matrix-nodejs-homeserver 0.3.4 → 0.3.6

package/dist/core/sso.d.ts

@@ -1,15 +1,27 @@
 import { Homeserver } from "../homeserver.js";
 //#region src/core/sso.d.ts
-/** An upstream OpenID Connect provider for `m.login.sso`. */
+/**
+ * An upstream identity provider: OpenID Connect (found through `issuer`), or plain OAuth 2.0 with
+ * a user info endpoint (`endpoints`, e.g. GitHub; see `githubProvider`).
+ */
 export interface SsoProvider {
   /** Stable identifier, used in URLs and stored with linked accounts. */
   id: string;
   name: string;
-  issuer: string;
+  /** OpenID Connect issuer; its discovery document gives the endpoints. Required without `endpoints`. */
+  issuer?: string;
+  /** Endpoints of a provider without OpenID Connect discovery. */
+  endpoints?: {
+    authorization: string;
+    token: string;
+    userinfo?: string;
+  };
   clientId: string;
   clientSecret?: string;
-  /** Default: ["openid", "profile", "email"]. */
+  /** Default: ["openid", "profile", "email"] with `issuer`, none with `endpoints`. */
   scopes?: string[];
+  /** Claim that identifies the user at the provider. Default: "sub". */
+  subjectClaim?: string;
   icon?: string;
   brand?: string;
   /**
@@ -35,26 +47,50 @@ export interface SsoOptions {
    */
   clientAllowlist?: string[];
 }
-/** Where the browser goes after login, and whether the user has to confirm that client first. */
-export interface SsoResult {
-  url: string;
-  confirm: boolean;
-  /** The client as shown to the user: its host, or its scheme for app links. */
-  client: string;
-}
-/** Upstream OIDC login (authorization code + PKCE) issuing Matrix login tokens. */
+/**
+ * What a login through a provider is for: a client of the legacy API (`m.login.sso`, which gets a
+ * login token at `redirectUrl`), or the server's own web pages (OAuth 2.0 API), which continue
+ * at `next` in the browser session `sid`.
+ */
+export type SsoTarget = {
+  kind: "client";
+  redirectUrl: string;
+} | {
+  kind: "web";
+  next: string;
+  sid: string;
+};
+/**
+ * GitHub as an identity provider (an OAuth app or GitHub app; its callback URL is
+ * `{publicBaseUrl}/_matrix/client/v3/login/sso/callback/github`). Users are matched by their
+ * numeric GitHub ID, so renaming the GitHub account keeps the Matrix account; new accounts take
+ * the GitHub login as their localpart.
+ */
+export declare function githubProvider(opts: {
+  clientId: string;
+  clientSecret: string;
+  id?: string;
+  name?: string;
+  allowRegistration?: boolean;
+  mapUser?: SsoProvider["mapUser"];
+}): SsoProvider;
+/** Upstream login (authorization code + PKCE) for the legacy `m.login.sso` and the OAuth 2.0 API's web pages. */
 export declare class SsoService {
   private hs;
   readonly providers: SsoProvider[];
-  private clientAllowlist;
+  readonly clientAllowlist: string[];
   private discovery;
   constructor(hs: Homeserver, options: SsoOptions);
   private callbackUrl;
   private discover;
+  private scopes;
   /** URL to send the user's browser to. */
-  startLogin(providerId: string | null, redirectUrl: string): Promise<string>;
-  /** Handle the provider's redirect; returns the client URL carrying a login token. */
-  finishLogin(providerId: string, params: URLSearchParams): Promise<SsoResult>;
+  startLogin(providerId: string | null, target: SsoTarget): Promise<string>;
+  /** Handle the provider's redirect: the user who logged in, and what the login was for. */
+  finishLogin(providerId: string, params: URLSearchParams): Promise<{
+    userId: string;
+    target: SsoTarget;
+  }>;
   private resolveUser;
 }
 //#endregion

package/dist/core/sso.js

@@ -39,7 +39,35 @@ function decodeJwtPayload(jwt) {
 	if (!part) throw new Error("Malformed ID token");
 	return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
 }
-/** Upstream OIDC login (authorization code + PKCE) issuing Matrix login tokens. */
+/**
+* GitHub as an identity provider (an OAuth app or GitHub app; its callback URL is
+* `{publicBaseUrl}/_matrix/client/v3/login/sso/callback/github`). Users are matched by their
+* numeric GitHub ID, so renaming the GitHub account keeps the Matrix account; new accounts take
+* the GitHub login as their localpart.
+*/
+function githubProvider(opts) {
+	return {
+		id: opts.id ?? "github",
+		name: opts.name ?? "GitHub",
+		brand: "github",
+		clientId: opts.clientId,
+		clientSecret: opts.clientSecret,
+		endpoints: {
+			authorization: "https://github.com/login/oauth/authorize",
+			token: "https://github.com/login/oauth/access_token",
+			userinfo: "https://api.github.com/user"
+		},
+		scopes: ["read:user"],
+		subjectClaim: "id",
+		mapUser: opts.mapUser ?? ((c) => ({
+			localpart: sanitizeLocalpart(String(c.login ?? c.id)),
+			displayname: c.name ?? c.login
+		})),
+		...opts.allowRegistration !== void 0 ? { allowRegistration: opts.allowRegistration } : {}
+	};
+}
+const USER_AGENT = "matrix-nodejs-homeserver";
+/** Upstream login (authorization code + PKCE) for the legacy `m.login.sso` and the OAuth 2.0 API's web pages. */
 var SsoService = class {
 	hs;
 	providers;
@@ -56,8 +84,18 @@ var SsoService = class {
 		return `${base.replace(/\/$/, "")}/_matrix/client/v3/login/sso/callback/${encodeURIComponent(provider.id)}`;
 	}
 	async discover(provider) {
+		if (provider.endpoints) {
+			const e = provider.endpoints;
+			return {
+				issuer: provider.issuer,
+				authorization_endpoint: e.authorization,
+				token_endpoint: e.token,
+				userinfo_endpoint: e.userinfo
+			};
+		}
 		const cached = this.discovery.get(provider.id);
 		if (cached) return cached;
+		if (!provider.issuer) throw new Error(`Identity provider ${provider.id} needs an issuer or endpoints`);
 		const res = await this.hs.fetch(`${provider.issuer.replace(/\/$/, "")}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(1e4) });
 		if (!res.ok) throw new Error(`OIDC discovery for ${provider.id} failed with ${res.status}`);
 		const meta = await res.json();
@@ -65,8 +103,15 @@ var SsoService = class {
 		this.discovery.set(provider.id, meta);
 		return meta;
 	}
+	scopes(provider) {
+		return provider.scopes ?? (provider.endpoints ? [] : [
+			"openid",
+			"profile",
+			"email"
+		]);
+	}
 	/** URL to send the user's browser to. */
-	async startLogin(providerId, redirectUrl) {
+	async startLogin(providerId, target) {
 		const provider = providerId ? this.providers.find((p) => p.id === providerId) : this.providers[0];
 		if (!provider) throw errors.notFound("Unknown identity provider");
 		const meta = await this.discover(provider);
@@ -75,7 +120,7 @@ var SsoService = class {
 		const nonce = randomToken(16);
 		await this.hs.cluster.set(`sso:${state}`, {
 			providerId: provider.id,
-			redirectUrl,
+			target,
 			verifier,
 			nonce,
 			expires: Date.now() + 6e5
@@ -84,18 +129,15 @@ var SsoService = class {
 		url.searchParams.set("response_type", "code");
 		url.searchParams.set("client_id", provider.clientId);
 		url.searchParams.set("redirect_uri", this.callbackUrl(provider));
-		url.searchParams.set("scope", (provider.scopes ?? [
-			"openid",
-			"profile",
-			"email"
-		]).join(" "));
+		const scopes = this.scopes(provider);
+		if (scopes.length) url.searchParams.set("scope", scopes.join(" "));
 		url.searchParams.set("state", state);
 		url.searchParams.set("nonce", nonce);
 		url.searchParams.set("code_challenge", urlSafeBase64(createHash("sha256").update(verifier).digest()));
 		url.searchParams.set("code_challenge_method", "S256");
 		return url.toString();
 	}
-	/** Handle the provider's redirect; returns the client URL carrying a login token. */
+	/** Handle the provider's redirect: the user who logged in, and what the login was for. */
 	async finishLogin(providerId, params) {
 		const state = params.get("state") ?? "";
 		const pending = await this.hs.cluster.get(`sso:${state}`);
@@ -115,7 +157,8 @@ var SsoService = class {
 		});
 		const headers = {
 			"content-type": "application/x-www-form-urlencoded",
-			accept: "application/json"
+			accept: "application/json",
+			"user-agent": USER_AGENT
 		};
 		if (provider.clientSecret) headers.authorization = `Basic ${Buffer.from(`${encodeURIComponent(provider.clientId)}:${encodeURIComponent(provider.clientSecret)}`).toString("base64")}`;
 		const res = await this.hs.fetch(meta.token_endpoint, {
@@ -126,8 +169,9 @@ var SsoService = class {
 		});
 		if (!res.ok) throw errors.forbidden("Code exchange failed");
 		const tokens = await res.json();
+		if (typeof tokens.error === "string") throw errors.forbidden("Code exchange failed");
 		let claims = {};
-		if ((provider.scopes ?? ["openid"]).includes("openid") && typeof tokens.id_token !== "string") throw errors.forbidden("The provider returned no ID token");
+		if (this.scopes(provider).includes("openid") && typeof tokens.id_token !== "string") throw errors.forbidden("The provider returned no ID token");
 		if (typeof tokens.id_token === "string") {
 			claims = decodeJwtPayload(tokens.id_token);
 			const aud = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
@@ -137,7 +181,11 @@ var SsoService = class {
 		}
 		if (meta.userinfo_endpoint && typeof tokens.access_token === "string") {
 			const info = await this.hs.fetch(meta.userinfo_endpoint, {
-				headers: { authorization: `Bearer ${tokens.access_token}` },
+				headers: {
+					authorization: `Bearer ${tokens.access_token}`,
+					accept: "application/json",
+					"user-agent": USER_AGENT
+				},
 				signal: AbortSignal.timeout(1e4)
 			});
 			if (info.ok) {
@@ -149,37 +197,35 @@ var SsoService = class {
 				};
 			}
 		}
-		if (typeof claims.sub !== "string") throw errors.forbidden("Provider did not return a subject");
-		const userId = await this.resolveUser(provider, claims);
-		const loginToken = await this.hs.auth.createLoginToken(userId);
+		const rawSubject = claims[provider.subjectClaim ?? "sub"];
+		const subject = typeof rawSubject === "number" ? String(rawSubject) : rawSubject;
+		if (typeof subject !== "string" || !subject) throw errors.forbidden("Provider did not return a subject");
+		const userId = await this.resolveUser(provider, subject, claims);
 		await this.hs.audit.record({
 			action: "sso_login",
 			actor: userId,
 			details: {
 				idp: provider.id,
-				subject: claims.sub
+				subject
 			}
 		});
-		const redirect = new URL(pending.redirectUrl);
-		redirect.searchParams.set("loginToken", loginToken);
 		return {
-			url: redirect.toString(),
-			confirm: !this.clientAllowlist.some((entry) => clientMatches(pending.redirectUrl, entry)),
-			client: redirect.host || redirect.protocol.replace(/:$/, "")
+			userId,
+			target: pending.target
 		};
 	}
-	async resolveUser(provider, claims) {
+	async resolveUser(provider, subject, claims) {
 		const link = await this.hs.db.findOne("sso_identities", [{
 			field: "idp_id",
 			value: provider.id
 		}, {
 			field: "subject",
-			value: claims.sub
+			value: subject
 		}]);
 		if (link) return link.user_id;
 		if (provider.allowRegistration === false) throw errors.forbidden("No account is linked to this identity");
 		const mapped = provider.mapUser ? await provider.mapUser(claims) : {
-			localpart: sanitizeLocalpart(claims.preferred_username ?? claims.sub),
+			localpart: sanitizeLocalpart(claims.preferred_username ?? subject),
 			displayname: claims.name
 		};
 		if (!mapped || !LOCALPART_RE.test(mapped.localpart)) throw errors.forbidden("Could not map identity to a Matrix user");
@@ -191,11 +237,25 @@ var SsoService = class {
 		const userId = await this.hs.admin.createUser(localpart, { displayname: mapped.displayname });
 		await this.hs.db.create("sso_identities", {
 			idp_id: provider.id,
-			subject: claims.sub,
+			subject,
 			user_id: userId
 		});
 		return userId;
 	}
 };
+/**
+* The legacy API's last step: the client URL carrying a login token for `userId`, and whether
+* the user confirms the client first (clients not on `sso.clientAllowlist`).
+*/
+async function legacyClientRedirect(hs, userId, redirectUrl) {
+	const loginToken = await hs.auth.createLoginToken(userId);
+	const redirect = new URL(redirectUrl);
+	redirect.searchParams.set("loginToken", loginToken);
+	return {
+		url: redirect.toString(),
+		confirm: !(hs.sso?.clientAllowlist ?? []).some((entry) => clientMatches(redirectUrl, entry)),
+		client: redirect.host || redirect.protocol.replace(/:$/, "")
+	};
+}
 //#endregion
-export { SsoService, checkRedirectUrl };
+export { SsoService, checkRedirectUrl, githubProvider, legacyClientRedirect, sanitizeLocalpart };

package/dist/homeserver.d.ts

@@ -13,19 +13,20 @@ import { Notifier } from "./core/notifier.js";
 import { RoomService } from "./core/rooms.js";
 import { TypingService } from "./core/typing.js";
 import { PushService } from "./core/push.js";
-import { AdminService, ServerNoticesOptions } from "./core/admin.js";
-import { OAuthDelegation, OAuthDelegationOptions } from "./core/oauth.js";
-import { SsoOptions, SsoService } from "./core/sso.js";
-import { FederationOptions, FederationService } from "./federation/index.js";
-import { DelayedEventService, DelayedEventsOptions } from "./core/delayed.js";
+import { ResolvedUserAuth, UserAuthAdapter } from "./adapters/auth.js";
+import { MediaAdapter, Thumbnailer } from "./adapters/media.js";
 import { RateLimitAction, RateLimitRule, RateLimiter, RateLimits } from "./core/ratelimit.js";
+import { FederationOptions, FederationService } from "./federation/index.js";
 import { Router } from "./http/router.js";
 import { RtcOptions } from "./api/rtc.js";
+import { DelayedEventService, DelayedEventsOptions } from "./core/delayed.js";
+import { OAuthDelegation, OAuthDelegationOptions } from "./core/oauth.js";
+import { OAuthServer, OAuthServerOptions } from "./core/oauthserver.js";
+import { SsoOptions, SsoService } from "./core/sso.js";
 import { AuditOptions, AuditService } from "./core/audit.js";
-import { SettingsService } from "./core/settings.js";
 import { AdminRoomOptions, AdminRoomService } from "./core/adminroom.js";
-import { ResolvedUserAuth, UserAuthAdapter } from "./adapters/auth.js";
-import { MediaAdapter, Thumbnailer } from "./adapters/media.js";
+import { AdminService, ServerNoticesOptions } from "./core/admin.js";
+import { SettingsService } from "./core/settings.js";
 import { ChangeTracker } from "./core/changes.js";
 import { AddressPolicy } from "./core/outbound.js";
 import { EventEmitter } from "node:events";
@@ -112,7 +113,16 @@ export interface HomeserverOptions {
    */
   /** Delegate authentication to an external OAuth 2.0 / OIDC provider (disables password login and registration). */
   oauth?: OAuthDelegationOptions;
-  /** Upstream OpenID Connect providers for `m.login.sso`. Requires `publicBaseUrl`. */
+  /**
+   * Serve the spec's OAuth 2.0 API: users log in on the server's own web pages, with a password
+   * and/or the upstream providers of `sso` (e.g. `githubProvider`). Requires `publicBaseUrl`.
+   * Cannot be combined with `oauth`.
+   */
+  oauthServer?: boolean | OAuthServerOptions;
+  /**
+   * Upstream identity providers (OpenID Connect, or OAuth 2.0 such as GitHub) for `m.login.sso`
+   * and the `oauthServer` login page. Requires `publicBaseUrl`.
+   */
   sso?: SsoOptions;
   /**
    * Coordination between instances. The default (`localCluster()`) supports one process;
@@ -198,6 +208,7 @@ export declare class Homeserver extends EventEmitter {
   readonly rateLimits: RateLimits;
   readonly admin: AdminService;
   readonly oauth: OAuthDelegation | null;
+  readonly oauthServer: OAuthServer | null;
   readonly sso: SsoService | null;
   readonly federation: FederationService;
   readonly delayedEvents: DelayedEventService;

package/dist/homeserver.js

@@ -16,6 +16,7 @@ import { TypingService } from "./core/typing.js";
 import { coalesceReads } from "./storage/batch.js";
 import { ChangeTracker } from "./core/changes.js";
 import { PushService } from "./core/push.js";
+import { OAuthServer } from "./core/oauthserver.js";
 import { SsoService } from "./core/sso.js";
 import { AdminService } from "./core/admin.js";
 import { OAuthDelegation } from "./core/oauth.js";
@@ -75,6 +76,7 @@ var Homeserver = class extends EventEmitter {
 	rateLimits;
 	admin;
 	oauth;
+	oauthServer;
 	sso;
 	federation;
 	delayedEvents;
@@ -153,6 +155,9 @@ var Homeserver = class extends EventEmitter {
 		this.push = new PushService(this);
 		this.admin = new AdminService(this);
 		this.oauth = options.oauth ? new OAuthDelegation(this, options.oauth) : null;
+		if (options.oauthServer && options.oauth) throw new Error("`oauthServer` and `oauth` (delegated OAuth) cannot be used together");
+		if (options.oauthServer && !options.publicBaseUrl) throw new Error("`publicBaseUrl` is required for `oauthServer`");
+		this.oauthServer = options.oauthServer ? new OAuthServer(this, options.oauthServer === true ? {} : options.oauthServer, options.publicBaseUrl) : null;
 		this.fetch = options.fetch ?? globalThis.fetch;
 		this.addressPolicy = addressPolicy(options.allowPrivateAddresses);
 		this.publicFetch = policyFetch(this.addressPolicy, options.fetch);
@@ -167,7 +172,7 @@ var Homeserver = class extends EventEmitter {
 		this.identityServers = new IdentityServers(this);
 		const adminRoom = options.adminRoom === true ? {} : options.adminRoom || null;
 		this.adminRoom = adminRoom && adminRoom.enabled !== false ? new AdminRoomService(this, adminRoom) : null;
-		this.sso = options.sso?.providers.length ? new SsoService(this, options.sso) : null;
+		this.sso = options.sso && (options.sso.providers.length || options.oauthServer) ? new SsoService(this, options.sso) : null;
 		if (this.sso && !options.publicBaseUrl) throw new Error("`publicBaseUrl` is required when SSO is configured");
 		this.rateLimits = options.rateLimits === false ? new RateLimits(null) : new RateLimits(options.rateLimits?.limiter ?? memoryRateLimiter(), options.rateLimits?.rules);
 		const cleanupEvery = options.cleanupIntervalMs ?? 6e5;
@@ -222,7 +227,13 @@ var Homeserver = class extends EventEmitter {
 			limit: 1
 		});
 		if (oldestSnap[0] && oldestSnap[0].id < 0) await this.streams.lowerBackfillTo(oldestSnap[0].id);
-		await this.cluster.advance("federation_outbox", await this.db.max("federation_outbox", "id") ?? 0);
+		for (const model of [
+			"federation_outbox",
+			"audit_log",
+			"event_reports",
+			"user_reports",
+			"appservice_outbox"
+		]) await this.cluster.advance(model, await this.db.max(model, "id") ?? 0);
 		if (this.federation.enabled) this.federation.sender.start();
 		this.delayedEvents.start();
 		this.appservices.start();
@@ -235,7 +246,11 @@ var Homeserver = class extends EventEmitter {
 			field: "expires_ts",
 			operator: "lt",
 			value: now - 6048e5
+		}, {
+			field: "refresh_used",
+			value: true
 		}]);
+		await this.oauthServer?.prune();
 		await this.db.delete("login_tokens", [{
 			field: "expires_ts",
 			operator: "lt",

package/dist/index.d.ts

@@ -3,24 +3,25 @@ import { M, UNSTABLE } from "./core/m.js";
 import { AppServiceRegistration, loadAppServiceRegistrations, parseAppServiceRegistration } from "./core/appservices.js";
 import { DatabaseAdapter, FieldDef, FindManyOptions, ModelDef, Operator, Row, Schema, WhereClause } from "./storage/types.js";
 import { ClusterAdapter, localCluster } from "./core/cluster.js";
-import { AdminService, ServerNoticesOptions } from "./core/admin.js";
-import { OAuthDelegationOptions } from "./core/oauth.js";
-import { SsoOptions, SsoProvider } from "./core/sso.js";
-import { MatrixError } from "./core/errors.js";
-import { FederationOptions } from "./federation/index.js";
-import { DelayedEventsOptions } from "./core/delayed.js";
-import { RateLimitAction, RateLimitRule, RateLimiter, memoryRateLimiter } from "./core/ratelimit.js";
-import { RtcOptions, TurnOptions } from "./api/rtc.js";
-import { AuditAction, AuditEntry, AuditOptions } from "./core/audit.js";
-import { AdminRoomOptions } from "./core/adminroom.js";
-import { PasswordCheckContext, UserAuthAdapter } from "./adapters/auth.js";
-import { MediaAdapter, MediaMetadata, ThumbnailRequest, Thumbnailer, filesystemMedia, memoryMedia, sharpThumbnailer } from "./adapters/media.js";
-import { Homeserver, HomeserverOptions, Logger, createHomeserver } from "./homeserver.js";
 import { NodeHandler, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, isMatrixPath } from "./http/adapters.js";
 import { handleRequest } from "./http/handler.js";
+import { MatrixError } from "./core/errors.js";
 import { memoryAdapter } from "./storage/memory.js";
 import { MysqlPoolLike, PgPoolLike, SqlAdapterOptions, SqlDialect, SqlExecutor, SqliteDatabaseLike, mysqlAdapter, postgresAdapter, sqlAdapter, sqliteAdapter } from "./storage/sql.js";
 import { schema } from "./storage/schema.js";
+import { PasswordCheckContext, UserAuthAdapter } from "./adapters/auth.js";
+import { MediaAdapter, MediaMetadata, ThumbnailRequest, Thumbnailer, filesystemMedia, memoryMedia, sharpThumbnailer } from "./adapters/media.js";
 import { S3MediaOptions, s3Media } from "./adapters/s3.js";
+import { RateLimitAction, RateLimitRule, RateLimiter, memoryRateLimiter } from "./core/ratelimit.js";
 import { PgClusterPoolLike, postgresCluster } from "./adapters/cluster.js";
-export { type AdminRoomOptions, type AdminService, type AppServiceRegistration, type AuditAction, type AuditEntry, type AuditOptions, type ClusterAdapter, type DatabaseAdapter, type DelayedEventsOptions, type FederationOptions, type FieldDef, type FindManyOptions, Homeserver, type HomeserverOptions, type Logger, M, MatrixError, type MediaAdapter, type MediaMetadata, type ModelDef, type MysqlPoolLike, type NodeHandler, type OAuthDelegationOptions, type Operator, type PasswordCheckContext, type PgClusterPoolLike, type PgPoolLike, type RateLimitAction, type RateLimitRule, type RateLimiter, type Row, type RtcOptions, type S3MediaOptions, type Schema, type ServerNoticesOptions, type SqlAdapterOptions, type SqlDialect, type SqlExecutor, type SqliteDatabaseLike, type SsoOptions, type SsoProvider, type ThreepidEmail, type ThreepidOptions, type ThreepidPurpose, type ThreepidSms, type ThumbnailRequest, type Thumbnailer, type TurnOptions, UNSTABLE, type UserAuthAdapter, type WhereClause, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };
+import { FederationOptions } from "./federation/index.js";
+import { RtcOptions, TurnOptions } from "./api/rtc.js";
+import { DelayedEventsOptions } from "./core/delayed.js";
+import { OAuthDelegationOptions } from "./core/oauth.js";
+import { OAuthServerOptions } from "./core/oauthserver.js";
+import { SsoOptions, SsoProvider, githubProvider } from "./core/sso.js";
+import { AuditAction, AuditEntry, AuditOptions } from "./core/audit.js";
+import { AdminRoomOptions } from "./core/adminroom.js";
+import { AdminService, ServerNoticesOptions } from "./core/admin.js";
+import { Homeserver, HomeserverOptions, Logger, createHomeserver } from "./homeserver.js";
+export { type AdminRoomOptions, type AdminService, type AppServiceRegistration, type AuditAction, type AuditEntry, type AuditOptions, type ClusterAdapter, type DatabaseAdapter, type DelayedEventsOptions, type FederationOptions, type FieldDef, type FindManyOptions, Homeserver, type HomeserverOptions, type Logger, M, MatrixError, type MediaAdapter, type MediaMetadata, type ModelDef, type MysqlPoolLike, type NodeHandler, type OAuthDelegationOptions, type OAuthServerOptions, type Operator, type PasswordCheckContext, type PgClusterPoolLike, type PgPoolLike, type RateLimitAction, type RateLimitRule, type RateLimiter, type Row, type RtcOptions, type S3MediaOptions, type Schema, type ServerNoticesOptions, type SqlAdapterOptions, type SqlDialect, type SqlExecutor, type SqliteDatabaseLike, type SsoOptions, type SsoProvider, type ThreepidEmail, type ThreepidOptions, type ThreepidPurpose, type ThreepidSms, type ThumbnailRequest, type Thumbnailer, type TurnOptions, UNSTABLE, type UserAuthAdapter, type WhereClause, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, githubProvider, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };

package/dist/index.js

@@ -1,6 +1,7 @@
 import { M, UNSTABLE } from "./core/m.js";
 import { MatrixError } from "./core/errors.js";
 import { localCluster } from "./core/cluster.js";
+import { githubProvider } from "./core/sso.js";
 import { loadAppServiceRegistrations, parseAppServiceRegistration } from "./core/appservices.js";
 import { memoryRateLimiter } from "./core/ratelimit.js";
 import { filesystemMedia, memoryMedia, sharpThumbnailer } from "./adapters/media.js";
@@ -12,4 +13,4 @@ import { getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, g
 import { mysqlAdapter, postgresAdapter, sqlAdapter, sqliteAdapter } from "./storage/sql.js";
 import { s3Media } from "./adapters/s3.js";
 import { postgresCluster } from "./adapters/cluster.js";
-export { Homeserver, M, MatrixError, UNSTABLE, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };
+export { Homeserver, M, MatrixError, UNSTABLE, createHomeserver, filesystemMedia, getExpressHandler, getFastifyPlugin, getFetchHandler, getHonoHandler, getNodeHandler, githubProvider, handleRequest, isMatrixPath, loadAppServiceRegistrations, localCluster, memoryAdapter, memoryMedia, memoryRateLimiter, mysqlAdapter, parseAppServiceRegistration, postgresAdapter, postgresCluster, s3Media, schema, sharpThumbnailer, sqlAdapter, sqliteAdapter };

package/dist/storage/schema.js

@@ -48,10 +48,28 @@ const schema = {
 			user_id: s,
 			device_id: s,
 			refresh_token: sn,
-			expires_ts: nn
+			expires_ts: nn,
+			client_id: sn,
+			scope: sn,
+			refresh_parent: sn,
+			refresh_used: bn
 		},
 		primaryKey: ["token"],
-		indexes: [["user_id"], ["refresh_token"]]
+		indexes: [
+			["user_id"],
+			["refresh_token"],
+			["client_id"],
+			["refresh_parent"]
+		]
+	},
+	oauth_clients: {
+		fields: {
+			client_id: s,
+			metadata: j,
+			created_ts: n
+		},
+		primaryKey: ["client_id"],
+		indexes: [["created_ts"]]
 	},
 	rooms: {
 		fields: {

package/dist/vendor/zod/v4/classic/errors.js

@@ -1,7 +1,7 @@
 import { jsonStringifyReplacer } from "../core/util.js";
 import { $constructor } from "../core/core.js";
 import { $ZodError, flattenError, formatError } from "../core/errors.js";
-//#region node_modules/zod/v4/classic/errors.js
+//#region ../../node_modules/zod/v4/classic/errors.js
 const _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
 	Object.defineProperty(proto, key, {

package/dist/vendor/zod/v4/classic/parse.js

@@ -1,6 +1,6 @@
 import { _decode, _decodeAsync, _encode, _encodeAsync, _parse, _parseAsync, _safeDecode, _safeDecodeAsync, _safeEncode, _safeEncodeAsync, _safeParse, _safeParseAsync } from "../core/parse.js";
 import { ZodRealError } from "./errors.js";
-//#region node_modules/zod/v4/classic/parse.js
+//#region ../../node_modules/zod/v4/classic/parse.js
 const parse = /* @__PURE__ */ _parse(ZodRealError);
 const parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 const safeParse = /* @__PURE__ */ _safeParse(ZodRealError);

package/dist/vendor/zod/v4/classic/schemas.js

@@ -9,7 +9,7 @@ import { _array, _base64, _base64url, _boolean, _cidrv4, _cidrv6, _cuid, _cuid2,
 import { createStandardJSONSchemaMethod, createToJSONSchemaMethod } from "../core/to-json-schema.js";
 import { aggregateChecks, arrayProcessor, booleanProcessor, catchProcessor, customProcessor, defaultProcessor, enumProcessor, intersectionProcessor, neverProcessor, nonoptionalProcessor, nullableProcessor, numberProcessor, objectProcessor, optionalProcessor, pipeProcessor, prefaultProcessor, readonlyProcessor, recordProcessor, stringProcessor, transformProcessor, unionProcessor, unknownProcessor } from "../core/json-schema-processors.js";
 import { decode, decodeAsync, encode, encodeAsync, parse, parseAsync, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync } from "./parse.js";
-//#region node_modules/zod/v4/classic/schemas.js
+//#region ../../node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
 	if (!globalConfig.localeError) config(en_default());
 }

package/dist/vendor/zod/v4/core/api.js

@@ -1,6 +1,6 @@
 import { issue, normalizeParams, slugify } from "./util.js";
 import { $ZodCheck, $ZodCheckEndsWith, $ZodCheckGreaterThan, $ZodCheckIncludes, $ZodCheckLengthEquals, $ZodCheckLessThan, $ZodCheckLowerCase, $ZodCheckMaxLength, $ZodCheckMinLength, $ZodCheckMultipleOf, $ZodCheckOverwrite, $ZodCheckRegex, $ZodCheckStartsWith, $ZodCheckUpperCase } from "./checks.js";
-//#region node_modules/zod/v4/core/api.js
+//#region ../../node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
 	if (def.checks) def.checks = [...def.checks];
 	return def;

package/dist/vendor/zod/v4/core/checks.js

@@ -1,7 +1,7 @@
 import { NUMBER_FORMAT_RANGES, codePointLength, escapeRegex, floatSafeRemainder, getLengthableOrigin, nullish } from "./util.js";
 import { $constructor } from "./core.js";
 import { lowercase, uppercase } from "./regexes.js";
-//#region node_modules/zod/v4/core/checks.js
+//#region ../../node_modules/zod/v4/core/checks.js
 const $ZodCheck = /*@__PURE__*/ $constructor("$ZodCheck", (inst, def) => {
 	var _a;
 	inst._zod ?? (inst._zod = {});

package/dist/vendor/zod/v4/core/core.js

@@ -1,5 +1,5 @@
 import { members } from "./util.js";
-//#region node_modules/zod/v4/core/core.js
+//#region ../../node_modules/zod/v4/core/core.js
 var _a;
 const _zodDesc = {
 	value: void 0,

package/dist/vendor/zod/v4/core/doc.js

@@ -1,4 +1,4 @@
-//#region node_modules/zod/v4/core/doc.js
+//#region ../../node_modules/zod/v4/core/doc.js
 var Doc = class {
 	constructor(args = [], closed = {}) {
 		this.content = [];

package/dist/vendor/zod/v4/core/errors.js

@@ -1,6 +1,6 @@
 import { jsonStringifyReplacer } from "./util.js";
 import { $constructor } from "./core.js";
-//#region node_modules/zod/v4/core/errors.js
+//#region ../../node_modules/zod/v4/core/errors.js
 function _getMessage() {
 	const internals = this._zod;
 	internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));

package/dist/vendor/zod/v4/core/json-schema-processors.js

@@ -2,7 +2,7 @@ import { BIGINT_FORMAT_RANGES, NUMBER_FORMAT_RANGES, assignProp, getEnumValues }
 import { base64, base64url, integer, number } from "./regexes.js";
 import { base64Charset, base64urlCharset } from "./schemas.js";
 import { handleUnrepresentable, process as processSchema } from "./to-json-schema.js";
-//#region node_modules/zod/v4/core/json-schema-processors.js
+//#region ../../node_modules/zod/v4/core/json-schema-processors.js
 const narrowMin = (agg, key, value) => {
 	if (agg[key] === void 0 || value > agg[key]) agg[key] = value;
 };

package/dist/vendor/zod/v4/core/memoizer.js

@@ -1,5 +1,5 @@
 import { rawShape } from "./util.js";
-//#region node_modules/zod/v4/core/memoizer.js
+//#region ../../node_modules/zod/v4/core/memoizer.js
 var $ZodCyclicError = class extends Error {
 	constructor() {
 		super(`Cannot parse a reference cycle that closes through a transform`);

package/dist/vendor/zod/v4/core/parse.js

@@ -1,6 +1,6 @@
 import { captureStackTrace, finalizeIssue } from "./util.js";
 import { $ZodAsyncError, config } from "./core.js";
-//#region node_modules/zod/v4/core/parse.js
+//#region ../../node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
 	return {
 		callee: params?.callee ?? callee,

package/dist/vendor/zod/v4/core/regexes.js

@@ -1,4 +1,4 @@
-//#region node_modules/zod/v4/core/regexes.js
+//#region ../../node_modules/zod/v4/core/regexes.js
 /**
 * @deprecated CUID v1 is deprecated by its authors due to information leakage
 * (timestamps embedded in the id). Use {@link cuid2} instead.

package/dist/vendor/zod/v4/core/registries.js

@@ -1,4 +1,4 @@
-//#region node_modules/zod/v4/core/registries.js
+//#region ../../node_modules/zod/v4/core/registries.js
 var _a;
 var $ZodRegistry = class {
 	constructor() {

package/dist/vendor/zod/v4/core/schemas.js

@@ -4,7 +4,7 @@ import { anyString, boolean, cidrv4, cidrv6, cuid, cuid2, date, datetime, durati
 import { $ZodCheck, $ZodCheckNumberFormat, $ZodCheckStringFormat } from "./checks.js";
 import { Doc } from "./doc.js";
 import { version } from "./versions.js";
-//#region node_modules/zod/v4/core/schemas.js
+//#region ../../node_modules/zod/v4/core/schemas.js
 const $ZodType = /*@__PURE__*/ $constructor("$ZodType", (inst, def) => {
 	var _a;
 	inst ?? (inst = {});