support timestamped appservice messaging

Co-authored-by: strawberry <strawberry@puppygock.gay> Signed-off-by: strawberry <strawberry@puppygock.gay>
nix: bump flake.lock
2024-08-14 20:01:34 -04:00 · 2024-08-14 02:39:18 -04:00 · 2024-08-14 02:39:13 -04:00 · 2024-08-13 19:25:07 -04:00 · 2024-08-13 19:25:07 -04:00 · 2024-08-13 19:25:07 -04:00
26 changed files with 552 additions and 302 deletions
@@ -19,7 +19,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://github.com/girlbossceo/conduwuit"
-rust-version = "1.80.0"
+rust-version = "1.80.1"
 version = "0.4.6"

 [workspace.metadata.crane]
@@ -69,7 +69,7 @@ version = "0.8.5"

 # Used for the http request / response body type for Ruma endpoints used with reqwest
 [workspace.dependencies.bytes]
-version = "1.6.1"
+version = "1.7.1"

 [workspace.dependencies.http-body-util]
 version = "0.1.1"
@@ -78,7 +78,7 @@ version = "0.1.1"
 version = "1.1.0"

 [workspace.dependencies.regex]
-version = "1.10.4"
+version = "1.10.6"

 [workspace.dependencies.axum]
 version = "0.7.5"
@@ -99,7 +99,7 @@ default-features = false
 features = ["typed-header", "tracing"]

 [workspace.dependencies.axum-server]
-version = "0.6.0"
+version = "0.7.1"
 default-features = false
 features = ["tls-rustls"]

@@ -107,7 +107,7 @@ features = ["tls-rustls"]
 version = "0.6.0"

 [workspace.dependencies.tower]
-version = "0.4.13"
+version = "0.5.0"
 default-features = false
 features = ["util"]

@@ -140,7 +140,7 @@ default-features = false
 features = ["rc"]

 [workspace.dependencies.serde_json]
-version = "1.0.121"
+version = "1.0.124"
 default-features = false
 features = ["raw_value"]

@@ -193,7 +193,7 @@ default-features = false

 # used for conduit's CLI and admin room command parsing
 [workspace.dependencies.clap]
-version = "4.5.9"
+version = "4.5.15"
 default-features = false
 features = [
 	"std",
@@ -307,7 +307,7 @@ version = "0.1.2"
 [workspace.dependencies.ruma]
 git = "https://github.com/girlbossceo/ruwuma"
 #branch = "conduwuit-changes"
-rev = "c76e2873c1593a3308d4ba3e0e4a1db65acf8536"
+rev = "11cbd52af1039f3d4a0b96333acd1d1687ba01aa"
 features = [
    "compat",
    "rand",
@@ -431,11 +431,11 @@ features = [
 ]

 [workspace.dependencies.rustyline-async]
-version = "0.4.2"
+version = "0.4.3"
 default-features = false

 [workspace.dependencies.termimad]
-version = "0.29.4"
+version = "0.30.0"
 default-features = false

 [workspace.dependencies.checked_ops]
@@ -473,17 +473,11 @@ rev = "4d78a14a5e03f539b8c6b475aefa08bb14e4de91"
 git = "https://github.com/girlbossceo/tracing"
 rev = "4d78a14a5e03f539b8c6b475aefa08bb14e4de91"

-# fixes hyper graceful shutdowns [https://github.com/programatik29/axum-server/issues/114]
-# https://github.com/girlbossceo/axum-server/commit/8e3368d899079818934e61cc9c839abcbbcada8a
-[patch.crates-io.axum-server]
-git = "https://github.com/girlbossceo/axum-server"
-rev = "8e3368d899079818934e61cc9c839abcbbcada8a"
-
 # adds a tab completion callback: https://github.com/girlbossceo/rustyline-async/commit/de26100b0db03e419a3d8e1dd26895d170d1fe50
 # adds event for CTRL+\: https://github.com/girlbossceo/rustyline-async/commit/67d8c49aeac03a5ef4e818f663eaa94dd7bf339b
 [patch.crates-io.rustyline-async]
 git = "https://github.com/girlbossceo/rustyline-async"
-rev = "de26100b0db03e419a3d8e1dd26895d170d1fe50"
+rev = "9654cc84e19241f6e19021eb8e677892656f5071"

 #
 # Our crates
@@ -224,9 +224,11 @@ registration_token = "change this token for something specific to your server"
 # No default.
 # forbidden_alias_names = []

-# List of forbidden server names that we will block all client room joins, incoming federated room directory requests, incoming federated invites for, and incoming federated joins. This check is applied on the room ID, room alias, sender server name, and sender user's server name.
-# Basically "global" ACLs. For our user (client) checks, admin users are allowed.
-# No default.
+# List of forbidden server names that we will block incoming AND outgoing federation with, and block client room joins / remote user invites.
+#
+# This check is applied on the room ID, room alias, sender server name, sender user's server name, inbound federation X-Matrix origin, and outbound federation handler.
+#
+# Basically "global" ACLs. No default.
 # forbidden_remote_server_names = []

 # List of forbidden server names that we will block all outgoing federated room directory requests for. Useful for preventing our users from wandering into bad servers or spaces.
@@ -9,11 +9,11 @@
        "nixpkgs-stable": "nixpkgs-stable"
      },
      "locked": {
-        "lastModified": 1720542474,
-        "narHash": "sha256-aKjJ/4l2I9+wNGTaOGRsuS3M1+IoTibqgEMPDikXm04=",
+        "lastModified": 1723558887,
+        "narHash": "sha256-FBaRmikNnCX+HQJXAfNJyiOl3sM1NrlxvcFwQDqwCyk=",
        "owner": "zhaofengli",
        "repo": "attic",
-        "rev": "6139576a3ce6bb992e0f6c3022528ec233e45f00",
+        "rev": "26b9417bde03edc6280d1f7ce709cd619cdb72d4",
        "type": "github"
      },
      "original": {
@@ -27,15 +27,15 @@
      "inputs": {
        "devenv": "devenv",
        "flake-compat": "flake-compat_3",
-        "nixpkgs": "nixpkgs_3",
-        "pre-commit-hooks": "pre-commit-hooks"
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1719923519,
-        "narHash": "sha256-7Rhljj2fsklFRsu+eq7N683Z9qukmreMEj5C1GqCrSA=",
+        "lastModified": 1723252655,
+        "narHash": "sha256-uOxcrNEMTOHvGHYyqDWnUpkhkY29l01KhjkgVQU2gXg=",
        "owner": "cachix",
        "repo": "cachix",
-        "rev": "4e9e71f78b9500fa6210cf1eaa4d75bdbab777c3",
+        "rev": "bd558fd32f55d6df1c3d496bade90335a1a6044d",
        "type": "github"
      },
      "original": {
@@ -123,11 +123,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1720546058,
-        "narHash": "sha256-iU2yVaPIZm5vMGdlT0+57vdB/aPq/V5oZFBRwYw+HBM=",
+        "lastModified": 1722960479,
+        "narHash": "sha256-NhCkJJQhD5GUib8zN9JrmYGMwt4lCRp6ZVNzIiYCl0Y=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "2d83156f23c43598cf44e152c33a59d3892f8b29",
+        "rev": "4c6c77920b8d44cd6660c1621dea6b3fc4b4c4f4",
        "type": "github"
      },
      "original": {
@@ -151,15 +151,15 @@
        ],
        "pre-commit-hooks": [
          "cachix",
-          "pre-commit-hooks"
+          "git-hooks"
        ]
      },
      "locked": {
-        "lastModified": 1719759336,
-        "narHash": "sha256-3a34VL/QnHprl5gMy9xlx6d8J+iNp+W88Ex8smkgH9M=",
+        "lastModified": 1723156315,
+        "narHash": "sha256-0JrfahRMJ37Rf1i0iOOn+8Z4CLvbcGNwa2ChOAVrp/8=",
        "owner": "cachix",
        "repo": "devenv",
-        "rev": "bb32aa986f2f695385e54428d0eaf7d05b31466e",
+        "rev": "ff5eb4f2accbcda963af67f1a1159e3f6c7f5f91",
        "type": "github"
      },
      "original": {
@@ -209,11 +209,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1720852044,
-        "narHash": "sha256-3NBYz8VuXuKU+8ONd9NFafCNjPEGHIZQ2Mdoam1a4mY=",
+        "lastModified": 1723530607,
+        "narHash": "sha256-FaXZZLLDW1D+pj7UgrIslDS8XjMMG3Pus5gAvUYWQS0=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "5087b12a595ee73131a944d922f24d81dae05725",
+        "rev": "296d44c440302980824c5f3b67e477cf0522e0c1",
        "type": "github"
      },
      "original": {
@@ -272,22 +272,6 @@
      }
    },
    "flake-compat_4": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-compat_5": {
      "flake": false,
      "locked": {
        "lastModified": 1696426674,
@@ -356,11 +340,38 @@
        "type": "github"
      }
    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "cachix",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "cachix",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable_2"
+      },
+      "locked": {
+        "lastModified": 1723202784,
+        "narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "c7012d0c18567c889b948781bc74a501e92275d1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
    "gitignore": {
      "inputs": {
        "nixpkgs": [
          "cachix",
-          "pre-commit-hooks",
+          "git-hooks",
          "nixpkgs"
        ]
      },
@@ -381,11 +392,11 @@
    "liburing": {
      "flake": false,
      "locked": {
-        "lastModified": 1720798442,
-        "narHash": "sha256-gtPppAoksMLW4GuruQ36nf4EAqIA1Bs6V9Xcx8dBxrQ=",
+        "lastModified": 1723553052,
+        "narHash": "sha256-sjqmYP/tvQKmsTD6FOd8m7aEja2hhEyyB3aTxVXEbuE=",
        "owner": "axboe",
        "repo": "liburing",
-        "rev": "1d674f83b7d0f07553ac44d99a401b05853d9dbe",
+        "rev": "401b3e4bde2316d35e93b548269c72bbb64adc02",
        "type": "github"
      },
      "original": {
@@ -558,16 +569,16 @@
    },
    "nixpkgs-stable_2": {
      "locked": {
-        "lastModified": 1718811006,
-        "narHash": "sha256-0Y8IrGhRmBmT7HHXlxxepg2t8j1X90++qRN3lukGaIk=",
+        "lastModified": 1720386169,
+        "narHash": "sha256-NGKVY4PjzwAa4upkGtAMz1npHGoRzWotlSnVlqI40mo=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "03d771e513ce90147b65fe922d87d3a0356fc125",
+        "rev": "194846768975b7ad2c4988bdb82572c00222c0d7",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-23.11",
+        "ref": "nixos-24.05",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -590,11 +601,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1719848872,
-        "narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=",
+        "lastModified": 1722813957,
+        "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8",
+        "rev": "cb9a96f23c491c081b38eab96d22fa958043c9fa",
        "type": "github"
      },
      "original": {
@@ -606,11 +617,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1720768451,
-        "narHash": "sha256-EYekUHJE2gxeo2pM/zM9Wlqw1Uw2XTJXOSAO79ksc4Y=",
+        "lastModified": 1723362943,
+        "narHash": "sha256-dFZRVSgmJkyM0bkPpaYRtG/kRMRTorUIDj8BxoOt1T4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "7e7c39ea35c5cdd002cd4588b03a3fb9ece6fad9",
+        "rev": "a58bc8ad779655e790115244571758e8de055e3d",
        "type": "github"
      },
      "original": {
@@ -646,30 +657,6 @@
        "type": "github"
      }
    },
-    "pre-commit-hooks": {
-      "inputs": {
-        "flake-compat": "flake-compat_4",
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "cachix",
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable_2"
-      },
-      "locked": {
-        "lastModified": 1719259945,
-        "narHash": "sha256-F1h+XIsGKT9TkGO3omxDLEb/9jOOsI6NnzsXFsZhry4=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "0ff4381bbb8f7a52ca4a851660fc7a437a4c6e07",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
    "rocksdb": {
      "flake": false,
      "locked": {
@@ -694,7 +681,7 @@
        "complement": "complement",
        "crane": "crane_2",
        "fenix": "fenix",
-        "flake-compat": "flake-compat_5",
+        "flake-compat": "flake-compat_4",
        "flake-utils": "flake-utils_3",
        "liburing": "liburing",
        "nix-filter": "nix-filter",
@@ -705,11 +692,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1720717809,
-        "narHash": "sha256-6I+fm+nTLF/iaj7ffiFGlSY7POmubwUaPA/Wq0Bm53M=",
+        "lastModified": 1723473250,
+        "narHash": "sha256-Ls0e6R4FmGUFXZlUcm6ZQaVNJ4Yj/nua4SSctXIopao=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "ffbc5ad993d5cd2f3b8bcf9a511165470944ab91",
+        "rev": "32a86cb1dad2b208e8f36f1bb50c2e4806b0371f",
        "type": "github"
      },
      "original": {
@@ -24,7 +24,7 @@
        file = ./rust-toolchain.toml;

        # See also `rust-toolchain.toml`
-        sha256 = "sha256-6eN/GKzjVSjEhGO9FhWObkRFaE1Jf+uqMSdQnb8lcB4=";
+        sha256 = "sha256-3jVIIf5XPnUU1CRaTyAiO0XHVbJl12MSx3eucTXCjtE=";
      };

      mkScope = pkgs: pkgs.lib.makeScope pkgs.newScope (self: {
@@ -11,7 +11,7 @@
 # If you're having trouble making the relevant changes, bug a maintainer.

 [toolchain]
-channel = "1.80.0"
+channel = "1.80.1"
 components = [
    # For rust-analyzer
    "rust-src",
@@ -240,7 +240,7 @@ pub(crate) async fn register_route(

 	// If `new_user_displayname_suffix` is set, registration will push whatever
 	// content is set to the user's display name with a space before it
-	if !services.globals.new_user_displayname_suffix().is_empty() {
+	if !services.globals.new_user_displayname_suffix().is_empty() && body.appservice_info.is_none() {
 		write!(displayname, " {}", services.globals.config.new_user_displayname_suffix)
 			.expect("should be able to write to string buffer");
 	}
@@ -5,7 +5,7 @@ use std::time::Duration;
 use axum::extract::State;
 use axum_client_ip::InsecureClientIp;
 use conduit::{
-	debug_warn, err, error,
+	debug_info, debug_warn, err, info,
 	utils::{
 		self,
 		content_disposition::{content_disposition_type, make_content_disposition, sanitise_filename},
@@ -13,12 +13,8 @@ use conduit::{
 	},
 	warn, Err, Error, Result,
 };
-use ruma::api::client::{
-	error::{ErrorKind, RetryAfter},
-	media::{
-		create_content, get_content, get_content_as_filename, get_content_thumbnail, get_media_config,
-		get_media_preview,
-	},
+use ruma::api::client::media::{
+	create_content, get_content, get_content_as_filename, get_content_thumbnail, get_media_config, get_media_preview,
 };
 use service::{
 	media::{FileMeta, MXC_LENGTH},
@@ -70,35 +66,22 @@ pub(crate) async fn get_media_preview_route(

 	let url = &body.url;
 	if !services.media.url_preview_allowed(url) {
-		return Err!(Request(Forbidden(
-			warn!(%sender_user, %url, "URL is not allowed to be previewed")
-		)));
+		debug_info!(%sender_user, %url, "URL is not allowed to be previewed");
+		return Err!(Request(Forbidden("URL is not allowed to be previewed")));
 	}

 	match services.media.get_url_preview(url).await {
 		Ok(preview) => {
 			let res = serde_json::value::to_raw_value(&preview).map_err(|e| {
-				error!(%sender_user, "Failed to convert UrlPreviewData into a serde json value: {e}");
-				Error::BadRequest(
-					ErrorKind::LimitExceeded {
-						retry_after: Some(RetryAfter::Delay(Duration::from_secs(5))),
-					},
-					"Failed to generate a URL preview, try again later.",
-				)
+				warn!(%sender_user, "Failed to convert UrlPreviewData into a serde json value: {e}");
+				err!(Request(Unknown("Failed to generate a URL preview")))
 			})?;

 			Ok(get_media_preview::v3::Response::from_raw_value(res))
 		},
 		Err(e) => {
-			warn!(%sender_user, "Failed to generate a URL preview: {e}");
-			// there doesn't seem to be an agreed-upon error code in the spec.
-			// the only response codes in the preview_url spec page are 200 and 429.
-			Err(Error::BadRequest(
-				ErrorKind::LimitExceeded {
-					retry_after: Some(RetryAfter::Delay(Duration::from_secs(5))),
-				},
-				"Failed to generate a URL preview, try again later.",
-			))
+			info!(%sender_user, "Failed to generate a URL preview: {e}");
+			Err!(Request(Unknown("Failed to generate a URL preview")))
 		},
 	}
 }
@@ -403,6 +403,7 @@ pub(crate) async fn kick_user_route(
 				unsigned: None,
 				state_key: Some(body.user_id.to_string()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&body.room_id,
@@ -465,6 +466,7 @@ pub(crate) async fn ban_user_route(
 				unsigned: None,
 				state_key: Some(body.user_id.to_string()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&body.room_id,
@@ -512,6 +514,7 @@ pub(crate) async fn unban_user_route(
 				unsigned: None,
 				state_key: Some(body.user_id.to_string()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&body.room_id,
@@ -662,6 +665,12 @@ pub async fn join_room_by_id_helper(
 ) -> Result<join_room_by_id::v3::Response> {
 	let state_lock = services.rooms.state.mutex.lock(room_id).await;

+	let user_is_guest = services.users.is_deactivated(sender_user).unwrap_or(false);
+
+	if matches!(services.rooms.state_accessor.guest_can_join(room_id), Ok(false)) && user_is_guest {
+		return Err!(Request(Forbidden("Guests are not allowed to join this room")));
+	}
+
 	if matches!(services.rooms.state_cache.is_joined(sender_user, room_id), Ok(true)) {
 		debug_warn!("{sender_user} is already joined in {room_id}");
 		return Ok(join_room_by_id::v3::Response {
@@ -1094,6 +1103,7 @@ async fn join_room_by_id_helper_local(
 				unsigned: None,
 				state_key: Some(sender_user.to_string()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			room_id,
@@ -1406,6 +1416,7 @@ pub(crate) async fn invite_helper(
 					unsigned: None,
 					state_key: Some(user_id.to_string()),
 					redacts: None,
+					timestamp: None,
 				},
 				sender_user,
 				room_id,
@@ -1517,6 +1528,7 @@ pub(crate) async fn invite_helper(
 				unsigned: None,
 				state_key: Some(user_id.to_string()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			room_id,
@@ -1634,6 +1646,7 @@ pub async fn leave_room(services: &Services, user_id: &UserId, room_id: &RoomId,
 					unsigned: None,
 					state_key: Some(user_id.to_string()),
 					redacts: None,
+					timestamp: None,
 				},
 				user_id,
 				room_id,
@@ -84,6 +84,11 @@ pub(crate) async fn send_message_event_route(
 				unsigned: Some(unsigned),
 				state_key: None,
 				redacts: None,
+				timestamp: if body.appservice_info.is_some() {
+					body.timestamp
+				} else {
+					None
+				},
 			},
 			sender_user,
 			&body.room_id,
@@ -257,6 +257,12 @@ pub(crate) async fn get_profile_route(
 pub async fn update_displayname(
 	services: &Services, user_id: OwnedUserId, displayname: Option<String>, all_joined_rooms: Vec<OwnedRoomId>,
 ) -> Result<()> {
+	let current_display_name = services.users.displayname(&user_id).unwrap_or_default();
+
+	if displayname == current_display_name {
+		return Ok(());
+	}
+
 	services
 		.users
 		.set_displayname(&user_id, displayname.clone())
@@ -289,6 +295,7 @@ pub async fn update_displayname(
 					unsigned: None,
 					state_key: Some(user_id.to_string()),
 					redacts: None,
+					timestamp: None,
 				},
 				room_id,
 			))
@@ -305,6 +312,13 @@ pub async fn update_avatar_url(
 	services: &Services, user_id: OwnedUserId, avatar_url: Option<OwnedMxcUri>, blurhash: Option<String>,
 	all_joined_rooms: Vec<OwnedRoomId>,
 ) -> Result<()> {
+	let current_avatar_url = services.users.avatar_url(&user_id).unwrap_or_default();
+	let current_blurhash = services.users.blurhash(&user_id).unwrap_or_default();
+
+	if current_avatar_url == avatar_url && current_blurhash == blurhash {
+		return Ok(());
+	}
+
 	services
 		.users
 		.set_avatar_url(&user_id, avatar_url.clone())
@@ -342,6 +356,7 @@ pub async fn update_avatar_url(
 					unsigned: None,
 					state_key: Some(user_id.to_string()),
 					redacts: None,
+					timestamp: None,
 				},
 				room_id,
 			))
@@ -34,6 +34,7 @@ pub(crate) async fn redact_event_route(
 				unsigned: None,
 				state_key: None,
 				redacts: Some(body.event_id.into()),
+				timestamp: None,
 			},
 			sender_user,
 			&body.room_id,
@@ -1,7 +1,7 @@
 use std::{cmp::max, collections::BTreeMap};

 use axum::extract::State;
-use conduit::{debug_info, debug_warn};
+use conduit::{debug_info, debug_warn, err};
 use ruma::{
 	api::client::{
 		error::ErrorKind,
@@ -197,6 +197,7 @@ pub(crate) async fn create_room_route(
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&room_id,
@@ -225,6 +226,7 @@ pub(crate) async fn create_room_route(
 				unsigned: None,
 				state_key: Some(sender_user.to_string()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&room_id,
@@ -262,6 +264,7 @@ pub(crate) async fn create_room_route(
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&room_id,
@@ -285,6 +288,7 @@ pub(crate) async fn create_room_route(
 					unsigned: None,
 					state_key: Some(String::new()),
 					redacts: None,
+					timestamp: None,
 				},
 				sender_user,
 				&room_id,
@@ -311,6 +315,7 @@ pub(crate) async fn create_room_route(
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&room_id,
@@ -330,6 +335,7 @@ pub(crate) async fn create_room_route(
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&room_id,
@@ -352,6 +358,7 @@ pub(crate) async fn create_room_route(
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&room_id,
@@ -405,6 +412,7 @@ pub(crate) async fn create_room_route(
 					unsigned: None,
 					state_key: Some(String::new()),
 					redacts: None,
+					timestamp: None,
 				},
 				sender_user,
 				&room_id,
@@ -427,6 +435,7 @@ pub(crate) async fn create_room_route(
 					unsigned: None,
 					state_key: Some(String::new()),
 					redacts: None,
+					timestamp: None,
 				},
 				sender_user,
 				&room_id,
@@ -475,10 +484,7 @@ pub(crate) async fn get_room_event_route(
 		.rooms
 		.timeline
 		.get_pdu(&body.event_id)?
-		.ok_or_else(|| {
-			warn!("Event not found, event ID: {:?}", &body.event_id);
-			Error::BadRequest(ErrorKind::NotFound, "Event not found.")
-		})?;
+		.ok_or_else(|| err!(Request(NotFound("Event {} not found.", &body.event_id))))?;

 	if !services
 		.rooms
@@ -584,6 +590,7 @@ pub(crate) async fn upgrade_room_route(
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&body.room_id,
@@ -675,6 +682,7 @@ pub(crate) async fn upgrade_room_route(
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&replacement_room,
@@ -703,6 +711,7 @@ pub(crate) async fn upgrade_room_route(
 				unsigned: None,
 				state_key: Some(sender_user.to_string()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&replacement_room,
@@ -731,6 +740,7 @@ pub(crate) async fn upgrade_room_route(
 					unsigned: None,
 					state_key: Some(String::new()),
 					redacts: None,
+					timestamp: None,
 				},
 				sender_user,
 				&replacement_room,
@@ -789,6 +799,7 @@ pub(crate) async fn upgrade_room_route(
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			sender_user,
 			&body.room_id,
@@ -34,7 +34,7 @@ struct Claims {
 ///
 /// Get the supported login types of this server. One of these should be used as
 /// the `type` field when logging in.
-#[tracing::instrument(skip_all, fields(%client), name = "register")]
+#[tracing::instrument(skip_all, fields(%client), name = "login")]
 pub(crate) async fn get_login_types_route(
 	InsecureClientIp(client): InsecureClientIp, _body: Ruma<get_login_types::v3::Request>,
 ) -> Result<get_login_types::v3::Response> {
@@ -58,7 +58,7 @@ pub(crate) async fn get_login_types_route(
 /// Note: You can use [`GET
 /// /_matrix/client/r0/login`](fn.get_supported_versions_route.html) to see
 /// supported login types.
-#[tracing::instrument(skip_all, fields(%client), name = "register")]
+#[tracing::instrument(skip_all, fields(%client), name = "login")]
 pub(crate) async fn login_route(
 	State(services): State<crate::State>, InsecureClientIp(client): InsecureClientIp, body: Ruma<login::v3::Request>,
 ) -> Result<login::v3::Response> {
@@ -221,7 +221,7 @@ pub(crate) async fn login_route(
 ///   last seen ts)
 /// - Forgets to-device events
 /// - Triggers device list updates
-#[tracing::instrument(skip_all, fields(%client), name = "register")]
+#[tracing::instrument(skip_all, fields(%client), name = "logout")]
 pub(crate) async fn logout_route(
 	State(services): State<crate::State>, InsecureClientIp(client): InsecureClientIp, body: Ruma<logout::v3::Request>,
 ) -> Result<logout::v3::Response> {
@@ -249,7 +249,7 @@ pub(crate) async fn logout_route(
 /// Note: This is equivalent to calling [`GET
 /// /_matrix/client/r0/logout`](fn.logout_route.html) from each device of this
 /// user.
-#[tracing::instrument(skip_all, fields(%client), name = "register")]
+#[tracing::instrument(skip_all, fields(%client), name = "logout")]
 pub(crate) async fn logout_all_route(
 	State(services): State<crate::State>, InsecureClientIp(client): InsecureClientIp,
 	body: Ruma<logout_all::v3::Request>,
@@ -43,6 +43,11 @@ pub(crate) async fn send_state_event_for_key_route(
 			&body.event_type,
 			&body.body.body,
 			body.state_key.clone(),
+			if body.appservice_info.is_some() {
+				body.timestamp
+			} else {
+				None
+			},
 		)
 		.await?
 		.into(),
@@ -172,7 +177,7 @@ pub(crate) async fn get_state_events_for_empty_key_route(

 async fn send_state_event_for_key_helper(
 	services: &Services, sender: &UserId, room_id: &RoomId, event_type: &StateEventType,
-	json: &Raw<AnyStateEventContent>, state_key: String,
+	json: &Raw<AnyStateEventContent>, state_key: String, timestamp: Option<ruma::MilliSecondsSinceUnixEpoch>,
 ) -> Result<Arc<EventId>> {
 	allowed_to_send_state_event(services, room_id, event_type, json).await?;
 	let state_lock = services.rooms.state.mutex.lock(room_id).await;
@@ -186,6 +191,7 @@ async fn send_state_event_for_key_helper(
 				unsigned: None,
 				state_key: Some(state_key),
 				redacts: None,
+				timestamp,
 			},
 			sender,
 			room_id,
@@ -2,7 +2,7 @@ use std::time::{Duration, SystemTime};

 use axum::extract::State;
 use base64::{engine::general_purpose, Engine as _};
-use conduit::utils;
+use conduit::{utils, Err};
 use hmac::{Hmac, Mac};
 use ruma::{api::client::voip::get_turn_server_info, SecondsSinceUnixEpoch, UserId};
 use sha1::Sha1;
@@ -19,6 +19,11 @@ type HmacSha1 = Hmac<Sha1>;
 pub(crate) async fn turn_server_route(
 	State(services): State<crate::State>, body: Ruma<get_turn_server_info::v3::Request>,
 ) -> Result<get_turn_server_info::v3::Response> {
+	// MSC4166: return M_NOT_FOUND 404 if no TURN URIs are specified in any way
+	if services.server.config.turn_uris.is_empty() {
+		return Err!(Request(NotFound("Not Found")));
+	}
+
 	let turn_secret = services.globals.turn_secret().clone();

 	let (username, password) = if !turn_secret.is_empty() {
@@ -6,7 +6,7 @@ use axum_extra::{
 	typed_header::TypedHeaderRejectionReason,
 	TypedHeader,
 };
-use conduit::{warn, Err, Error, Result};
+use conduit::{debug_info, warn, Err, Error, Result};
 use http::uri::PathAndQuery;
 use ruma::{
 	api::{client::error::ErrorKind, AuthScheme, Metadata},
@@ -185,7 +185,7 @@ fn auth_appservice(services: &Services, request: &Request, info: Box<Registratio
 async fn auth_server(
 	services: &Services, request: &mut Request, json_body: &Option<CanonicalJsonValue>,
 ) -> Result<Auth> {
-	if !services.globals.allow_federation() {
+	if !services.server.config.allow_federation {
 		return Err!(Config("allow_federation", "Federation is disabled."));
 	}

@@ -206,6 +206,17 @@ async fn auth_server(
 		})?;

 	let origin = &x_matrix.origin;
+
+	if services
+		.server
+		.config
+		.forbidden_remote_server_names
+		.contains(origin)
+	{
+		debug_info!("Refusing to accept inbound federation request to {origin}");
+		return Err!(Request(Forbidden("Federation with this homeserver is not allowed.")));
+	}
+
 	let signatures =
 		BTreeMap::from_iter([(x_matrix.key.clone(), CanonicalJsonValue::String(x_matrix.sig.to_string()))]);
 	let signatures = BTreeMap::from_iter([(
@@ -139,6 +139,7 @@ pub(crate) async fn create_join_event_template_route(
 			unsigned: None,
 			state_key: Some(body.user_id.to_string()),
 			redacts: None,
+			timestamp: None,
 		},
 		&body.user_id,
 		&body.room_id,
@@ -57,6 +57,7 @@ pub(crate) async fn create_leave_event_template_route(
 			unsigned: None,
 			state_key: Some(body.user_id.to_string()),
 			redacts: None,
+			timestamp: None,
 		},
 		&body.user_id,
 		&body.room_id,
@@ -1,6 +1,6 @@
 use std::{collections::BTreeMap, sync::Arc};

-use ruma::{events::TimelineEventType, EventId};
+use ruma::{events::TimelineEventType, EventId, MilliSecondsSinceUnixEpoch};
 use serde::Deserialize;
 use serde_json::value::RawValue as RawJsonValue;

@@ -13,4 +13,8 @@ pub struct PduBuilder {
 	pub unsigned: Option<BTreeMap<String, serde_json::Value>>,
 	pub state_key: Option<String>,
 	pub redacts: Option<Arc<EventId>>,
+	/// For timestamped messaging, should only be used for appservices
+	///
+	/// Will be set to current time if None
+	pub timestamp: Option<MilliSecondsSinceUnixEpoch>,
 }
@@ -71,6 +71,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -99,6 +100,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(server_user.to_string()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -124,6 +126,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -143,6 +146,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -162,6 +166,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -181,6 +186,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -201,6 +207,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -221,6 +228,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -245,6 +253,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -271,6 +280,7 @@ pub async fn create_admin_room(services: &Services) -> Result<()> {
 				unsigned: None,
 				state_key: Some(String::new()),
 				redacts: None,
+				timestamp: None,
 			},
 			server_user,
 			&room_id,
@@ -50,6 +50,7 @@ impl super::Service {
 					unsigned: None,
 					state_key: Some(user_id.to_string()),
 					redacts: None,
+					timestamp: None,
 				},
 				server_user,
 				&room_id,
@@ -75,6 +76,7 @@ impl super::Service {
 					unsigned: None,
 					state_key: Some(user_id.to_string()),
 					redacts: None,
+					timestamp: None,
 				},
 				user_id,
 				&room_id,
@@ -100,6 +102,7 @@ impl super::Service {
 					unsigned: None,
 					state_key: Some(String::new()),
 					redacts: None,
+					timestamp: None,
 				},
 				server_user,
 				&room_id,
@@ -119,6 +122,7 @@ impl super::Service {
                unsigned: None,
                state_key: None,
                redacts: None,
+                timestamp: None,
            },
            server_user,
            &room_id,
@@ -260,6 +260,7 @@ impl Service {
 			unsigned: None,
 			state_key: None,
 			redacts: None,
+			timestamp: None,
 		};

 		if let Err(e) = self
@@ -289,6 +290,7 @@ impl Service {
 			unsigned: None,
 			state_key: None,
 			redacts: None,
+			timestamp: None,
 		};

 		self.services
@@ -350,6 +350,7 @@ impl Service {
 			unsigned: None,
 			state_key: Some(target_user.into()),
 			redacts: None,
+			timestamp: None,
 		};

 		Ok(self
@@ -638,6 +638,7 @@ impl Service {
 			unsigned,
 			state_key,
 			redacts,
+			timestamp,
 		} = pdu_builder;

 		let prev_events: Vec<_> = self
@@ -705,9 +706,14 @@ impl Service {
 			room_id: room_id.to_owned(),
 			sender: sender.to_owned(),
 			origin: None,
-			origin_server_ts: utils::millis_since_unix_epoch()
-				.try_into()
-				.expect("time is valid"),
+			origin_server_ts: timestamp.map_or_else(
+				|| {
+					utils::millis_since_unix_epoch()
+						.try_into()
+						.expect("u64 fits into UInt")
+				},
+				|ts| ts.get(),
+			),
 			kind: event_type,
 			content,
 			state_key,
@@ -1,7 +1,8 @@
 use std::{fmt::Debug, mem};

 use conduit::{
-	debug, debug_error, debug_warn, err, error::inspect_debug_log, trace, utils::string::EMPTY, Err, Error, Result,
+	debug, debug_error, debug_info, debug_warn, err, error::inspect_debug_log, trace, utils::string::EMPTY, Err, Error,
+	Result,
 };
 use http::{header::AUTHORIZATION, HeaderValue};
 use ipaddress::IPAddress;
@@ -31,6 +32,16 @@ impl super::Service {
 			return Err!(Config("allow_federation", "Federation is disabled."));
 		}

+		if self
+			.server
+			.config
+			.forbidden_remote_server_names
+			.contains(&dest.to_owned())
+		{
+			debug_info!("Refusing to send outbound federation request to {dest}");
+			return Err!(Request(Forbidden("Federation with this homeserver is not allowed.")));
+		}
+
 		let actual = self.services.resolver.get_actual_dest(dest).await?;
 		let request = self.prepare::<T>(dest, &actual, req).await?;
 		self.execute::<T>(dest, &actual, request, client).await
Author	SHA1	Message	Date
Matthias Ahouansou	69b3d9f7dd	support timestamped appservice messaging Co-authored-by: strawberry <strawberry@puppygock.gay> Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-14 20:01:34 -04:00
strawberry	1fb32e8861	nix: bump flake.lock • Updated input 'attic': 'github:zhaofengli/attic/6139576a3ce6bb992e0f6c3022528ec233e45f00' (2024-07-09) → 'github:zhaofengli/attic/26b9417bde03edc6280d1f7ce709cd619cdb72d4' (2024-08-13) • Updated input 'cachix': 'github:cachix/cachix/4e9e71f78b9500fa6210cf1eaa4d75bdbab777c3' (2024-07-02) → 'github:cachix/cachix/bd558fd32f55d6df1c3d496bade90335a1a6044d' (2024-08-10) • Updated input 'cachix/devenv': 'github:cachix/devenv/bb32aa986f2f695385e54428d0eaf7d05b31466e' (2024-06-30) → 'github:cachix/devenv/ff5eb4f2accbcda963af67f1a1159e3f6c7f5f91' (2024-08-08) • Updated input 'cachix/devenv/pre-commit-hooks': follows 'cachix/pre-commit-hooks' → follows 'cachix/git-hooks' • Added input 'cachix/git-hooks': 'github:cachix/git-hooks.nix/c7012d0c18567c889b948781bc74a501e92275d1' (2024-08-09) • Added input 'cachix/git-hooks/flake-compat': follows 'cachix/flake-compat' • Added input 'cachix/git-hooks/gitignore': 'github:hercules-ci/gitignore.nix/637db329424fd7e46cf4185293b9cc8c88c95394' (2024-02-28) • Added input 'cachix/git-hooks/gitignore/nixpkgs': follows 'cachix/git-hooks/nixpkgs' • Added input 'cachix/git-hooks/nixpkgs': follows 'cachix/nixpkgs' • Added input 'cachix/git-hooks/nixpkgs-stable': 'github:NixOS/nixpkgs/194846768975b7ad2c4988bdb82572c00222c0d7' (2024-07-07) • Updated input 'cachix/nixpkgs': 'github:NixOS/nixpkgs/00d80d13810dbfea8ab4ed1009b09100cca86ba8' (2024-07-01) → 'github:NixOS/nixpkgs/cb9a96f23c491c081b38eab96d22fa958043c9fa' (2024-08-04) • Removed input 'cachix/pre-commit-hooks' • Removed input 'cachix/pre-commit-hooks/flake-compat' • Removed input 'cachix/pre-commit-hooks/gitignore' • Removed input 'cachix/pre-commit-hooks/gitignore/nixpkgs' • Removed input 'cachix/pre-commit-hooks/nixpkgs' • Removed input 'cachix/pre-commit-hooks/nixpkgs-stable' • Updated input 'crane': 'github:ipetkov/crane/2d83156f23c43598cf44e152c33a59d3892f8b29' (2024-07-09) → 'github:ipetkov/crane/4c6c77920b8d44cd6660c1621dea6b3fc4b4c4f4' (2024-08-06) • Updated input 'fenix': 'github:nix-community/fenix/5087b12a595ee73131a944d922f24d81dae05725' (2024-07-13) → 'github:nix-community/fenix/296d44c440302980824c5f3b67e477cf0522e0c1' (2024-08-13) • Updated input 'fenix/rust-analyzer-src': 'github:rust-lang/rust-analyzer/ffbc5ad993d5cd2f3b8bcf9a511165470944ab91' (2024-07-11) → 'github:rust-lang/rust-analyzer/32a86cb1dad2b208e8f36f1bb50c2e4806b0371f' (2024-08-12) • Updated input 'liburing': 'github:axboe/liburing/1d674f83b7d0f07553ac44d99a401b05853d9dbe' (2024-07-12) → 'github:axboe/liburing/401b3e4bde2316d35e93b548269c72bbb64adc02' (2024-08-13) • Updated input 'nixpkgs': 'github:NixOS/nixpkgs/7e7c39ea35c5cdd002cd4588b03a3fb9ece6fad9' (2024-07-12) → 'github:NixOS/nixpkgs/a58bc8ad779655e790115244571758e8de055e3d' (2024-08-11) Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-14 02:39:18 -04:00
strawberry	4d2e8dab0b	bump various cargo deps Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-14 02:39:13 -04:00
strawberry	89dbbf18a5	bump rust toolchain to hotfix 1.80.1 Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-13 19:25:07 -04:00
strawberry	02590b9cd1	dont apply new_user_displayname_suffix to appservice user registrations Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-13 19:25:07 -04:00
strawberry	b12f21dce6	reduce unnecessary logging on URL preview and event, use sensible error code for URL previews Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-13 19:25:07 -04:00
strawberry	d08f181564	apply `forbidden_remote_server_names` to outbound sending and inbound federation handling Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-13 19:25:07 -04:00
strawberry	442d950545	dont send duplicate membership update events if pfp and display name are same Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-09 23:20:46 -04:00
strawberry	fa9298f427	respect m.room.guest_access on room joins Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-09 23:20:43 -04:00
strawberry	3d32726bbe	implement MSC4166, returning M_NOT_FOUND if no TURN URIs are set Signed-off-by: strawberry <strawberry@puppygock.gay>	2024-08-09 14:41:46 -04:00