer } from "./relationships.js";
 import { canonicalJsonResponse } from "../http/handler.js";
 //#region src/api/federation.ts

package/dist/api/index.js

@@ -1,4 +1,5 @@
 import { registerThreadSubscriptionRoutes } from "./threadsubs.js";
+import { registerOAuthServerRoutes } from "./oauthserver.js";
 import { registerAccountRoutes } from "./account.js";
 import { registerBackupRoutes } from "./backup.js";
 import { registerRoomRoutes } from "./rooms.js";
@@ -23,6 +24,7 @@ import { registerUserRoutes } from "./user.js";
 function registerRoutes(r) {
 	registerMiscRoutes(r);
 	registerAccountRoutes(r);
+	registerOAuthServerRoutes(r);
 	registerProfileRoutes(r);
 	registerRoomRoutes(r);
 	registerLegacyRoutes(r);

package/dist/api/misc.js

@@ -60,7 +60,7 @@ function registerMiscRoutes(r) {
 			const available = {};
 			for (const v of SUPPORTED_ROOM_VERSIONS) available[v] = /^\d+$/.test(v) ? "stable" : "unstable";
 			return { capabilities: {
-				[M.CHANGE_PASSWORD]: { enabled: !ctx.hs.oauth && ctx.hs.userAuth.passwordLoginEnabled },
+				[M.CHANGE_PASSWORD]: { enabled: !ctx.hs.oauth && !ctx.session.oauth && ctx.hs.userAuth.passwordLoginEnabled },
 				[M.ROOM_VERSIONS]: {
 					default: ctx.hs.config.defaultRoomVersion,
 					available
@@ -68,8 +68,8 @@ function registerMiscRoutes(r) {
 				[M.SET_DISPLAYNAME]: { enabled: true },
 				[M.SET_AVATAR_URL]: { enabled: true },
 				[M.PROFILE_FIELDS]: { enabled: true },
-				[M.THREEPID_CHANGES]: { enabled: ctx.hs.threepids.enabled && !ctx.hs.oauth },
-				[M.GET_LOGIN_TOKEN]: { enabled: ctx.hs.config.loginViaExistingSession && !ctx.hs.oauth }
+				[M.THREEPID_CHANGES]: { enabled: ctx.hs.threepids.enabled && !ctx.hs.oauth && !ctx.session.oauth },
+				[M.GET_LOGIN_TOKEN]: { enabled: ctx.hs.config.loginViaExistingSession && !ctx.hs.oauth && !ctx.session.oauth }
 			} };
 		}
 	}));