chore: News fragment

.forgejo/workflows/renovate.yml

@@ -43,7 +43,7 @@ jobs:
     name: Renovate
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/renovatebot/renovate:43.272.6@sha256:e9dee374e7a32827af434362c6e503aa179168a96a8212cc4a5c64bb5c550142
+      image: ghcr.io/renovatebot/renovate:43.281.1@sha256:34c2dd58f58e8976be2024a24fec23bbee805f0bf887837d9aaee7daeb09ccfc
       options: --tmpfs /tmp:exec
     steps:
       - name: Checkout

Cargo.toml

@@ -343,8 +343,8 @@ version = "1.1.1"
 # Used for matrix spec type definitions and helpers
 [workspace.dependencies.ruma]
 # version = "0.14.1"
-git = "https://github.com/gingershaped/ruwuma.git"
-rev = "66811f042b1bdc147dab3c45f697383e902f28c0"
+git = "https://github.com/ruma/ruma.git"
+rev = "3ad047126b321d5fdcf170e1f2e545fed820cf75"
 features = [
     "appservice-api-c",
     "client-api",
@@ -380,7 +380,6 @@ features = [
     "unstable-msc4406",
     "unstable-msc4439",
     "unstable-msc4466",
-    "unstable-msc4484",
     "unstable-extensible-events",
 ]
 
@@ -504,7 +503,7 @@ default-features = false
 version = "0.1"
 
 [workspace.dependencies.syn]
-version = "2.0"
+version = "3.0"
 default-features = false
 features = ["full", "extra-traits"]
 

changelog.d/1970.feature.md

@@ -0,0 +1 @@
+Dehydrated devices are now visible in the account panel. Contributed by @ginger.

changelog.d/2044.feature.md

@@ -0,0 +1 @@
+Added an admin command to issue an access token for a bot account, to allow legacy bots to function while legacy authentication is disabled.

changelog.d/2057.bugfix.md

@@ -0,0 +1 @@
+Re-introduced admin room registration alerts that were accidentally removed in the OAuth2 update.

src/admin/token/commands.rs

@@ -3,7 +3,7 @@
 use service::registration_tokens::TokenExpires;
 
 impl crate::Context<'_> {
-	pub(super) async fn issue_token(&self, expires: super::TokenExpires) -> Result {
+	pub(super) async fn issue_registration_token(&self, expires: super::TokenExpires) -> Result {
 		let expires = {
 			if expires.immortal {
 				None

src/admin/token/mod.rs

@@ -10,7 +10,7 @@
 pub enum TokenCommand {
 	/// Issue a new registration token
 	#[clap(name = "issue")]
-	IssueToken {
+	IssueRegistrationToken {
 		/// When this token will expire.
 		#[command(flatten)]
 		expires: TokenExpires,

src/admin/user/commands.rs

@@ -20,7 +20,7 @@
 		tag::{TagEvent, TagEventContent, TagInfo},
 	},
 };
-use service::users::{AccountStatus, HashedPassword};
+use service::users::{AccountStatus, DeviceToken, HashedPassword};
 
 use crate::{
 	get_room_info,
@@ -59,13 +59,42 @@ pub(super) async fn create_user(&self, username: String, password: Option<String
 
 		self.services
 			.users
-			.create_local_account(&user_id, Some(HashedPassword::new(password)?), None)
+			.create_local_account(
+				&user_id,
+				Some(HashedPassword::new(password)?),
+				None,
+				None,
+				None,
+			)
 			.await?;
 
 		self.write_str(&format!("Created user {user_id} with password `{password}`"))
 			.await
 	}
 
+	pub(super) async fn issue_access_token(&self, username: String, password: String) -> Result {
+		let user_id = parse_active_local_user_id(self.services, &username).await?;
+
+		let user_id = self
+			.services
+			.users
+			.check_password(&user_id, &password)
+			.await?;
+		let token = DeviceToken::new_random();
+
+		let device_id = self
+			.services
+			.users
+			.create_device(&user_id, None, Some(token.clone()), None, None)
+			.await?;
+
+		self.write_str(&format!(
+			"Created device `{device_id}` with access token `{}` for {user_id}",
+			token.into_token()
+		))
+		.await
+	}
+
 	pub(super) async fn deactivate(&self, no_leave_rooms: bool, user_id: String) -> Result {
 		// Validate user id
 		let user_id = parse_local_user_id(self.services, &user_id)?;
@@ -102,7 +131,6 @@ pub(super) async fn deactivate(&self, no_leave_rooms: bool, user_id: String) ->
 	}
 
 	pub(super) async fn suspend(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -115,7 +143,7 @@ pub(super) async fn suspend(&self, user_id: String) -> Result {
 		// TODO: Record the actual user that sent the suspension where possible
 		self.services
 			.users
-			.suspend_account(&user_id, self.sender)
+			.suspend_account(&user_id, self.sender_or_service_user())
 			.await;
 
 		self.write_str(&format!("User {user_id} has been suspended."))
@@ -123,7 +151,6 @@ pub(super) async fn suspend(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn unsuspend(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -935,7 +962,6 @@ pub(super) async fn force_leave_remote_room(
 	}
 
 	pub(super) async fn lock(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -948,7 +974,7 @@ pub(super) async fn lock(&self, user_id: String) -> Result {
 
 		self.services
 			.users
-			.lock_account(&user_id, self.sender)
+			.lock_account(&user_id, self.sender_or_service_user())
 			.await;
 
 		self.write_str(&format!("User {user_id} has been locked."))
@@ -956,7 +982,6 @@ pub(super) async fn lock(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn unlock(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		self.services.users.unlock_account(&user_id).await;
@@ -966,7 +991,6 @@ pub(super) async fn unlock(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn logout(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -992,7 +1016,6 @@ pub(super) async fn logout(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn disable_login(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -1011,7 +1034,6 @@ pub(super) async fn disable_login(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn enable_login(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		self.services.users.enable_login(&user_id);
@@ -1020,7 +1042,6 @@ pub(super) async fn enable_login(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn get_email(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_local_user_id(self.services, &user_id)?;
 
 		match self
@@ -1039,8 +1060,6 @@ pub(super) async fn get_email(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn get_user_by_email(&self, email: String) -> Result {
-		self.bail_restricted()?;
-
 		let Ok(email) = Address::try_from(email) else {
 			return Err!("Invalid email address.");
 		};
@@ -1063,8 +1082,6 @@ pub(super) async fn get_user_by_email(&self, email: String) -> Result {
 	}
 
 	pub(super) async fn change_email(&self, user_id: String, email: Option<String>) -> Result {
-		self.bail_restricted()?;
-
 		let user_id = parse_local_user_id(self.services, &user_id)?;
 		let Ok(new_email) = email.map(Address::try_from).transpose() else {
 			return Err!("Invalid email address.");

src/admin/user/mod.rs

@@ -18,6 +18,15 @@ pub enum UserCommand {
 		password: Option<String>,
 	},
 
+	/// Issue an access token for a user. This command will not work on
+	/// shadow users, such as appservice puppets or accounts imported from
+	/// an identity provider.
+	#[clap(name = "issue-token")]
+	IssueAccessToken {
+		username: String,
+		password: String,
+	},
+
 	/// Reset user password
 	ResetPassword {
 		/// Log out existing sessions

src/api/Cargo.toml

@@ -62,8 +62,6 @@ zstd_compression = [
 	"reqwest/zstd",
 ]
 
-admin_api = []
-
 [dependencies]
 async-trait.workspace = true
 axum-extra.workspace = true

src/api/admin/mod.rs

@@ -0,0 +1 @@
+pub mod rooms;

src/api/admin/rooms/ban.rs

@@ -6,7 +6,7 @@
 
 use crate::{Ruma, client::leave_room};
 
-/// # `PUT /_continuwuity/admin/v1/rooms/{roomID}/ban`
+/// # `PUT /_continuwuity/admin/rooms/{roomID}/ban`
 ///
 /// Bans or unbans a room.
 pub(crate) async fn ban_room(

src/api/admin/rooms/list.rs

@@ -0,0 +1,36 @@
+use axum::extract::State;
+use conduwuit::{Err, Result};
+use futures::StreamExt;
+use ruma::OwnedRoomId;
+use ruminuwuity::admin::continuwuity::rooms;
+
+use crate::Ruma;
+
+/// # `GET /_continuwuity/admin/rooms/list`
+///
+/// Lists all rooms known to this server, excluding banned ones.
+pub(crate) async fn list_rooms(
+	State(services): State<crate::State>,
+	body: Ruma<rooms::list::v1::Request>,
+) -> Result<rooms::list::v1::Response> {
+	let sender_user = body.identity.expect_sender_user()?;
+	if !services.users.is_admin(sender_user).await {
+		return Err!(Request(Forbidden("Only server administrators can use this endpoint")));
+	}
+
+	let mut rooms: Vec<OwnedRoomId> = services
+		.rooms
+		.metadata
+		.iter_ids()
+		.filter_map(|room_id| async move {
+			if !services.rooms.metadata.is_banned(&room_id).await {
+				Some(room_id.clone())
+			} else {
+				None
+			}
+		})
+		.collect()
+		.await;
+	rooms.sort();
+	Ok(rooms::list::v1::Response::new(rooms))
+}

src/api/admin/rooms/mod.rs

@@ -0,0 +1,2 @@
+pub mod ban;
+pub mod list;

src/api/client/account/mod.rs

@@ -25,7 +25,6 @@
 };
 use service::{mailer::messages, uiaa::UiaaInitiator, users::HashedPassword};
 
-use super::DEVICE_ID_LENGTH;
 use crate::{Ruma, router::ClientIdentity};
 
 pub(crate) mod register;

src/api/client/account/register.rs

@@ -1,10 +1,7 @@
 use std::collections::HashMap;
 
 use axum::extract::State;
-use conduwuit::{
-	Err, Result, debug_info, info,
-	utils::{self},
-};
+use conduwuit::{Err, Result, debug_info, info};
 use conduwuit_service::Services;
 use futures::StreamExt;
 use lettre::{Address, message::Mailbox};
@@ -24,7 +21,6 @@
 	users::{DeviceToken, HashedPassword},
 };
 
-use super::DEVICE_ID_LENGTH;
 use crate::{Ruma, client_ip::ClientIp};
 
 /// # `POST /_matrix/client/v3/register`
@@ -99,7 +95,13 @@ pub(crate) async fn register_route(
 
 		services
 			.users
-			.create_local_account(&user_id, Some(password), identity.email)
+			.create_local_account(
+				&user_id,
+				Some(password),
+				identity.email,
+				Some(&client),
+				body.initial_device_display_name.as_deref(),
+			)
 			.await?;
 
 		user_id
@@ -114,26 +116,21 @@ pub(crate) async fn register_route(
 			)));
 		}
 
-		// Generate new device id if the user didn't specify one
-		let device_id = body
-			.device_id
-			.clone()
-			.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
-
 		// Generate new token for the device
 		let new_token = DeviceToken::new_random();
 
 		// Create device for this account
-		services
+		let device_id = services
 			.users
 			.create_device(
 				&user_id,
-				&device_id,
+				body.device_id.clone(),
 				Some(new_token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
 			.await?;
+
 		(Some(new_token), Some(device_id))
 	} else {
 		// Don't create a device for inhibited logins

src/api/client/admin/lock.rs

@@ -1,6 +1,6 @@
 use axum::extract::State;
 use conduwuit::{Err, Result};
-use futures::join;
+use futures::future::{join, join3};
 use ruma::api::client::admin::{is_user_locked, lock_user};
 
 use crate::Ruma;
@@ -12,7 +12,15 @@ pub(crate) async fn get_lock_status(
 	State(services): State<crate::State>,
 	body: Ruma<is_user_locked::v1::Request>,
 ) -> Result<is_user_locked::v1::Response> {
-	let status = services.users.status(&body.user_id).await;
+	let (admin, status) = join(
+		services.users.is_admin(body.identity.expect_sender_user()?),
+		services.users.status(&body.user_id),
+	)
+	.await;
+
+	if !admin {
+		return Err!(Request(Forbidden("Only server administrators can use this endpoint")));
+	}
 
 	status.ensure_active()?;
 
@@ -28,14 +36,22 @@ pub(crate) async fn put_lock_status(
 	State(services): State<crate::State>,
 	body: Ruma<lock_user::v1::Request>,
 ) -> Result<lock_user::v1::Response> {
-	let sender_user = body.identity.sender_user();
+	let sender_user = body.identity.expect_sender_user()?;
 
-	let (status, target_admin) =
-		join!(services.users.status(&body.user_id), services.users.is_admin(&body.user_id),);
+	let (sender_admin, status, target_admin) = join3(
+		services.users.is_admin(sender_user),
+		services.users.status(&body.user_id),
+		services.users.is_admin(&body.user_id),
+	)
+	.await;
+
+	if !sender_admin {
+		return Err!(Request(Forbidden("Only server administrators can use this endpoint")));
+	}
 
 	status.ensure_active()?;
 
-	if sender_user.is_some_and(|sender_user| body.user_id == sender_user) {
+	if body.user_id == *sender_user {
 		return Err!(Request(Forbidden("You cannot lock yourself")));
 	}
 
@@ -63,7 +79,7 @@ pub(crate) async fn put_lock_status(
 		// Notify the admin room that an account has been un/suspended
 		services
 			.admin
-			.send_text(&format!("{} has been {} by {}.", body.user_id, action, body.identity))
+			.send_text(&format!("{} has been {} by {}.", body.user_id, action, sender_user))
 			.await;
 	}
 

src/api/client/admin/mod.rs

@@ -1,5 +1,4 @@
 mod lock;
-pub(crate) mod site;
 mod suspend;
 
 pub(crate) use self::{lock::*, suspend::*};

src/api/client/admin/site/mod.rs

@@ -1,2 +0,0 @@
-pub(crate) mod rooms;
-pub(crate) mod users;

src/api/client/admin/site/rooms/list.rs

@@ -1,178 +0,0 @@
-use axum::extract::State;
-use conduwuit::{
-	Event, Result,
-	utils::stream::{BroadbandExt, WidebandExt},
-};
-use futures::StreamExt;
-use ruma::{
-	OwnedRoomId,
-	events::{
-		StateEventType,
-		room::{
-			create::RoomCreateEventContent,
-			encryption::PossiblyRedactedRoomEncryptionEventContent,
-			tombstone::PossiblyRedactedRoomTombstoneEventContent,
-		},
-	},
-};
-use ruminuwuity::admin::continuwuity::rooms;
-use tokio::join;
-
-use crate::Ruma;
-
-/// # `GET /_continuwuity/admin/rooms`
-///
-/// Lists all room IDs known to this server, excluding banned ones.
-///
-/// This is the legacy version of the endpoint, which does not support
-/// pagination or including banned rooms. It is recommended to use the
-/// `/v1/rooms` endpoint instead. This endpoint may be removed in a future
-/// release.
-pub(crate) async fn legacy_list_rooms(
-	State(services): State<crate::State>,
-	_body: Ruma<rooms::list::unstable::Request>,
-) -> Result<rooms::list::unstable::Response> {
-	let mut rooms: Vec<OwnedRoomId> = services
-		.rooms
-		.metadata
-		.iter_ids()
-		.filter_map(|room_id| async move {
-			if !services.rooms.metadata.is_banned(&room_id).await {
-				Some(room_id.clone())
-			} else {
-				None
-			}
-		})
-		.collect()
-		.await;
-	rooms.sort();
-	Ok(rooms::list::unstable::Response::new(rooms))
-}
-
-/// # `GET /_continuwuity/admin/v1/rooms`
-///
-/// Lists rooms known to this server.
-pub(crate) async fn list_rooms(
-	State(services): State<crate::State>,
-	body: Ruma<rooms::list::v1::Request>,
-) -> Result<rooms::list::v1::Response> {
-	let include_banned_rooms = body.include_banned_rooms;
-	let rooms = services
-		.rooms
-		.metadata
-		.iter_ids()
-		.wide_filter_map(|room_id| async move {
-			if include_banned_rooms || !services.rooms.metadata.is_banned(&room_id).await {
-				Some(room_id.clone())
-			} else {
-				None
-			}
-		})
-		.skip(body.offset.unwrap_or_default())
-		.take(body.limit.unwrap_or(100).min(100))
-		.broad_filter_map(|room_id| async move {
-			let (
-				banned,
-				disabled,
-				member_count,
-				local_member_count,
-				resident_server_count,
-				published,
-				create_event,
-				encryption_event,
-				name_event,
-				topic_event,
-				canonical_alias_event,
-				join_rules_event,
-				history_visibility_event,
-				tombstone_event,
-			) = join!(
-				services.rooms.metadata.is_banned(&room_id),
-				services.rooms.metadata.is_disabled(&room_id),
-				services.rooms.state_cache.room_joined_count(&room_id),
-				services
-					.rooms
-					.state_cache
-					.active_local_users_in_room(&room_id)
-					.count(),
-				services.rooms.state_cache.room_servers(&room_id).count(),
-				services.rooms.directory.is_public_room(&room_id),
-				services.rooms.state_accessor.room_state_get(
-					&room_id,
-					&StateEventType::RoomCreate,
-					""
-				),
-				services
-					.rooms
-					.state_accessor
-					.room_state_get_content::<PossiblyRedactedRoomEncryptionEventContent>(
-						&room_id,
-						&StateEventType::RoomEncryption,
-						""
-					),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomName,
-					""
-				),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomTopic,
-					""
-				),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomCanonicalAlias,
-					""
-				),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomJoinRules,
-					""
-				),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomHistoryVisibility,
-					""
-				),
-				services
-					.rooms
-					.state_accessor
-					.room_state_get_content::<PossiblyRedactedRoomTombstoneEventContent>(
-						&room_id,
-						&StateEventType::RoomTombstone,
-						""
-					),
-			);
-			let Ok(create_event) = create_event else {
-				return None;
-			};
-			let create_content = create_event
-				.get_content::<RoomCreateEventContent>()
-				.expect("m.room.create content must be valid");
-			Some(rooms::list::v1::MinimalRoomInfo {
-				room_id,
-				banned,
-				disabled,
-				member_count: usize::try_from(member_count.unwrap_or_default())
-					.expect("u64 should fit in usize"),
-				local_member_count,
-				resident_server_count,
-				creators: vec![create_event.sender],
-				encrypted: encryption_event.is_ok_and(|c| c.algorithm.is_some()),
-				federated: create_content.federate,
-				published,
-				version: create_content.room_version,
-				name: name_event.unwrap_or(None),
-				topic: topic_event.unwrap_or(None),
-				canonical_alias: canonical_alias_event.unwrap_or(None),
-				join_rules: join_rules_event.unwrap_or(None),
-				history_visibility: history_visibility_event.unwrap_or(None),
-				predecessor: create_content.predecessor.map(|c| c.room_id),
-				successor: tombstone_event.map_or(None, |c| c.replacement_room),
-			})
-		})
-		.collect()
-		.await;
-	Ok(rooms::list::v1::Response::new(rooms))
-}

src/api/client/admin/site/rooms/mod.rs

@@ -1,5 +0,0 @@
-mod ban;
-mod list;
-
-pub(crate) use ban::ban_room;
-pub(crate) use list::*;

src/api/client/admin/site/users/create.rs

@@ -1,142 +0,0 @@
-use axum::extract::State;
-use conduwuit::{
-	err, error, info,
-	utils::{IterStream, stream::BroadbandExt},
-	warn,
-};
-use futures::{FutureExt, StreamExt};
-use ruma::{api::client::profile::PropagateTo, profile::ProfileFieldValue};
-use ruminuwuity::admin::continuwuity::users;
-use service::users::{HashedPassword, ProfileFieldChange};
-
-use crate::router::Ruma;
-
-/// # `POST /_continuwuity/admin/v1/users/create`
-///
-/// Creates a new user.
-pub(crate) async fn create_user(
-	State(services): State<crate::State>,
-	body: Ruma<users::create::v1::Request>,
-) -> conduwuit::Result<users::create::v1::Response> {
-	let email = body
-		.email
-		.clone()
-		.map(lettre::Address::try_from)
-		.transpose()
-		.map_err(|e| err!(Request(BadJson("Invalid email address: {e}"))))?;
-
-	let ref user_id = services
-		.users
-		.determine_registration_user_id(Some(body.localpart.clone()), email.as_ref(), None)
-		.await?;
-
-	services.users.create_shadow_account(user_id).await?;
-
-	services
-		.users
-		.convert_to_local_account(user_id, HashedPassword::new(&body.password)?)
-		.await?;
-
-	if let Some(email) = &email {
-		services
-			.threepid
-			.associate_localpart_email(user_id.localpart(), email)
-			.await?;
-	}
-
-	if body.suspended {
-		services
-			.users
-			.suspend_account(user_id, body.identity.sender_user())
-			.await;
-	}
-	if body.locked {
-		services
-			.users
-			.lock_account(user_id, body.identity.sender_user())
-			.await;
-	}
-	if body.login_disabled {
-		services.users.disable_login(user_id);
-	}
-	if let Some(ref value) = body.display_name {
-		services
-			.users
-			.set_profile_field(
-				user_id,
-				ProfileFieldChange::Set(ProfileFieldValue::DisplayName(value.to_owned())),
-				PropagateTo::None,
-			)
-			.await?;
-	}
-	if let Some(ref value) = body.avatar_url {
-		services
-			.users
-			.set_profile_field(
-				user_id,
-				ProfileFieldChange::Set(ProfileFieldValue::AvatarUrl(value.to_owned())),
-				PropagateTo::None,
-			)
-			.await?;
-	}
-	if body.admin {
-		services
-			.admin
-			.make_user_admin(user_id)
-			.await
-			.inspect_err(|e| error!("failed to make new user {user_id} an admin: {e}"))
-			.ok();
-	}
-
-	body.auto_join_rooms
-		.clone()
-		.into_iter()
-		.stream()
-		.chain(
-			if body.skip_auto_join {
-				vec![]
-			} else {
-				services.config.auto_join_rooms.clone()
-			}
-			.into_iter()
-			.stream(),
-		)
-		.broad_filter_map(|room| async move {
-			services
-				.rooms
-				.alias
-				.resolve_with_servers(&room, None)
-				.await
-				.inspect_err(|e| {
-					warn!(
-						"Failed to resolve room alias to room ID when attempting to auto join \
-						 {room}: {e}"
-					);
-				})
-				.ok()
-		})
-		.for_each_concurrent(None, |(room_id, servers)| async move {
-			match services
-				.rooms
-				.membership
-				.join_room(
-					user_id,
-					&room_id,
-					Some("Automatically joining this room upon registration".to_owned()),
-					servers.as_ref(),
-				)
-				.boxed()
-				.await
-			{
-				| Err(e) => {
-					warn!("Failed to automatically join {user_id} to {room_id}: {e}");
-				},
-				| _ => {
-					info!("Automatically joined room {user_id} to {room_id}");
-				},
-			}
-		})
-		.await;
-
-	Ok(users::create::v1::Response::new(user_id.to_owned()))
-}

src/api/client/admin/site/users/list.rs

@@ -1,42 +0,0 @@
-use axum::extract::State;
-use conduwuit::utils::stream::WidebandExt;
-use futures::StreamExt;
-use ruminuwuity::admin::continuwuity::users;
-use tokio::join;
-
-use crate::router::Ruma;
-
-/// # `GET /_continuwuity/admin/v1/users`
-///
-/// Lists all users on this homeserver.
-pub(crate) async fn list_users(
-	State(services): State<crate::State>,
-	body: Ruma<users::list::v1::Request>,
-) -> conduwuit::Result<users::list::v1::Response> {
-	let users = services
-		.users
-		.stream_local_users()
-		.skip(body.offset.unwrap_or_default())
-		.take(body.limit.unwrap_or(100).min(100))
-		.wide_filter_map(|user_id| async move {
-			let (status, suspended, locked, admin, login_disabled) = join!(
-				services.users.status(&user_id),
-				services.users.is_suspended(&user_id),
-				services.users.is_locked(&user_id),
-				services.users.is_admin(&user_id),
-				services.users.is_login_disabled(&user_id),
-			);
-			Some(users::list::v1::User {
-				user_id: user_id.clone(),
-				deactivated: !status.is_active(),
-				suspended: suspended.unwrap_or_default(),
-				locked: locked.unwrap_or_default(),
-				admin,
-				login_disabled,
-			})
-		})
-		.collect()
-		.await;
-
-	Ok(users::list::v1::Response::new(users))
-}

src/api/client/admin/site/users/mod.rs

@@ -1,5 +0,0 @@
-mod create;
-mod list;
-
-pub(crate) use create::*;
-pub(crate) use list::*;

src/api/client/admin/suspend.rs

@@ -67,7 +67,7 @@ pub(crate) async fn put_suspended_status(
 	let action = if body.suspended {
 		services
 			.users
-			.suspend_account(&body.user_id, body.identity.sender_user())
+			.suspend_account(&body.user_id, sender_user)
 			.await;
 		"suspended"
 	} else {

src/api/client/device.rs

@@ -88,7 +88,7 @@ pub(crate) async fn update_device_route(
 				.users
 				.create_device(
 					sender_user,
-					&body.device_id,
+					Some(body.device_id.clone()),
 					None,
 					body.display_name.clone(),
 					Some(client.to_string()),

src/api/client/mod.rs

@@ -90,8 +90,5 @@
 pub(super) use voip::*;
 pub(super) use well_known::*;
 
-/// generated device ID length
-const DEVICE_ID_LENGTH: usize = 10;
-
 /// generated user access token length
 const TOKEN_LENGTH: usize = 32;

src/api/client/profile.rs

@@ -29,12 +29,6 @@ pub(crate) async fn get_profile_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile::v3::Request>,
 ) -> Result<get_profile::v3::Response> {
-	if services.config.require_auth_for_profile_requests && body.identity.is_none() {
-		return Err!(Request(Unauthorized(
-			"This server requires authentication to view user profiles."
-		)));
-	}
-
 	let Some(profile) = fetch_full_profile(&services, &body.user_id).await else {
 		return Err!(Request(NotFound("This user's profile could not be fetched.")));
 	};
@@ -46,12 +40,6 @@ pub(crate) async fn get_profile_field_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile_field::v3::Request>,
 ) -> Result<get_profile_field::v3::Response> {
-	if services.config.require_auth_for_profile_requests && body.identity.is_none() {
-		return Err!(Request(Unauthorized(
-			"This server requires authentication to view user profiles."
-		)));
-	}
-
 	let value = fetch_profile_field(&services, &body.user_id, body.field.clone()).await?;
 
 	Ok(assign!(get_profile_field::v3::Response::default(), { value }))

src/api/client/session.rs

@@ -3,7 +3,7 @@
 use axum::extract::State;
 use conduwuit::{
 	Err, Result, debug, err, info,
-	utils::{self, ReadyExt, stream::BroadbandExt},
+	utils::{ReadyExt, stream::BroadbandExt},
 	warn,
 };
 use conduwuit_service::Services;
@@ -30,7 +30,6 @@
 };
 use service::users::DeviceToken;
 
-use super::DEVICE_ID_LENGTH;
 use crate::{Ruma, client_ip::ClientIp};
 
 /// # `GET /_matrix/client/v3/login`
@@ -189,43 +188,39 @@ pub(crate) async fn login_route(
 		},
 	};
 
-	// Generate new device id if the user didn't specify one
-	let device_id = body
-		.device_id
-		.clone()
-		.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
-
 	// Generate a new token for the device
 	let token = DeviceToken::new_random();
 
 	// Determine if device_id was provided and exists in the db for this user
-	let device_exists = if body.device_id.is_some() {
+	let existing_device_id = if let Some(device_id) = &body.device_id {
 		services
 			.users
 			.all_device_ids(&user_id)
-			.ready_any(|v| v == device_id)
+			.ready_find(|v| v == device_id)
 			.await
 	} else {
-		false
+		None
 	};
 
-	if device_exists {
+	let device_id = if let Some(existing_device_id) = existing_device_id {
 		services
 			.users
-			.set_token(&user_id, &device_id, token.clone())
+			.set_token(&user_id, &existing_device_id, token.clone())
 			.await?;
+
+		existing_device_id
 	} else {
 		services
 			.users
 			.create_device(
 				&user_id,
-				&device_id,
+				body.device_id.clone(),
 				Some(token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
-			.await?;
-	}
+			.await?
+	};
 
 	// send client well-known if specified so the client knows to reconfigure itself
 	let client_discovery_info: Option<DiscoveryInfo> = services

src/api/mod.rs

@@ -13,6 +13,8 @@
 
 pub mod client_ip;
 
+pub mod admin;
+
 pub(crate) use self::router::{Ruma, RumaResponse, State};
 
 conduwuit::mod_ctor! {}

src/api/router.rs

@@ -16,12 +16,7 @@
 
 use self::handler::RouterExt;
 pub(super) use self::{args::Args as Ruma, auth::ClientIdentity, response::RumaResponse};
-#[cfg(feature = "admin_api")]
-use crate::client::admin::site as admin_api;
-use crate::{
-	client::{self, admin},
-	server,
-};
+use crate::{admin, client, server};
 
 pub fn build(router: Router<State>, state: State) -> Router<State> {
 	let config = &state.server.config;
@@ -196,11 +191,8 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 		.ruma_route(&client::get_authorization_server_metadata_route)
 		.merge(client::oauth::router(state))
 		.route("/_continuwuity/server_version", get(client::continuwuity_server_version))
-		.ruma_route(&admin::site::rooms::ban_room)
-		.ruma_route(&admin::site::rooms::list_rooms)
-		.ruma_route(&admin::site::rooms::legacy_list_rooms)
-		.ruma_route(&admin::site::users::create_user)
-		.ruma_route(&admin::site::users::list_users);
+		.ruma_route(&admin::rooms::ban::ban_room)
+		.ruma_route(&admin::rooms::list::list_rooms);
 
 	if config.allow_federation {
 		router = router
@@ -283,16 +275,6 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 			.route("/_matrix/media/r0/preview_url", any(redirect_legacy_preview));
 	}
 
-	#[cfg(feature = "admin_api")]
-	{
-		router = router
-			.ruma_route(&admin_api::users::list_users_route)
-			.ruma_route(&admin_api::users::create_user_route)
-			.ruma_route(&admin_api::rooms::ban_room)
-			.ruma_route(&admin_api::rooms::legacy_list_rooms_route)
-			.ruma_route(&admin_api::rooms::list_rooms_route);
-	};
-
 	router
 }
 

src/api/router/auth.rs

@@ -1,14 +1,11 @@
-use std::{
-	any::{Any, TypeId},
-	fmt::Display,
-};
+use std::any::{Any, TypeId};
 
 use conduwuit::{Err, Error, Result, err};
 use http::StatusCode;
 use ruma::{
 	DeviceId, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId,
 	api::{
-		IncomingRequest, OAuthClientScope,
+		IncomingRequest,
 		auth_scheme::{
 			AccessToken, AccessTokenOptional, AppserviceToken, AppserviceTokenOptional,
 			AuthScheme, NoAccessToken, NoAuthentication,
@@ -80,67 +77,68 @@ pub(crate) fn appservice_info(&self) -> Option<&RegistrationInfo> {
 	pub(crate) fn is_appservice(&self) -> bool { matches!(self, Self::Appservice { .. }) }
 }
 
-impl Display for ClientIdentity {
-	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-		match self {
-			| Self::User { sender_user, sender_device } =>
-				write!(f, "{sender_user} ({sender_device})"),
-			| Self::Appservice { sender_user, appservice_info, .. } =>
-				write!(f, "appservice `{}` using {sender_user}", appservice_info.registration.id),
-		}
-	}
-}
-
 pub(crate) trait CheckAuth: AuthScheme {
 	type Identity: Send;
 
-	fn authenticate<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	fn authenticate<R: IncomingRequest + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		incoming_request: &hyper::Request<B>,
 		query: AuthQueryParams,
 	) -> impl Future<Output = Result<Self::Identity>> + Send {
 		async move {
+			let route = TypeId::of::<R>();
+
 			let output = Self::extract_authentication(incoming_request).map_err(|err| {
 				err!(Request(Unauthorized(warn!(
-					"Failed to extract request authentication: {}",
+					"Failed to extract authorization: {}",
 					err.into()
 				))))
 			})?;
 
-			Self::verify::<R, B>(services, output, incoming_request, query)
-				.await
+			Self::verify(services, output, incoming_request, query, route).await
 		}
 	}
 
-	fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		request: &hyper::Request<B>,
 		query: AuthQueryParams,
+		route: TypeId,
 	) -> impl Future<Output = Result<Self::Identity>> + Send;
 }
 
 impl CheckAuth for ServerSignatures {
 	type Identity = OwnedServerName;
 
-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		request: &hyper::Request<B>,
 		_query: AuthQueryParams,
+		_route: TypeId,
 	) -> Result<Self::Identity> {
+		let destination = services.globals.server_name();
+		if output
+			.destination
+			.as_ref()
+			.is_some_and(|supplied_destination| supplied_destination != destination)
+		{
+			return Err!(Request(Unauthorized("Destination mismatch.")));
+		}
+
 		let key = services
 			.server_keys
 			.get_verify_key(&output.origin, &output.key)
 			.await
-			.map_err(|err| {
-				err!(Request(Unauthorized(warn!("Failed to fetch signing keys: {err}"))))
+			.map_err(|e| {
+				err!(Request(Unauthorized(warn!("Failed to fetch signing keys: {e}"))))
 			})?;
 
 		let keys: PubKeys = [(output.key.to_string(), key.key)].into();
 		let keys: PubKeyMap = [(output.origin.as_str().into(), keys)].into();
 
-		match output.verify_request(request, services.globals.server_name(), &keys) {
+		match output.verify_request(request, destination, &keys) {
 			| Ok(()) => {
 				if services
 					.moderation
@@ -162,194 +160,61 @@ async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]>
 impl CheckAuth for AccessToken {
 	type Identity = ClientIdentity;
 
-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		_request: &hyper::Request<B>,
 		query: AuthQueryParams,
+		route: TypeId,
 	) -> Result<Self::Identity> {
-		verify_access_token(services, output, query, TypeId::of::<R>(), R::required_scopes())
-			.await
-	}
-}
-
-impl CheckAuth for AccessTokenOptional {
-	type Identity = Option<ClientIdentity>;
-
-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
-		services: &Services,
-		output: Self::Output,
-		_request: &hyper::Request<B>,
-		query: AuthQueryParams,
-	) -> Result<Self::Identity> {
-		match output {
-			| Some(token) => verify_access_token(
-				services,
-				token,
-				query,
-				TypeId::of::<R>(),
-				R::required_scopes(),
-			)
-			.await
-			.map(Some),
-			| None => Ok(None),
+		if output.is_empty() {
+			return Err!(Request(Unauthorized("Missing access token.")));
 		}
-	}
-}
+		if let Some((sender_user, sender_device, status)) =
+			services.users.find_from_token(&output).await
+		{
+			// If the token is expired we return a soft logout
+			if matches!(status, AccessTokenStatus::Expired) {
+				return Err(Error::Request(
+					ErrorKind::UnknownToken(
+						assign!(UnknownTokenErrorData::new(), { soft_logout: true }),
+					),
+					"This token has expired".into(),
+					StatusCode::UNAUTHORIZED,
+				));
+			}
 
-impl CheckAuth for AppserviceToken {
-	type Identity = RegistrationInfo;
-
-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
-		services: &Services,
-		output: Self::Output,
-		_request: &hyper::Request<B>,
-		_query: AuthQueryParams,
-	) -> Result<Self::Identity> {
-		verify_appservice_access_token(services, output).await
-	}
-}
-
-impl CheckAuth for AppserviceTokenOptional {
-	type Identity = Option<RegistrationInfo>;
-
-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
-		services: &Services,
-		output: Self::Output,
-		_request: &hyper::Request<B>,
-		_query: AuthQueryParams,
-	) -> Result<Self::Identity> {
-		match output {
-			| Some(token) => verify_appservice_access_token(services, token)
+			// Locked users can only use /logout and /logout/all
+			if services
+				.users
+				.is_locked(&sender_user)
 				.await
-				.map(Some),
-			| None => Ok(None),
-		}
-	}
-}
-
-impl CheckAuth for NoAuthentication {
-	type Identity = ();
-
-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
-		_services: &Services,
-		_output: Self::Output,
-		_request: &hyper::Request<B>,
-		_query: AuthQueryParams,
-	) -> Result<Self::Identity> {
-		Ok(())
-	}
-}
-
-impl CheckAuth for NoAccessToken {
-	type Identity = Option<ClientIdentity>;
-
-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
-		services: &Services,
-		_output: Self::Output,
-		request: &hyper::Request<B>,
-		query: AuthQueryParams,
-	) -> Result<Self::Identity> {
-		// We handle these the same as AccessTokenOptional
-		let token = AccessTokenOptional::extract_authentication(request).map_err(|err| {
-			err!(Request(Unauthorized(warn!("Failed to extract authorization: {}", err))))
-		})?;
-
-		match token {
-			| Some(token) => verify_access_token(
-				services,
-				token,
-				query,
-				TypeId::of::<R>(),
-				// Assume that no scopes are required for these endpoints since
-				// ostensibly they don't require authentication
-				&[],
-			)
-			.await
-			.map(Some),
-			| None => Ok(None),
-		}
-	}
-}
-
-async fn verify_access_token(
-	services: &Services,
-	output: String,
-	query: AuthQueryParams,
-	route: TypeId,
-	required_scopes: &[OAuthClientScope],
-) -> Result<ClientIdentity> {
-	if let Some((sender_user, sender_device, status)) =
-		services.users.find_from_token(&output).await
-	{
-		// If the token is expired we return a soft logout
-		if matches!(status, AccessTokenStatus::Expired) {
-			return Err(Error::Request(
-				ErrorKind::UnknownToken(
-					assign!(UnknownTokenErrorData::new(), { soft_logout: true }),
-				),
-				"This access token has expired.".into(),
-				StatusCode::UNAUTHORIZED,
-			));
-		}
-
-		// Locked users can only use /logout and /logout/all
-		if services
-			.users
-			.is_locked(&sender_user)
-			.await
-			.is_ok_and(std::convert::identity)
-		{
-			if !(route == TypeId::of::<client::session::logout::v3::Request>()
-				|| route == TypeId::of::<client::session::logout_all::v3::Request>())
+				.is_ok_and(std::convert::identity)
 			{
-				return Err!(Request(UserLocked("Your account is locked.")));
+				if !(route == TypeId::of::<client::session::logout::v3::Request>()
+					|| route == TypeId::of::<client::session::logout_all::v3::Request>())
+				{
+					return Err!(Request(UserLocked("Your account is locked.")));
+				}
 			}
-		}
 
-		// If this device is bound to an OAuth session, check its scopes. This will also
-		// handle admin-only endpoints for OAuth clients.
-		if let Some(session) = services
-			.oauth
-			.get_session_info_for_device(&sender_user, &sender_device)
-			.await
-		{
-			if required_scopes
-				.iter()
-				.all(|scope| !session.scopes.contains(scope))
-			{
-				return Err!(Request(Forbidden(
-					"You don't have the necessary scopes to use this endpoint."
-				)));
+			Ok(ClientIdentity::User { sender_user, sender_device })
+		} else if let Ok(appservice_info) = services.appservice.find_from_token(&output).await {
+			let Ok(sender_user) = query.user_id.clone().map_or_else(
+				|| {
+					UserId::parse_with_server_name(
+						appservice_info.registration.sender_localpart.as_str(),
+						services.globals.server_name(),
+					)
+				},
+				UserId::parse,
+			) else {
+				return Err!(Request(InvalidUsername("Username is invalid.")));
+			};
+
+			if !appservice_info.is_user_match(&sender_user) {
+				return Err!(Request(Exclusive("User is not in namespace.")));
 			}
-		} else {
-			// Otherwise, explicitly check if the endpoint is restricted to admins only.
-			if required_scopes.contains(&OAuthClientScope::ServerAdministration)
-				&& !services.users.is_admin(&sender_user).await
-			{
-				return Err!(Request(Forbidden(
-					"Only server administrators can use this endpoint."
-				)));
-			}
-		}
-
-		Ok(ClientIdentity::User { sender_user, sender_device })
-	} else if let Ok(appservice_info) = services.appservice.find_from_token(&output).await {
-		let Ok(sender_user) = query.user_id.clone().map_or_else(
-			|| {
-				UserId::parse_with_server_name(
-					appservice_info.registration.sender_localpart.as_str(),
-					services.globals.server_name(),
-				)
-			},
-			UserId::parse,
-		) else {
-			return Err!(Request(InvalidUsername("Username is invalid.")));
-		};
-
-		if !appservice_info.is_user_match(&sender_user) {
-			return Err!(Request(Exclusive("User is not in this appservice's namespace.")));
-		}
 
 			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
 			// The device_id can be provided via `device_id` or
@@ -367,7 +232,10 @@ async fn verify_access_token(
 					.await
 					.is_err()
 				{
-					return Err!(Request(Forbidden("Appservice cannot masquerade as this device.")));
+					return Err!(Request(Forbidden(
+						"Device does not exist for user or appservice cannot masquerade as this \
+						 device."
+					)));
 				}
 
 				Some(device_id.to_owned())
@@ -375,27 +243,124 @@ async fn verify_access_token(
 				None
 			};
 
-		Ok(ClientIdentity::Appservice {
-			sender_user,
-			sender_device,
-			appservice_info: Box::new(appservice_info),
-		})
-	} else {
-		Err(Error::Request(
-			ErrorKind::UnknownToken(UnknownTokenErrorData::new()),
-			"Invalid access token.".into(),
-			StatusCode::UNAUTHORIZED,
-		))
+			Ok(ClientIdentity::Appservice {
+				sender_user,
+				sender_device,
+				appservice_info: Box::new(appservice_info),
+			})
+		} else {
+			Err(Error::Request(
+				ErrorKind::UnknownToken(UnknownTokenErrorData::new()),
+				"Invalid token".into(),
+				StatusCode::UNAUTHORIZED,
+			))
+		}
 	}
 }
 
-async fn verify_appservice_access_token(
-	services: &Services,
-	output: String,
-) -> Result<RegistrationInfo> {
-	let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
-		return Err!(Request(Unauthorized("Invalid appservice token.")));
-	};
+impl CheckAuth for AccessTokenOptional {
+	type Identity = Option<ClientIdentity>;
 
-	Ok(appservice_info)
+	async fn verify<B: AsRef<[u8]> + Sync>(
+		services: &Services,
+		output: Self::Output,
+		request: &hyper::Request<B>,
+		query: AuthQueryParams,
+		route: TypeId,
+	) -> Result<Self::Identity> {
+		match output {
+			| Some(token) =>
+				<AccessToken as CheckAuth>::verify(services, token, request, query, route)
+					.await
+					.map(Some),
+			| None => Ok(None),
+		}
+	}
+}
+
+impl CheckAuth for AppserviceToken {
+	type Identity = RegistrationInfo;
+
+	async fn verify<B: AsRef<[u8]> + Sync>(
+		services: &Services,
+		output: Self::Output,
+		_request: &hyper::Request<B>,
+		_query: AuthQueryParams,
+		_route: TypeId,
+	) -> Result<Self::Identity> {
+		if output.is_empty() {
+			return Err!(Request(Unauthorized("Missing access token.")));
+		}
+		let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
+			return Err!(Request(Unauthorized("Invalid appservice token.")));
+		};
+
+		Ok(appservice_info)
+	}
+}
+
+impl CheckAuth for AppserviceTokenOptional {
+	type Identity = Option<RegistrationInfo>;
+
+	async fn verify<B: AsRef<[u8]> + Sync>(
+		services: &Services,
+		output: Self::Output,
+		request: &hyper::Request<B>,
+		query: AuthQueryParams,
+		route: TypeId,
+	) -> Result<Self::Identity> {
+		match output {
+			| Some(token) =>
+				<AppserviceToken as CheckAuth>::verify(services, token, request, query, route)
+					.await
+					.map(Some),
+			| None => Ok(None),
+		}
+	}
+}
+
+impl CheckAuth for NoAuthentication {
+	type Identity = ();
+
+	async fn verify<B: AsRef<[u8]> + Sync>(
+		_services: &Services,
+		_output: Self::Output,
+		_request: &hyper::Request<B>,
+		_query: AuthQueryParams,
+		_route: TypeId,
+	) -> Result<Self::Identity> {
+		Ok(())
+	}
+}
+
+impl CheckAuth for NoAccessToken {
+	type Identity = Option<ClientIdentity>;
+
+	async fn verify<B: AsRef<[u8]> + Sync>(
+		services: &Services,
+		_output: Self::Output,
+		request: &hyper::Request<B>,
+		query: AuthQueryParams,
+		route: TypeId,
+	) -> Result<Self::Identity> {
+		// We handle these the same as AccessTokenOptional
+		let token = AccessTokenOptional::extract_authentication(request).map_err(|err| {
+			err!(Request(Unauthorized(warn!("Failed to extract authorization: {}", err))))
+		})?;
+
+		// Check special access restrictions
+		if (route == TypeId::of::<client::profile::get_avatar_url::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_display_name::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_profile_field::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_profile::v3::Request>())
+			&& services.config.require_auth_for_profile_requests
+			&& token.is_none()
+		{
+			return Err!(Request(Unauthorized(
+				"This server requires authentication to access user profiles."
+			)));
+		}
+
+		<AccessTokenOptional as CheckAuth>::verify(services, token, request, query, route).await
+	}
 }

src/core/matrix/versions.rs

@@ -41,7 +41,5 @@ pub fn unstable_features() -> BTreeMap<String, bool> {
 		("org.matrix.msc4155".to_owned(), true),
 		// profile change propagation (https://github.com/matrix-org/matrix-spec-proposals/pull/4466)
 		("computer.gingershaped.msc4466".to_owned(), true),
-		// server admin oauth scope (https://github.com/matrix-org/matrix-spec-proposals/pull/4484)
-		("org.continuwuity.msc4484.unstable".to_owned(), true),
 	])
 }

src/main/Cargo.toml

@@ -68,7 +68,6 @@ full = [
     "jemalloc_prof",
     "perf_measurements",
     "tokio_console",
-	"conduwuit-api/admin_api",
 ]
 
 brotli_compression = [

src/ruminuwuity/admin/continuwuity/mod.rs

@@ -1,2 +1 @@
 pub mod rooms;
-pub mod users;

src/ruminuwuity/admin/continuwuity/rooms/ban.rs

@@ -1,7 +1,7 @@
 pub mod v1 {
 	use ruma::{
 		OwnedRoomAliasId, OwnedRoomId, OwnedUserId,
-		api::{OAuthClientScope, auth_scheme::AccessToken, request, response},
+		api::{auth_scheme::AccessToken, request, response},
 		metadata,
 	};
 
@@ -9,10 +9,8 @@ pub mod v1 {
 		method: PUT,
 		rate_limited: false,
 		authentication: AccessToken,
-		required_scopes: [OAuthClientScope::ServerAdministration],
 		history: {
-			unstable("org.continuwuity.admin") => "/_continuwuity/admin/rooms/{room_id}/ban",
-			1.0 => "/_continuwuity/admin/v1/rooms/{room_id}/ban",
+			1.0 => "/_continuwuity/admin/rooms/{room_id}/ban",
 		}
 	}
 
@@ -31,11 +29,8 @@ pub struct Request {
 
 	#[response]
 	pub struct Response {
-		/// Users who were successfully kicked from this room.
 		pub kicked_users: Vec<OwnedUserId>,
-		/// Users who could not be kicked from the room.
 		pub failed_kicked_users: Vec<OwnedUserId>,
-		/// Any local aliases that were removed from the room.
 		pub local_aliases: Vec<OwnedRoomAliasId>,
 	}
 

src/ruminuwuity/admin/continuwuity/rooms/list.rs

@@ -1,7 +1,7 @@
-pub mod unstable {
+pub mod v1 {
 	use ruma::{
 		OwnedRoomId,
-		api::{OAuthClientScope, auth_scheme::AccessToken, request, response},
+		api::{auth_scheme::AccessToken, request, response},
 		metadata,
 	};
 
@@ -9,9 +9,8 @@ pub mod unstable {
 		method: GET,
 		rate_limited: false,
 		authentication: AccessToken,
-		required_scopes: [OAuthClientScope::ServerAdministration],
 		history: {
-			unstable => "/_continuwuity/admin/rooms/list",
+			1.0 => "/_continuwuity/admin/rooms/list",
 		}
 	}
 
@@ -21,7 +20,6 @@ pub mod unstable {
 
 	#[response]
 	pub struct Response {
-		/// A list of room IDs known to this server.
 		pub rooms: Vec<OwnedRoomId>,
 	}
 
@@ -35,133 +33,3 @@ impl Response {
 		pub fn new(rooms: Vec<OwnedRoomId>) -> Self { Self { rooms } }
 	}
 }
-
-pub mod v1 {
-	use ruma::{
-		OwnedRoomId, OwnedUserId, RoomVersionId,
-		api::{auth_scheme::AccessToken, request, response},
-		events::room::{
-			canonical_alias::PossiblyRedactedRoomCanonicalAliasEventContent,
-			history_visibility::PossiblyRedactedRoomHistoryVisibilityEventContent,
-			join_rules::PossiblyRedactedRoomJoinRulesEventContent,
-			name::PossiblyRedactedRoomNameEventContent,
-			topic::PossiblyRedactedRoomTopicEventContent,
-		},
-		metadata,
-		serde::{default_true, is_default},
-	};
-
-	metadata! {
-		method: GET,
-		rate_limited: false,
-		authentication: AccessToken,
-		history: {
-			1.0 => "/_continuwuity/admin/v1/rooms",
-		}
-	}
-
-	#[request]
-	#[derive(Default)]
-	pub struct Request {
-		/// The maximum number of results to return in this page. Maximum (and
-		/// default) is 100.
-		#[ruma_api(query)]
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub limit: Option<usize>,
-
-		/// The number of results to skip over before returning results. Default
-		/// is 0.
-		#[ruma_api(query)]
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub offset: Option<usize>,
-
-		/// If true, includes banned rooms in the response.
-		#[ruma_api(query)]
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub include_banned_rooms: bool,
-	}
-
-	#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
-	pub struct MinimalRoomInfo {
-		/// The room's unique ID.
-		pub room_id: OwnedRoomId,
-		/// If true, this room is banned, and cannot be joined by non-admins.
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub banned: bool,
-		/// If true, this room has federation disabled, but can still be locally
-		/// used.
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub disabled: bool,
-		/// The total number of joined members in this room.
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub member_count: usize,
-		/// The total number of joined members in this room that are local to
-		/// this server.
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub local_member_count: usize,
-		/// The number of unique homeservers currently joined to this room.
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub resident_server_count: usize,
-		/// The users who created this room.
-		///
-		/// The first entry is always the sender of the `m.room.create` event.
-		/// Any entries thereafter are additional creators in v12+ rooms. An
-		/// empty vec indicates the room is not known.
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub creators: Vec<OwnedUserId>,
-		/// If true, this room has encryption enabled.
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub encrypted: bool,
-		/// If true, this room is allowed to be federated (`m.federate` is not
-		/// `false` in `m.room.create`).
-		#[serde(default = "default_true", skip_serializing_if = "is_default")]
-		pub federated: bool,
-		/// If true, this room is published to this server's room directory.
-		#[serde(default, skip_serializing_if = "is_default")]
-		pub published: bool,
-		/// The version of the room.
-		pub version: RoomVersionId,
-		/// The event content for the `m.room.name` event, if any is present.
-		/// May be redacted.
-		#[serde(default, skip_serializing_if = "Option::is_none")]
-		pub name: Option<PossiblyRedactedRoomNameEventContent>,
-		/// The event content for the `m.room.topic` event, if any is present.
-		/// May be redacted.
-		#[serde(default, skip_serializing_if = "Option::is_none")]
-		pub topic: Option<PossiblyRedactedRoomTopicEventContent>,
-		/// The event content for the `m.room.canonical_alias` event, if any is
-		/// present. May be redacted.
-		#[serde(default, skip_serializing_if = "Option::is_none")]
-		pub canonical_alias: Option<PossiblyRedactedRoomCanonicalAliasEventContent>,
-		/// The event content for the `m.room.join_rules` event, if any is
-		/// present. May be redacted.
-		#[serde(default, skip_serializing_if = "Option::is_none")]
-		pub join_rules: Option<PossiblyRedactedRoomJoinRulesEventContent>,
-		/// The event content for the `m.room.history_visibility` event, if any
-		/// is present. May be redacted.
-		#[serde(default, skip_serializing_if = "Option::is_none")]
-		pub history_visibility: Option<PossiblyRedactedRoomHistoryVisibilityEventContent>,
-		/// The ID of the room which replaces this one, if any.
-		#[serde(default, skip_serializing_if = "Option::is_none")]
-		pub successor: Option<OwnedRoomId>,
-		/// The ID of the room which preceded this one, if any.
-		#[serde(default, skip_serializing_if = "Option::is_none")]
-		pub predecessor: Option<OwnedRoomId>,
-	}
-
-	#[response]
-	pub struct Response {
-		/// A list of rooms known to this server.
-		pub rooms: Vec<MinimalRoomInfo>,
-	}
-
-	impl Request {
-		#[must_use]
-		pub fn new() -> Self { Self::default() }
-	}
-
-	impl Response {
-		#[must_use]
-		pub fn new(rooms: Vec<MinimalRoomInfo>) -> Self { Self { rooms } }
-	}
-}

src/ruminuwuity/admin/continuwuity/users/create.rs

@@ -1,105 +0,0 @@
-pub mod v1 {
-	use ruma::{
-		OwnedMxcUri, OwnedRoomOrAliasId, OwnedUserId,
-		api::{OAuthClientScope, auth_scheme::AccessToken, request, response},
-		metadata,
-	};
-
-	metadata! {
-		method: POST,
-		rate_limited: false,
-		authentication: AccessToken,
-		required_scopes: [OAuthClientScope::ServerAdministration],
-		history: {
-			1.0 => "/_continuwuity/admin/v1/users/create",
-		},
-	}
-
-	#[request]
-	pub struct Request {
-		/// The user's localpart (the identifier between `@` and `:`). Cannot be
-		/// blank.
-		pub localpart: String,
-
-		/// The user's desired password. Cannot be blank.
-		pub password: String,
-
-		/// The user's email address, if any.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub email: Option<String>,
-
-		/// The display name to set upon creation.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub display_name: Option<String>,
-
-		/// The avatar URI to set upon creation.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub avatar_url: Option<OwnedMxcUri>,
-
-		/// Suspends the user immediately upon creation. They can still log in.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub suspended: bool,
-
-		/// Locks the user immediately upon creation. They will receive
-		/// M_USER_LOCKED upon login.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub locked: bool,
-
-		/// Disables the user's login immediately upon creation.
-		///
-		/// The user can still be used if an admin generates an access token for
-		/// the account, but the user will not be able to use `POST
-		/// /_matrix/client/v3/login`.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub login_disabled: bool,
-
-		/// Promotes the user to a server administrator immediately upon
-		/// creation.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub admin: bool,
-
-		/// Skips joining rooms in the server's configured auto_join_rooms.
-		///
-		/// If this is false, all rooms in the config.toml's `auto_join_rooms`
-		/// will be automatically joined upon creation. If `auto_join_rooms`
-		/// is supplied in this request too, those rooms will be joined
-		/// afterwards.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub skip_auto_join: bool,
-
-		/// Additional rooms to auto-join the new user to. If `skip_auto_join`
-		/// is `true`, these rooms will still be joined.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub auto_join_rooms: Vec<OwnedRoomOrAliasId>,
-	}
-
-	#[response]
-	pub struct Response {
-		/// The fully qualified user ID of the newly created user.
-		pub user_id: OwnedUserId,
-	}
-
-	impl Request {
-		#[must_use]
-		pub fn new(localpart: String, password: String) -> Self {
-			Self {
-				localpart,
-				password,
-				email: None,
-				display_name: None,
-				avatar_url: None,
-				suspended: false,
-				locked: false,
-				login_disabled: false,
-				admin: false,
-				skip_auto_join: false,
-				auto_join_rooms: Vec::new(),
-			}
-		}
-	}
-
-	impl Response {
-		#[must_use]
-		pub fn new(user_id: OwnedUserId) -> Self { Self { user_id } }
-	}
-}

src/ruminuwuity/admin/continuwuity/users/list.rs

@@ -1,139 +0,0 @@
-pub mod v1 {
-	use ruma::{
-		OwnedUserId,
-		api::{OAuthClientScope, auth_scheme::AccessToken, request, response},
-		metadata,
-	};
-	use serde::Deserialize;
-
-	metadata! {
-		method: GET,
-		rate_limited: false,
-		authentication: AccessToken,
-		required_scopes: [OAuthClientScope::ServerAdministration],
-		history: {
-			1.0 => "/_continuwuity/admin/v1/users",
-		}
-	}
-
-	#[request]
-	#[derive(Default)]
-	pub struct Request {
-		/// If true, includes deactivated users in the response.
-		#[ruma_api(query)]
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub include_deactivated: bool,
-		/// If true, includes locked users in the response.
-		#[ruma_api(query)]
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub include_locked: bool,
-		/// If true, includes suspended users in the response.
-		#[ruma_api(query)]
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub include_suspended: bool,
-
-		/// The maximum number of results to return in this page. Maximum (and
-		/// default) is 100.
-		#[ruma_api(query)]
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub limit: Option<usize>,
-
-		/// The number of results to skip over before returning results. Default
-		/// is 0.
-		#[ruma_api(query)]
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub offset: Option<usize>,
-	}
-
-	#[derive(Debug, Clone, PartialEq, Eq, Deserialize, serde::Serialize)]
-	pub struct User {
-		/// The full user ID of the user.
-		pub user_id: OwnedUserId,
-
-		/// Whether this user is deactivated.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub deactivated: bool,
-
-		/// Whether this user is suspended.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub suspended: bool,
-
-		/// Whether this user is locked.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub locked: bool,
-
-		/// Whether this user is an admin.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub admin: bool,
-
-		/// Whether this user has their login disabled.
-		#[serde(default, skip_serializing_if = "ruma::serde::is_default")]
-		pub login_disabled: bool,
-	}
-
-	impl User {
-		#[must_use]
-		pub fn new(user_id: OwnedUserId) -> Self {
-			Self {
-				user_id,
-				deactivated: false,
-				suspended: false,
-				locked: false,
-				admin: false,
-				login_disabled: false,
-			}
-		}
-	}
-
-	#[response]
-	#[derive(Default)]
-	pub struct Response {
-		pub users: Vec<User>,
-	}
-
-	impl Request {
-		#[must_use]
-		pub fn new() -> Self { Self::default() }
-	}
-
-	impl Response {
-		#[must_use]
-		pub fn new(users: Vec<User>) -> Self { Self { users } }
-	}
-
-	#[cfg(test)]
-	mod tests {
-		use assign::assign;
-		use serde_json::json;
-
-		use super::*;
-
-		#[test]
-		fn request_defaults() {
-			let req = Request::new();
-			assert!(!req.include_deactivated && !req.include_locked && !req.include_suspended);
-		}
-
-		#[test]
-		fn user_serialize_omits_default_values() {
-			let user_id = OwnedUserId::try_from("@alice:example.org".to_owned()).unwrap();
-			let user = User::new(user_id.clone());
-
-			let expected = json!({ "user_id": user_id.to_string() });
-			assert_eq!(serde_json::to_value(&user).expect("failed to serialize user"), expected);
-
-			let suspended_user = assign!(user, {suspended: true});
-			let expected2 = json!({ "user_id": "@alice:example.org", "suspended": true});
-			assert_eq!(
-				serde_json::to_value(&suspended_user).expect("failed to serialize user"),
-				expected2
-			);
-		}
-
-		#[test]
-		fn response_defaults() {
-			let response = Response::default();
-			assert!(response.users.is_empty());
-		}
-	}
-}

src/ruminuwuity/admin/continuwuity/users/mod.rs

@@ -1,2 +0,0 @@
-pub mod create;
-pub mod list;

src/ruminuwuity/admin/get_suspended.rs

@@ -0,0 +1,53 @@
+//! `GET /_matrix/client/v1/admin/suspend/{userId}`
+//!
+//! Check the suspension status of a target user
+
+pub mod v1 {
+	//! `/_matrix/client/unstable/uk.timedout.msc4323/admin/suspend/{userID}`
+	//! ([msc])
+	//!
+	//! [msc]: https://github.com/matrix-org/matrix-spec-proposals/pull/4323
+
+	use ruma::{
+		OwnedUserId,
+		api::{auth_scheme::AccessToken, request, response},
+		metadata,
+	};
+
+	metadata! {
+		method: GET,
+		rate_limited: false,
+		authentication: AccessToken,
+		history: {
+			unstable => "/_matrix/client/unstable/uk.timedout.msc4323/admin/suspend/{user_id}",
+			1.18 => "/_matrix/client/v1/admin/suspend/{user_id}",
+		}
+	}
+
+	/// Request type for the get & set user suspension status endpoint.
+	#[request(error = ruma::api::error::Error)]
+	pub struct Request {
+		/// The user to look up.
+		#[ruma_api(path)]
+		pub user_id: OwnedUserId,
+	}
+
+	/// Response type for the suspension endpoints
+	#[response(error = ruma::api::error::Error)]
+	pub struct Response {
+		/// Whether the user is currently suspended.
+		pub suspended: bool,
+	}
+
+	impl Request {
+		/// Creates a new `Request` with the given user id.
+		#[must_use]
+		pub fn new(user_id: OwnedUserId) -> Self { Self { user_id } }
+	}
+
+	impl Response {
+		/// Creates a new `Response` with the given suspension status.
+		#[must_use]
+		pub fn new(suspended: bool) -> Self { Self { suspended } }
+	}
+}

src/ruminuwuity/admin/mod.rs

@@ -1 +1,3 @@
 pub mod continuwuity;
+pub mod get_suspended;
+pub mod set_suspended;

src/ruminuwuity/admin/set_suspended.rs

@@ -0,0 +1,55 @@
+//! `PUT /_matrix/client/v1/admin/suspend/{userId}`
+//!
+//! Set the suspension status of a target user
+
+pub mod v1 {
+	//! `/_matrix/client/unstable/uk.timedout.msc4323/admin/suspend/{userID}`
+	//! ([msc])
+	//!
+	//! [msc]: https://github.com/matrix-org/matrix-spec-proposals/pull/4323
+
+	use ruma::{
+		OwnedUserId,
+		api::{auth_scheme::AccessToken, request, response},
+		metadata,
+	};
+
+	metadata! {
+		method: PUT,
+		rate_limited: false,
+		authentication: AccessToken,
+		history: {
+			unstable => "/_matrix/client/unstable/uk.timedout.msc4323/admin/suspend/{user_id}",
+			1.18 => "/_matrix/client/v1/admin/suspend/{user_id}",
+		}
+	}
+
+	/// Request type for the set user suspension status endpoint.
+	#[request(error = ruma::api::error::Error)]
+	pub struct Request {
+		/// The user to look up.
+		#[ruma_api(path)]
+		pub user_id: OwnedUserId,
+
+		pub suspended: bool,
+	}
+
+	/// Response type for the suspension endpoints
+	#[response(error = ruma::api::error::Error)]
+	pub struct Response {
+		/// Whether the user is currently suspended.
+		pub suspended: bool,
+	}
+
+	impl Request {
+		/// Creates a new `Request` with the given user id.
+		#[must_use]
+		pub fn new(user_id: OwnedUserId, suspended: bool) -> Self { Self { user_id, suspended } }
+	}
+
+	impl Response {
+		/// Creates a new `Response` with the given suspension status.
+		#[must_use]
+		pub fn new(suspended: bool) -> Self { Self { suspended } }
+	}
+}

src/service/oauth/grant.rs

@@ -8,7 +8,7 @@
 };
 
 use regex::Regex;
-use ruma::{OwnedDeviceId, api::OAuthClientScope};
+use ruma::OwnedDeviceId;
 use serde::{Deserialize, Serialize};
 use url::Url;
 
@@ -30,15 +30,8 @@ pub struct AuthorizationCodeQuery {
 	pub prompt: Option<Prompt>,
 }
 
-#[derive(Serialize)]
-#[serde(untagged)]
-pub enum AuthorizationCodeResponse {
-	Success(AuthorizationCodeData),
-	Error(OAuthError),
-}
-
-#[derive(Serialize, Deserialize)]
-pub struct AuthorizationCodeData {
+#[derive(Deserialize, Serialize)]
+pub struct AuthorizationCodeResponse {
 	pub state: String,
 	pub code: String,
 }
@@ -90,40 +83,26 @@ pub enum Prompt {
 }
 
 #[derive(Debug, Clone, Deserialize, Serialize, PartialOrd, Ord)]
-pub enum RequestedScope {
+pub enum Scope {
 	Device(OwnedDeviceId),
-	ApiFullAccess,
-	ServerAdministration,
+	ClientApi,
 }
 
-impl RequestedScope {
-	#[must_use]
-	pub fn as_granted_scope(&self) -> Option<OAuthClientScope> {
-		match self {
-			| Self::ApiFullAccess => Some(OAuthClientScope::ApiFullAccess),
-			| Self::ServerAdministration => Some(OAuthClientScope::ServerAdministration),
-			| Self::Device(_) => None,
-		}
-	}
-}
-
-impl PartialEq for RequestedScope {
+impl PartialEq for Scope {
 	fn eq(&self, other: &Self) -> bool { discriminant(self) == discriminant(other) }
 }
 
-impl Eq for RequestedScope {}
+impl Eq for Scope {}
 
-impl Hash for RequestedScope {
+impl Hash for Scope {
 	fn hash<H: std::hash::Hasher>(&self, state: &mut H) { discriminant(self).hash(state); }
 }
 
-impl Display for RequestedScope {
+impl Display for Scope {
 	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
 		let urn = match self {
-			| Self::ApiFullAccess => "urn:matrix:client:api:*".to_owned(),
+			| Self::ClientApi => "urn:matrix:client:api:*".to_owned(),
 			| Self::Device(device_id) => format!("urn:matrix:client:device:{device_id}"),
-			| Self::ServerAdministration =>
-				"urn:matrix:client:cc.c10y.msc4484.server_administration".to_owned(),
 		};
 
 		f.write_str(&urn)
@@ -134,27 +113,22 @@ fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
 pub struct RawScopes(String);
 
 impl RawScopes {
-	pub fn to_scopes(&self) -> Result<BTreeSet<RequestedScope>, String> {
-		let full_access_regex =
+	pub fn to_scopes(&self) -> Result<BTreeSet<Scope>, String> {
+		let client_api_token_regex =
 			Regex::new(r"urn:matrix:(client|org.matrix.msc2967.client):api:\*").unwrap();
 		let device_token_regex = Regex::new(
 			r"urn:matrix:(client|org.matrix.msc2967.client):device:([a-zA-Z0-9-._~]{5,})",
 		)
 		.unwrap();
-		let server_administration_regex =
-			Regex::new(r"urn:matrix:client:cc.c10y.msc4484.server_administration").unwrap();
 
 		let mut scopes = BTreeSet::new();
 
 		for token in self.0.split(' ') {
 			let scope_was_new = {
-				if full_access_regex.is_match(token) {
-					scopes.insert(RequestedScope::ApiFullAccess)
+				if client_api_token_regex.is_match(token) {
+					scopes.insert(Scope::ClientApi)
 				} else if let Some(captures) = device_token_regex.captures(token) {
-					scopes
-						.insert(RequestedScope::Device(captures.get(2).unwrap().as_str().into()))
-				} else if server_administration_regex.is_match(token) {
-					scopes.insert(RequestedScope::ServerAdministration)
+					scopes.insert(Scope::Device(captures.get(2).unwrap().as_str().into()))
 				} else if token == "openid" {
 					// TODO(unspecced): Element sets this scope but doesn't use it for anything
 					true
@@ -279,4 +253,4 @@ pub enum TokenType {
 #[derive(Deserialize)]
 pub struct RevokeTokenRequest {
 	pub token: String,
-}
+}

src/service/oauth/mod.rs

@@ -13,7 +13,7 @@
 use itertools::Itertools;
 use lru_cache::LruCache;
 use rand::distr::{Distribution, slice::Choose};
-use ruma::{DeviceId, OwnedDeviceId, OwnedUserId, UserId, api::OAuthClientScope};
+use ruma::{DeviceId, OwnedDeviceId, OwnedUserId, UserId};
 use serde::{Deserialize, Serialize};
 use url::Url;
 
@@ -22,9 +22,8 @@
 	oauth::{
 		client_metadata::{ApplicationType, ClientMetadata, ResponseType},
 		grant::{
-			AuthorizationCodeData, AuthorizationCodeQuery, AuthorizationCodeResponse,
-			CodeChallengeMethod,
-			DeviceCodeRequest, DeviceCodeResponse, ErrorCode, OAuthError, RequestedScope, ResponseMode,
+			AuthorizationCodeQuery, AuthorizationCodeResponse, CodeChallengeMethod,
+			DeviceCodeRequest, DeviceCodeResponse, ErrorCode, OAuthError, ResponseMode, Scope,
 			TokenRequest, TokenRequestType, TokenResponse, TokenType,
 		},
 	},
@@ -56,7 +55,7 @@ struct Services {
 #[derive(Debug, Deserialize, Serialize)]
 pub struct SessionInfo {
 	pub client_id: String,
-	pub scopes: BTreeSet<OAuthClientScope>,
+	pub scopes: BTreeSet<Scope>,
 	current_refresh_token: String,
 }
 
@@ -69,7 +68,7 @@ struct RefreshTokenInfo {
 
 struct PendingAuthCodeGrant {
 	authorizing_user: OwnedUserId,
-	requested_scopes: BTreeSet<RequestedScope>,
+	requested_scopes: BTreeSet<Scope>,
 	client_name: Option<String>,
 	expected_client_id: String,
 	expected_redirect_uri: Url,
@@ -93,7 +92,7 @@ pub(crate) fn is_valid_for(&self, client_id: &str) -> bool {
 
 struct PendingDeviceCodeGrant {
 	state: DeviceCodeGrantState,
-	requested_scopes: BTreeSet<RequestedScope>,
+	requested_scopes: BTreeSet<Scope>,
 	client_name: Option<String>,
 	client_id: String,
 	requested_at: SystemTime,
@@ -125,7 +124,7 @@ pub(crate) fn is_valid_for(&self, client_id: &str) -> bool {
 pub struct DeviceCodeGrantInfo {
 	pub device_code: String,
 	pub client_metadata: ClientMetadata,
-	pub requested_scopes: BTreeSet<RequestedScope>,
+	pub requested_scopes: BTreeSet<Scope>,
 }
 
 /// A time-limited grant for a client to perform some sensitive action.
@@ -276,59 +275,49 @@ pub async fn request_authorization_code(
 			}
 		}
 
+		let requested_scopes = query.scope.to_scopes()?;
+
 		let redirect_uri_query_separator = match query.response_mode {
 			| ResponseMode::Fragment => '#',
 			| ResponseMode::Query => '?',
 		};
 
-		let response = 'response: {
-			let requested_scopes = query.scope.to_scopes()?;
+		let code = Self::generate_token();
 
-			if requested_scopes.contains(&RequestedScope::ServerAdministration) {
-				// Only server admins can request this scope
-				if !self.services.users.is_admin(&authorizing_user).await {
-					break 'response AuthorizationCodeResponse::Error(OAuthError {
-						error: ErrorCode::AccessDenied,
-						error_description: "You are not a server administrator.".into(),
-					});
-				}
-			}
-
-			let code = Self::generate_token();
-
-			info!(
-				client_id = &query.client_id,
-				client_name = &client_metadata.client_name,
-				?requested_scopes,
-				?authorizing_user,
-				"Issuing OAuth authorization code"
-			);
-
-			let pending_grant = PendingAuthCodeGrant {
-				authorizing_user,
-				requested_scopes,
-				client_name: client_metadata.client_name,
-				expected_client_id: query.client_id,
-				expected_redirect_uri: query.redirect_uri.clone(),
-				code_challenge: query.code_challenge,
-				requested_at: SystemTime::now(),
-			};
-
-			self.pending_auth_code_grants
-				.lock()
-				.await
-				.insert(code.clone(), pending_grant);
-
-			AuthorizationCodeResponse::Success(AuthorizationCodeData { state: query.state, code })
-		};
+		info!(
+			client_id = &query.client_id,
+			client_name = &client_metadata.client_name,
+			?requested_scopes,
+			?authorizing_user,
+			"Issuing OAuth authorization code"
+		);
 
 		let redirect_uri = format!(
 			"{}{}{}",
 			query.redirect_uri,
 			redirect_uri_query_separator,
-			serde_urlencoded::to_string(response).unwrap(),
+			serde_urlencoded::to_string(AuthorizationCodeResponse {
+				state: query.state,
+				code: code.clone(),
+			})
+			.unwrap(),
 		);
 
+		let pending_grant = PendingAuthCodeGrant {
+			authorizing_user,
+			requested_scopes,
+			client_name: client_metadata.client_name,
+			expected_client_id: query.client_id,
+			expected_redirect_uri: query.redirect_uri,
+			code_challenge: query.code_challenge,
+			requested_at: SystemTime::now(),
+		};
+
+		self.pending_auth_code_grants
+			.lock()
+			.await
+			.insert(code, pending_grant);
+
 		Ok(redirect_uri)
 	}
 
@@ -547,7 +536,7 @@ pub async fn revoke_token(&self, token: String) -> Result<(), OAuthError> {
 	async fn create_session(
 		&self,
 		authorizing_user: OwnedUserId,
-		requested_scopes: BTreeSet<RequestedScope>,
+		requested_scopes: BTreeSet<Scope>,
 		client_name: Option<String>,
 		client_id: String,
 	) -> Result<TokenResponse, OAuthError> {
@@ -557,8 +546,8 @@ async fn create_session(
 		let device_id = requested_scopes
 			.iter()
 			.find_map(|scope| {
-				if let RequestedScope::Device(device_id) = scope {
-					Some(device_id)
+				if let Scope::Device(device_id) = scope {
+					Some(device_id.to_owned())
 				} else {
 					None
 				}
@@ -568,7 +557,7 @@ async fn create_session(
 		if self
 			.services
 			.users
-			.get_device_metadata(&authorizing_user, device_id)
+			.get_device_metadata(&authorizing_user, &device_id)
 			.await
 			.is_ok()
 		{
@@ -578,11 +567,11 @@ async fn create_session(
 			));
 		}
 
-		self.services
+		let device_id = self.services
 			.users
 			.create_device(
 				&authorizing_user,
-				device_id,
+				Some(device_id),
 				Some(access_token.clone()),
 				client_name,
 				None,
@@ -592,15 +581,20 @@ async fn create_session(
 			// failure during authentication, which should(?) be impossible(?)
 			.expect("failed to create device");
 
+		info!(
+			?client_id,
+			?authorizing_user,
+			?device_id,
+			?requested_scopes,
+			"Created new oauth session"
+		);
+
 		self.db.userdeviceid_oauthsessioninfo.put(
-			(&authorizing_user, device_id),
+			(&authorizing_user, &device_id),
 			Json(SessionInfo {
 				client_id: client_id.clone(),
 				current_refresh_token: refresh_token.clone(),
-				scopes: requested_scopes
-					.iter()
-					.filter_map(RequestedScope::as_granted_scope)
-					.collect(),
+				scopes: requested_scopes.clone(),
 			}),
 		);
 
@@ -609,18 +603,10 @@ async fn create_session(
 			Json(RefreshTokenInfo {
 				client_id: client_id.clone(),
 				user_id: authorizing_user.clone(),
-				device_id: device_id.to_owned(),
+				device_id,
 			}),
 		);
 
-		info!(
-			?client_id,
-			?authorizing_user,
-			?device_id,
-			?requested_scopes,
-			"Created new oauth session"
-		);
-
 		Ok(TokenResponse {
 			access_token: access_token.into_token(),
 			token_type: TokenType::Bearer,

src/service/oidc/mod.rs

@@ -33,7 +33,7 @@
 
 use crate::{
 	Dep, config, globals, media,
-	oauth::grant::AuthorizationCodeData,
+	oauth::grant::AuthorizationCodeResponse,
 	threepid,
 	users::{self, AccountStatus, ProfileFieldChange},
 };
@@ -261,7 +261,7 @@ pub async fn begin_session(&self, prompt: Option<CoreAuthPrompt>) -> (PendingSes
 	pub async fn exchange_code(
 		&self,
 		session: PendingSession,
-		response: AuthorizationCodeData,
+		response: AuthorizationCodeResponse,
 	) -> Result<Claims, &'static str> {
 		let Some(OidcClient { machine, client, .. }) = self.client.as_ref() else {
 			return Err("Delegated authentication is not enabled on this server.");
@@ -367,7 +367,7 @@ pub async fn complete_session(
 				// Create a new shadow user
 				self.services
 					.users
-					.create_local_account(&user_id, None, None)
+					.create_local_account(&user_id, None, None, None, None)
 					.await
 					.map_err(|err| {
 						error!("Failed to create a shadow user for {user_id}: {err}");

src/service/sending/appservice.rs

@@ -6,7 +6,8 @@
 };
 use ruma::api::{
 	IncomingResponse, OutgoingRequest, OutgoingRequestExt,
-	appservice::{HomeserverToken, Registration},
+	appservice::Registration,
+	auth_scheme::{AccessToken, SendAccessToken},
 	path_builder::SinglePath,
 };
 
@@ -21,9 +22,7 @@ pub async fn send_appservice_request<T>(
 		request: T,
 	) -> Result<Option<T::IncomingResponse>>
 	where
-		T: OutgoingRequest<Authentication = HomeserverToken, PathBuilder = SinglePath>
-			+ Debug
-			+ Send,
+		T: OutgoingRequest<Authentication = AccessToken, PathBuilder = SinglePath> + Debug + Send,
 	{
 		let Some(dest) = registration.url else {
 			return Ok(None);
@@ -37,7 +36,7 @@ pub async fn send_appservice_request<T>(
 
 		let hs_token = registration.hs_token.as_str();
 		let mut http_request = request
-			.try_into_http_request::<BytesMut>(&dest, hs_token, ())
+			.try_into_http_request::<BytesMut>(&dest, SendAccessToken::Appservice(hs_token), ())
 			.map_err(|e| {
 				err!(BadServerResponse(
 					warn!(appservice = %registration.id, "Failed to find destination {dest}: {e:?}")

src/service/server_keys/util.rs

@@ -2,6 +2,7 @@
 
 use ruma::{
 	CanonicalJsonObject, CanonicalJsonValue, OwnedServerName, OwnedServerSigningKeyId,
+	events::room::policy::POLICY_SERVER_ED25519_SIGNING_KEY_ID,
 	room_version_rules::SignaturesRules,
 	signatures::{VerificationError, required_server_signatures_to_verify_event},
 };
@@ -27,6 +28,9 @@ pub(super) fn required_keys(
 			.cloned()
 			.map(TryInto::try_into)
 			.filter_map(Result::ok)
+			.filter(|key_id: &OwnedServerSigningKeyId| {
+				key_id.as_str() != POLICY_SERVER_ED25519_SIGNING_KEY_ID
+			})
 			.for_each(|key_id| entry.push(key_id));
 	}
 

src/service/users/account.rs

@@ -1,4 +1,7 @@
-use std::time::{Duration, SystemTime};
+use std::{
+	net::IpAddr,
+	time::{Duration, SystemTime},
+};
 
 use conduwuit::{
 	Err, Result, debug_error, debug_warn, err, error, info, trace,
@@ -136,6 +139,8 @@ pub async fn create_local_account(
 		user_id: &UserId,
 		password: Option<HashedPassword>,
 		email: Option<Address>,
+		client: Option<&IpAddr>,
+		device_name: Option<&str>,
 	) -> Result<()> {
 		self.create_shadow_account(user_id).await?;
 
@@ -143,6 +148,22 @@ pub async fn create_local_account(
 			self.convert_to_local_account(user_id, password).await?;
 		}
 
+		if let Some(client) = client {
+			let notice = if let Some(device_name) = device_name {
+				format!(
+					"New user \"{user_id}\" registered on this server from IP {client} and \
+					 device display name \"{device_name}\".",
+				)
+			} else {
+				format!("New user \"{user_id}\" registered on this server from IP {client}.")
+			};
+			info!("{notice}");
+
+			if self.services.config.admin_room_notices {
+				self.services.admin.notice(&notice).await;
+			}
+		}
+
 		// Set an initial display name
 		{
 			let mut displayname = user_id.localpart().to_owned();
@@ -197,7 +218,7 @@ pub async fn create_local_account(
 		// register, suspend them.
 		if !was_first_user && self.services.config.suspend_on_register {
 			// Note that we can still do auto joins for suspended users
-			self.suspend_account(user_id, Some(&self.services.globals.server_user))
+			self.suspend_account(user_id, &self.services.globals.server_user)
 				.await;
 
 			// And send an @room notice to the admin room, to prompt admins to review the
@@ -389,13 +410,13 @@ pub async fn deactivate_account(&self, user_id: &UserId) -> Result<()> {
 	}
 
 	/// Suspend account, placing it in a read-only state
-	pub async fn suspend_account(&self, user_id: &UserId, suspending_user: Option<&UserId>) {
+	pub async fn suspend_account(&self, user_id: &UserId, suspending_user: &UserId) {
 		self.db.userid_suspension.raw_put(
 			user_id,
 			Json(UserSuspension {
 				suspended: true,
 				suspended_at: MilliSecondsSinceUnixEpoch::now().get().into(),
-				suspended_by: suspending_user.map(ToString::to_string),
+				suspended_by: suspending_user.to_string(),
 			}),
 		);
 	}
@@ -406,7 +427,7 @@ pub async fn unsuspend_account(&self, user_id: &UserId) {
 	}
 
 	/// Locks an account, preventing it being used until it is unlocked.
-	pub async fn lock_account(&self, user_id: &UserId, locking_user: Option<&UserId>) {
+	pub async fn lock_account(&self, user_id: &UserId, locking_user: &UserId) {
 		// NOTE: Locking is basically just suspension with a more severe effect,
 		// so we'll just re-use the suspension data structure to store the lock state.
 		let suspension = self
@@ -418,7 +439,7 @@ pub async fn lock_account(&self, user_id: &UserId, locking_user: Option<&UserId>
 			.unwrap_or_else(|_| UserSuspension {
 				suspended: true,
 				suspended_at: MilliSecondsSinceUnixEpoch::now().get().into(),
-				suspended_by: locking_user.map(ToString::to_string),
+				suspended_by: locking_user.to_string(),
 			});
 
 		self.db.userid_lock.raw_put(user_id, Json(suspension));

src/service/users/dehydrated_device.rs

@@ -40,7 +40,7 @@ pub async fn set_dehydrated_device(&self, user_id: &UserId, request: Request) ->
 
 		self.create_device(
 			user_id,
-			&request.device_id,
+			Some(request.device_id.clone()),
 			None,
 			request.initial_device_display_name.clone(),
 			None,

src/service/users/device.rs

@@ -42,32 +42,39 @@ pub fn into_token(self) -> String { self.token }
 impl super::Service {
 	/// Adds a new device to a user.
 	///
+	/// If no `device_id` is provided, a random one will be generated.
+	///
 	/// If no `token` is provided, the device will not be able to be logged
 	/// into.
 	pub async fn create_device(
 		&self,
 		user_id: &UserId,
-		device_id: &DeviceId,
+		device_id: Option<OwnedDeviceId>,
 		token: Option<DeviceToken>,
 		initial_device_display_name: Option<String>,
 		client_ip: Option<String>,
-	) -> Result<()> {
+	) -> Result<OwnedDeviceId> {
+		const DEVICE_ID_LENGTH: usize = 10;
+
 		self.status(user_id).await.ensure_active()?;
 
-		let key = (user_id, device_id);
-		let mut device = Device::new(device_id.into());
+		let device_id =
+			device_id.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
+
+		let mut device = Device::new(device_id.clone());
 		device.display_name = initial_device_display_name;
 		device.last_seen_ip = client_ip;
 		device.last_seen_ts = Some(MilliSecondsSinceUnixEpoch::now());
 
+		let key = (user_id, &device_id);
 		increment(&self.db.userid_devicelistversion, user_id.as_bytes());
 		self.db.userdeviceid_metadata.put(key, Json(device));
 
 		if let Some(token) = token {
-			self.set_token(user_id, device_id, token).await?;
+			self.set_token(user_id, &device_id, token).await?;
 		}
 
-		Ok(())
+		Ok(device_id)
 	}
 
 	/// Removes a device from a user.

src/service/users/mod.rs

@@ -32,7 +32,7 @@ pub struct UserSuspension {
 	/// When the user was suspended (Unix timestamp in milliseconds)
 	pub suspended_at: u64,
 	/// User ID of who suspended this user
-	pub suspended_by: Option<String>,
+	pub suspended_by: String,
 }
 
 /// A password hash. This is only for use when setting a user's password,

src/web/pages/account/mod.rs

@@ -70,6 +70,7 @@ enum AccountBody {
 		email_requirement: EmailRequirement,
 		email: Option<String>,
 		devices: Vec<DeviceCard>,
+		dehydrated_device_id: Option<OwnedDeviceId>,
 	},
 	Locked,
 }
@@ -132,7 +133,8 @@ async fn get_account(
 		oidc_enabled: services.oidc.enabled(),
 		email_requirement,
 		email,
-		devices: device_cards
+		devices: device_cards,
+		dehydrated_device_id,
 	}))
 }
 

src/web/pages/account/register.rs

@@ -1,4 +1,4 @@
-use std::{collections::BTreeMap, time::SystemTime};
+use std::{collections::BTreeMap, net::IpAddr, time::SystemTime};
 
 use axum::{
 	Extension, Router,
@@ -6,6 +6,7 @@
 	response::{Redirect, Response},
 	routing::{get, on},
 };
+use conduwuit_api::client_ip::ClientIp;
 use conduwuit_core::{config::TermsDocument, warn};
 use conduwuit_service::{
 	mailer::messages,
@@ -116,6 +117,7 @@ struct CompletedRegistration {
 
 async fn route_register(
 	State(services): State<crate::State>,
+	ClientIp(client): ClientIp, // NOTE: Required for metadata.
 	Extension(context): Extension<TemplateContext>,
 	session_store: Session,
 	Expect(Query(query)): Expect<Query<RegisterQuery>>,
@@ -144,6 +146,7 @@ async fn route_register(
 					session_store,
 					form,
 					query.next.clone(),
+					&client,
 				)
 				.boxed()
 				.await?
@@ -276,6 +279,7 @@ struct RegisterEmailValidateQuery {
 
 async fn get_register_email_validate(
 	State(services): State<crate::State>,
+	ClientIp(client): ClientIp, // NOTE: Required for metadata.
 	Extension(context): Extension<TemplateContext>,
 	session_store: Session,
 	Expect(Query(RegisterEmailValidateQuery {
@@ -303,8 +307,14 @@ async fn get_register_email_validate(
 	let email = session.consume();
 
 	response!(
-		complete_registration(&services, session_store, completed_registration, Some(email))
-			.await?
+		complete_registration(
+			&services,
+			session_store,
+			completed_registration,
+			Some(email),
+			&client
+		)
+		.await?
 	)
 }
 
@@ -314,6 +324,7 @@ async fn begin_registration(
 	session_store: Session,
 	form: RegistrationForm,
 	next: Option<LoginTarget>,
+	client: &IpAddr,
 ) -> Result<Result<Response, ValidationErrors>> {
 	let open_registration = services
 		.config
@@ -496,7 +507,8 @@ async fn begin_registration(
 	} else {
 		// If email isn't required we can immediately complete registration
 		Ok(response!(
-			complete_registration(services, session_store, completed_registration, None).await?
+			complete_registration(services, session_store, completed_registration, None, client)
+				.await?
 		))
 	}
 }
@@ -511,10 +523,11 @@ async fn complete_registration(
 		next,
 	}: CompletedRegistration,
 	email: Option<Address>,
+	client: &IpAddr,
 ) -> Result<Redirect> {
 	services
 		.users
-		.create_local_account(&user_id, Some(password_hash), email)
+		.create_local_account(&user_id, Some(password_hash), email, Some(client), None)
 		.await?;
 
 	if let Some(registration_token) = registration_token {

src/web/pages/components/mod.rs

@@ -3,11 +3,12 @@
 use askama::{Template, filters::HtmlSafe};
 use base64::Engine;
 use conduwuit_core::{result::FlatOk, utils};
-use conduwuit_service::{Services, media::mxc::Mxc, oauth::client_metadata::ClientMetadata};
-use ruma::{
-	OwnedDeviceId, OwnedUserId, UserId,
-	api::{OAuthClientScope, client::device::Device},
+use conduwuit_service::{
+	Services,
+	media::mxc::Mxc,
+	oauth::{client_metadata::ClientMetadata, grant::Scope},
 };
+use ruma::{OwnedDeviceId, OwnedUserId, UserId, api::client::device::Device};
 
 pub(super) mod form;
 
@@ -66,12 +67,15 @@ pub(super) async fn for_local_user(services: &Services, user_id: &UserId) -> Sel
 	pub(super) fn for_device(
 		client_metadata: Option<&ClientMetadata>,
 		display_name: Option<&str>,
+		dehydrated: bool,
 	) -> Self {
 		let avatar_src = client_metadata
 			.and_then(|metadata| metadata.logo_uri.as_ref())
 			.map(|uri| uri.as_str().to_owned());
 
-		let avatar_type = if let Some(avatar_src) = avatar_src {
+		let avatar_type = if dehydrated {
+			AvatarType::Initial('⊡')
+		} else if let Some(avatar_src) = avatar_src {
 			AvatarType::Image(avatar_src)
 		} else if let Some(initial) = display_name.and_then(|name| name.chars().next()) {
 			if client_metadata.is_some() {
@@ -129,6 +133,7 @@ pub(super) struct DeviceCard {
 	pub last_active: String,
 	pub oauth_metadata: Option<ClientMetadata>,
 	pub style: DeviceCardStyle,
+	pub dehydrated: bool,
 }
 
 impl HtmlSafe for DeviceCard {}
@@ -162,12 +167,21 @@ pub(super) async fn for_device(
 		}
 		.await;
 
+		let dehydrated_device_id = services
+			.users
+			.get_dehydrated_device(user_id)
+			.await
+			.ok()
+			.map(|device| device.device_id);
+		let dehydrated = dehydrated_device_id.as_ref() == Some(&device.device_id);
+
 		let display_name = oauth_metadata
 			.as_ref()
 			.and_then(|metadata| metadata.client_name.clone())
 			.or_else(|| device.display_name.clone());
 
-		let avatar = Avatar::for_device(oauth_metadata.as_ref(), display_name.as_deref());
+		let avatar =
+			Avatar::for_device(oauth_metadata.as_ref(), display_name.as_deref(), dehydrated);
 
 		let last_active = device.last_seen_ts.map_or_else(
 			|| "unknown".to_owned(),
@@ -189,6 +203,7 @@ pub(super) async fn for_device(
 			last_active,
 			oauth_metadata,
 			style,
+			dehydrated,
 		}
 	}
 }
@@ -196,7 +211,7 @@ pub(super) async fn for_device(
 #[derive(Debug, Template)]
 #[template(path = "_components/client_scopes.html.j2")]
 pub(super) struct ClientScopes {
-	pub scopes: BTreeSet<OAuthClientScope>,
+	pub scopes: BTreeSet<Scope>,
 }
 
 impl HtmlSafe for ClientScopes {}

src/web/pages/oauth/grant.rs

@@ -6,7 +6,7 @@
 };
 use conduwuit_service::oauth::{
 	client_metadata::ClientMetadata,
-	grant::{AuthorizationCodeQuery, DeviceCodeVerifyQuery, Prompt, RequestedScope},
+	grant::{AuthorizationCodeQuery, DeviceCodeVerifyQuery, Prompt},
 };
 use ruma::OwnedUserId;
 use serde::{Deserialize, de::IgnoredAny};
@@ -102,13 +102,7 @@ async fn route_authorization_code(
 		return Err(WebError::BadRequest("Invalid client ID".to_owned()));
 	};
 
-	let scopes = query
-		.scope
-		.to_scopes()
-		.map_err(WebError::BadRequest)?
-		.iter()
-		.filter_map(RequestedScope::as_granted_scope)
-		.collect();
+	let scopes = query.scope.to_scopes().map_err(WebError::BadRequest)?;
 
 	let user_avatar = Avatar::for_local_user(&services, &user_id).await;
 
@@ -191,11 +185,6 @@ async fn route_device_code(
 
 			let user_avatar = Avatar::for_local_user(&services, &user_id).await;
 
-			let scopes = grant_info.requested_scopes
-				.iter()
-				.filter_map(RequestedScope::as_granted_scope)
-				.collect();
-
 			response!(Grant::new(
 				context,
 				serde_urlencoded::to_string(LoginQuery {
@@ -207,7 +196,7 @@ async fn route_device_code(
 				user_id,
 				user_avatar,
 				grant_info.client_metadata,
-				ClientScopes { scopes },
+				ClientScopes { scopes: grant_info.requested_scopes },
 				Some(grant_info.device_code),
 			))
 		},

src/web/pages/oidc/complete.rs

@@ -7,7 +7,7 @@
 	routing::on,
 };
 use conduwuit_service::{
-	oauth::grant::AuthorizationCodeData,
+	oauth::grant::AuthorizationCodeResponse,
 	oidc::{ClaimedLocalUser, SessionCompletionStatus},
 };
 use futures::FutureExt;
@@ -60,7 +60,7 @@ struct LoginForm {
 async fn route_complete(
 	State(services): State<crate::State>,
 	Extension(context): Extension<TemplateContext>,
-	Expect(Query(query)): Expect<Query<AuthorizationCodeData>>,
+	Expect(Query(query)): Expect<Query<AuthorizationCodeResponse>>,
 	session_store: Session,
 	user: User<true>,
 	PostForm(form): PostForm<LoginForm>,

src/web/pages/templates/_components/client_scopes.html.j2

@@ -1,13 +1,10 @@
 <ul>
     {% for scope in scopes %}
         {% match scope %}
-            {% when OAuthClientScope::ApiFullAccess %}
+            {% when Scope::ClientApi %}
                 <li>Send messages and interact with chatrooms on your behalf</li>
-            {% when OAuthClientScope::ServerAdministration %}
-                <li>⚠️ Administrate this homeserver
-                <br><em class="negative">This is a dangerous permission. Make sure you trust this app.</em></li>
-            {% when _ %}
-                <li>missingno</li>
+            {% when Scope::Device(_) %}
+                <li>Access your Matrix account</li>
         {% endmatch %}
     {% endfor %}
 </ul>

src/web/pages/templates/_components/device_card.html.j2

@@ -1,37 +1,41 @@
 <div class="card">
     {{ avatar }}
     <div class="info">
-        <div class="name">
-            <span>
-                {% if let Some(display_name) = display_name %}
-                    {{ display_name }}
-                {% else %}
-                    Unknown device
-                {% endif %}
-            </span>
-            {% if style == DeviceCardStyle::Detailed %}
-                <span class="id">
-                    <span class="mobile-hidden">•</span>
-                    <ul class="bullet-separated">
-                        <li>{{ device_id }}</li>
-                        <li>
-                            {% if let Some(metadata) = oauth_metadata %}
-                                <a href="{{ metadata.client_uri }}">Client website</a>
-                            {% else %}
-                                legacy
-                            {% endif %}
-                        </li>
-                    </span>
+        {% if dehydrated %}
+            <div class="name">Dehydrated device</div>
+        {% else %}
+            <div class="name">
+                <span>
+                    {% if let Some(display_name) = display_name %}
+                        {{ display_name }}
+                    {% else %}
+                        Unknown device
+                    {% endif %}
                 </span>
+                {% if style == DeviceCardStyle::Detailed %}
+                    <span class="id">
+                        <span class="mobile-hidden">•</span>
+                        <ul class="bullet-separated">
+                            <li>{{ device_id }}</li>
+                            <li>
+                                {% if let Some(metadata) = oauth_metadata %}
+                                    <a href="{{ metadata.client_uri }}">Client website</a>
+                                {% else %}
+                                    legacy
+                                {% endif %}
+                            </li>
+                        </span>
+                    </span>
+                {% endif %}
+            </div>
+            <div>
+                Last active: {{ last_active }}
+            </div>
+            <div>
+            {% if style != DeviceCardStyle::Detailed %}
+                <a href="{{ crate::ROUTE_PREFIX }}/account/device/{{ device_id }}/">Details</a>
             {% endif %}
-        </div>
-        <div>
-            Last active: {{ last_active }}
-        </div>
-        <div>
-        {% if style != DeviceCardStyle::Detailed %}
-            <a href="{{ crate::ROUTE_PREFIX }}/account/device/{{ device_id }}/">Details</a>
+            </div>
         {% endif %}
-        </div>
     </div>
 </div>

src/web/pages/templates/account.html.j2

@@ -9,7 +9,7 @@ Your account
     <h1>Manage your account</h1>
     {{ user_card }}
     {% match body %}
-        {% when AccountBody::Unlocked { suspended, email_requirement, email, devices, oidc_enabled } %}
+        {% when AccountBody::Unlocked { suspended, email_requirement, email, devices, oidc_enabled, dehydrated_device_id } %}
             {% if suspended %}
                 <p class="card danger">
                     ⚠️ Your account has been suspended by your homeserver's administrator.
@@ -52,6 +52,9 @@ Your account
                                 and sign in to start chatting on Matrix.
                             </span>
                         {% endfor %}
+                        {% if let Some(dehydrated_device_id) = dehydrated_device_id %}
+                            <small>⊡ Your account has a dehydrated device. <a href="device/{{ dehydrated_device_id | urlencode_strict }}/">View details</a></small>
+                        {% endif %}
                     </div>
                 </details>
             </section>

src/web/pages/templates/device_info.html.j2

@@ -27,6 +27,8 @@ Device information
             {% if let Some((_, session_info)) = client_metadata %}
                 This device has permission to:
                 {{ ClientScopes { scopes: session_info.scopes.clone() } }}
+            {% else if device_card.dehydrated %}
+                This is your dehydrated device. It saves encryption keys for you while you're offline.
             {% else %}
                 This device can access and control all features of your Matrix account.
                 <br>

src/web/session/mod.rs

@@ -4,6 +4,7 @@
 	time::{Duration, SystemTime},
 };
 
+use askama::filters::urlencode_strict;
 use axum::{
 	extract::FromRequestParts,
 	http::request::Parts,
@@ -63,8 +64,11 @@ pub(crate) fn target_path(&self) -> String {
 			| Self::DeviceCode(code) =>
 				format!("oauth2/grant/device_code?{}", serde_urlencoded::to_string(code).unwrap())
 					.into(),
-			| Self::DeviceInfo(path) => format!("account/device/{}/", path.device).into(),
-			| Self::RemoveDevice(path) => format!("account/device/{}/remove", path.device).into(),
+			| Self::DeviceInfo(path) =>
+				format!("account/device/{}/", urlencode_strict(&path.device).unwrap()).into(),
+			| Self::RemoveDevice(path) =>
+				format!("account/device/{}/remove", urlencode_strict(&path.device).unwrap())
+					.into(),
 		};
 
 		format!("{ROUTE_PREFIX}/{path}")