chore: Release

No longer needed because Terra now distributes both stable and nightly
releases for Fedora- & EL-family distributions.

.forgejo/actions/create-docker-manifest/action.yml

@@ -44,7 +44,7 @@ runs:
 
     - name: Login to builtin registry
       if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
       with:
         registry: ${{ env.BUILTIN_REGISTRY }}
         username: ${{ inputs.registry_user }}
@@ -52,7 +52,7 @@ runs:
 
     - name: Set up Docker Buildx
       if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
       with:
         # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
         driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
@@ -61,7 +61,7 @@ runs:
     - name: Extract metadata (tags) for Docker
       if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
       id: meta
-      uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
       with:
         flavor: |
           latest=auto

.forgejo/actions/prepare-docker-build/action.yml

@@ -67,7 +67,7 @@ runs:
       uses: ./.forgejo/actions/rust-toolchain
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
       with:
         # Use persistent BuildKit if BUILDKIT_ENDPOINT is set (e.g. tcp://buildkit:8125)
         driver: ${{ env.BUILDKIT_ENDPOINT != '' && 'remote' || 'docker-container' }}
@@ -75,11 +75,11 @@ runs:
 
     - name: Set up QEMU
       if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
 
     - name: Login to builtin registry
       if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
-      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+      uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
       with:
         registry: ${{ env.BUILTIN_REGISTRY }}
         username: ${{ inputs.registry_user }}
@@ -87,7 +87,7 @@ runs:
 
     - name: Extract metadata (labels, annotations) for Docker
       id: meta
-      uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
       with:
         images: ${{ inputs.images }}
         # default labels & annotations: https://github.com/docker/metadata-action/blob/master/src/meta.ts#L509

.forgejo/actions/setup-llvm-with-apt/action.yml

@@ -120,7 +120,7 @@ runs:
 
     - name: Install additional packages
       if: inputs.extra-packages != ''
-      uses: https://github.com/awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # latest
+      uses: https://github.com/awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ${{ inputs.extra-packages }}
         version: 1.0

.forgejo/actions/timelord/action.yml

@@ -71,7 +71,7 @@ runs:
 
     - name: Install timelord-cli and git-warp-time
       if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@9bcaee1dcae34154180f412e2fa69355a7cda9f6 # v2
+      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
       with:
         tool: git-warp-time,timelord-cli@3.0.1
 

.forgejo/workflows/build-fedora.yml

@@ -1,394 +0,0 @@
-name: Build / Fedora RPM
-
-concurrency:
-  group: "build-fedora-${{ github.ref }}"
-  cancel-in-progress: true
-
-on:
-  push:
-    tags:
-      - "v*.*.*"
-    # paths:
-    #   - 'pkg/fedora/**'
-    #   - 'src/**'
-    #   - 'Cargo.toml'
-    #   - 'Cargo.lock'
-    #   - '.forgejo/workflows/build-fedora.yml'
-  workflow_dispatch:
-  schedule:
-    - cron: '30 0 * * 2'
-
-jobs:
-  build:
-    runs-on: fedora-latest
-    steps:
-      - name: Detect Fedora version
-        id: fedora
-        run: |
-          VERSION=$(rpm -E %fedora)
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Fedora version: $VERSION"
-
-      - name: Checkout repository with full history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with:
-          fetch-depth: 0
-          ref: ${{ github.ref_name }}
-
-
-      - name: Cache DNF packages
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            /var/cache/dnf
-            /var/cache/yum
-          key: dnf-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('pkg/fedora/continuwuity.spec.rpkg') }}-v1
-          restore-keys: |
-            dnf-fedora${{ steps.fedora.outputs.version }}-
-
-      - name: Cache Cargo registry
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-          key: cargo-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            cargo-fedora${{ steps.fedora.outputs.version }}-
-
-      - name: Cache Rust build dependencies
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            ~/rpmbuild/BUILD/*/target/release/deps
-            ~/rpmbuild/BUILD/*/target/release/build
-            ~/rpmbuild/BUILD/*/target/release/.fingerprint
-            ~/rpmbuild/BUILD/*/target/release/incremental
-          key: rust-deps-fedora${{ steps.fedora.outputs.version }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            rust-deps-fedora${{ steps.fedora.outputs.version }}-
-
-      - name: Setup sccache
-        uses: https://git.tomfos.tr/tom/sccache-action@v1
-
-      - name: Configure sccache environment
-        run: |
-          echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
-          echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-          echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> $GITHUB_ENV
-          echo "SCCACHE_CACHE_SIZE=10G" >> $GITHUB_ENV
-          # Aggressive GC since cache restores don't increment counter
-          echo "CARGO_INCREMENTAL_GC_TRIGGER=5" >> $GITHUB_ENV
-
-      - name: Install base RPM tools
-        run: |
-          dnf install -y --setopt=keepcache=1 \
-            fedora-packager \
-            python3-pip \
-            rpm-sign \
-            rpkg \
-            wget
-
-      - name: Setup build environment and build SRPM
-        run: |
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git config --global user.email "ci@continuwuity.org"
-          git config --global user.name "Continuwuity"
-
-          rpmdev-setuptree
-
-          cd "$GITHUB_WORKSPACE"
-
-          # Determine release suffix and version based on ref type and branch
-          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
-            # Tags get clean version numbers for stable releases
-            RELEASE_SUFFIX=""
-            TAG_NAME="${{ github.ref_name }}"
-            # Extract version from tag (remove v prefix if present)
-            TAG_VERSION=$(echo "$TAG_NAME" | sed 's/^v//' | tr '-' '~')
-
-            # Create spec file with tag version
-            sed -e "s/^Version:.*$/Version:        $TAG_VERSION/" \
-                -e "s/^Release:.*$/Release:        1%{?dist}/" \
-                pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
-          elif [ "${{ github.ref_name }}" = "main" ]; then
-            # Main branch gets .dev suffix
-            RELEASE_SUFFIX=".dev"
-
-            # Replace the Release line to include our suffix
-            sed "s/^Release:.*$/Release:        1${RELEASE_SUFFIX}%{?dist}/" \
-              pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
-          else
-            # Other branches get sanitized branch name as suffix
-            SAFE_BRANCH=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9]/_/g' | cut -c1-20)
-            RELEASE_SUFFIX=".${SAFE_BRANCH}"
-
-            # Replace the Release line to include our suffix
-            sed "s/^Release:.*$/Release:        1${RELEASE_SUFFIX}%{?dist}/" \
-              pkg/fedora/continuwuity.spec.rpkg > continuwuity.spec.rpkg
-          fi
-
-          rpkg srpm --outdir "$HOME/rpmbuild/SRPMS"
-
-          ls -la $HOME/rpmbuild/SRPMS/
-
-
-      - name: Install build dependencies from SRPM
-        run: |
-          SRPM=$(find "$HOME/rpmbuild/SRPMS" -name "*.src.rpm" | head -1)
-
-          if [ -z "$SRPM" ]; then
-            echo "Error: No SRPM file found"
-            exit 1
-          fi
-
-          echo "Installing build dependencies from: $(basename $SRPM)"
-          dnf builddep -y "$SRPM"
-
-      - name: Build RPM from SRPM
-        run: |
-          SRPM=$(find "$HOME/rpmbuild/SRPMS" -name "*.src.rpm" | head -1)
-
-          if [ -z "$SRPM" ]; then
-            echo "Error: No SRPM file found"
-            exit 1
-          fi
-
-          echo "Building from SRPM: $SRPM"
-
-          rpmbuild --rebuild "$SRPM" \
-            --define "_topdir $HOME/rpmbuild" \
-            --define "_sourcedir $GITHUB_WORKSPACE" \
-            --nocheck  # Skip %check section to avoid test dependencies
-
-
-      - name: Test RPM installation
-        run: |
-          # Find the main binary RPM (exclude debug and source RPMs)
-          RPM=$(find "$HOME/rpmbuild/RPMS" -name "continuwuity-*.rpm" \
-            ! -name "*debuginfo*" \
-            ! -name "*debugsource*" \
-            ! -name "*.src.rpm" | head -1)
-
-          if [ -z "$RPM" ]; then
-            echo "Error: No binary RPM file found"
-            exit 1
-          fi
-
-          echo "Testing installation of: $RPM"
-
-          # Dry run first
-          rpm -qpi "$RPM"
-          echo ""
-          rpm -qpl "$RPM"
-
-          # Actually install it
-          dnf install -y "$RPM"
-
-          # Verify installation
-          rpm -qa | grep continuwuity
-
-          # Check that the binary exists
-          [ -f /usr/bin/conduwuit ] && echo "✅ Binary installed successfully"
-          [ -f /usr/lib/systemd/system/conduwuit.service ] && echo "✅ Systemd service installed"
-          [ -f /etc/conduwuit/conduwuit.toml ] && echo "✅ Config file installed"
-
-      - name: List built packages
-        run: |
-          echo "Binary RPMs:"
-          find "$HOME/rpmbuild/RPMS" -name "*.rpm" -type f -exec ls -la {} \;
-
-          echo ""
-          echo "Source RPMs:"
-          find "$HOME/rpmbuild/SRPMS" -name "*.rpm" -type f -exec ls -la {} \;
-
-      - name: Collect artifacts
-        run: |
-          mkdir -p artifacts
-
-          find "$HOME/rpmbuild/RPMS" -name "*.rpm" -type f -exec cp {} artifacts/ \;
-          find "$HOME/rpmbuild/SRPMS" -name "*.rpm" -type f -exec cp {} artifacts/ \;
-
-          cd artifacts
-          echo "Build Information:" > BUILD_INFO.txt
-          echo "==================" >> BUILD_INFO.txt
-          echo "Git commit: ${{ github.sha }}" >> BUILD_INFO.txt
-          echo "Git branch: ${{ github.ref_name }}" >> BUILD_INFO.txt
-          echo "Build date: $(date -u +%Y-%m-%d_%H:%M:%S_UTC)" >> BUILD_INFO.txt
-          echo "" >> BUILD_INFO.txt
-          echo "Package contents:" >> BUILD_INFO.txt
-          echo "-----------------" >> BUILD_INFO.txt
-          for rpm in *.rpm; do
-            echo "" >> BUILD_INFO.txt
-            echo "File: $rpm" >> BUILD_INFO.txt
-            rpm -qpi "$rpm" 2>/dev/null | grep -E "^(Name|Version|Release|Architecture|Size)" >> BUILD_INFO.txt
-          done
-
-          ls -la
-
-      - name: Upload binary RPM artifact
-        run: |
-          # Find the main binary RPM (exclude debug and source RPMs)
-          BIN_RPM=$(find artifacts -name "continuwuity-*.rpm" \
-            ! -name "*debuginfo*" \
-            ! -name "*debugsource*" \
-            ! -name "*.src.rpm" \
-            -type f)
-
-          mkdir -p upload-bin
-          cp $BIN_RPM upload-bin/
-
-      - name: Upload binary RPM
-        uses: forgejo/upload-artifact@v4
-        with:
-          name: continuwuity
-          path: upload-bin/
-
-      - name: Upload debug RPM artifact
-        uses: forgejo/upload-artifact@v4
-        with:
-          name: continuwuity-debug
-          path: artifacts/*debuginfo*.rpm
-
-      - name: Publish to RPM Package Registry
-        if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
-        run: |
-          # Find the main binary RPM (exclude debug and source RPMs)
-          RPM=$(find artifacts -name "continuwuity-*.rpm" \
-            ! -name "*debuginfo*" \
-            ! -name "*debugsource*" \
-            ! -name "*.src.rpm" \
-            -type f | head -1)
-
-          if [ -z "$RPM" ]; then
-            echo "No binary RPM found to publish"
-            exit 0
-          fi
-
-          RPM_BASENAME=$(basename "$RPM")
-          echo "Publishing: $RPM_BASENAME"
-
-          # Determine the group based on ref type and branch
-          if [[ "${{ github.ref }}" == "refs/tags/"* ]]; then
-            # For tags, extract the tag name for version info
-            TAG_NAME="${{ github.ref_name }}"
-            if [[ "$TAG_NAME" == *"-"* ]]; then
-              GROUP="unstable"
-            else
-              GROUP="stable"
-            fi
-          elif [ "${{ github.ref_name }}" = "main" ]; then
-            GROUP="dev"
-          else
-            # Use sanitized branch name as group for feature branches
-            GROUP=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9]/-/g' | tr '[:upper:]' '[:lower:]' | cut -c1-30)
-          fi
-
-          PACKAGE_INFO=$(rpm -qpi "$RPM" 2>/dev/null)
-          PACKAGE_NAME=$(echo "$PACKAGE_INFO" | grep "^Name" | awk '{print $3}')
-          PACKAGE_VERSION=$(echo "$PACKAGE_INFO" | grep "^Version" | awk '{print $3}')
-          PACKAGE_RELEASE=$(echo "$PACKAGE_INFO" | grep "^Release" | awk '{print $3}')
-          PACKAGE_ARCH=$(echo "$PACKAGE_INFO" | grep "^Architecture" | awk '{print $2}')
-
-          # Full version includes release
-          FULL_VERSION="${PACKAGE_VERSION}-${PACKAGE_RELEASE}"
-
-          # Forgejo's RPM registry cannot overwrite existing packages, so we must delete first
-          # 404 is OK if package doesn't exist yet
-          echo "Removing any existing package: $PACKAGE_NAME-$FULL_VERSION.$PACKAGE_ARCH"
-          RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
-            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
-            "https://forgejo.ellis.link/api/packages/continuwuation/rpm/$GROUP/package/$PACKAGE_NAME/$FULL_VERSION/$PACKAGE_ARCH")
-          HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
-
-          if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
-            echo "ERROR: Failed to delete package (HTTP $HTTP_CODE)"
-            echo "$RESPONSE" | head -n -1
-            exit 1
-          fi
-
-          curl --fail-with-body \
-            -X PUT \
-            -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
-            -H "Content-Type: application/x-rpm" \
-            -T "$RPM" \
-            "https://forgejo.ellis.link/api/packages/continuwuation/rpm/$GROUP/upload?sign=true"
-
-          echo ""
-          echo "✅ Published binary RPM to: https://forgejo.ellis.link/continuwuation/-/packages/rpm/continuwuity/"
-          echo "Group: $GROUP"
-
-          # Upload debug RPMs to separate group
-          DEBUG_RPMS=$(find artifacts -name "*debuginfo*.rpm")
-          if [ -n "$DEBUG_RPMS" ]; then
-            echo ""
-            echo "Publishing debug RPMs to group: ${GROUP}-debug"
-
-            for DEBUG_RPM in $DEBUG_RPMS; do
-              echo "Publishing: $(basename "$DEBUG_RPM")"
-
-              DEBUG_INFO=$(rpm -qpi "$DEBUG_RPM" 2>/dev/null)
-              DEBUG_NAME=$(echo "$DEBUG_INFO" | grep "^Name" | awk '{print $3}')
-              DEBUG_VERSION=$(echo "$DEBUG_INFO" | grep "^Version" | awk '{print $3}')
-              DEBUG_RELEASE=$(echo "$DEBUG_INFO" | grep "^Release" | awk '{print $3}')
-              DEBUG_ARCH=$(echo "$DEBUG_INFO" | grep "^Architecture" | awk '{print $2}')
-              DEBUG_FULL_VERSION="${DEBUG_VERSION}-${DEBUG_RELEASE}"
-
-              # Must delete existing package first (Forgejo limitation)
-              RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
-                -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
-                "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-debug/package/$DEBUG_NAME/$DEBUG_FULL_VERSION/$DEBUG_ARCH")
-              HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
-
-              if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
-                echo "ERROR: Failed to delete debug package (HTTP $HTTP_CODE)"
-                echo "$RESPONSE" | head -n -1
-                exit 1
-              fi
-
-              curl --fail-with-body \
-                -X PUT \
-                -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
-                -H "Content-Type: application/x-rpm" \
-                -T "$DEBUG_RPM" \
-                "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-debug/upload?sign=true"
-            done
-
-            echo "✅ Published debug RPMs to group: ${GROUP}-debug"
-          fi
-
-          # Also upload the SRPM to separate group
-          SRPM=$(find artifacts -name "*.src.rpm" | head -1)
-          if [ -n "$SRPM" ]; then
-            echo ""
-            echo "Publishing source RPM: $(basename "$SRPM")"
-            echo "Publishing to group: ${GROUP}-src"
-
-            SRPM_INFO=$(rpm -qpi "$SRPM" 2>/dev/null)
-            SRPM_NAME=$(echo "$SRPM_INFO" | grep "^Name" | awk '{print $3}')
-            SRPM_VERSION=$(echo "$SRPM_INFO" | grep "^Version" | awk '{print $3}')
-            SRPM_RELEASE=$(echo "$SRPM_INFO" | grep "^Release" | awk '{print $3}')
-            SRPM_FULL_VERSION="${SRPM_VERSION}-${SRPM_RELEASE}"
-
-            # Must delete existing SRPM first (Forgejo limitation)
-            echo "Removing any existing SRPM: $SRPM_NAME-$SRPM_FULL_VERSION.src"
-            RESPONSE=$(curl -s -w "\n%{http_code}" -X DELETE \
-              -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
-              "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-src/package/$SRPM_NAME/$SRPM_FULL_VERSION/src")
-            HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
-
-            if [ "$HTTP_CODE" != "204" ] && [ "$HTTP_CODE" != "404" ]; then
-              echo "ERROR: Failed to delete SRPM (HTTP $HTTP_CODE)"
-              echo "$RESPONSE" | head -n -1
-              exit 1
-            fi
-
-            curl --fail-with-body \
-              -X PUT \
-              -H "Authorization: token ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" \
-              -H "Content-Type: application/x-rpm" \
-              -T "$SRPM" \
-              "https://forgejo.ellis.link/api/packages/continuwuation/rpm/${GROUP}-src/upload?sign=true"
-
-            echo "✅ Published source RPM to group: ${GROUP}-src"
-          fi

.forgejo/workflows/mirror-images.yml

@@ -55,7 +55,7 @@ jobs:
       #     repositories: continuwuity
 
       - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: https://github.com/regclient/actions/regsync-installer@39bf30ced4be9d147faaabbde2682e9725fb8bd1 # main
 
       - name: Check what images need mirroring
         run: |

.forgejo/workflows/prek-checks.yml

@@ -53,7 +53,7 @@ jobs:
           persist-credentials: false
 
       - name: Check for file changes
-        uses: https://github.com/dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
+        uses: https://github.com/dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4
         id: filter
         with:
           filters: |

.forgejo/workflows/release-image.yml

@@ -62,7 +62,7 @@ jobs:
           registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
       - name: Build and push Docker image by digest
         id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           file: "docker/Dockerfile"
@@ -149,7 +149,7 @@ jobs:
           registry_password: ${{ secrets.BUILTIN_REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}
       - name: Build and push max-perf Docker image by digest
         id: build
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           file: "docker/Dockerfile"

.forgejo/workflows/renovate.yml

@@ -43,7 +43,7 @@ jobs:
     name: Renovate
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/renovatebot/renovate:43.246.1@sha256:5965c08f8ca5baff8dc9bf3a32c44ca71fef843ad94880e9696d46e1d722b0fa
+      image: ghcr.io/renovatebot/renovate:43.252.1@sha256:121eb04ef758537019fb58f587aa53c99e5fda4e703993ce2ca01bd4b3926bd4
       options: --tmpfs /tmp:exec
     steps:
       - name: Checkout

.pre-commit-config.yaml

@@ -24,7 +24,7 @@ repos:
         - id: check-added-large-files
 
   - repo: https://github.com/crate-ci/typos
-    rev: v1.47.2
+    rev: v1.48.0
     hooks:
       - id: typos
       - id: typos
@@ -57,3 +57,15 @@ repos:
         types: [rust]
         stages:
           - pre-push
+
+  - repo: local
+    hooks:
+      - id: docs-build
+        name: docs build
+        entry: npm run docs:build
+        language: system
+        pass_filenames: false
+        files: docs/
+        types: [mdx]
+        stages:
+          - pre-commit

Cargo.toml

@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.6.0-alpha.1"
+version = "26.6.0-rc.1"
 
 [workspace.metadata.crane]
 name = "conduwuit"
@@ -141,6 +141,12 @@ features = [
 version = "0.23.25"
 default-features = false
 
+[workspace.dependencies.aws-lc-sys]
+version = "0.41.0"
+
+[workspace.dependencies.aws-lc-rs]
+version = "1.17.0"
+
 [workspace.dependencies.reqwest]
 version = "0.13.2"
 default-features = false
@@ -164,7 +170,7 @@ features = ["raw_value"]
 
 # Used for appservice registration files
 [workspace.dependencies.serde-saphyr]
-version = "0.0.28"
+version = "0.0.29"
 
 # Used to load forbidden room/user regex from config
 [workspace.dependencies.serde_regex]
@@ -344,7 +350,7 @@ version = "1.1.1"
 [workspace.dependencies.ruma]
 # version = "0.14.1"
 git = "https://github.com/ruma/ruma.git"
-rev = "3ecd80b92794d2d93f657a7b3db62d4be237526b"
+rev = "fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
 features = [
     "appservice-api-c",
     "client-api",
@@ -563,6 +569,9 @@ features = ["std"]
 [workspace.dependencies.nonzero_ext]
 version = "0.3.0"
 
+[workspace.dependencies.resolvematrix]
+version = "1.0.0"
+
 [workspace.dependencies.serde_urlencoded]
 version = "0.7.1"
 

changelog.d/+32bb7e0d.bugfix.md

@@ -0,0 +1 @@
+Improved invite and join reliability in clients using legacy sync. Contributed by @ginger

changelog.d/+3a1a284e.removal.md

@@ -0,0 +1 @@
+Removed the `/_conduwuit/` versions of the `local_user_count` and `version` routes. These routes are still accessible under the `/_continuwuity` prefix.

changelog.d/1505.refactor.md

@@ -0,0 +1 @@
+Rewrite the resolver service to use [resolvematrix](https://forgejo.ellis.link/continuwuation/resolvematrix) for server resolution. Rewrite by @s1lv3r, crate by @Jade

changelog.d/1912.doc.md

@@ -0,0 +1 @@
+Updated deployment docs to account for new RPM package availability across more distros. Contributed by @julian45.

changelog.d/1927.refactor.md

@@ -0,0 +1 @@
+Move resolver service into client service, and remove deprecated and unused code. Contributed by @s1lv3r.

docs/_meta.json

@@ -36,8 +36,8 @@
     },
     {
         "type": "dir",
-        "name": "advanced",
-        "label": "Advanced"
+        "name": "guides",
+        "label": "Guides"
     },
     "security",
     {

docs/_nav.json

@@ -1,8 +1,8 @@
 [
     {
-        "text": "Guide",
+        "text": "Documentation",
         "link": "/introduction",
-        "activeMatch": "^/(introduction|configuration|deploying|calls|appservices|maintenance|troubleshooting|advanced)"
+        "activeMatch": "^/(introduction|configuration|deploying|calls|appservices|maintenance|troubleshooting|guides)"
     },
     {
         "text": "Development",

docs/deploying/_meta.json

@@ -16,8 +16,8 @@
     },
     {
         "type": "file",
-        "name": "fedora",
-        "label": "Fedora"
+        "name": "rpm",
+        "label": "RPM"
     },
     {
         "type": "file",

docs/deploying/docker.mdx

@@ -44,7 +44,7 @@ ### Prerequisites
     - Alternatively, if you want both client and federation traffic on `:443`, you can configure `CONTINUWUITY_WELL_KNOWN` following some of the [examples](#choose-your-reverse-proxy) below.
 
 :::tip Split-domain setups
-For more setups with `.well-known` delegation and split-domain deployments, consult the [Delegation/Split-domain](../advanced/delegation) page.
+For more setups with `.well-known` delegation and split-domain deployments, consult the [Delegation/Split-domain](../guides/delegation) page.
 :::
 
 ## Docker Compose
@@ -79,7 +79,7 @@ ### Choose Your Reverse Proxy
 nameserver 1.1.1.1
 ```
 
-Consult the [**DNS tuning guide (recommended)**](../advanced/dns.mdx) for full solutions to this issue.
+Consult the [**DNS tuning guide (recommended)**](../guides/dns.mdx) for full solutions to this issue.
 :::
 
 #### Caddy (using Caddyfile)
@@ -269,7 +269,7 @@ ### Accessing the Server's Console
 
 ## Next steps
 
-- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../advanced/dns.mdx) (recommended)
+- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../guides/dns.mdx) (recommended)
 - To set up Audio/Video communication, see the [**Calls**](../calls.mdx) page.
 - Consult the [Maintenance](../maintenance.mdx) page for guidance on maintaining your homeserver.
 - If you want to set up an appservice, take a look at the [**Appservice Guide**](../appservices.mdx).

docs/deploying/fedora.mdx

@@ -1,189 +0,0 @@
-# RPM Installation Guide
-
-Continuwuity is available as RPM packages for Fedora and compatible distributions.
-We do not currently have infrastructure to build RPMs for RHEL and compatible distributions, but this is a work in progress.
-
-The RPM packaging files are maintained in the `fedora/` directory:
-- `continuwuity.spec.rpkg` - RPM spec file using rpkg macros for building from git
-- `continuwuity.service` - Systemd service file for the server
-- `RPM-GPG-KEY-continuwuity.asc` - GPG public key for verifying signed packages
-
-RPM packages built by CI are signed with our GPG key (RSA, ID: `6595 E8DB 9191 D39A 46D6 A514 4BA7 F590 DF0B AA1D`). # spellchecker:disable-line
-
-```bash
-# Import the signing key
-sudo rpm --import https://forgejo.ellis.link/api/packages/continuwuation/rpm/repository.key
-
-# Verify a downloaded package
-rpm --checksig continuwuity-*.rpm
-```
-
-## Installation methods
-
-**Stable releases** (recommended)
-
-```bash
-# Add the repository and install
-sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/stable.repo
-sudo dnf install continuwuity
-```
-
-**Development builds** from main branch
-
-```bash
-# Add the dev repository and install
-sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/dev.repo
-sudo dnf install continuwuity
-```
-
-**Feature branch builds** (example: `tom/new-feature`)
-
-```bash
-# Branch names are sanitized (slashes become hyphens, lowercase only)
-sudo dnf config-manager addrepo --from-repofile=https://forgejo.ellis.link/api/packages/continuwuation/rpm/tom-new-feature.repo
-sudo dnf install continuwuity
-```
-
-**Manual repository configuration** (alternative method)
-
-```bash
-cat << 'EOF' | sudo tee /etc/yum.repos.d/continuwuity.repo
-[continuwuity]
-name=Continuwuity - Matrix homeserver
-baseurl=https://forgejo.ellis.link/api/packages/continuwuation/rpm/stable
-enabled=1
-gpgcheck=1
-gpgkey=https://forgejo.ellis.link/api/packages/continuwuation/rpm/repository.key
-EOF
-
-sudo dnf install continuwuity
-```
-
-## Package management
-
-**Automatic updates** with DNF Automatic
-
-```bash
-# Install and configure
-sudo dnf install dnf-automatic
-sudo nano /etc/dnf/automatic.conf  # Set: apply_updates = yes
-sudo systemctl enable --now dnf-automatic.timer
-```
-
-**Manual updates**
-
-```bash
-# Check for updates
-sudo dnf check-update continuwuity
-
-# Update to latest version
-sudo dnf update continuwuity
-```
-
-**Switching channels** (stable/dev/feature branches)
-
-```bash
-# List enabled repositories
-dnf repolist | grep continuwuation
-
-# Disable current repository
-sudo dnf config-manager --set-disabled continuwuation-stable  # or -dev, or branch name
-
-# Enable desired repository
-sudo dnf config-manager --set-enabled continuwuation-dev  # or -stable, or branch name
-
-# Update to the new channel's version
-sudo dnf update continuwuity
-```
-
-**Verifying installation**
-
-```bash
-# Check installed version
-rpm -q continuwuity
-
-# View package information
-rpm -qi continuwuity
-
-# List installed files
-rpm -ql continuwuity
-
-# Verify package integrity
-rpm -V continuwuity
-```
-
-## Service management and removal
-
-**Systemd service commands**
-
-```bash
-# Start the service
-sudo systemctl start conduwuit
-
-# Enable on boot
-sudo systemctl enable conduwuit
-
-# Check status
-sudo systemctl status conduwuit
-
-# View logs
-sudo journalctl -u conduwuit -f
-```
-
-**Uninstallation**
-
-```bash
-# Stop and disable the service
-sudo systemctl stop conduwuit
-sudo systemctl disable conduwuit
-
-# Remove the package
-sudo dnf remove continuwuity
-
-# Remove the repository (optional)
-sudo rm /etc/yum.repos.d/continuwuation-*.repo
-```
-
-## Troubleshooting
-
-**GPG key errors**: Temporarily disable GPG checking
-
-```bash
-sudo dnf --nogpgcheck install continuwuity
-```
-
-**Repository metadata issues**: Clear and rebuild cache
-
-```bash
-sudo dnf clean all
-sudo dnf makecache
-```
-
-**Finding specific versions**
-
-```bash
-# List all available versions
-dnf --showduplicates list continuwuity
-
-# Install a specific version
-sudo dnf install continuwuity-<version>
-```
-
-## Building locally
-
-Build the RPM locally using rpkg:
-
-```bash
-# Install dependencies
-sudo dnf install rpkg rpm-build cargo-rpm-macros systemd-rpm-macros
-
-# Clone the repository
-git clone https://forgejo.ellis.link/continuwuation/continuwuity.git
-cd continuwuity
-
-# Build SRPM
-rpkg srpm
-
-# Build RPM
-rpmbuild --rebuild *.src.rpm
-```

docs/deploying/generic.mdx

@@ -170,7 +170,7 @@ ## Exposing ports in the firewall or the router
 are: `ufw allow 8448/tcp` and `ufw allow 443/tcp`.
 
 :::tip Alternative port/domain setups
-If you would like to use only port 443, a different port, or a subdomain for the homeserver, you will need to set up `.well-known` delegation. Consult the `[global.well_known]` section of the config file, and the [**Delegation/Split-domain**](../advanced/delegation) page to learn more about these kinds of deployments.
+If you would like to use only port 443, a different port, or a subdomain for the homeserver, you will need to set up `.well-known` delegation. Consult the `[global.well_known]` section of the config file, and the [**Delegation/Split-domain**](../guides/delegation) page to learn more about these kinds of deployments.
 :::
 
 ## Setting up the Reverse Proxy
@@ -207,7 +207,7 @@ ### Other Reverse Proxies
 
   - `/_matrix/client` - core Client-Server APIs. These should be available on port :443
 
-- `/_conduwuit/` and `/_continuwuity/` - ad-hoc Continuwuity routes for password resets, email verification, and server details such as `/local_user_count` and `/server_version`.
+- `/_continuwuity/` - Continuwuity's integrated account management interface for OAuth-compatible clients
 
 You can optionally reverse proxy the following individual routes:
 
@@ -300,7 +300,8 @@ # For client-server endpoints
 
 ## What's next?
 
-- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../advanced/dns.mdx) (recommended)
+- For smooth federation, set up a caching resolver according to the [**DNS tuning guide**](../guides/dns.mdx) (recommended)
+- To configure OIDC login with an identity provider, see the [**delegated authentication guide**](../guides/oidc.mdx).
 - For Audio/Video call functionality see the [**Calls**](../calls.md) page.
 - Consult the [Maintenance](../maintenance.mdx) page for guidance on maintaining your homeserver.
 - If you want to set up an appservice, take a look at the [**Appservice Guide**](../appservices.md).

docs/deploying/rpm.mdx

@@ -0,0 +1,165 @@
+import { Tab, Tabs} from '@rspress/core/theme';
+
+# RPM Installation Guide
+
+## Overview
+
+Continuwuity versions v0.5.10+ are available as RPM packages for the following distributions:
+
+<Tabs groupId="distro">
+<Tab label="Fedora">
+Available for upstream-supported Fedora versions (including compatible distributions, such as Ultramarine Linux) and Rawhide through Terra.
+</Tab>
+<Tab label="EL">
+Available for Enterprise Linux (RHEL, AlmaLinux, Rocky Linux, etc.) **10+** through Terra.
+
+:::warning Oracle Linux support
+Due to upstream limitations, Terra is only usable on Oracle Linux if you use [upstream EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/)
+rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, as of the time of writing, 10.2 has been
+available for over a month through other ELs, but Oracle has not yet released corresponding updates—so you may encounter further compatibility issues with EPEL.
+**For this reason, it is recommended that you use another EL distribution if at all possible.**
+:::
+
+</Tab>
+<Tab label="SUSE">
+Available for openSUSE Tumbleweed and [supported Leap versions](https://en.opensuse.org/Lifetime) through the openSUSE Build Service.
+</Tab>
+</Tabs>
+
+## Installation methods
+
+### Stable releases (recommended)
+
+<Tabs groupId="distro">
+<Tab label="Fedora">
+1. Follow [Terra's directions for adding the Terra repo on your distribution](https://docs.terrapkg.com/usage/installing/#fedora-and-derivatives).
+2. Install the `continuwuity` package.
+</Tab>
+<Tab label="EL">
+1. Follow [Terra's directions for adding the Terra repo on your distribution](https://docs.terrapkg.com/usage/installing/#enterprise-linux). Be sure to acquire/enable relevant dependencies!
+2. Install the `continuwuity` package.
+</Tab>
+<Tab label="SUSE">
+openSUSE packages are available through an openSUSE Build Service project namespace provided by a community member.
+
+1. Navigate to [this page](https://software.opensuse.org/download.html?project=home%3Ajulian45&package=continuwuity).
+2. Click on the "Add repository and install manually" text to expand install instructions.
+3. Follow the provided instructions for your version of openSUSE.
+</Tab>
+</Tabs>
+
+### Nightly releases
+Nightly versions are built from the latest commit on the `main` branch every 24 hours.
+
+<Tabs groupId="distro">
+<Tab label="Fedora">
+1. Follow [Terra's directions for adding the Terra repo on your distribution](https://docs.terrapkg.com/usage/installing/#fedora-and-derivatives).
+2. Install the `continuwuity-nightly` package.
+</Tab>
+<Tab label="EL">
+1. Follow [Terra's directions for adding the Terra repo on your distribution](https://docs.terrapkg.com/usage/installing/#enterprise-linux). Be sure to acquire/enable relevant dependencies!
+2. Install the `continuwuity-nightly` package.
+</Tab>
+<Tab label="SUSE">
+Nightly packages for openSUSE are **not currently available**.
+
+If there is an ongoing need for these, please ask in `#continuwuity:continuwuity.org` or [open an issue on Forgejo](https://forgejo.ellis.link/continuwuation/continuwuity/issues/new).
+In the meantime, you may follow the [generic deployment instructions](generic).
+</Tab>
+</Tabs>
+
+## Service management and removal
+
+**Systemd service commands**
+
+```bash
+# Start the service
+sudo systemctl start conduwuit
+
+# Enable on boot
+sudo systemctl enable conduwuit
+
+# Check status
+sudo systemctl status conduwuit
+
+# View logs
+sudo journalctl -u conduwuit -f
+```
+
+**Uninstallation**
+
+```bash
+# Stop and disable the service
+sudo systemctl stop conduwuit
+sudo systemctl disable conduwuit
+
+# Remove the package
+sudo dnf remove continuwuity # replace `dnf` with `zypper` on openSUSE
+```
+
+## Troubleshooting
+
+**GPG key errors**: Temporarily disable GPG checking
+
+```bash
+sudo dnf --nogpgcheck install continuwuity
+```
+
+**Repository metadata issues**: Clear and rebuild cache
+
+```bash
+sudo dnf clean all
+sudo dnf makecache
+```
+
+**Finding specific versions**
+
+```bash
+# List all available versions
+dnf --showduplicates list continuwuity
+
+# Install a specific version
+sudo dnf install continuwuity-<version>
+```
+
+## Building locally
+
+<Tabs groupId="distro">
+<Tab label="Fedora">
+:::details Directly from Continuwuity source
+
+Build the RPM locally using rpkg:
+```bash
+# Install dependencies
+sudo dnf install rpkg rpm-build cargo-rpm-macros systemd-rpm-macros
+
+# Clone the repository
+git clone https://forgejo.ellis.link/continuwuation/continuwuity.git
+cd continuwuity
+
+# Build SRPM
+rpkg srpm
+
+# Build RPM
+rpmbuild --rebuild *.src.rpm
+```
+:::
+
+Or, use Terra:
+1. Follow [Terra's prep directions](https://docs.terrapkg.com/contributing/getting-started/#preparation) to bootstrap your development environment.
+2. `git clone` the [Terra sources repo](https://github.com/terrapkg/packages).
+3. Follow [Terra's build instructions](https://docs.terrapkg.com/contributing/getting-started/#building), using the path `anda/misc/continuwuity/nightly/pkg`. If desiring a build of the latest stable version, replace `nightly` with `stable` instead.
+</Tab>
+<Tab label="EL">
+1. Follow [Terra's prep directions](https://docs.terrapkg.com/contributing/getting-started/#preparation) to bootstrap your development environment.
+2. `git clone` the [Terra sources repo](https://github.com/terrapkg/packages).
+3. Follow [Terra's build instructions](https://docs.terrapkg.com/contributing/getting-started/#building), using the path `anda/misc/continuwuity/nightly/pkg`. If desiring a build of the latest stable version, replace `nightly` with `stable` instead.
+</Tab>
+<Tab label="SUSE">
+1. Navigate to [this package's location in the openSUSE Build Service web UI](https://build.opensuse.org/package/show/home:julian45/continuwuity).
+2. Click on the "Checkout package" text and follow the instructions to acquire a local copy of the packaging source.
+3. In the `_service` file, adjust the revision within the `<param name="revision">` tag (approx. line 6) to your desired git repo revision.
+4. Run `osc service ra` to update your copy of the Continuwuity sources and vendored packages.
+5. Run `osc build` to locally build an openSUSE-ready RPM.
+</Tab>
+</Tabs>

docs/guides/_meta.json

@@ -13,6 +13,10 @@
         "type": "file",
         "name": "performance",
         "label": "Performance tuning"
+    },
+    {
+        "type": "file",
+        "name": "oidc",
+        "label": "Delegated authentication"
     }
-
 ]

docs/guides/delegation.mdx

@@ -124,7 +124,11 @@ ## Reverse proxying well-known files to Continuwuity
 
 ### Serving well-known files manually
 
-Instead of configuring `[global.well_known]` options and reverse proxying well-known URIs, you can serve these files directly as static JSON that match the ones above. This is useful if your base domain points to a different physical server, and reverse proxying isn't feasible.
+Instead of reverse proxying well-known URIs, you can serve these files directly as static JSON that match the ones above. This is useful if your base domain points to a different physical server, and reverse proxying isn't feasible.
+
+:::warning
+Even if you choose to serve the well-known files manually, if you are using delegation at all, you **must** still set the `global.well_known.client` configuration option to the domain you're delegating to. Continuwuity needs to know the domain it runs on for OAuth-compatible clients to work correctly.
+:::
 
 <details>
 
@@ -152,6 +156,17 @@ ### Serving well-known files manually
 
 </details>
 
+<details>
+
+<summary>Accompanying Continuwuity configuration</summary>
+
+```toml
+[global.well_known]
+client = "https://matrix.example.com/"
+```
+
+</details>
+
 Remember to set the `Access-Control-Allow-Origin: *` header in your `/.well-known/matrix/client` path for web clients to work.
 
 ## Troubleshooting

docs/guides/oidc.mdx

@@ -0,0 +1,56 @@
+# Configuring delegated authentication
+
+Continuwuity supports delegating user authentication to an external identity provider that implements the OpenID Connect specification, such as Authentik, kanidm, or Keycloak.
+
+:::warning{title="OIDC versus OAuth, and supported clients"}
+**OIDC** is not to be confused with **OAuth**. In the context of Matrix, OAuth is the protocol that Matrix clients use to authenticate with the _homeserver_. OIDC is the protocol that the _homeserver_ uses to communicate with the _identity provider_. Continuwuity supports OAuth by default, alongside the legacy **UIAA** authentication framework.
+
+When OIDC is configured, Continuwuity will disable its support for legacy authentication. **Only clients that support OAuth**, such as the Element family of clients, will be able to log in when OIDC is configured. If your client of choice shows an error when you try to log in after configuring OIDC, it likely does not support OAuth. This is an issue with your client, not Continuwuity, and should be reported to your client's developers.
+:::
+
+A simple OIDC configuration is as easy as creating a new OIDC application in your identity provider's settings and supplying Continuwuity with the client ID and client secret. This guide will use kanidm as an example, but the described steps are broadly applicable to other identity providers.
+
+First, create a new application for Continuwuity in your identity provider.
+```sh
+# Here, `c10y` is the client ID that kanidm will use, and `Continuwuity` is the display name.
+# Other identity providers may generate a client ID for you.
+# Use the domain that clients can reach Continuwuity at, which may not be the same as your server name
+# if you have configured well-known delegation.
+kanidm system oauth2 create c10y Continuwuity https://matrix.yourdomain.com
+```
+
+Configure the redirect URL that Continuwuity uses.
+```sh
+kanidm system oauth2 add-redirect-url c10y https://matrix.yourdomain.com/_continuwuity/oidc/complete
+```
+
+Allow Continuwuity to request the `openid` scope. Other identity providers may not require this step.
+```sh
+kanidm system oauth2 update-scope-map c10y idm_all_persons openid
+```
+
+Find the client secret that was generated. Other identity providers may show this information in their web UI.
+```sh
+kanidm system oauth2 show-basic-secret c10y
+d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr
+```
+
+Configure Continuwuity with the client ID, client secret, and discovery URL. kanidm has a different discovery URL for each client, but other identity providers may have a single discovery URL at the root of their domain.
+
+```toml
+[global.oauth.oidc]
+
+# `/.well-known/openid-configuration` will be appended automatically
+discovery_url = "https://idm.example.com/oauth2/openid/c10y"
+
+# This may be randomly generated by your identity provider. kanidm requires
+# you to set it manually when you create the application.
+client_id = "c10y"
+
+# From the previous step
+client_secret = "d1qgx352kkuvs1j70b6w293d65x68jve1f7b27fyk90gjhpr"
+```
+
+Finally, restart Continuwuity, and log out and back in again. Your client should prompt you to continue in your web browser and open a webpage with the Continuwuity logo that allows you to continue in your identity provider. Once you log in successfully, you will be prompted to choose a user ID -- to link your existing account, enter its user ID, and then your old password when prompted.
+
+Continuwuity offers several additional configuration options to tweak its integration with your identity provider. Review the `[global.oauth.oidc]` section towards the bottom of the [reference configuration](../reference/config) for a complete list of options and documentation.

docs/troubleshooting.mdx

@@ -60,7 +60,7 @@ ### DNS server overload
 
 Matrix federation is extremely heavy and sends wild amounts of DNS requests. This makes normal resolvers like the ones above unsuitable for its activity. Ultimately, the best solution/fix for this is to selfhost a high quality caching DNS resolver such as Unbound, and configure Continuwuity to use it.
 
-Follow the [**DNS tuning guide**](./advanced/dns) for details on setting it up.
+Follow the [**DNS tuning guide**](./guides/dns) for details on setting it up.
 
 ### Intermittent federation failures to a specific server
 

package-lock.json

@@ -16,21 +16,21 @@
       }
     },
     "node_modules/@emnapi/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-RSvbQmHzdKzNsLYa/wHrbc3KN4sYLKAdPZxqiM2HATqv/SBk2/ENSHpvXGaLOMcsAyz0poEGqkmmKYG3OWiJEQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.2.1",
+        "@emnapi/wasi-threads": "1.2.2",
         "tslib": "^2.4.0"
       }
     },
     "node_modules/@emnapi/runtime": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.10.0.tgz",
-      "integrity": "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.1.tgz",
+      "integrity": "sha512-vgj7R3y3Wgx24IQaGPA/R6YFXLHVMOZ0uVEyIQPaWs+rd1AzfEMXlAC22FYwO1XkKR6NPsq7mUandH8oIRdZFw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -39,9 +39,9 @@
       }
     },
     "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.1.tgz",
-      "integrity": "sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
+      "integrity": "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -106,14 +106,14 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.4.tgz",
-      "integrity": "sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==",
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.6.tgz",
+      "integrity": "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@tybys/wasm-util": "^0.10.1"
+        "@tybys/wasm-util": "^0.10.3"
       },
       "funding": {
         "type": "github",
@@ -125,13 +125,13 @@
       }
     },
     "node_modules/@rsbuild/core": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.15.tgz",
-      "integrity": "sha512-O8vmMhZu1YImO6jOqt/K/vlJSvkq7UtSq5YM1DIlcEd9LW8Gf6/dkQ1B2KPI6F+hSMFBnTTTumdcIowSLCw97g==",
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.1.5.tgz",
+      "integrity": "sha512-7TW4U1SH7VxQZzSTIOzvwj5lo9uNTmGpsmTXFr4axQAE4giLDKP3kVUA1ZW4P3/Mz4QQJJyvZP29mVcb8kZCfg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rspack/core": "~2.0.8",
+        "@rspack/core": "~2.1.3",
         "@swc/helpers": "^0.5.23"
       },
       "bin": {
@@ -150,17 +150,17 @@
       }
     },
     "node_modules/@rsbuild/plugin-react": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@rsbuild/plugin-react/-/plugin-react-2.0.1.tgz",
-      "integrity": "sha512-n5m3VxEm6m3Dv1VkI0WnxsildySJ6M+QjGIzkZDy5UebRCIJ1Q/hlQVyhofBL6C+AcsF9fGjlHQkeiteXJSr3Q==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@rsbuild/plugin-react/-/plugin-react-2.1.0.tgz",
+      "integrity": "sha512-RQTIAWB/CwPjoWt9iAl+8HixeQVgZ7kEIBrWPCixfITyHdiD84h0YpUTpEUuz6kGHw1KXT9mHZ3Rwy6WG7aRDA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rspack/plugin-react-refresh": "2.0.0",
+        "@rspack/plugin-react-refresh": "^2.0.2",
         "react-refresh": "^0.18.0"
       },
       "peerDependencies": {
-        "@rsbuild/core": "^2.0.0-0"
+        "@rsbuild/core": "^2.0.0"
       },
       "peerDependenciesMeta": {
         "@rsbuild/core": {
@@ -169,28 +169,30 @@
       }
     },
     "node_modules/@rspack/binding": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.8.tgz",
-      "integrity": "sha512-3uZ+y8aQxq33ty2srMxg2Nu0XuBI6vVrG50rkDaXqwWqOohfgGUSfFuQK7EnSUNy4aFUQlCG6NHialQHJov0wg==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.1.3.tgz",
+      "integrity": "sha512-4UGXJqUHmm36tWG1GgFZz3p8sQ5JuSgWI+gq1xPPoihS41uYJL3cXuJnirTeWsmVrusmYZTQhgU3tl3VYGcJYg==",
       "dev": true,
       "license": "MIT",
       "optionalDependencies": {
-        "@rspack/binding-darwin-arm64": "2.0.8",
-        "@rspack/binding-darwin-x64": "2.0.8",
-        "@rspack/binding-linux-arm64-gnu": "2.0.8",
-        "@rspack/binding-linux-arm64-musl": "2.0.8",
-        "@rspack/binding-linux-x64-gnu": "2.0.8",
-        "@rspack/binding-linux-x64-musl": "2.0.8",
-        "@rspack/binding-wasm32-wasi": "2.0.8",
-        "@rspack/binding-win32-arm64-msvc": "2.0.8",
-        "@rspack/binding-win32-ia32-msvc": "2.0.8",
-        "@rspack/binding-win32-x64-msvc": "2.0.8"
+        "@rspack/binding-darwin-arm64": "2.1.3",
+        "@rspack/binding-darwin-x64": "2.1.3",
+        "@rspack/binding-linux-arm64-gnu": "2.1.3",
+        "@rspack/binding-linux-arm64-musl": "2.1.3",
+        "@rspack/binding-linux-riscv64-gnu": "2.1.3",
+        "@rspack/binding-linux-riscv64-musl": "2.1.3",
+        "@rspack/binding-linux-x64-gnu": "2.1.3",
+        "@rspack/binding-linux-x64-musl": "2.1.3",
+        "@rspack/binding-wasm32-wasi": "2.1.3",
+        "@rspack/binding-win32-arm64-msvc": "2.1.3",
+        "@rspack/binding-win32-ia32-msvc": "2.1.3",
+        "@rspack/binding-win32-x64-msvc": "2.1.3"
       }
     },
     "node_modules/@rspack/binding-darwin-arm64": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.8.tgz",
-      "integrity": "sha512-vCgbgH7B7qom+uID+RCZsTCOYFb9wC4/4+1U6rMfytrXGVJ72eNQs2tbdjOl0lb18CT3N/n+VkWynUiLk84GwA==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.1.3.tgz",
+      "integrity": "sha512-oOGI0RSL89Ehu9T22rugmfUY9OC2eBqLMeWRYsu7bhlUrjoXeVfGBBSEXCse666BQ1sAiM8hD/k7nqVria/okQ==",
       "cpu": [
         "arm64"
       ],
@@ -202,9 +204,9 @@
       ]
     },
     "node_modules/@rspack/binding-darwin-x64": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.8.tgz",
-      "integrity": "sha512-satPm2PD4B7jDTVlVAdvMVdUszwLvWUEnUDzLb77mvVkezKNDZmuhb+e8s+FfKs8hJpNbZ9VAejuA2rr8o985w==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.1.3.tgz",
+      "integrity": "sha512-sVqWXNiFTMXAyN362y6IA+eJc8LXZKfHdhEJ/zDuMmRp+u2IvhgaF8tk3vX/OmeB9jydVjySijuiqk8No/FoCA==",
       "cpu": [
         "x64"
       ],
@@ -216,9 +218,9 @@
       ]
     },
     "node_modules/@rspack/binding-linux-arm64-gnu": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.8.tgz",
-      "integrity": "sha512-pSI+npPQE/uDtiboqvcOIRJbEV2+B+H1xffmko/gw50la92oTUW60kVULFwsb6L0+GVCzIcwX3yq60GtYIn+Ug==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.1.3.tgz",
+      "integrity": "sha512-aCy9Zli/2Qf+Ee5otXfFQ6mhv5fEyn0wIoBVmouqtJoqOO21et6UTtJ+LHLsMDolwGLyHERAljeSFSmYX3/O5A==",
       "cpu": [
         "arm64"
       ],
@@ -233,9 +235,9 @@
       ]
     },
     "node_modules/@rspack/binding-linux-arm64-musl": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.8.tgz",
-      "integrity": "sha512-igjJ43yxWQ72GZqjDDZSSHax9/Vg+6rLMmOvFglTJUkQpB4Tyvu/YjW+WRjYj2xRw6blOjLxUSJWASvuSqqlvg==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.1.3.tgz",
+      "integrity": "sha512-flIE7eluz0d21Fn28EVm3vPwoJooOSqtmjLFVSuOMcoCbwV9clfor195oIrAppp/W7dL/3XquFuVfrsa01Jy8Q==",
       "cpu": [
         "arm64"
       ],
@@ -249,10 +251,44 @@
         "linux"
       ]
     },
+    "node_modules/@rspack/binding-linux-riscv64-gnu": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-riscv64-gnu/-/binding-linux-riscv64-gnu-2.1.3.tgz",
+      "integrity": "sha512-yojg8elye1nhsNeGncw0NrZ4pMGF7NVebR80CLg72TXyzfYwFJlFTdU5yUYb1Gy+JXIvrSCwzQt2QkyiEvmkfg==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rspack/binding-linux-riscv64-musl": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-riscv64-musl/-/binding-linux-riscv64-musl-2.1.3.tgz",
+      "integrity": "sha512-6PvbXb3FOK4X3S5QGvoSW/sqExmsvAoPnQ/YSFrXvTphkXFezA7wnobmGBHT8JQP31hcFRzJHIZSIOKktzSzzg==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
     "node_modules/@rspack/binding-linux-x64-gnu": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.8.tgz",
-      "integrity": "sha512-zrkoEOnqj1hOEBO5T2I/2Ts2HSJsYFh1qXwMpK4dMJFGGNWDfNeUa6/LF5uq3VINF3JUl7RL47AgrucoSZJXPA==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.1.3.tgz",
+      "integrity": "sha512-lMXjoGKf0SnviH596fmTszgtnXLHmWOoE90G8grG9MvKVa3pelRmfps5ewZL9s8ENf3NXRfOxIhIf/M9as6MqA==",
       "cpu": [
         "x64"
       ],
@@ -267,9 +303,9 @@
       ]
     },
     "node_modules/@rspack/binding-linux-x64-musl": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.8.tgz",
-      "integrity": "sha512-6CtDaGZjNDvJd9TBp7a9zABbrPORO21W96+3ZcGBn0YNUPUk4ARxIxrTTpeJ/1F41QDM8AYIkGDdqEYMqTYBsA==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.1.3.tgz",
+      "integrity": "sha512-0esT35v7pW2ZsJTMc/zDUHwpNXlPqyUCyuiLJvrAAUcdENrgOVe4DmFrgVJ2hwqI4GjeN1VBnGRJ8c+edAHH5w==",
       "cpu": [
         "x64"
       ],
@@ -284,9 +320,9 @@
       ]
     },
     "node_modules/@rspack/binding-wasm32-wasi": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.8.tgz",
-      "integrity": "sha512-Yf4SiqTUroT5Ju+te0YAY2xxKOb35tECsO21v7hYyGa705wrgoAK/MmF7enOvs9GR1iZIqgiLD/wxsIxl8GjJw==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.1.3.tgz",
+      "integrity": "sha512-UsrDjD59UEP0mhfN/Z+uTc3vLgiUvIr+mn92WC1sbQi9gtZohTYvaQYFhWuMkBqsACGcmZp704JAbbSrVrVYCA==",
       "cpu": [
         "wasm32"
       ],
@@ -294,15 +330,15 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "1.10.0",
-        "@emnapi/runtime": "1.10.0",
-        "@napi-rs/wasm-runtime": "1.1.4"
+        "@emnapi/core": "1.11.1",
+        "@emnapi/runtime": "1.11.1",
+        "@napi-rs/wasm-runtime": "1.1.6"
       }
     },
     "node_modules/@rspack/binding-win32-arm64-msvc": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.8.tgz",
-      "integrity": "sha512-8NCuiQsAhXrwRBy57QZoypqrws/zLBkaQVGiB8hksr6v++8hNigNjqpQARLbd0iyMuHsQQ++8+auGk6xlDXmzw==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.1.3.tgz",
+      "integrity": "sha512-42RS/SwKBTkNvXIPZXqTn0yEFN8zwGRfRe/ly0GDvPp/KxpLMFWxJmLxgtoLompU+0UCGvV4KpcBENt3oWs6BA==",
       "cpu": [
         "arm64"
       ],
@@ -314,9 +350,9 @@
       ]
     },
     "node_modules/@rspack/binding-win32-ia32-msvc": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.8.tgz",
-      "integrity": "sha512-bxiekytbX7V9KFAra+HkwtNWC6pYfHEBBZFpiT0xUs3mCFOmAAFVBsBSQsoCP9AdCEXoMAvNdnrHNw3iov4OZw==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.1.3.tgz",
+      "integrity": "sha512-thk43H1JHHbetNF3txcsGXeOwZi2m6Luf/uVUqNORXjxr5VV8woHAgaAx4QXVZRg70z1VDjd8mBWnHBnKI0FGA==",
       "cpu": [
         "ia32"
       ],
@@ -328,9 +364,9 @@
       ]
     },
     "node_modules/@rspack/binding-win32-x64-msvc": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.8.tgz",
-      "integrity": "sha512-7zPs8YCe/ZVJTwd+5lpB0CP0tkn2pONf/T1ycmVY76u21Nrwt8mXQGc/2yH2eWP4B7fikYBr3hGr7mpR2fajqQ==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.1.3.tgz",
+      "integrity": "sha512-ObaUcj+BHo/aBL1weyM3orApaHyAR5Phr3YNEpQEifxjZbNKM1iO5X5prN4OqEv3H+7o5e/Wh9Fy3N7Vvd+psA==",
       "cpu": [
         "x64"
       ],
@@ -342,13 +378,13 @@
       ]
     },
     "node_modules/@rspack/core": {
-      "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.8.tgz",
-      "integrity": "sha512-+NLGJf8gZxihDmMFzjlly3toc2SMjeDmuvz0/Cai9AMdV4F+Pqcnt2BA9V4e3SY2jmhJQtPwgyyLtR1RiJO77g==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.1.3.tgz",
+      "integrity": "sha512-1iGnxLrP+iyY0ZSjLZeQTaxrISpQz4yLyqJPmaF/l4uw27/dBcrloszAeLOJQ9jiv7EJtU0T5zB+LOFPpivIxA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rspack/binding": "2.0.8"
+        "@rspack/binding": "2.1.3"
       },
       "engines": {
         "node": "^20.19.0 || >=22.12.0"
@@ -367,13 +403,13 @@
       }
     },
     "node_modules/@rspack/plugin-react-refresh": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@rspack/plugin-react-refresh/-/plugin-react-refresh-2.0.0.tgz",
-      "integrity": "sha512-Cf6CxBStNDJbiXMc/GmsvG1G8PRlUpa0MSfWsMTI+e8npzuTN/p8nwLs3shriBZOLciqgkSZpBtPTd10BLpj1g==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@rspack/plugin-react-refresh/-/plugin-react-refresh-2.0.2.tgz",
+      "integrity": "sha512-dGNZiCxQxgAUI9sah7gd8u+O7OJZRCmqtEJNDOd8xW5RqcieC86F7p5qcShyw6onH5pKf57evpr2VjGbaFGkZg==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
-        "@rspack/core": "^2.0.0-0",
+        "@rspack/core": "^2.0.0",
         "react-refresh": ">=0.10.0 <1.0.0"
       },
       "peerDependenciesMeta": {
@@ -383,17 +419,17 @@
       }
     },
     "node_modules/@rspress/core": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.15.tgz",
-      "integrity": "sha512-epLmUXYscNRw/GtQZx2oknoBE9wKbCrUGEOrQEDI4Qq8X32GdM4d7itzuHsliY7q3IbffKx8rMVbvlmygEocTQ==",
+      "version": "2.0.17",
+      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.17.tgz",
+      "integrity": "sha512-oynYHE2aBj7BFzD/UgqKnrj/PyYxfWGrmRPlTmjLL22UPcocdUdFYLb/6nijyseAST59VMr5Gj4wOfFUeJT5vw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@mdx-js/mdx": "^3.1.1",
         "@mdx-js/react": "^3.1.1",
-        "@rsbuild/core": "^2.0.15",
-        "@rsbuild/plugin-react": "~2.0.1",
-        "@rspress/shared": "2.0.15",
+        "@rsbuild/core": "^2.1.5",
+        "@rsbuild/plugin-react": "~2.1.0",
+        "@rspress/shared": "2.0.17",
         "@shikijs/rehype": "^4.2.0",
         "@types/unist": "^3.0.3",
         "@unhead/react": "^2.1.15",
@@ -412,11 +448,11 @@
         "react-lazy-with-preload": "^2.2.1",
         "react-reconciler": "0.33.0",
         "react-render-to-markdown": "19.1.0",
-        "react-router-dom": "^7.15.1",
+        "react-router-dom": "^7.18.1",
         "rehype-external-links": "^3.0.0",
         "rehype-raw": "^7.0.0",
         "remark-cjk-friendly": "^2.3.1",
-        "remark-cjk-friendly-gfm-strikethrough": "^2.1.0",
+        "remark-cjk-friendly-gfm-strikethrough": "^2.3.1",
         "remark-gfm": "^4.0.1",
         "remark-mdx": "^3.1.1",
         "remark-parse": "^11.0.0",
@@ -436,9 +472,9 @@
       }
     },
     "node_modules/@rspress/plugin-client-redirects": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.15.tgz",
-      "integrity": "sha512-bPf/KIHH7Y6huLTtK6JXwRfxM7zKjksoxm46+IBsF1wisw0doKkEKR9HwJydxWnykyKBbA2cuZOaoT4h174Z1w==",
+      "version": "2.0.17",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.17.tgz",
+      "integrity": "sha512-HJMlW5xsQe2cAFYNHw3LhMy8WcuqRb4l0ey3E3OIu121ymbSLqIQJVPS/IF/NuoyPoxCAmV58LYIaCxGEriUww==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -449,9 +485,9 @@
       }
     },
     "node_modules/@rspress/plugin-sitemap": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.15.tgz",
-      "integrity": "sha512-z1hbyGP79ZXdSGJxiWw7ZjmX8qW0q9nXMDxr14cVEg/wdj7ToVzGtZHw0wvTPE0YiKG3BMiGkVNfE1rdOaPXiQ==",
+      "version": "2.0.17",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.17.tgz",
+      "integrity": "sha512-MpNxF+hFK7zsk8t+Ta7KYI/Py6Csjyw0AMGrWf3XG/kr0+fisVxbT/jUanXRLSoj2m9VX9CVsi180rPnezUpbQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -462,13 +498,13 @@
       }
     },
     "node_modules/@rspress/shared": {
-      "version": "2.0.15",
-      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.15.tgz",
-      "integrity": "sha512-o8aYwEzNuTmWnmKe91ntPv+34u3RbtAe+rcK9XC5MANOlgncwOaCs3bUa8/B1/llwyLoNgrpi+VB9bEiU11ZRQ==",
+      "version": "2.0.17",
+      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.17.tgz",
+      "integrity": "sha512-ZzpZ4hm5svgwU0w5CpTLZy4vFD3uPo8+gXtWMOREYMzwfzJeHqwOyXwxHf6byGpx85mVK5DQqMDi61meAS7ZUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rsbuild/core": "^2.0.15",
+        "@rsbuild/core": "^2.1.5",
         "@shikijs/rehype": "^4.2.0",
         "unified": "^11.0.5"
       }
@@ -610,9 +646,9 @@
       }
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2869,9 +2905,9 @@
       }
     },
     "node_modules/react-router": {
-      "version": "7.17.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.17.0.tgz",
-      "integrity": "sha512-FDELK7rTMlCHO5+reyXsPlmfr7N1F91lPHsWYfMEGQm/KQ+F4JFM8jGoeQDmDvdTs93Fw9aSilH+uKRb4/jXvQ==",
+      "version": "7.18.1",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.1.tgz",
+      "integrity": "sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2892,13 +2928,13 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.17.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.17.0.tgz",
-      "integrity": "sha512-fyU2yjGups/hE6Xz0I5ZYbVL8Gx29eCjgpHaRaTaVU+OOAdfRX05KsvyRm0GO8YQwOkhpU3MurW1jyMUJn+zSw==",
+      "version": "7.18.1",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.1.tgz",
+      "integrity": "sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.17.0"
+        "react-router": "7.18.1"
       },
       "engines": {
         "node": ">=20.0.0"
@@ -3081,9 +3117,9 @@
       }
     },
     "node_modules/remark-cjk-friendly-gfm-strikethrough": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/remark-cjk-friendly-gfm-strikethrough/-/remark-cjk-friendly-gfm-strikethrough-2.1.0.tgz",
-      "integrity": "sha512-3Kyq2hjY7V7eU8MbVbWW6QQLN81pjJcIvKHvPxr8hZZmcq/9wqm3MJ3iUG34Ch9QTM4WHN+a1JVAVC1fSi5mig==",
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/remark-cjk-friendly-gfm-strikethrough/-/remark-cjk-friendly-gfm-strikethrough-2.3.1.tgz",
+      "integrity": "sha512-JE3TGgouk/sy92SemNMEUhO5mNP4on04cmzOV3s3R5Dbk160ewmpM4tgPiinKKvoJ5UW2fTu7FOYsjVbusSA9w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

src/admin/Cargo.toml

@@ -92,6 +92,7 @@ serde-saphyr.workspace = true
 tokio.workspace = true
 tracing-subscriber.workspace = true
 tracing.workspace = true
+resolvematrix.workspace = true
 
 [lints]
 workspace = true

src/admin/debug/commands.rs

@@ -20,6 +20,10 @@
 };
 use futures::{FutureExt, StreamExt, TryStreamExt};
 use lettre::message::Mailbox;
+use resolvematrix::{
+	resolution::ResolvedDestination,
+	server::{MatrixResolver, MatrixResolverBuilder},
+};
 use ruma::{
 	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, OwnedRoomId,
 	OwnedRoomOrAliasId, OwnedServerName, RoomId, RoomVersionId, UInt,
@@ -1007,13 +1011,26 @@ pub(super) async fn resolve_true_destination(
 			);
 		}
 
-		let actual = self
-			.services
-			.resolver
-			.resolve_actual_dest(&server_name, !no_cache)
-			.await?;
+		let resolver: &MatrixResolver = if no_cache {
+			&MatrixResolverBuilder::new()
+				.dangerous_tls_accept_invalid_certs(self.services.server.config.allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure)
+				.http_client(self.services.client.default.clone())
+				.build()?
+		} else {
+			&self.services.client.resolver
+		};
 
-		let msg = format!("Destination: {}\nHostname URI: {}", actual.dest, actual.host);
+		let actual = resolver.resolve_server(server_name.as_str()).await?;
+
+		let destination = match actual.destination {
+			| ResolvedDestination::Literal(addr) => addr.to_string(),
+			| ResolvedDestination::Named(host, port) => format!("{host}:{port}"),
+		};
+
+		let msg = format!(
+			"Destination: {}\nHostname URI (SNI): {}\nIs override?: {}\nResolution step: {}",
+			destination, actual.host, actual.is_override, actual.resolution_step
+		);
 		self.write_str(&msg).await
 	}
 

src/admin/query/resolver.rs

@@ -1,6 +1,6 @@
 use clap::Subcommand;
 use conduwuit::{Err, Result, utils::time};
-use futures::StreamExt;
+use resolvematrix::resolution::Resolution;
 use ruma::OwnedServerName;
 
 use crate::admin_command_dispatch;
@@ -10,14 +10,13 @@
 #[allow(clippy::enum_variant_names)]
 /// Resolver service and caches
 pub enum ResolverCommand {
-	/// Query the destinations cache
-	DestinationsCache {
+	/// Query the destinations or overrides cache, depending on the value of the
+	/// `overrides` flag (default false)
+	Cache {
 		server_name: Option<OwnedServerName>,
-	},
 
-	/// Query the overrides cache
-	OverridesCache {
-		name: Option<String>,
+		#[arg(short, long)]
+		overrides: Option<bool>,
 	},
 
 	/// Flush a given server from the resolver caches or flush them completely
@@ -40,49 +39,39 @@ pub enum ResolverCommand {
 }
 
 impl crate::Context<'_> {
-	async fn destinations_cache(&self, server_name: Option<OwnedServerName>) -> Result {
-		use service::resolver::cache::CachedDest;
+	async fn cache(
+		&self,
+		server_name: Option<OwnedServerName>,
+		overrides: Option<bool>,
+	) -> Result {
+		writeln!(self, "| Server Name | Destination | SNI | Override | Step | Expires |").await?;
+		writeln!(self, "| ----------- | ----------- | --- | -------- | ---- | ------- |").await?;
 
-		writeln!(self, "| Server Name | Destination | Hostname | Expires |").await?;
-		writeln!(self, "| ----------- | ----------- | -------- | ------- |").await?;
+		let entries = self.services.client.resolver.get_all_cache_entries();
 
-		let mut destinations = self.services.resolver.cache.destinations().boxed();
-
-		while let Some((name, CachedDest { dest, host, expire })) = destinations.next().await {
-			if let Some(server_name) = server_name.as_ref() {
-				if name != *server_name {
-					continue;
-				}
+		for (host, entry) in entries {
+			if let Some(ors) = overrides
+				&& entry.is_override != ors
+			{
+				continue;
 			}
 
-			let expire = time::format(expire, "%+");
-			self.write_str(&format!("| {name} | {dest} | {host} | {expire} |\n"))
-				.await?;
-		}
-
-		Ok(())
-	}
-
-	async fn overrides_cache(&self, server_name: Option<String>) -> Result {
-		use service::resolver::cache::CachedOverride;
-
-		writeln!(self, "| Server Name | IP  | Port | Expires | Overriding |").await?;
-		writeln!(self, "| ----------- | --- | ----:| ------- | ---------- |").await?;
-
-		let mut overrides = self.services.resolver.cache.overrides().boxed();
-
-		while let Some((name, CachedOverride { ips, port, expire, overriding })) =
-			overrides.next().await
-		{
-			if let Some(server_name) = server_name.as_ref() {
-				if name != *server_name {
-					continue;
-				}
+			if let Some(server_name) = server_name.as_ref()
+				&& host != *server_name
+			{
+				continue;
 			}
 
-			let expire = time::format(expire, "%+");
+			let Resolution {
+				destination,
+				is_override,
+				host: sni_host,
+				resolution_step,
+			} = entry.resolution;
+			let expires = time::format(entry.expires_at, "%Y-%m-%dT%H:%M:%S%.3f%z");
 			self.write_str(&format!(
-				"| {name} | {ips:?} | {port} | {expire} | {overriding:?} |\n"
+				"| {host} | {destination:?} | {sni_host} | {is_override:?} | {resolution_step} \
+				 | {expires} |\n"
 			))
 			.await?;
 		}
@@ -92,11 +81,14 @@ async fn overrides_cache(&self, server_name: Option<String>) -> Result {
 
 	async fn flush_cache(&self, name: Option<OwnedServerName>, all: bool) -> Result {
 		if all {
-			self.services.resolver.cache.clear().await;
-			writeln!(self, "Resolver caches cleared!").await
+			self.services.client.resolver.clear_cache();
+			self.services.client.dns.clear_cache();
+			writeln!(self, "Resolver and DNS caches cleared!").await
 		} else if let Some(name) = name {
-			self.services.resolver.cache.del_destination(&name);
-			self.services.resolver.cache.del_override(&name);
+			self.services
+				.client
+				.resolver
+				.remove_cache_entry(name.as_str());
 			self.write_str(&format!("Cleared {name} from resolver caches!"))
 				.await
 		} else {

src/admin/user/commands.rs

@@ -35,7 +35,7 @@ pub(super) async fn list_users(&self) -> Result {
 		let users: Vec<_> = self
 			.services
 			.users
-			.list_local_users()
+			.stream_local_users()
 			.map(|id| id.as_str().to_owned())
 			.collect()
 			.await;
@@ -588,7 +588,7 @@ pub(super) async fn force_join_all_local_users(
 		for user_id in &self
 			.services
 			.users
-			.list_local_users()
+			.stream_local_users()
 			.collect::<Vec<_>>()
 			.await
 		{

src/api/client/membership/leave.rs

@@ -170,9 +170,7 @@ pub async fn leave_room(
 					 locally."
 				);
 
-				// return the existing leave state, if one exists. `mark_as_left` will then
-				// update the `roomuserid_leftcount` table, making the leave come down sync
-				// again.
+				// return the existing leave state, if one exists
 				services
 					.rooms
 					.state_cache
@@ -207,6 +205,8 @@ pub async fn leave_room(
 		.update_joined_count(room_id)
 		.await;
 
+	services.sync.wake(user_id).await;
+
 	Ok(())
 }
 

src/api/client/read_marker.rs

@@ -107,6 +107,8 @@ pub(crate) async fn set_read_marker_route(
 			.private_read_set(&body.room_id, sender_user, count);
 	}
 
+	services.sync.wake(sender_user).await;
+
 	Ok(set_read_marker::v3::Response::new())
 }
 
@@ -209,5 +211,7 @@ pub(crate) async fn create_receipt_route(
 		},
 	}
 
+	services.sync.wake(sender_user).await;
+
 	Ok(create_receipt::v3::Response::new())
 }

src/api/client/room/create.rs

@@ -337,14 +337,21 @@ pub(crate) async fn create_room_route(
 	});
 
 	let mut power_levels_to_grant = BTreeMap::from_iter([(sender_user.to_owned(), int!(100))]);
+	let mut creators: Vec<OwnedUserId> = vec![sender_user.to_owned()];
 
 	if preset == RoomPreset::TrustedPrivateChat {
-		for recipient_user in &invitees {
-			power_levels_to_grant.insert(recipient_user.clone(), int!(100));
+		for recipient_user in invitees.iter().cloned() {
+			if room_version_rules
+				.authorization
+				.explicitly_privilege_room_creators
+			{
+				creators.push(recipient_user);
+			} else {
+				power_levels_to_grant.insert(recipient_user, int!(100));
+			}
 		}
 	}
 
-	let mut creators: Vec<OwnedUserId> = vec![sender_user.to_owned()];
 	// Do we care about additional_creators?
 	if room_version_rules
 		.authorization

src/api/client/sync/v3/mod.rs

@@ -201,9 +201,6 @@ pub(crate) async fn sync_events_route(
 		.update_device_last_seen(sender_user, Some(sender_device), client_ip)
 		.await;
 
-	// Setup watchers, so if there's no response, we can wait for them
-	let watcher = services.sync.watch(sender_user, sender_device);
-
 	let response = build_sync_events(&services, &body).await?;
 	if body.body.full_state
 		|| !(response.rooms.is_empty()
@@ -219,7 +216,7 @@ pub(crate) async fn sync_events_route(
 	// Stop hanging if new info arrives
 	let default = Duration::from_secs(30);
 	let duration = cmp::min(body.body.timeout.unwrap_or(default), default);
-	_ = tokio::time::timeout(duration, watcher).await;
+	_ = tokio::time::timeout(duration, services.sync.wait_for_wake(sender_user)).await;
 
 	// Retry returning data
 	build_sync_events(&services, &body).await

src/api/client/sync/v5.rs

@@ -80,9 +80,6 @@ pub(crate) async fn sync_events_v5_route(
 
 	let mut body = body.body;
 
-	// Setup watchers, so if there's no response, we can wait for them
-	let watcher = services.sync.watch(sender_user, sender_device);
-
 	let next_batch = services.globals.next_count()?;
 
 	let conn_id = body.conn_id.clone();
@@ -220,7 +217,7 @@ pub(crate) async fn sync_events_v5_route(
 		// Stop hanging if new info arrives
 		let default = Duration::from_secs(30);
 		let duration = cmp::min(body.timeout.unwrap_or(default), default);
-		_ = tokio::time::timeout(duration, watcher).await;
+		_ = tokio::time::timeout(duration, services.sync.wait_for_wake(sender_user)).await;
 	}
 
 	let typing = collect_typing_events(services, sender_user, &body, &todo_rooms).await?;

src/api/client/unversioned.rs

@@ -29,26 +29,26 @@ pub(crate) async fn get_supported_versions_route(
 	))
 }
 
-/// # `GET /_conduwuit/server_version`
+/// # `GET /_continuwuity/server_version`
 ///
 /// Conduwuit-specific API to get the server version, results akin to
 /// `/_matrix/federation/v1/version`
-pub(crate) async fn conduwuit_server_version() -> Result<impl IntoResponse> {
+pub(crate) async fn continuwuity_server_version() -> Result<impl IntoResponse> {
 	Ok(Json(serde_json::json!({
 		"name": conduwuit::BRANDING,
 		"version": conduwuit::version(),
 	})))
 }
 
-/// # `GET /_conduwuit/local_user_count`
+/// # `GET /_continuwuity/local_user_count`
 ///
 /// conduwuit-specific API to return the amount of users registered on this
 /// homeserver. Endpoint is disabled if federation is disabled for privacy. This
 /// only includes active users (not deactivated, etc)
-pub(crate) async fn conduwuit_local_user_count(
+pub(crate) async fn continuwuity_local_user_count(
 	State(services): State<crate::State>,
 ) -> Result<impl IntoResponse> {
-	let user_count = services.users.list_local_users().count().await;
+	let user_count = services.users.stream_local_users().count().await;
 
 	Ok(Json(serde_json::json!({
 		"count": user_count

src/api/router.rs

@@ -190,8 +190,7 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 		.ruma_route(&client::room_initial_sync_route)
 		.ruma_route(&client::get_authorization_server_metadata_route)
 		.merge(client::oauth::router(state))
-		.route("/_conduwuit/server_version", get(client::conduwuit_server_version))
-		.route("/_continuwuity/server_version", get(client::conduwuit_server_version))
+		.route("/_continuwuity/server_version", get(client::continuwuity_server_version))
 		.ruma_route(&admin::rooms::ban::ban_room)
 		.ruma_route(&admin::rooms::list::list_rooms);
 
@@ -229,14 +228,12 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 			.ruma_route(&server::well_known_server)
 			.ruma_route(&server::get_content_route)
 			.ruma_route(&server::get_content_thumbnail_route)
-			.route("/_conduwuit/local_user_count", get(client::conduwuit_local_user_count))
-			.route("/_continuwuity/local_user_count", get(client::conduwuit_local_user_count));
+			.route("/_continuwuity/local_user_count", get(client::continuwuity_local_user_count));
 	} else {
 		router = router
 			.route("/_matrix/federation/{*path}", any(federation_disabled))
 			.route("/.well-known/matrix/server", any(federation_disabled))
 			.route("/_matrix/key/{*path}", any(federation_disabled))
-			.route("/_conduwuit/local_user_count", any(federation_disabled))
 			.route("/_continuwuity/local_user_count", any(federation_disabled));
 	}
 

src/api/router/auth.rs

@@ -60,8 +60,9 @@ pub(crate) fn sender_device(&self) -> Option<&DeviceId> {
 
 	pub(crate) fn expect_sender_device(&self) -> Result<&DeviceId> {
 		match self {
-			| Self::User { sender_device, .. } => Ok(sender_device),
-			| Self::Appservice { .. } =>
+			| Self::User { sender_device, .. }
+			| Self::Appservice { sender_device: Some(sender_device), .. } => Ok(sender_device),
+			| Self::Appservice { sender_device: None, .. } =>
 				Err!(Request(Forbidden("Appservices must masquerade to use this endpoint."))),
 		}
 	}

src/api/server/invite.rs

@@ -203,6 +203,8 @@ pub(crate) async fn create_invite_route(
 			.update_joined_count(&body.room_id)
 			.await;
 
+		services.sync.wake(&recipient_user).await;
+
 		for appservice in services.appservice.read().await.values() {
 			if appservice.is_user_match(&recipient_user) {
 				let transaction_id = general_purpose::URL_SAFE_NO_PAD

src/api/server/send.rs

@@ -41,7 +41,7 @@
 	to_device::DeviceIdOrAllDevices,
 };
 use service::{
-	rooms::event_handler::build_local_dag,
+	rooms::event_handler::{DagBuilderTree, build_local_dag},
 	transactions::{FederationTxnState, TransactionError, TxnKey, WrappedTransactionResponse},
 };
 use tokio::sync::watch::{Receiver, Sender};
@@ -301,10 +301,12 @@ async fn handle_room(
 			.iter()
 			.map(|(event_id, obj)| (event_id.clone(), obj))
 			.collect();
-		build_local_dag(&refmap).await.unwrap_or_else(|e| {
-			debug_warn!("Failed to build local DAG for room {room_id}: {e}");
-			pdu_map.keys().cloned().collect()
-		})
+		build_local_dag(&refmap, DagBuilderTree::PrevEvents)
+			.await
+			.unwrap_or_else(|e| {
+				debug_warn!("Failed to build local DAG for room {room_id}: {e}");
+				pdu_map.keys().cloned().collect()
+			})
 	} else {
 		pdu_map.keys().cloned().collect()
 	};

src/core/Cargo.toml

@@ -118,6 +118,7 @@ url.workspace = true
 parking_lot.workspace = true
 lock_api.workspace = true
 hyper-util.workspace = true
+resolvematrix.workspace = true
 openidconnect.workspace = true
 
 [target.'cfg(unix)'.dependencies]

src/core/error/mod.rs

@@ -87,6 +87,8 @@ pub enum Error {
 	YamlDe(#[from] serde_saphyr::Error),
 	#[error(transparent)]
 	YamlSer(#[from] serde_saphyr::ser_error::Error),
+	#[error(transparent)]
+	ResolveServer(#[from] resolvematrix::error::ResolveServerError),
 
 	// ruma/conduwuit
 	#[error("Arithmetic operation failed: {0}")]
@@ -117,8 +119,6 @@ pub enum Error {
 	Mxc(#[from] ruma::MxcUriError),
 	#[error(transparent)]
 	Mxid(#[from] ruma::IdParseError),
-	#[error("from {0}: {1}")]
-	Redaction(ruma::OwnedServerName, ruma::canonical_json::RedactionError),
 	#[error("{0:?}: {1}")]
 	Request(ErrorKind, Cow<'static, str>, http::StatusCode),
 	#[error(transparent)]

src/core/matrix/state_res/event_auth.rs

@@ -1,4 +1,4 @@
-use std::{borrow::Borrow, collections::BTreeSet};
+use std::collections::BTreeSet;
 
 use futures::{
 	Future,
@@ -824,7 +824,7 @@ struct GetThirdPartyInvite {
 
 			let prev_event_is_create_event = prev_events
 				.next()
-				.is_some_and(|event_id| event_id.borrow() == create_room.event_id().borrow());
+				.is_some_and(|event_id| event_id == create_room.event_id());
 			let no_more_prev_events = prev_events.next().is_none();
 
 			if prev_event_is_create_event && no_more_prev_events {

src/core/matrix/versions.rs

@@ -33,7 +33,7 @@ pub fn unstable_features() -> BTreeMap<String, bool> {
 	BTreeMap::from_iter([
 		// query mutual rooms (https://github.com/matrix-org/matrix-spec-proposals/pull/2666)
 		// Expected for spec v1.19
-		("uk.half-shot.msc2666.query_mutual_rooms.stable".to_owned(), true),
+		("uk.half-shot.msc2666.query_mutual_rooms".to_owned(), true),
 		// Simplified Sliding sync (https://github.com/matrix-org/matrix-spec-proposals/pull/4186)
 		// Expected for spec v1.19
 		("org.matrix.simplified_msc3575".to_owned(), true),

src/service/Cargo.toml

@@ -119,6 +119,7 @@ recaptcha-verify = { version = "0.2.0", default-features = false }
 reqwest_recaptcha = { package = "reqwest", version = "0.12.28", default-features = false, features = ["rustls-tls-native-roots-no-provider"]  } # As long as recaptcha-verify's reqwest is outdated
 yansi.workspace = true
 lettre.workspace = true
+resolvematrix.workspace = true
 serde_urlencoded.workspace = true
 openidconnect.workspace = true
 

src/service/account_data/mod.rs

@@ -16,7 +16,7 @@
 };
 use serde::Deserialize;
 
-use crate::{Dep, globals};
+use crate::{Dep, globals, sync};
 
 #[derive(Debug)]
 pub enum AnyRawAccountDataEvent {
@@ -36,6 +36,7 @@ struct Data {
 
 struct Services {
 	globals: Dep<globals::Service>,
+	sync: Dep<sync::Service>,
 }
 
 impl crate::Service for Service {
@@ -43,6 +44,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		Ok(Arc::new(Self {
 			services: Services {
 				globals: args.depend::<globals::Service>("globals"),
+				sync: args.depend::<sync::Service>("sync"),
 			},
 			db: Data {
 				roomuserdataid_accountdata: args.db["roomuserdataid_accountdata"].clone(),
@@ -84,6 +86,8 @@ pub async fn update(
 			self.db.roomuserdataid_accountdata.remove(&prev);
 		}
 
+		self.services.sync.wake(user_id).await;
+
 		Ok(())
 	}
 

src/service/client/dns.rs

@@ -8,17 +8,8 @@
 };
 use reqwest::dns::{Addrs, Name, Resolve, Resolving};
 
-use super::cache::{Cache, CachedOverride};
-
 pub struct Resolver {
 	pub(crate) resolver: Arc<TokioResolver>,
-	pub(crate) hooked: Arc<Hooked>,
-	server: Arc<Server>,
-}
-
-pub(crate) struct Hooked {
-	resolver: Arc<TokioResolver>,
-	cache: Arc<Cache>,
 	server: Arc<Server>,
 }
 
@@ -26,7 +17,7 @@ pub(crate) struct Hooked {
 
 impl Resolver {
 	#[allow(clippy::as_conversions, clippy::cast_sign_loss, clippy::cast_possible_truncation)]
-	pub(super) fn build(server: &Arc<Server>, cache: Arc<Cache>) -> Result<Arc<Self>> {
+	pub(super) fn build(server: &Arc<Server>) -> Result<Arc<Self>> {
 		let config = &server.config;
 		let (sys_conf, mut opts) = hickory_resolver::system_conf::read_system_conf()
 			.map_err(|e| err!(error!("Failed to configure DNS resolver from system: {e}")))?;
@@ -78,11 +69,7 @@ pub(super) fn build(server: &Arc<Server>, cache: Arc<Cache>) -> Result<Arc<Self>
 		*builder.options_mut() = opts;
 		let resolver = Arc::new(builder.build().expect("failed to build resolver :("));
 
-		Ok(Arc::new(Self {
-			resolver: resolver.clone(),
-			hooked: Arc::new(Hooked { resolver, cache, server: server.clone() }),
-			server: server.clone(),
-		}))
+		Ok(Arc::new(Self { resolver, server: server.clone() }))
 	}
 
 	/// Clear the in-memory hickory-dns caches
@@ -96,43 +83,6 @@ fn resolve(&self, name: Name) -> Resolving {
 	}
 }
 
-impl Resolve for Hooked {
-	fn resolve(&self, name: Name) -> Resolving {
-		hooked_resolve(self.cache.clone(), self.server.clone(), self.resolver.clone(), name)
-			.boxed()
-	}
-}
-
-#[tracing::instrument(
-	level = "debug",
-	skip_all,
-	fields(name = ?name.as_str())
-)]
-async fn hooked_resolve(
-	cache: Arc<Cache>,
-	server: Arc<Server>,
-	resolver: Arc<TokioResolver>,
-	name: Name,
-) -> Result<Addrs, Box<dyn std::error::Error + Send + Sync>> {
-	match cache.get_override(name.as_str()).await {
-		| Ok(cached) if cached.valid() => cached_to_reqwest(cached).await,
-		| Ok(CachedOverride { overriding, .. }) if overriding.is_some() =>
-			resolve_to_reqwest(
-				server,
-				resolver,
-				overriding
-					.as_deref()
-					.map(str::parse)
-					.expect("overriding is set for this record")
-					.expect("overriding is a valid internet name"),
-			)
-			.boxed()
-			.await,
-
-		| _ => resolve_to_reqwest(server, resolver, name).boxed().await,
-	}
-}
-
 async fn resolve_to_reqwest(
 	server: Arc<Server>,
 	resolver: Arc<TokioResolver>,
@@ -156,12 +106,3 @@ async fn resolve_to_reqwest(
 		() = server.until_shutdown() => Err(handle_shutdown()),
 	}
 }
-
-async fn cached_to_reqwest(cached: CachedOverride) -> ResolvingResult {
-	let addrs = cached
-		.ips
-		.into_iter()
-		.map(move |ip| SocketAddr::new(ip, cached.port));
-
-	Ok(Box::new(addrs))
-}

src/service/client/mod.rs

@@ -1,17 +1,23 @@
+mod dns;
+
 use std::{sync::Arc, time::Duration};
 
+use async_trait::async_trait;
 use conduwuit::{Config, Result, err, trace};
 use either::Either;
 use ipaddress::IPAddress;
 use reqwest::redirect;
+use resolvematrix::server::{MatrixResolver, MatrixResolverBuilder};
 
-use crate::{resolver, service};
+use crate::{client::dns::Resolver, service};
 
 pub struct Service {
+	pub resolver: MatrixResolver,
+	pub dns: Arc<Resolver>,
+
 	pub default: reqwest::Client,
 	pub url_preview: reqwest::Client,
 	pub extern_media: reqwest::Client,
-	pub well_known: reqwest::Client,
 	pub federation: reqwest::Client,
 	pub federation_slow: reqwest::Client,
 	pub sender: reqwest::Client,
@@ -21,10 +27,24 @@ pub struct Service {
 	pub cidr_range_denylist: Vec<IPAddress>,
 }
 
+#[async_trait]
 impl crate::Service for Service {
 	fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		let config = &args.server.config;
-		let resolver = args.require::<resolver::Service>("resolver");
+		let dns = Resolver::build(args.server)?;
+		let resolver = MatrixResolverBuilder::new()
+			.dangerous_tls_accept_invalid_certs(args.server.config.allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure)
+			.http_client(
+				base(&args.server.config)?
+					.connect_timeout(Duration::from_secs(args.server.config.well_known_conn_timeout))
+					.read_timeout(Duration::from_secs(args.server.config.well_known_timeout))
+					.timeout(Duration::from_secs(args.server.config.well_known_timeout))
+					.pool_max_idle_per_host(0)
+					.redirect(redirect::Policy::limited(4))
+					.build()?
+			)
+			.dns_resolver(dns.resolver.clone())
+			.build()?;
 
 		let url_preview_bind_addr = config
 			.url_preview_bound_interface
@@ -42,37 +62,29 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 			.unwrap_or_else(|| conduwuit::user_agent_media().to_owned());
 
 		Ok(Arc::new(Self {
-			default: base(config)?
-				.dns_resolver(resolver.resolver.clone())
-				.build()?,
+			resolver,
+			dns: dns.clone(),
+
+			default: base(config)?.dns_resolver(dns.clone()).build()?,
 
 			url_preview: base(config)
 				.and_then(|builder| {
 					builder_interface(builder, url_preview_bind_iface.as_deref())
 				})?
 				.local_address(url_preview_bind_addr)
-				.dns_resolver(resolver.resolver.clone())
+				.dns_resolver(dns.clone())
 				.timeout(Duration::from_secs(config.url_preview_timeout))
 				.redirect(redirect::Policy::limited(3))
 				.user_agent(url_preview_user_agent)
 				.build()?,
 
 			extern_media: base(config)?
-				.dns_resolver(resolver.resolver.clone())
+				.dns_resolver(dns.clone())
 				.redirect(redirect::Policy::limited(3))
 				.build()?,
 
-			well_known: base(config)?
-				.dns_resolver(resolver.resolver.clone())
-				.connect_timeout(Duration::from_secs(config.well_known_conn_timeout))
-				.read_timeout(Duration::from_secs(config.well_known_timeout))
-				.timeout(Duration::from_secs(config.well_known_timeout))
-				.pool_max_idle_per_host(0)
-				.redirect(redirect::Policy::limited(4))
-				.build()?,
-
 			federation: base(config)?
-				.dns_resolver(resolver.resolver.hooked.clone())
+				.dns_resolver(dns.clone())
 				.connect_timeout(Duration::from_secs(config.federation_conn_timeout))
 				.read_timeout(Duration::from_secs(config.federation_timeout))
 				.timeout(Duration::from_secs(
@@ -86,7 +98,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				.build()?,
 
 			federation_slow: base(config)?
-				.dns_resolver(resolver.resolver.hooked.clone())
+				.dns_resolver(dns.clone())
 				.connect_timeout(Duration::from_secs(config.federation_conn_timeout))
 				.read_timeout(Duration::from_secs(config.federation_timeout.saturating_mul(6)))
 				.timeout(Duration::from_secs(
@@ -100,7 +112,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				.build()?,
 
 			sender: base(config)?
-				.dns_resolver(resolver.resolver.hooked.clone())
+				.dns_resolver(dns.clone())
 				.connect_timeout(Duration::from_secs(config.federation_conn_timeout))
 				.read_timeout(Duration::from_secs(config.sender_timeout))
 				.timeout(Duration::from_secs(config.sender_timeout))
@@ -110,7 +122,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				.build()?,
 
 			appservice: base(config)?
-				.dns_resolver(resolver.resolver.clone())
+				.dns_resolver(dns.clone())
 				.connect_timeout(Duration::from_secs(5))
 				.read_timeout(Duration::from_secs(config.appservice_timeout))
 				.timeout(Duration::from_secs(config.appservice_timeout))
@@ -120,7 +132,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				.build()?,
 
 			pusher: base(config)?
-				.dns_resolver(resolver.resolver.clone())
+				.dns_resolver(dns)
 				.connect_timeout(Duration::from_secs(config.pusher_conn_timeout))
 				.timeout(Duration::from_secs(config.pusher_timeout))
 				.pool_max_idle_per_host(1)
@@ -138,6 +150,11 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		}))
 	}
 
+	async fn clear_cache(&self) {
+		self.resolver.clear_cache();
+		self.dns.resolver.clear_cache();
+	}
+
 	fn name(&self) -> &str { service::make_name(std::module_path!()) }
 }
 
@@ -151,7 +168,7 @@ pub fn valid_cidr_range(&self, ip: &IPAddress) -> bool {
 	}
 }
 
-fn base(config: &Config) -> Result<reqwest::ClientBuilder> {
+pub fn base(config: &Config) -> Result<reqwest::ClientBuilder> {
 	let mut builder = reqwest::Client::builder()
 		.hickory_dns(true)
 		.connect_timeout(Duration::from_secs(config.request_conn_timeout))

src/service/federation/execute.rs

@@ -7,6 +7,7 @@
 };
 use ipaddress::IPAddress;
 use reqwest::{Client, Method, Request, Response, Url};
+use resolvematrix::resolution::Resolution;
 use ruma::{
 	ServerName,
 	api::{
@@ -18,7 +19,7 @@
 	},
 };
 
-use crate::{SUPPORTED_VERSIONS, resolver::actual::ActualDest};
+use crate::SUPPORTED_VERSIONS;
 
 impl super::Service {
 	/// Sends a signed request to a remote server over federation.
@@ -130,10 +131,15 @@ pub async fn execute_on<'i, T, PathBuilderInput>(
 			))));
 		}
 
-		let actual = self.services.resolver.get_actual_dest(dest).await?;
+		let actual = self
+			.services
+			.client
+			.resolver
+			.resolve_server(dest.as_str())
+			.await?;
 
 		let request = Request::try_from(request.try_into_http_request::<Vec<u8>>(
-			actual.string().as_str(),
+			actual.base_url().as_str(),
 			authentication,
 			PathBuilderInput::create(),
 		)?)?;
@@ -150,7 +156,7 @@ pub async fn execute_on<'i, T, PathBuilderInput>(
 	async fn perform<T>(
 		&self,
 		dest: &ServerName,
-		actual: &ActualDest,
+		actual: &Resolution,
 		request: Request,
 		client: &Client,
 	) -> Result<T::IncomingResponse>
@@ -186,7 +192,9 @@ fn validate_url(&self, url: &Url) -> Result<()> {
 		if let Some(url_host) = url.host_str() {
 			if let Ok(ip) = IPAddress::parse(url_host) {
 				trace!("Checking request URL IP {ip:?}");
-				self.services.resolver.validate_ip(&ip)?;
+				if !self.services.client.valid_cidr_range(&ip) {
+					return Err!(BadServerResponse("Not allowed to send requests to this IP"));
+				}
 			}
 		}
 
@@ -198,7 +206,7 @@ fn validate_url(&self, url: &Url) -> Result<()> {
 	async fn handle_response<T>(
 		&self,
 		dest: &ServerName,
-		actual: &ActualDest,
+		actual: &Resolution,
 		method: &Method,
 		url: &Url,
 		response: Response,
@@ -231,7 +239,7 @@ async fn handle_response<T>(
 
 async fn into_http_response(
 	dest: &ServerName,
-	actual: &ActualDest,
+	actual: &Resolution,
 	method: &Method,
 	url: &Url,
 	mut response: Response,
@@ -243,7 +251,7 @@ async fn into_http_response(
 		request_url = %url,
 		response_url = %response.url(),
 		"Received response from {}",
-		actual.string(),
+		actual.base_url(),
 	);
 
 	let mut http_response_builder = http::Response::builder()
@@ -280,7 +288,7 @@ async fn into_http_response(
 }
 
 fn handle_error(
-	actual: &ActualDest,
+	actual: &Resolution,
 	method: &Method,
 	url: &Url,
 	mut e: reqwest::Error,

src/service/federation/mod.rs

@@ -4,7 +4,7 @@
 use conduwuit::{Result, Server};
 pub(crate) use execute::FederationPathBuilderInput;
 
-use crate::{Dep, client, moderation, resolver, server_keys};
+use crate::{Dep, client, moderation, server_keys};
 
 pub struct Service {
 	services: Services,
@@ -13,7 +13,6 @@ pub struct Service {
 struct Services {
 	server: Arc<Server>,
 	client: Dep<client::Service>,
-	resolver: Dep<resolver::Service>,
 	server_keys: Dep<server_keys::Service>,
 	moderation: Dep<moderation::Service>,
 }
@@ -24,7 +23,6 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 			services: Services {
 				server: args.server.clone(),
 				client: args.depend::<client::Service>("client"),
-				resolver: args.depend::<resolver::Service>("resolver"),
 				server_keys: args.depend::<server_keys::Service>("server_keys"),
 				moderation: args.depend::<moderation::Service>("moderation"),
 			},

src/service/firstrun/mod.rs

@@ -73,7 +73,7 @@ async fn worker(self: Arc<Self>) -> Result {
 			&& self
 				.services
 				.users
-				.list_local_users()
+				.stream_local_users()
 				.ready_filter(|user| *user != self.services.globals.server_user)
 				.next()
 				.await

src/service/migrations.rs

@@ -315,7 +315,8 @@ async fn migrate(services: &Services) -> Result<()> {
 async fn db_lt_12(services: &Services) -> Result<()> {
 	for username in &services
 		.users
-		.list_local_users()
+		.stream_local_users()
+		.ready_filter(|user| services.globals.user_is_local(user))
 		.collect::<Vec<OwnedUserId>>()
 		.await
 	{
@@ -394,7 +395,8 @@ async fn db_lt_12(services: &Services) -> Result<()> {
 async fn db_lt_13(services: &Services) -> Result<()> {
 	for username in &services
 		.users
-		.list_local_users()
+		.stream_local_users()
+		.ready_filter(|user| services.globals.user_is_local(user))
 		.collect::<Vec<OwnedUserId>>()
 		.await
 	{

src/service/mod.rs

@@ -32,7 +32,6 @@
 pub mod presence;
 pub mod pusher;
 pub mod registration_tokens;
-pub mod resolver;
 pub mod rooms;
 pub mod sending;
 pub mod server_keys;

src/service/presence/mod.rs

@@ -182,7 +182,7 @@ pub async fn unset_all_presence(&self) {
 		for user_id in &self
 			.services
 			.users
-			.list_local_users()
+			.stream_local_users()
 			.collect::<Vec<OwnedUserId>>()
 			.await
 		{

src/service/resolver/actual.rs

@@ -1,398 +0,0 @@
-use std::{
-	fmt::Debug,
-	net::{IpAddr, SocketAddr},
-};
-
-use conduwuit::{Err, Result, debug, debug_info, err, error, trace};
-use futures::{FutureExt, TryFutureExt};
-use hickory_resolver::{
-	net::{DnsError, NetError},
-	proto::rr::rdata::SRV,
-};
-use ipaddress::IPAddress;
-use ruma::ServerName;
-
-use super::{
-	cache::{CachedDest, CachedOverride, MAX_IPS},
-	fed::{FedDest, PortString, add_port_to_hostname, get_ip_with_port},
-};
-
-#[derive(Clone, Debug)]
-pub(crate) struct ActualDest {
-	pub(crate) dest: FedDest,
-	pub(crate) host: String,
-}
-
-impl ActualDest {
-	#[inline]
-	pub(crate) fn string(&self) -> String { self.dest.https_string() }
-}
-
-impl super::Service {
-	#[tracing::instrument(skip_all, level = "debug", name = "resolve")]
-	pub(crate) async fn get_actual_dest(&self, server_name: &ServerName) -> Result<ActualDest> {
-		let (CachedDest { dest, host, .. }, _cached) =
-			self.lookup_actual_dest(server_name).await?;
-
-		Ok(ActualDest { dest, host })
-	}
-
-	pub(crate) async fn lookup_actual_dest(
-		&self,
-		server_name: &ServerName,
-	) -> Result<(CachedDest, bool)> {
-		if let Ok(result) = self.cache.get_destination(server_name).await {
-			return Ok((result, true));
-		}
-
-		let _dedup = self.resolving.lock(server_name.as_str());
-		if let Ok(result) = self.cache.get_destination(server_name).await {
-			return Ok((result, true));
-		}
-
-		self.resolve_actual_dest(server_name, true)
-			.inspect_ok(|result| self.cache.set_destination(server_name, result))
-			.map_ok(|result| (result, false))
-			.boxed()
-			.await
-	}
-
-	/// Returns: `actual_destination`, host header
-	/// Implemented according to the specification at <https://matrix.org/docs/spec/server_server/r0.1.4#resolving-server-names>
-	/// Numbers in comments below refer to bullet points in linked section of
-	/// specification
-	#[tracing::instrument(name = "actual", level = "debug", skip(self, cache))]
-	pub async fn resolve_actual_dest(
-		&self,
-		dest: &ServerName,
-		cache: bool,
-	) -> Result<CachedDest> {
-		self.validate_dest(dest)?;
-		let mut host = dest.as_str().to_owned();
-		let actual_dest = match get_ip_with_port(dest.as_str()) {
-			| Some(host_port) => Self::actual_dest_1(host_port)?,
-			| None =>
-				if let Some(pos) = dest.as_str().find(':') {
-					self.actual_dest_2(dest, cache, pos).await?
-				} else {
-					self.services.server.check_running()?;
-					match self.request_well_known(dest.as_str()).await? {
-						| Some(delegated) =>
-							self.actual_dest_3(&mut host, cache, delegated).await?,
-						| _ => match self.query_srv_record(dest.as_str()).await? {
-							| Some(overrider) =>
-								self.actual_dest_4(&host, cache, overrider).await?,
-							| _ => self.actual_dest_5(dest, cache).await?,
-						},
-					}
-				},
-		};
-
-		// Can't use get_ip_with_port here because we don't want to add a port
-		// to an IP address if it wasn't specified
-		let host = if let Ok(addr) = host.parse::<SocketAddr>() {
-			FedDest::Literal(addr)
-		} else if let Ok(addr) = host.parse::<IpAddr>() {
-			FedDest::Named(addr.to_string(), FedDest::default_port())
-		} else if let Some(pos) = host.find(':') {
-			let (host, port) = host.split_at(pos);
-			FedDest::Named(
-				host.to_owned(),
-				port.try_into().unwrap_or_else(|_| FedDest::default_port()),
-			)
-		} else {
-			FedDest::Named(host, FedDest::default_port())
-		};
-
-		debug!("Actual destination: {actual_dest:?} hostname: {host:?}");
-		Ok(CachedDest {
-			dest: actual_dest,
-			host: host.uri_string(),
-			expire: CachedDest::default_expire(),
-		})
-	}
-
-	fn actual_dest_1(host_port: FedDest) -> Result<FedDest> {
-		debug!("1: IP literal with provided or default port");
-		Ok(host_port)
-	}
-
-	async fn actual_dest_2(&self, dest: &ServerName, cache: bool, pos: usize) -> Result<FedDest> {
-		debug!("2: Hostname with included port");
-		let (host, port) = dest.as_str().split_at(pos);
-		self.conditional_query_and_cache(host, port.parse::<u16>().unwrap_or(8448), cache)
-			.await?;
-
-		Ok(FedDest::Named(
-			host.to_owned(),
-			port.try_into().unwrap_or_else(|_| FedDest::default_port()),
-		))
-	}
-
-	async fn actual_dest_3(
-		&self,
-		host: &mut String,
-		cache: bool,
-		delegated: String,
-	) -> Result<FedDest> {
-		debug!("3: A .well-known file is available");
-		*host = add_port_to_hostname(&delegated).uri_string();
-		match get_ip_with_port(&delegated) {
-			| Some(host_and_port) => Self::actual_dest_3_1(host_and_port),
-			| None =>
-				if let Some(pos) = delegated.find(':') {
-					self.actual_dest_3_2(cache, delegated, pos).await
-				} else {
-					trace!("Delegated hostname has no port in this branch");
-					match self.query_srv_record(&delegated).await? {
-						| Some(overrider) =>
-							self.actual_dest_3_3(cache, delegated, overrider).await,
-						| _ => self.actual_dest_3_4(cache, delegated).await,
-					}
-				},
-		}
-	}
-
-	fn actual_dest_3_1(host_and_port: FedDest) -> Result<FedDest> {
-		debug!("3.1: IP literal in .well-known file");
-		Ok(host_and_port)
-	}
-
-	async fn actual_dest_3_2(
-		&self,
-		cache: bool,
-		delegated: String,
-		pos: usize,
-	) -> Result<FedDest> {
-		debug!("3.2: Hostname with port in .well-known file");
-		let (host, port) = delegated.split_at(pos);
-		self.conditional_query_and_cache(host, port.parse::<u16>().unwrap_or(8448), cache)
-			.await?;
-
-		Ok(FedDest::Named(
-			host.to_owned(),
-			port.try_into().unwrap_or_else(|_| FedDest::default_port()),
-		))
-	}
-
-	async fn actual_dest_3_3(
-		&self,
-		cache: bool,
-		delegated: String,
-		overrider: FedDest,
-	) -> Result<FedDest> {
-		debug!("3.3: SRV lookup successful");
-		let force_port = overrider.port();
-		self.conditional_query_and_cache_override(
-			&delegated,
-			&overrider.hostname(),
-			force_port.unwrap_or(8448),
-			cache,
-		)
-		.await?;
-
-		if let Some(port) = force_port {
-			return Ok(FedDest::Named(
-				delegated,
-				format!(":{port}")
-					.as_str()
-					.try_into()
-					.unwrap_or_else(|_| FedDest::default_port()),
-			));
-		}
-
-		Ok(add_port_to_hostname(&delegated))
-	}
-
-	async fn actual_dest_3_4(&self, cache: bool, delegated: String) -> Result<FedDest> {
-		debug!("3.4: No SRV records, just use the hostname from .well-known");
-		self.conditional_query_and_cache(&delegated, 8448, cache)
-			.await?;
-		Ok(add_port_to_hostname(&delegated))
-	}
-
-	async fn actual_dest_4(
-		&self,
-		host: &str,
-		cache: bool,
-		overrider: FedDest,
-	) -> Result<FedDest> {
-		debug!("4: No .well-known; SRV record found");
-		let force_port = overrider.port();
-		self.conditional_query_and_cache_override(
-			host,
-			&overrider.hostname(),
-			force_port.unwrap_or(8448),
-			cache,
-		)
-		.await?;
-
-		if let Some(port) = force_port {
-			let port = format!(":{port}");
-
-			return Ok(FedDest::Named(
-				host.to_owned(),
-				PortString::from(port.as_str()).unwrap_or_else(|_| FedDest::default_port()),
-			));
-		}
-
-		Ok(add_port_to_hostname(host))
-	}
-
-	async fn actual_dest_5(&self, dest: &ServerName, cache: bool) -> Result<FedDest> {
-		debug!("5: No SRV record found");
-		self.conditional_query_and_cache(dest.as_str(), 8448, cache)
-			.await?;
-
-		Ok(add_port_to_hostname(dest.as_str()))
-	}
-
-	#[inline]
-	async fn conditional_query_and_cache(
-		&self,
-		hostname: &str,
-		port: u16,
-		cache: bool,
-	) -> Result {
-		self.conditional_query_and_cache_override(hostname, hostname, port, cache)
-			.await
-	}
-
-	#[inline]
-	async fn conditional_query_and_cache_override(
-		&self,
-		untername: &str,
-		hostname: &str,
-		port: u16,
-		cache: bool,
-	) -> Result {
-		if !cache {
-			return Ok(());
-		}
-
-		if self.cache.has_override(untername).await {
-			return Ok(());
-		}
-
-		self.query_and_cache_override(untername, hostname, port)
-			.await
-	}
-
-	#[tracing::instrument(name = "ip", level = "debug", skip(self))]
-	async fn query_and_cache_override(
-		&self,
-		untername: &'_ str,
-		hostname: &'_ str,
-		port: u16,
-	) -> Result {
-		self.services.server.check_running()?;
-
-		debug!("querying IP for {untername:?} ({hostname:?}:{port})");
-		match self.resolver.resolver.lookup_ip(hostname.to_owned()).await {
-			| Err(e) => Self::handle_resolve_error(&e, hostname),
-			| Ok(override_ip) => {
-				self.cache.set_override(untername, &CachedOverride {
-					ips: override_ip.iter().take(MAX_IPS).collect(),
-					port,
-					expire: CachedOverride::default_expire(),
-					overriding: (hostname != untername)
-						.then_some(hostname.into())
-						.inspect(|_| debug_info!("{untername:?} overridden by {hostname:?}")),
-				});
-
-				Ok(())
-			},
-		}
-	}
-
-	#[tracing::instrument(name = "srv", level = "debug", skip(self))]
-	async fn query_srv_record(&self, hostname: &'_ str) -> Result<Option<FedDest>> {
-		let hostnames =
-			[format!("_matrix-fed._tcp.{hostname}."), format!("_matrix._tcp.{hostname}.")];
-
-		for hostname in hostnames {
-			self.services.server.check_running()?;
-
-			debug!("querying SRV for {hostname:?}");
-			let hostname = hostname.trim_end_matches('.');
-			match self.resolver.resolver.srv_lookup(hostname).await {
-				| Err(e) => Self::handle_resolve_error(&e, hostname)?,
-				| Ok(result) => {
-					return Ok(result.answers().iter().next().map(|result| {
-						let data = result.try_borrow::<SRV>().expect("should be SRV response");
-
-						FedDest::Named(
-							data.data()
-								.target
-								.to_string()
-								.trim_end_matches('.')
-								.to_owned(),
-							format!(":{}", data.data().port)
-								.as_str()
-								.try_into()
-								.unwrap_or_else(|_| FedDest::default_port()),
-						)
-					}));
-				},
-			}
-		}
-
-		Ok(None)
-	}
-
-	fn handle_resolve_error(err: &NetError, host: &'_ str) -> Result<()> {
-		match err {
-			| NetError::NoConnections => {
-				error!(
-					"Your DNS server is overloaded and has ran out of connections. It is \
-					 strongly recommended you remediate this issue to ensure proper federation \
-					 connectivity."
-				);
-
-				Err!(error!(%host, "DNS error: {err}"))
-			},
-			| NetError::Timeout => Err!(error!(%host, "DNS query timed out")),
-			| NetError::Dns(DnsError::NoRecordsFound(..)) => {
-				// Raise to debug_warn if we can find out the result wasn't from cache
-				debug!(%host, "No DNS records found: {err}");
-				Ok(())
-			},
-			| _ => Err!(error!(%host, "DNS error: {err}")),
-		}
-	}
-
-	fn validate_dest(&self, dest: &ServerName) -> Result<()> {
-		if dest == self.services.server.name && !self.services.server.config.federation_loopback {
-			return Err!("Won't send federation request to ourselves");
-		}
-
-		if dest.is_ip_literal() || IPAddress::is_valid(dest.host()) {
-			self.validate_dest_ip_literal(dest)?;
-		}
-
-		Ok(())
-	}
-
-	fn validate_dest_ip_literal(&self, dest: &ServerName) -> Result<()> {
-		trace!("Destination is an IP literal, checking against IP range denylist.",);
-		debug_assert!(
-			dest.is_ip_literal() || !IPAddress::is_valid(dest.host()),
-			"Destination is not an IP literal."
-		);
-		let ip = IPAddress::parse(dest.host()).map_err(|e| {
-			err!(BadServerResponse(debug_error!("Failed to parse IP literal from string: {e}")))
-		})?;
-
-		self.validate_ip(&ip)?;
-
-		Ok(())
-	}
-
-	pub(crate) fn validate_ip(&self, ip: &IPAddress) -> Result<()> {
-		if !self.services.client.valid_cidr_range(ip) {
-			return Err!(BadServerResponse("Not allowed to send requests to this IP"));
-		}
-
-		Ok(())
-	}
-}

src/service/resolver/cache.rs

@@ -1,145 +0,0 @@
-use std::{net::IpAddr, sync::Arc, time::SystemTime};
-
-use conduwuit::{
-	Result,
-	arrayvec::ArrayVec,
-	at, err,
-	utils::{math::Expected, rand, stream::TryIgnore},
-};
-use database::{Cbor, Deserialized, Map};
-use futures::{Stream, StreamExt, future::join};
-use ruma::{OwnedServerName, ServerName};
-use serde::{Deserialize, Serialize};
-
-use super::fed::FedDest;
-
-pub struct Cache {
-	destinations: Arc<Map>,
-	overrides: Arc<Map>,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct CachedDest {
-	pub dest: FedDest,
-	pub host: String,
-	pub expire: SystemTime,
-}
-
-#[derive(Clone, Debug, Deserialize, Serialize)]
-pub struct CachedOverride {
-	pub ips: IpAddrs,
-	pub port: u16,
-	pub expire: SystemTime,
-	pub overriding: Option<String>,
-}
-
-pub type IpAddrs = ArrayVec<IpAddr, MAX_IPS>;
-pub(crate) const MAX_IPS: usize = 3;
-
-impl Cache {
-	pub(super) fn new(args: &crate::Args<'_>) -> Arc<Self> {
-		Arc::new(Self {
-			destinations: args.db["servername_destination"].clone(),
-			overrides: args.db["servername_override"].clone(),
-		})
-	}
-
-	pub async fn clear(&self) { join(self.clear_destinations(), self.clear_overrides()).await; }
-
-	pub async fn clear_destinations(&self) { self.destinations.clear().await; }
-
-	pub async fn clear_overrides(&self) { self.overrides.clear().await; }
-
-	pub fn del_destination(&self, name: &ServerName) { self.destinations.remove(name); }
-
-	pub fn del_override(&self, name: &ServerName) { self.overrides.remove(name); }
-
-	pub fn set_destination(&self, name: &ServerName, dest: &CachedDest) {
-		self.destinations.raw_put(name, Cbor(dest));
-	}
-
-	pub fn set_override(&self, name: &str, over: &CachedOverride) {
-		self.overrides.raw_put(name, Cbor(over));
-	}
-
-	#[must_use]
-	pub async fn has_destination(&self, destination: &ServerName) -> bool {
-		self.get_destination(destination).await.is_ok()
-	}
-
-	#[must_use]
-	pub async fn has_override(&self, destination: &str) -> bool {
-		self.get_override(destination)
-			.await
-			.iter()
-			.any(CachedOverride::valid)
-	}
-
-	pub async fn get_destination(&self, name: &ServerName) -> Result<CachedDest> {
-		self.destinations
-			.get(name)
-			.await
-			.deserialized::<Cbor<_>>()
-			.map(at!(0))
-			.into_iter()
-			.find(CachedDest::valid)
-			.ok_or(err!(Request(NotFound("Expired from cache"))))
-	}
-
-	pub async fn get_override(&self, name: &str) -> Result<CachedOverride> {
-		self.overrides
-			.get(name)
-			.await
-			.deserialized::<Cbor<_>>()
-			.map(at!(0))
-	}
-
-	pub fn destinations(&self) -> impl Stream<Item = (OwnedServerName, CachedDest)> + Send + '_ {
-		self.destinations
-			.stream()
-			.ignore_err()
-			.map(|item: (OwnedServerName, Cbor<_>)| (item.0, item.1.0))
-	}
-
-	pub fn overrides(&self) -> impl Stream<Item = (OwnedServerName, CachedOverride)> + Send + '_ {
-		self.overrides
-			.stream()
-			.ignore_err()
-			.map(|item: (OwnedServerName, Cbor<_>)| (item.0, item.1.0))
-	}
-}
-
-impl CachedDest {
-	#[inline]
-	#[must_use]
-	pub fn valid(&self) -> bool { self.expire > SystemTime::now() }
-
-	#[must_use]
-	pub(crate) fn default_expire() -> SystemTime {
-		rand::time_from_now_secs(60 * 60 * 18..60 * 60 * 36)
-	}
-
-	#[inline]
-	#[must_use]
-	pub fn size(&self) -> usize {
-		self.dest
-			.size()
-			.expected_add(self.host.len())
-			.expected_add(size_of_val(&self.expire))
-	}
-}
-
-impl CachedOverride {
-	#[inline]
-	#[must_use]
-	pub fn valid(&self) -> bool { self.expire > SystemTime::now() }
-
-	#[must_use]
-	pub(crate) fn default_expire() -> SystemTime {
-		rand::time_from_now_secs(60 * 60 * 6..60 * 60 * 12)
-	}
-
-	#[inline]
-	#[must_use]
-	pub fn size(&self) -> usize { size_of_val(self) }
-}

src/service/resolver/fed.rs

@@ -1,95 +0,0 @@
-use std::{
-	borrow::Cow,
-	fmt,
-	net::{IpAddr, SocketAddr},
-};
-
-use conduwuit::{arrayvec::ArrayString, utils::math::Expected};
-use serde::{Deserialize, Serialize};
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
-pub enum FedDest {
-	Literal(SocketAddr),
-	Named(String, PortString),
-}
-
-/// numeric or service-name
-pub type PortString = ArrayString<16>;
-
-const DEFAULT_PORT: &str = ":8448";
-
-pub(crate) fn get_ip_with_port(dest_str: &str) -> Option<FedDest> {
-	if let Ok(dest) = dest_str.parse::<SocketAddr>() {
-		Some(FedDest::Literal(dest))
-	} else if let Ok(ip_addr) = dest_str.parse::<IpAddr>() {
-		Some(FedDest::Literal(SocketAddr::new(ip_addr, 8448)))
-	} else {
-		None
-	}
-}
-
-pub(crate) fn add_port_to_hostname(dest: &str) -> FedDest {
-	let (host, port) = match dest.find(':') {
-		| None => (dest, DEFAULT_PORT),
-		| Some(pos) => dest.split_at(pos),
-	};
-
-	FedDest::Named(
-		host.to_owned(),
-		PortString::from(port).unwrap_or_else(|_| FedDest::default_port()),
-	)
-}
-
-impl FedDest {
-	pub(crate) fn https_string(&self) -> String {
-		match self {
-			| Self::Literal(addr) => format!("https://{addr}"),
-			| Self::Named(host, port) => format!("https://{host}{port}"),
-		}
-	}
-
-	pub(crate) fn uri_string(&self) -> String {
-		match self {
-			| Self::Literal(addr) => addr.to_string(),
-			| Self::Named(host, port) => format!("{host}{port}"),
-		}
-	}
-
-	#[inline]
-	pub(crate) fn hostname(&self) -> Cow<'_, str> {
-		match &self {
-			| Self::Literal(addr) => addr.ip().to_string().into(),
-			| Self::Named(host, _) => host.into(),
-		}
-	}
-
-	#[inline]
-	#[allow(clippy::string_slice)]
-	pub(crate) fn port(&self) -> Option<u16> {
-		match &self {
-			| Self::Literal(addr) => Some(addr.port()),
-			| Self::Named(_, port) => port[1..].parse().ok(),
-		}
-	}
-
-	#[inline]
-	#[must_use]
-	pub fn default_port() -> PortString {
-		PortString::from(DEFAULT_PORT).expect("default port string")
-	}
-
-	#[inline]
-	#[must_use]
-	pub fn size(&self) -> usize {
-		match self {
-			| Self::Literal(saddr) => size_of_val(saddr),
-			| Self::Named(host, port) => host.len().expected_add(port.capacity()),
-		}
-	}
-}
-
-impl fmt::Display for FedDest {
-	fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-		f.write_str(self.uri_string().as_str())
-	}
-}

src/service/resolver/mod.rs

@@ -1,54 +0,0 @@
-pub mod actual;
-pub mod cache;
-mod dns;
-pub mod fed;
-#[cfg(test)]
-mod tests;
-mod well_known;
-
-use std::sync::Arc;
-
-use async_trait::async_trait;
-use conduwuit::{Result, Server, arrayvec::ArrayString, utils::MutexMap};
-
-use self::{cache::Cache, dns::Resolver};
-use crate::{Dep, client};
-
-pub struct Service {
-	pub cache: Arc<Cache>,
-	pub resolver: Arc<Resolver>,
-	resolving: Resolving,
-	services: Services,
-}
-
-struct Services {
-	server: Arc<Server>,
-	client: Dep<client::Service>,
-}
-
-type Resolving = MutexMap<NameBuf, ()>;
-type NameBuf = ArrayString<256>;
-
-#[async_trait]
-impl crate::Service for Service {
-	#[allow(clippy::as_conversions, clippy::cast_sign_loss, clippy::cast_possible_truncation)]
-	fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
-		let cache = Cache::new(&args);
-		Ok(Arc::new(Self {
-			cache: cache.clone(),
-			resolver: Resolver::build(args.server, cache)?,
-			resolving: MutexMap::new(),
-			services: Services {
-				server: args.server.clone(),
-				client: args.depend::<client::Service>("client"),
-			},
-		}))
-	}
-
-	async fn clear_cache(&self) {
-		self.resolver.clear_cache();
-		self.cache.clear().await;
-	}
-
-	fn name(&self) -> &str { crate::service::make_name(std::module_path!()) }
-}

src/service/resolver/tests.rs

@@ -1,41 +0,0 @@
-use super::fed::{FedDest, add_port_to_hostname, get_ip_with_port};
-
-#[test]
-fn ips_get_default_ports() {
-	assert_eq!(
-		get_ip_with_port("1.1.1.1"),
-		Some(FedDest::Literal("1.1.1.1:8448".parse().unwrap()))
-	);
-	assert_eq!(
-		get_ip_with_port("dead:beef::"),
-		Some(FedDest::Literal("[dead:beef::]:8448".parse().unwrap()))
-	);
-}
-
-#[test]
-fn ips_keep_custom_ports() {
-	assert_eq!(
-		get_ip_with_port("1.1.1.1:1234"),
-		Some(FedDest::Literal("1.1.1.1:1234".parse().unwrap()))
-	);
-	assert_eq!(
-		get_ip_with_port("[dead::beef]:8933"),
-		Some(FedDest::Literal("[dead::beef]:8933".parse().unwrap()))
-	);
-}
-
-#[test]
-fn hostnames_get_default_ports() {
-	assert_eq!(
-		add_port_to_hostname("example.com"),
-		FedDest::Named(String::from("example.com"), ":8448".try_into().unwrap())
-	);
-}
-
-#[test]
-fn hostnames_keep_custom_ports() {
-	assert_eq!(
-		add_port_to_hostname("example.com:1337"),
-		FedDest::Named(String::from("example.com"), ":1337".try_into().unwrap())
-	);
-}

src/service/resolver/well_known.rs

@@ -1,50 +0,0 @@
-use conduwuit::{Result, debug, debug_error, debug_info, trace, utils::response::LimitReadExt};
-use ruma::ServerName;
-
-impl super::Service {
-	#[tracing::instrument(name = "well-known", level = "debug", skip(self, dest))]
-	pub(super) async fn request_well_known(&self, dest: &str) -> Result<Option<String>> {
-		trace!("Requesting well known for {dest}");
-		let response = self
-			.services
-			.client
-			.well_known
-			.get(format!("https://{dest}/.well-known/matrix/server"))
-			.send()
-			.await;
-
-		trace!("response: {response:?}");
-		if let Err(e) = &response {
-			debug!("error: {e:?}");
-			return Ok(None);
-		}
-
-		let response = response?;
-		if !response.status().is_success() {
-			debug!("response not 2XX");
-			return Ok(None);
-		}
-
-		let Ok(text) = response.limit_read_text(8192).await else {
-			debug!("failed to read well-known response (too large or non-text content)");
-			return Ok(None);
-		};
-		trace!("response text: {text:?}");
-
-		let body: serde_json::Value = serde_json::from_str(&text).unwrap_or_default();
-
-		let m_server = body
-			.get("m.server")
-			.unwrap_or(&serde_json::Value::Null)
-			.as_str()
-			.unwrap_or_default();
-
-		if ServerName::parse(m_server).is_err() {
-			debug_error!("response content missing or invalid");
-			return Ok(None);
-		}
-
-		debug_info!("{dest:?} found at {m_server:?}");
-		Ok(Some(m_server.to_owned()))
-	}
-}

src/service/rooms/event_handler/fetch_and_handle_outliers.rs

@@ -7,7 +7,7 @@
 #[cfg(debug_assertions)]
 use conduwuit::error;
 use conduwuit::{
-	Err, Event, PduEvent, debug, debug_error, debug_info, debug_warn, err,
+	Err, Event, PduEvent, Result, debug, debug_error, debug_info, debug_warn, err,
 	result::FlatOk,
 	state_res::lexicographical_topological_sort,
 	trace,
@@ -28,6 +28,11 @@
 
 pub const GET_MISSING_EVENTS_MAX_BATCH_SIZE: usize = 50;
 
+pub enum DagBuilderTree {
+	PrevEvents,
+	AuthEvents,
+}
+
 /// Attempts to build a localised directed acyclic graph out of the given PDUs,
 /// returning them in a topologically sorted order.
 ///
@@ -38,21 +43,24 @@
 #[allow(clippy::implicit_hasher)]
 pub async fn build_local_dag(
 	pdu_map: &HashMap<OwnedEventId, &CanonicalJsonObject>,
-) -> conduwuit::Result<Vec<OwnedEventId>> {
+	tree: DagBuilderTree,
+) -> Result<Vec<OwnedEventId>> {
 	debug_assert!(pdu_map.len() >= 2, "needless call to build_local_dag with less than 2 PDUs");
 	let mut dag: HashMap<OwnedEventId, HashSet<OwnedEventId>> =
 		HashMap::with_capacity(pdu_map.len());
 	let mut id_origin_ts: HashMap<OwnedEventId, _> = HashMap::with_capacity(pdu_map.len());
+	let tree = match tree {
+		| DagBuilderTree::AuthEvents => "auth_events",
+		| DagBuilderTree::PrevEvents => "prev_events",
+	};
 
 	for (event_id, value) in pdu_map {
 		// Parse all prev events as event IDs - if they are missing, return an error (we
 		// can't sanely continue in this case), otherwise skip invalid prev events.
 		let prev_events = value
-			.get("prev_events")
+			.get(tree)
 			.and_then(CanonicalJsonValue::as_array)
-			.ok_or_else(|| {
-				err!(Request(BadJson("event JSON for {event_id} is missing prev_events")))
-			})?
+			.ok_or_else(|| err!(Request(BadJson("event JSON for {event_id} is missing {tree}"))))?
 			.iter()
 			.map(|v| v.as_str().and_then(|s| EventId::parse(s).ok()))
 			.filter(|id| id.as_ref().is_some_and(|id| pdu_map.contains_key(id)))
@@ -123,7 +131,7 @@ pub async fn get_missing_events(
 		tail: Vec<OwnedEventId>,
 		via: &ServerName,
 		min_depth: UInt,
-	) -> conduwuit::Result<HashMap<OwnedEventId, PduEvent>> {
+	) -> Result<HashMap<OwnedEventId, PduEvent>> {
 		let start = Instant::now();
 		#[cfg(debug_assertions)]
 		{
@@ -355,7 +363,7 @@ async fn fetch_event_via(
 		remote: OwnedServerName,
 		event_id: OwnedEventId,
 		room_version_rules: &RoomVersionRules,
-	) -> conduwuit::Result<(OwnedEventId, CanonicalJsonObject)> {
+	) -> Result<(OwnedEventId, CanonicalJsonObject)> {
 		let res = self
 			.services
 			.sending
@@ -382,7 +390,7 @@ async fn fetch_event_vias(
 		candidates: impl Iterator<Item = &OwnedServerName>,
 		event_id: &EventId,
 		room_version_rules: &RoomVersionRules,
-	) -> conduwuit::Result<(OwnedEventId, CanonicalJsonObject)> {
+	) -> Result<(OwnedEventId, CanonicalJsonObject)> {
 		if let Ok(pdu_json) = self.services.timeline.get_pdu_json(event_id).await {
 			return Ok((event_id.to_owned(), pdu_json));
 		}
@@ -534,7 +542,7 @@ pub(super) async fn fetch_and_handle_auth_events<Pdu>(
 			.iter()
 			.map(|(id, data)| (id.clone(), data))
 			.collect();
-		let seeded_ordered = build_local_dag(&refmap)
+		let seeded_ordered = build_local_dag(&refmap, DagBuilderTree::AuthEvents)
 			.await
 			.expect("failed to build local DAG");
 		let mut pdus = HashMap::with_capacity(seeded_ordered.len());

src/service/rooms/event_handler/fetch_auth.rs

@@ -0,0 +1,176 @@
+use std::collections::{HashMap, hash_map};
+
+use conduwuit::{Err, Event, EventTypeExt, PduEvent, Result, err};
+use ruma::{
+	CanonicalJsonObject, OwnedEventId, ServerName,
+	api::federation::authorization::get_event_authorization,
+	room_version_rules::RoomVersionRules,
+};
+use tokio::join;
+
+use crate::rooms::event_handler::{build_local_dag, fetch_and_handle_outliers::DagBuilderTree};
+
+impl super::Service {
+	/// Fetches (and persists) the incoming event's entire auth chain by asking
+	/// the remote server for it. The events are added to the outlier tree, but
+	/// no de-outliering is attempted.
+	///
+	/// Returns a map of auth events, which includes potentially unauthorised
+	/// ones - it is the caller's responsibility to check rejection status of
+	/// each required event post factum.
+	#[tracing::instrument(skip_all)]
+	pub(super) async fn fetch_and_persist_event_auth<Pdu>(
+		&self,
+		incoming_event: &PduEvent,
+		origin: &ServerName,
+		room_version_rules: &RoomVersionRules,
+		create_event: &Pdu,
+	) -> Result<HashMap<OwnedEventId, PduEvent>>
+	where
+		Pdu: Event + Send + Sync,
+	{
+		let event_auth: get_event_authorization::v1::Response = self
+			.services
+			.sending
+			.send_federation_request(
+				origin,
+				get_event_authorization::v1::Request::new(
+					incoming_event.room_id_or_hash().clone(),
+					incoming_event.event_id().to_owned(),
+				),
+			)
+			.await
+			.map_err(|e| {
+				err!(Request(Forbidden(
+					"Remote server is not divulging incoming event's auth chain: {e}"
+				)))
+			})?;
+
+		let mut auth_chain_map = HashMap::with_capacity(event_auth.auth_chain.len());
+
+		for auth_pdu_json in event_auth.auth_chain {
+			let (auth_event_room_id, auth_event_id, auth_pdu_json) =
+				self.parse_incoming_pdu(&auth_pdu_json).await?;
+			if auth_event_room_id != incoming_event.room_id_or_hash() {
+				return Err!(Request(Forbidden(
+					"Auth event {auth_event_id} is in {auth_event_room_id}, not {}.",
+					incoming_event.room_id_or_hash()
+				)));
+			}
+			let auth_pdu = PduEvent::from_id_val(&auth_event_id, auth_pdu_json).map_err(|e| {
+				err!(Request(BadJson("Invalid PDU {auth_event_id} in auth chain: {e}")))
+			})?;
+			if auth_pdu.state_key().is_none() {
+				return Err!(Request(BadJson(
+					"Invalid PDU {auth_event_id} in auth_chain: not a state event"
+				)));
+			}
+
+			auth_chain_map.insert(auth_event_id, auth_pdu);
+		}
+
+		// We need to authorise each returned PDU to make sure that the caller can
+		// correctly detect if one of them is rejected. We don't remove the event from
+		// the map in case the caller incorrectly then identifies that event as missing,
+		// rather than rejected.
+		self.authorise_remote_auth_chain(
+			&auth_chain_map,
+			room_version_rules,
+			create_event.as_pdu(),
+		)
+		.await?;
+
+		Ok(auth_chain_map)
+	}
+
+	/// Runs through the returned auth chain topologically and flags any events
+	/// that fail PDU check 4.
+	///
+	/// An empty `Ok` is returned unless the auth chain is missing required
+	/// events (which means the remote server returned an invalid response).
+	async fn authorise_remote_auth_chain<Pdu>(
+		&self,
+		auth_chain_map: &HashMap<OwnedEventId, PduEvent>,
+		room_version_rules: &RoomVersionRules,
+		create_event: &Pdu,
+	) -> Result<()>
+	where
+		Pdu: Event + Send + Sync,
+	{
+		// TODO(nex): build_local_dag's signature needs changing because all callsites
+		// seem to do this refmap hack.
+		let pdu_objects = auth_chain_map
+			.iter()
+			.map(|(event_id, pdu)| (event_id, pdu.to_canonical_object()))
+			.collect::<HashMap<_, _>>();
+		let refmap: HashMap<OwnedEventId, &CanonicalJsonObject> = pdu_objects
+			.iter()
+			.map(|(id, data)| ((*id).to_owned(), data))
+			.collect();
+		let auth_chain_topo = build_local_dag(&refmap, DagBuilderTree::AuthEvents)
+			.await?
+			.into_iter()
+			.map(|event_id| (event_id.clone(), auth_chain_map.get(&event_id).unwrap().to_owned()))
+			.collect::<HashMap<_, _>>();
+
+		'outer: for (event_id, pdu) in auth_chain_topo {
+			// If we know the event is rejected OR have it locally, we can skip this check.
+			// This is safe because if we know the event is rejected, running event auth
+			// will just reject it again. And, if we have it locally, and HAVEN'T flagged it
+			// as rejected, then we know it was at least accepted under the check we would
+			// otherwise be about to perform, previously.
+			let (is_rejected, have_locally) = join!(
+				self.services.pdu_metadata.is_event_rejected(&event_id),
+				self.services.timeline.pdu_exists(&event_id)
+			);
+			if is_rejected || have_locally {
+				continue;
+			}
+
+			let mut auth_events_by_key: HashMap<_, _> =
+				HashMap::with_capacity(pdu.auth_events.len());
+
+			for auth_event_id in pdu.auth_events() {
+				let Some(auth_event) = auth_chain_map.get(auth_event_id) else {
+					return Err!(Request(NotFound(
+						"Invalid event_auth response from remote server: {event_id} depends on \
+						 {auth_event_id}, but it is not present"
+					)));
+				};
+
+				self.services
+					.outlier
+					.add_pdu_outlier(auth_event_id, &auth_event.to_canonical_object());
+				let key = auth_event
+					.kind()
+					.with_state_key(auth_event.state_key().unwrap());
+				match auth_events_by_key.entry(key) {
+					| hash_map::Entry::Vacant(v) => {
+						v.insert(auth_event.clone());
+					},
+					| hash_map::Entry::Occupied(_) => {
+						// Duplicate auth events by key are not allowed.
+						self.services
+							.pdu_metadata
+							.mark_event_rejected(auth_event_id);
+						self.services.pdu_metadata.mark_event_rejected(&event_id);
+						continue 'outer;
+					},
+				}
+			}
+			if !self
+				.is_event_self_authorised(
+					&pdu,
+					room_version_rules,
+					create_event.as_pdu(),
+					&auth_events_by_key,
+				)
+				.await
+			{
+				self.services.pdu_metadata.mark_event_rejected(&event_id);
+			}
+		}
+
+		Ok(())
+	}
+}

src/service/rooms/event_handler/fetch_prev.rs

@@ -7,7 +7,7 @@
 use futures::StreamExt;
 use ruma::{CanonicalJsonObject, MilliSecondsSinceUnixEpoch, OwnedEventId, RoomId, ServerName};
 
-use crate::rooms::event_handler::build_local_dag;
+use crate::rooms::event_handler::{build_local_dag, fetch_and_handle_outliers::DagBuilderTree};
 
 impl super::Service {
 	/// Fetches any missing prev_events for this event and persists them before
@@ -89,7 +89,7 @@ pub(super) async fn fetch_prevs(
 		} else {
 			let refmap: HashMap<OwnedEventId, &CanonicalJsonObject> =
 				mapped.iter().map(|(id, data)| (id.clone(), data)).collect();
-			build_local_dag(&refmap).await?
+			build_local_dag(&refmap, DagBuilderTree::PrevEvents).await?
 		};
 
 		let job_start = Instant::now();

src/service/rooms/event_handler/handle_incoming_pdu.rs

@@ -194,10 +194,14 @@ pub async fn handle_incoming_pdu<'a>(
 						"Invite to {room_id} appears to have been rescinded by {sender}, \
 						 marking as left"
 					);
+
 					self.services
 						.state_cache
 						.mark_as_left(&sender, room_id, Some(pdu))
 						.await;
+
+					self.services.sync.wake(&sender).await;
+
 					return Ok(None);
 				}
 			}

src/service/rooms/event_handler/handle_outlier_pdu.rs

@@ -1,14 +1,13 @@
 use std::collections::{BTreeMap, HashMap, hash_map};
 
 use conduwuit::{
-	Err, Event, PduEvent, Result, debug, debug_info, debug_warn, err, info, state_res, trace,
-	warn,
+	Err, Event, EventTypeExt, PduEvent, Result, debug, debug_info, debug_warn, err, info,
+	matrix::StateKey, state_res::auth_check, trace, warn,
 };
 use futures::future::ready;
 use ruma::{
 	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, RoomId, ServerName,
-	api::federation::authorization::get_event_authorization, canonical_json::redact,
-	events::StateEventType,
+	canonical_json::redact, events::StateEventType, room_version_rules::RoomVersionRules,
 };
 
 use super::{check_room_id, get_room_version_rules};
@@ -100,10 +99,62 @@ pub(super) async fn handle_outlier_pdu<'a, Pdu>(
 
 		check_room_id(room_id, &pdu_event)?;
 
+		// TODO(nex): From hereon the event is not dropped, and thus always added as an
+		// outlier. However, we only do that at the end of this function, which means
+		// several duplicated calls to add_pdu_outlier. Shouldn't we just do it here
+		// instead, since we know it's going to be persisted as an outlier no matter
+		// what? the rest of this function is basically just to check PDU check 4.
+
+		// NOTE^: Technically, persisting the event before knowing if it's rejected
+		// introduces a race condition in fetch_and_persist_event_auth, where we have
+		// the event locally, but haven't yet flagged it as rejected, which the
+		// fetcher perceives as "accepted". I'm not sure if that's practically possible
+		// though.
+
 		// Fetch all auth events
 		let mut auth_events: HashMap<OwnedEventId, PduEvent> = HashMap::new();
 
 		for auth_event_id in pdu_event.auth_events() {
+			if let Ok(auth_event) = self.services.timeline.get_pdu(auth_event_id).await {
+				check_room_id(room_id, &auth_event)?;
+				trace!("Found auth event {auth_event_id} for outlier event {event_id} locally");
+				auth_events.insert(auth_event_id.to_owned(), auth_event);
+			} else {
+				debug_warn!(
+					"Could not find auth event {auth_event_id} for outlier event {event_id} \
+					 locally"
+				);
+			}
+		}
+
+		// Fetch any missing ones & reject invalid ones
+		if auth_events.len() != pdu_event.auth_events().count() {
+			info!("Missing some auth events, asking remote for auth chain");
+			let auth_chain_map = self
+				.fetch_and_persist_event_auth(
+					&pdu_event,
+					origin,
+					&room_version_rules,
+					create_event,
+				)
+				.await?;
+			for auth_event_id in pdu_event.auth_events() {
+				if auth_events.contains_key(auth_event_id) {
+					continue;
+				}
+				if let Some(auth_event) = auth_chain_map.get(auth_event_id) {
+					auth_events.insert(auth_event_id.to_owned(), auth_event.clone());
+				} else {
+					return Err!(Request(Forbidden(
+						"Remote server is not divulging incoming event's auth events (missing: \
+						 {auth_event_id})"
+					)));
+				}
+			}
+		}
+
+		// Ensure none of the auth events are rejected - if they are, reject too.
+		for auth_event_id in auth_events.keys() {
 			if self
 				.services
 				.pdu_metadata
@@ -120,64 +171,6 @@ pub(super) async fn handle_outlier_pdu<'a, Pdu>(
 					"Event has rejected auth event: {auth_event_id}"
 				)));
 			}
-
-			if let Ok(auth_event) = self.services.timeline.get_pdu(auth_event_id).await {
-				check_room_id(room_id, &auth_event)?;
-				trace!("Found auth event {auth_event_id} for outlier event {event_id} locally");
-				auth_events.insert(auth_event_id.to_owned(), auth_event);
-			} else {
-				debug_warn!(
-					"Could not find auth event {auth_event_id} for outlier event {event_id} \
-					 locally"
-				);
-			}
-		}
-
-		// Fetch any missing ones & reject invalid ones
-		if auth_events.len() != pdu_event.auth_events().count() {
-			info!("Missing some auth events, asking remote for auth chain");
-			let response: get_event_authorization::v1::Response = self
-				.services
-				.sending
-				.send_federation_request(
-					origin,
-					get_event_authorization::v1::Request::new(
-						room_id.to_owned(),
-						event_id.to_owned(),
-					),
-				)
-				.await
-				.map_err(|e| {
-					err!(Request(Forbidden(
-						"Remote server is not divulging incoming event's auth chain: {e}"
-					)))
-				})?;
-			let mut auth_chain_map = HashMap::with_capacity(response.auth_chain.len());
-			for auth_pdu_json in response.auth_chain {
-				let (auth_event_room_id, auth_event_id, auth_pdu_json) =
-					self.parse_incoming_pdu(&auth_pdu_json).await?;
-				if auth_event_room_id != room_id {
-					return Err!(Request(Forbidden(
-						"Auth event {auth_event_id} is in {auth_event_room_id}, not {room_id}."
-					)));
-				}
-				let auth_pdu = PduEvent::from_id_val(&auth_event_id, auth_pdu_json)
-					.map_err(|e| err!(Request(BadJson("Invalid PDU {auth_event_id}: {e}"))))?;
-				auth_chain_map.insert(auth_event_id, auth_pdu);
-			}
-			for auth_event_id in pdu_event.auth_events() {
-				if auth_events.contains_key(auth_event_id) {
-					continue;
-				}
-				if let Some(auth_event) = auth_chain_map.get(auth_event_id) {
-					auth_events.insert(auth_event_id.to_owned(), auth_event.clone());
-				} else {
-					return Err!(Request(Forbidden(
-						"Remote server is not divulging incoming event's auth events (missing: \
-						 {auth_event_id})"
-					)));
-				}
-			}
 		}
 
 		// 6. Reject "due to auth events" if the event doesn't pass auth based on the
@@ -193,13 +186,13 @@ pub(super) async fn handle_outlier_pdu<'a, Pdu>(
 
 			check_room_id(room_id, &auth_event)?;
 
-			match auth_events_by_key.entry((
-				auth_event.kind.to_string().into(),
+			let key = auth_event.kind().with_state_key(
 				auth_event
 					.state_key
 					.clone()
-					.expect("all auth events have state keys"),
-			)) {
+					.expect("all auth events must have state keys"),
+			);
+			match auth_events_by_key.entry(key) {
 				| hash_map::Entry::Vacant(v) => {
 					v.insert(auth_event);
 				},
@@ -218,23 +211,15 @@ pub(super) async fn handle_outlier_pdu<'a, Pdu>(
 			}
 		}
 
-		let state_fetch = |ty: &StateEventType, sk: &str| {
-			let key = (ty.to_owned(), sk.into());
-			ready(auth_events_by_key.get(&key).map(ToOwned::to_owned))
-		};
-
-		// PDU check: 3
-		let auth_check = state_res::event_auth::auth_check(
-			&room_version_rules,
-			&pdu_event,
-			None, // TODO: third party invite
-			state_fetch,
-			create_event.as_pdu(),
-		)
-		.await
-		.map_err(|e| err!(Request(Forbidden("Auth check failed: {e:?}"))))?;
-
-		if !auth_check {
+		if !self
+			.is_event_self_authorised(
+				&pdu_event,
+				&room_version_rules,
+				create_event.as_pdu(),
+				&auth_events_by_key,
+			)
+			.await
+		{
 			self.services.pdu_metadata.mark_event_rejected(event_id);
 			self.services
 				.outlier
@@ -255,4 +240,55 @@ pub(super) async fn handle_outlier_pdu<'a, Pdu>(
 
 		Ok((pdu_event, incoming_pdu))
 	}
+
+	/// Helper method that turns the return value of `is_event_self_authorised`
+	/// into a `Result` depending on the value.
+	///
+	/// If the event is not authorised, a Forbidden error is returned.
+	/// Otherwise, an empty `Ok`.
+	pub(super) async fn is_event_self_authorised(
+		&self,
+		pdu: &PduEvent,
+		room_version_rules: &RoomVersionRules,
+		create_event: &PduEvent,
+		auth_events_by_key: &HashMap<(StateEventType, StateKey), PduEvent>,
+	) -> bool {
+		self.expect_event_is_self_authorised(
+			pdu,
+			room_version_rules,
+			create_event,
+			auth_events_by_key,
+		)
+		.await
+		.is_ok()
+	}
+
+	/// Checks PDU check 4: Passes authorisation rules based on the event's auth
+	/// events ([spec]).
+	///
+	/// If the auth check fails, false is returned, otherwise true.
+	///
+	/// [spec]: https://spec.matrix.org/v1.19/server-server-api/#checks-performed-on-receipt-of-a-pdu
+	pub(super) async fn expect_event_is_self_authorised(
+		&self,
+		pdu: &PduEvent,
+		room_version_rules: &RoomVersionRules,
+		create_event: &PduEvent,
+		auth_events_by_key: &HashMap<(StateEventType, StateKey), PduEvent>,
+	) -> Result<bool> {
+		let state_fetch = |ty: &StateEventType, sk: &str| {
+			let key = (ty.to_owned(), sk.into());
+			ready(auth_events_by_key.get(&key).map(ToOwned::to_owned))
+		};
+
+		auth_check(
+			room_version_rules,
+			pdu,
+			None, // TODO: third party invite
+			state_fetch,
+			create_event,
+		)
+		.await
+		.map_err(|e| err!("Event self-authentication failed: {e:?}"))
+	}
 }

src/service/rooms/event_handler/mod.rs

@@ -1,5 +1,6 @@
 mod acl_check;
 mod fetch_and_handle_outliers;
+mod fetch_auth;
 mod fetch_prev;
 mod fetch_state;
 mod handle_incoming_pdu;
@@ -14,14 +15,16 @@
 
 use async_trait::async_trait;
 use conduwuit::{Err, Event, PduEvent, Result, Server, SyncRwLock, utils::MutexMap};
-pub use fetch_and_handle_outliers::{GET_MISSING_EVENTS_MAX_BATCH_SIZE, build_local_dag};
+pub use fetch_and_handle_outliers::{
+	DagBuilderTree, GET_MISSING_EVENTS_MAX_BATCH_SIZE, build_local_dag,
+};
 use ruma::{
 	OwnedEventId, OwnedRoomId, RoomId, events::room::create::RoomCreateEventContent,
 	room_version_rules::RoomVersionRules,
 };
 use tokio::sync::{Notify, mpsc};
 
-use crate::{Dep, globals, rooms, sending, server_keys};
+use crate::{Dep, globals, rooms, sending, server_keys, sync};
 pub struct Service {
 	pub mutex_federation: RoomMutexMap,
 	pub federation_handletime: SyncRwLock<HandleTimeMap>,
@@ -44,6 +47,7 @@ struct Services {
 	state_cache: Dep<rooms::state_cache::Service>,
 	state_accessor: Dep<rooms::state_accessor::Service>,
 	state_compressor: Dep<rooms::state_compressor::Service>,
+	sync: Dep<sync::Service>,
 	timeline: Dep<rooms::timeline::Service>,
 	server: Arc<Server>,
 }
@@ -74,6 +78,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 					.depend::<rooms::state_accessor::Service>("rooms::state_accessor"),
 				state_compressor: args
 					.depend::<rooms::state_compressor::Service>("rooms::state_compressor"),
+				sync: args.depend::<sync::Service>("sync"),
 				timeline: args.depend::<rooms::timeline::Service>("rooms::timeline"),
 				server: args.server.clone(),
 			},

src/service/rooms/membership/mod.rs

@@ -40,7 +40,7 @@
 		state_compressor::{self, CompressedState, HashSetCompressStateEvent},
 		timeline::{self, pdu_fits},
 	},
-	sending, server_keys, users,
+	sending, server_keys, sync, users,
 };
 
 pub struct Service {
@@ -63,6 +63,7 @@ struct Services {
 	state_accessor: Dep<state_accessor::Service>,
 	state_cache: Dep<state_cache::Service>,
 	state_compressor: Dep<state_compressor::Service>,
+	sync: Dep<sync::Service>,
 	timeline: Dep<timeline::Service>,
 	users: Dep<users::Service>,
 }
@@ -87,6 +88,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				state_cache: args.depend::<state_cache::Service>("rooms::state_cache"),
 				state_compressor: args
 					.depend::<state_compressor::Service>("rooms::state_compressor"),
+				sync: args.depend::<sync::Service>("sync"),
 				timeline: args.depend::<timeline::Service>("rooms::timeline"),
 				users: args.depend::<users::Service>("users"),
 			},
@@ -672,6 +674,8 @@ pub async fn join_remote_room(
 		}
 		drop(cork);
 
+		self.services.sync.wake_all_joined(room_id).await;
+
 		Ok(())
 	}
 

src/service/rooms/read_receipt/mod.rs

@@ -21,7 +21,7 @@
 };
 
 use self::data::{Data, ReceiptItem};
-use crate::{Dep, rooms, sending};
+use crate::{Dep, rooms, sending, sync};
 
 pub struct Service {
 	services: Services,
@@ -31,6 +31,7 @@ pub struct Service {
 struct Services {
 	sending: Dep<sending::Service>,
 	short: Dep<rooms::short::Service>,
+	sync: Dep<sync::Service>,
 	timeline: Dep<rooms::timeline::Service>,
 }
 
@@ -40,6 +41,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 			services: Services {
 				sending: args.depend::<sending::Service>("sending"),
 				short: args.depend::<rooms::short::Service>("rooms::short"),
+				sync: args.depend::<sync::Service>("sync"),
 				timeline: args.depend::<rooms::timeline::Service>("rooms::timeline"),
 			},
 			db: Data::new(&args),
@@ -63,6 +65,7 @@ pub async fn readreceipt_update(
 			.flush_room(room_id)
 			.await
 			.expect("room flush failed");
+		self.services.sync.wake_all_joined(room_id).await;
 	}
 
 	/// Gets the latest private read receipt from the user in the room

src/service/rooms/state/mod.rs

@@ -24,11 +24,13 @@
 };
 
 use crate::{
-	Dep, globals, rooms,
+	Dep, globals,
 	rooms::{
+		self,
 		short::{ShortEventId, ShortStateHash},
 		state_compressor::{CompressedState, parse_compressed_state_event},
 	},
+	sync,
 };
 
 pub struct Service {
@@ -43,6 +45,7 @@ struct Services {
 	state_cache: Dep<rooms::state_cache::Service>,
 	state_accessor: Dep<rooms::state_accessor::Service>,
 	state_compressor: Dep<rooms::state_compressor::Service>,
+	sync: Dep<sync::Service>,
 	timeline: Dep<rooms::timeline::Service>,
 }
 
@@ -68,6 +71,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 					.depend::<rooms::state_accessor::Service>("rooms::state_accessor"),
 				state_compressor: args
 					.depend::<rooms::state_compressor::Service>("rooms::state_compressor"),
+				sync: args.depend::<sync::Service>("sync"),
 				timeline: args.depend::<rooms::timeline::Service>("rooms::timeline"),
 			},
 			db: Data {
@@ -135,6 +139,8 @@ pub async fn force_state(
 
 		self.set_room_state(room_id, shortstatehash, state_lock);
 
+		self.services.sync.wake_all_joined(room_id).await;
+
 		Ok(())
 	}
 
@@ -296,23 +302,19 @@ pub async fn append_to_state(&self, new_pdu: &PduEvent, room_id: &RoomId) -> Res
 	}
 
 	#[tracing::instrument(skip_all, level = "debug")]
-	pub async fn summary_stripped<'a, E>(
+	pub async fn summary_stripped(
 		&self,
-		event: &'a E,
+		event: &PduEvent,
 		room_id: &RoomId,
 		target_user: &UserId,
-	) -> Vec<RawStrippedState>
-	where
-		E: Event + Send + Sync,
-		&'a E: Event + Send,
-	{
+	) -> Vec<RawStrippedState> {
 		let mut state_events = [
 			(&StateEventType::RoomCreate, ""),
 			(&StateEventType::RoomJoinRules, ""),
 			(&StateEventType::RoomCanonicalAlias, ""),
 			(&StateEventType::RoomName, ""),
 			(&StateEventType::RoomAvatar, ""),
-			(&StateEventType::RoomMember, event.sender().as_str()), // Add recommended events
+			(&StateEventType::RoomMember, event.sender().as_str()),
 			(&StateEventType::RoomEncryption, ""),
 			(&StateEventType::RoomTopic, ""),
 		]
@@ -322,11 +324,20 @@ pub async fn summary_stripped<'a, E>(
 			state_events.push((&StateEventType::RoomMember, target_user.as_str()));
 		}
 
-		let fetches = state_events.into_iter().map(|(event_type, state_key)| {
-			self.services
-				.state_accessor
-				.room_state_get(room_id, event_type, state_key)
-		});
+		let fetches = state_events
+			.into_iter()
+			.map(async |(event_type, state_key)| {
+				if event.event_type() == &TimelineEventType::from(event_type.clone())
+					&& event.state_key() == Some(state_key)
+				{
+					Ok(event.clone())
+				} else {
+					self.services
+						.state_accessor
+						.room_state_get(room_id, event_type, state_key)
+						.await
+				}
+			});
 
 		join_all(fetches)
 			.await

src/service/rooms/state_cache/mod.rs

@@ -16,7 +16,9 @@
 	serde::Raw,
 };
 
-use crate::{Dep, account_data, appservice::RegistrationInfo, config, globals, rooms, users};
+use crate::{
+	Dep, account_data, appservice::RegistrationInfo, config, globals, rooms, sync, users,
+};
 
 pub struct Service {
 	appservice_in_room_cache: AppServiceInRoomCache,
@@ -31,6 +33,7 @@ struct Services {
 	metadata: Dep<rooms::metadata::Service>,
 	state: Dep<rooms::state::Service>,
 	state_accessor: Dep<rooms::state_accessor::Service>,
+	sync: Dep<sync::Service>,
 	users: Dep<users::Service>,
 }
 
@@ -67,6 +70,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				state: args.depend::<rooms::state::Service>("rooms::state"),
 				state_accessor: args
 					.depend::<rooms::state_accessor::Service>("rooms::state_accessor"),
+				sync: args.depend::<sync::Service>("sync"),
 				users: args.depend::<users::Service>("users"),
 			},
 			db: Data {

src/service/rooms/state_cache/update.rs

@@ -29,8 +29,9 @@ pub async fn update_membership(
 		update_joined_count: bool,
 	) -> Result {
 		let membership = pdu.get_content::<RoomMemberEventContent>()?;
+		let is_local = self.services.globals.user_is_local(user_id);
 
-		if !self.services.globals.user_is_local(user_id) {
+		if !is_local {
 			self.services.users.record_remote_user(user_id);
 		}
 
@@ -41,13 +42,14 @@ pub async fn update_membership(
 					// Add the user ID to the join list then
 					self.mark_as_once_joined(user_id, room_id);
 
-					// Check if the room has a predecessor
-					if let Ok(Some(predecessor)) = self
-						.services
-						.state_accessor
-						.room_state_get_content(room_id, &StateEventType::RoomCreate, "")
-						.await
-						.map(|content: RoomCreateEventContent| content.predecessor)
+					// Copy data from the predecessor if the user is local
+					if is_local
+						&& let Ok(Some(predecessor)) = self
+							.services
+							.state_accessor
+							.room_state_get_content(room_id, &StateEventType::RoomCreate, "")
+							.await
+							.map(|content: RoomCreateEventContent| content.predecessor)
 					{
 						// Copy old tags to new room
 						if let Ok(tag_event) = self
@@ -109,13 +111,16 @@ pub async fn update_membership(
 				self.mark_as_joined(user_id, room_id);
 			},
 			| MembershipState::Invite => {
-				let last_state = self
-					.services
-					.state
-					.summary_stripped(pdu, room_id, user_id)
-					.await;
+				let invite_state = if is_local {
+					self.services
+						.state
+						.summary_stripped(pdu, room_id, user_id)
+						.await
+				} else {
+					vec![]
+				};
 
-				self.mark_as_invited(user_id, room_id, pdu.sender(), last_state, None)
+				self.mark_as_invited(user_id, room_id, pdu.sender(), invite_state, None)
 					.await?;
 			},
 			| MembershipState::Leave | MembershipState::Ban => {
@@ -128,6 +133,13 @@ pub async fn update_membership(
 			self.update_joined_count(room_id).await;
 		}
 
+		// Kick the target user's sync loop if they're local and this isn't a join to
+		// make sure that membership changes like invites or invite rejections get
+		// synced
+		if is_local && !matches!(membership.membership, MembershipState::Join) {
+			self.services.sync.wake(user_id).await;
+		}
+
 		Ok(())
 	}
 

src/service/rooms/timeline/append.rs

@@ -86,6 +86,8 @@ pub async fn append_incoming_pdu<'a, Leaves>(
 			}
 		}
 
+		self.services.sync.wake_all_joined(room_id).await;
+
 		Ok(Some(pdu_id))
 	}
 
@@ -187,18 +189,6 @@ pub async fn append_pdu<'a, Leaves>(
 
 		let count1 = self.services.globals.next_count().unwrap();
 
-		// Mark as read first so the sending client doesn't get a notification even if
-		// appending fails
-		// TODO: Is this necessary? appending doesn't seem that fallible, and if it is,
-		// there's bigger issues than ghost notifications.
-		self.services
-			.read_receipt
-			.private_read_set(room_id, pdu.sender(), count1);
-
-		self.services
-			.user
-			.reset_notification_counts(pdu.sender(), room_id);
-
 		let count2 = PduCount::Normal(self.services.globals.next_count().unwrap());
 		let pdu_id: RawPduId = PduId { shortroomid, shorteventid: count2 }.into();
 
@@ -223,6 +213,14 @@ pub async fn append_pdu<'a, Leaves>(
 			);
 		}
 
+		self.services
+			.read_receipt
+			.private_read_set(room_id, pdu.sender(), count1);
+
+		self.services
+			.user
+			.reset_notification_counts(pdu.sender(), room_id);
+
 		self.send_to_interested_appservices(pdu, &pdu_id, room_id)
 			.await;
 

src/service/rooms/timeline/build.rs

@@ -153,6 +153,8 @@ pub async fn build_and_append_pdu(
 			.state
 			.set_room_state(&room_id, statehashid, state_lock);
 
+		self.services.sync.wake_all_joined(&room_id).await;
+
 		let mut servers: HashSet<OwnedServerName> = self
 			.services
 			.state_cache

src/service/rooms/timeline/mod.rs

@@ -28,7 +28,8 @@
 use self::data::Data;
 pub use self::{create::pdu_fits, data::PdusIterItem};
 use crate::{
-	Dep, account_data, admin, appservice, globals, pusher, rooms, sending, server_keys, users,
+	Dep, account_data, admin, appservice, globals, pusher, rooms, sending, server_keys, sync,
+	users,
 };
 
 // Update Relationships
@@ -65,21 +66,22 @@ struct Services {
 	appservice: Dep<appservice::Service>,
 	admin: Dep<admin::Service>,
 	alias: Dep<rooms::alias::Service>,
+	event_handler: Dep<rooms::event_handler::Service>,
 	globals: Dep<globals::Service>,
-	short: Dep<rooms::short::Service>,
-	state: Dep<rooms::state::Service>,
-	state_cache: Dep<rooms::state_cache::Service>,
-	state_accessor: Dep<rooms::state_accessor::Service>,
 	pdu_metadata: Dep<rooms::pdu_metadata::Service>,
+	pusher: Dep<pusher::Service>,
 	read_receipt: Dep<rooms::read_receipt::Service>,
+	search: Dep<rooms::search::Service>,
 	sending: Dep<sending::Service>,
 	server_keys: Dep<server_keys::Service>,
+	short: Dep<rooms::short::Service>,
+	state: Dep<rooms::state::Service>,
+	state_accessor: Dep<rooms::state_accessor::Service>,
+	state_cache: Dep<rooms::state_cache::Service>,
+	sync: Dep<sync::Service>,
+	threads: Dep<rooms::threads::Service>,
 	user: Dep<rooms::user::Service>,
 	users: Dep<users::Service>,
-	pusher: Dep<pusher::Service>,
-	threads: Dep<rooms::threads::Service>,
-	search: Dep<rooms::search::Service>,
-	event_handler: Dep<rooms::event_handler::Service>,
 }
 
 type RoomMutexMap = MutexMap<OwnedRoomId, ()>;
@@ -95,23 +97,24 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				appservice: args.depend::<appservice::Service>("appservice"),
 				admin: args.depend::<admin::Service>("admin"),
 				alias: args.depend::<rooms::alias::Service>("rooms::alias"),
-				globals: args.depend::<globals::Service>("globals"),
-				short: args.depend::<rooms::short::Service>("rooms::short"),
-				state: args.depend::<rooms::state::Service>("rooms::state"),
-				state_cache: args.depend::<rooms::state_cache::Service>("rooms::state_cache"),
-				state_accessor: args
-					.depend::<rooms::state_accessor::Service>("rooms::state_accessor"),
-				pdu_metadata: args.depend::<rooms::pdu_metadata::Service>("rooms::pdu_metadata"),
-				read_receipt: args.depend::<rooms::read_receipt::Service>("rooms::read_receipt"),
-				sending: args.depend::<sending::Service>("sending"),
-				server_keys: args.depend::<server_keys::Service>("server_keys"),
-				user: args.depend::<rooms::user::Service>("rooms::user"),
-				users: args.depend::<users::Service>("users"),
-				pusher: args.depend::<pusher::Service>("pusher"),
-				threads: args.depend::<rooms::threads::Service>("rooms::threads"),
-				search: args.depend::<rooms::search::Service>("rooms::search"),
 				event_handler: args
 					.depend::<rooms::event_handler::Service>("rooms::event_handler"),
+				globals: args.depend::<globals::Service>("globals"),
+				pdu_metadata: args.depend::<rooms::pdu_metadata::Service>("rooms::pdu_metadata"),
+				pusher: args.depend::<pusher::Service>("pusher"),
+				read_receipt: args.depend::<rooms::read_receipt::Service>("rooms::read_receipt"),
+				search: args.depend::<rooms::search::Service>("rooms::search"),
+				sending: args.depend::<sending::Service>("sending"),
+				server_keys: args.depend::<server_keys::Service>("server_keys"),
+				short: args.depend::<rooms::short::Service>("rooms::short"),
+				state: args.depend::<rooms::state::Service>("rooms::state"),
+				state_accessor: args
+					.depend::<rooms::state_accessor::Service>("rooms::state_accessor"),
+				state_cache: args.depend::<rooms::state_cache::Service>("rooms::state_cache"),
+				sync: args.depend::<sync::Service>("sync"),
+				threads: args.depend::<rooms::threads::Service>("rooms::threads"),
+				user: args.depend::<rooms::user::Service>("rooms::user"),
+				users: args.depend::<users::Service>("users"),
 			},
 			db: Data::new(&args),
 			mutex_insert: RoomMutexMap::new(),

src/service/service.rs

@@ -121,6 +121,7 @@ pub(crate) fn depend<T: Service>(&'a self, name: &'static str) -> Dep<T> {
 	/// Create a reference immediately to a service when constructing another
 	/// Service. The other service must be constructed.
 	#[inline]
+	#[allow(dead_code)]
 	pub(crate) fn require<T: Service>(&'a self, name: &str) -> Arc<T> {
 		require::<T>(self.service, name)
 	}

src/service/services.rs

@@ -11,8 +11,8 @@
 	account_data, admin, announcements, antispam, appservice, client, config, emergency,
 	federation, firstrun, globals, key_backups, mailer,
 	manager::Manager,
-	media, moderation, oauth, oidc, presence, pusher, registration_tokens, resolver, rooms,
-	sending, server_keys,
+	media, moderation, oauth, oidc, presence, pusher, registration_tokens, rooms, sending,
+	server_keys,
 	service::{self, Args, Map, Service},
 	sync, threepid, transactions, uiaa, users,
 };
@@ -33,7 +33,6 @@ pub struct Services {
 	pub presence: Arc<presence::Service>,
 	pub pusher: Arc<pusher::Service>,
 	pub registration_tokens: Arc<registration_tokens::Service>,
-	pub resolver: Arc<resolver::Service>,
 	pub rooms: rooms::Service,
 	pub federation: Arc<federation::Service>,
 	pub firstrun: Arc<firstrun::Service>,
@@ -78,7 +77,6 @@ macro_rules! build {
 			account_data: build!(account_data::Service),
 			admin: build!(admin::Service),
 			appservice: build!(appservice::Service),
-			resolver: build!(resolver::Service),
 			client: build!(client::Service),
 			config: build!(config::Service),
 			emergency: build!(emergency::Service),

src/service/sync/mod.rs

@@ -1,42 +1,26 @@
-mod watch;
-
 use std::{
-	collections::{BTreeMap, BTreeSet},
+	collections::{BTreeMap, BTreeSet, HashMap},
+	pin::pin,
 	sync::Arc,
 };
 
-use conduwuit::{Result, Server, SyncMutex};
-use database::Map;
-use ruma::{OwnedDeviceId, OwnedRoomId, OwnedUserId, api::client::sync::sync_events::v5};
+use conduwuit::{Result, SyncMutex, trace};
+use futures::StreamExt;
+use ruma::{
+	OwnedDeviceId, OwnedRoomId, OwnedUserId, RoomId, UserId, api::client::sync::sync_events::v5,
+};
+use tokio::sync::{Mutex, Notify};
 
 use crate::{Dep, rooms};
 
 pub struct Service {
-	db: Data,
 	services: Services,
-	connections: DbConnections<DbConnectionsKey, DbConnectionsVal>,
+	wakers: Mutex<HashMap<OwnedUserId, Arc<Notify>>>,
 	snake_connections: DbConnections<SnakeConnectionsKey, SnakeConnectionsVal>,
 }
 
-pub struct Data {
-	todeviceid_events: Arc<Map>,
-	userroomid_joined: Arc<Map>,
-	userroomid_invitestate: Arc<Map>,
-	userroomid_leftstate: Arc<Map>,
-	userroomid_notificationcount: Arc<Map>,
-	userroomid_highlightcount: Arc<Map>,
-	pduid_pdu: Arc<Map>,
-	keychangeid_userid: Arc<Map>,
-	roomusertype_roomuserdataid: Arc<Map>,
-	readreceiptid_readreceipt: Arc<Map>,
-	userid_lastonetimekeyupdate: Arc<Map>,
-}
-
 struct Services {
-	server: Arc<Server>,
-	short: Dep<rooms::short::Service>,
 	state_cache: Dep<rooms::state_cache::Service>,
-	typing: Dep<rooms::typing::Service>,
 }
 
 #[allow(unused, reason = "TODO refactor")]
@@ -58,33 +42,16 @@ struct SnakeSyncCache {
 
 type DbConnections<K, V> = SyncMutex<BTreeMap<K, V>>;
 type DbConnectionsKey = (OwnedUserId, OwnedDeviceId, String);
-type DbConnectionsVal = Arc<SyncMutex<SlidingSyncCache>>;
 type SnakeConnectionsKey = (OwnedUserId, OwnedDeviceId, Option<String>);
 type SnakeConnectionsVal = Arc<SyncMutex<SnakeSyncCache>>;
 
 impl crate::Service for Service {
 	fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		Ok(Arc::new(Self {
-			db: Data {
-				todeviceid_events: args.db["todeviceid_events"].clone(),
-				userroomid_joined: args.db["userroomid_joined"].clone(),
-				userroomid_invitestate: args.db["userroomid_invitestate"].clone(),
-				userroomid_leftstate: args.db["userroomid_leftstate"].clone(),
-				userroomid_notificationcount: args.db["userroomid_notificationcount"].clone(),
-				userroomid_highlightcount: args.db["userroomid_highlightcount"].clone(),
-				pduid_pdu: args.db["pduid_pdu"].clone(),
-				keychangeid_userid: args.db["keychangeid_userid"].clone(),
-				roomusertype_roomuserdataid: args.db["roomusertype_roomuserdataid"].clone(),
-				readreceiptid_readreceipt: args.db["readreceiptid_readreceipt"].clone(),
-				userid_lastonetimekeyupdate: args.db["userid_lastonetimekeyupdate"].clone(),
-			},
 			services: Services {
-				server: args.server.clone(),
-				short: args.depend::<rooms::short::Service>("rooms::short"),
 				state_cache: args.depend::<rooms::state_cache::Service>("rooms::state_cache"),
-				typing: args.depend::<rooms::typing::Service>("rooms::typing"),
 			},
-			connections: SyncMutex::new(BTreeMap::new()),
+			wakers: Mutex::default(),
 			snake_connections: SyncMutex::new(BTreeMap::new()),
 		}))
 	}
@@ -93,6 +60,41 @@ fn name(&self) -> &str { crate::service::make_name(std::module_path!()) }
 }
 
 impl Service {
+	pub async fn wait_for_wake(&self, user: &UserId) {
+		self.waker_for(user).await.notified().await;
+	}
+
+	/// Wake the target user's sync loop. Call this when something
+	/// that gets included in a legacy sync response changes.
+	///
+	/// Be careful where you call this function! In particular, don't call
+	/// it in any function that's called by `append_pdu`. `append_pdu` will call
+	/// it _after_ it's done appending a PDU, and calling it earlier can cause
+	/// hard-to-diagnose race conditions.
+	pub async fn wake(&self, user: &UserId) {
+		trace!(?user, "Waking user's sync loops");
+
+		self.waker_for(user).await.notify_waiters();
+	}
+
+	/// Wake all of our users who are joined to the specified room.
+	pub async fn wake_all_joined(&self, room: &RoomId) {
+		trace!(?room, "Waking all joined users' sync loops");
+		let mut wakers = self.wakers.lock().await;
+
+		let mut users_in_room = pin!(self.services.state_cache.active_local_users_in_room(room));
+
+		while let Some(user) = users_in_room.next().await {
+			wakers.entry(user).or_default().notify_waiters();
+		}
+	}
+
+	async fn waker_for(&self, user: &UserId) -> Arc<Notify> {
+		let mut wakers = self.wakers.lock().await;
+
+		wakers.entry(user.to_owned()).or_default().clone()
+	}
+
 	pub fn snake_connection_cached(&self, key: &SnakeConnectionsKey) -> bool {
 		self.snake_connections.lock().contains_key(key)
 	}
@@ -101,14 +103,6 @@ pub fn forget_snake_sync_connection(&self, key: &SnakeConnectionsKey) {
 		self.snake_connections.lock().remove(key);
 	}
 
-	pub fn remembered(&self, key: &DbConnectionsKey) -> bool {
-		self.connections.lock().contains_key(key)
-	}
-
-	pub fn forget_sync_request_connection(&self, key: &DbConnectionsKey) {
-		self.connections.lock().remove(key);
-	}
-
 	pub fn update_snake_sync_request_with_cache(
 		&self,
 		snake_key: &SnakeConnectionsKey,

src/service/sync/watch.rs

@@ -1,115 +0,0 @@
-use conduwuit::{Result, trace};
-use futures::{FutureExt, StreamExt, pin_mut, stream::FuturesUnordered};
-use ruma::{DeviceId, UserId};
-
-impl super::Service {
-	/// Watches for changes that might wake the sync loop for the given user +
-	/// device.
-	#[tracing::instrument(skip(self), level = "debug")]
-	pub async fn watch(&self, user_id: &UserId, device_id: &DeviceId) -> Result {
-		let userid_bytes = user_id.as_bytes().to_vec();
-		let mut userid_prefix = userid_bytes.clone();
-		userid_prefix.push(0xFF);
-
-		let mut userdeviceid_prefix = userid_prefix.clone();
-		userdeviceid_prefix.extend_from_slice(device_id.as_bytes());
-		userdeviceid_prefix.push(0xFF);
-
-		let mut futures = FuturesUnordered::new();
-
-		// Return when *any* user changed their key
-		// TODO: only send for user they share a room with
-		futures.push(self.db.todeviceid_events.watch_prefix(&userdeviceid_prefix));
-
-		futures.push(self.db.userroomid_joined.watch_prefix(&userid_prefix));
-		futures.push(self.db.userroomid_invitestate.watch_prefix(&userid_prefix));
-		futures.push(self.db.userroomid_leftstate.watch_prefix(&userid_prefix));
-		futures.push(
-			self.db
-				.userroomid_notificationcount
-				.watch_prefix(&userid_prefix),
-		);
-		futures.push(
-			self.db
-				.userroomid_highlightcount
-				.watch_prefix(&userid_prefix),
-		);
-
-		// Events for rooms we are in
-		let rooms_joined = self.services.state_cache.rooms_joined(user_id);
-
-		pin_mut!(rooms_joined);
-		while let Some(room_id) = rooms_joined.next().await {
-			let Ok(short_roomid) = self.services.short.get_shortroomid(&room_id).await else {
-				continue;
-			};
-
-			let roomid_bytes = room_id.as_bytes().to_vec();
-			let mut roomid_prefix = roomid_bytes.clone();
-			roomid_prefix.push(0xFF);
-
-			// Key changes
-			futures.push(self.db.keychangeid_userid.watch_prefix(&roomid_prefix));
-
-			// Room account data
-			let mut roomuser_prefix = roomid_prefix.clone();
-			roomuser_prefix.extend_from_slice(&userid_prefix);
-
-			futures.push(
-				self.db
-					.roomusertype_roomuserdataid
-					.watch_prefix(&roomuser_prefix),
-			);
-
-			// PDUs
-			let short_roomid = short_roomid.to_be_bytes().to_vec();
-			futures.push(self.db.pduid_pdu.watch_prefix(&short_roomid));
-
-			// EDUs
-			let typing_room_id = room_id.clone();
-			let typing_wait_for_update = async move {
-				self.services.typing.wait_for_update(&typing_room_id).await;
-			};
-
-			futures.push(typing_wait_for_update.boxed());
-			futures.push(
-				self.db
-					.readreceiptid_readreceipt
-					.watch_prefix(&roomid_prefix),
-			);
-		}
-
-		let mut globaluserdata_prefix = vec![0xFF];
-		globaluserdata_prefix.extend_from_slice(&userid_prefix);
-
-		futures.push(
-			self.db
-				.roomusertype_roomuserdataid
-				.watch_prefix(&globaluserdata_prefix),
-		);
-
-		// More key changes (used when user is not joined to any rooms)
-		futures.push(self.db.keychangeid_userid.watch_prefix(&userid_prefix));
-
-		// One time keys
-		futures.push(
-			self.db
-				.userid_lastonetimekeyupdate
-				.watch_prefix(&userid_bytes),
-		);
-
-		// Server shutdown
-		futures.push(self.services.server.until_shutdown().boxed());
-
-		if !self.services.server.running() {
-			return Ok(());
-		}
-
-		// Wait until one of them finds something
-		trace!(futures = futures.len(), "watch started");
-		futures.next().await;
-		trace!(futures = futures.len(), "watch finished");
-
-		Ok(())
-	}
-}

src/service/users/account.rs

@@ -2,7 +2,7 @@
 
 use conduwuit::{
 	Err, Result, debug_error, debug_warn, err, error, info, trace,
-	utils::{self, ReadyExt, stream::TryIgnore},
+	utils::{self, stream::TryIgnore},
 	warn,
 };
 use database::{Deserialized, Json};
@@ -557,18 +557,6 @@ pub fn stream_local_users(&self) -> impl Stream<Item = OwnedUserId> + Send {
 		self.db.userid_password.keys().ignore_err()
 	}
 
-	/// Returns a list of active local users.
-	///
-	/// A user account is considered `local` if the associated password is not
-	/// empty.
-	pub fn list_local_users(&self) -> impl Stream<Item = OwnedUserId> + Send + '_ {
-		self.db
-			.userid_password
-			.stream()
-			.ignore_err()
-			.ready_filter_map(|(u, p): (OwnedUserId, &[u8])| (!p.is_empty()).then_some(u))
-	}
-
 	/// Set a user's password.
 	pub async fn set_password(&self, user_id: &UserId, password: HashedPassword) -> Result {
 		self.status(user_id).await.ensure_active()?;

src/service/users/device.rs

@@ -191,6 +191,8 @@ pub async fn add_to_device_event(
 				"content": content,
 			})),
 		);
+
+		self.services.sync.wake(target_user_id).await;
 	}
 
 	/// Gets all to-device events between the two counts.
@@ -242,6 +244,8 @@ pub async fn remove_to_device_events<Until>(
 				self.db.todeviceid_events.del(key);
 			})
 			.await;
+
+		self.services.sync.wake(user_id).await;
 	}
 
 	/// Updates device metadata and increments the device list version.

src/service/users/keys.rs

@@ -56,6 +56,8 @@ pub async fn add_one_time_key(
 		let count = self.services.globals.next_count().unwrap();
 		self.db.userid_lastonetimekeyupdate.raw_put(user_id, count);
 
+		self.services.sync.wake(user_id).await;
+
 		Ok(())
 	}
 
@@ -152,6 +154,7 @@ pub async fn take_one_time_key(
 			});
 
 		if let Some(result) = one_time_key {
+			self.services.sync.wake(user_id).await;
 			return Ok(result);
 		}
 
@@ -183,6 +186,8 @@ pub async fn take_one_time_key(
 				)
 				.await?;
 			}
+
+			self.services.sync.wake(user_id).await;
 			return Ok((fallback_key_id, fallback_key_value));
 		}
 
@@ -450,9 +455,11 @@ pub async fn mark_device_key_update(&self, user_id: &UserId) {
 					None
 				}
 			})
-			.ready_for_each(|room_id| {
-				let key = (room_id, count);
+			.for_each(async |room_id| {
+				let key = (&room_id, count);
 				self.db.keychangeid_userid.put_raw(key, user_id);
+
+				self.services.sync.wake_all_joined(&room_id).await;
 			})
 			.await;
 

src/service/users/mod.rs

@@ -21,7 +21,7 @@
 use crate::{
 	Dep, account_data, admin, appservice, config, firstrun, globals, oauth, presence,
 	rooms::{self, alias, membership},
-	threepid,
+	sync, threepid,
 };
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -67,6 +67,7 @@ struct Services {
 	state: Dep<rooms::state::Service>,
 	state_accessor: Dep<rooms::state_accessor::Service>,
 	state_cache: Dep<rooms::state_cache::Service>,
+	sync: Dep<sync::Service>,
 	threepid: Dep<threepid::Service>,
 	timeline: Dep<rooms::timeline::Service>,
 }
@@ -119,6 +120,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				state_accessor: args
 					.depend::<rooms::state_accessor::Service>("rooms::state_accessor"),
 				state_cache: args.depend::<rooms::state_cache::Service>("rooms::state_cache"),
+				sync: args.depend::<sync::Service>("sync"),
 				threepid: args.depend::<threepid::Service>("threepid"),
 				timeline: args.depend::<rooms::timeline::Service>("rooms::timeline"),
 			},

src/service/users/profile.rs

@@ -4,6 +4,7 @@
 	Err, Result,
 	pdu::PartialPdu,
 	utils::{ReadyExt, stream::TryIgnore, to_canonical_object},
+	warn,
 };
 use database::{Deserialized, Ignore, Interfix, Json};
 use futures::{Stream, StreamExt};
@@ -115,18 +116,32 @@ pub async fn set_profile_field(
 
 			while let Some(room_id) = all_joined_rooms.next().await {
 				// TODO: this clobbers any custom fields on the event content
-				let mut current_membership = self
+				let mut current_membership = match self
 					.services
 					.state_accessor
 					.get_member(&room_id, user_id)
 					.await
-					.expect("should be able to fetch membership event for joined room");
-
-				assert_eq!(
-					current_membership.membership,
-					MembershipState::Join,
-					"user should be joined"
-				);
+				{
+					| Ok(current_membership)
+						if current_membership.membership == MembershipState::Join =>
+						current_membership,
+					| Ok(current_membership) => {
+						warn!(
+							?user_id,
+							?room_id,
+							"User is not joined in joined room: {current_membership:?}"
+						);
+						continue;
+					},
+					| Err(err) => {
+						warn!(
+							?user_id,
+							?room_id,
+							"Could not load membership event for joined room: {err}"
+						);
+						continue;
+					},
+				};
 
 				// If `propagate_to` is `unchanged`, and the current value of the field we're
 				// updating was changed from its global value in this room, skip it.

src/web/pages/resources/common.css

@@ -175,6 +175,7 @@ pre {
     background-color: oklch(from var(--panel-bg) calc(l - 0.05) c h);
     border-radius: var(--border-radius-sm);
     padding: 8px;
+    overflow-x: scroll;
 }
 
 input, button, a.button {
@@ -214,11 +215,6 @@ button, a.button {
     text-align: center;
     margin: 0.5rem 0;
 
-    &:enabled:hover {
-        opacity: 0.8;
-        cursor: pointer;
-    }
-
     &:disabled {
         color: lightgray;
         background-color: gray;
@@ -226,6 +222,11 @@ button, a.button {
 
     &:not(:disabled) {
         transition: linear color, background-color 0.1s;
+
+        &:hover {
+            opacity: 0.8;
+            cursor: pointer;
+        }
     }
 
     &:visited {
@@ -341,6 +342,10 @@ ul.bullet-separated {
         margin-top: 0;
     }
 
+    .error-body {
+        width: 100%;
+    }
+
     .mobile-hidden {
         display: none;
     }

src/web/pages/resources/components.css

@@ -2,8 +2,8 @@
     --avatar-size: 56px;
 
     display: inline-block;
-    aspect-ratio: 1 / 1;
-    inline-size: var(--avatar-size);
+    width: var(--avatar-size);
+    height: var(--avatar-size);
     border-radius: 50%;
 
     text-align: center;

src/web/pages/templates/_components/device_card.html.j2

@@ -29,9 +29,7 @@
             Last active: {{ last_active }}
         </div>
         <div>
-        {% if style == DeviceCardStyle::Detailed %}
-            <a href="{{ crate::ROUTE_PREFIX }}/account/device/{{ device_id }}/remove">Remove</a>
-        {% else %}
+        {% if style != DeviceCardStyle::Detailed %}
             <a href="{{ crate::ROUTE_PREFIX }}/account/device/{{ device_id }}/">Details</a>
         {% endif %}
         </div>

src/web/pages/templates/account.html.j2

@@ -25,7 +25,7 @@ Your account
                             Your account has no associated email address.
                         {% endif %}
                         {% if email_requirement.may_change() %}
-                            <a href="email/change/">Change your email</a>\
+                            <a href="email/change/">Change your email</a>
                         {% endif %}
                     </p>
                 {% endif %}

src/web/pages/templates/change_password.html.j2

@@ -20,7 +20,7 @@ Change your password
             </div>
         {% when ChangePasswordBody::Success %}
             <p>
-                Your password has been changed successfully. <a href="{{ crate::ROUTE_PREFIX }}/account/">Back</a>
+                Your password has been changed successfully.
             </p>
     {% endmatch %}
 </div>

src/web/pages/templates/device_info.html.j2

@@ -34,6 +34,7 @@ Device information
             {% endif %}
         </p>
     </section>
+    <a class="button" href="remove">Remove this device</a>
     {% if let Some((client_metadata, session_info)) = client_metadata %}
         <details>
             <summary>Client registration</summary>

src/web/pages/templates/error.html.j2

@@ -37,6 +37,7 @@
         {% endif %}
 
         <pre style="white-space: pre-wrap"><code>{{ error }}</code></pre>
+        <a href="{{ crate::ROUTE_PREFIX }}/account/">Back to account settings</a>
     </div>
 </div>
 

src/web/pages/templates/login.html.j2

@@ -44,6 +44,9 @@ Log in
                         </p>
                         <button type="submit">Log in</button>
                     </form>
+                    {% if let Some(error) = login_error %}
+                        <small class="error">{{ error }}</small>
+                    {% endif %}
                     <div class="centered-links">
                         {% if registration_available %}
                             {% let query = next.as_ref().map(serde_urlencoded::to_string).transpose().unwrap().unwrap_or_default() %}
@@ -67,6 +70,9 @@ Log in
                         </p>
                         <button type="submit">Continue</button>
                     </form>
+                    {% if let Some(error) = login_error %}
+                        <small class="error">{{ error }}</small>
+                    {% endif %}
                     <div class="centered-links">
                         <a href="{{ crate::ROUTE_PREFIX }}/account/password/reset/">Forgot your password?</a>
                     </div>
@@ -74,8 +80,5 @@ Log in
                     <a class="button" href="{{ redirect_url }}">Continue</a>
             {% endmatch %}
     {% endmatch %}
-    {% if let Some(error) = login_error %}
-        <small class="error">{{ error }}</small>
-    {% endif %}
 </div>
 {%- endblock -%}

src/web/pages/templates/remove_device.html.j2

@@ -6,7 +6,7 @@ Remove a device
 
 {%- block content -%}
 <div class="panel">
-    <h1>Remove a device <a class="back" href="{{ crate::ROUTE_PREFIX }}/account/">Back</a></h1>
+    <h1>Remove a device <a class="back" href=".">Back</a></h1>
     {% match body %}
         {% when RemoveDeviceBody::Form { device_card, last_device } %}
             {{ device_card }}
@@ -25,8 +25,9 @@ Remove a device
                 </p>
             {% endif %}
             <form method="post">
-                <button type="submit">Remove this device</button>
+                <button type="submit" class="slowdown">Remove this device</button>
             </form>
+            <script src="{{ crate::ROUTE_PREFIX }}/resources/slowdown.js" nonce="{{ context.csp_nonce }}"></script>
         {% when RemoveDeviceBody::Success %}
             <p>
                 The device has been signed out successfully.

src/web/pages/templates/reset_password.html.j2

@@ -27,6 +27,7 @@ Reset your password
             <p>
                 To reset your password, contact your homeserver's administrator.
             </p>
+            <a href="{{ crate::ROUTE_PREFIX }}/account/">Back to account settings</a>
     {% endmatch %}
 </div>
 {%- endblock -%}