chore: Clippy fixes

refactor: Represent route auth information in the type system
2026-07-05 20:21:36 +00:00 · 2026-05-26 13:49:17 -04:00 · 2026-05-26 13:28:23 -04:00
205 changed files with 2059 additions and 8028 deletions
@@ -75,7 +75,7 @@ runs:

    - name: Set up QEMU
      if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4

    - name: Login to builtin registry
      if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
@@ -71,7 +71,7 @@ runs:

    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@e49978b799e49ff429d162b7a30601a569ab6538 # v2
+      uses: https://github.com/taiki-e/install-action@920ab1831fbf4fb3ef75c8ead83556c918bb7290 # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1

@@ -43,7 +43,7 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.214.6@sha256:fd228b92f067204e444ddea1ec2fefb007592f9a46845e966f9334d5bd4bb52c
+      image: ghcr.io/renovatebot/renovate:43.195.3@sha256:868dffc3d6a46f42dfefe48b6978cc063d8df9c1d58a93a694c8989afa503e34
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
@@ -1,4 +1,4 @@
-github: [JadedBlueEyes, timedoutuk, gingershaped]
+github: [JadedBlueEyes, nexy7574, gingershaped]
 custom:
  - https://timedout.uk/donate.html
  - https://jade.ellis.link/sponsors
@@ -24,7 +24,7 @@ repos:
        - id: check-added-large-files

  - repo: https://github.com/crate-ci/typos
-    rev: v1.47.2
+    rev: v1.46.2
    hooks:
      - id: typos
      - id: typos
@@ -678,9 +678,9 @@ dependencies = [

 [[package]]
 name = "chrono"
-version = "0.4.45"
+version = "0.4.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
+checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 dependencies = [
 "num-traits",
 ]
@@ -827,7 +827,7 @@ dependencies = [
 "opentelemetry-otlp",
 "opentelemetry_sdk",
 "parking_lot",
- "reqwest 0.13.4",
+ "reqwest 0.13.3",
 "rustls",
 "sentry",
 "sentry-tower",
@@ -893,7 +893,7 @@ dependencies = [
 "lettre",
 "log",
 "rand 0.10.1",
- "reqwest 0.13.4",
+ "reqwest 0.13.3",
 "ruma",
 "ruminuwuity",
 "serde",
@@ -955,7 +955,7 @@ dependencies = [
 "rand 0.10.1",
 "rand_core 0.6.4",
 "regex",
- "reqwest 0.13.4",
+ "reqwest 0.13.3",
 "ruma",
 "sanitize-filename",
 "serde",
@@ -1066,7 +1066,7 @@ dependencies = [
 "either",
 "futures",
 "governor",
- "hickory-resolver 0.25.2",
+ "hickory-resolver",
 "http",
 "image",
 "ipaddress",
@@ -1080,7 +1080,7 @@ dependencies = [
 "recaptcha-verify",
 "regex",
 "reqwest 0.12.28",
- "reqwest 0.13.4",
+ "reqwest 0.13.3",
 "ruma",
 "ruminuwuity",
 "rustyline-async",
@@ -1088,7 +1088,6 @@ dependencies = [
 "serde",
 "serde-saphyr",
 "serde_json",
- "serde_urlencoded",
 "sha2 0.11.0",
 "termimad",
 "tokio",
@@ -1108,29 +1107,18 @@ dependencies = [
 "axum",
 "axum-extra",
 "base64 0.22.1",
- "conduwuit_api",
 "conduwuit_build_metadata",
 "conduwuit_core",
- "conduwuit_database",
 "conduwuit_service",
- "form_urlencoded",
 "futures",
- "lettre",
 "memory-serve",
 "rand 0.10.1",
- "recaptcha-verify",
- "reqwest 0.12.28",
 "ruma",
 "serde",
- "serde_json",
- "serde_urlencoded",
 "thiserror",
 "tower-http",
 "tower-sec-fetch",
- "tower-sessions",
- "tower-sessions-core",
 "tracing",
- "url",
 "validator",
 ]

@@ -1224,16 +1212,6 @@ dependencies = [
 "crossterm",
 ]

-[[package]]
-name = "core-foundation"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -1424,9 +1402,9 @@ dependencies = [

 [[package]]
 name = "ctor"
-version = "1.0.7"
+version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "01334b89b69ff726750c5ce5073fc8bd860e99aa9a8fc5ca11b04730e3aee97a"
+checksum = "6d765eb1c0bda10d31e0ea185f5ee15da532d60b0912d2bd1441783439e749c5"
 dependencies = [
 "link-section",
 "linktime-proc-macro",
@@ -1548,7 +1526,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
 "powerfmt",
- "serde_core",
 ]

 [[package]]
@@ -1627,9 +1604,9 @@ dependencies = [

 [[package]]
 name = "dtor"
-version = "1.0.5"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d738e43aa64edab57c983d56de890d65fea7dc05605490c74451ce721dfd84b"
+checksum = "e2137ce22f50d4c43ce098daf41c904cc700de1ce8bc2daf53ed4e702180a464"
 dependencies = [
 "linktime-proc-macro",
 ]
@@ -1732,7 +1709,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
 "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -2206,30 +2183,6 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"

-[[package]]
-name = "hickory-net"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2295ed2f9c31e471e1428a8f88a3f0e1f4b27c15049592138d1eebe9c35b183"
-dependencies = [
- "async-trait",
- "cfg-if",
- "data-encoding",
- "futures-channel",
- "futures-io",
- "futures-util",
- "hickory-proto 0.26.1",
- "idna",
- "ipnet",
- "jni",
- "rand 0.10.1",
- "thiserror",
- "tinyvec",
- "tokio",
- "tracing",
- "url",
-]
-
 [[package]]
 name = "hickory-proto"
 version = "0.25.2"
@@ -2256,26 +2209,6 @@ dependencies = [
 "url",
 ]

-[[package]]
-name = "hickory-proto"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
-dependencies = [
- "data-encoding",
- "idna",
- "ipnet",
- "jni",
- "once_cell",
- "prefix-trie",
- "rand 0.10.1",
- "ring",
- "thiserror",
- "tinyvec",
- "tracing",
- "url",
-]
-
 [[package]]
 name = "hickory-resolver"
 version = "0.25.2"
@@ -2284,7 +2217,7 @@ checksum = "dc62a9a99b0bfb44d2ab95a7208ac952d31060efc16241c87eaf36406fecf87a"
 dependencies = [
 "cfg-if",
 "futures-util",
- "hickory-proto 0.25.2",
+ "hickory-proto",
 "ipconfig",
 "moka",
 "once_cell",
@@ -2298,32 +2231,6 @@ dependencies = [
 "tracing",
 ]

-[[package]]
-name = "hickory-resolver"
-version = "0.26.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0d58d28879ceecde6607729660c2667a081ccdc082e082675042793960f178c"
-dependencies = [
- "cfg-if",
- "futures-util",
- "hickory-net",
- "hickory-proto 0.26.1",
- "ipconfig",
- "ipnet",
- "jni",
- "moka",
- "ndk-context",
- "once_cell",
- "parking_lot",
- "rand 0.10.1",
- "resolv-conf",
- "smallvec",
- "system-configuration",
- "thiserror",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "hmac"
 version = "0.13.0"
@@ -2360,9 +2267,9 @@ dependencies = [

 [[package]]
 name = "http"
-version = "1.4.1"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
+checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
 dependencies = [
 "bytes",
 "itoa",
@@ -2429,9 +2336,9 @@ dependencies = [

 [[package]]
 name = "hyper"
-version = "1.10.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+checksum = "6299f016b246a94207e63da54dbe807655bf9e00044f73ded42c3ac5305fbcca"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -2693,9 +2600,6 @@ name = "ipnet"
 version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
-dependencies = [
- "serde",
-]

 [[package]]
 name = "itertools"
@@ -2924,9 +2828,9 @@ dependencies = [

 [[package]]
 name = "link-section"
-version = "0.18.1"
+version = "0.17.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "014e440054ce8170890229eeef5bcda955305e056ec713de40ed366944483f09"
+checksum = "4d1e908a416d6e9f725743b84a36feea40c4c131e805fbc26d61f9f451f36080"

 [[package]]
 name = "linked-hash-map"
@@ -2936,9 +2840,9 @@ checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"

 [[package]]
 name = "linktime-proc-macro"
-version = "0.2.0"
+version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c7b0a3383c2a1002d11349c92c85a666a5fb679e96c79d782cf0dbe557fd6ee"
+checksum = "a44cd706ff0d503ee32b2071166510ca27e281228de10cd3aa8d35ff94560f81"

 [[package]]
 name = "linux-raw-sys"
@@ -2969,9 +2873,9 @@ dependencies = [

 [[package]]
 name = "log"
-version = "0.4.32"
+version = "0.4.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
+checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"

 [[package]]
 name = "loole"
@@ -3179,12 +3083,6 @@ dependencies = [
 "pxfm",
 ]

-[[package]]
-name = "ndk-context"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
-
 [[package]]
 name = "new_debug_unreachable"
 version = "1.0.6"
@@ -3240,7 +3138,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -3540,7 +3438,7 @@ dependencies = [
 "bytes",
 "http",
 "opentelemetry",
- "reqwest 0.13.4",
+ "reqwest 0.13.3",
 ]

 [[package]]
@@ -3555,7 +3453,7 @@ dependencies = [
 "opentelemetry-proto",
 "opentelemetry_sdk",
 "prost",
- "reqwest 0.13.4",
+ "reqwest 0.13.3",
 "thiserror",
 "tokio",
 "tonic",
@@ -3577,9 +3475,9 @@ dependencies = [

 [[package]]
 name = "opentelemetry_sdk"
-version = "0.32.1"
+version = "0.32.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b59f80e1ac4d5ff7a2db8fb6c80badb7f0f3f858211fba08dd9aaec750894f9"
+checksum = "368afaed344110f40b179bb8fbe54bc52d98f9bd2b281799ef32487c2650c956"
 dependencies = [
 "futures-channel",
 "futures-executor",
@@ -3825,17 +3723,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"

-[[package]]
-name = "prefix-trie"
-version = "0.8.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7"
-dependencies = [
- "either",
- "ipnet",
- "num-traits",
-]
-
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -4197,9 +4084,9 @@ dependencies = [

 [[package]]
 name = "reqwest"
-version = "0.13.4"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+checksum = "62e0021ea2c22aed41653bc7e1419abb2c97e038ff2c33d0e1309e49a97deec0"
 dependencies = [
 "base64 0.22.1",
 "bytes",
@@ -4209,7 +4096,7 @@ dependencies = [
 "h2",
 "h3",
 "h3-quinn",
- "hickory-resolver 0.26.1",
+ "hickory-resolver",
 "http",
 "http-body",
 "http-body-util",
@@ -4263,8 +4150,8 @@ dependencies = [

 [[package]]
 name = "ruma"
-version = "0.16.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.15.1"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "assign",
 "js_int",
@@ -4282,8 +4169,8 @@ dependencies = [

 [[package]]
 name = "ruma-appservice-api"
-version = "0.16.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.15.0"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "js_int",
 "ruma-common",
@@ -4294,8 +4181,8 @@ dependencies = [

 [[package]]
 name = "ruma-client-api"
-version = "0.24.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.23.1"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "as_variant",
 "assign",
@@ -4316,8 +4203,8 @@ dependencies = [

 [[package]]
 name = "ruma-common"
-version = "0.19.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.18.0"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "as_variant",
 "base64 0.22.1",
@@ -4349,8 +4236,8 @@ dependencies = [

 [[package]]
 name = "ruma-events"
-version = "0.34.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.33.0"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "as_variant",
 "indexmap",
@@ -4370,8 +4257,8 @@ dependencies = [

 [[package]]
 name = "ruma-federation-api"
-version = "0.15.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.14.0"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "bytes",
 "headers",
@@ -4394,7 +4281,7 @@ dependencies = [
 [[package]]
 name = "ruma-identifiers-validation"
 version = "0.12.1"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "js_int",
 "thiserror",
@@ -4402,8 +4289,8 @@ dependencies = [

 [[package]]
 name = "ruma-macros"
-version = "0.19.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.18.0"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "as_variant",
 "cfg-if",
@@ -4418,8 +4305,8 @@ dependencies = [

 [[package]]
 name = "ruma-push-gateway-api"
-version = "0.15.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.14.0"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "js_int",
 "ruma-common",
@@ -4430,8 +4317,8 @@ dependencies = [

 [[package]]
 name = "ruma-signatures"
-version = "0.21.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.20.0"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "base64 0.22.1",
 "ed25519-dalek",
@@ -4446,8 +4333,8 @@ dependencies = [

 [[package]]
 name = "ruma-state-res"
-version = "0.17.0"
-source = "git+https://github.com/gingershaped/ruwuma.git?rev=a0178c4e5e1729d27cf2f1c4dacf77b763987749#a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+version = "0.16.0"
+source = "git+https://github.com/ruma/ruma.git?rev=9c9dccc93f054bbd28f23f630223fffa6289ecbc#9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 dependencies = [
 "js_int",
 "ruma-common",
@@ -4528,7 +4415,7 @@ dependencies = [
 "errno",
 "libc",
 "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4575,7 +4462,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
- "core-foundation 0.10.1",
+ "core-foundation",
 "core-foundation-sys",
 "jni",
 "log",
@@ -4587,7 +4474,7 @@ dependencies = [
 "security-framework",
 "security-framework-sys",
 "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -4683,7 +4570,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
 "bitflags",
- "core-foundation 0.10.1",
+ "core-foundation",
 "core-foundation-sys",
 "libc",
 "security-framework-sys",
@@ -4717,7 +4604,7 @@ checksum = "931a20b0da02350676e3d6d3c9028d58eaa448cf42a866712eec5845a505421e"
 dependencies = [
 "cfg_aliases",
 "httpdate",
- "reqwest 0.13.4",
+ "reqwest 0.13.3",
 "sentry-backtrace",
 "sentry-contexts",
 "sentry-core",
@@ -4860,7 +4747,7 @@ checksum = "dcc7fe48e34d02a97bc8e6253b8b91e5a47fe2c47eaacb5149cefbb69922eaf0"
 dependencies = [
 "ahash",
 "annotate-snippets",
- "base64 0.21.7",
+ "base64 0.22.1",
 "encoding_rs_io",
 "getrandom 0.3.4",
 "granit-parser",
@@ -4930,9 +4817,9 @@ dependencies = [

 [[package]]
 name = "serde_regex"
-version = "1.2.0"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bafc8d0c5330cecff10f16b459b479fd9acaa5b4acd7167301414e21b0057012"
+checksum = "a8136f1a4ea815d7eac4101cfd0b16dc0cb5e1fe1b8609dfd728058656b7badf"
 dependencies = [
 "regex",
 "serde",
@@ -5140,7 +5027,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
 "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -5242,27 +5129,6 @@ dependencies = [
 "syn",
 ]

-[[package]]
-name = "system-configuration"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
-dependencies = [
- "bitflags",
- "core-foundation 0.9.4",
- "system-configuration-sys",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
 [[package]]
 name = "tagptr"
 version = "0.2.0"
@@ -5677,22 +5543,6 @@ dependencies = [
 "tracing",
 ]

-[[package]]
-name = "tower-cookies"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "151b5a3e3c45df17466454bb74e9ecedecc955269bdedbf4d150dfa393b55a36"
-dependencies = [
- "axum-core",
- "cookie",
- "futures-util",
- "http",
- "parking_lot",
- "pin-project-lite",
- "tower-layer",
- "tower-service",
-]
-
 [[package]]
 name = "tower-http"
 version = "0.6.11"
@@ -5741,44 +5591,6 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"

-[[package]]
-name = "tower-sessions"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "518dca34b74a17cadfcee06e616a09d2bd0c3984eff1769e1e76d58df978fc78"
-dependencies = [
- "async-trait",
- "http",
- "time",
- "tokio",
- "tower-cookies",
- "tower-layer",
- "tower-service",
- "tower-sessions-core",
- "tracing",
-]
-
-[[package]]
-name = "tower-sessions-core"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "568531ec3dfcf3ffe493de1958ae5662a0284ac5d767476ecdb6a34ff8c6b06c"
-dependencies = [
- "async-trait",
- "axum-core",
- "base64 0.22.1",
- "futures",
- "http",
- "parking_lot",
- "rand 0.9.4",
- "serde",
- "serde_json",
- "thiserror",
- "time",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "tracing"
 version = "0.1.44"
@@ -6274,7 +6086,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]

 [[package]]
@@ -343,8 +343,8 @@ version = "1.1.1"
 # Used for matrix spec type definitions and helpers
 [workspace.dependencies.ruma]
 # version = "0.14.1"
-git = "https://github.com/gingershaped/ruwuma.git"
-rev = "a0178c4e5e1729d27cf2f1c4dacf77b763987749"
+git = "https://github.com/ruma/ruma.git"
+rev = "9c9dccc93f054bbd28f23f630223fffa6289ecbc"
 features = [
    "appservice-api-c",
    "client-api",
@@ -373,13 +373,12 @@ features = [
    "unstable-msc4195",
    "unstable-msc4203",
    "unstable-msc4310",
+    "unstable-msc4373",
    "unstable-msc4380",
    "unstable-msc4143",
    "unstable-msc4293",
    "unstable-msc4406",
    "unstable-msc4439",
-    "unstable-msc4466",
-    "unstable-msc4484",
    "unstable-extensible-events",
 ]

@@ -560,9 +559,6 @@ features = ["std"]
 [workspace.dependencies.nonzero_ext]
 version = "0.3.0"

-[workspace.dependencies.serde_urlencoded]
-version = "0.7.1"
-
 #
 # Patches
 #
@@ -1 +0,0 @@
-Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.
@@ -1 +0,0 @@
-Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.
@@ -1 +0,0 @@
-Added support for MSC4466, which allows clients to customize how changes to a user's global profile are propagated. Contributed by @ginger.
@@ -1 +0,0 @@
-Devices which set their presence as "offline" will no longer be considered for presence updates. Contributed by @timedout.
@@ -1 +0,0 @@
-Remove support for MSC4373, as the MSC is now closed. Contributed by @vel.
@@ -521,15 +521,17 @@
 #
 #recaptcha_private_site_key =

-# Controls whether users are allowed to deactivate their own accounts
-# through the account management panel or their Matrix clients. Server
-# admins can always deactivate users using the relevant admin commands.
+# Policy documents, such as terms and conditions or a privacy policy,
+# which users must agree to when registering an account.
 #
-# Note that, in some jurisdictions, you may be legally required to honor
-# users who request to deactivate their accounts if you set this option
-# to `false`.
+# Example:
+# ```ignore
+# [global.registration_terms.privacy_policy]
+# en = { name = "Privacy Policy", url = "https://homeserver.example/en/privacy_policy.html" }
+# es = { name = "Política de Privacidad", url = "https://homeserver.example/es/privacy_policy.html" }
+# ```
 #
-#allow_deactivation = true
+#registration_terms = {}

 # Controls whether encrypted rooms and events are allowed.
 #
@@ -1985,33 +1987,3 @@
 # `require_email_for_registration`.
 #
 #require_email_for_token_registration = false
-
-#[global.registration_terms]
-
-# The language code to provide to clients along with the policy documents.
-#
-#language = "en"
-
-# Policy documents, such as terms and conditions or a privacy policy,
-# which users must agree to when registering an account.
-#
-# Example:
-# ```ignore
-# [global.registration_terms.documents]
-# privacy_policy = { name = "Privacy Policy", url = "https://homeserver.example/en/privacy_policy.html" }
-# ```
-#
-#documents = {}
-
-#[global.oauth]
-
-# The compatibility mode to use for OAuth.
-#
-# - "disabled": OAuth will be unavailable. Users will only be able to log
-#   in using legacy authentication.
-# - "hybrid": OAuth and legacy authentication will both be available. Some
-#   clients may only use one or the other.
-# - "exclusive": Only OAuth will be available. Clients which require
-#   legacy authentication will be unable to log in.
-#
-#compatibility_mode = "hybrid"
@@ -16,7 +16,7 @@
            file = inputs.self + "/rust-toolchain.toml";

            # See also `rust-toolchain.toml`
-            sha256 = "sha256-mvUGEOHYJpn3ikC5hckneuGixaC+yGrkMM/liDIDgoU=";
+            sha256 = "sha256-gh/xTkxKHL4eiRXzWv8KP7vfjSk61Iq48x47BEDFgfk=";
          };
        in
        {
@@ -125,14 +125,14 @@
      }
    },
    "node_modules/@rsbuild/core": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.11.tgz",
-      "integrity": "sha512-Mpp/viUSkVdSWJkFipdZxM2nUztrBwSnMm6Q86bPzLHtHnXqQ3VFpSMlA4wWRyySNddP6s6efKiVpx0ZOCf7Gg==",
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/@rsbuild/core/-/core-2.0.7.tgz",
+      "integrity": "sha512-LsBONEzsjzOAqO72ot39eI7g53zSfF9QuDXTu4ks8IUX+EZsxRSniQfc+1zVA6a6y3b9KUUtG96avoMLKbWklQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/core": "~2.0.6",
-        "@swc/helpers": "^0.5.23"
+        "@rspack/core": "~2.0.4",
+        "@swc/helpers": "^0.5.21"
      },
      "bin": {
        "rsbuild": "bin/rsbuild.js"
@@ -150,9 +150,9 @@
      }
    },
    "node_modules/@rsbuild/plugin-react": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@rsbuild/plugin-react/-/plugin-react-2.0.1.tgz",
-      "integrity": "sha512-n5m3VxEm6m3Dv1VkI0WnxsildySJ6M+QjGIzkZDy5UebRCIJ1Q/hlQVyhofBL6C+AcsF9fGjlHQkeiteXJSr3Q==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@rsbuild/plugin-react/-/plugin-react-2.0.0.tgz",
+      "integrity": "sha512-/1gzt39EGUSFEqB83g46QoOwsgv172HI18i6au1b6lgIaX4sv9stuX4ijdHbHCp8PqYEq+MyQ99jIQMO6I+etg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -169,28 +169,28 @@
      }
    },
    "node_modules/@rspack/binding": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.6.tgz",
-      "integrity": "sha512-z5EO9mPlmYNpHAlRGub0Chr6D+Klgy+tX36n7tCm7VRGRlwTmTU9wSENrYbHcCpFbegtrE0s30rDeTBeOu+JiQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding/-/binding-2.0.4.tgz",
+      "integrity": "sha512-/QeJDPUw/lWkBJESG264KA9u6/rAjvoJhKncU4rkTi5Ap45kue5HTgOzr0ufxKdd2Xl72fjFBuqlKmtFDD5LiQ==",
      "dev": true,
      "license": "MIT",
      "optionalDependencies": {
-        "@rspack/binding-darwin-arm64": "2.0.6",
-        "@rspack/binding-darwin-x64": "2.0.6",
-        "@rspack/binding-linux-arm64-gnu": "2.0.6",
-        "@rspack/binding-linux-arm64-musl": "2.0.6",
-        "@rspack/binding-linux-x64-gnu": "2.0.6",
-        "@rspack/binding-linux-x64-musl": "2.0.6",
-        "@rspack/binding-wasm32-wasi": "2.0.6",
-        "@rspack/binding-win32-arm64-msvc": "2.0.6",
-        "@rspack/binding-win32-ia32-msvc": "2.0.6",
-        "@rspack/binding-win32-x64-msvc": "2.0.6"
+        "@rspack/binding-darwin-arm64": "2.0.4",
+        "@rspack/binding-darwin-x64": "2.0.4",
+        "@rspack/binding-linux-arm64-gnu": "2.0.4",
+        "@rspack/binding-linux-arm64-musl": "2.0.4",
+        "@rspack/binding-linux-x64-gnu": "2.0.4",
+        "@rspack/binding-linux-x64-musl": "2.0.4",
+        "@rspack/binding-wasm32-wasi": "2.0.4",
+        "@rspack/binding-win32-arm64-msvc": "2.0.4",
+        "@rspack/binding-win32-ia32-msvc": "2.0.4",
+        "@rspack/binding-win32-x64-msvc": "2.0.4"
      }
    },
    "node_modules/@rspack/binding-darwin-arm64": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.6.tgz",
-      "integrity": "sha512-0giCKiWlBfcM4i2scv1j2k9HlSecO9Ybhaa5wsMUyvcFeKr9HbNHh7C2eDFlC6zaI85IUdY71TXF/g/Tcxr9MA==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-arm64/-/binding-darwin-arm64-2.0.4.tgz",
+      "integrity": "sha512-0Q1QXFEsZfDc4opiDnb8q50KlBbC2VovViDaYlMJZBzvjAo325mh3itXPfz7YZ31M+TxRE7TUiJXH3ltiV1Hdg==",
      "cpu": [
        "arm64"
      ],
@@ -202,9 +202,9 @@
      ]
    },
    "node_modules/@rspack/binding-darwin-x64": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.6.tgz",
-      "integrity": "sha512-/mMo2IpI02aOKMlHbVbZue3TJxFqHGX+ibVTdEO+6bzRSuHs7+R9KM5U3XH2YxcWJy5Sid1X1T1pJAjsXcE3rA==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-darwin-x64/-/binding-darwin-x64-2.0.4.tgz",
+      "integrity": "sha512-oO5J2QYf7+H+aYRj85EiGrDOoDEE9EDDl7NgXv46iWvIF0wXowEHXqnjMFxHxRq2Vf6scT+0yYQX9blWcvMWAA==",
      "cpu": [
        "x64"
      ],
@@ -216,9 +216,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-arm64-gnu": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.6.tgz",
-      "integrity": "sha512-H6ACzeM1KBxYDEF8YAim3501Jb1aCsSG79Gjm1M4pwJ5OJPK2ydiJEa438ugXmh0962eKYMHI2yZY0sQq8txaw==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-2.0.4.tgz",
+      "integrity": "sha512-BEk6mIYBK4BihW9qXXITJORrVXecTlkRjrqhgefili4xjXtLdcUnxAm9sN/2oJ8m378n2h33qDh4gr2orPBFWQ==",
      "cpu": [
        "arm64"
      ],
@@ -233,9 +233,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-arm64-musl": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.6.tgz",
-      "integrity": "sha512-QTFmBg0n+L397Wi8CIjbd5pe/hxpHnqCDaG1A7e2NWX8Fj9zulAoKLiKflQa1ELEhAY4Foq88aX75+Ilt2tHcw==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-arm64-musl/-/binding-linux-arm64-musl-2.0.4.tgz",
+      "integrity": "sha512-Hyt3z1RwNcSMIoaoWLN4Hb/696/O5JPukf8rXQASvf2UkC+X3ij7tr+8lMSYi3Zysi1QL375CnT4fNoABEW0JA==",
      "cpu": [
        "arm64"
      ],
@@ -250,9 +250,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-x64-gnu": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.6.tgz",
-      "integrity": "sha512-rerCAz022zf0ewxI+7n3SrqLEaxCL+MXRxKjK5FLUGFa8UkIrivq+VUP/1OB6JLh2Bucebc7Y9WoWHvtk22mLA==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-gnu/-/binding-linux-x64-gnu-2.0.4.tgz",
+      "integrity": "sha512-xHorBPBZAg0Pn9Q0k9dWZ9euowieDxcSOzQ9JhTCmhDY6wZH5M/kCBFlCs/OQeW5/NUArW3x3MwEdO/0QJHMxg==",
      "cpu": [
        "x64"
      ],
@@ -267,9 +267,9 @@
      ]
    },
    "node_modules/@rspack/binding-linux-x64-musl": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.6.tgz",
-      "integrity": "sha512-96IgOFXQjX6Wbxd+DCYJFy2r/VMu1OoHifW4Cr3kGTYDKoQOIMLwb0ieu/ILp2dGWFMZo5S8odiByAmNICAOIA==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-linux-x64-musl/-/binding-linux-x64-musl-2.0.4.tgz",
+      "integrity": "sha512-QLxEGUXofF0kVNU12Y2NT3Qi9lGs+WbnYpapVeb+2IXtrAXJfU7Rhy7lAp5GLMzYMQNrKKL9SVnTWKbODbNW9Q==",
      "cpu": [
        "x64"
      ],
@@ -284,9 +284,9 @@
      ]
    },
    "node_modules/@rspack/binding-wasm32-wasi": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.6.tgz",
-      "integrity": "sha512-0aWiF+qmdb0csp1x+MaR2o1pscoquLaEbLTVdKjmoTRs6sguMemtB1ObnVTahAUL73P66WePuNpFAJ81zNdqzQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-wasm32-wasi/-/binding-wasm32-wasi-2.0.4.tgz",
+      "integrity": "sha512-YhN8HkiH46ONU9tm5dyoXDImDWGpU7E4SPqGI4OyAVF0445uIChurIUmTIOYcD6cg81GGeIjozWJOcb635Dcqw==",
      "cpu": [
        "wasm32"
      ],
@@ -300,9 +300,9 @@
      }
    },
    "node_modules/@rspack/binding-win32-arm64-msvc": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.6.tgz",
-      "integrity": "sha512-BX638A1MXsjc2E3tUskVh3X/WBIHjLKK+lo395v7MmEL9u2BA6l3F6RyW+YaJOt5aEOOv83iA7iCZsviVZ49Uw==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-2.0.4.tgz",
+      "integrity": "sha512-MUlYIz82xQRN0aoiXXyEBrNVUwiOSSFRi7nuCgUKduaSdlbPWzCY31IdtOygZ06LVp5JIGUEtyqSrjQq4FrMRw==",
      "cpu": [
        "arm64"
      ],
@@ -314,9 +314,9 @@
      ]
    },
    "node_modules/@rspack/binding-win32-ia32-msvc": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.6.tgz",
-      "integrity": "sha512-DCK/+MlN35uvH7tp4j0hbg8wIs9MHArMIrNZXtiD8xP6DNw2wrXcGC1VaxxR5apyWpqXAfIL/KsXBiWS3ygCvg==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-ia32-msvc/-/binding-win32-ia32-msvc-2.0.4.tgz",
+      "integrity": "sha512-D7UcIFMzlY2yhhyuW4Ej15gBWmTwUM5DxuObl3Kv31qRv/pmV3MsqUeG5m2dqLbUxzqPH87qnp0cArbkJQ1b+w==",
      "cpu": [
        "ia32"
      ],
@@ -328,9 +328,9 @@
      ]
    },
    "node_modules/@rspack/binding-win32-x64-msvc": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.6.tgz",
-      "integrity": "sha512-TxutgzdEX9BkAU/5liKxdQmggJ23INz7EZDWtzSJO6C2SiSYzTJdyPQDIJi1ddkM5TX/drzH184gAJMVOQefng==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/binding-win32-x64-msvc/-/binding-win32-x64-msvc-2.0.4.tgz",
+      "integrity": "sha512-MnYKPfdrAEbtpKg/1SZ6cNtzreIRyQJK4APbxLLPXENdTH5QXQkaTjLMKEeJcJ51FRhI/+yNpOUm2oTHdCQ1Og==",
      "cpu": [
        "x64"
      ],
@@ -342,20 +342,20 @@
      ]
    },
    "node_modules/@rspack/core": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.6.tgz",
-      "integrity": "sha512-ronRqH1T2dYdMFVOQbGvDNxYaLugQK8qhNYYtS2DbOvPKQYvdIYWDenL9k/WV+hLoknnPWMn2ME2cKJcK3Po+g==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@rspack/core/-/core-2.0.4.tgz",
+      "integrity": "sha512-OuxdQeeKWQpNvFBRDOcnoSaQvp6E4APM/6JJMM/k0p6oL1TEFQVGdNu3VGY4mRAsebnNBXapMVMhj+v66Bn2pg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rspack/binding": "2.0.6"
+        "@rspack/binding": "2.0.4"
      },
      "engines": {
        "node": "^20.19.0 || >=22.12.0"
      },
      "peerDependencies": {
        "@module-federation/runtime-tools": "^0.24.1 || ^2.0.0",
-        "@swc/helpers": "^0.5.23"
+        "@swc/helpers": ">=0.5.1"
      },
      "peerDependenciesMeta": {
        "@module-federation/runtime-tools": {
@@ -383,17 +383,17 @@
      }
    },
    "node_modules/@rspress/core": {
-      "version": "2.0.14",
-      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.14.tgz",
-      "integrity": "sha512-k59i08zwBGgHrjHw8CK1m4CeTrKPvZRmV54bxubQl6AdDdmhJK6WrNg3UthwWmd38scKtqF40ATXDE8RMiNcNA==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.13.tgz",
+      "integrity": "sha512-lbaBA5eqh7wKdH98TUQEI+SfS3Z6YgaNCup3X+ttrYVLOrxN8PJvbedo6fFAcl+wP3XLy6D0pcnnzAgu8y3tdg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@mdx-js/mdx": "^3.1.1",
        "@mdx-js/react": "^3.1.1",
-        "@rsbuild/core": "^2.0.9",
-        "@rsbuild/plugin-react": "~2.0.1",
-        "@rspress/shared": "2.0.14",
+        "@rsbuild/core": "^2.0.7",
+        "@rsbuild/plugin-react": "~2.0.0",
+        "@rspress/shared": "2.0.13",
        "@shikijs/rehype": "^4.0.2",
        "@types/unist": "^3.0.3",
        "@unhead/react": "^2.1.15",
@@ -436,9 +436,9 @@
      }
    },
    "node_modules/@rspress/plugin-client-redirects": {
-      "version": "2.0.14",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.14.tgz",
-      "integrity": "sha512-/WpbWUiepQglpPeplxCnELe2c7VdBUxPiICPAVnS1ZxAFdYkIpW0C+Vbk1t08kZqx8EAZGu+s6Zy43zyQpjdxg==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.13.tgz",
+      "integrity": "sha512-dP753ASTvH6eDtSEulcqq2lE/kTSdOWSCw0nzvXG+7atTWTHDp6z47uH3CGD8E78cBuKyEi4OH+U7V0EtCTc0Q==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -449,9 +449,9 @@
      }
    },
    "node_modules/@rspress/plugin-sitemap": {
-      "version": "2.0.14",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.14.tgz",
-      "integrity": "sha512-Gpone22PvXGfGRSyi/WM8IXgsvKhNspXqHjtPD3g62jX8SJL3kpj2YZ2V28WEkg672fICauUYXrpre74Rddcsw==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.13.tgz",
+      "integrity": "sha512-JtkNlxNuA7BzknKIrLvLQkSk0XVi7OXzrE76ma/cLvleccNWr8LGrHtrac4IrDr+HauK4WKTM2JaHGGHUdOUKw==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -462,13 +462,13 @@
      }
    },
    "node_modules/@rspress/shared": {
-      "version": "2.0.14",
-      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.14.tgz",
-      "integrity": "sha512-sCe9tAo+s9tR4DmFSjMyHOxQvhzTSYXkkMUfVEo5w+uMCNXXGAIC6D0xAVDMHq1jIFF9ix47VxzlCo+CYNS14g==",
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.13.tgz",
+      "integrity": "sha512-LmDfr7+MDNWRBbxcNoWkW68A35oRonpDJq2Jlx3L8GCzG4sAsyd6Yw0DebTWAxx7hVOXGMf37nEf1J4aOLEZfg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@rsbuild/core": "^2.0.9",
+        "@rsbuild/core": "^2.0.7",
        "@shikijs/rehype": "^4.0.2",
        "unified": "^11.0.5"
      }
@@ -600,9 +600,9 @@
      "license": "MIT"
    },
    "node_modules/@swc/helpers": {
-      "version": "0.5.23",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
-      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.21.tgz",
+      "integrity": "sha512-jI/VAmtdjB/RnI8GTnokyX7Ug8c+g+ffD6QRLa6XQewtnGyukKkKSk3wLTM3b5cjt1jNh9x0jfVlagdN2gDKQg==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
@@ -10,7 +10,7 @@

 [toolchain]
 profile = "minimal"
-channel = "1.96.0"
+channel = "1.95.0"
 components = [
    # For rust-analyzer
    "rust-src",
@@ -16,7 +16,7 @@
 };

 #[derive(Debug, Parser)]
-#[command(name = conduwuit_core::BRANDING, version = conduwuit_core::version())]
+#[command(name = conduwuit_core::name(), version = conduwuit_core::version())]
 pub enum AdminCommand {
 	#[command(subcommand)]
 	/// Commands for managing appservices
@@ -30,37 +30,14 @@ pub(super) async fn issue_token(&self, expires: super::TokenExpires) -> Result {
 		.issue_token(self.sender_or_service_user().into(), expires);

 	self.write_str(&format!(
-		"New registration token issued: `{token}` . {}.",
+		"New registration token issued: `{token}`. {}.",
 		if let Some(expires) = info.expires {
 			format!("{expires}")
 		} else {
 			"Never expires".to_owned()
 		}
 	))
-	.await?;
-
-	if self
-		.services
-		.config
-		.oauth
-		.compatibility_mode
-		.oauth_available()
-	{
-		self.write_str(&format!(
-			"\nInvite link using this token: {}",
-			self.services
-				.config
-				.get_client_domain()
-				.join(&format!(
-					"{}/account/register/?flow=trusted&token={token}",
-					conduwuit::ROUTE_PREFIX
-				))
-				.unwrap()
-		))
-		.await?;
-	}
-
-	Ok(())
+	.await
 }

 #[admin_command]
@@ -1,10 +1,13 @@
-use std::collections::{BTreeMap, HashSet};
+use std::{
+	collections::{BTreeMap, HashSet},
+	fmt::Write as _,
+};

 use api::client::{
 	full_user_deactivate, leave_room, recreate_push_rules_and_return, remote_leave_room,
 };
 use conduwuit::{
-	Err, Result, debug_warn, info,
+	Err, Result, debug_warn, error, info,
 	matrix::{Event, pdu::PartialPdu},
 	utils::{self, ReadyExt},
 	warn,
@@ -50,22 +53,130 @@ pub(super) async fn list_users(&self) -> Result {
 #[admin_command]
 pub(super) async fn create_user(&self, username: String, password: Option<String>) -> Result {
 	// Validate user id
-	let user_id = self
-		.services
+	let user_id = parse_local_user_id(self.services, &username)?;
+
+	if let Err(e) = user_id.validate_strict() {
+		if self.services.config.emergency_password.is_none() {
+			return Err!("Username {user_id} contains disallowed characters or spaces: {e}");
+		}
+	}
+
+	if self.services.users.exists(&user_id).await {
+		return Err!("User {user_id} already exists");
+	}
+
+	let password = password.unwrap_or_else(|| utils::random_string(AUTO_GEN_PASSWORD_LENGTH));
+
+	// Create user
+	self.services
 		.users
-		.determine_registration_user_id(Some(username), None, None)
+		.create(&user_id, Some(HashedPassword::new(&password)?))
 		.await?;

-	let password = HashedPassword::new(
-		&password.unwrap_or_else(|| utils::random_string(AUTO_GEN_PASSWORD_LENGTH)),
-	)?;
+	// Default to pretty displayname
+	let mut displayname = user_id.localpart().to_owned();
+
+	// If `new_user_displayname_suffix` is set, registration will push whatever
+	// content is set to the user's display name with a space before it
+	if !self
+		.services
+		.server
+		.config
+		.new_user_displayname_suffix
+		.is_empty()
+	{
+		write!(displayname, " {}", self.services.server.config.new_user_displayname_suffix)?;
+	}

 	self.services
 		.users
-		.create_local_account(&user_id, password, None)
-		.await;
+		.set_displayname(&user_id, Some(displayname));

-	self.write_str(&format!("Created user {user_id}")).await
+	// Initial account data
+	self.services
+		.account_data
+		.update(
+			None,
+			&user_id,
+			ruma::events::GlobalAccountDataEventType::PushRules
+				.to_string()
+				.into(),
+			&serde_json::to_value(ruma::events::push_rules::PushRulesEvent::new(
+				ruma::events::push_rules::PushRulesEventContent::new(
+					ruma::push::Ruleset::server_default(&user_id),
+				),
+			))
+			.unwrap(),
+		)
+		.await?;
+
+	if !self.services.server.config.auto_join_rooms.is_empty() {
+		for room in &self.services.server.config.auto_join_rooms {
+			let Ok(room_id) = self.services.rooms.alias.resolve(room).await else {
+				error!(
+					%user_id,
+					"Failed to resolve room alias to room ID when attempting to auto join {room}, skipping"
+				);
+				continue;
+			};
+
+			if !self
+				.services
+				.rooms
+				.state_cache
+				.server_in_room(self.services.globals.server_name(), &room_id)
+				.await
+			{
+				warn!(
+					"Skipping room {room} to automatically join as we have never joined before."
+				);
+				continue;
+			}
+
+			if let Some(room_server_name) = room.server_name() {
+				match self
+					.services
+					.rooms
+					.membership
+					.join_room(
+						&user_id,
+						&room_id,
+						Some("Automatically joining this room upon registration".to_owned()),
+						&[
+							self.services.globals.server_name().to_owned(),
+							room_server_name.to_owned(),
+						],
+					)
+					.await
+				{
+					| Ok(_response) => {
+						info!("Automatically joined room {room} for user {user_id}");
+					},
+					| Err(e) => {
+						// don't return this error so we don't fail registrations
+						error!(
+							"Failed to automatically join room {room} for user {user_id}: {e}"
+						);
+						self.services
+							.admin
+							.send_text(&format!(
+								"Failed to automatically join room {room} for user {user_id}: \
+								 {e}"
+							))
+							.await;
+					},
+				}
+			}
+		}
+	}
+
+	// we dont add a device since we're not the user, just the creator
+
+	// Make the first user to register an administrator and disable first-run mode.
+	self.services.firstrun.empower_first_user(&user_id).await?;
+
+	self.write_str(&format!("Created user with user_id: {user_id} and password: `{password}`"))
+		.await
 }

 #[admin_command]
@@ -122,7 +233,7 @@ pub(super) async fn suspend(&self, user_id: String) -> Result {
 	// TODO: Record the actual user that sent the suspension where possible
 	self.services
 		.users
-		.suspend_account(&user_id, self.sender)
+		.suspend_account(&user_id, self.sender_or_service_user())
 		.await;

 	self.write_str(&format!("User {user_id} has been suspended."))
@@ -191,6 +302,31 @@ pub(super) async fn reset_password(
 	Ok(())
 }

+#[admin_command]
+pub(super) async fn issue_password_reset_link(&self, username: String) -> Result {
+	use conduwuit_service::password_reset::{PASSWORD_RESET_PATH, RESET_TOKEN_QUERY_PARAM};
+
+	self.bail_restricted()?;
+
+	let mut reset_url = self
+		.services
+		.config
+		.get_client_domain()
+		.join(PASSWORD_RESET_PATH)
+		.unwrap();
+
+	let user_id = parse_local_user_id(self.services, &username)?;
+	let token = self.services.password_reset.issue_token(user_id).await?;
+	reset_url
+		.query_pairs_mut()
+		.append_pair(RESET_TOKEN_QUERY_PARAM, &token.token);
+
+	self.write_str(&format!("Password reset link issued for {username}: {reset_url}"))
+		.await?;
+
+	Ok(())
+}
+
 #[admin_command]
 pub(super) async fn deactivate_all(&self, no_leave_rooms: bool, force: bool) -> Result {
 	if self.body.len() < 2
@@ -939,7 +1075,7 @@ pub(super) async fn lock(&self, user_id: String) -> Result {
 	}
 	self.services
 		.users
-		.lock_account(&user_id, self.sender)
+		.lock_account(&user_id, self.sender_or_service_user())
 		.await;

 	self.write_str(&format!("User {user_id} has been locked."))
@@ -29,6 +29,12 @@ pub enum UserCommand {
 		password: Option<String>,
 	},

+	/// Issue a self-service password reset link for a user.
+	IssuePasswordResetLink {
+		/// Username of the user who may use the link
+		username: String,
+	},
+
 	/// Get a user's associated email address.
 	GetEmail {
 		user_id: String,
@@ -62,8 +62,6 @@ zstd_compression = [
 	"reqwest/zstd",
 ]

-admin_api = []
-
 [dependencies]
 async-trait.workspace = true
 axum-client-ip.workspace = true
@@ -0,0 +1 @@
+pub mod rooms;
@@ -6,14 +6,14 @@

 use crate::{Ruma, client::leave_room};

-/// # `PUT /_continuwuity/admin/v1/rooms/{roomID}/ban`
+/// # `PUT /_continuwuity/admin/rooms/{roomID}/ban`
 ///
 /// Bans or unbans a room.
 pub(crate) async fn ban_room(
 	State(services): State<crate::State>,
 	body: Ruma<rooms::ban::v1::Request>,
 ) -> Result<rooms::ban::v1::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	if !services.users.is_admin(sender_user).await {
 		return Err!(Request(Forbidden("Only server administrators can use this endpoint")));
 	}
@@ -0,0 +1,36 @@
+use axum::extract::State;
+use conduwuit::{Err, Result};
+use futures::StreamExt;
+use ruma::OwnedRoomId;
+use ruminuwuity::admin::continuwuity::rooms;
+
+use crate::Ruma;
+
+/// # `GET /_continuwuity/admin/rooms/list`
+///
+/// Lists all rooms known to this server, excluding banned ones.
+pub(crate) async fn list_rooms(
+	State(services): State<crate::State>,
+	body: Ruma<rooms::list::v1::Request>,
+) -> Result<rooms::list::v1::Response> {
+	let sender_user = body.identity.sender_user();
+	if !services.users.is_admin(sender_user).await {
+		return Err!(Request(Forbidden("Only server administrators can use this endpoint")));
+	}
+
+	let mut rooms: Vec<OwnedRoomId> = services
+		.rooms
+		.metadata
+		.iter_ids()
+		.filter_map(|room_id| async move {
+			if !services.rooms.metadata.is_banned(&room_id).await {
+				Some(room_id.clone())
+			} else {
+				None
+			}
+		})
+		.collect()
+		.await;
+	rooms.sort();
+	Ok(rooms::list::v1::Response::new(rooms))
+}
@@ -0,0 +1,2 @@
+pub mod ban;
+pub mod list;
@@ -24,7 +24,7 @@
 		power_levels::RoomPowerLevelsEventContent,
 	},
 };
-use service::{mailer::messages, uiaa::UiaaInitiator, users::HashedPassword};
+use service::{mailer::messages, uiaa::Identity, users::HashedPassword};

 use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::{Ruma, router::ClientIdentity};
@@ -49,16 +49,39 @@ pub(crate) async fn get_register_available_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_username_availability::v3::Request>,
 ) -> Result<get_username_availability::v3::Response> {
-	let _ = services
-		.users
-		.determine_registration_user_id(
-			Some(body.username.clone()),
-			None,
-			body.identity
-				.as_ref()
-				.and_then(ClientIdentity::appservice_info),
-		)
-		.await?;
+	// Validate user id
+	let user_id =
+		match UserId::parse_with_server_name(&body.username, services.globals.server_name()) {
+			| Ok(user_id) => {
+				if let Err(e) = user_id.validate_strict() {
+					return Err!(Request(InvalidUsername(debug_warn!(
+						"Username {} contains disallowed characters or spaces: {e}",
+						body.username
+					))));
+				}
+
+				user_id
+			},
+			| Err(e) => {
+				return Err!(Request(InvalidUsername(debug_warn!(
+					"Username {} is not valid: {e}",
+					body.username
+				))));
+			},
+		};
+
+	// Check if username is creative enough
+	if services.users.exists(&user_id).await {
+		return Err!(Request(UserInUse("User ID is not available.")));
+	}
+
+	if let Some(ClientIdentity::Appservice { appservice_info, .. }) = &body.identity
+		&& !appservice_info.is_user_match(&user_id)
+	{
+		return Err!(Request(Exclusive("Username is not in an appservice namespace.")));
+	} else if services.appservice.is_exclusive_user_id(&user_id).await {
+		return Err!(Request(Exclusive("Username is reserved by an appservice.")));
+	}

 	Ok(get_username_availability::v3::Response::new(true))
 }
@@ -86,7 +109,8 @@ pub(crate) async fn change_password_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<change_password::v3::Request>,
 ) -> Result<change_password::v3::Response> {
-	let identity = if let Some(identity) = body.identity.as_ref() {
+	let identity = if let Some(user_id) = body.identity.as_ref().map(ClientIdentity::sender_user)
+	{
 		// A signed-in user is trying to change their password, prompt them for their
 		// existing one

@@ -96,10 +120,7 @@ pub(crate) async fn change_password_route(
 				&body.auth,
 				vec![AuthFlow::new(vec![AuthType::Password])],
 				Box::default(),
-				Some(UiaaInitiator::new(
-					identity.expect_sender_user()?,
-					identity.sender_device(),
-				)),
+				Some(Identity::from_user_id(user_id)),
 			)
 			.await?
 	} else {
@@ -230,7 +251,7 @@ pub(crate) async fn whoami_route(
 	body: Ruma<whoami::v3::Request>,
 ) -> Result<whoami::v3::Response> {
 	Ok(
-		assign!(whoami::v3::Response::new(body.identity.expect_sender_user()?.to_owned(), false), {
+		assign!(whoami::v3::Response::new(body.identity.sender_user().to_owned(), false), {
 			device_id: body.identity.sender_device().map(ToOwned::to_owned),
 		}),
 	)
@@ -255,24 +276,16 @@ pub(crate) async fn deactivate_route(
 ) -> Result<deactivate::v3::Response> {
 	// Authentication for this endpoint is technically optional,
 	// but we require the user to be logged in
-	let identity = body
+	let sender_user = body
 		.identity
 		.as_ref()
+		.map(ClientIdentity::sender_user)
 		.ok_or_else(|| err!(Request(MissingToken("Missing access token."))))?;

-	let sender_user = identity.expect_sender_user()?;
-
-	if !services.config.allow_deactivation {
-		return Err!(Request(Unauthorized(
-			"You may not deactivate your own account. Contact your server's administrator for \
-			 assistance."
-		)));
-	}
-
 	// Prompt the user to confirm with their password using UIAA
 	let _ = services
 		.uiaa
-		.authenticate_password(&body.auth, sender_user, identity.sender_device(), None)
+		.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 		.await?;

 	// Remove profile pictures and display name
@@ -1,15 +1,17 @@
-use std::collections::HashMap;
+use std::{collections::HashMap, fmt::Write};

 use axum::extract::State;
 use axum_client_ip::ClientIp;
 use conduwuit::{
-	Err, Result, debug_info, info,
+	Err, Result, debug_info, error, info,
 	utils::{self},
+	warn,
 };
 use conduwuit_service::Services;
-use futures::StreamExt;
+use futures::{FutureExt, StreamExt};
 use lettre::{Address, message::Mailbox};
 use ruma::{
+	OwnedUserId, UserId,
 	api::client::{
 		account::{
 			register::{self, LoginType, RegistrationKind},
@@ -18,6 +20,11 @@
 		uiaa::{AuthFlow, AuthType},
 	},
 	assign,
+	events::{
+		GlobalAccountDataEventType, push_rules::PushRulesEvent,
+		room::message::RoomMessageEventContent,
+	},
+	push,
 };
 use serde_json::value::RawValue;
 use service::{mailer::messages, users::HashedPassword};
@@ -25,6 +32,8 @@
 use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::Ruma;

+const RANDOM_USER_ID_LENGTH: usize = 10;
+
 /// # `POST /_matrix/client/v3/register`
 ///
 /// Register an account on this homeserver.
@@ -43,6 +52,8 @@ pub(crate) async fn register_route(
 		return Err!(Request(GuestAccessForbidden("Guests may not register on this server.")));
 	}

+	let emergency_mode_enabled = services.config.emergency_password.is_some();
+
 	// Allow registration if it's enabled in the config file or if this is the first
 	// run (so the first user account can be created)
 	let allow_registration =
@@ -60,59 +71,99 @@ pub(crate) async fn register_route(
 		)));
 	}

-	let user_id = if body.body.login_type == Some(LoginType::ApplicationService) {
-		let Some(appservice_info) = &body.identity else {
-			return Err!(Request(Forbidden(
-				"Only appservices can use the appservice login type."
-			)));
-		};
-
-		let user_id = services
-			.users
-			.determine_registration_user_id(body.username.clone(), None, Some(appservice_info))
-			.await?;
-
-		services.users.create(&user_id, None).await?;
-
-		user_id
+	let identity = if body.identity.is_some() {
+		// Appservices can skip auth
+		None
 	} else {
 		// Perform UIAA to determine the user's identity
 		let (flows, params) = create_registration_uiaa_session(&services).await?;

-		let identity = services
-			.uiaa
-			.authenticate(&body.auth, flows, params, None)
-			.await?;
-
-		let password = if let Some(password) = &body.password {
-			HashedPassword::new(password)?
-		} else {
-			return Err!(Request(InvalidParam("A password must be provided.")));
-		};
-
-		let user_id = services
-			.users
-			.determine_registration_user_id(body.username.clone(), identity.email.as_ref(), None)
-			.await?;
-
-		services
-			.users
-			.create_local_account(&user_id, password, identity.email)
-			.await;
-		services.users.join_auto_join_rooms(&user_id).await;
-		user_id
+		Some(
+			services
+				.uiaa
+				.authenticate(&body.auth, flows, params, None)
+				.await?,
+		)
 	};

-	let (token, device) = if !body.inhibit_login {
-		// If UIAA is disabled, we can't create a device. In that case only appservices
-		// can reach this point in the first place, so we return an error for them.
-		if !services.config.oauth.compatibility_mode.uiaa_available() {
-			return Err!(Request(AppserviceLoginUnsupported(
-				"User-interactive appservice registration is not available on this server."
-			)));
+	// If the user didn't supply a username but did supply an email, use
+	// the email's user as their initial localpart to avoid falling back to
+	// a randomly generated localpart
+	let supplied_username = body.username.clone().or_else(|| {
+		if let Some(identity) = &identity
+			&& let Some(email) = &identity.email
+		{
+			Some(email.user().to_owned())
+		} else {
+			None
 		}
+	});

-		// Generate new device id if the user didn't specify one
+	let user_id =
+		determine_registration_user_id(&services, supplied_username, emergency_mode_enabled)
+			.await?;
+
+	if body.body.login_type == Some(LoginType::ApplicationService) {
+		// For appservice logins, make sure that the user ID is in the appservice's
+		// namespace
+
+		match body.identity {
+			| Some(ref info) =>
+				if !info.is_user_match(&user_id) && !emergency_mode_enabled {
+					return Err!(Request(Exclusive(
+						"Username is not in an appservice namespace."
+					)));
+				},
+			| _ => {
+				return Err!(Request(MissingToken("Missing appservice token.")));
+			},
+		}
+	} else if services.appservice.is_exclusive_user_id(&user_id).await && !emergency_mode_enabled
+	{
+		// For non-appservice logins, ban user IDs which are in an appservice's
+		// namespace (unless emergency mode is enabled)
+		return Err!(Request(Exclusive("Username is reserved by an appservice.")));
+	}
+
+	let password = if body.identity.is_some() {
+		None
+	} else if let Some(password) = body.password.as_deref() {
+		Some(HashedPassword::new(password)?)
+	} else {
+		return Err!(Request(InvalidParam("A password must be provided")));
+	};
+
+	// Create user
+	services.users.create(&user_id, password).await?;
+
+	// Set an initial display name
+	let mut displayname = user_id.localpart().to_owned();
+
+	// Apply the new user displayname suffix, if it's set
+	if !services.globals.new_user_displayname_suffix().is_empty() && body.identity.is_none() {
+		write!(displayname, " {}", services.server.config.new_user_displayname_suffix)?;
+	}
+
+	services
+		.users
+		.set_displayname(&user_id, Some(displayname.clone()));
+
+	// Initial account data
+	services
+		.account_data
+		.update(
+			None,
+			&user_id,
+			GlobalAccountDataEventType::PushRules.to_string().into(),
+			&serde_json::to_value(PushRulesEvent::new(
+				push::Ruleset::server_default(&user_id).into(),
+			))
+			.expect("should be able to serialize push rules"),
+		)
+		.await?;
+
+	// Generate new device id if the user didn't specify one
+	let (token, device) = if !body.inhibit_login {
 		let device_id = body
 			.device_id
 			.clone()
@@ -128,7 +179,6 @@ pub(crate) async fn register_route(
 				&user_id,
 				&device_id,
 				&new_token,
-				None,
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -139,7 +189,118 @@ pub(crate) async fn register_route(
 		(None, None)
 	};

-	debug_info!(%user_id, ?device, "New account created via legacy registration");
+	debug_info!(%user_id, ?device, "User account was created");
+
+	// If the user registered with an email, associate it with their account.
+	if let Some(identity) = identity
+		&& let Some(email) = identity.email
+	{
+		// This may fail if the email is already in use, but we already check for that
+		// in `/requestToken`, so ignoring the error is acceptable here in the rare case
+		// that an email is sniped by another user between the `/requestToken` request
+		// and the `/register` request.
+		let _ = services
+			.threepid
+			.associate_localpart_email(user_id.localpart(), &email)
+			.await;
+	}
+
+	let device_display_name = body.initial_device_display_name.as_deref().unwrap_or("");
+
+	if body.identity.is_none() {
+		if !device_display_name.is_empty() {
+			let notice = format!(
+				"New user \"{user_id}\" registered on this server from IP {client} and device \
+				 display name \"{device_display_name}\""
+			);
+
+			info!("{notice}");
+			if services.server.config.admin_room_notices {
+				services.admin.notice(&notice).await;
+			}
+		} else {
+			let notice = format!("New user \"{user_id}\" registered on this server.");
+
+			info!("{notice}");
+			if services.server.config.admin_room_notices {
+				services.admin.notice(&notice).await;
+			}
+		}
+	}
+
+	// Make the first user to register an administrator and disable first-run mode.
+	let was_first_user = services.firstrun.empower_first_user(&user_id).await?;
+
+	// If the registering user was not the first and we're suspending users on
+	// register, suspend them.
+	if !was_first_user && services.config.suspend_on_register {
+		// Note that we can still do auto joins for suspended users
+		services
+			.users
+			.suspend_account(&user_id, &services.globals.server_user)
+			.await;
+		// And send an @room notice to the admin room, to prompt admins to review the
+		// new user and ideally unsuspend them if deemed appropriate.
+		if services.server.config.admin_room_notices {
+			services
+				.admin
+				.send_loud_message(RoomMessageEventContent::text_plain(format!(
+					"User {user_id} has been suspended as they are not the first user on this \
+					 server. Please review and unsuspend them if appropriate."
+				)))
+				.await
+				.ok();
+		}
+	}
+
+	if body.identity.is_none() && !services.server.config.auto_join_rooms.is_empty() {
+		for room in &services.server.config.auto_join_rooms {
+			let Ok(room_id) = services.rooms.alias.resolve(room).await else {
+				error!(
+					"Failed to resolve room alias to room ID when attempting to auto join \
+					 {room}, skipping"
+				);
+				continue;
+			};
+
+			if !services
+				.rooms
+				.state_cache
+				.server_in_room(services.globals.server_name(), &room_id)
+				.await
+			{
+				warn!(
+					"Skipping room {room} to automatically join as we have never joined before."
+				);
+				continue;
+			}
+
+			if let Some(room_server_name) = room.server_name() {
+				match services
+					.rooms
+					.membership
+					.join_room(
+						&user_id,
+						&room_id,
+						Some("Automatically joining this room upon registration".to_owned()),
+						&[services.globals.server_name().to_owned(), room_server_name.to_owned()],
+					)
+					.boxed()
+					.await
+				{
+					| Err(e) => {
+						// don't return this error so we don't fail registrations
+						error!(
+							"Failed to automatically join room {room} for user {user_id}: {e}"
+						);
+					},
+					| _ => {
+						info!("Automatically joined room {room} for user {user_id}");
+					},
+				}
+			}
+		}
+	}

 	Ok(assign!(register::v3::Response::new(user_id), {
 		access_token: token,
@@ -211,21 +372,21 @@ async fn create_registration_uiaa_session(

 		// Require all users to agree to the terms and conditions, if configured
 		let terms = &services.config.registration_terms;
-		if !terms.documents.is_empty() {
-			let mut terms_map = HashMap::new();
+		if !terms.is_empty() {
+			let mut terms =
+				serde_json::to_value(terms.clone()).expect("failed to serialize terms");

-			for (id, document) in &terms.documents {
-				terms_map.insert(id.to_owned(), serde_json::json!({
-					terms.language.clone(): serde_json::to_value(document).expect("should be able to serialize document")
-				}));
+			// Insert a dummy `version` field
+			for (_, documents) in terms.as_object_mut().unwrap() {
+				let documents = documents.as_object_mut().unwrap();
+
+				documents.insert("version".to_owned(), "latest".into());
 			}

-			terms_map.insert("version".to_owned(), "latest".into());
-
 			params.insert(
 				AuthType::Terms.as_str().to_owned(),
 				serde_json::json!({
-					"policies": terms_map,
+					"policies": terms,
 				}),
 			);

@@ -258,6 +419,81 @@ async fn create_registration_uiaa_session(
 	Ok((flows, params))
 }

+async fn determine_registration_user_id(
+	services: &Services,
+	supplied_username: Option<String>,
+	emergency_mode_enabled: bool,
+) -> Result<OwnedUserId> {
+	if let Some(supplied_username) = supplied_username {
+		// The user gets to pick their username. Do some validation to make sure it's
+		// acceptable.
+
+		// Don't allow registration with forbidden usernames.
+		if services
+			.globals
+			.forbidden_usernames()
+			.is_match(&supplied_username)
+			&& !emergency_mode_enabled
+		{
+			return Err!(Request(Forbidden("Username is forbidden")));
+		}
+
+		// Create and validate the user ID
+		let user_id = match UserId::parse_with_server_name(
+			&supplied_username,
+			services.globals.server_name(),
+		) {
+			| Ok(user_id) => {
+				if let Err(e) = user_id.validate_strict() {
+					// Unless we are in emergency mode, we should follow synapse's behaviour on
+					// not allowing things like spaces and UTF-8 characters in usernames
+					if !emergency_mode_enabled {
+						return Err!(Request(InvalidUsername(debug_warn!(
+							"Username {supplied_username} contains disallowed characters or \
+							 spaces: {e}"
+						))));
+					}
+				}
+
+				// Don't allow registration with user IDs that aren't local
+				if !services.globals.user_is_local(&user_id) {
+					return Err!(Request(InvalidUsername(
+						"Username {supplied_username} is not local to this server"
+					)));
+				}
+
+				user_id
+			},
+			| Err(e) => {
+				return Err!(Request(InvalidUsername(debug_warn!(
+					"Username {supplied_username} is not valid: {e}"
+				))));
+			},
+		};
+
+		if services.users.exists(&user_id).await {
+			return Err!(Request(UserInUse("User ID is not available.")));
+		}
+
+		Ok(user_id)
+	} else {
+		// The user didn't specify a username. Generate a username for
+		// them.
+
+		loop {
+			let user_id = UserId::parse_with_server_name(
+				utils::random_string(RANDOM_USER_ID_LENGTH).to_lowercase(),
+				services.globals.server_name(),
+			)
+			.unwrap();
+
+			if !services.users.exists(&user_id).await {
+				break Ok(user_id);
+			}
+		}
+	}
+}
+
 /// # `POST /_matrix/client/v3/register/email/requestToken`
 ///
 /// Requests a validation email for the purpose of registering a new account.
@@ -11,7 +11,7 @@
 	},
 	thirdparty::{Medium, ThirdPartyIdentifierInit},
 };
-use service::mailer::messages;
+use service::{mailer::messages, uiaa::Identity};

 use crate::{Ruma, router::ClientIdentity};

@@ -22,7 +22,7 @@ pub(crate) async fn third_party_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_3pids::v3::Request>,
 ) -> Result<get_3pids::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let mut threepids = vec![];

 	if let Some(email) = services
@@ -58,8 +58,8 @@ pub(crate) async fn request_3pid_management_token_via_email_route(
 	let sender_user = body
 		.identity
 		.as_ref()
-		.map(ClientIdentity::expect_sender_user)
-		.ok_or_else(|| err!(Request(MissingToken("Missing access token."))))??;
+		.map(ClientIdentity::sender_user)
+		.ok_or_else(|| err!(Request(MissingToken("Missing access token."))))?;

 	if !services.threepid.email_requirement().may_change() {
 		return Err!(Request(Forbidden("You may not change your email address.")));
@@ -124,22 +124,19 @@ pub(crate) async fn add_3pid_route(
 		.uiaa
 		.authenticate_password(
 			&body.auth,
-			body.identity.expect_sender_user()?,
-			body.identity.sender_device(),
-			None,
+			Some(Identity::from_user_id(body.identity.sender_user())),
 		)
 		.await?;

 	let email = services
 		.threepid
-		.get_valid_session(&body.sid, &body.client_secret)
+		.consume_valid_session(&body.sid, &body.client_secret)
 		.await
-		.map_err(|message| err!(Request(ThreepidAuthFailed("{message}"))))?
-		.consume();
+		.map_err(|message| err!(Request(ThreepidAuthFailed("{message}"))))?;

 	services
 		.threepid
-		.associate_localpart_email(body.identity.expect_sender_user()?.localpart(), &email)
+		.associate_localpart_email(body.identity.sender_user().localpart(), &email)
 		.await?;

 	Ok(add_3pid::v3::Response::new())
@@ -160,7 +157,7 @@ pub(crate) async fn delete_3pid_route(

 	if services
 		.threepid
-		.disassociate_localpart_email(body.identity.expect_sender_user()?.localpart())
+		.disassociate_localpart_email(body.identity.sender_user().localpart())
 		.await
 		.is_none()
 	{
@@ -22,7 +22,7 @@ pub(crate) async fn set_global_account_data_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_global_account_data::v3::Request>,
 ) -> Result<set_global_account_data::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if sender_user != body.user_id && !body.identity.is_appservice() {
 		return Err!(Request(Forbidden("You cannot set account data for other users.")));
@@ -47,7 +47,7 @@ pub(crate) async fn set_room_account_data_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_room_account_data::v3::Request>,
 ) -> Result<set_room_account_data::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if sender_user != body.user_id && !body.identity.is_appservice() {
 		return Err!(Request(Forbidden("You cannot set account data for other users.")));
@@ -72,7 +72,7 @@ pub(crate) async fn get_global_account_data_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_global_account_data::v3::Request>,
 ) -> Result<get_global_account_data::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if sender_user != body.user_id && !body.identity.is_appservice() {
 		return Err!(Request(Forbidden("You cannot get account data of other users.")));
@@ -94,7 +94,7 @@ pub(crate) async fn get_room_account_data_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_room_account_data::v3::Request>,
 ) -> Result<get_room_account_data::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if sender_user != body.user_id && !body.identity.is_appservice() {
 		return Err!(Request(Forbidden("You cannot get account data of other users.")));
@@ -1,71 +0,0 @@
-use axum::extract::State;
-use conduwuit::Err;
-use ruma::api::client::admin::{is_user_locked, lock_user};
-
-use crate::router::Ruma;
-
-/// # `GET /_matrix/client/v1/admin/lock/{userId}`
-///
-/// Check the account lock status of a target user
-pub(crate) async fn get_locked_status(
-	State(services): State<crate::State>,
-	body: Ruma<is_user_locked::v1::Request>,
-) -> conduwuit::Result<is_user_locked::v1::Response> {
-	if !services.users.is_active_local(&body.user_id).await {
-		return Err!(Request(InvalidParam(
-			"Can only check the lock status of active local users"
-		)));
-	}
-
-	Ok(is_user_locked::v1::Response::new(
-		services.users.is_locked(&body.user_id).await?,
-	))
-}
-
-/// # `PUT /_matrix/client/v1/admin/lock/{userId}`
-///
-/// Set the account lock status of a target user
-pub(crate) async fn put_locked_status(
-	State(services): State<crate::State>,
-	body: Ruma<lock_user::v1::Request>,
-) -> conduwuit::Result<lock_user::v1::Response> {
-	if !services.users.is_active_local(&body.user_id).await {
-		return Err!(Request(InvalidParam(
-			"Can only set the locked status of active local users"
-		)));
-	}
-
-	if body.identity.sender_user() == Some(&body.user_id) {
-		return Err!(Request(Forbidden("You cannot lock yourself")));
-	}
-
-	if services.users.is_admin(&body.user_id).await {
-		return Err!(Request(Forbidden("You cannot lock another server administrator")));
-	}
-
-	if services.users.is_locked(&body.user_id).await? == body.locked {
-		// No change
-		return Ok(lock_user::v1::Response::new(body.locked));
-	}
-
-	let action = if body.locked {
-		services
-			.users
-			.lock_account(&body.user_id, body.identity.sender_user())
-			.await;
-		"suspended"
-	} else {
-		services.users.unlock_account(&body.user_id).await;
-		"unsuspended"
-	};
-
-	if services.config.admin_room_notices {
-		// Notify the admin room that an account has been un/suspended
-		services
-			.admin
-			.send_text(&format!("{} has been {} by {}.", body.user_id, action, body.identity))
-			.await;
-	}
-
-	Ok(lock_user::v1::Response::new(body.locked))
-}
@@ -1,5 +1,3 @@
-mod lock;
-pub(crate) mod site;
 mod suspend;

-pub(crate) use self::{lock::*, suspend::*};
+pub(crate) use self::suspend::*;
@@ -1,2 +0,0 @@
-pub(crate) mod rooms;
-pub(crate) mod users;
@@ -1,178 +0,0 @@
-use axum::extract::State;
-use conduwuit::{
-	Event, Result,
-	utils::stream::{BroadbandExt, WidebandExt},
-};
-use futures::StreamExt;
-use ruma::{
-	OwnedRoomId,
-	events::{
-		StateEventType,
-		room::{
-			create::RoomCreateEventContent,
-			encryption::PossiblyRedactedRoomEncryptionEventContent,
-			tombstone::PossiblyRedactedRoomTombstoneEventContent,
-		},
-	},
-};
-use ruminuwuity::admin::continuwuity::rooms;
-use tokio::join;
-
-use crate::Ruma;
-
-/// # `GET /_continuwuity/admin/rooms`
-///
-/// Lists all room IDs known to this server, excluding banned ones.
-///
-/// This is the legacy version of the endpoint, which does not support
-/// pagination or including banned rooms. It is recommended to use the
-/// `/v1/rooms` endpoint instead. This endpoint may be removed in a future
-/// release.
-pub(crate) async fn legacy_list_rooms_route(
-	State(services): State<crate::State>,
-	body: Ruma<rooms::list::unstable::Request>,
-) -> Result<rooms::list::unstable::Response> {
-	let mut rooms: Vec<OwnedRoomId> = services
-		.rooms
-		.metadata
-		.iter_ids()
-		.filter_map(|room_id| async move {
-			if !services.rooms.metadata.is_banned(&room_id).await {
-				Some(room_id.clone())
-			} else {
-				None
-			}
-		})
-		.collect()
-		.await;
-	rooms.sort();
-	Ok(rooms::list::unstable::Response::new(rooms))
-}
-
-/// # `GET /_continuwuity/admin/v1/rooms`
-///
-/// Lists rooms known to this server.
-pub(crate) async fn list_rooms_route(
-	State(services): State<crate::State>,
-	body: Ruma<rooms::list::v1::Request>,
-) -> Result<rooms::list::v1::Response> {
-	let include_banned_rooms = body.include_banned_rooms;
-	let rooms = services
-		.rooms
-		.metadata
-		.iter_ids()
-		.wide_filter_map(|room_id| async move {
-			if include_banned_rooms || !services.rooms.metadata.is_banned(&room_id).await {
-				Some(room_id.clone())
-			} else {
-				None
-			}
-		})
-		.skip(body.offset.unwrap_or_default())
-		.take(body.limit.unwrap_or(100).min(100))
-		.broad_filter_map(|room_id| async move {
-			let (
-				banned,
-				disabled,
-				member_count,
-				local_member_count,
-				resident_server_count,
-				published,
-				create_event,
-				encryption_event,
-				name_event,
-				topic_event,
-				canonical_alias_event,
-				join_rules_event,
-				history_visibility_event,
-				tombstone_event,
-			) = join!(
-				services.rooms.metadata.is_banned(&room_id),
-				services.rooms.metadata.is_disabled(&room_id),
-				services.rooms.state_cache.room_joined_count(&room_id),
-				services
-					.rooms
-					.state_cache
-					.active_local_users_in_room(&room_id)
-					.count(),
-				services.rooms.state_cache.room_servers(&room_id).count(),
-				services.rooms.directory.is_public_room(&room_id),
-				services.rooms.state_accessor.room_state_get(
-					&room_id,
-					&StateEventType::RoomCreate,
-					""
-				),
-				services
-					.rooms
-					.state_accessor
-					.room_state_get_content::<PossiblyRedactedRoomEncryptionEventContent>(
-						&room_id,
-						&StateEventType::RoomEncryption,
-						""
-					),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomName,
-					""
-				),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomTopic,
-					""
-				),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomCanonicalAlias,
-					""
-				),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomJoinRules,
-					""
-				),
-				services.rooms.state_accessor.room_state_get_content(
-					&room_id,
-					&StateEventType::RoomHistoryVisibility,
-					""
-				),
-				services
-					.rooms
-					.state_accessor
-					.room_state_get_content::<PossiblyRedactedRoomTombstoneEventContent>(
-						&room_id,
-						&StateEventType::RoomTombstone,
-						""
-					),
-			);
-			let Ok(create_event) = create_event else {
-				return None;
-			};
-			let create_content = create_event
-				.get_content::<RoomCreateEventContent>()
-				.expect("m.room.create content must be valid");
-			Some(rooms::list::v1::MinimalRoomInfo {
-				room_id,
-				banned,
-				disabled,
-				member_count: usize::try_from(member_count.unwrap_or_default())
-					.expect("u64 should fit in usize"),
-				local_member_count,
-				resident_server_count,
-				creators: vec![create_event.sender],
-				encrypted: encryption_event.is_ok_and(|c| c.algorithm.is_some()),
-				federated: create_content.federate,
-				published,
-				version: create_content.room_version,
-				name: name_event.unwrap_or(None),
-				topic: topic_event.unwrap_or(None),
-				canonical_alias: canonical_alias_event.unwrap_or(None),
-				join_rules: join_rules_event.unwrap_or(None),
-				history_visibility: history_visibility_event.unwrap_or(None),
-				predecessor: create_content.predecessor.map(|c| c.room_id),
-				successor: tombstone_event.map_or(None, |c| c.replacement_room),
-			})
-		})
-		.collect()
-		.await;
-	Ok(rooms::list::v1::Response::new(rooms))
-}
@@ -1,5 +0,0 @@
-mod ban;
-mod list;
-
-pub(crate) use ban::ban_room;
-pub(crate) use list::*;
@@ -1,119 +0,0 @@
-use axum::extract::State;
-use conduwuit::{
-	Err, err, error, info,
-	utils::{IterStream, stream::BroadbandExt},
-	warn,
-};
-use futures::{FutureExt, StreamExt};
-use ruma::UserId;
-use ruminuwuity::admin::continuwuity::users;
-use service::users::HashedPassword;
-
-use crate::router::Ruma;
-
-/// # `POST /_continuwuity/admin/v1/users/create`
-///
-/// Creates a new user.
-pub(crate) async fn create_user_route(
-	State(services): State<crate::State>,
-	body: Ruma<users::create::v1::Request>,
-) -> conduwuit::Result<users::create::v1::Response> {
-	let email = body
-		.email
-		.clone()
-		.map(lettre::Address::try_from)
-		.transpose()
-		.map_err(|e| err!(Request(BadJson("Invalid email address: {e}"))))?;
-
-	let ref user_id = services
-		.users
-		.determine_registration_user_id(Some(body.localpart.clone()), email.as_ref(), None)
-		.await?;
-
-	services
-		.users
-		.create_local_account(user_id, HashedPassword::new(&body.password)?, email)
-		.await;
-
-	if body.suspended {
-		services
-			.users
-			.suspend_account(&user_id, body.identity.sender_user())
-			.await;
-	}
-	if body.locked {
-		services
-			.users
-			.lock_account(user_id, body.identity.sender_user())
-			.await;
-	}
-	if body.login_disabled {
-		services.users.disable_login(user_id);
-	}
-	if let Some(ref value) = body.display_name {
-		services.users.set_profile_key(
-			user_id,
-			"displayname",
-			Some(serde_json::to_value(value)?),
-		);
-	}
-	if let Some(ref value) = body.avatar_url {
-		services
-			.users
-			.set_profile_key(user_id, "avatar_url", Some(serde_json::to_value(value)?));
-	}
-	if body.admin {
-		services
-			.admin
-			.make_user_admin(user_id)
-			.await
-			.inspect_err(|e| error!("failed to make new user {user_id} an admin: {e}"))
-			.ok();
-	}
-	if !body.skip_auto_join {
-		services.users.join_auto_join_rooms(user_id).await;
-	}
-
-	body.auto_join_rooms
-		.clone()
-		.into_iter()
-		.stream()
-		.broad_filter_map(|room| async move {
-			services
-				.rooms
-				.alias
-				.resolve_with_servers(&room, None)
-				.await
-				.inspect_err(|e| {
-					warn!(
-						"Failed to resolve room alias to room ID when attempting to auto join \
-						 {room}: {e}"
-					);
-				})
-				.ok()
-		})
-		.for_each_concurrent(None, |(room_id, servers)| async move {
-			match services
-				.rooms
-				.membership
-				.join_room(
-					user_id,
-					&room_id,
-					Some("Automatically joining this room upon registration".to_owned()),
-					servers.as_ref(),
-				)
-				.boxed()
-				.await
-			{
-				| Err(e) => {
-					warn!("Failed to automatically join {user_id} to {room_id}: {e}");
-				},
-				| _ => {
-					info!("Automatically joined room {user_id} to {room_id}");
-				},
-			}
-		})
-		.await;
-
-	Ok(users::create::v1::Response::new(user_id.to_owned()))
-}
@@ -1,42 +0,0 @@
-use axum::extract::State;
-use conduwuit::utils::stream::WidebandExt;
-use futures::StreamExt;
-use ruminuwuity::admin::continuwuity::users;
-use tokio::join;
-
-use crate::router::Ruma;
-
-/// # `GET /_continuwuity/admin/v1/users`
-///
-/// Lists all users on this homeserver.
-pub(crate) async fn list_users_route(
-	State(services): State<crate::State>,
-	body: Ruma<users::list::v1::Request>,
-) -> conduwuit::Result<users::list::v1::Response> {
-	let users = services
-		.users
-		.list_local_users()
-		.skip(body.offset.unwrap_or_default())
-		.take(body.limit.unwrap_or(100).min(100))
-		.wide_filter_map(|user_id| async move {
-			let (deactivated, suspended, locked, admin, login_disabled) = join!(
-				services.users.is_deactivated(&user_id),
-				services.users.is_suspended(&user_id),
-				services.users.is_locked(&user_id),
-				services.users.is_admin(&user_id),
-				services.users.is_login_disabled(&user_id),
-			);
-			Some(users::list::v1::User {
-				user_id: user_id.clone(),
-				deactivated: deactivated.unwrap_or_default(),
-				suspended: suspended.unwrap_or_default(),
-				locked: locked.unwrap_or_default(),
-				admin,
-				login_disabled,
-			})
-		})
-		.collect()
-		.await;
-
-	Ok(users::list::v1::Response::new(users))
-}
@@ -1,5 +0,0 @@
-mod create;
-mod list;
-
-pub(crate) use create::*;
-pub(crate) use list::*;
@@ -1,7 +1,7 @@
 use axum::extract::State;
 use conduwuit::{Err, Result};
 use futures::future::{join, join3};
-use ruma::api::client::admin::{is_user_suspended, suspend_user};
+use ruminuwuity::admin::{get_suspended, set_suspended};

 use crate::Ruma;

@@ -10,10 +10,10 @@
 /// Check the suspension status of a target user
 pub(crate) async fn get_suspended_status(
 	State(services): State<crate::State>,
-	body: Ruma<is_user_suspended::v1::Request>,
-) -> Result<is_user_suspended::v1::Response> {
+	body: Ruma<get_suspended::v1::Request>,
+) -> Result<get_suspended::v1::Response> {
 	let (admin, active) = join(
-		services.users.is_admin(body.identity.expect_sender_user()?),
+		services.users.is_admin(body.identity.sender_user()),
 		services.users.is_active(&body.user_id),
 	)
 	.await;
@@ -26,7 +26,7 @@ pub(crate) async fn get_suspended_status(
 	if !active {
 		return Err!(Request(NotFound("Unknown user")));
 	}
-	Ok(is_user_suspended::v1::Response::new(
+	Ok(get_suspended::v1::Response::new(
 		services.users.is_suspended(&body.user_id).await?,
 	))
 }
@@ -36,9 +36,9 @@ pub(crate) async fn get_suspended_status(
 /// Set the suspension status of a target user
 pub(crate) async fn put_suspended_status(
 	State(services): State<crate::State>,
-	body: Ruma<suspend_user::v1::Request>,
-) -> Result<suspend_user::v1::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	body: Ruma<set_suspended::v1::Request>,
+) -> Result<set_suspended::v1::Response> {
+	let sender_user = body.identity.sender_user();

 	let (sender_admin, active, target_admin) = join3(
 		services.users.is_admin(sender_user),
@@ -64,13 +64,13 @@ pub(crate) async fn put_suspended_status(
 	}
 	if services.users.is_suspended(&body.user_id).await? == body.suspended {
 		// No change
-		return Ok(suspend_user::v1::Response::new(body.suspended));
+		return Ok(set_suspended::v1::Response::new(body.suspended));
 	}

 	let action = if body.suspended {
 		services
 			.users
-			.suspend_account(&body.user_id, body.identity.sender_user())
+			.suspend_account(&body.user_id, sender_user)
 			.await;
 		"suspended"
 	} else {
@@ -86,5 +86,5 @@ pub(crate) async fn put_suspended_status(
 			.await;
 	}

-	Ok(suspend_user::v1::Response::new(body.suspended))
+	Ok(set_suspended::v1::Response::new(body.suspended))
 }
@@ -11,8 +11,7 @@ pub(crate) async fn create_alias_route(
 	State(services): State<crate::State>,
 	body: Ruma<create_alias::v3::Request>,
 ) -> Result<create_alias::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
+	let sender_user = body.identity.sender_user();
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -60,8 +59,7 @@ pub(crate) async fn delete_alias_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_alias::v3::Request>,
 ) -> Result<delete_alias::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
+	let sender_user = body.identity.sender_user();
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -25,7 +25,7 @@ pub(crate) async fn create_backup_version_route(
 ) -> Result<create_backup_version::v3::Response> {
 	let version = services
 		.key_backups
-		.create_backup(body.identity.expect_sender_user()?, &body.algorithm)?;
+		.create_backup(body.identity.sender_user(), &body.algorithm)?;

 	Ok(create_backup_version::v3::Response::new(version))
 }
@@ -40,7 +40,7 @@ pub(crate) async fn update_backup_version_route(
 ) -> Result<update_backup_version::v3::Response> {
 	services
 		.key_backups
-		.update_backup(body.identity.expect_sender_user()?, &body.version, &body.algorithm)
+		.update_backup(body.identity.sender_user(), &body.version, &body.algorithm)
 		.await?;

 	Ok(update_backup_version::v3::Response::new())
@@ -53,15 +53,13 @@ pub(crate) async fn get_latest_backup_info_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_latest_backup_info::v3::Request>,
 ) -> Result<get_latest_backup_info::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	let (version, algorithm) = services
 		.key_backups
-		.get_latest_backup(sender_user)
+		.get_latest_backup(body.identity.sender_user())
 		.await
 		.map_err(|_| err!(Request(NotFound("Key backup does not exist."))))?;

-	let (count, etag) = get_count_etag(&services, sender_user, &version).await;
+	let (count, etag) = get_count_etag(&services, body.identity.sender_user(), &version).await;

 	Ok(get_latest_backup_info::v3::Response::new(algorithm, count, etag, version))
 }
@@ -73,17 +71,16 @@ pub(crate) async fn get_backup_info_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_backup_info::v3::Request>,
 ) -> Result<get_backup_info::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	let algorithm = services
 		.key_backups
-		.get_backup(sender_user, &body.version)
+		.get_backup(body.identity.sender_user(), &body.version)
 		.await
 		.map_err(|_| {
 			err!(Request(NotFound("Key backup does not exist at version {:?}", body.version)))
 		})?;

-	let (count, etag) = get_count_etag(&services, sender_user, &body.version).await;
+	let (count, etag) =
+		get_count_etag(&services, body.identity.sender_user(), &body.version).await;

 	Ok(get_backup_info::v3::Response::new(algorithm, count, etag, body.version.clone()))
 }
@@ -100,7 +97,7 @@ pub(crate) async fn delete_backup_version_route(
 ) -> Result<delete_backup_version::v3::Response> {
 	services
 		.key_backups
-		.delete_backup(body.identity.expect_sender_user()?, &body.version)
+		.delete_backup(body.identity.sender_user(), &body.version)
 		.await;

 	Ok(delete_backup_version::v3::Response::new())
@@ -118,11 +115,9 @@ pub(crate) async fn add_backup_keys_route(
 	State(services): State<crate::State>,
 	body: Ruma<add_backup_keys::v3::Request>,
 ) -> Result<add_backup_keys::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	if services
 		.key_backups
-		.get_latest_backup_version(sender_user)
+		.get_latest_backup_version(body.identity.sender_user())
 		.await
 		.is_ok_and(|version| version != body.version)
 	{
@@ -135,12 +130,19 @@ pub(crate) async fn add_backup_keys_route(
 		for (session_id, key_data) in &room.sessions {
 			services
 				.key_backups
-				.add_key(sender_user, &body.version, room_id, session_id, key_data)
+				.add_key(
+					body.identity.sender_user(),
+					&body.version,
+					room_id,
+					session_id,
+					key_data,
+				)
 				.await?;
 		}
 	}

-	let (count, etag) = get_count_etag(&services, sender_user, &body.version).await;
+	let (count, etag) =
+		get_count_etag(&services, body.identity.sender_user(), &body.version).await;

 	Ok(add_backup_keys::v3::Response::new(etag, count))
 }
@@ -157,11 +159,9 @@ pub(crate) async fn add_backup_keys_for_room_route(
 	State(services): State<crate::State>,
 	body: Ruma<add_backup_keys_for_room::v3::Request>,
 ) -> Result<add_backup_keys_for_room::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	if services
 		.key_backups
-		.get_latest_backup_version(sender_user)
+		.get_latest_backup_version(body.identity.sender_user())
 		.await
 		.is_ok_and(|version| version != body.version)
 	{
@@ -173,11 +173,18 @@ pub(crate) async fn add_backup_keys_for_room_route(
 	for (session_id, key_data) in &body.sessions {
 		services
 			.key_backups
-			.add_key(sender_user, &body.version, &body.room_id, session_id, key_data)
+			.add_key(
+				body.identity.sender_user(),
+				&body.version,
+				&body.room_id,
+				session_id,
+				key_data,
+			)
 			.await?;
 	}

-	let (count, etag) = get_count_etag(&services, sender_user, &body.version).await;
+	let (count, etag) =
+		get_count_etag(&services, body.identity.sender_user(), &body.version).await;

 	Ok(add_backup_keys_for_room::v3::Response::new(etag, count))
 }
@@ -194,11 +201,9 @@ pub(crate) async fn add_backup_keys_for_session_route(
 	State(services): State<crate::State>,
 	body: Ruma<add_backup_keys_for_session::v3::Request>,
 ) -> Result<add_backup_keys_for_session::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	if services
 		.key_backups
-		.get_latest_backup_version(sender_user)
+		.get_latest_backup_version(body.identity.sender_user())
 		.await
 		.is_ok_and(|version| version != body.version)
 	{
@@ -211,7 +216,7 @@ pub(crate) async fn add_backup_keys_for_session_route(
 	let mut ok_to_replace = true;
 	if let Some(old_key) = &services
 		.key_backups
-		.get_session(sender_user, &body.version, &body.room_id, &body.session_id)
+		.get_session(body.identity.sender_user(), &body.version, &body.room_id, &body.session_id)
 		.await
 		.ok()
 	{
@@ -270,7 +275,7 @@ pub(crate) async fn add_backup_keys_for_session_route(
 		services
 			.key_backups
 			.add_key(
-				sender_user,
+				body.identity.sender_user(),
 				&body.version,
 				&body.room_id,
 				&body.session_id,
@@ -279,7 +284,8 @@ pub(crate) async fn add_backup_keys_for_session_route(
 			.await?;
 	}

-	let (count, etag) = get_count_etag(&services, sender_user, &body.version).await;
+	let (count, etag) =
+		get_count_etag(&services, body.identity.sender_user(), &body.version).await;

 	Ok(add_backup_keys_for_session::v3::Response::new(etag, count))
 }
@@ -293,7 +299,7 @@ pub(crate) async fn get_backup_keys_route(
 ) -> Result<get_backup_keys::v3::Response> {
 	let rooms = services
 		.key_backups
-		.get_all(body.identity.expect_sender_user()?, &body.version)
+		.get_all(body.identity.sender_user(), &body.version)
 		.await;

 	Ok(get_backup_keys::v3::Response::new(rooms))
@@ -308,7 +314,7 @@ pub(crate) async fn get_backup_keys_for_room_route(
 ) -> Result<get_backup_keys_for_room::v3::Response> {
 	let sessions = services
 		.key_backups
-		.get_room(body.identity.expect_sender_user()?, &body.version, &body.room_id)
+		.get_room(body.identity.sender_user(), &body.version, &body.room_id)
 		.await;

 	Ok(get_backup_keys_for_room::v3::Response::new(sessions))
@@ -323,12 +329,7 @@ pub(crate) async fn get_backup_keys_for_session_route(
 ) -> Result<get_backup_keys_for_session::v3::Response> {
 	let key_data = services
 		.key_backups
-		.get_session(
-			body.identity.expect_sender_user()?,
-			&body.version,
-			&body.room_id,
-			&body.session_id,
-		)
+		.get_session(body.identity.sender_user(), &body.version, &body.room_id, &body.session_id)
 		.await
 		.map_err(|_| {
 			err!(Request(NotFound(debug_error!("Backup key not found for this user's session."))))
@@ -344,14 +345,13 @@ pub(crate) async fn delete_backup_keys_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_backup_keys::v3::Request>,
 ) -> Result<delete_backup_keys::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	services
 		.key_backups
-		.delete_all_keys(sender_user, &body.version)
+		.delete_all_keys(body.identity.sender_user(), &body.version)
 		.await;

-	let (count, etag) = get_count_etag(&services, sender_user, &body.version).await;
+	let (count, etag) =
+		get_count_etag(&services, body.identity.sender_user(), &body.version).await;

 	Ok(delete_backup_keys::v3::Response::new(etag, count))
 }
@@ -363,14 +363,13 @@ pub(crate) async fn delete_backup_keys_for_room_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_backup_keys_for_room::v3::Request>,
 ) -> Result<delete_backup_keys_for_room::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	services
 		.key_backups
-		.delete_room_keys(sender_user, &body.version, &body.room_id)
+		.delete_room_keys(body.identity.sender_user(), &body.version, &body.room_id)
 		.await;

-	let (count, etag) = get_count_etag(&services, sender_user, &body.version).await;
+	let (count, etag) =
+		get_count_etag(&services, body.identity.sender_user(), &body.version).await;

 	Ok(delete_backup_keys_for_room::v3::Response::new(etag, count))
 }
@@ -382,14 +381,18 @@ pub(crate) async fn delete_backup_keys_for_session_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_backup_keys_for_session::v3::Request>,
 ) -> Result<delete_backup_keys_for_session::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	services
 		.key_backups
-		.delete_room_key(sender_user, &body.version, &body.room_id, &body.session_id)
+		.delete_room_key(
+			body.identity.sender_user(),
+			&body.version,
+			&body.room_id,
+			&body.session_id,
+		)
 		.await;

-	let (count, etag) = get_count_etag(&services, sender_user, &body.version).await;
+	let (count, etag) =
+		get_count_etag(&services, body.identity.sender_user(), &body.version).await;

 	Ok(delete_backup_keys_for_session::v3::Response::new(etag, count))
 }
@@ -48,11 +48,7 @@ pub(crate) async fn get_capabilities_route(
 		json!({"enabled": services.config.forget_forced_upon_leave}),
 	)?;

-	if services
-		.users
-		.is_admin(body.identity.expect_sender_user()?)
-		.await
-	{
+	if services.users.is_admin(body.identity.sender_user()).await {
 		// Advertise suspension API
 		capabilities.set("uk.timedout.msc4323", json!({"suspend": true, "lock": false}))?;
 	}
@@ -37,7 +37,7 @@ pub(crate) async fn get_context_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_context::v3::Request>,
 ) -> Result<get_context::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.sender_device();
 	let room_id = &body.room_id;
 	let event_id = &body.event_id;
@@ -29,7 +29,7 @@ pub(crate) async fn put_dehydrated_device_route(

 	services
 		.users
-		.set_dehydrated_device(body.identity.expect_sender_user()?, body.body)
+		.set_dehydrated_device(body.identity.sender_user(), body.body)
 		.await?;

 	Ok(put_dehydrated_device::Response::new(device_id))
@@ -44,7 +44,7 @@ pub(crate) async fn delete_dehydrated_device_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<delete_dehydrated_device::Request>,
 ) -> Result<delete_dehydrated_device::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let device_id = services.users.get_dehydrated_device_id(sender_user).await?;

@@ -62,7 +62,7 @@ pub(crate) async fn get_dehydrated_device_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_dehydrated_device::Request>,
 ) -> Result<get_dehydrated_device::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let device = services.users.get_dehydrated_device(sender_user).await?;

@@ -78,7 +78,7 @@ pub(crate) async fn get_dehydrated_events_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_events::Request>,
 ) -> Result<get_events::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let device_id = &body.body.device_id;
 	let existing_id = services.users.get_dehydrated_device_id(sender_user).await;
@@ -8,6 +8,7 @@
 		self, delete_device, delete_devices, get_device, get_devices, update_device,
 	},
 };
+use service::uiaa::Identity;

 use crate::{Ruma, client::DEVICE_ID_LENGTH};

@@ -20,7 +21,7 @@ pub(crate) async fn get_devices_route(
 ) -> Result<get_devices::v3::Response> {
 	let devices: Vec<device::Device> = services
 		.users
-		.all_devices_metadata(body.identity.expect_sender_user()?)
+		.all_devices_metadata(body.identity.sender_user())
 		.collect()
 		.await;

@@ -36,7 +37,7 @@ pub(crate) async fn get_device_route(
 ) -> Result<get_device::v3::Response> {
 	let device = services
 		.users
-		.get_device_metadata(body.identity.expect_sender_user()?, &body.body.device_id)
+		.get_device_metadata(body.identity.sender_user(), &body.body.device_id)
 		.await
 		.map_err(|_| err!(Request(NotFound("Device not found."))))?;

@@ -52,7 +53,7 @@ pub(crate) async fn update_device_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<update_device::v3::Request>,
 ) -> Result<update_device::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let appservice = body.identity.appservice_info();

 	match services
@@ -94,7 +95,6 @@ pub(crate) async fn update_device_route(
 					&device_id,
 					&appservice.registration.as_token,
 					None,
-					None,
 					Some(client.to_string()),
 				)
 				.await?;
@@ -118,14 +118,15 @@ pub(crate) async fn delete_device_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_device::v3::Request>,
 ) -> Result<delete_device::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
+	let appservice = body.identity.appservice_info();

 	// Appservices get to skip UIAA for this endpoint
-	if let Some(sender_device) = body.identity.sender_device() {
+	if appservice.is_none() {
 		// Prompt the user to confirm with their password using UIAA
 		let _ = services
 			.uiaa
-			.authenticate_password(&body.auth, sender_user, Some(sender_device), None)
+			.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 			.await?;
 	}

@@ -153,14 +154,15 @@ pub(crate) async fn delete_devices_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_devices::v3::Request>,
 ) -> Result<delete_devices::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
+	let appservice = body.identity.appservice_info();

 	// Appservices get to skip UIAA for this endpoint
-	if let Some(sender_device) = body.identity.sender_device() {
+	if appservice.is_none() {
 		// Prompt the user to confirm with their password using UIAA
 		let _ = services
 			.uiaa
-			.authenticate_password(&body.auth, sender_user, Some(sender_device), None)
+			.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 			.await?;
 	}

@@ -112,7 +112,7 @@ pub(crate) async fn set_room_visibility_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<set_room_visibility::v3::Request>,
 ) -> Result<set_room_visibility::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if !services.rooms.metadata.exists(&body.room_id).await {
 		// Return 404 if the room doesn't exist
@@ -15,7 +15,7 @@ pub(crate) async fn get_filter_route(
 ) -> Result<get_filter::v3::Response> {
 	services
 		.users
-		.get_filter(body.identity.expect_sender_user()?, &body.filter_id)
+		.get_filter(body.identity.sender_user(), &body.filter_id)
 		.await
 		.map(get_filter::v3::Response::new)
 		.map_err(|_| err!(Request(NotFound("Filter not found."))))
@@ -30,7 +30,7 @@ pub(crate) async fn create_filter_route(
 ) -> Result<create_filter::v3::Response> {
 	let filter_id = services
 		.users
-		.create_filter(body.identity.expect_sender_user()?, &body.filter);
+		.create_filter(body.identity.sender_user(), &body.filter);

 	Ok(create_filter::v3::Response::new(filter_id))
 }
@@ -26,7 +26,7 @@
 	serde::Raw,
 };
 use serde_json::json;
-use service::oauth::OAuthTicket;
+use service::uiaa::Identity;

 use crate::Ruma;

@@ -41,7 +41,7 @@ pub(crate) async fn upload_keys_route(
 	State(services): State<crate::State>,
 	body: Ruma<upload_keys::v3::Request>,
 ) -> Result<upload_keys::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.expect_sender_device()?;

 	for (key_id, one_time_key) in &body.one_time_keys {
@@ -155,7 +155,7 @@ pub(crate) async fn get_keys_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_keys::v3::Request>,
 ) -> Result<get_keys::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	get_keys_helper(
 		&services,
@@ -192,7 +192,7 @@ pub(crate) async fn upload_signing_keys_route(
 	State(services): State<crate::State>,
 	body: Ruma<upload_signing_keys::v3::Request>,
 ) -> Result<upload_signing_keys::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if uiaa_needed_to_upload_keys(
 		services,
@@ -205,12 +205,7 @@ pub(crate) async fn upload_signing_keys_route(
 	{
 		let _ = services
 			.uiaa
-			.authenticate_password(
-				&body.auth,
-				sender_user,
-				body.identity.sender_device(),
-				Some(OAuthTicket::CrossSigningReset),
-			)
+			.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 			.await?;
 	}

@@ -293,7 +288,7 @@ pub(crate) async fn upload_signatures_route(
 		return Ok(upload_signatures::v3::Response::new());
 	}

-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	for (user_id, keys) in &body.signed_keys {
 		for (key_id, key) in keys {
@@ -346,7 +341,7 @@ pub(crate) async fn get_key_changes_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_key_changes::v3::Request>,
 ) -> Result<get_key_changes::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let mut device_list_updates = HashSet::new();

@@ -53,7 +53,7 @@ pub(crate) async fn create_content_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<create_content::v3::Response> {
-	let user = body.identity.expect_sender_user()?;
+	let user = body.identity.sender_user();
 	if services.users.is_suspended(user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -92,7 +92,7 @@ pub(crate) async fn get_content_thumbnail_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v1::Request>,
 ) -> Result<get_content_thumbnail::v1::Response> {
-	let user = body.identity.expect_sender_user()?;
+	let user = body.identity.sender_user();

 	let dim = Dim::from_ruma(body.width, body.height, body.method.clone())?;
 	let mxc = Mxc {
@@ -142,7 +142,7 @@ pub(crate) async fn get_content_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v1::Request>,
 ) -> Result<get_content::v1::Response> {
-	let user = body.identity.expect_sender_user()?;
+	let user = body.identity.sender_user();

 	let mxc = Mxc {
 		server_name: &body.server_name,
@@ -189,7 +189,7 @@ pub(crate) async fn get_content_as_filename_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v1::Request>,
 ) -> Result<get_content_as_filename::v1::Response> {
-	let user = body.identity.expect_sender_user()?;
+	let user = body.identity.sender_user();

 	let mxc = Mxc {
 		server_name: &body.server_name,
@@ -240,7 +240,7 @@ pub(crate) async fn get_media_preview_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v1::Request>,
 ) -> Result<get_media_preview::v1::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let url = &body.url;
 	let url = Url::parse(&body.url).map_err(|e| {
@@ -56,7 +56,7 @@ pub(crate) async fn get_media_preview_legacy_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<get_media_preview::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let url = &body.url;
 	let url = Url::parse(&body.url).map_err(|e| {
@@ -15,7 +15,7 @@ pub(crate) async fn ban_user_route(
 	State(services): State<crate::State>,
 	body: Ruma<ban_user::v3::Request>,
 ) -> Result<ban_user::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if sender_user == body.user_id {
 		return Err!(Request(Forbidden("You cannot ban yourself.")));
@@ -18,7 +18,7 @@ pub(crate) async fn forget_room_route(
 	State(services): State<crate::State>,
 	body: Ruma<forget_room::v3::Request>,
 ) -> Result<forget_room::v3::Response> {
-	let user_id = body.identity.expect_sender_user()?;
+	let user_id = body.identity.sender_user();
 	let room_id = &body.room_id;

 	let joined = services.rooms.state_cache.is_joined(user_id, room_id);
@@ -29,7 +29,7 @@ pub(crate) async fn invite_user_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<invite_user::v3::Request>,
 ) -> Result<invite_user::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -28,7 +28,7 @@ pub(crate) async fn join_room_by_id_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<join_room_by_id::v3::Request>,
 ) -> Result<join_room_by_id::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -97,7 +97,7 @@ pub(crate) async fn join_room_by_id_or_alias_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<join_room_by_id_or_alias::v3::Request>,
 ) -> Result<join_room_by_id_or_alias::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let body = &body.body;
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
@@ -15,7 +15,7 @@ pub(crate) async fn kick_user_route(
 	State(services): State<crate::State>,
 	body: Ruma<kick_user::v3::Request>,
 ) -> Result<kick_user::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -51,7 +51,7 @@ pub(crate) async fn knock_room_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<knock_room::v3::Request>,
 ) -> Result<knock_room::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let body = &body.body;
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
@@ -32,15 +32,10 @@ pub(crate) async fn leave_room_route(
 	State(services): State<crate::State>,
 	body: Ruma<leave_room::v3::Request>,
 ) -> Result<leave_room::v3::Response> {
-	leave_room(
-		&services,
-		body.identity.expect_sender_user()?,
-		&body.room_id,
-		body.reason.clone(),
-	)
-	.boxed()
-	.await
-	.map(|()| leave_room::v3::Response::new())
+	leave_room(&services, body.identity.sender_user(), &body.room_id, body.reason.clone())
+		.boxed()
+		.await
+		.map(|()| leave_room::v3::Response::new())
 }

 // Make a user leave all their joined rooms, rescinds knocks, forgets all rooms,
@@ -30,7 +30,7 @@ pub(crate) async fn get_member_events_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_member_events::v3::Request>,
 ) -> Result<get_member_events::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let membership = body.membership.as_ref();
 	let not_membership = body.not_membership.as_ref();

@@ -72,7 +72,7 @@ pub(crate) async fn joined_members_route(
 	if !services
 		.rooms
 		.state_accessor
-		.user_can_see_state_events(body.identity.expect_sender_user()?, &body.room_id)
+		.user_can_see_state_events(body.identity.sender_user(), &body.room_id)
 		.await
 	{
 		return Err!(Request(Forbidden("You don't have permission to view this room.")));
@@ -40,7 +40,7 @@ pub(crate) async fn joined_rooms_route(
 	let joined_rooms = services
 		.rooms
 		.state_cache
-		.rooms_joined(body.identity.expect_sender_user()?)
+		.rooms_joined(body.identity.sender_user())
 		.collect()
 		.await;

@@ -14,7 +14,7 @@ pub(crate) async fn unban_user_route(
 	State(services): State<crate::State>,
 	body: Ruma<unban_user::v3::Request>,
 ) -> Result<unban_user::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -75,7 +75,7 @@ pub(crate) async fn get_message_events_route(
 	ClientIp(client_ip): ClientIp,
 	body: Ruma<get_message_events::v3::Request>,
 ) -> Result<get_message_events::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.sender_device();
 	let room_id = &body.room_id;
 	let filter = &body.filter;
@@ -16,7 +16,6 @@
 pub(super) mod membership;
 pub(super) mod message;
 pub(super) mod mutual_rooms;
-pub(super) mod oauth;
 pub(super) mod openid;
 pub(super) mod presence;
 pub(super) mod profile;
@@ -62,7 +61,6 @@
 pub use membership::{leave_all_rooms, leave_room, remote_leave_room};
 pub(super) use message::*;
 pub(super) use mutual_rooms::*;
-pub(super) use oauth::*;
 pub(super) use openid::*;
 pub(super) use presence::*;
 pub(super) use profile::*;
@@ -75,7 +73,6 @@
 pub(super) use room::*;
 pub(super) use search::*;
 pub(super) use send::*;
-pub use session::handle_login;
 pub(super) use session::*;
 pub(super) use space::*;
 pub(super) use state::*;
@@ -15,7 +15,7 @@ pub(crate) async fn get_mutual_rooms_route(
 	State(services): State<crate::State>,
 	body: Ruma<mutual_rooms::unstable::Request>,
 ) -> Result<mutual_rooms::unstable::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if sender_user == body.user_id {
 		return Err!(Request(Unknown("You cannot request rooms in common with yourself.")));
@@ -1,56 +0,0 @@
-use axum::{
-	Json, Router,
-	extract::{Request, State},
-	middleware::{self, Next},
-	response::{IntoResponse, Response},
-	routing::method_routing::{get, post},
-};
-use const_str::concat;
-use http::StatusCode;
-use serde_json::json;
-pub(crate) use server_metadata::*;
-
-mod register_client;
-mod server_metadata;
-mod token;
-
-const BASE_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/oauth2/");
-const AUTH_CODE_PATH: &str = "grant/authorization_code";
-const JWKS_URI_PATH: &str = "client/keys.json";
-const CLIENT_REGISTER_PATH: &str = "client/register";
-const TOKEN_REVOKE_PATH: &str = "client/revoke";
-const TOKEN_PATH: &str = "grant/token";
-const ACCOUNT_MANAGEMENT_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/account/deeplink");
-
-pub(crate) fn router(state: crate::State) -> Router<crate::State> {
-	Router::new()
-		.nest(BASE_PATH, oauth_router())
-		.route(
-			"/.well-known/openid-configuration",
-			get(
-				// TODO(unspecced): used by old versions of the matrix-js-sdk
-				async |State(services): State<crate::State>| {
-					Json(authorization_server_metadata(&services).await)
-				},
-			),
-		)
-		.layer(middleware::from_fn_with_state(
-			state,
-			async |State(state): State<crate::State>, request: Request, next: Next| -> Response {
-				if state.config.oauth.compatibility_mode.oauth_available() {
-					next.run(request).await
-				} else {
-					(StatusCode::NOT_FOUND, "OAuth is unavailable on this server").into_response()
-				}
-			},
-		))
-}
-
-fn oauth_router() -> Router<crate::State> {
-	Router::new()
-		.route(concat!("/", CLIENT_REGISTER_PATH), post(register_client::register_client_route))
-		// TODO(unspecced): used by old versions of the matrix-js-sdk
-		.route(concat!("/", JWKS_URI_PATH), get(async || Json(json!({"keys": []}))))
-		.route(concat!("/", TOKEN_PATH), post(token::token_route))
-		.route(concat!("/", TOKEN_REVOKE_PATH), post(token::revoke_token_route))
-}
@@ -1,28 +0,0 @@
-use axum::{
-	Json,
-	extract::State,
-	response::{IntoResponse, Response},
-};
-use http::StatusCode;
-use serde::Serialize;
-use service::oauth::client_metadata::ClientMetadata;
-
-#[derive(Serialize)]
-struct RegisteredClient {
-	client_id: String,
-	#[serde(flatten)]
-	metadata: ClientMetadata,
-}
-
-pub(crate) async fn register_client_route(
-	State(services): State<crate::State>,
-	Json(metadata): Json<ClientMetadata>,
-) -> Result<Response, Response> {
-	let client_id = services
-		.oauth
-		.register_client(&metadata)
-		.await
-		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;
-
-	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
-}
@@ -1,62 +0,0 @@
-use axum::extract::State;
-use conduwuit::{Err, Result};
-use ruma::{
-	api::client::discovery::get_authorization_server_metadata::{
-		self, v1::AccountManagementAction,
-	},
-	serde::Raw,
-};
-use serde_json::{Value, json};
-use service::Services;
-
-use crate::{
-	Ruma,
-	client::oauth::{
-		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, JWKS_URI_PATH, TOKEN_PATH,
-		TOKEN_REVOKE_PATH,
-	},
-};
-
-pub(crate) async fn get_authorization_server_metadata_route(
-	State(services): State<crate::State>,
-	_body: Ruma<get_authorization_server_metadata::v1::Request>,
-) -> Result<get_authorization_server_metadata::v1::Response> {
-	if !services.config.oauth.compatibility_mode.oauth_available() {
-		return Err!(Request(Unrecognized("OAuth is unavailable on this server")));
-	}
-
-	let metadata = Raw::new(&authorization_server_metadata(&services).await).unwrap();
-
-	Ok(get_authorization_server_metadata::v1::Response::new(metadata.cast_unchecked()))
-}
-
-pub(crate) async fn authorization_server_metadata(services: &Services) -> Value {
-	let endpoint_base = services
-		.config
-		.get_client_domain()
-		.join(super::BASE_PATH)
-		.unwrap();
-
-	json!({
-		"account_management_uri": endpoint_base.join(ACCOUNT_MANAGEMENT_PATH).unwrap(),
-		"account_management_actions_supported": [
-			AccountManagementAction::AccountDeactivate,
-			AccountManagementAction::CrossSigningReset,
-			AccountManagementAction::DeviceDelete,
-			AccountManagementAction::DeviceView,
-			AccountManagementAction::DevicesList,
-			AccountManagementAction::Profile,
-		],
-		"authorization_endpoint": endpoint_base.join(AUTH_CODE_PATH).unwrap(),
-		"code_challenge_methods_supported": ["S256"],
-		"grant_types_supported": ["authorization_code", "refresh_token"],
-		"issuer": services.config.get_client_domain(),
-		"jwks_uri": endpoint_base.join(JWKS_URI_PATH).unwrap(),
-		"prompt_values_supported": ["create"],
-		"registration_endpoint": endpoint_base.join(CLIENT_REGISTER_PATH).unwrap(),
-		"response_modes_supported": ["query", "fragment"],
-		"response_types_supported": ["code"],
-		"revocation_endpoint": endpoint_base.join(TOKEN_REVOKE_PATH).unwrap(),
-		"token_endpoint": endpoint_base.join(TOKEN_PATH).unwrap(),
-	})
-}
@@ -1,23 +0,0 @@
-use axum::{Form, Json, extract::State, response::IntoResponse};
-use http::StatusCode;
-use service::oauth::grant::{RevokeTokenRequest, TokenRequest};
-
-pub(crate) async fn token_route(
-	State(services): State<crate::State>,
-	Form(request): Form<TokenRequest>,
-) -> impl IntoResponse {
-	match services.oauth.issue_token(request).await {
-		| Ok(response) => Ok(Json(response)),
-		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
-	}
-}
-
-pub(crate) async fn revoke_token_route(
-	State(services): State<crate::State>,
-	Form(request): Form<RevokeTokenRequest>,
-) -> impl IntoResponse {
-	match services.oauth.revoke_token(request.token).await {
-		| Ok(()) => Ok(StatusCode::OK),
-		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
-	}
-}
@@ -16,7 +16,7 @@ pub(crate) async fn create_openid_token_route(
 	State(services): State<crate::State>,
 	body: Ruma<account::request_openid_token::v3::Request>,
 ) -> Result<account::request_openid_token::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if sender_user != body.user_id {
 		return Err!(Request(InvalidParam(
@@ -16,19 +16,23 @@ pub(crate) async fn set_presence_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_presence::v3::Request>,
 ) -> Result<set_presence::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	if !services.config.allow_local_presence {
 		return Err!(Request(Forbidden("Presence is disabled on this server")));
 	}

-	if sender_user != body.user_id && !body.identity.is_appservice() {
+	if body.identity.sender_user() != body.user_id && !body.identity.is_appservice() {
 		return Err!(Request(InvalidParam("Not allowed to set presence of other users")));
 	}

 	services
 		.presence
-		.set_presence(sender_user, &body.presence, None, None, body.status_msg.clone())
+		.set_presence(
+			body.identity.sender_user(),
+			&body.presence,
+			None,
+			None,
+			body.status_msg.clone(),
+		)
 		.await?;

 	Ok(set_presence::v3::Response::new())
@@ -51,7 +55,7 @@ pub(crate) async fn get_presence_route(
 	let has_shared_rooms = services
 		.rooms
 		.state_cache
-		.user_sees_user(body.identity.expect_sender_user()?, &body.user_id)
+		.user_sees_user(body.identity.sender_user(), &body.user_id)
 		.await;

 	if has_shared_rooms {
@@ -8,12 +8,12 @@
 	UserId,
 	api::{
 		client::profile::{
-			PropagateTo, delete_profile_field, get_profile, get_profile_field, set_profile_field,
+			delete_profile_field, get_profile, get_profile_field, set_profile_field,
 		},
 		federation,
 	},
 	assign,
-	events::room::member::MembershipState,
+	events::room::member::{MembershipState, RoomMemberEventContent},
 	presence::PresenceState,
 	profile::{ProfileFieldName, ProfileFieldValue},
 };
@@ -31,12 +31,6 @@ pub(crate) async fn get_profile_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile::v3::Request>,
 ) -> Result<get_profile::v3::Response> {
-	if services.config.require_auth_for_profile_requests && body.identity.is_none() {
-		return Err!(Request(Unauthorized(
-			"This server requires authentication to view user profiles."
-		)));
-	}
-
 	let Some(profile) = fetch_full_profile(&services, &body.user_id).await else {
 		return Err!(Request(NotFound("This user's profile could not be fetched.")));
 	};
@@ -48,12 +42,6 @@ pub(crate) async fn get_profile_field_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_profile_field::v3::Request>,
 ) -> Result<get_profile_field::v3::Response> {
-	if services.config.require_auth_for_profile_requests && body.identity.is_none() {
-		return Err!(Request(Unauthorized(
-			"This server requires authentication to view user profiles."
-		)));
-	}
-
 	let value = fetch_profile_field(&services, &body.user_id, body.field.clone()).await?;

 	Ok(assign!(get_profile_field::v3::Response::default(), { value }))
@@ -63,11 +51,11 @@ pub(crate) async fn set_profile_field_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_profile_field::v3::Request>,
 ) -> Result<set_profile_field::v3::Response> {
-	if body.user_id != body.identity.expect_sender_user()?
+	if body.user_id != body.identity.sender_user()
 		&& !(body.identity.is_appservice()
 			|| services
 				.admin
-				.user_is_admin(body.identity.expect_sender_user()?)
+				.user_is_admin(body.identity.sender_user())
 				.await)
 	{
 		return Err!(Request(Forbidden("You may not change other users' profile data.")));
@@ -77,13 +65,8 @@ pub(crate) async fn set_profile_field_route(
 		return Err!(Request(InvalidParam("You may not change a remote user's profile data.")));
 	}

-	set_profile_field(
-		&services,
-		&body.user_id,
-		ProfileFieldChange::Set(body.value.clone()),
-		body.propagate_to.clone(),
-	)
-	.await?;
+	set_profile_field(&services, &body.user_id, ProfileFieldChange::Set(body.value.clone()))
+		.await?;

 	Ok(set_profile_field::v3::Response::new())
 }
@@ -92,11 +75,11 @@ pub(crate) async fn delete_profile_field_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_profile_field::v3::Request>,
 ) -> Result<delete_profile_field::v3::Response> {
-	if body.user_id != body.identity.expect_sender_user()?
+	if body.user_id != body.identity.sender_user()
 		&& !(body.identity.is_appservice()
 			|| services
 				.admin
-				.user_is_admin(body.identity.expect_sender_user()?)
+				.user_is_admin(body.identity.sender_user())
 				.await)
 	{
 		return Err!(Request(Forbidden("You may not change other users' profile data.")));
@@ -106,13 +89,8 @@ pub(crate) async fn delete_profile_field_route(
 		return Err!(Request(InvalidParam("You may not change a remote user's profile data.")));
 	}

-	set_profile_field(
-		&services,
-		&body.user_id,
-		ProfileFieldChange::Delete(body.field.clone()),
-		body.propagate_to.clone(),
-	)
-	.await?;
+	set_profile_field(&services, &body.user_id, ProfileFieldChange::Delete(body.field.clone()))
+		.await?;

 	Ok(delete_profile_field::v3::Response::new())
 }
@@ -147,13 +125,7 @@ async fn fetch_full_profile(
 			continue;
 		};

-		let _ = set_profile_field(
-			services,
-			user_id,
-			ProfileFieldChange::Set(value),
-			PropagateTo::None,
-		)
-		.await;
+		let _ = set_profile_field(services, user_id, ProfileFieldChange::Set(value)).await;
 	}

 	Some(BTreeMap::from_iter(response))
@@ -187,13 +159,8 @@ async fn fetch_profile_field(

 	if let Some(value) = response.get(field.as_str()).map(ToOwned::to_owned) {
 		if let Ok(value) = ProfileFieldValue::new(field.as_str(), value) {
-			let _ = set_profile_field(
-				services,
-				user_id,
-				ProfileFieldChange::Set(value.clone()),
-				PropagateTo::None,
-			)
-			.await;
+			let _ = set_profile_field(services, user_id, ProfileFieldChange::Set(value.clone()))
+				.await;

 			Ok(Some(value))
 		} else {
@@ -202,13 +169,7 @@ async fn fetch_profile_field(
 			)))
 		}
 	} else {
-		let _ = set_profile_field(
-			services,
-			user_id,
-			ProfileFieldChange::Delete(field),
-			PropagateTo::None,
-		)
-		.await;
+		let _ = set_profile_field(services, user_id, ProfileFieldChange::Delete(field)).await;

 		Ok(None)
 	}
@@ -301,7 +262,6 @@ async fn set_profile_field(
 	services: &Services,
 	user_id: &UserId,
 	change: ProfileFieldChange,
-	propagate_to: PropagateTo,
 ) -> Result<()> {
 	const MAX_KEY_LENGTH_BYTES: usize = 255;
 	const MAX_PROFILE_LENGTH_BYTES: usize = 65536;
@@ -349,91 +309,6 @@ async fn set_profile_field(
 		}
 	}

-	// If the user is local and changed their displayname or avatar_url, update it
-	// in all their joined rooms. This is done before updating their profile data
-	// so we can check the old value of the field if `propagate_to` is `unchanged`.
-	if matches!(field_name, ProfileFieldName::AvatarUrl | ProfileFieldName::DisplayName)
-		&& matches!(propagate_to, PropagateTo::All | PropagateTo::Unchanged)
-		&& services.globals.user_is_local(user_id)
-	{
-		let current_displayname = services.users.displayname(user_id).await.ok();
-		let current_avatar_url = services.users.avatar_url(user_id).await.ok();
-
-		let mut all_joined_rooms = services.rooms.state_cache.rooms_joined(user_id);
-
-		while let Some(room_id) = all_joined_rooms.next().await {
-			// TODO: this clobbers any custom fields on the event content
-			let mut current_membership = services
-				.rooms
-				.state_accessor
-				.get_member(&room_id, user_id)
-				.await
-				.expect("should be able to fetch membership event for joined room");
-
-			assert_eq!(
-				current_membership.membership,
-				MembershipState::Join,
-				"user should be joined"
-			);
-
-			// If `propagate_to` is `unchanged`, and the current value of the field we're
-			// updating was changed from its global value in this room, skip it.
-			if matches!(propagate_to, PropagateTo::Unchanged) {
-				let field_changed_from_global = match field_name {
-					| ProfileFieldName::AvatarUrl =>
-						current_membership.avatar_url.as_ref() != current_avatar_url.as_ref(),
-					| ProfileFieldName::DisplayName =>
-						current_membership.displayname.as_ref() != current_displayname.as_ref(),
-					| _ => unreachable!(),
-				};
-
-				if field_changed_from_global {
-					continue;
-				}
-			}
-
-			let state_lock = services.rooms.state.mutex.lock(room_id.as_str()).await;
-
-			// Preserve keys in accordance with the key copying rules
-			current_membership.reason = None;
-			current_membership.join_authorized_via_users_server = None;
-			match &change {
-				| ProfileFieldChange::Set(ProfileFieldValue::AvatarUrl(avatar_url)) => {
-					current_membership.avatar_url = Some(avatar_url.clone());
-				},
-				| ProfileFieldChange::Set(ProfileFieldValue::DisplayName(displayname)) => {
-					current_membership.displayname = Some(displayname.clone());
-				},
-				| ProfileFieldChange::Delete(ProfileFieldName::AvatarUrl) => {
-					current_membership.avatar_url = None;
-				},
-				| ProfileFieldChange::Delete(ProfileFieldName::DisplayName) => {
-					current_membership.displayname = None;
-				},
-				| _ => unreachable!(),
-			}
-
-			let _ = services
-				.rooms
-				.timeline
-				.build_and_append_pdu(
-					PartialPdu::state(user_id.to_string(), &current_membership),
-					user_id,
-					Some(&room_id),
-					&state_lock,
-				)
-				.await;
-		}
-
-		if services.config.allow_local_presence {
-			// Send a presence EDU to indicate the profile changed
-			let _ = services
-				.presence
-				.ping_presence(user_id, &PresenceState::Online)
-				.await;
-		}
-	}
-
 	match change {
 		| ProfileFieldChange::Set(ProfileFieldValue::DisplayName(displayname)) => {
 			services
@@ -457,5 +332,42 @@ async fn set_profile_field(
 				.set_profile_key(user_id, other.field_name().as_str(), other.value()),
 	}

+	// If the user is local and changed their displayname or avatar_url, update it
+	// in all their joined rooms
+	if matches!(field_name, ProfileFieldName::AvatarUrl | ProfileFieldName::DisplayName)
+		&& services.globals.user_is_local(user_id)
+	{
+		let displayname = services.users.displayname(user_id).await.ok();
+		let avatar_url = services.users.avatar_url(user_id).await.ok();
+		let membership_content = assign!(
+			RoomMemberEventContent::new(MembershipState::Join), { displayname, avatar_url }
+		);
+
+		let mut all_joined_rooms = services.rooms.state_cache.rooms_joined(user_id);
+
+		while let Some(room_id) = all_joined_rooms.next().await {
+			let state_lock = services.rooms.state.mutex.lock(room_id.as_str()).await;
+
+			let _ = services
+				.rooms
+				.timeline
+				.build_and_append_pdu(
+					PartialPdu::state(user_id.to_string(), &membership_content),
+					user_id,
+					Some(&room_id),
+					&state_lock,
+				)
+				.await;
+		}
+
+		if services.config.allow_local_presence {
+			// Send a presence EDU to indicate the profile changed
+			let _ = services
+				.presence
+				.ping_presence(user_id, &PresenceState::Online)
+				.await;
+		}
+	}
+
 	Ok(())
 }
@@ -30,7 +30,7 @@ pub(crate) async fn get_pushrules_all_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_pushrules_all::v3::Request>,
 ) -> Result<get_pushrules_all::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let Some(content_value) = services
 		.account_data
@@ -101,7 +101,7 @@ pub(crate) async fn get_pushrules_global_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_pushrules_global_scope::v3::Request>,
 ) -> Result<get_pushrules_global_scope::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let Some(content_value) = services
 		.account_data
@@ -189,7 +189,7 @@ pub(crate) async fn get_pushrule_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_pushrule::v3::Request>,
 ) -> Result<get_pushrule::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	// remove old deprecated mentions push rules as per MSC4210
 	#[allow(deprecated)]
@@ -226,7 +226,7 @@ pub(crate) async fn set_pushrule_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_pushrule::v3::Request>,
 ) -> Result<set_pushrule::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let body = &body.body;
 	let mut account_data: PushRulesEvent = services
 		.account_data
@@ -282,7 +282,7 @@ pub(crate) async fn get_pushrule_actions_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_pushrule_actions::v3::Request>,
 ) -> Result<get_pushrule_actions::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	// remove old deprecated mentions push rules as per MSC4210
 	#[allow(deprecated)]
@@ -316,7 +316,7 @@ pub(crate) async fn set_pushrule_actions_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_pushrule_actions::v3::Request>,
 ) -> Result<set_pushrule_actions::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let mut account_data: PushRulesEvent = services
 		.account_data
@@ -349,7 +349,7 @@ pub(crate) async fn get_pushrule_enabled_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_pushrule_enabled::v3::Request>,
 ) -> Result<get_pushrule_enabled::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	// remove old deprecated mentions push rules as per MSC4210
 	#[allow(deprecated)]
@@ -383,7 +383,7 @@ pub(crate) async fn set_pushrule_enabled_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_pushrule_enabled::v3::Request>,
 ) -> Result<set_pushrule_enabled::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let mut account_data: PushRulesEvent = services
 		.account_data
@@ -416,7 +416,7 @@ pub(crate) async fn delete_pushrule_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_pushrule::v3::Request>,
 ) -> Result<delete_pushrule::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let mut account_data: PushRulesEvent = services
 		.account_data
@@ -458,7 +458,7 @@ pub(crate) async fn get_pushers_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_pushers::v3::Request>,
 ) -> Result<get_pushers::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	Ok(get_pushers::v3::Response::new(services.pusher.get_pushers(sender_user).await))
 }
@@ -472,7 +472,7 @@ pub(crate) async fn set_pushers_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_pusher::v3::Request>,
 ) -> Result<set_pusher::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.expect_sender_device()?;

 	services
@@ -26,7 +26,7 @@ pub(crate) async fn set_read_marker_route(
 	State(services): State<crate::State>,
 	body: Ruma<set_read_marker::v3::Request>,
 ) -> Result<set_read_marker::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if let Some(event) = &body.fully_read {
 		let fully_read_event = FullyReadEvent::new(FullyReadEventContent::new(event.to_owned()));
@@ -118,8 +118,7 @@ pub(crate) async fn create_receipt_route(
 	ClientIp(client_ip): ClientIp,
 	body: Ruma<create_receipt::v3::Request>,
 ) -> Result<create_receipt::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
+	let sender_user = body.identity.sender_user();
 	services
 		.users
 		.update_device_last_seen(sender_user, body.identity.sender_device(), client_ip)
@@ -17,7 +17,7 @@ pub(crate) async fn redact_event_route(
 	ClientIp(client_ip): ClientIp,
 	body: Ruma<redact_event::v3::Request>,
 ) -> Result<redact_event::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	services
 		.users
 		.update_device_last_seen(sender_user, body.identity.sender_device(), client_ip)
@@ -28,7 +28,7 @@ pub(crate) async fn get_relating_events_with_rel_type_and_event_type_route(
 ) -> Result<get_relating_events_with_rel_type_and_event_type::v1::Response> {
 	paginate_relations_with_filter(
 		&services,
-		body.identity.expect_sender_user()?,
+		body.identity.sender_user(),
 		&body.room_id,
 		&body.event_id,
 		body.event_type.clone().into(),
@@ -56,7 +56,7 @@ pub(crate) async fn get_relating_events_with_rel_type_route(
 ) -> Result<get_relating_events_with_rel_type::v1::Response> {
 	paginate_relations_with_filter(
 		&services,
-		body.identity.expect_sender_user()?,
+		body.identity.sender_user(),
 		&body.room_id,
 		&body.event_id,
 		None,
@@ -84,7 +84,7 @@ pub(crate) async fn get_relating_events_route(
 ) -> Result<get_relating_events::v1::Response> {
 	paginate_relations_with_filter(
 		&services,
-		body.identity.expect_sender_user()?,
+		body.identity.sender_user(),
 		&body.room_id,
 		&body.event_id,
 		None,
@@ -36,7 +36,7 @@ pub(crate) async fn report_room_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<report_room::v3::Request>,
 ) -> Result<report_room::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -92,7 +92,7 @@ pub(crate) async fn report_event_route(
 	body: Ruma<report_content::v3::Request>,
 ) -> Result<report_content::v3::Response> {
 	// user authentication
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
@@ -135,7 +135,7 @@ pub(crate) async fn report_user_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<report_user::v3::Request>,
 ) -> Result<report_user::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if services.users.is_suspended(sender_user).await? {
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
@@ -15,7 +15,7 @@ pub(crate) async fn get_room_aliases_route(
 	State(services): State<crate::State>,
 	body: Ruma<aliases::v3::Request>,
 ) -> Result<aliases::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if !services
 		.rooms
@@ -61,7 +61,7 @@ pub(crate) async fn create_room_route(
 ) -> Result<create_room::v3::Response> {
 	use create_room::v3::RoomPreset;

-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if !services.globals.allow_room_creation()
 		&& !body.identity.is_appservice()
@@ -12,7 +12,6 @@ pub(crate) async fn get_room_event_route(
 	State(ref services): State<crate::State>,
 	ref body: Ruma<get_room_event::v3::Request>,
 ) -> Result<get_room_event::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
 	let event_id = &body.event_id;
 	let room_id = &body.room_id;

@@ -25,25 +24,25 @@ pub(crate) async fn get_room_event_route(
 	let visible = services
 		.rooms
 		.state_accessor
-		.user_can_see_event(sender_user, room_id, event_id)
+		.user_can_see_event(body.identity.sender_user(), room_id, event_id)
 		.map(Ok);

 	let (mut event, visible) = try_join(event, visible).await?;

-	if !visible || is_ignored_pdu(services, &event, sender_user).await? {
+	if !visible || is_ignored_pdu(services, &event, body.identity.sender_user()).await? {
 		return Err!(Request(Forbidden("You don't have permission to view this event.")));
 	}

 	if let Err(e) = services
 		.rooms
 		.pdu_metadata
-		.add_bundled_aggregations_to_pdu(sender_user, &mut event)
+		.add_bundled_aggregations_to_pdu(body.identity.sender_user(), &mut event)
 		.await
 	{
 		debug_warn!("Failed to add bundled aggregations to event: {e}");
 	}

-	event.set_unsigned(Some(body.identity.expect_sender_user()?));
+	event.set_unsigned(Some(body.identity.sender_user()));

 	Ok(get_room_event::v3::Response::new(event.into_format()))
 }
@@ -17,13 +17,12 @@ pub(crate) async fn room_initial_sync_route(
 	State(services): State<crate::State>,
 	body: Ruma<Request>,
 ) -> Result<Response> {
-	let sender_user = body.identity.expect_sender_user()?;
 	let room_id = &body.room_id;

 	if !services
 		.rooms
 		.state_accessor
-		.user_can_see_state_events(sender_user, room_id)
+		.user_can_see_state_events(body.identity.sender_user(), room_id)
 		.await
 	{
 		return Err!(Request(Forbidden("No room preview available.")));
@@ -32,7 +31,7 @@ pub(crate) async fn room_initial_sync_route(
 	let membership = services
 		.rooms
 		.state_cache
-		.user_membership(sender_user, room_id)
+		.user_membership(body.identity.sender_user(), room_id)
 		.map(Ok);

 	let visibility = services.rooms.directory.visibility(room_id).map(Ok);
@@ -53,11 +52,11 @@ pub(crate) async fn room_initial_sync_route(
 		.pdus_rev(room_id, None)
 		.try_take(limit)
 		.and_then(async |mut pdu| {
-			pdu.1.set_unsigned(Some(sender_user));
+			pdu.1.set_unsigned(Some(body.identity.sender_user()));
 			if let Err(e) = services
 				.rooms
 				.pdu_metadata
-				.add_bundled_aggregations_to_pdu(sender_user, &mut pdu.1)
+				.add_bundled_aggregations_to_pdu(body.identity.sender_user(), &mut pdu.1)
 				.await
 			{
 				debug_warn!("Failed to add bundled aggregations: {e}");
@@ -29,10 +29,7 @@ pub(crate) async fn get_room_summary(
 		.rooms
 		.summary
 		.get_room_summary_for_user(
-			body.identity
-				.as_ref()
-				.map(ClientIdentity::expect_sender_user)
-				.transpose()?,
+			body.identity.as_ref().map(ClientIdentity::sender_user),
 			&room_id,
 			&servers,
 		)
@@ -277,7 +277,7 @@ pub(crate) async fn upgrade_room_route(
 	State(services): State<crate::State>,
 	body: Ruma<upgrade_room::v3::Request>,
 ) -> Result<upgrade_room::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let (supported, forbid_unstable, is_unstable) = (
 		services.server.supported_room_version(&body.new_version),
@@ -43,7 +43,7 @@ pub(crate) async fn search_events_route(
 	State(services): State<crate::State>,
 	body: Ruma<Request>,
 ) -> Result<Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let next_batch = body.next_batch.as_deref();

 	let mut result_categories = ResultCategories::new();
@@ -22,7 +22,7 @@ pub(crate) async fn send_message_event_route(
 	ClientIp(client_ip): ClientIp,
 	body: Ruma<send_message_event::v3::Request>,
 ) -> Result<send_message_event::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.sender_device();

 	if services.users.is_suspended(sender_user).await? {
@@ -21,7 +21,7 @@
 			},
 			login::{
 				self,
-				v3::{DiscoveryInfo, HomeserverInfo, LoginInfo},
+				v3::{DiscoveryInfo, HomeserverInfo},
 			},
 			logout, logout_all,
 		},
@@ -29,6 +29,7 @@
 	},
 	assign,
 };
+use service::uiaa::Identity;

 use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::Ruma;
@@ -43,12 +44,6 @@ pub(crate) async fn get_login_types_route(
 	ClientIp(client): ClientIp,
 	_body: Ruma<get_login_types::v3::Request>,
 ) -> Result<get_login_types::v3::Response> {
-	if !services.config.oauth.compatibility_mode.uiaa_available() {
-		return Err!(Request(Unrecognized(
-			"User-interactive authentication is not available on this server."
-		)));
-	}
-
 	Ok(get_login_types::v3::Response::new(vec![
 		get_login_types::v3::LoginType::Password(PasswordLoginType::default()),
 		get_login_types::v3::LoginType::ApplicationService(ApplicationServiceLoginType::default()),
@@ -58,7 +53,7 @@ pub(crate) async fn get_login_types_route(
 	]))
 }

-pub async fn handle_login(
+pub(crate) async fn handle_login(
 	services: &Services,
 	identifier: Option<&UserIdentifier>,
 	password: &str,
@@ -92,6 +87,10 @@ pub async fn handle_login(
 		return Err!(Request(InvalidParam("User ID does not belong to this homeserver")));
 	}

+	if services.users.is_locked(&user_id).await? {
+		return Err!(Request(UserLocked("This account has been locked.")));
+	}
+
 	if services.users.is_login_disabled(&user_id).await {
 		warn!(%user_id, "user attempted to log in with a login-disabled account");
 		return Err!(Request(Forbidden("This account is not permitted to log in.")));
@@ -120,29 +119,19 @@ pub(crate) async fn login_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<login::v3::Request>,
 ) -> Result<login::v3::Response> {
-	if !services.config.oauth.compatibility_mode.uiaa_available() {
-		return match body.login_info {
-			| LoginInfo::ApplicationService(_) => {
-				Err!(Request(AppserviceLoginUnsupported(
-					"User-interactive appservice login is not available on this server."
-				)))
-			},
-			| _ => {
-				Err!(Request(Unrecognized(
-					"User-interactive authentication is not available on this server."
-				)))
-			},
-		};
-	}
-
 	let emergency_mode_enabled = services.config.emergency_password.is_some();

 	// Validate login method
+	// TODO: Other login methods
 	let user_id = match &body.login_info {
 		#[allow(deprecated)]
-		| LoginInfo::Password(login::v3::Password { identifier, password, user, .. }) =>
-			handle_login(&services, identifier.as_ref(), password, user.as_ref()).await?,
-		| LoginInfo::Token(login::v3::Token { token, .. }) => {
+		| login::v3::LoginInfo::Password(login::v3::Password {
+			identifier,
+			password,
+			user,
+			..
+		}) => handle_login(&services, identifier.as_ref(), password, user.as_ref()).await?,
+		| login::v3::LoginInfo::Token(login::v3::Token { token, .. }) => {
 			debug!("Got token login type");
 			if !services.server.config.login_via_existing_session {
 				return Err!(Request(Unknown("Token login is not enabled.")));
@@ -150,7 +139,7 @@ pub(crate) async fn login_route(
 			services.users.find_from_login_token(token).await?
 		},
 		#[allow(deprecated)]
-		| LoginInfo::ApplicationService(login::v3::ApplicationService {
+		| login::v3::LoginInfo::ApplicationService(login::v3::ApplicationService {
 			identifier,
 			user,
 			..
@@ -184,6 +173,7 @@ pub(crate) async fn login_route(
 			user_id
 		},
 		| _ => {
+			debug!("/login json_body: {:?}", &body.json_body);
 			return Err!(Request(Unknown(
 				debug_warn!(?body.login_info, "Invalid or unsupported login type")
 			)));
@@ -213,7 +203,7 @@ pub(crate) async fn login_route(
 	if device_exists {
 		services
 			.users
-			.set_token(&user_id, &device_id, &token, None)
+			.set_token(&user_id, &device_id, &token)
 			.await?;
 	} else {
 		services
@@ -222,7 +212,6 @@ pub(crate) async fn login_route(
 				&user_id,
 				&device_id,
 				&token,
-				None,
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -261,16 +250,16 @@ pub(crate) async fn login_token_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<get_login_token::v1::Request>,
 ) -> Result<get_login_token::v1::Response> {
-	if !services.config.login_via_existing_session {
+	if !services.server.config.login_via_existing_session {
 		return Err!(Request(Forbidden("Login via an existing session is not enabled")));
 	}

-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	// Prompt the user to confirm with their password using UIAA
 	let _ = services
 		.uiaa
-		.authenticate_password(&body.auth, sender_user, body.identity.sender_device(), None)
+		.authenticate_password(&body.auth, Some(Identity::from_user_id(sender_user)))
 		.await?;

 	let login_token = utils::random_string(TOKEN_LENGTH);
@@ -297,7 +286,7 @@ pub(crate) async fn logout_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<logout::v3::Request>,
 ) -> Result<logout::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.expect_sender_device()?;

 	services
@@ -345,7 +334,7 @@ pub(crate) async fn logout_all_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<logout_all::v3::Request>,
 ) -> Result<logout_all::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	services
 		.users
 		.all_device_ids(sender_user)
@@ -27,7 +27,7 @@ pub(crate) async fn get_hierarchy_route(
 		.rooms
 		.summary
 		.get_room_hierarchy_for_user(
-			body.identity.expect_sender_user()?,
+			body.identity.sender_user(),
 			body.room_id.clone(),
 			max_depth,
 			body.suggested_only,
@@ -38,7 +38,7 @@ pub(crate) async fn send_state_event_for_key_route(
 	ClientIp(ip): ClientIp,
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<send_state_event::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	services
 		.users
 		.update_device_last_seen(sender_user, body.identity.sender_device(), ip)
@@ -91,7 +91,7 @@ pub(crate) async fn get_state_events_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_state_events::v3::Request>,
 ) -> Result<get_state_events::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if !services
 		.rooms
@@ -125,7 +125,7 @@ pub(crate) async fn get_state_event_for_key_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_state_event_for_key::v3::Request>,
 ) -> Result<get_state_event_for_key::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	if !services
 		.rooms
@@ -34,7 +34,6 @@
 	},
 	assign,
 	events::presence::{PresenceEvent, PresenceEventContent},
-	presence::PresenceState,
 	serde::Raw,
 };
 use service::{
@@ -182,11 +181,11 @@ pub(crate) async fn sync_events_route(
 	ClientIp(client_ip): ClientIp,
 	body: Ruma<sync_events::v3::Request>,
 ) -> Result<sync_events::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.expect_sender_device()?;

 	// Presence update
-	if services.config.allow_local_presence && body.set_presence != PresenceState::Offline {
+	if services.config.allow_local_presence {
 		services
 			.presence
 			.ping_presence(sender_user, &body.body.set_presence)
@@ -227,7 +226,7 @@ pub(crate) async fn build_sync_events(
 	services: &Services,
 	body: &Ruma<sync_events::v3::Request>,
 ) -> Result<sync_events::v3::Response> {
-	let syncing_user = body.identity.sender_user().expect("should have a user");
+	let syncing_user = body.identity.sender_user();
 	let syncing_device = body.identity.sender_device().expect("should have a device");

 	let current_count = services.globals.current_count()?;
@@ -69,7 +69,8 @@ pub(crate) async fn sync_events_v5_route(
 	ClientIp(client_ip): ClientIp,
 	body: Ruma<sync_events::v5::Request>,
 ) -> Result<sync_events::v5::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	debug_assert!(DEFAULT_BUMP_TYPES.is_sorted(), "DEFAULT_BUMP_TYPES is not sorted");
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.expect_sender_device()?;

 	services
@@ -21,7 +21,7 @@ pub(crate) async fn update_tag_route(
 	State(services): State<crate::State>,
 	body: Ruma<create_tag::v3::Request>,
 ) -> Result<create_tag::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let mut tags_event = services
 		.account_data
@@ -56,7 +56,7 @@ pub(crate) async fn delete_tag_route(
 	State(services): State<crate::State>,
 	body: Ruma<delete_tag::v3::Request>,
 ) -> Result<delete_tag::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let mut tags_event = services
 		.account_data
@@ -88,7 +88,7 @@ pub(crate) async fn get_tags_route(
 	State(services): State<crate::State>,
 	body: Ruma<get_tags::v3::Request>,
 ) -> Result<get_tags::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();

 	let tags_event = services
 		.account_data
@@ -16,8 +16,6 @@ pub(crate) async fn get_threads_route(
 	State(services): State<crate::State>,
 	ref body: Ruma<get_threads::v1::Request>,
 ) -> Result<get_threads::v1::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
-
 	// Use limit or else 10, with maximum 100
 	let limit = body
 		.limit
@@ -36,14 +34,14 @@ pub(crate) async fn get_threads_route(
 	let threads: Vec<(PduCount, PduEvent)> = services
 		.rooms
 		.threads
-		.threads_until(sender_user, &body.room_id, from, &body.include)
+		.threads_until(body.identity.sender_user(), &body.room_id, from, &body.include)
 		.await?
 		.take(limit)
 		.filter_map(|(count, pdu)| async move {
 			services
 				.rooms
 				.state_accessor
-				.user_can_see_event(sender_user, &body.room_id, &pdu.event_id)
+				.user_can_see_event(body.identity.sender_user(), &body.room_id, &pdu.event_id)
 				.await
 				.then_some((count, pdu))
 		})
@@ -51,7 +49,7 @@ pub(crate) async fn get_threads_route(
 			if let Err(e) = services
 				.rooms
 				.pdu_metadata
-				.add_bundled_aggregations_to_pdu(sender_user, &mut pdu)
+				.add_bundled_aggregations_to_pdu(body.identity.sender_user(), &mut pdu)
 				.await
 			{
 				debug_warn!("Failed to add bundled aggregations to thread: {e}");
@@ -22,7 +22,7 @@ pub(crate) async fn send_event_to_device_route(
 	State(services): State<crate::State>,
 	body: Ruma<send_event_to_device::v3::Request>,
 ) -> Result<send_event_to_device::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let sender_device = body.identity.sender_device();

 	// Check if this is a new transaction id
@@ -14,8 +14,7 @@ pub(crate) async fn create_typing_event_route(
 	body: Ruma<create_typing_event::v3::Request>,
 ) -> Result<create_typing_event::v3::Response> {
 	use create_typing_event::v3::Typing;
-	let sender_user = body.identity.expect_sender_user()?;
-
+	let sender_user = body.identity.sender_user();
 	services
 		.users
 		.update_device_last_seen(sender_user, body.identity.sender_device(), ip)
@@ -35,8 +35,8 @@ pub(crate) async fn get_supported_versions_route(
 /// `/_matrix/federation/v1/version`
 pub(crate) async fn conduwuit_server_version() -> Result<impl IntoResponse> {
 	Ok(Json(serde_json::json!({
-		"name": conduwuit::BRANDING,
-		"version": conduwuit::version(),
+		"name": conduwuit::version::name(),
+		"version": conduwuit::version::version(),
 	})))
 }

@@ -26,7 +26,7 @@ pub(crate) async fn search_users_route(
 	State(services): State<crate::State>,
 	body: Ruma<search_users::v3::Request>,
 ) -> Result<search_users::v3::Response> {
-	let sender_user = body.identity.expect_sender_user()?;
+	let sender_user = body.identity.sender_user();
 	let limit = usize::try_from(body.limit)
 		.map_or(LIMIT_DEFAULT, usize::from)
 		.min(LIMIT_MAX);
@@ -33,8 +33,7 @@ pub(crate) async fn turn_server_route(
 		)
 		.expect("time is valid");

-		let username: String =
-			format!("{}:{}", expiry.get(), body.identity.expect_sender_user()?);
+		let username: String = format!("{}:{}", expiry.get(), body.identity.sender_user());

 		let mut mac = HmacSha1::new_from_slice(turn_secret.as_bytes())
 			.expect("HMAC can take key of any size");
@@ -3,7 +3,8 @@
 use ruma::{
 	api::client::discovery::{
 		discover_homeserver::{self, HomeserverInfo},
-		discover_policy_server, discover_support,
+		discover_policy_server,
+		discover_support::{self, Contact, ContactRole},
 	},
 	assign,
 };
@@ -66,7 +67,46 @@ pub(crate) async fn well_known_support(
 		.as_ref()
 		.map(ToString::to_string);

-	let contacts = services.admin.get_support_contacts().await;
+	let email_address = services.config.well_known.support_email.clone();
+	let matrix_id = services.config.well_known.support_mxid.clone();
+	let pgp_key = services.config.well_known.support_pgp_key.clone();
+
+	// TODO: support defining multiple contacts in the config
+	let mut contacts: Vec<Contact> = vec![];
+
+	let role = services
+		.config
+		.well_known
+		.support_role
+		.clone()
+		.unwrap_or(ContactRole::Admin);
+
+	// Add configured contact if at least one contact method is specified
+	let configured_contact = match (matrix_id, email_address) {
+		| (Some(matrix_id), email_address) =>
+			Some(assign!(Contact::with_matrix_id(role, matrix_id), { email_address })),
+		| (None, Some(email_address)) => Some(Contact::with_email_address(role, email_address)),
+		| (None, None) => None,
+	};
+
+	if let Some(mut configured_contact) = configured_contact {
+		configured_contact.pgp_key = pgp_key;
+
+		contacts.push(configured_contact);
+	}
+
+	// Try to add admin users as contacts if no contacts are configured
+	if contacts.is_empty() {
+		let admin_users = services.admin.get_admins().await;
+
+		for user_id in &admin_users {
+			if *user_id == services.globals.server_user {
+				continue;
+			}
+
+			contacts.push(Contact::with_matrix_id(ContactRole::Admin, user_id.to_owned()));
+		}
+	}

 	if contacts.is_empty() && support_page.is_none() {
 		// No admin room, no configured contacts, and no support page
@@ -1,5 +1,4 @@
 #![type_length_limit = "16384"] //TODO: reduce me
-#![recursion_limit = "256"] // My Giant Async Function
 #![allow(clippy::toplevel_ref_arg)]

 extern crate conduwuit_core as conduwuit;
@@ -11,6 +10,8 @@
 pub mod router;
 pub mod server;

+pub mod admin;
+
 pub(crate) use self::router::{Ruma, RumaResponse, State};

 conduwuit::mod_ctor! {}
@@ -10,18 +10,16 @@
 	response::{IntoResponse, Redirect},
 	routing::{any, get, post},
 };
-use conduwuit::err;
+use conduwuit::{Server, err};
 pub(super) use conduwuit_service::state::State;
 use http::{Uri, uri};

 use self::handler::RouterExt;
 pub(super) use self::{args::Args as Ruma, auth::ClientIdentity, response::RumaResponse};
-#[cfg(feature = "admin_api")]
-use crate::client::admin::site as admin_api;
-use crate::{client, server};
+use crate::{admin, client, server};

-pub fn build(router: Router<State>, state: State) -> Router<State> {
-	let config = &state.server.config;
+pub fn build(router: Router<State>, server: &Server) -> Router<State> {
+	let config = &server.config;
 	let mut router = router
        .ruma_route(&client::appservice_ping)
 		.ruma_route(&client::get_supported_versions_route)
@@ -183,17 +181,15 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 		.ruma_route(&client::get_room_summary)
 		.ruma_route(&client::get_suspended_status)
 		.ruma_route(&client::put_suspended_status)
-		.ruma_route(&client::get_locked_status)
-		.ruma_route(&client::put_locked_status)
 		.ruma_route(&client::well_known_support)
 		.ruma_route(&client::well_known_client)
 		.ruma_route(&client::well_known_policy_server)
 		.ruma_route(&client::get_rtc_transports)
 		.ruma_route(&client::room_initial_sync_route)
-		.ruma_route(&client::get_authorization_server_metadata_route)
-		.merge(client::oauth::router(state))
 		.route("/_conduwuit/server_version", get(client::conduwuit_server_version))
-		.route("/_continuwuity/server_version", get(client::conduwuit_server_version));
+		.route("/_continuwuity/server_version", get(client::conduwuit_server_version))
+		.ruma_route(&admin::rooms::ban::ban_room)
+		.ruma_route(&admin::rooms::list::list_rooms);

 	if config.allow_federation {
 		router = router
@@ -229,6 +225,7 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 			.ruma_route(&server::well_known_server)
 			.ruma_route(&server::get_content_route)
 			.ruma_route(&server::get_content_thumbnail_route)
+			.ruma_route(&server::get_edutypes_route)
 			.route("/_conduwuit/local_user_count", get(client::conduwuit_local_user_count))
 			.route("/_continuwuity/local_user_count", get(client::conduwuit_local_user_count));
 	} else {
@@ -278,16 +275,6 @@ pub fn build(router: Router<State>, state: State) -> Router<State> {
 			.route("/_matrix/media/r0/preview_url", any(redirect_legacy_preview));
 	}

-	#[cfg(feature = "admin_api")]
-	{
-		router = router
-			.ruma_route(&admin_api::users::list_users_route)
-			.ruma_route(&admin_api::users::create_user_route)
-			.ruma_route(&admin_api::rooms::ban_room)
-			.ruma_route(&admin_api::rooms::legacy_list_rooms_route)
-			.ruma_route(&admin_api::rooms::list_rooms_route);
-	};
-
 	router
 }

@@ -1,28 +1,21 @@
-use std::{
-	any::{Any, TypeId},
-	fmt::Display,
-};
+use std::any::{Any, TypeId};

-use conduwuit::{Err, Error, Result, err};
-use http::StatusCode;
+use conduwuit::{Err, Result, err};
 use ruma::{
 	DeviceId, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId,
 	api::{
-		IncomingRequest, OAuthScope,
+		IncomingRequest,
 		auth_scheme::{
 			AccessToken, AccessTokenOptional, AppserviceToken, AppserviceTokenOptional,
 			AuthScheme, NoAccessToken, NoAuthentication,
 		},
 		client,
-		error::{ErrorKind, UnknownTokenErrorData},
 		federation::authentication::ServerSignatures,
 	},
-	assign,
 };
 use service::{
 	Services,
 	server_keys::{PubKeyMap, PubKeys},
-	users::AccessTokenStatus,
 };

 use crate::{router::args::AuthQueryParams, service::appservice::RegistrationInfo};
@@ -40,17 +33,10 @@ pub(crate) enum ClientIdentity {
 }

 impl ClientIdentity {
-	pub(crate) fn sender_user(&self) -> Option<&UserId> {
+	pub(crate) fn sender_user(&self) -> &UserId {
 		match self {
 			| Self::User { sender_user, .. } | Self::Appservice { sender_user, .. } =>
-				Some(sender_user),
-		}
-	}
-
-	pub(crate) fn expect_sender_user(&self) -> Result<&UserId> {
-		match self {
-			| Self::User { sender_user, .. } | Self::Appservice { sender_user, .. } =>
-				Ok(sender_user),
+				sender_user,
 		}
 	}

@@ -62,11 +48,9 @@ pub(crate) fn sender_device(&self) -> Option<&DeviceId> {
 	}

 	pub(crate) fn expect_sender_device(&self) -> Result<&DeviceId> {
-		match self {
-			| Self::User { sender_device, .. } => Ok(sender_device),
-			| Self::Appservice { .. } =>
-				Err!(Request(Forbidden("Appservices must masquerade to use this endpoint."))),
-		}
+		self.sender_device().ok_or_else(|| {
+			err!(Request(Forbidden("Appservices must masquerade to use this endpoint.")))
+		})
 	}

 	pub(crate) fn appservice_info(&self) -> Option<&RegistrationInfo> {
@@ -79,66 +63,68 @@ pub(crate) fn appservice_info(&self) -> Option<&RegistrationInfo> {
 	pub(crate) fn is_appservice(&self) -> bool { matches!(self, Self::Appservice { .. }) }
 }

-impl Display for ClientIdentity {
-	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-		match self {
-			| Self::User { sender_user, sender_device } =>
-				write!(f, "{sender_user} ({sender_device})"),
-			| Self::Appservice { sender_user, appservice_info, .. } =>
-				write!(f, "appservice `{}` using {sender_user}", appservice_info.registration.id),
-		}
-	}
-}
-
 pub(crate) trait CheckAuth: AuthScheme {
 	type Identity: Send;

-	fn authenticate<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	fn authenticate<R: IncomingRequest + Any, B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		incoming_request: &hyper::Request<B>,
 		query: AuthQueryParams,
 	) -> impl Future<Output = Result<Self::Identity>> + Send {
 		async move {
+			let route = TypeId::of::<R>();
+
 			let output = Self::extract_authentication(incoming_request).map_err(|err| {
 				err!(Request(Unauthorized(warn!(
-					"Failed to extract request authentication: {}",
+					"Failed to extract authorization: {}",
 					err.into()
 				))))
 			})?;

-			Self::verify::<R, B>(services, output, incoming_request, query).await
+			Self::verify(services, output, incoming_request, query, route).await
 		}
 	}

-	fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		request: &hyper::Request<B>,
 		query: AuthQueryParams,
+		route: TypeId,
 	) -> impl Future<Output = Result<Self::Identity>> + Send;
 }

 impl CheckAuth for ServerSignatures {
 	type Identity = OwnedServerName;

-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		request: &hyper::Request<B>,
 		_query: AuthQueryParams,
+		_route: TypeId,
 	) -> Result<Self::Identity> {
+		let destination = services.globals.server_name();
+		if output
+			.destination
+			.as_ref()
+			.is_some_and(|supplied_destination| supplied_destination != destination)
+		{
+			return Err!(Request(Unauthorized("Destination mismatch.")));
+		}
+
 		let key = services
 			.server_keys
 			.get_verify_key(&output.origin, &output.key)
 			.await
-			.map_err(|err| {
-				err!(Request(Unauthorized(warn!("Failed to fetch signing keys: {err}"))))
+			.map_err(|e| {
+				err!(Request(Unauthorized(warn!("Failed to fetch signing keys: {e}"))))
 			})?;

 		let keys: PubKeys = [(output.key.to_string(), key.key)].into();
 		let keys: PubKeyMap = [(output.origin.as_str().into(), keys)].into();

-		match output.verify_request(request, services.globals.server_name(), &keys) {
+		match output.verify_request(request, destination, &keys) {
 			| Ok(()) => {
 				if services
 					.moderation
@@ -160,36 +146,95 @@ async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]>
 impl CheckAuth for AccessToken {
 	type Identity = ClientIdentity;

-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		_request: &hyper::Request<B>,
 		query: AuthQueryParams,
+		route: TypeId,
 	) -> Result<Self::Identity> {
-		verify_access_token(services, output, query, TypeId::of::<R>(), R::required_scopes())
-			.await
+		if let Ok((sender_user, sender_device)) = services.users.find_from_token(&output).await {
+			// Locked users can only use /logout and /logout/all
+			if services
+				.users
+				.is_locked(&sender_user)
+				.await
+				.is_ok_and(std::convert::identity)
+			{
+				if !(route == TypeId::of::<client::session::logout::v3::Request>()
+					|| route == TypeId::of::<client::session::logout_all::v3::Request>())
+				{
+					return Err!(Request(Unauthorized("Your account is locked.")));
+				}
+			}
+
+			Ok(ClientIdentity::User { sender_user, sender_device })
+		} else if let Ok(appservice_info) = services.appservice.find_from_token(&output).await {
+			let Ok(sender_user) = query.user_id.clone().map_or_else(
+				|| {
+					UserId::parse_with_server_name(
+						appservice_info.registration.sender_localpart.as_str(),
+						services.globals.server_name(),
+					)
+				},
+				UserId::parse,
+			) else {
+				return Err!(Request(InvalidUsername("Username is invalid.")));
+			};
+
+			if !appservice_info.is_user_match(&sender_user) {
+				return Err!(Request(Exclusive("User is not in namespace.")));
+			}
+
+			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
+			// The device_id can be provided via `device_id` or
+			// `org.matrix.msc3202.device_id` query parameter.
+			let sender_device =
+				if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
+					// Verify the device exists for this user
+					if services
+						.users
+						.get_device_metadata(&sender_user, device_id)
+						.await
+						.is_err()
+					{
+						return Err!(Request(Forbidden(
+							"Device does not exist for user or appservice cannot masquerade as \
+							 this device."
+						)));
+					}
+
+					Some(device_id.to_owned())
+				} else {
+					None
+				};
+
+			Ok(ClientIdentity::Appservice {
+				sender_user,
+				sender_device,
+				appservice_info: Box::new(appservice_info),
+			})
+		} else {
+			Err!(Request(Unauthorized("Invalid access token.")))
+		}
 	}
 }

 impl CheckAuth for AccessTokenOptional {
 	type Identity = Option<ClientIdentity>;

-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
-		_request: &hyper::Request<B>,
+		request: &hyper::Request<B>,
 		query: AuthQueryParams,
+		route: TypeId,
 	) -> Result<Self::Identity> {
 		match output {
-			| Some(token) => verify_access_token(
-				services,
-				token,
-				query,
-				TypeId::of::<R>(),
-				R::required_scopes(),
-			)
-			.await
-			.map(Some),
+			| Some(token) =>
+				<AccessToken as CheckAuth>::verify(services, token, request, query, route)
+					.await
+					.map(Some),
 			| None => Ok(None),
 		}
 	}
@@ -198,29 +243,36 @@ async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]>
 impl CheckAuth for AppserviceToken {
 	type Identity = RegistrationInfo;

-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
 		_request: &hyper::Request<B>,
 		_query: AuthQueryParams,
+		_route: TypeId,
 	) -> Result<Self::Identity> {
-		verify_appservice_access_token(services, output).await
+		let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
+			return Err!(Request(Unauthorized("Invalid appservice token.")));
+		};
+
+		Ok(appservice_info)
 	}
 }

 impl CheckAuth for AppserviceTokenOptional {
 	type Identity = Option<RegistrationInfo>;

-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		output: Self::Output,
-		_request: &hyper::Request<B>,
-		_query: AuthQueryParams,
+		request: &hyper::Request<B>,
+		query: AuthQueryParams,
+		route: TypeId,
 	) -> Result<Self::Identity> {
 		match output {
-			| Some(token) => verify_appservice_access_token(services, token)
-				.await
-				.map(Some),
+			| Some(token) =>
+				<AppserviceToken as CheckAuth>::verify(services, token, request, query, route)
+					.await
+					.map(Some),
 			| None => Ok(None),
 		}
 	}
@@ -229,11 +281,12 @@ async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]>
 impl CheckAuth for NoAuthentication {
 	type Identity = ();

-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		_services: &Services,
 		_output: Self::Output,
 		_request: &hyper::Request<B>,
 		_query: AuthQueryParams,
+		_route: TypeId,
 	) -> Result<Self::Identity> {
 		Ok(())
 	}
@@ -242,153 +295,31 @@ async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]>
 impl CheckAuth for NoAccessToken {
 	type Identity = Option<ClientIdentity>;

-	async fn verify<R: IncomingRequest<Authentication = Self> + Any, B: AsRef<[u8]> + Sync>(
+	async fn verify<B: AsRef<[u8]> + Sync>(
 		services: &Services,
 		_output: Self::Output,
 		request: &hyper::Request<B>,
 		query: AuthQueryParams,
+		route: TypeId,
 	) -> Result<Self::Identity> {
 		// We handle these the same as AccessTokenOptional
 		let token = AccessTokenOptional::extract_authentication(request).map_err(|err| {
 			err!(Request(Unauthorized(warn!("Failed to extract authorization: {}", err))))
 		})?;

-		match token {
-			| Some(token) => verify_access_token(
-				services,
-				token,
-				query,
-				TypeId::of::<R>(),
-				// Assume that no scopes are required for these endpoints since
-				// ostensibly they don't require authentication
-				&[],
-			)
-			.await
-			.map(Some),
-			| None => Ok(None),
+		// Check special access restrictions
+		if (route == TypeId::of::<client::profile::get_avatar_url::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_display_name::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_profile_field::v3::Request>()
+			|| route == TypeId::of::<client::profile::get_profile::v3::Request>())
+			&& services.config.require_auth_for_profile_requests
+			&& token.is_none()
+		{
+			return Err!(Request(Unauthorized(
+				"This server requires authentication to access user profiles."
+			)));
 		}
+
+		<AccessTokenOptional as CheckAuth>::verify(services, token, request, query, route).await
 	}
 }
-
-async fn verify_access_token(
-	services: &Services,
-	output: String,
-	query: AuthQueryParams,
-	route: TypeId,
-	required_scopes: &[OAuthScope],
-) -> Result<ClientIdentity> {
-	if let Some((sender_user, sender_device, status)) =
-		services.users.find_from_token(&output).await
-	{
-		// If the token is expired we return a soft logout
-		if matches!(status, AccessTokenStatus::Expired) {
-			return Err(Error::Request(
-				ErrorKind::UnknownToken(
-					assign!(UnknownTokenErrorData::new(), { soft_logout: true }),
-				),
-				"This access token has expired.".into(),
-				StatusCode::UNAUTHORIZED,
-			));
-		}
-
-		// Locked users can only use /logout and /logout/all
-		if services
-			.users
-			.is_locked(&sender_user)
-			.await
-			.is_ok_and(std::convert::identity)
-		{
-			if !(route == TypeId::of::<client::session::logout::v3::Request>()
-				|| route == TypeId::of::<client::session::logout_all::v3::Request>())
-			{
-				return Err!(Request(UserLocked("Your account is locked.")));
-			}
-		}
-
-		// If this device is bound to an OAuth session, check its scopes. This will also
-		// handle admin-only endpoints for OAuth clients.
-		if let Some(session) = services
-			.oauth
-			.get_session_info_for_device(&sender_user, &sender_device)
-			.await
-		{
-			if required_scopes
-				.iter()
-				.all(|scope| !session.scopes.contains(scope))
-			{
-				return Err!(Request(Forbidden(
-					"You don't have the necessary scopes to use this endpoint."
-				)));
-			}
-		} else {
-			// Otherwise, explicitly check if the endpoint is restricted to admins only.
-			if required_scopes.contains(&OAuthScope::ServerAdministration)
-				&& !services.users.is_admin(&sender_user).await
-			{
-				return Err!(Request(Forbidden(
-					"Only server administrators can use this endpoint."
-				)));
-			}
-		}
-
-		Ok(ClientIdentity::User { sender_user, sender_device })
-	} else if let Ok(appservice_info) = services.appservice.find_from_token(&output).await {
-		let Ok(sender_user) = query.user_id.clone().map_or_else(
-			|| {
-				UserId::parse_with_server_name(
-					appservice_info.registration.sender_localpart.as_str(),
-					services.globals.server_name(),
-				)
-			},
-			UserId::parse,
-		) else {
-			return Err!(Request(InvalidUsername("Username is invalid.")));
-		};
-
-		if !appservice_info.is_user_match(&sender_user) {
-			return Err!(Request(Exclusive("User is not in this appservice's namespace.")));
-		}
-
-		// MSC3202/MSC4190: Handle device_id masquerading for appservices.
-		// The device_id can be provided via `device_id` or
-		// `org.matrix.msc3202.device_id` query parameter.
-		let sender_device = if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
-			// Verify the device exists for this user
-			if services
-				.users
-				.get_device_metadata(&sender_user, device_id)
-				.await
-				.is_err()
-			{
-				return Err!(Request(Forbidden("Appservice cannot masquerade as this device.")));
-			}
-
-			Some(device_id.to_owned())
-		} else {
-			None
-		};
-
-		Ok(ClientIdentity::Appservice {
-			sender_user,
-			sender_device,
-			appservice_info: Box::new(appservice_info),
-		})
-	} else {
-		Err(Error::Request(
-			ErrorKind::UnknownToken(UnknownTokenErrorData::new()),
-			"Invalid access token.".into(),
-			StatusCode::UNAUTHORIZED,
-		))
-	}
-}
-
-async fn verify_appservice_access_token(
-	services: &Services,
-	output: String,
-) -> Result<RegistrationInfo> {
-	let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
-		return Err!(Request(Unauthorized("Invalid appservice token.")));
-	};
-
-	Ok(appservice_info)
-}
@@ -0,0 +1,19 @@
+use axum::extract::State;
+use conduwuit::Result;
+use ruma::{api::federation::query::get_edu_types, assign};
+
+use crate::Ruma;
+
+/// # `GET /_matrix/federation/v1/edutypes`
+///
+/// Lists EDU types we wish to receive
+pub(crate) async fn get_edutypes_route(
+	State(services): State<crate::State>,
+	_body: Ruma<get_edu_types::unstable::Request>,
+) -> Result<get_edu_types::unstable::Response> {
+	Ok(assign!(get_edu_types::unstable::Response::new(), {
+		typing: services.config.allow_incoming_typing,
+		presence: services.config.allow_incoming_presence,
+		receipt: services.config.allow_incoming_read_receipts,
+	}))
+}
@@ -1,4 +1,5 @@
 pub(super) mod backfill;
+pub(super) mod edutypes;
 pub(super) mod event;
 pub(super) mod event_auth;
 pub(super) mod get_missing_events;
@@ -23,6 +24,7 @@
 pub(super) mod well_known;

 pub(super) use backfill::*;
+pub(super) use edutypes::*;
 pub(super) use event::*;
 pub(super) use event_auth::*;
 pub(super) use get_missing_events::*;
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ginger	a33e6a0ebb	chore: Clippy fixes	2026-05-26 13:49:17 -04:00
Ginger	4b75d78ac4	refactor: Represent route auth information in the type system	2026-05-26 13:28:23 -04:00
				`@@ -1 +0,0 @@`
				Users may now be forbidden from deactivating their own accounts with the new `allow_deactivation` config option. Contributed by @ginger.
				`@@ -1 +0,0 @@`
				`Added support for authenticating clients using the new OAuth 2.0 login API. Contributed by @ginger.`
				`@@ -1 +0,0 @@`
				`Added support for MSC4466, which allows clients to customize how changes to a user's global profile are propagated. Contributed by @ginger.`
				`@@ -1 +0,0 @@`
				`Devices which set their presence as "offline" will no longer be considered for presence updates. Contributed by @timedout.`
				`@@ -1 +0,0 @@`
				`Remove support for MSC4373, as the MSC is now closed. Contributed by @vel.`