matrix-nodejs-homeserver 0.3.4 → 0.3.6

package/dist/api/uia.js

@@ -2,15 +2,26 @@ import { isObject } from "../core/json.js";
 import { randomString } from "../core/crypto.js";
 import { M, UNSTABLE } from "../core/m.js";
 import { MatrixError, errors } from "../core/errors.js";
+import { crossSigningResetAllowed } from "../core/oauthserver.js";
 //#region src/api/uia.ts
 const UIA_TTL_MS = 6e5;
 /**
 * User-interactive authentication. Resolves when one of `flows` has been
 * completed; otherwise throws the 401 response describing what is required.
-* `userId` binds password stages to an already-authenticated user.
+* `userId` binds password stages to an already-authenticated user. `session` is the caller's,
+* and `crossSigningReset` marks `/keys/device_signing/upload`, the one endpoint where tokens of
+* the OAuth 2.0 API may use UIA (the `m.oauth` stage).
 */
-async function requireUia(hs, body, flows, userId) {
-	if (hs.oauth && flows.some((f) => f.includes(M.LOGIN.PASSWORD))) flows = [[M.OAUTH], [UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET]];
+async function requireUia(hs, body, flows, userId, opts = {}) {
+	const viaOAuth = !!opts.session?.oauth || !!hs.oauth && flows.some((f) => f.includes(M.LOGIN.PASSWORD));
+	let oauthUrl;
+	if (viaOAuth) {
+		const accountUri = hs.oauthServer?.accountManagementUri ?? hs.oauth?.options.accountManagementUrl;
+		if (!opts.crossSigningReset) throw new MatrixError(403, "M_FORBIDDEN", "Do this on the account management page", accountUri ? { account_management_uri: accountUri } : {});
+		if (userId && await crossSigningResetAllowed(hs, userId)) return { threepids: [] };
+		flows = [[M.OAUTH], [UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET]];
+		oauthUrl = hs.oauthServer ? `${hs.oauthServer.accountManagementUri}?action=org.matrix.cross_signing_reset` : hs.oauth.options.accountManagementUrl ?? hs.oauth.options.issuer;
+	}
 	const auth = isObject(body.auth) ? body.auth : null;
 	let sessionId = typeof auth?.session === "string" ? auth.session : void 0;
 	const stored = sessionId ? await hs.cluster.get(`uia:${sessionId}`) : null;
@@ -25,8 +36,7 @@ async function requireUia(hs, body, flows, userId) {
 		userId: session.userId,
 		threepids: session.threepids
 	}, UIA_TTL_MS);
-	const oauthUrl = hs.oauth?.options.accountManagementUrl ?? hs.oauth?.options.issuer;
-	const params = hs.oauth ? {
+	const params = oauthUrl ? {
 		[M.OAUTH]: { url: oauthUrl },
 		[UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET]: { url: oauthUrl }
 	} : {};
@@ -49,12 +59,14 @@ async function requireUia(hs, body, flows, userId) {
 			break;
 		case M.OAUTH:
 		case UNSTABLE.ORG.MATRIX.CROSS_SIGNING_RESET:
-			if (!hs.oauth) throw challenge({
+			if (!viaOAuth) throw challenge({
 				errcode: "M_UNRECOGNIZED",
 				error: "OAuth is not enabled"
 			});
-			session.completed.add(auth.type);
-			break;
+			throw challenge({
+				errcode: "M_FORBIDDEN",
+				error: "The reset has not been approved on the account page"
+			});
 		case M.LOGIN.REGISTRATION_TOKEN: {
 			const { registrationTokenValid } = await import("./account.js");
 			if (typeof auth.token !== "string" || !await registrationTokenValid(hs, auth.token)) throw challenge({

package/dist/api/user.js

@@ -185,7 +185,7 @@ function registerUserRoutes(r) {
 				value: ctx.params.deviceId
 			}];
 			if (!await ctx.hs.db.findOne("devices", where)) throw errors.notFound("Device not found");
-			await requireUia(ctx.hs, body, [[M.LOGIN.PASSWORD]], s.userId);
+			await requireUia(ctx.hs, body, [[M.LOGIN.PASSWORD]], s.userId, { session: s });
 			await ctx.hs.auth.deleteDevice(s.userId, ctx.params.deviceId);
 			return {};
 		}
@@ -196,7 +196,7 @@ function registerUserRoutes(r) {
 		handler: async (ctx) => {
 			const s = ctx.session;
 			const body = ctx.input;
-			await requireUia(ctx.hs, body, [[M.LOGIN.PASSWORD]], s.userId);
+			await requireUia(ctx.hs, body, [[M.LOGIN.PASSWORD]], s.userId, { session: s });
 			for (const d of body.devices) if (typeof d === "string") await ctx.hs.auth.deleteDevice(s.userId, d);
 			return {};
 		}
@@ -275,7 +275,10 @@ function registerUserRoutes(r) {
 					"self_signing",
 					"user_signing"
 				].filter((type) => body[`${type}_key`] !== void 0).every((type) => stored.get(type) === canonicalJson(body[`${type}_key`]))) return {};
-				await requireUia(ctx.hs, body, [[M.LOGIN.PASSWORD]], s.userId);
+				await requireUia(ctx.hs, body, [[M.LOGIN.PASSWORD]], s.userId, {
+					session: s,
+					crossSigningReset: true
+				});
 			}
 			await ctx.hs.keys.uploadCrossSigning(s.userId, body);
 			return {};

package/dist/auditbot/bot.d.ts

@@ -0,0 +1,37 @@
+import { Homeserver } from "../homeserver.js";
+import { AuditSink } from "./sinks.js";
+//#region src/auditbot/bot.d.ts
+export interface AuditBotOptions {
+  /** Where the records go: `fileSink(dir)`, or your own. */
+  sink: AuditSink;
+  /**
+   * Directory for the bot's state: its crypto store (room keys, device keys) and the sync
+   * position. Losing it loses the keys of encrypted rooms, so keep it on a persistent volume and
+   * back it up.
+   */
+  dataDir: string;
+  /** Encrypts the crypto store. Required; keep it with the backups of `dataDir`. */
+  storePassphrase: string;
+  /** Default "auditbot". */
+  localpart?: string;
+  /** The bot's name in member lists. Default "Audit log (this room is recorded)". */
+  displayName?: string;
+  /** "all" rooms, or "groups": not direct messages (rooms created with is_direct). Default "all". */
+  rooms?: "all" | "groups";
+  /** How often to look for rooms it is not in yet, in ms. Default 10 minutes. */
+  sweepIntervalMs?: number;
+  /** How long a new room has to be quiet before the bot joins it, in ms. Default 500. */
+  joinDelayMs?: number;
+  /** How long an undecryptable event waits for its room key before it is recorded as such. Default 1 hour. */
+  keyWaitMs?: number;
+}
+export interface AuditBot {
+  userId: string;
+  /** Resolves once the bot has synced up to now (tests). */
+  synced(): Promise<void>;
+  /** Join every room it is not in yet (it also does this on its own). */
+  sweep(): Promise<void>;
+  stop(): Promise<void>;
+}
+export declare function startAuditBot(hs: Homeserver, options: AuditBotOptions): Promise<AuditBot>;
+//#endregion

package/dist/auditbot/bot.js

@@ -0,0 +1,208 @@
+import { getFetchHandler } from "../http/adapters.js";
+import { CryptoClient } from "./client.js";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+//#region src/auditbot/bot.ts
+const MAX_PENDING = 1e4;
+async function startAuditBot(hs, options) {
+	await hs.ready;
+	const localpart = options.localpart ?? "auditbot";
+	const userId = `@${localpart}:${hs.serverName}`;
+	const displayName = options.displayName ?? "Audit log (this room is recorded)";
+	await mkdir(options.dataDir, { recursive: true });
+	const statePath = join(options.dataDir, "state.json");
+	const saved = await readFile(statePath, "utf8").then(JSON.parse, () => null);
+	if (!await hs.admin.getUser(userId)) await hs.admin.createUser(localpart, { displayname: displayName });
+	const session = await hs.auth.createSession(userId, {
+		deviceId: saved?.deviceId,
+		displayName: "Audit bot"
+	});
+	const state = {
+		deviceId: session.device_id,
+		since: saved?.since
+	};
+	const save = () => writeFile(statePath, JSON.stringify(state));
+	await save();
+	const client = new CryptoClient({
+		fetch: getFetchHandler(hs),
+		userId,
+		deviceId: session.device_id,
+		accessToken: session.access_token
+	});
+	await client.open(join(options.dataDir, "crypto"), options.storePassphrase);
+	await client.flush();
+	await client.ensureCrossSigning();
+	await client.request("PUT", `/_matrix/client/v3/profile/${encodeURIComponent(userId)}/displayname`, { displayname: displayName });
+	const pending = [];
+	const recorded = /* @__PURE__ */ new Set();
+	const encryptedRooms = /* @__PURE__ */ new Set();
+	let stopped = false;
+	const abort = new AbortController();
+	let syncedUpTo = 0;
+	const syncWaiters = [];
+	const isDirect = async (roomId) => {
+		const state = await hs.rooms.currentState(roomId);
+		for (const ev of state.values()) if (ev.type === "m.room.member" && ev.content?.is_direct === true) return true;
+		return false;
+	};
+	const joining = /* @__PURE__ */ new Map();
+	const ensureJoined = (roomId) => {
+		const running = joining.get(roomId);
+		if (running) return running;
+		const p = (async () => {
+			if ((await hs.rooms.roomsForUser(userId)).includes(roomId)) return;
+			if (options.rooms === "groups" && await isDirect(roomId)) return;
+			try {
+				await hs.admin.joinUser(userId, roomId);
+				hs.logger.info("Audit bot joined", roomId);
+			} catch (err) {
+				hs.logger.warn("Audit bot could not join", roomId, err.message);
+			}
+		})().finally(() => joining.delete(roomId));
+		joining.set(roomId, p);
+		return p;
+	};
+	const sweep = async () => {
+		const { rooms } = await hs.admin.listRooms({ limit: 1e6 });
+		for (const r of rooms) await ensureJoined(r.room_id);
+	};
+	const quietTimers = /* @__PURE__ */ new Map();
+	const joinWhenQuiet = (roomId) => {
+		clearTimeout(quietTimers.get(roomId));
+		quietTimers.set(roomId, setTimeout(() => {
+			quietTimers.delete(roomId);
+			ensureJoined(roomId);
+		}, options.joinDelayMs ?? 500));
+	};
+	const onEvent = (ev) => {
+		if (stopped || ev.type !== "m.room.member" || ev.state_key === userId) return;
+		if (ev.content?.membership === "join") joinWhenQuiet(ev.room_id);
+		if (options.rooms === "groups" && ev.content?.is_direct === true) (async () => {
+			if (!(await hs.rooms.joinedMembers(ev.room_id)).includes(userId)) return;
+			await client.request("POST", `/_matrix/client/v3/rooms/${encodeURIComponent(ev.room_id)}/leave`, {}).catch(() => {});
+			hs.logger.info("Audit bot left a direct message room", ev.room_id);
+		})();
+	};
+	hs.on("event", onEvent);
+	const toRecord = (roomId, ev, extra = {}) => ({
+		recorded_at: Date.now(),
+		room_id: roomId,
+		event_id: ev.event_id,
+		type: ev.type,
+		sender: ev.sender,
+		origin_server_ts: ev.origin_server_ts,
+		...ev.state_key !== void 0 ? { state_key: ev.state_key } : {},
+		content: ev.content ?? {},
+		...ev.redacts ? { redacts: ev.redacts } : {},
+		encrypted: false,
+		...extra
+	});
+	/** A record for an event, decrypting it when it is encrypted; null when its key is not here yet. */
+	const process = async (roomId, ev) => {
+		if (ev.type !== "m.room.encrypted") return toRecord(roomId, ev);
+		try {
+			const decrypted = await client.decrypt(ev, roomId);
+			const clear = JSON.parse(decrypted.event);
+			return toRecord(roomId, {
+				...ev,
+				type: clear.type,
+				content: clear.content
+			}, {
+				encrypted: true,
+				sender_device: decrypted.senderDevice?.toString()
+			});
+		} catch {
+			return null;
+		}
+	};
+	const write = async (records) => {
+		const fresh = records.filter((r) => !recorded.has(r.event_id));
+		if (fresh.length === 0) return;
+		await options.sink.write(fresh);
+		for (const r of fresh) recorded.add(r.event_id);
+		if (recorded.size > 1e5) recorded.clear();
+	};
+	const retryPending = async () => {
+		const out = [];
+		const keyWait = options.keyWaitMs ?? 36e5;
+		for (let i = pending.length - 1; i >= 0; i--) {
+			const p = pending[i];
+			const record = await process(p.roomId, p.event);
+			if (record || Date.now() - p.since > keyWait) {
+				out.push(record ?? toRecord(p.roomId, p.event, {
+					encrypted: true,
+					decryption_error: "The room key did not reach the audit bot"
+				}));
+				pending.splice(i, 1);
+			}
+		}
+		await write(out.reverse());
+	};
+	const handleSync = async (sync) => {
+		await client.receiveSync(sync);
+		const out = [];
+		for (const [roomId, room] of Object.entries(sync.rooms?.join ?? {})) {
+			const timeline = room.timeline?.events ?? [];
+			const stateEvents = room.state?.events ?? [];
+			for (const ev of [...stateEvents, ...timeline]) if (ev.type === "m.room.encryption") encryptedRooms.add(roomId);
+			if (encryptedRooms.has(roomId) && (stateEvents.length || timeline.some((e) => e.type === "m.room.member"))) await client.track(await hs.rooms.joinedMembers(roomId));
+			for (const ev of stateEvents) out.push(toRecord(roomId, ev, { initial_state: true }));
+			for (const ev of timeline) {
+				const record = await process(roomId, ev);
+				if (record) out.push(record);
+				else if (pending.length < MAX_PENDING) pending.push({
+					roomId,
+					event: ev,
+					since: Date.now()
+				});
+			}
+		}
+		await write(out);
+		await retryPending();
+	};
+	const loop = async () => {
+		while (!stopped) try {
+			const params = new URLSearchParams({
+				timeout: "30000",
+				filter: JSON.stringify({ room: { timeline: { limit: 200 } } })
+			});
+			if (state.since) params.set("since", state.since);
+			const sync = await client.request("GET", `/_matrix/client/v3/sync?${params}`, void 0, abort.signal);
+			await handleSync(sync);
+			state.since = sync.next_batch;
+			await save();
+			syncedUpTo = Date.now();
+			for (const w of syncWaiters.splice(0)) w();
+		} catch (err) {
+			if (stopped) return;
+			hs.logger.warn("Audit bot sync failed", err.message);
+			await new Promise((r) => setTimeout(r, 5e3));
+		}
+	};
+	await sweep();
+	const running = loop();
+	const timer = setInterval(() => void sweep().catch(() => {}), options.sweepIntervalMs ?? 6e5);
+	timer.unref();
+	return {
+		userId,
+		sweep,
+		synced() {
+			const asked = Date.now();
+			return new Promise((resolve) => {
+				const check = () => syncedUpTo > asked ? resolve() : syncWaiters.push(check);
+				check();
+			});
+		},
+		async stop() {
+			stopped = true;
+			abort.abort();
+			clearInterval(timer);
+			for (const t of quietTimers.values()) clearTimeout(t);
+			hs.off("event", onEvent);
+			await running.catch(() => {});
+			client.close();
+		}
+	};
+}
+//#endregion
+export { startAuditBot };

package/dist/auditbot/client.d.ts

@@ -0,0 +1,41 @@
+import { DecryptedRoomEvent, OlmMachine } from "@matrix-org/matrix-sdk-crypto-nodejs";
+//#region src/auditbot/client.d.ts
+export type Fetch = (request: Request) => Promise<Response>;
+export declare class CryptoClient {
+  readonly userId: string;
+  readonly deviceId: string;
+  private accessToken;
+  private fetch;
+  private baseUrl;
+  private txn;
+  machine: OlmMachine;
+  constructor(opts: {
+    fetch: Fetch;
+    baseUrl?: string;
+    userId: string;
+    deviceId: string;
+    accessToken: string;
+  });
+  /**
+   * Open the crypto store. With `storePath`, keys live in an encrypted SQLite store there (they
+   * must survive restarts: room keys are sent once). Without, in memory (tests).
+   */
+  open(storePath?: string, passphrase?: string): Promise<void>;
+  request<T = any>(method: string, path: string, body?: unknown, signal?: AbortSignal): Promise<T>;
+  /** Feed a /sync response to the crypto machine, then send what it needs sent. */
+  receiveSync(sync: Record<string, any>): Promise<void>;
+  /** Send every outgoing request of the crypto machine (key uploads, queries, claims, to-device). */
+  flush(): Promise<void>;
+  /** Make sure the crypto machine knows these users' devices. */
+  track(users: string[]): Promise<void>;
+  decrypt(event: Record<string, any>, roomId: string): Promise<DecryptedRoomEvent>;
+  /**
+   * Set up cross-signing for this account and sign the device with it, so other users' clients
+   * see the device as its owner's (not as an unknown one). Only once: an existing identity is kept.
+   */
+  ensureCrossSigning(): Promise<void>;
+  /** Encrypt and send a message (the test's sender; the bot itself sends nothing encrypted). */
+  sendEncrypted(roomId: string, members: string[], content: Record<string, unknown>): Promise<string>;
+  close(): void;
+}
+//#endregion

package/dist/auditbot/client.js

@@ -0,0 +1,156 @@
+import { DeviceId, DeviceLists, OlmMachine, RoomId, UserId } from "@matrix-org/matrix-sdk-crypto-nodejs";
+//#region src/auditbot/client.ts
+/** The request types of matrix-sdk-crypto (a const enum in its typings). */
+const Req = {
+	KeysUpload: 0,
+	KeysQuery: 1,
+	KeysClaim: 2,
+	ToDevice: 3,
+	SignatureUpload: 4,
+	RoomMessage: 5,
+	KeysBackup: 6
+};
+/**
+* matrix-sdk-crypto puts signature uploads under `signed_keys`; the endpoint takes the map of
+* signatures itself as the body.
+*/
+function signatureUploadBody(body) {
+	const parsed = JSON.parse(body);
+	return Object.keys(parsed).length === 1 && parsed.signed_keys ? JSON.stringify(parsed.signed_keys) : body;
+}
+var MatrixError = class extends Error {
+	status;
+	body;
+	constructor(status, body) {
+		super(`${status} ${body.errcode ?? ""} ${body.error ?? ""}`.trim());
+		this.status = status;
+		this.body = body;
+	}
+};
+var CryptoClient = class {
+	userId;
+	deviceId;
+	accessToken;
+	fetch;
+	baseUrl;
+	txn = 0;
+	machine;
+	constructor(opts) {
+		this.fetch = opts.fetch;
+		this.baseUrl = opts.baseUrl ?? "http://localhost";
+		this.userId = opts.userId;
+		this.deviceId = opts.deviceId;
+		this.accessToken = opts.accessToken;
+	}
+	/**
+	* Open the crypto store. With `storePath`, keys live in an encrypted SQLite store there (they
+	* must survive restarts: room keys are sent once). Without, in memory (tests).
+	*/
+	async open(storePath, passphrase) {
+		this.machine = await OlmMachine.initialize(new UserId(this.userId), new DeviceId(this.deviceId), storePath ?? null, passphrase ?? null, storePath ? 0 : null);
+	}
+	async request(method, path, body, signal) {
+		const res = await this.fetch(new Request(`${this.baseUrl}${path}`, {
+			method,
+			signal,
+			headers: {
+				authorization: `Bearer ${this.accessToken}`,
+				"content-type": "application/json"
+			},
+			body: body === void 0 ? void 0 : typeof body === "string" ? body : JSON.stringify(body)
+		}));
+		const text = await res.text();
+		const json = text ? JSON.parse(text) : {};
+		if (!res.ok) throw new MatrixError(res.status, json);
+		return json;
+	}
+	/** Feed a /sync response to the crypto machine, then send what it needs sent. */
+	async receiveSync(sync) {
+		const changed = (sync.device_lists?.changed ?? []).map((u) => new UserId(u));
+		const left = (sync.device_lists?.left ?? []).map((u) => new UserId(u));
+		await this.machine.receiveSyncChanges(JSON.stringify(sync.to_device?.events ?? []), new DeviceLists(changed, left), sync.device_one_time_keys_count ?? {}, sync.device_unused_fallback_key_types ?? []);
+		await this.flush();
+	}
+	/** Send every outgoing request of the crypto machine (key uploads, queries, claims, to-device). */
+	async flush() {
+		for (let round = 0; round < 10; round++) {
+			const requests = await this.machine.outgoingRequests();
+			if (requests.length === 0) return;
+			for (const r of requests) {
+				let response;
+				switch (r.type) {
+					case Req.KeysUpload:
+						response = await this.request("POST", "/_matrix/client/v3/keys/upload", r.body);
+						break;
+					case Req.KeysQuery:
+						response = await this.request("POST", "/_matrix/client/v3/keys/query", r.body);
+						break;
+					case Req.KeysClaim:
+						response = await this.request("POST", "/_matrix/client/v3/keys/claim", r.body);
+						break;
+					case Req.SignatureUpload:
+						response = await this.request("POST", "/_matrix/client/v3/keys/signatures/upload", signatureUploadBody(r.body));
+						break;
+					case Req.ToDevice: {
+						const t = r;
+						response = await this.request("PUT", `/_matrix/client/v3/sendToDevice/${encodeURIComponent(t.eventType)}/${encodeURIComponent(t.txnId)}`, t.body);
+						break;
+					}
+					case Req.RoomMessage: {
+						const m = r;
+						response = await this.request("PUT", `/_matrix/client/v3/rooms/${encodeURIComponent(m.roomId)}/send/${encodeURIComponent(m.eventType)}/${encodeURIComponent(m.txnId)}`, m.body);
+						break;
+					}
+					default: continue;
+				}
+				await this.machine.markRequestAsSent(r.id, r.type, JSON.stringify(response));
+			}
+		}
+	}
+	/** Make sure the crypto machine knows these users' devices. */
+	async track(users) {
+		await this.machine.updateTrackedUsers(users.map((u) => new UserId(u)));
+		await this.flush();
+	}
+	decrypt(event, roomId) {
+		return this.machine.decryptRoomEvent(JSON.stringify(event), new RoomId(roomId));
+	}
+	/**
+	* Set up cross-signing for this account and sign the device with it, so other users' clients
+	* see the device as its owner's (not as an unknown one). Only once: an existing identity is kept.
+	*/
+	async ensureCrossSigning() {
+		const status = await this.machine.crossSigningStatus();
+		if (status.hasMaster && status.hasSelfSigning) return;
+		const requests = await this.machine.bootstrapCrossSigning(true);
+		if (requests.uploadKeysReq) {
+			const response = await this.request("POST", "/_matrix/client/v3/keys/upload", requests.uploadKeysReq.body);
+			await this.machine.markRequestAsSent(requests.uploadKeysReq.id, requests.uploadKeysReq.type, JSON.stringify(response));
+		}
+		await this.request("POST", "/_matrix/client/v3/keys/device_signing/upload", requests.uploadSigningKeysReq);
+		const signatures = await this.request("POST", "/_matrix/client/v3/keys/signatures/upload", signatureUploadBody(requests.uploadSignaturesReq.body));
+		await this.machine.markRequestAsSent(requests.uploadSignaturesReq.id, requests.uploadSignaturesReq.type, JSON.stringify(signatures));
+	}
+	/** Encrypt and send a message (the test's sender; the bot itself sends nothing encrypted). */
+	async sendEncrypted(roomId, members, content) {
+		const { EncryptionSettings } = await import("@matrix-org/matrix-sdk-crypto-nodejs");
+		await this.track(members);
+		const users = members.map((u) => new UserId(u));
+		const claim = await this.machine.getMissingSessions(users);
+		if (claim) {
+			const response = await this.request("POST", "/_matrix/client/v3/keys/claim", claim.body);
+			await this.machine.markRequestAsSent(claim.id, claim.type, JSON.stringify(response));
+		}
+		for (const r of await this.machine.shareRoomKey(new RoomId(roomId), users, new EncryptionSettings())) {
+			const response = await this.request("PUT", `/_matrix/client/v3/sendToDevice/${encodeURIComponent(r.eventType)}/${encodeURIComponent(r.txnId)}`, r.body);
+			await this.machine.markRequestAsSent(r.id, r.type, JSON.stringify(response));
+		}
+		const encrypted = await this.machine.encryptRoomEvent(new RoomId(roomId), "m.room.message", JSON.stringify(content));
+		return (await this.request("PUT", `/_matrix/client/v3/rooms/${encodeURIComponent(roomId)}/send/m.room.encrypted/e2e${Date.now()}${this.txn++}`, encrypted)).event_id;
+	}
+	close() {
+		this.machine?.close();
+	}
+};
+//#endregion
+export { CryptoClient, MatrixError };

package/dist/auditbot/index.d.ts

@@ -0,0 +1,4 @@
+import { AuditRecord, AuditSink, fileSink, memorySink } from "./sinks.js";
+import { AuditBot, AuditBotOptions, startAuditBot } from "./bot.js";
+import { CryptoClient } from "./client.js";
+export { type AuditBot, type AuditBotOptions, type AuditRecord, type AuditSink, CryptoClient, fileSink, memorySink, startAuditBot };

package/dist/auditbot/index.js

@@ -0,0 +1,4 @@
+import { CryptoClient } from "./client.js";
+import { startAuditBot } from "./bot.js";
+import { fileSink, memorySink } from "./sinks.js";
+export { CryptoClient, fileSink, memorySink, startAuditBot };

package/dist/auditbot/sinks.d.ts

@@ -0,0 +1,37 @@
+//#region src/auditbot/sinks.d.ts
+/** One recorded event, as written to the archive (one JSON object per line). */
+export interface AuditRecord {
+  /** When the bot recorded it (ms). */
+  recorded_at: number;
+  room_id: string;
+  event_id: string;
+  type: string;
+  sender: string;
+  origin_server_ts: number;
+  state_key?: string;
+  /** The content as the room's members see it: decrypted for end-to-end encrypted events. */
+  content: Record<string, unknown>;
+  redacts?: string;
+  /** The event was end-to-end encrypted. */
+  encrypted: boolean;
+  /** For encrypted events: the sending device, as the room key says. */
+  sender_device?: string;
+  /** The event could not be decrypted (no room key reached the bot); `content` is the ciphertext. */
+  decryption_error?: string;
+  /** Part of the room's state when the bot joined, not a new event. */
+  initial_state?: boolean;
+}
+/** Where records go. Writes for one room come in order; a write that throws is retried. */
+export interface AuditSink {
+  write(records: AuditRecord[]): Promise<void>;
+}
+/**
+ * JSON Lines files: `{directory}/{room ID}/{YYYY-MM-DD}.jsonl`, one file per room and UTC day of
+ * the event. Room IDs are percent-encoded, so they cannot name a path outside the directory.
+ */
+export declare function fileSink(directory: string): AuditSink;
+/** Records kept in memory (tests, or a custom forwarder that reads `records`). */
+export declare function memorySink(): AuditSink & {
+  records: AuditRecord[];
+};
+//#endregion

package/dist/auditbot/sinks.js

@@ -0,0 +1,33 @@
+import { appendFile, mkdir } from "node:fs/promises";
+import { join } from "node:path";
+//#region src/auditbot/sinks.ts
+const day = (ts) => new Date(ts).toISOString().slice(0, 10);
+/**
+* JSON Lines files: `{directory}/{room ID}/{YYYY-MM-DD}.jsonl`, one file per room and UTC day of
+* the event. Room IDs are percent-encoded, so they cannot name a path outside the directory.
+*/
+function fileSink(directory) {
+	return { async write(records) {
+		const byFile = /* @__PURE__ */ new Map();
+		for (const r of records) {
+			const file = join(directory, encodeURIComponent(r.room_id), `${day(r.origin_server_ts)}.jsonl`);
+			byFile.set(file, [...byFile.get(file) ?? [], JSON.stringify(r)]);
+		}
+		for (const [file, lines] of byFile) {
+			await mkdir(join(file, ".."), { recursive: true });
+			await appendFile(file, `${lines.join("\n")}\n`);
+		}
+	} };
+}
+/** Records kept in memory (tests, or a custom forwarder that reads `records`). */
+function memorySink() {
+	const records = [];
+	return {
+		records,
+		async write(batch) {
+			records.push(...batch);
+		}
+	};
+}
+//#endregion
+export { fileSink, memorySink };

package/dist/core/admin.d.ts

@@ -53,6 +53,12 @@ export declare class AdminService {
   }>;
   listRegistrationTokens(): Promise<Row[]>;
   deleteRegistrationToken(token: string): Promise<void>;
+  /**
+   * Make a local user join a room, as Synapse's `POST /_synapse/admin/v1/join` does: public rooms
+   * directly; otherwise a local member who may invite invites them first (the invite shows in the
+   * room, so its members see who added them). Returns the room ID.
+   */
+  joinUser(userId: string, roomIdOrAlias: string): Promise<string>;
   listRooms(opts?: {
     from?: number;
     limit?: number;

package/dist/core/admin.js

@@ -2,6 +2,7 @@ import { randomString } from "./crypto.js";
 import { M } from "./m.js";
 import { errors } from "./errors.js";
 import { LOCALPART_RE, isValidUserId } from "./ids.js";
+import { getState, membershipOf, powerLevels, userLevel } from "./authrules.js";
 import { createUser } from "../api/account.js";
 //#region src/core/admin.ts
 /** Programmatic administration, for embedding applications and the admin HTTP API. */
@@ -145,6 +146,30 @@ var AdminService = class {
 			value: token
 		}])) throw errors.notFound("Unknown token");
 	}
+	/**
+	* Make a local user join a room, as Synapse's `POST /_synapse/admin/v1/join` does: public rooms
+	* directly; otherwise a local member who may invite invites them first (the invite shows in the
+	* room, so its members see who added them). Returns the room ID.
+	*/
+	async joinUser(userId, roomIdOrAlias) {
+		if (!this.hs.isLocalUser(userId) || !await this.getUser(userId)) throw errors.notFound("Unknown user");
+		const roomId = await this.hs.rooms.resolveRoomIdOrAlias(roomIdOrAlias);
+		const version = await this.hs.rooms.roomVersion(roomId);
+		if (!version) throw errors.notFound("Unknown room");
+		const state = await this.hs.rooms.currentState(roomId);
+		const membership = membershipOf(state, userId);
+		if (membership === "join") return roomId;
+		if (membership === "ban") throw errors.forbidden("The user is banned from the room");
+		const joinRule = getState(state, M.ROOM.JOIN_RULES)?.content?.join_rule;
+		if (membership !== "invite" && joinRule !== "public") {
+			const pl = powerLevels(state, version);
+			const inviter = (await this.hs.rooms.joinedMembers(roomId)).find((m) => this.hs.isLocalUser(m) && userLevel(pl, m) >= pl.invite);
+			if (!inviter) throw errors.forbidden("No local member of the room may invite");
+			await this.hs.rooms.invite(roomId, inviter, userId);
+		}
+		await this.hs.rooms.join(userId, roomId);
+		return roomId;
+	}
 	async listRooms(opts = {}) {
 		const rows = await this.hs.db.findMany("rooms", { sortBy: {
 			field: "created_ts",