chore: Formatting

Ruma already does this check for us

Cargo.lock

@@ -4601,7 +4601,7 @@ dependencies = [
 [[package]]
 name = "ruma"
 version = "0.16.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "assign",
  "js_int",
@@ -4620,8 +4620,9 @@ dependencies = [
 [[package]]
 name = "ruma-appservice-api"
 version = "0.16.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
+ "http",
  "js_int",
  "ruma-common",
  "ruma-events",
@@ -4632,7 +4633,7 @@ dependencies = [
 [[package]]
 name = "ruma-client-api"
 version = "0.24.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "as_variant",
  "assign",
@@ -4654,7 +4655,7 @@ dependencies = [
 [[package]]
 name = "ruma-common"
 version = "0.19.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "as_variant",
  "base64 0.22.1",
@@ -4687,7 +4688,7 @@ dependencies = [
 [[package]]
 name = "ruma-events"
 version = "0.34.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "as_variant",
  "indexmap 2.14.0",
@@ -4708,7 +4709,7 @@ dependencies = [
 [[package]]
 name = "ruma-federation-api"
 version = "0.15.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "bytes",
  "headers",
@@ -4731,7 +4732,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers-validation"
 version = "0.12.1"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "js_int",
  "thiserror 2.0.18",
@@ -4740,7 +4741,7 @@ dependencies = [
 [[package]]
 name = "ruma-macros"
 version = "0.19.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "as_variant",
  "cfg-if",
@@ -4756,7 +4757,7 @@ dependencies = [
 [[package]]
 name = "ruma-push-gateway-api"
 version = "0.15.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "js_int",
  "ruma-common",
@@ -4768,7 +4769,7 @@ dependencies = [
 [[package]]
 name = "ruma-signatures"
 version = "0.21.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "base64 0.22.1",
  "ed25519-dalek",
@@ -4785,7 +4786,7 @@ dependencies = [
 [[package]]
 name = "ruma-state-res"
 version = "0.17.0"
-source = "git+https://github.com/ruma/ruma.git?rev=fca1dbc060f730c1aaf84c9c2fb1e8a587455be8#fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+source = "git+https://github.com/gingershaped/ruwuma.git?rev=0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff#0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 dependencies = [
  "js_int",
  "ruma-common",

Cargo.toml

@@ -349,8 +349,8 @@ version = "1.1.1"
 # Used for matrix spec type definitions and helpers
 [workspace.dependencies.ruma]
 # version = "0.14.1"
-git = "https://github.com/ruma/ruma.git"
-rev = "fca1dbc060f730c1aaf84c9c2fb1e8a587455be8"
+git = "https://github.com/gingershaped/ruwuma.git"
+rev = "0713b97ed53b7cb5e639f5e2f067c0fe6ac525ff"
 features = [
     "appservice-api-c",
     "client-api",
@@ -386,6 +386,7 @@ features = [
     "unstable-msc4406",
     "unstable-msc4439",
     "unstable-msc4466",
+    "unstable-msc4484",
     "unstable-extensible-events",
 ]
 

changelog.d/+6d0bc844.bugfix.md

@@ -1 +0,0 @@
-Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.

docker/Dockerfile

@@ -171,6 +171,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git/db \
     --mount=type=cache,target=/app/target,id=continuwuity-cargo-target-${TARGET_CPU}-${TARGETPLATFORM}-${RUST_PROFILE} \
     bash <<'EOF'
+    set -euo pipefail
     set -o allexport
     set -o xtrace
     . /etc/environment
@@ -191,7 +192,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
             jq -r ".target_directory"))
     mkdir /out/sbin
     PACKAGE=conduwuit
-    xx-cargo build --locked --profile ${RUST_PROFILE} \
+    CARGO_LOG=debug xx-cargo build --locked --profile ${RUST_PROFILE} \
         --no-default-features --features ${CARGO_FEATURES} \
         -p $PACKAGE;
     BINARIES=($(cargo metadata --no-deps --format-version 1 | \
@@ -207,6 +208,7 @@ EOF
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/usr/local/cargo/git/db \
     bash <<'EOF'
+    set -euo pipefail
     set -o xtrace
     mkdir /out/sbom
     typeset -A PACKAGES

nix/rust.nix

@@ -12,7 +12,7 @@
         target:
         target.fromToolchainName {
           name = (lib.importTOML "${inputs.self}/rust-toolchain.toml").toolchain.channel;
-          sha256 = "sha256-h+t2xTBz5yt2YIO+1VMIIGlCU7gyp2LYOFvaV1nwOXU=";
+          sha256 = "sha256-OATSZm98Es5kIFuqaba+UvkQtFsVgJEBMmS+t6od5/U=";
         };
     in
     {

rust-toolchain.toml

@@ -10,7 +10,7 @@
 
 [toolchain]
 profile = "minimal"
-channel = "1.96.1"
+channel = "1.97.0"
 components = [
     # For rust-analyzer
     "rust-src",

src/admin/user/commands.rs

@@ -115,7 +115,7 @@ pub(super) async fn suspend(&self, user_id: String) -> Result {
 		// TODO: Record the actual user that sent the suspension where possible
 		self.services
 			.users
-			.suspend_account(&user_id, self.sender_or_service_user())
+			.suspend_account(&user_id, self.sender)
 			.await;
 
 		self.write_str(&format!("User {user_id} has been suspended."))
@@ -948,7 +948,7 @@ pub(super) async fn lock(&self, user_id: String) -> Result {
 
 		self.services
 			.users
-			.lock_account(&user_id, self.sender_or_service_user())
+			.lock_account(&user_id, self.sender)
 			.await;
 
 		self.write_str(&format!("User {user_id} has been locked."))

src/api/Cargo.toml

@@ -62,6 +62,8 @@ zstd_compression = [
 	"reqwest/zstd",
 ]
 
+admin_api = []
+
 [dependencies]
 async-trait.workspace = true
 axum-client-ip.workspace = true

src/api/admin/mod.rs

@@ -1 +0,0 @@
-pub mod rooms;

src/api/admin/rooms/list.rs

@@ -1,36 +0,0 @@
-use axum::extract::State;
-use conduwuit::{Err, Result};
-use futures::StreamExt;
-use ruma::OwnedRoomId;
-use ruminuwuity::admin::continuwuity::rooms;
-
-use crate::Ruma;
-
-/// # `GET /_continuwuity/admin/rooms/list`
-///
-/// Lists all rooms known to this server, excluding banned ones.
-pub(crate) async fn list_rooms(
-	State(services): State<crate::State>,
-	body: Ruma<rooms::list::v1::Request>,
-) -> Result<rooms::list::v1::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-	if !services.users.is_admin(sender_user).await {
-		return Err!(Request(Forbidden("Only server administrators can use this endpoint")));
-	}
-
-	let mut rooms: Vec<OwnedRoomId> = services
-		.rooms
-		.metadata
-		.iter_ids()
-		.filter_map(|room_id| async move {
-			if !services.rooms.metadata.is_banned(&room_id).await {
-				Some(room_id.clone())
-			} else {
-				None
-			}
-		})
-		.collect()
-		.await;
-	rooms.sort();
-	Ok(rooms::list::v1::Response::new(rooms))
-}

src/api/admin/rooms/mod.rs

@@ -1,2 +0,0 @@
-pub mod ban;
-pub mod list;

src/api/client/admin/lock.rs

@@ -1,6 +1,6 @@
 use axum::extract::State;
 use conduwuit::{Err, Result};
-use futures::future::{join, join3};
+use futures::join;
 use ruma::api::client::admin::{is_user_locked, lock_user};
 
 use crate::Ruma;
@@ -12,15 +12,7 @@ pub(crate) async fn get_lock_status(
 	State(services): State<crate::State>,
 	body: Ruma<is_user_locked::v1::Request>,
 ) -> Result<is_user_locked::v1::Response> {
-	let (admin, status) = join(
-		services.users.is_admin(body.identity.expect_sender_user()?),
-		services.users.status(&body.user_id),
-	)
-	.await;
-
-	if !admin {
-		return Err!(Request(Forbidden("Only server administrators can use this endpoint")));
-	}
+	let status = services.users.status(&body.user_id).await;
 
 	status.ensure_active()?;
 
@@ -36,22 +28,14 @@ pub(crate) async fn put_lock_status(
 	State(services): State<crate::State>,
 	body: Ruma<lock_user::v1::Request>,
 ) -> Result<lock_user::v1::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 
-	let (sender_admin, status, target_admin) = join3(
-		services.users.is_admin(sender_user),
-		services.users.status(&body.user_id),
-		services.users.is_admin(&body.user_id),
-	)
-	.await;
-
-	if !sender_admin {
-		return Err!(Request(Forbidden("Only server administrators can use this endpoint")));
-	}
+	let (status, target_admin) =
+		join!(services.users.status(&body.user_id), services.users.is_admin(&body.user_id),);
 
 	status.ensure_active()?;
 
-	if body.user_id == *sender_user {
+	if sender_user.is_some_and(|sender_user| body.user_id == sender_user) {
 		return Err!(Request(Forbidden("You cannot lock yourself")));
 	}
 
@@ -79,7 +63,7 @@ pub(crate) async fn put_lock_status(
 		// Notify the admin room that an account has been un/suspended
 		services
 			.admin
-			.send_text(&format!("{} has been {} by {}.", body.user_id, action, sender_user))
+			.send_text(&format!("{} has been {} by {}.", body.user_id, action, body.identity))
 			.await;
 	}
 

src/api/client/admin/mod.rs

@@ -1,4 +1,5 @@
 mod lock;
+pub(crate) mod site;
 mod suspend;
 
 pub(crate) use self::{lock::*, suspend::*};

src/api/client/admin/site/mod.rs

@@ -0,0 +1,2 @@
+pub(crate) mod rooms;
+pub(crate) mod users;

src/api/client/admin/site/rooms/ban.rs

@@ -6,7 +6,7 @@
 
 use crate::{Ruma, client::leave_room};
 
-/// # `PUT /_continuwuity/admin/rooms/{roomID}/ban`
+/// # `PUT /_continuwuity/admin/v1/rooms/{roomID}/ban`
 ///
 /// Bans or unbans a room.
 pub(crate) async fn ban_room(

src/api/client/admin/site/rooms/list.rs

@@ -0,0 +1,178 @@
+use axum::extract::State;
+use conduwuit::{
+	Event, Result,
+	utils::stream::{BroadbandExt, WidebandExt},
+};
+use futures::StreamExt;
+use ruma::{
+	OwnedRoomId,
+	events::{
+		StateEventType,
+		room::{
+			create::RoomCreateEventContent,
+			encryption::PossiblyRedactedRoomEncryptionEventContent,
+			tombstone::PossiblyRedactedRoomTombstoneEventContent,
+		},
+	},
+};
+use ruminuwuity::admin::continuwuity::rooms;
+use tokio::join;
+
+use crate::Ruma;
+
+/// # `GET /_continuwuity/admin/rooms`
+///
+/// Lists all room IDs known to this server, excluding banned ones.
+///
+/// This is the legacy version of the endpoint, which does not support
+/// pagination or including banned rooms. It is recommended to use the
+/// `/v1/rooms` endpoint instead. This endpoint may be removed in a future
+/// release.
+pub(crate) async fn legacy_list_rooms(
+	State(services): State<crate::State>,
+	_body: Ruma<rooms::list::unstable::Request>,
+) -> Result<rooms::list::unstable::Response> {
+	let mut rooms: Vec<OwnedRoomId> = services
+		.rooms
+		.metadata
+		.iter_ids()
+		.filter_map(|room_id| async move {
+			if !services.rooms.metadata.is_banned(&room_id).await {
+				Some(room_id.clone())
+			} else {
+				None
+			}
+		})
+		.collect()
+		.await;
+	rooms.sort();
+	Ok(rooms::list::unstable::Response::new(rooms))
+}
+
+/// # `GET /_continuwuity/admin/v1/rooms`
+///
+/// Lists rooms known to this server.
+pub(crate) async fn list_rooms(
+	State(services): State<crate::State>,
+	body: Ruma<rooms::list::v1::Request>,
+) -> Result<rooms::list::v1::Response> {
+	let include_banned_rooms = body.include_banned_rooms;
+	let rooms = services
+		.rooms
+		.metadata
+		.iter_ids()
+		.wide_filter_map(|room_id| async move {
+			if include_banned_rooms || !services.rooms.metadata.is_banned(&room_id).await {
+				Some(room_id.clone())
+			} else {
+				None
+			}
+		})
+		.skip(body.offset.unwrap_or_default())
+		.take(body.limit.unwrap_or(100).min(100))
+		.broad_filter_map(|room_id| async move {
+			let (
+				banned,
+				disabled,
+				member_count,
+				local_member_count,
+				resident_server_count,
+				published,
+				create_event,
+				encryption_event,
+				name_event,
+				topic_event,
+				canonical_alias_event,
+				join_rules_event,
+				history_visibility_event,
+				tombstone_event,
+			) = join!(
+				services.rooms.metadata.is_banned(&room_id),
+				services.rooms.metadata.is_disabled(&room_id),
+				services.rooms.state_cache.room_joined_count(&room_id),
+				services
+					.rooms
+					.state_cache
+					.active_local_users_in_room(&room_id)
+					.count(),
+				services.rooms.state_cache.room_servers(&room_id).count(),
+				services.rooms.directory.is_public_room(&room_id),
+				services.rooms.state_accessor.room_state_get(
+					&room_id,
+					&StateEventType::RoomCreate,
+					""
+				),
+				services
+					.rooms
+					.state_accessor
+					.room_state_get_content::<PossiblyRedactedRoomEncryptionEventContent>(
+						&room_id,
+						&StateEventType::RoomEncryption,
+						""
+					),
+				services.rooms.state_accessor.room_state_get_content(
+					&room_id,
+					&StateEventType::RoomName,
+					""
+				),
+				services.rooms.state_accessor.room_state_get_content(
+					&room_id,
+					&StateEventType::RoomTopic,
+					""
+				),
+				services.rooms.state_accessor.room_state_get_content(
+					&room_id,
+					&StateEventType::RoomCanonicalAlias,
+					""
+				),
+				services.rooms.state_accessor.room_state_get_content(
+					&room_id,
+					&StateEventType::RoomJoinRules,
+					""
+				),
+				services.rooms.state_accessor.room_state_get_content(
+					&room_id,
+					&StateEventType::RoomHistoryVisibility,
+					""
+				),
+				services
+					.rooms
+					.state_accessor
+					.room_state_get_content::<PossiblyRedactedRoomTombstoneEventContent>(
+						&room_id,
+						&StateEventType::RoomTombstone,
+						""
+					),
+			);
+			let Ok(create_event) = create_event else {
+				return None;
+			};
+			let create_content = create_event
+				.get_content::<RoomCreateEventContent>()
+				.expect("m.room.create content must be valid");
+			Some(rooms::list::v1::MinimalRoomInfo {
+				room_id,
+				banned,
+				disabled,
+				member_count: usize::try_from(member_count.unwrap_or_default())
+					.expect("u64 should fit in usize"),
+				local_member_count,
+				resident_server_count,
+				creators: vec![create_event.sender],
+				encrypted: encryption_event.is_ok_and(|c| c.algorithm.is_some()),
+				federated: create_content.federate,
+				published,
+				version: create_content.room_version,
+				name: name_event.unwrap_or(None),
+				topic: topic_event.unwrap_or(None),
+				canonical_alias: canonical_alias_event.unwrap_or(None),
+				join_rules: join_rules_event.unwrap_or(None),
+				history_visibility: history_visibility_event.unwrap_or(None),
+				predecessor: create_content.predecessor.map(|c| c.room_id),
+				successor: tombstone_event.map_or(None, |c| c.replacement_room),
+			})
+		})
+		.collect()
+		.await;
+	Ok(rooms::list::v1::Response::new(rooms))
+}

src/api/client/admin/site/rooms/mod.rs

@@ -0,0 +1,5 @@
+mod ban;
+mod list;
+
+pub(crate) use ban::ban_room;
+pub(crate) use list::*;

src/api/client/admin/site/users/create.rs

@@ -0,0 +1,142 @@
+use axum::extract::State;
+use conduwuit::{
+	err, error, info,
+	utils::{IterStream, stream::BroadbandExt},
+	warn,
+};
+use futures::{FutureExt, StreamExt};
+use ruma::{api::client::profile::PropagateTo, profile::ProfileFieldValue};
+use ruminuwuity::admin::continuwuity::users;
+use service::users::{HashedPassword, ProfileFieldChange};
+
+use crate::router::Ruma;
+
+/// # `POST /_continuwuity/admin/v1/users/create`
+///
+/// Creates a new user.
+pub(crate) async fn create_user(
+	State(services): State<crate::State>,
+	body: Ruma<users::create::v1::Request>,
+) -> conduwuit::Result<users::create::v1::Response> {
+	let email = body
+		.email
+		.clone()
+		.map(lettre::Address::try_from)
+		.transpose()
+		.map_err(|e| err!(Request(BadJson("Invalid email address: {e}"))))?;
+
+	let ref user_id = services
+		.users
+		.determine_registration_user_id(Some(body.localpart.clone()), email.as_ref(), None)
+		.await?;
+
+	services.users.create_shadow_account(user_id).await?;
+
+	services
+		.users
+		.convert_to_local_account(user_id, HashedPassword::new(&body.password)?)
+		.await?;
+
+	if let Some(email) = &email {
+		services
+			.threepid
+			.associate_localpart_email(user_id.localpart(), email)
+			.await?;
+	}
+
+	if body.suspended {
+		services
+			.users
+			.suspend_account(user_id, body.identity.sender_user())
+			.await;
+	}
+	if body.locked {
+		services
+			.users
+			.lock_account(user_id, body.identity.sender_user())
+			.await;
+	}
+	if body.login_disabled {
+		services.users.disable_login(user_id);
+	}
+	if let Some(ref value) = body.display_name {
+		services
+			.users
+			.set_profile_field(
+				user_id,
+				ProfileFieldChange::Set(ProfileFieldValue::DisplayName(value.to_owned())),
+				PropagateTo::None,
+			)
+			.await?;
+	}
+	if let Some(ref value) = body.avatar_url {
+		services
+			.users
+			.set_profile_field(
+				user_id,
+				ProfileFieldChange::Set(ProfileFieldValue::AvatarUrl(value.to_owned())),
+				PropagateTo::None,
+			)
+			.await?;
+	}
+	if body.admin {
+		services
+			.admin
+			.make_user_admin(user_id)
+			.await
+			.inspect_err(|e| error!("failed to make new user {user_id} an admin: {e}"))
+			.ok();
+	}
+
+	body.auto_join_rooms
+		.clone()
+		.into_iter()
+		.stream()
+		.chain(
+			if body.skip_auto_join {
+				vec![]
+			} else {
+				services.config.auto_join_rooms.clone()
+			}
+			.into_iter()
+			.stream(),
+		)
+		.broad_filter_map(|room| async move {
+			services
+				.rooms
+				.alias
+				.resolve_with_servers(&room, None)
+				.await
+				.inspect_err(|e| {
+					warn!(
+						"Failed to resolve room alias to room ID when attempting to auto join \
+						 {room}: {e}"
+					);
+				})
+				.ok()
+		})
+		.for_each_concurrent(None, |(room_id, servers)| async move {
+			match services
+				.rooms
+				.membership
+				.join_room(
+					user_id,
+					&room_id,
+					Some("Automatically joining this room upon registration".to_owned()),
+					servers.as_ref(),
+				)
+				.boxed()
+				.await
+			{
+				| Err(e) => {
+					warn!("Failed to automatically join {user_id} to {room_id}: {e}");
+				},
+				| _ => {
+					info!("Automatically joined room {user_id} to {room_id}");
+				},
+			}
+		})
+		.await;
+
+	Ok(users::create::v1::Response::new(user_id.to_owned()))
+}

src/api/client/admin/site/users/list.rs

@@ -0,0 +1,42 @@
+use axum::extract::State;
+use conduwuit::utils::stream::WidebandExt;
+use futures::StreamExt;
+use ruminuwuity::admin::continuwuity::users;
+use tokio::join;
+
+use crate::router::Ruma;
+
+/// # `GET /_continuwuity/admin/v1/users`
+///
+/// Lists all users on this homeserver.
+pub(crate) async fn list_users(
+	State(services): State<crate::State>,
+	body: Ruma<users::list::v1::Request>,
+) -> conduwuit::Result<users::list::v1::Response> {
+	let users = services
+		.users
+		.stream_local_users()
+		.skip(body.offset.unwrap_or_default())
+		.take(body.limit.unwrap_or(100).min(100))
+		.wide_filter_map(|user_id| async move {
+			let (status, suspended, locked, admin, login_disabled) = join!(
+				services.users.status(&user_id),
+				services.users.is_suspended(&user_id),
+				services.users.is_locked(&user_id),
+				services.users.is_admin(&user_id),
+				services.users.is_login_disabled(&user_id),
+			);
+			Some(users::list::v1::User {
+				user_id: user_id.clone(),
+				deactivated: !status.is_active(),
+				suspended: suspended.unwrap_or_default(),
+				locked: locked.unwrap_or_default(),
+				admin,
+				login_disabled,
+			})
+		})
+		.collect()
+		.await;
+
+	Ok(users::list::v1::Response::new(users))
+}

src/api/client/admin/site/users/mod.rs

@@ -0,0 +1,5 @@
+mod create;
+mod list;
+
+pub(crate) use create::*;
+pub(crate) use list::*;

src/api/client/admin/suspend.rs

@@ -67,7 +67,7 @@ pub(crate) async fn put_suspended_status(
 	let action = if body.suspended {
 		services
 			.users
-			.suspend_account(&body.user_id, sender_user)
+			.suspend_account(&body.user_id, body.identity.sender_user())
 			.await;
 		"suspended"
 	} else {

src/api/client/profile.rs

@@ -29,6 +29,12 @@ pub(crate) async fn get_profile_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile::v3::Request>,
 ) -> Result<get_profile::v3::Response> {
+	if services.config.require_auth_for_profile_requests && body.identity.is_none() {
+		return Err!(Request(Unauthorized(
+			"This server requires authentication to view user profiles."
+		)));
+	}
+
 	let Some(profile) = fetch_full_profile(&services, &body.user_id).await else {
 		return Err!(Request(NotFound("This user's profile could not be fetched.")));
 	};
@@ -40,6 +46,12 @@ pub(crate) async fn get_profile_field_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile_field::v3::Request>,
 ) -> Result<get_profile_field::v3::Response> {
+	if services.config.require_auth_for_profile_requests && body.identity.is_none() {
+		return Err!(Request(Unauthorized(
+			"This server requires authentication to view user profiles."
+		)));
+	}
+
 	let value = fetch_profile_field(&services, &body.user_id, body.field.clone()).await?;
 
 	Ok(assign!(get_profile_field::v3::Response::default(), { value }))

src/api/mod.rs

@@ -11,8 +11,6 @@
 pub mod router;
 pub mod server;
 
-pub mod admin;
-
 pub(crate) use self::router::{Ruma, RumaResponse, State};
 
 conduwuit::mod_ctor! {}

src/api/router.rs

@@ -16,7 +16,12 @@
 
 use self::handler::RouterExt;
 pub(super) use self::{args::Args as Ruma, auth::ClientIdentity, response::RumaResponse};
-use crate::{admin, client, server};
+#[cfg(feature = "admin_api")]
+use crate::client::admin::site as admin_api;
+use crate::{
+	client::{self, admin},
+	server,
+};
 
 pub fn build(router: Router<State>, state: State) -> Router<State> {
 	let config = &state.server.config;
@@ -191,8 +196,11 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 		.ruma_route(&client::get_authorization_server_metadata_route)
 		.merge(client::oauth::router(state))
 		.route("/_continuwuity/server_version", get(client::continuwuity_server_version))
-		.ruma_route(&admin::rooms::ban::ban_room)
-		.ruma_route(&admin::rooms::list::list_rooms);
+		.ruma_route(&admin::site::rooms::ban_room)
+		.ruma_route(&admin::site::rooms::list_rooms)
+		.ruma_route(&admin::site::rooms::legacy_list_rooms)
+		.ruma_route(&admin::site::users::create_user)
+		.ruma_route(&admin::site::users::list_users);
 
 	if config.allow_federation {
 		router = router
@@ -275,6 +283,16 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 			.route("/_matrix/media/r0/preview_url", any(redirect_legacy_preview));
 	}
 
+	#[cfg(feature = "admin_api")]
+	{
+		router = router
+			.ruma_route(&admin_api::users::list_users_route)
+			.ruma_route(&admin_api::users::create_user_route)
+			.ruma_route(&admin_api::rooms::ban_room)
+			.ruma_route(&admin_api::rooms::legacy_list_rooms_route)
+			.ruma_route(&admin_api::rooms::list_rooms_route);
+	};
+
 	router
 }
 

src/api/router/auth.rs

@@ -1,11 +1,14 @@
-use std::any::{Any, TypeId};
+use std::{
+	any::{Any, TypeId},
+	fmt::Display,
+};
 
 use conduwuit::{Err, Error, Result, err};
 use http::StatusCode;
 use ruma::{
 	DeviceId, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId,
 	api::{
-		IncomingRequest,
+		IncomingRequest, OAuthClientScope,
 		auth_scheme::{
 			AccessToken, AccessTokenOptional, AppserviceToken, AppserviceTokenOptional,
 			AuthScheme, NoAccessToken, NoAuthentication,
@@ -77,68 +80,66 @@ pub(crate) fn appservice_info(&self) -> Option<&RegistrationInfo> {
 	pub(crate) fn is_appservice(&self) -> bool { matches!(self, Self::Appservice { .. }) }
 }
 
+impl Display for ClientIdentity {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+		match self {
+			| Self::User { sender_user, sender_device } =>
+				write!(f, "{sender_user} ({sender_device})"),
+			| Self::Appservice { sender_user, appservice_info, .. } =>
+				write!(f, "appservice `{}` using {sender_user}", appservice_info.registration.id),
+		}
+	}
+}
+
 pub(crate) trait CheckAuth: AuthScheme {
 	type Identity: Send;
 
-	fn authenticate<R: IncomingRequest + Any, B: AsRef<[u8]> + Sync>(
+	fn authenticate<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		incoming_request: &hyper::Request<B>,
 		query: AuthQueryParams,
 	) -> impl Future<Output = Result<Self::Identity>> + Send {
 		async move {
-			let route = TypeId::of::<R>();
-
 			let output = Self::extract_authentication(incoming_request).map_err(|err| {
 				err!(Request(Unauthorized(warn!(
-					"Failed to extract authorization: {}",
+					"Failed to extract request authentication: {}",
 					err.into()
 				))))
 			})?;
 
-			Self::verify(services, output, incoming_request, query, route).await
+			Self::verify::<R, B>(services, output, incoming_request, query).await
 		}
 	}
 
-	fn verify<B: AsRef<[u8]> + Sync>(
+	fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		request: &hyper::Request<B>,
 		query: AuthQueryParams,
-		route: TypeId,
 	) -> impl Future<Output = Result<Self::Identity>> + Send;
 }
 
 impl CheckAuth for ServerSignatures {
 	type Identity = OwnedServerName;
 
-	async fn verify<B: AsRef<[u8]> + Sync>(
+	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		request: &hyper::Request<B>,
 		_query: AuthQueryParams,
-		_route: TypeId,
 	) -> Result<Self::Identity> {
-		let destination = services.globals.server_name();
-		if output
-			.destination
-			.as_ref()
-			.is_some_and(|supplied_destination| supplied_destination != destination)
-		{
-			return Err!(Request(Unauthorized("Destination mismatch.")));
-		}
-
 		let key = services
 			.server_keys
 			.get_verify_key(&output.origin, &output.key)
 			.await
-			.map_err(|e| {
-				err!(Request(Unauthorized(warn!("Failed to fetch signing keys: {e}"))))
+			.map_err(|err| {
+				err!(Request(Unauthorized(warn!("Failed to fetch signing keys: {err}"))))
 			})?;
 
 		let keys: PubKeys = [(output.key.to_string(), key.key)].into();
 		let keys: PubKeyMap = [(output.origin.as_str().into(), keys)].into();
 
-		match output.verify_request(request, destination, &keys) {
+		match output.verify_request(request, services.globals.server_name(), &keys) {
 			| Ok(()) => {
 				if services
 					.moderation
@@ -160,115 +161,36 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 impl CheckAuth for AccessToken {
 	type Identity = ClientIdentity;
 
-	async fn verify<B: AsRef<[u8]> + Sync>(
+	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		_request: &hyper::Request<B>,
 		query: AuthQueryParams,
-		route: TypeId,
 	) -> Result<Self::Identity> {
-		if output.is_empty() {
-			return Err!(Request(Unauthorized("Missing access token.")));
-		}
-		if let Some((sender_user, sender_device, status)) =
-			services.users.find_from_token(&output).await
-		{
-			// If the token is expired we return a soft logout
-			if matches!(status, AccessTokenStatus::Expired) {
-				return Err(Error::Request(
-					ErrorKind::UnknownToken(
-						assign!(UnknownTokenErrorData::new(), { soft_logout: true }),
-					),
-					"This token has expired".into(),
-					StatusCode::UNAUTHORIZED,
-				));
-			}
-
-			// Locked users can only use /logout and /logout/all
-			if services
-				.users
-				.is_locked(&sender_user)
-				.await
-				.is_ok_and(std::convert::identity)
-			{
-				if !(route == TypeId::of::<client::session::logout::v3::Request>()
-					|| route == TypeId::of::<client::session::logout_all::v3::Request>())
-				{
-					return Err!(Request(UserLocked("Your account is locked.")));
-				}
-			}
-
-			Ok(ClientIdentity::User { sender_user, sender_device })
-		} else if let Ok(appservice_info) = services.appservice.find_from_token(&output).await {
-			let Ok(sender_user) = query.user_id.clone().map_or_else(
-				|| {
-					UserId::parse_with_server_name(
-						appservice_info.registration.sender_localpart.as_str(),
-						services.globals.server_name(),
-					)
-				},
-				UserId::parse,
-			) else {
-				return Err!(Request(InvalidUsername("Username is invalid.")));
-			};
-
-			if !appservice_info.is_user_match(&sender_user) {
-				return Err!(Request(Exclusive("User is not in namespace.")));
-			}
-
-			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
-			// The device_id can be provided via `device_id` or
-			// `org.matrix.msc3202.device_id` query parameter.
-			let sender_device =
-				if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
-					// Verify the device exists for this user
-					if services
-						.users
-						.get_device_metadata(&sender_user, device_id)
-						.await
-						.is_err()
-					{
-						return Err!(Request(Forbidden(
-							"Device does not exist for user or appservice cannot masquerade as \
-							 this device."
-						)));
-					}
-
-					Some(device_id.to_owned())
-				} else {
-					None
-				};
-
-			Ok(ClientIdentity::Appservice {
-				sender_user,
-				sender_device,
-				appservice_info: Box::new(appservice_info),
-			})
-		} else {
-			Err(Error::Request(
-				ErrorKind::UnknownToken(UnknownTokenErrorData::new()),
-				"Invalid token".into(),
-				StatusCode::UNAUTHORIZED,
-			))
-		}
+		verify_access_token(services, output, query, TypeId::of::<R>(), R::required_scopes())
+			.await
 	}
 }
 
 impl CheckAuth for AccessTokenOptional {
 	type Identity = Option<ClientIdentity>;
 
-	async fn verify<B: AsRef<[u8]> + Sync>(
+	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
-		request: &hyper::Request<B>,
+		_request: &hyper::Request<B>,
 		query: AuthQueryParams,
-		route: TypeId,
 	) -> Result<Self::Identity> {
 		match output {
-			| Some(token) =>
-				<AccessToken as CheckAuth>::verify(services, token, request, query, route)
-					.await
-					.map(Some),
+			| Some(token) => verify_access_token(
+				services,
+				token,
+				query,
+				TypeId::of::<R>(),
+				R::required_scopes(),
+			)
+			.await
+			.map(Some),
 			| None => Ok(None),
 		}
 	}
@@ -277,39 +199,29 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 impl CheckAuth for AppserviceToken {
 	type Identity = RegistrationInfo;
 
-	async fn verify<B: AsRef<[u8]> + Sync>(
+	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		_request: &hyper::Request<B>,
 		_query: AuthQueryParams,
-		_route: TypeId,
 	) -> Result<Self::Identity> {
-		if output.is_empty() {
-			return Err!(Request(Unauthorized("Missing access token.")));
-		}
-		let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
-			return Err!(Request(Unauthorized("Invalid appservice token.")));
-		};
-
-		Ok(appservice_info)
+		verify_appservice_access_token(services, output).await
 	}
 }
 
 impl CheckAuth for AppserviceTokenOptional {
 	type Identity = Option<RegistrationInfo>;
 
-	async fn verify<B: AsRef<[u8]> + Sync>(
+	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
-		request: &hyper::Request<B>,
-		query: AuthQueryParams,
-		route: TypeId,
+		_request: &hyper::Request<B>,
+		_query: AuthQueryParams,
 	) -> Result<Self::Identity> {
 		match output {
-			| Some(token) =>
-				<AppserviceToken as CheckAuth>::verify(services, token, request, query, route)
-					.await
-					.map(Some),
+			| Some(token) => verify_appservice_access_token(services, token)
+				.await
+				.map(Some),
 			| None => Ok(None),
 		}
 	}
@@ -318,12 +230,11 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 impl CheckAuth for NoAuthentication {
 	type Identity = ();
 
-	async fn verify<B: AsRef<[u8]> + Sync>(
+	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		_services: &Services,
 		_output: Self::Output,
 		_request: &hyper::Request<B>,
 		_query: AuthQueryParams,
-		_route: TypeId,
 	) -> Result<Self::Identity> {
 		Ok(())
 	}
@@ -332,31 +243,153 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 impl CheckAuth for NoAccessToken {
 	type Identity = Option<ClientIdentity>;
 
-	async fn verify<B: AsRef<[u8]> + Sync>(
+	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		_output: Self::Output,
 		request: &hyper::Request<B>,
 		query: AuthQueryParams,
-		route: TypeId,
 	) -> Result<Self::Identity> {
 		// We handle these the same as AccessTokenOptional
 		let token = AccessTokenOptional::extract_authentication(request).map_err(|err| {
 			err!(Request(Unauthorized(warn!("Failed to extract authorization: {}", err))))
 		})?;
 
-		// Check special access restrictions
-		if (route == TypeId::of::<client::profile::get_avatar_url::v3::Request>()
-			|| route == TypeId::of::<client::profile::get_display_name::v3::Request>()
-			|| route == TypeId::of::<client::profile::get_profile_field::v3::Request>()
-			|| route == TypeId::of::<client::profile::get_profile::v3::Request>())
-			&& services.config.require_auth_for_profile_requests
-			&& token.is_none()
-		{
-			return Err!(Request(Unauthorized(
-				"This server requires authentication to access user profiles."
-			)));
+		match token {
+			| Some(token) => verify_access_token(
+				services,
+				token,
+				query,
+				TypeId::of::<R>(),
+				// Assume that no scopes are required for these endpoints since
+				// ostensibly they don't require authentication
+				&[],
+			)
+			.await
+			.map(Some),
+			| None => Ok(None),
 		}
-
-		<AccessTokenOptional as CheckAuth>::verify(services, token, request, query, route).await
 	}
 }
+
+async fn verify_access_token(
+	services: &Services,
+	output: String,
+	query: AuthQueryParams,
+	route: TypeId,
+	required_scopes: &[OAuthClientScope],
+) -> Result<ClientIdentity> {
+	if let Some((sender_user, sender_device, status)) =
+		services.users.find_from_token(&output).await
+	{
+		// If the token is expired we return a soft logout
+		if matches!(status, AccessTokenStatus::Expired) {
+			return Err(Error::Request(
+				ErrorKind::UnknownToken(
+					assign!(UnknownTokenErrorData::new(), { soft_logout: true }),
+				),
+				"This access token has expired.".into(),
+				StatusCode::UNAUTHORIZED,
+			));
+		}
+
+		// Locked users can only use /logout and /logout/all
+		if services
+			.users
+			.is_locked(&sender_user)
+			.await
+			.is_ok_and(std::convert::identity)
+		{
+			if !(route == TypeId::of::<client::session::logout::v3::Request>()
+				|| route == TypeId::of::<client::session::logout_all::v3::Request>())
+			{
+				return Err!(Request(UserLocked("Your account is locked.")));
+			}
+		}
+
+		// If this device is bound to an OAuth session, check its scopes. This will also
+		// handle admin-only endpoints for OAuth clients.
+		if let Some(session) = services
+			.oauth
+			.get_session_info_for_device(&sender_user, &sender_device)
+			.await
+		{
+			if required_scopes
+				.iter()
+				.all(|scope| !session.scopes.contains(scope))
+			{
+				return Err!(Request(Forbidden(
+					"You don't have the necessary scopes to use this endpoint."
+				)));
+			}
+		} else {
+			// Otherwise, explicitly check if the endpoint is restricted to admins only.
+			if required_scopes.contains(&OAuthClientScope::ServerAdministration)
+				&& !services.users.is_admin(&sender_user).await
+			{
+				return Err!(Request(Forbidden(
+					"Only server administrators can use this endpoint."
+				)));
+			}
+		}
+
+		Ok(ClientIdentity::User { sender_user, sender_device })
+	} else if let Ok(appservice_info) = services.appservice.find_from_token(&output).await {
+		let Ok(sender_user) = query.user_id.clone().map_or_else(
+			|| {
+				UserId::parse_with_server_name(
+					appservice_info.registration.sender_localpart.as_str(),
+					services.globals.server_name(),
+				)
+			},
+			UserId::parse,
+		) else {
+			return Err!(Request(InvalidUsername("Username is invalid.")));
+		};
+
+		if !appservice_info.is_user_match(&sender_user) {
+			return Err!(Request(Exclusive("User is not in this appservice's namespace.")));
+		}
+
+		// MSC3202/MSC4190: Handle device_id masquerading for appservices.
+		// The device_id can be provided via `device_id` or
+		// `org.matrix.msc3202.device_id` query parameter.
+		let sender_device = if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
+			// Verify the device exists for this user
+			if services
+				.users
+				.get_device_metadata(&sender_user, device_id)
+				.await
+				.is_err()
+			{
+				return Err!(Request(Forbidden("Appservice cannot masquerade as this device.")));
+			}
+
+			Some(device_id.to_owned())
+		} else {
+			None
+		};
+
+		Ok(ClientIdentity::Appservice {
+			sender_user,
+			sender_device,
+			appservice_info: Box::new(appservice_info),
+		})
+	} else {
+		Err(Error::Request(
+			ErrorKind::UnknownToken(UnknownTokenErrorData::new()),
+			"Invalid access token.".into(),
+			StatusCode::UNAUTHORIZED,
+		))
+	}
+}
+
+async fn verify_appservice_access_token(
+	services: &Services,
+	output: String,
+) -> Result<RegistrationInfo> {
+	let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
+		return Err!(Request(Unauthorized("Invalid appservice token.")));
+	};
+
+	Ok(appservice_info)
+}

src/core/config/mod.rs

@@ -2442,7 +2442,6 @@ pub struct OauthConfig {
 	///   legacy authentication will be unable to log in.
 	///
 	/// default: "hybrid"
-	#[serde(default)]
 	compatibility_mode: OAuthMode,
 
 	/// display: hidden

src/core/matrix/versions.rs

@@ -41,5 +41,7 @@ pub fn unstable_features() -> BTreeMap<String, bool> {
 		("org.matrix.msc4155".to_owned(), true),
 		// profile change propagation (https://github.com/matrix-org/matrix-spec-proposals/pull/4466)
 		("computer.gingershaped.msc4466".to_owned(), true),
+		// server admin oauth scope (https://github.com/matrix-org/matrix-spec-proposals/pull/4484)
+		("org.continuwuity.msc4484.unstable".to_owned(), true),
 	])
 }

src/main/Cargo.toml

@@ -68,6 +68,7 @@ full = [
     "jemalloc_prof",
     "perf_measurements",
     "tokio_console",
+	"conduwuit-api/admin_api",
 ]
 
 brotli_compression = [

src/ruminuwuity/admin/continuwuity/mod.rs

@@ -1 +1,2 @@
 pub mod rooms;
+pub mod users;

src/ruminuwuity/admin/continuwuity/rooms/ban.rs

@@ -1,7 +1,7 @@
 pub mod v1 {
 	use ruma::{
 		OwnedRoomAliasId, OwnedRoomId, OwnedUserId,
-		api::{auth_scheme::AccessToken, request, response},
+		api::{OAuthClientScope, auth_scheme::AccessToken, request, response},
 		metadata,
 	};
 
@@ -9,8 +9,10 @@ pub mod v1 {
 		method: PUT,
 		rate_limited: false,
 		authentication: AccessToken,
+		required_scopes: [OAuthClientScope::ServerAdministration],
 		history: {
-			1.0 => "/_continuwuity/admin/rooms/{room_id}/ban",
+			unstable("org.continuwuity.admin") => "/_continuwuity/admin/rooms/{room_id}/ban",
+			1.0 => "/_continuwuity/admin/v1/rooms/{room_id}/ban",
 		}
 	}
 
@@ -29,8 +31,11 @@ pub struct Request {
 
 	#[response]
 	pub struct Response {
+		/// Users who were successfully kicked from this room.
 		pub kicked_users: Vec<OwnedUserId>,
+		/// Users who could not be kicked from the room.
 		pub failed_kicked_users: Vec<OwnedUserId>,
+		/// Any local aliases that were removed from the room.
 		pub local_aliases: Vec<OwnedRoomAliasId>,
 	}
 

src/ruminuwuity/admin/continuwuity/rooms/list.rs

@@ -1,7 +1,7 @@
-pub mod v1 {
+pub mod unstable {
 	use ruma::{
 		OwnedRoomId,
-		api::{auth_scheme::AccessToken, request, response},
+		api::{OAuthClientScope, auth_scheme::AccessToken, request, response},
 		metadata,
 	};
 
@@ -9,8 +9,9 @@ pub mod v1 {
 		method: GET,
 		rate_limited: false,
 		authentication: AccessToken,
+		required_scopes: [OAuthClientScope::ServerAdministration],
 		history: {
-			1.0 => "/_continuwuity/admin/rooms/list",
+			unstable => "/_continuwuity/admin/rooms/list",
 		}
 	}
 
@@ -20,6 +21,7 @@ pub mod v1 {
 
 	#[response]
 	pub struct Response {
+		/// A list of room IDs known to this server.
 		pub rooms: Vec<OwnedRoomId>,
 	}
 
@@ -33,3 +35,133 @@ impl Response {
 		pub fn new(rooms: Vec<OwnedRoomId>) -> Self { Self { rooms } }
 	}
 }
+
+pub mod v1 {
+	use ruma::{
+		OwnedRoomId, OwnedUserId, RoomVersionId,
+		api::{auth_scheme::AccessToken, request, response},
+		events::room::{
+			canonical_alias::PossiblyRedactedRoomCanonicalAliasEventContent,
+			history_visibility::PossiblyRedactedRoomHistoryVisibilityEventContent,
+			join_rules::PossiblyRedactedRoomJoinRulesEventContent,
+			name::PossiblyRedactedRoomNameEventContent,
+			topic::PossiblyRedactedRoomTopicEventContent,
+		},
+		metadata,
+		serde::{default_true, is_default},
+	};
+
+	metadata! {
+		method: GET,
+		rate_limited: false,
+		authentication: AccessToken,
+		history: {
+			1.0 => "/_continuwuity/admin/v1/rooms",
+		}
+	}
+
+	#[request]
+	#[derive(Default)]
+	pub struct Request {
+		/// The maximum number of results to return in this page. Maximum (and
+		/// default) is 100.
+		#[ruma_api(query)]
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub limit: Option<usize>,
+
+		/// The number of results to skip over before returning results. Default
+		/// is 0.
+		#[ruma_api(query)]
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub offset: Option<usize>,
+
+		/// If true, includes banned rooms in the response.
+		#[ruma_api(query)]
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub include_banned_rooms: bool,
+	}
+
+	#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
+	pub struct MinimalRoomInfo {
+		/// The room's unique ID.
+		pub room_id: OwnedRoomId,
+		/// If true, this room is banned, and cannot be joined by non-admins.
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub banned: bool,
+		/// If true, this room has federation disabled, but can still be locally
+		/// used.
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub disabled: bool,
+		/// The total number of joined members in this room.
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub member_count: usize,
+		/// The total number of joined members in this room that are local to
+		/// this server.
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub local_member_count: usize,
+		/// The number of unique homeservers currently joined to this room.
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub resident_server_count: usize,
+		/// The users who created this room.
+		///
+		/// The first entry is always the sender of the `m.room.create` event.
+		/// Any entries thereafter are additional creators in v12+ rooms. An
+		/// empty vec indicates the room is not known.
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub creators: Vec<OwnedUserId>,
+		/// If true, this room has encryption enabled.
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub encrypted: bool,
+		/// If true, this room is allowed to be federated (`m.federate` is not
+		/// `false` in `m.room.create`).
+		#[serde(default = "default_true", skip_serializing_if = "is_default")]
+		pub federated: bool,
+		/// If true, this room is published to this server's room directory.
+		#[serde(default, skip_serializing_if = "is_default")]
+		pub published: bool,
+		/// The version of the room.
+		pub version: RoomVersionId,
+		/// The event content for the `m.room.name` event, if any is present.
+		/// May be redacted.
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		pub name: Option<PossiblyRedactedRoomNameEventContent>,
+		/// The event content for the `m.room.topic` event, if any is present.
+		/// May be redacted.
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		pub topic: Option<PossiblyRedactedRoomTopicEventContent>,
+		/// The event content for the `m.room.canonical_alias` event, if any is
+		/// present. May be redacted.
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		pub canonical_alias: Option<PossiblyRedactedRoomCanonicalAliasEventContent>,
+		/// The event content for the `m.room.join_rules` event, if any is
+		/// present. May be redacted.
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		pub join_rules: Option<PossiblyRedactedRoomJoinRulesEventContent>,
+		/// The event content for the `m.room.history_visibility` event, if any
+		/// is present. May be redacted.
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		pub history_visibility: Option<PossiblyRedactedRoomHistoryVisibilityEventContent>,
+		/// The ID of the room which replaces this one, if any.
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		pub successor: Option<OwnedRoomId>,
+		/// The ID of the room which preceded this one, if any.
+		#[serde(default, skip_serializing_if = "Option::is_none")]
+		pub predecessor: Option<OwnedRoomId>,
+	}
+
+	#[response]
+	pub struct Response {
+		/// A list of rooms known to this server.
+		pub rooms: Vec<MinimalRoomInfo>,
+	}
+
+	impl Request {
+		#[must_use]
+		pub fn new() -> Self { Self::default() }
+	}
+
+	impl Response {
+		#[must_use]
+		pub fn new(rooms: Vec<MinimalRoomInfo>) -> Self { Self { rooms } }
+	}
+}

src/ruminuwuity/admin/continuwuity/users/create.rs

@@ -0,0 +1,105 @@
+pub mod v1 {
+	use ruma::{
+		OwnedMxcUri, OwnedRoomOrAliasId, OwnedUserId,
+		api::{OAuthClientScope, auth_scheme::AccessToken, request, response},
+		metadata,
+	};
+
+	metadata! {
+		method: POST,
+		rate_limited: false,
+		authentication: AccessToken,
+		required_scopes: [OAuthClientScope::ServerAdministration],
+		history: {
+			1.0 => "/_continuwuity/admin/v1/users/create",
+		},
+	}
+
+	#[request]
+	pub struct Request {
+		/// The user's localpart (the identifier between `@` and `:`). Cannot be
+		/// blank.
+		pub localpart: String,
+
+		/// The user's desired password. Cannot be blank.
+		pub password: String,
+
+		/// The user's email address, if any.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub email: Option<String>,
+
+		/// The display name to set upon creation.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub display_name: Option<String>,
+
+		/// The avatar URI to set upon creation.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub avatar_url: Option<OwnedMxcUri>,
+
+		/// Suspends the user immediately upon creation. They can still log in.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub suspended: bool,
+
+		/// Locks the user immediately upon creation. They will receive
+		/// M_USER_LOCKED upon login.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub locked: bool,
+
+		/// Disables the user's login immediately upon creation.
+		///
+		/// The user can still be used if an admin generates an access token for
+		/// the account, but the user will not be able to use `POST
+		/// /_matrix/client/v3/login`.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub login_disabled: bool,
+
+		/// Promotes the user to a server administrator immediately upon
+		/// creation.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub admin: bool,
+
+		/// Skips joining rooms in the server's configured auto_join_rooms.
+		///
+		/// If this is false, all rooms in the config.toml's `auto_join_rooms`
+		/// will be automatically joined upon creation. If `auto_join_rooms`
+		/// is supplied in this request too, those rooms will be joined
+		/// afterwards.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub skip_auto_join: bool,
+
+		/// Additional rooms to auto-join the new user to. If `skip_auto_join`
+		/// is `true`, these rooms will still be joined.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub auto_join_rooms: Vec<OwnedRoomOrAliasId>,
+	}
+
+	#[response]
+	pub struct Response {
+		/// The fully qualified user ID of the newly created user.
+		pub user_id: OwnedUserId,
+	}
+
+	impl Request {
+		#[must_use]
+		pub fn new(localpart: String, password: String) -> Self {
+			Self {
+				localpart,
+				password,
+				email: None,
+				display_name: None,
+				avatar_url: None,
+				suspended: false,
+				locked: false,
+				login_disabled: false,
+				admin: false,
+				skip_auto_join: false,
+				auto_join_rooms: Vec::new(),
+			}
+		}
+	}
+
+	impl Response {
+		#[must_use]
+		pub fn new(user_id: OwnedUserId) -> Self { Self { user_id } }
+	}
+}

src/ruminuwuity/admin/continuwuity/users/list.rs

@@ -0,0 +1,139 @@
+pub mod v1 {
+	use ruma::{
+		OwnedUserId,
+		api::{OAuthClientScope, auth_scheme::AccessToken, request, response},
+		metadata,
+	};
+	use serde::Deserialize;
+
+	metadata! {
+		method: GET,
+		rate_limited: false,
+		authentication: AccessToken,
+		required_scopes: [OAuthClientScope::ServerAdministration],
+		history: {
+			1.0 => "/_continuwuity/admin/v1/users",
+		}
+	}
+
+	#[request]
+	#[derive(Default)]
+	pub struct Request {
+		/// If true, includes deactivated users in the response.
+		#[ruma_api(query)]
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub include_deactivated: bool,
+		/// If true, includes locked users in the response.
+		#[ruma_api(query)]
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub include_locked: bool,
+		/// If true, includes suspended users in the response.
+		#[ruma_api(query)]
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub include_suspended: bool,
+
+		/// The maximum number of results to return in this page. Maximum (and
+		/// default) is 100.
+		#[ruma_api(query)]
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub limit: Option<usize>,
+
+		/// The number of results to skip over before returning results. Default
+		/// is 0.
+		#[ruma_api(query)]
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub offset: Option<usize>,
+	}
+
+	#[derive(Debug, Clone, PartialEq, Eq, Deserialize, serde::Serialize)]
+	pub struct User {
+		/// The full user ID of the user.
+		pub user_id: OwnedUserId,
+
+		/// Whether this user is deactivated.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub deactivated: bool,
+
+		/// Whether this user is suspended.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub suspended: bool,
+
+		/// Whether this user is locked.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub locked: bool,
+
+		/// Whether this user is an admin.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub admin: bool,
+
+		/// Whether this user has their login disabled.
+		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
+		pub login_disabled: bool,
+	}
+
+	impl User {
+		#[must_use]
+		pub fn new(user_id: OwnedUserId) -> Self {
+			Self {
+				user_id,
+				deactivated: false,
+				suspended: false,
+				locked: false,
+				admin: false,
+				login_disabled: false,
+			}
+		}
+	}
+
+	#[response]
+	#[derive(Default)]
+	pub struct Response {
+		pub users: Vec<User>,
+	}
+
+	impl Request {
+		#[must_use]
+		pub fn new() -> Self { Self::default() }
+	}
+
+	impl Response {
+		#[must_use]
+		pub fn new(users: Vec<User>) -> Self { Self { users } }
+	}
+
+	#[cfg(test)]
+	mod tests {
+		use assign::assign;
+		use serde_json::json;
+
+		use super::*;
+
+		#[test]
+		fn request_defaults() {
+			let req = Request::new();
+			assert!(!req.include_deactivated && !req.include_locked && !req.include_suspended);
+		}
+
+		#[test]
+		fn user_serialize_omits_default_values() {
+			let user_id = OwnedUserId::try_from("@alice:example.org".to_owned()).unwrap();
+			let user = User::new(user_id.clone());
+
+			let expected = json!({ "user_id": user_id.to_string() });
+			assert_eq!(serde_json::to_value(&user).expect("failed to serialize user"), expected);
+
+			let suspended_user = assign!(user, {suspended: true});
+			let expected2 = json!({ "user_id": "@alice:example.org", "suspended": true});
+			assert_eq!(
+				serde_json::to_value(&suspended_user).expect("failed to serialize user"),
+				expected2
+			);
+		}
+
+		#[test]
+		fn response_defaults() {
+			let response = Response::default();
+			assert!(response.users.is_empty());
+		}
+	}
+}

src/ruminuwuity/admin/continuwuity/users/mod.rs

@@ -0,0 +1,2 @@
+pub mod create;
+pub mod list;

src/ruminuwuity/admin/get_suspended.rs

@@ -1,53 +0,0 @@
-//! `GET /_matrix/client/v1/admin/suspend/{userId}`
-//!
-//! Check the suspension status of a target user
-
-pub mod v1 {
-	//! `/_matrix/client/unstable/uk.timedout.msc4323/admin/suspend/{userID}`
-	//! ([msc])
-	//!
-	//! [msc]: https://github.com/matrix-org/matrix-spec-proposals/pull/4323
-
-	use ruma::{
-		OwnedUserId,
-		api::{auth_scheme::AccessToken, request, response},
-		metadata,
-	};
-
-	metadata! {
-		method: GET,
-		rate_limited: false,
-		authentication: AccessToken,
-		history: {
-			unstable => "/_matrix/client/unstable/uk.timedout.msc4323/admin/suspend/{user_id}",
-			1.18 => "/_matrix/client/v1/admin/suspend/{user_id}",
-		}
-	}
-
-	/// Request type for the get & set user suspension status endpoint.
-	#[request(error = ruma::api::error::Error)]
-	pub struct Request {
-		/// The user to look up.
-		#[ruma_api(path)]
-		pub user_id: OwnedUserId,
-	}
-
-	/// Response type for the suspension endpoints
-	#[response(error = ruma::api::error::Error)]
-	pub struct Response {
-		/// Whether the user is currently suspended.
-		pub suspended: bool,
-	}
-
-	impl Request {
-		/// Creates a new `Request` with the given user id.
-		#[must_use]
-		pub fn new(user_id: OwnedUserId) -> Self { Self { user_id } }
-	}
-
-	impl Response {
-		/// Creates a new `Response` with the given suspension status.
-		#[must_use]
-		pub fn new(suspended: bool) -> Self { Self { suspended } }
-	}
-}

src/ruminuwuity/admin/mod.rs

@@ -1,3 +1 @@
 pub mod continuwuity;
-pub mod get_suspended;
-pub mod set_suspended;

src/ruminuwuity/admin/set_suspended.rs

@@ -1,55 +0,0 @@
-//! `PUT /_matrix/client/v1/admin/suspend/{userId}`
-//!
-//! Set the suspension status of a target user
-
-pub mod v1 {
-	//! `/_matrix/client/unstable/uk.timedout.msc4323/admin/suspend/{userID}`
-	//! ([msc])
-	//!
-	//! [msc]: https://github.com/matrix-org/matrix-spec-proposals/pull/4323
-
-	use ruma::{
-		OwnedUserId,
-		api::{auth_scheme::AccessToken, request, response},
-		metadata,
-	};
-
-	metadata! {
-		method: PUT,
-		rate_limited: false,
-		authentication: AccessToken,
-		history: {
-			unstable => "/_matrix/client/unstable/uk.timedout.msc4323/admin/suspend/{user_id}",
-			1.18 => "/_matrix/client/v1/admin/suspend/{user_id}",
-		}
-	}
-
-	/// Request type for the set user suspension status endpoint.
-	#[request(error = ruma::api::error::Error)]
-	pub struct Request {
-		/// The user to look up.
-		#[ruma_api(path)]
-		pub user_id: OwnedUserId,
-
-		pub suspended: bool,
-	}
-
-	/// Response type for the suspension endpoints
-	#[response(error = ruma::api::error::Error)]
-	pub struct Response {
-		/// Whether the user is currently suspended.
-		pub suspended: bool,
-	}
-
-	impl Request {
-		/// Creates a new `Request` with the given user id.
-		#[must_use]
-		pub fn new(user_id: OwnedUserId, suspended: bool) -> Self { Self { user_id, suspended } }
-	}
-
-	impl Response {
-		/// Creates a new `Response` with the given suspension status.
-		#[must_use]
-		pub fn new(suspended: bool) -> Self { Self { suspended } }
-	}
-}

src/service/oauth/grant.rs

@@ -8,7 +8,7 @@
 };
 
 use regex::Regex;
-use ruma::OwnedDeviceId;
+use ruma::{OwnedDeviceId, api::OAuthClientScope};
 use serde::{Deserialize, Serialize};
 use url::Url;
 
@@ -55,26 +55,40 @@ pub enum Prompt {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, PartialOrd, Ord)]
-pub enum Scope {
+pub enum RequestedScope {
 	Device(OwnedDeviceId),
-	ClientApi,
+	ApiFullAccess,
+	ServerAdministration,
 }
 
-impl PartialEq for Scope {
+impl RequestedScope {
+	#[must_use]
+	pub fn as_granted_scope(&self) -> Option<OAuthClientScope> {
+		match self {
+			| Self::ApiFullAccess => Some(OAuthClientScope::ApiFullAccess),
+			| Self::ServerAdministration => Some(OAuthClientScope::ServerAdministration),
+			| Self::Device(_) => None,
+		}
+	}
+}
+
+impl PartialEq for RequestedScope {
 	fn eq(&self, other: &Self) -> bool { discriminant(self) == discriminant(other) }
 }
 
-impl Eq for Scope {}
+impl Eq for RequestedScope {}
 
-impl Hash for Scope {
+impl Hash for RequestedScope {
 	fn hash<H: std::hash::Hasher>(&self, state: &mut H) { discriminant(self).hash(state); }
 }
 
-impl Display for Scope {
+impl Display for RequestedScope {
 	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
 		let urn = match self {
-			| Self::ClientApi => "urn:matrix:client:api:*".to_owned(),
+			| Self::ApiFullAccess => "urn:matrix:client:api:*".to_owned(),
 			| Self::Device(device_id) => format!("urn:matrix:client:device:{device_id}"),
+			| Self::ServerAdministration =>
+				"urn:matrix:client:cc.c10y.msc4484.server_administration".to_owned(),
 		};
 
 		f.write_str(&urn)
@@ -85,22 +99,27 @@ fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
 pub struct RawScopes(String);
 
 impl RawScopes {
-	pub fn to_scopes(&self) -> Result<BTreeSet<Scope>, String> {
-		let client_api_token_regex =
+	pub fn to_scopes(&self) -> Result<BTreeSet<RequestedScope>, String> {
+		let full_access_regex =
 			Regex::new(r"urn:matrix:(client|org.matrix.msc2967.client):api:\*").unwrap();
 		let device_token_regex = Regex::new(
 			r"urn:matrix:(client|org.matrix.msc2967.client):device:([a-zA-Z0-9-._~]{5,})",
 		)
 		.unwrap();
+		let server_administration_regex =
+			Regex::new(r"urn:matrix:client:cc.c10y.msc4484.server_administration").unwrap();
 
 		let mut scopes = BTreeSet::new();
 
 		for token in self.0.split(' ') {
 			let scope_was_new = {
-				if client_api_token_regex.is_match(token) {
-					scopes.insert(Scope::ClientApi)
+				if full_access_regex.is_match(token) {
+					scopes.insert(RequestedScope::ApiFullAccess)
 				} else if let Some(captures) = device_token_regex.captures(token) {
-					scopes.insert(Scope::Device(captures.get(2).unwrap().as_str().into()))
+					scopes
+						.insert(RequestedScope::Device(captures.get(2).unwrap().as_str().into()))
+				} else if server_administration_regex.is_match(token) {
+					scopes.insert(RequestedScope::ServerAdministration)
 				} else if token == "openid" {
 					// TODO(unspecced): Element sets this scope but doesn't use it for anything
 					true
@@ -160,8 +179,15 @@ pub enum ErrorCode {
 	InvalidClientMetadata,
 }
 
+#[derive(Serialize)]
+#[serde(untagged)]
+pub enum AuthorizationCodeResponse {
+	Success(AuthorizationCodeData),
+	Error(OAuthError),
+}
+
 #[derive(Serialize, Deserialize)]
-pub struct AuthorizationCodeResponse {
+pub struct AuthorizationCodeData {
 	pub state: String,
 	pub code: String,
 }

src/service/oauth/mod.rs

@@ -12,7 +12,7 @@
 use database::{Deserialized, Json, Map};
 use itertools::Itertools;
 use lru_cache::LruCache;
-use ruma::{DeviceId, OwnedDeviceId, OwnedUserId, UserId};
+use ruma::{DeviceId, OwnedDeviceId, OwnedUserId, UserId, api::OAuthClientScope};
 use serde::{Deserialize, Serialize};
 use url::Url;
 
@@ -21,8 +21,9 @@
 	oauth::{
 		client_metadata::{ApplicationType, ClientMetadata, ResponseType},
 		grant::{
-			AuthorizationCodeQuery, AuthorizationCodeResponse, CodeChallengeMethod, ErrorCode,
-			OAuthError, ResponseMode, Scope, TokenRequest, TokenResponse, TokenType,
+			AuthorizationCodeData, AuthorizationCodeQuery, AuthorizationCodeResponse,
+			CodeChallengeMethod, ErrorCode, OAuthError, RequestedScope, ResponseMode,
+			TokenRequest, TokenResponse, TokenType,
 		},
 	},
 	users,
@@ -51,7 +52,7 @@ struct Services {
 #[derive(Debug, Deserialize, Serialize)]
 pub struct SessionInfo {
 	pub client_id: String,
-	pub scopes: BTreeSet<Scope>,
+	pub scopes: BTreeSet<OAuthClientScope>,
 	current_refresh_token: String,
 }
 
@@ -64,7 +65,7 @@ struct RefreshTokenInfo {
 
 struct PendingCodeGrant {
 	authorizing_user: OwnedUserId,
-	requested_scopes: BTreeSet<Scope>,
+	requested_scopes: BTreeSet<RequestedScope>,
 	client_name: Option<String>,
 	expected_client_id: String,
 	expected_redirect_uri: Url,
@@ -224,49 +225,59 @@ pub async fn request_authorization_code(
 			}
 		}
 
-		let requested_scopes = query.scope.to_scopes()?;
-
 		let redirect_uri_query_separator = match query.response_mode {
 			| ResponseMode::Fragment => '#',
 			| ResponseMode::Query => '?',
 		};
 
-		let code = PendingCodeGrant::generate_code();
+		let response = 'response: {
+			let requested_scopes = query.scope.to_scopes()?;
 
-		info!(
-			client_id = &query.client_id,
-			client_name = &client_metadata.client_name,
-			?requested_scopes,
-			?authorizing_user,
-			"Issuing oauth authorization code"
-		);
+			if requested_scopes.contains(&RequestedScope::ServerAdministration) {
+				// Only server admins can request this scope
+				if !self.services.users.is_admin(&authorizing_user).await {
+					break 'response AuthorizationCodeResponse::Error(OAuthError {
+						error: ErrorCode::AccessDenied,
+						error_description: "You are not a server administrator.".into(),
+					});
+				}
+			}
+
+			let code = PendingCodeGrant::generate_code();
+
+			info!(
+				client_id = &query.client_id,
+				client_name = &client_metadata.client_name,
+				?requested_scopes,
+				?authorizing_user,
+				"Issuing oauth authorization code"
+			);
+
+			let pending_grant = PendingCodeGrant {
+				authorizing_user,
+				requested_scopes,
+				client_name: client_metadata.client_name,
+				expected_client_id: query.client_id,
+				expected_redirect_uri: query.redirect_uri.clone(),
+				code_challenge: query.code_challenge,
+				requested_at: SystemTime::now(),
+			};
+
+			self.pending_code_grants
+				.lock()
+				.await
+				.insert(code.clone(), pending_grant);
+
+			AuthorizationCodeResponse::Success(AuthorizationCodeData { state: query.state, code })
+		};
 
 		let redirect_uri = format!(
 			"{}{}{}",
 			query.redirect_uri,
 			redirect_uri_query_separator,
-			serde_urlencoded::to_string(AuthorizationCodeResponse {
-				state: query.state,
-				code: code.clone(),
-			})
-			.unwrap(),
+			serde_urlencoded::to_string(response).unwrap(),
 		);
 
-		let pending_grant = PendingCodeGrant {
-			authorizing_user,
-			requested_scopes,
-			client_name: client_metadata.client_name,
-			expected_client_id: query.client_id,
-			expected_redirect_uri: query.redirect_uri,
-			code_challenge: query.code_challenge,
-			requested_at: SystemTime::now(),
-		};
-
-		self.pending_code_grants
-			.lock()
-			.await
-			.insert(code, pending_grant);
-
 		Ok(redirect_uri)
 	}
 
@@ -339,7 +350,7 @@ pub async fn revoke_token(&self, token: String) -> Result<(), OAuthError> {
 	async fn create_session(
 		&self,
 		authorizing_user: OwnedUserId,
-		requested_scopes: BTreeSet<Scope>,
+		requested_scopes: BTreeSet<RequestedScope>,
 		client_name: Option<String>,
 		client_id: String,
 	) -> Result<TokenResponse, OAuthError> {
@@ -349,7 +360,7 @@ async fn create_session(
 		let device_id = requested_scopes
 			.iter()
 			.find_map(|scope| {
-				if let Scope::Device(device_id) = scope {
+				if let RequestedScope::Device(device_id) = scope {
 					Some(device_id)
 				} else {
 					None
@@ -391,7 +402,10 @@ async fn create_session(
 			Json(SessionInfo {
 				client_id: client_id.clone(),
 				current_refresh_token: refresh_token.clone(),
-				scopes: requested_scopes.clone(),
+				scopes: requested_scopes
+					.iter()
+					.filter_map(RequestedScope::as_granted_scope)
+					.collect(),
 			}),
 		);
 

src/service/oidc/mod.rs

@@ -33,7 +33,7 @@
 
 use crate::{
 	Dep, config, globals, media,
-	oauth::grant::AuthorizationCodeResponse,
+	oauth::grant::AuthorizationCodeData,
 	threepid,
 	users::{self, AccountStatus, ProfileFieldChange},
 };
@@ -245,7 +245,7 @@ pub async fn begin_session(&self, prompt: Option<CoreAuthPrompt>) -> (PendingSes
 	pub async fn exchange_code(
 		&self,
 		session: PendingSession,
-		response: AuthorizationCodeResponse,
+		response: AuthorizationCodeData,
 	) -> Result<Claims, &'static str> {
 		let Some(OidcClient { machine, client, .. }) = self.client.as_ref() else {
 			return Err("Delegated authentication is not enabled on this server.");

src/service/sending/appservice.rs

@@ -6,8 +6,7 @@
 };
 use ruma::api::{
 	IncomingResponse, OutgoingRequest,
-	appservice::Registration,
-	auth_scheme::{AccessToken, SendAccessToken},
+	appservice::{HomeserverToken, Registration},
 	path_builder::SinglePath,
 };
 
@@ -22,7 +21,9 @@ pub async fn send_appservice_request<T>(
 		request: T,
 	) -> Result<Option<T::IncomingResponse>>
 	where
-		T: OutgoingRequest<Authentication = AccessToken, PathBuilder = SinglePath> + Debug + Send,
+		T: OutgoingRequest<Authentication = HomeserverToken, PathBuilder = SinglePath>
+			+ Debug
+			+ Send,
 	{
 		let Some(dest) = registration.url else {
 			return Ok(None);
@@ -36,7 +37,7 @@ pub async fn send_appservice_request<T>(
 
 		let hs_token = registration.hs_token.as_str();
 		let mut http_request = request
-			.try_into_http_request::<BytesMut>(&dest, SendAccessToken::Appservice(hs_token), ())
+			.try_into_http_request::<BytesMut>(&dest, hs_token, ())
 			.map_err(|e| {
 				err!(BadServerResponse(
 					warn!(appservice = %registration.id, "Failed to find destination {dest}: {e:?}")

src/service/users/account.rs

@@ -197,7 +197,7 @@ pub async fn create_local_account(
 		// register, suspend them.
 		if !was_first_user && self.services.config.suspend_on_register {
 			// Note that we can still do auto joins for suspended users
-			self.suspend_account(user_id, &self.services.globals.server_user)
+			self.suspend_account(user_id, Some(&self.services.globals.server_user))
 				.await;
 
 			// And send an @room notice to the admin room, to prompt admins to review the
@@ -389,13 +389,13 @@ pub async fn deactivate_account(&self, user_id: &UserId) -> Result<()> {
 	}
 
 	/// Suspend account, placing it in a read-only state
-	pub async fn suspend_account(&self, user_id: &UserId, suspending_user: &UserId) {
+	pub async fn suspend_account(&self, user_id: &UserId, suspending_user: Option<&UserId>) {
 		self.db.userid_suspension.raw_put(
 			user_id,
 			Json(UserSuspension {
 				suspended: true,
 				suspended_at: MilliSecondsSinceUnixEpoch::now().get().into(),
-				suspended_by: suspending_user.to_string(),
+				suspended_by: suspending_user.map(ToString::to_string),
 			}),
 		);
 	}
@@ -406,7 +406,7 @@ pub async fn unsuspend_account(&self, user_id: &UserId) {
 	}
 
 	/// Locks an account, preventing it being used until it is unlocked.
-	pub async fn lock_account(&self, user_id: &UserId, locking_user: &UserId) {
+	pub async fn lock_account(&self, user_id: &UserId, locking_user: Option<&UserId>) {
 		// NOTE: Locking is basically just suspension with a more severe effect,
 		// so we'll just re-use the suspension data structure to store the lock state.
 		let suspension = self
@@ -418,7 +418,7 @@ pub async fn lock_account(&self, user_id: &UserId, locking_user: &UserId) {
 			.unwrap_or_else(|_| UserSuspension {
 				suspended: true,
 				suspended_at: MilliSecondsSinceUnixEpoch::now().get().into(),
-				suspended_by: locking_user.to_string(),
+				suspended_by: locking_user.map(ToString::to_string),
 			});
 
 		self.db.userid_lock.raw_put(user_id, Json(suspension));

src/service/users/mod.rs

@@ -31,7 +31,7 @@ pub struct UserSuspension {
 	/// When the user was suspended (Unix timestamp in milliseconds)
 	pub suspended_at: u64,
 	/// User ID of who suspended this user
-	pub suspended_by: String,
+	pub suspended_by: Option<String>,
 }
 
 /// A password hash. This is only for use when setting a user's password,

src/web/pages/components/mod.rs

@@ -3,12 +3,11 @@
 use askama::{Template, filters::HtmlSafe};
 use base64::Engine;
 use conduwuit_core::{result::FlatOk, utils};
-use conduwuit_service::{
-	Services,
-	media::mxc::Mxc,
-	oauth::{client_metadata::ClientMetadata, grant::Scope},
+use conduwuit_service::{Services, media::mxc::Mxc, oauth::client_metadata::ClientMetadata};
+use ruma::{
+	OwnedDeviceId, OwnedUserId, UserId,
+	api::{OAuthClientScope, client::device::Device},
 };
-use ruma::{OwnedDeviceId, OwnedUserId, UserId, api::client::device::Device};
 
 pub(super) mod form;
 
@@ -183,7 +182,7 @@ pub(super) async fn for_device(
 #[derive(Debug, Template)]
 #[template(path = "_components/client_scopes.html.j2")]
 pub(super) struct ClientScopes {
-	pub scopes: BTreeSet<Scope>,
+	pub scopes: BTreeSet<OAuthClientScope>,
 }
 
 impl HtmlSafe for ClientScopes {}

src/web/pages/oauth/grant.rs

@@ -4,7 +4,7 @@
 	response::Redirect,
 	routing::on,
 };
-use conduwuit_service::oauth::grant::{AuthorizationCodeQuery, Prompt};
+use conduwuit_service::oauth::grant::{AuthorizationCodeQuery, Prompt, RequestedScope};
 use ruma::OwnedUserId;
 use url::Url;
 
@@ -100,7 +100,13 @@ async fn route_authorization_code(
 		return Err(WebError::BadRequest("Invalid client ID".to_owned()));
 	};
 
-	let scopes = query.scope.to_scopes().map_err(WebError::BadRequest)?;
+	let scopes = query
+		.scope
+		.to_scopes()
+		.map_err(WebError::BadRequest)?
+		.iter()
+		.filter_map(RequestedScope::as_granted_scope)
+		.collect();
 
 	let client_name = if let Some(name) = &client.client_name {
 		name

src/web/pages/oidc/complete.rs

@@ -6,7 +6,7 @@
 	response::Redirect,
 	routing::on,
 };
-use conduwuit_service::{oauth::grant::AuthorizationCodeResponse, oidc::SessionCompletionStatus};
+use conduwuit_service::{oauth::grant::AuthorizationCodeData, oidc::SessionCompletionStatus};
 use futures::FutureExt;
 use ruma::{OwnedServerName, UserId};
 use serde::{Deserialize, de::IgnoredAny};
@@ -57,7 +57,7 @@ struct LoginForm {
 async fn route_complete(
 	State(services): State<crate::State>,
 	Extension(context): Extension<TemplateContext>,
-	Expect(Query(query)): Expect<Query<AuthorizationCodeResponse>>,
+	Expect(Query(query)): Expect<Query<AuthorizationCodeData>>,
 	session_store: Session,
 	user: User<true>,
 	PostForm(form): PostForm<LoginForm>,
@@ -107,7 +107,7 @@ async fn route_complete(
 			let supplied_user_id = if let Some(form) = form {
 				if let Ok(user_id) = UserId::parse(format!(
 					"@{}:{}",
-					&form.username,
+					form.username,
 					services.globals.server_name()
 				)) && services.users.status(&user_id).await.is_active()
 				{

src/web/pages/templates/_components/client_scopes.html.j2

@@ -1,10 +1,13 @@
 <ul>
     {% for scope in scopes %}
         {% match scope %}
-            {% when Scope::ClientApi %}
+            {% when OAuthClientScope::ApiFullAccess %}
                 <li>Send messages and interact with chatrooms on your behalf</li>
-            {% when Scope::Device(_) %}
-                <li>Access your Matrix account</li>
+            {% when OAuthClientScope::ServerAdministration %}
+                <li>⚠️ Administrate this homeserver
+                <br><em class="negative">This is a dangerous permission. Make sure you trust this app.</em></li>
+            {% when _ %}
+                <li>missingno</li>
         {% endmatch %}
     {% endfor %}
 </ul>