chore: News fragment

feat: Show dehydrated devices in account panel
fix: Explicit type error
2026-08-07 01:39:59 +00:00 · 2026-07-27 14:36:42 -04:00 · 2026-07-27 14:36:01 -04:00 · 2026-07-27 16:01:33 +00:00 · 2026-07-27 16:01:33 +00:00 · 2026-07-27 16:01:11 +00:00
160 changed files with 3112 additions and 2092 deletions
@@ -71,7 +71,7 @@ runs:

    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
+      uses: https://github.com/taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1

@@ -43,7 +43,7 @@ jobs:
      #    fi

      - name: Checkout repository with full history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          ref: ${{ github.ref_name }}
@@ -65,7 +65,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          draft: true
          files: binaries/*
@@ -21,7 +21,7 @@ jobs:

    steps:
      - name: Sync repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          fetch-depth: 0
@@ -32,7 +32,7 @@ jobs:

      - name: Setup Node.js
        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: 22

@@ -24,7 +24,7 @@ jobs:

    steps:
      - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: "22"

@@ -41,7 +41,7 @@ jobs:
      DOCKER_MIRROR_TOKEN: ${{ secrets.DOCKER_MIRROR_TOKEN }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

@@ -55,7 +55,7 @@ jobs:
      #     repositories: continuwuity

      - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@39bf30ced4be9d147faaabbde2682e9725fb8bd1 # main
+        uses: https://github.com/regclient/actions/regsync-installer@c48159175b58fb90cccd0f98410927a81e04a166 # main

      - name: Check what images need mirroring
        run: |
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

@@ -48,7 +48,7 @@ jobs:
      rust: ${{ steps.filter.outputs.rust }}
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

@@ -70,7 +70,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

@@ -46,7 +46,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Prepare Docker build environment
@@ -101,7 +101,7 @@ jobs:
    needs: build-release
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Create multi-platform manifest
@@ -134,7 +134,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Prepare max-perf Docker build environment
@@ -189,7 +189,7 @@ jobs:
    needs: build-maxperf
    steps:
      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - name: Create max-perf manifest
@@ -218,7 +218,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          draft: true
          files: binaries/*
@@ -43,11 +43,11 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.252.1@sha256:121eb04ef758537019fb58f587aa53c99e5fda4e703993ce2ca01bd4b3926bd4
+      image: ghcr.io/renovatebot/renovate:43.281.1@sha256:34c2dd58f58e8976be2024a24fec23bbee805f0bf887837d9aaee7daeb09ccfc
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          show-progress: false

@@ -14,7 +14,7 @@ jobs:
  update-flake-hashes:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: true
          token: ${{ secrets.FORGEJO_TOKEN }}
@@ -1,3 +1,27 @@
+# Continuwuity 26.6.2 (2026-07-12)
+
+## Bugfixes
+
+- Fixed the server returning 500 errors if `admin_console_automatic` is enabled and no TTY is available. Contributed by @s1lv3r. (#1975)
+- Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
+- Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.
+
+
+# Continuwuity 26.6.1 (2026-07-12)
+
+## Features
+
+- Added enforcement for new federated invite checks and corrected a bunch of related spec compliance issues along the way. Contributed by @nex. (#1952)
+
+## Bugfixes
+
+- Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`. (#1942)
+- Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint. (#1953)
+- Fixed newly created rooms failing to sync properly in clients using legacy sync.
+- Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.
+- Whitespace will now automatically be trimmed from the start and end of the `global.oauth.oidc.client_secret_file`.
+
+
 # Continuwuity 26.6.0 (2026-07-10)

 ## Features
@@ -26,7 +26,7 @@ ### Pre-commit Checks


 ```bash
-# Install prek using cargo-binstall
+# Install prek using cargo-binstall https://github.com/cargo-bins/cargo-binstall
 cargo binstall prek

 # Install git hooks to run checks automatically
@@ -155,7 +155,7 @@ ### Creating pull requests

 Before submitting a pull request, please ensure:
 1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
-2. Your code follows the [code style guide](/development/code_style.md)
+2. Your code follows the [code style guide](docs/development/code_style.mdx)
 3. Your commit messages follow the conventional commits format
 4. Tests are added for new functionality
 5. Documentation is updated if needed
@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.6.0"
+version = "26.6.2"

 [workspace.metadata.crane]
 name = "conduwuit"
@@ -115,8 +115,8 @@ git = "https://github.com/vinchona/axum-server-dual-protocol.git"
 rev = "ca6db055254255b74238673ce4135698e347d71c" # feat!: bump axum_server to 0.8.0
 default-features = false

-[workspace.dependencies.axum-client-ip]
-version = "1.3"
+[workspace.dependencies.client-ip]
+version = "0.2"

 [workspace.dependencies.tower]
 version = "0.5.2"
@@ -141,12 +141,6 @@ features = [
 version = "0.23.25"
 default-features = false

-[workspace.dependencies.aws-lc-sys]
-version = "0.41.0"
-
-[workspace.dependencies.aws-lc-rs]
-version = "1.17.0"
-
 [workspace.dependencies.reqwest]
 version = "0.13.2"
 default-features = false
@@ -350,7 +344,7 @@ version = "1.1.1"
 [workspace.dependencies.ruma]
 # version = "0.14.1"
 git = "https://github.com/ruma/ruma.git"
-rev = "9b6a2e7323649af926e4b5363d87239ee4247f4a"
+rev = "3ad047126b321d5fdcf170e1f2e545fed820cf75"
 features = [
    "appservice-api-c",
    "client-api",
@@ -509,7 +503,7 @@ default-features = false
 version = "0.1"

 [workspace.dependencies.syn]
-version = "2.0"
+version = "3.0"
 default-features = false
 features = ["full", "extra-traits"]

@@ -570,7 +564,7 @@ features = ["std"]
 version = "0.3.0"

 [workspace.dependencies.resolvematrix]
-version = "1.1.0"
+version = "1.2.0"

 [workspace.dependencies.serde_urlencoded]
 version = "0.7.1"
@@ -1,47 +1,90 @@
 # Security Policy for Continuwuity

-This document outlines the security policy for Continuwuity. Our goal is to maintain a secure platform for all users, and we take security matters seriously.
+This document outlines the security policy for Continuwuity. Our goal is to maintain a secure platform for all users,
+and we take security matters seriously.

 ## Supported Versions

 We provide security updates for the following versions of Continuwuity:

-| Version        | Supported        |
-| -------------- |:----------------:|
-| Latest release |        ✅        |
-| Main branch    |        ✅        |
-| Older releases |        ❌        |
+| Version        | Supported |
+|----------------|:---------:|
+| Latest release |     ✅     |
+| Main branch    |     ✅     |
+| Older releases |     ❌     |

-We may backport fixes to the previous release at our discretion, but we don't guarantee this.
+We may backport fixes to the previous release at our discretion, but we don't guarantee this; our versioning is designed
+to encourage users to stay up-to-date with the latest release, and we have no concept of "long term support".

 ## Reporting a Vulnerability

 ### Responsible Disclosure

-We appreciate the efforts of security researchers and the community in identifying and reporting vulnerabilities. To ensure that potential vulnerabilities are addressed properly, please follow these guidelines:
+We appreciate the efforts of security researchers and the community in identifying and reporting vulnerabilities. To
+ensure that potential vulnerabilities are addressed properly, please follow these guidelines:

 1. **Contact members of the team directly** over E2EE private message.
-   - [@jade:ellis.link](https://matrix.to/#/@jade:ellis.link)
-   - [@nex:nexy7574.co.uk](https://matrix.to/#/@nex:nexy7574.co.uk)
-   - [@ginger:gingershaped.computer](https://matrix.to/#/@ginger:gingershaped.computer)
-2. **Email the security team** at [security@continuwuity.org](mailto:security@continuwuity.org). This is not E2EE, so don't include sensitive details.
-3. **Do not disclose the vulnerability publicly** until it has been addressed
+    - [@jade:ellis.link](https://matrix.to/#/@jade:ellis.link)
+    - [@nex:nexy7574.co.uk](https://matrix.to/#/@nex:nexy7574.co.uk)
+    - [@ginger:gingershaped.computer](https://matrix.to/#/@ginger:gingershaped.computer)
+2. **Email the security team** at [security@continuwuity.org](mailto:security@continuwuity.org). This is not E2EE, so
+   don't include sensitive details.
+3. **Do not disclose the vulnerability publicly** until a fix has been pushed to the main branch.
 4. **Provide detailed information** about the vulnerability, including:
-   - A clear description of the issue
-   - Steps to reproduce
-   - Potential impact
-   - Any possible mitigations
-   - Version(s) affected, including specific commits if possible
+    - A clear description of the issue
+    - Steps to reproduce
+    - Potential impact
+    - Any possible mitigations
+    - Version(s) affected, including specific commits if possible
+    - How you want to be attributed if your report is accepted (website, social media handle, Matrix user ID, etc).
+      **Please state explicitly if you wish to remain anonymous.**

-If you have any doubts about a potential security vulnerability, contact us via private channels first! We'd prefer that you bother us, instead of having a vulnerability disclosed without a fix.
+If you have any doubts about a potential security vulnerability, contact us via private channels first! We'd prefer that
+you bother us, instead of having a vulnerability disclosed without a fix.

-### What to Expect
+### Terms for credit
+
+Before reporting a vulnerability, please remember that we are a small team maintaining a large codebase depended upon by
+a vast unknown number of users in our free time. While we always investigate *all* security reports, we may not
+acknowledge or credit your report under certain circumstances.
+
+#### Following the security policy
+
+If you do not report the vulnerability following this security policy, your report may be ignored and/or may not be
+credited if fixed. This includes filing for GitHub security advisories without contacting us directly first (we do not
+get notified about these!).
+
+#### Automation-assisted reports
+
+Reports assisted by automatic tooling such as LLMs MUST disclose such in the report.
+Assisted reports must also produce a working proof-of-concept (PoC) demonstrating the vulnerability against the latest
+release and/or main commit with no modifications to the codebase. This is to demonstrate that not only does
+the author understand the vulnerability that they are reporting, but also that the vulnerability is reproducible
+and not a false positive.
+
+#### Reports for known issues
+
+Reports for issues we are already aware of will only be credited if subsequent reporters provide new information.
+
+#### Audits and CVE farming
+
+Sweeping audits (vulnerability hunting) **must** be coordinated with the team first - receiving a rapsheet of new
+vulnerabilities is explicitly not helpful to us and only harms the project. If you are interested in performing a
+security audit, please contact us first to discuss the scope and methodology.
+
+Likewise, CVE farming (reporting vulnerabilities with the primary intent to get a CVE number) is actively harmful to the
+project, and will not be credited. Severe violations of this policy will result in a permanent ban from collaborating
+with the project in any capacity. We are attempting to build high quality free software, not flesh out your CV/resume.
+
+### What to expect

 When you report a security vulnerability:

-1. **Acknowledgment**: We will acknowledge receipt of your report.
-2. **Assessment**: We will assess the vulnerability and determine its impact on our users
-3. **Updates**: We will provide updates on our progress in addressing the vulnerability, and may request you help test mitigations
+1. **Acknowledgment**: We will acknowledge receipt of your report. We may ask for further information.
+2. **Triage**: The report will be triaged into our internal tracker, and you will be provided with a reference number (
+   in case you end up with multiple reports). An ETA for a fix will be provided if feasible.
+3. **Updates**: We will provide updates on our progress in addressing the vulnerability, including a heads-up for when
+   we plan to release a fix.
 4. **Resolution**: Once resolved, we will notify you and discuss coordinated disclosure
 5. **Credit**: We will recognize your contribution (unless you prefer to remain anonymous)

@@ -51,7 +94,8 @@ ## Security Update Process

 1. We will develop and test fixes in a private fork
 2. Security updates will be released as soon as possible
-3. Release notes will include information about the vulnerabilities, avoiding details that could facilitate exploitation where possible
+3. Release notes will include information about the vulnerabilities, avoiding details that could facilitate exploitation
+   where possible
 4. Critical security updates may be backported to the previous stable release

 ## Additional Resources
@@ -0,0 +1 @@
+Added support for the OAuth2 device authorization flow. Contributed by @ginger
@@ -0,0 +1 @@
+Fixed requests returning `500 Internal Server Error` when the header selected by `request_ip_source` is absent, duplicated, or malformed (for example Envoy omitting `X-Envoy-External-Address` on internal requests). The client IP now falls back to the connection peer address instead of failing the request. Contributed by @eleboucher
@@ -0,0 +1 @@
+Appservices are now properly able to create devices for E2EE.
@@ -0,0 +1 @@
+Resolve alias service by correct name for auto-join. Contributed by @eleboucher
@@ -0,0 +1 @@
+Fixed newly joined rooms failing to sync their full state (including the room name) to clients using legacy sync.
@@ -1 +0,0 @@
-Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.
@@ -0,0 +1 @@
+Fixed `roomuserid_lastnotificationread` being aliased to the highlight count table, which clobbered highlight counts when setting a read marker. Contributed by @eleboucher
@@ -0,0 +1 @@
+Fixed freshly left room failing to sync.
@@ -0,0 +1 @@
+Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
@@ -0,0 +1 @@
+Fetch the joined member count once per event instead of once per notified user.
@@ -1 +0,0 @@
-Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`.
@@ -1 +0,0 @@
-Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint.
@@ -0,0 +1 @@
+Fixed the deeplink redirect for deleting devices. Contributed by @koen
@@ -0,0 +1 @@
+Dehydrated devices are now visible in the account panel. Contributed by @ginger.
@@ -0,0 +1 @@
+Fix status code for oauth registration. Contributed by @n00byking
@@ -0,0 +1 @@
+Introduce `accepted_ip_sources` as a multiple options variant of `request_ip_source`, allowing for more advanced deployments and making fallbacks an explicit choice. Contributed by @Omar007
@@ -0,0 +1 @@
+Exempt m.room.create from auth_events check. Contributed by @eleboucher
@@ -0,0 +1 @@
+Fixed `create` being returned as a supported prompt value regardless of if registration is enabled or not. Contributed by @ginger
@@ -0,0 +1 @@
+Updated an out-of-date statement about Oracle Linux release cadences.
@@ -0,0 +1 @@
+Fixed high CPU usage when multiple clients from the same account were connected at once. Each sync woke the account's other sync loops, causing them to wake each other in a loop.
@@ -0,0 +1 @@
+Fixed MSC4190 appservice device creation registering a random device ID instead of the requested one (and dropping the requested display name), which prevented encrypted mautrix bridges from starting on OIDC-enabled servers and leaked an orphan device on the bridge bot per startup attempt.
@@ -0,0 +1 @@
+Deactivated users and appservice puppets are no longer counted by `/_continuwuity/local_user_count`. Contributed by @ginger.
@@ -0,0 +1 @@
+Added an admin command to issue an access token for a bot account, to allow legacy bots to function while legacy authentication is disabled.
@@ -0,0 +1 @@
+Re-introduced admin room registration alerts that were accidentally removed in the OAuth2 update.
@@ -0,0 +1 @@
+Fix joining restricted rooms over federation failing with signature verification error.
@@ -0,0 +1 @@
+Fixed the client space hierarchy endpoint returning a 500 "Space hierarchy is unreasonably large" error for cyclic space graphs (e.g. a space containing itself). Rooms are now deduplicated during traversal as required by the spec, and the traversal depth is bounded even when the client does not specify `max_depth`.
@@ -0,0 +1 @@
+Fixed simplified sliding sync holding account data for up to 30 seconds, which made encryption setup and cross-signing resets appear to hang.
@@ -0,0 +1 @@
+Fixed local invites and invite acceptances not being reflected in sync promptly. Contributed by @eleboucher
@@ -290,7 +290,7 @@
 #
 #ip_lookup_strategy = 5

-# The source to use for discovering the real connecting client IP.
+# The preferred source to use for getting the real client IP.
 #
 # Takes any of the following options:
 #
@@ -301,16 +301,47 @@
 # "true_client_ip" - `True-Client-Ip` header
 # "x_envoy_external_address" - `X-Envoy-External-Address` header
 # "x_real_ip" - `X-Real-Ip` header
+# "direct" - the directly connected IP address (fallback for other
+# options)
 #
 # Only set this if you are certain only your reverse proxy
 # will send the expected header. There is no "is the connecting IP allowed
 # to set this header" check; if the header selected is present, it is
 # used.
 #
-# Defaults to the IP address actually making the connection.
+# Ignored if `accepted_ip_sources` is set.
+#
+# If not set set, `direct` is used. Additionally, `direct` is used
+# as a fallback if the chosen header is not found.
 #
 #request_ip_source = false

+# The accepted source(s) for the real client IP.
+#
+# Takes any combination of the following options:
+#
+# "cf_connecting_ip" - `Cf-Connecting-Ip` header
+# "cloudfront_viewer_address" - `CloudFront-Viewer-Address` header
+# "fly_client_ip" - `Fly-Client-IP` header
+# "x_forwarded_for" - rightmost value of the `X-Forwarded-For` header
+# "true_client_ip" - `True-Client-Ip` header
+# "x_envoy_external_address" - `X-Envoy-External-Address` header
+# "x_real_ip" - `X-Real-Ip` header
+# "direct" - the directly connected IP address
+#
+# Only set this if you are certain only your reverse proxy
+# will send the expected header. There is no "is the connecting IP allowed
+# to set this header" check; if the header selected is present, it is
+# used.
+#
+# One of the configured sources must be available or the request is
+# rejected. If you want a fallback (including `direct`!), you have to
+# configure it. Priority is based on configuration order.
+#
+# If not set, `request_ip_source` configuration is used.
+#
+#accepted_ip_sources = []
+
 # Max request size for file uploads in bytes. Defaults to 20MB.
 # Also limits incoming federated media.
 #
@@ -50,7 +50,7 @@ EOF

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.20.1
+ENV BINSTALL_VERSION=1.21.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -18,7 +18,7 @@ RUN --mount=type=cache,target=/etc/apk/cache apk add \

 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.20.1
+ENV BINSTALL_VERSION=1.21.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree
@@ -15,8 +15,8 @@ ## Overview

 :::warning Oracle Linux support
 Due to upstream limitations, Terra is only usable on Oracle Linux if you use [upstream EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/)
-rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, as of the time of writing, 10.2 has been
-available for over a month through other ELs, but Oracle has not yet released corresponding updates—so you may encounter further compatibility issues with EPEL.
+rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, Oracle's release of 10.2 lagged
+approximately 1.5 months behind other ELs—so you may encounter further compatibility issues with EPEL.
 **For this reason, it is recommended that you use another EL distribution if at all possible.**
 :::

@@ -6,10 +6,10 @@
            "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
        },
        {
-            "id": 15,
+            "id": 16,
            "mention_room": true,
-            "date": "2026-07-10",
-            "message": "[Continuwuity 26.6.0](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.0) is finally out! This is by far our largest release yet, and it wouldn't have been possible without our community. Thank you so much for all of your patience, support, and/or development time over the last three months <3"
+            "date": "2026-07-13",
+            "message": "[Continuwuity 26.6.2](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release fixes a severe bug with OIDC that could cause users' accounts to be flagged as deactivated. If you use OIDC, please update as soon as possible."
        }
    ]
 }
@@ -3,11 +3,11 @@
    "advisory-db": {
      "flake": false,
      "locked": {
-        "lastModified": 1781566179,
-        "narHash": "sha256-Tqv8I586fYzWpEW/Smq/JqESFa3DVVzVWsnAMtvhy/I=",
+        "lastModified": 1783840254,
+        "narHash": "sha256-XjyvZk0f3YiinVHmkGOotmLBAzvK+LwEJYj2QqJ5pn8=",
        "owner": "rustsec",
        "repo": "advisory-db",
-        "rev": "74e084413d979d52d2f93b1d93b1ab7b9ee648f5",
+        "rev": "6e3286f4efa8c142fb33e5ea4342c8db6693cf34",
        "type": "github"
      },
      "original": {
@@ -18,11 +18,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1780532242,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
+        "lastModified": 1783203018,
+        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
+        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
        "type": "github"
      },
      "original": {
@@ -39,11 +39,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1781527054,
-        "narHash": "sha256-1fX9ev2Fh5QoKQ41G9dYutjo5j/jywu6tZse5Eb1Ck4=",
+        "lastModified": 1783844668,
+        "narHash": "sha256-3MOpw4y3reoErRLvFBDz0t9aG6FWXUj7leKvUns5eQA=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "8c2e51dffefc040a21975da7abf6f252c8c9b783",
+        "rev": "4e49ef62eedaa5c149d62b63b3f53844e1cc45d7",
        "type": "github"
      },
      "original": {
@@ -74,11 +74,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
        "type": "github"
      },
      "original": {
@@ -89,11 +89,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "lastModified": 1783776592,
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
        "type": "github"
      },
      "original": {
@@ -105,11 +105,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1777168982,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
        "type": "github"
      },
      "original": {
@@ -132,11 +132,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1781453968,
-        "narHash": "sha256-+V3nK4pCngbmgyVGXY6Kkrlevp4ocPkJJLf2aqwkDNA=",
+        "lastModified": 1783779020,
+        "narHash": "sha256-vpm418WZa9l1KUl6HRs+Ga+SIfE+D2/sV4olwTlilYc=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "cc272809a173c2c11d0e479d639c811c1eacf049",
+        "rev": "5be5e89cf0145d73a85c805726821b4adfc3af48",
        "type": "github"
      },
      "original": {
@@ -9,7 +9,7 @@
    {
      # basic nix shell containing all things necessary to build continuwuity in all flavors manually (on x86_64-linux)
      devShells.default =
-        ((inputs.crane.mkLib pkgs).overrideToolchain (pkgs: self'.packages.stable-toolchain)).devShell
+        ((inputs.crane.mkLib pkgs).overrideToolchain (pkgs: self'.packages.dev-toolchain)).devShell
          {
            packages = [
              self'.packages.rocksdb
@@ -12,7 +12,7 @@
        target:
        target.fromToolchainName {
          name = (lib.importTOML "${inputs.self}/rust-toolchain.toml").toolchain.channel;
-          sha256 = "sha256-OATSZm98Es5kIFuqaba+UvkQtFsVgJEBMmS+t6od5/U=";
+          sha256 = "sha256-A1abGIbOtcBSdrUMhDGrER3pRM1hQP4fp9gh3Y4PKc8=";
        };
    in
    {
@@ -27,9 +27,9 @@
          inherit stable-toolchain;

          dev-toolchain = fnx.combine [
-            stable-toolchain
            # use the nightly rustfmt because we use nightly features
            fnx.complete.rustfmt
+            stable-toolchain
          ];
        };
    };
@@ -419,9 +419,9 @@
      }
    },
    "node_modules/@rspress/core": {
-      "version": "2.0.17",
-      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.17.tgz",
-      "integrity": "sha512-oynYHE2aBj7BFzD/UgqKnrj/PyYxfWGrmRPlTmjLL22UPcocdUdFYLb/6nijyseAST59VMr5Gj4wOfFUeJT5vw==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.18.tgz",
+      "integrity": "sha512-DBpsr/6XAItQkZPL5FSjthLGuzdG9ks/7EOxkqaaXp93uAT54LO0PD5Dkoy6ydup1PnvkpHyiHpUyDcnHHTVhg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -429,7 +429,7 @@
        "@mdx-js/react": "^3.1.1",
        "@rsbuild/core": "^2.1.5",
        "@rsbuild/plugin-react": "~2.1.0",
-        "@rspress/shared": "2.0.17",
+        "@rspress/shared": "2.0.18",
        "@shikijs/rehype": "^4.2.0",
        "@types/unist": "^3.0.3",
        "@unhead/react": "^2.1.15",
@@ -472,9 +472,9 @@
      }
    },
    "node_modules/@rspress/plugin-client-redirects": {
-      "version": "2.0.17",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.17.tgz",
-      "integrity": "sha512-HJMlW5xsQe2cAFYNHw3LhMy8WcuqRb4l0ey3E3OIu121ymbSLqIQJVPS/IF/NuoyPoxCAmV58LYIaCxGEriUww==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.18.tgz",
+      "integrity": "sha512-q70ufN0S125kl0QlucO7JuiZ0WJaxFOtPPoGu7eWwam9fb+i4YsWnOWtAKSKGH4JP5+897mgpDPP+dmfl9DPCw==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -485,9 +485,9 @@
      }
    },
    "node_modules/@rspress/plugin-sitemap": {
-      "version": "2.0.17",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.17.tgz",
-      "integrity": "sha512-MpNxF+hFK7zsk8t+Ta7KYI/Py6Csjyw0AMGrWf3XG/kr0+fisVxbT/jUanXRLSoj2m9VX9CVsi180rPnezUpbQ==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.18.tgz",
+      "integrity": "sha512-XfaXzZx+ASN9OMTc0fOvW8QmbmyCyDWkO8xJj4XF4E0YJtsu7j/65+v8/KXXdwpywOfUIQ6M94/meRTy2urNmQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -498,9 +498,9 @@
      }
    },
    "node_modules/@rspress/shared": {
-      "version": "2.0.17",
-      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.17.tgz",
-      "integrity": "sha512-ZzpZ4hm5svgwU0w5CpTLZy4vFD3uPo8+gXtWMOREYMzwfzJeHqwOyXwxHf6byGpx85mVK5DQqMDi61meAS7ZUw==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.18.tgz",
+      "integrity": "sha512-GJswqJQCPSxvBt5r+gJzz8Em8EEK/sOmCQjTpemTvldvxr1Lva85BGVnSQZOgofnM0nrjt18kn4mmnuuSstbpA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -510,14 +510,14 @@
      }
    },
    "node_modules/@shikijs/core": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.2.0.tgz",
-      "integrity": "sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
+      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/primitive": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/primitive": "4.3.1",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4",
        "hast-util-to-html": "^9.0.5"
@@ -527,13 +527,13 @@
      }
    },
    "node_modules/@shikijs/engine-javascript": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.2.0.tgz",
-      "integrity": "sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
+      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "oniguruma-to-es": "^4.3.6"
      },
@@ -542,13 +542,13 @@
      }
    },
    "node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.2.0.tgz",
-      "integrity": "sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.3.1.tgz",
+      "integrity": "sha512-OXyNMzg0pews+msMj4cHeqT4xiYKKvbnn6VbdAXxfoFl3SSx4fJTc8FadECuc5/H9p3BzhNAoAUXKwAu9rWYhg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2"
      },
      "engines": {
@@ -556,26 +556,26 @@
      }
    },
    "node_modules/@shikijs/langs": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.2.0.tgz",
-      "integrity": "sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
+      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/primitive": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.2.0.tgz",
-      "integrity": "sha512-NOq+DtUkVBJtZMVXL5A0vI0Xk8nvDYaXetFHSJFlOqjDZIVhIPRYFdGkSoElDqNuegikcc3A76SNUa8dTqtAYA==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.3.1.tgz",
+      "integrity": "sha512-CXQRQOYy1leqQ8ceTeJdmXv/bsUY++6QyLpXJ94LZAAYj5X2SKRdc5ipguv4NPyGVKItB2PPwUpRNe0Sjh5S1A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -584,16 +584,16 @@
      }
    },
    "node_modules/@shikijs/rehype": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.2.0.tgz",
-      "integrity": "sha512-ST3EWye/dwF1gWskczJNBnwFtDzEQ9ceytXZtyc/GfwR5V0qJrkoSGZO55O3SAKDDsXkTDcsfwd9pVe7ROlAHg==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.3.1.tgz",
+      "integrity": "sha512-oshrlfUF3VPUJfnp5K1lLwsS/SRBKrIxONpdWebSKZXdBE3UsZnxgqpvRUA8UsofS7vmjFOCAHIT71ECbmOxTw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@types/hast": "^3.0.4",
        "hast-util-to-string": "^3.0.1",
-        "shiki": "4.2.0",
+        "shiki": "4.3.1",
        "unified": "^11.0.5",
        "unist-util-visit": "^5.1.0"
      },
@@ -602,22 +602,22 @@
      }
    },
    "node_modules/@shikijs/themes": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
-      "integrity": "sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
+      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/types": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -684,9 +684,9 @@
      }
    },
    "node_modules/@types/hast": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.4.tgz",
-      "integrity": "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==",
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
+      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -1076,9 +1076,9 @@
      }
    },
    "node_modules/@ungap/structured-clone": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
+      "integrity": "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==",
      "dev": true,
      "license": "ISC"
    },
@@ -3589,18 +3589,18 @@
      "license": "MIT"
    },
    "node_modules/shiki": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz",
-      "integrity": "sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.3.1.tgz",
+      "integrity": "sha512-oR+qDVi2OjX1tmDpyv+3KviX01KzO6Af+0NNnKnsp9491UEGz2YpxTuJboS/6VhYpTdqzmuJBuiTlrAWWJAssw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/core": "4.2.0",
-        "@shikijs/engine-javascript": "4.2.0",
-        "@shikijs/engine-oniguruma": "4.2.0",
-        "@shikijs/langs": "4.2.0",
-        "@shikijs/themes": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/core": "4.3.1",
+        "@shikijs/engine-javascript": "4.3.1",
+        "@shikijs/engine-oniguruma": "4.3.1",
+        "@shikijs/langs": "4.3.1",
+        "@shikijs/themes": "4.3.1",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -60,6 +60,13 @@
            "matchPackageNames": ["rust", "rustc", "cargo"],
            "groupName": "rust-toolchain"
        },
+        {
+            "description": "Delay major rust toolchain updates",
+            "matchManagers": ["custom.regex"],
+            "matchPackageNames": ["rust", "rustc", "cargo"],
+            "matchUpdateTypes": ["major"],
+            "minimumReleaseAge": "30 days"
+        },
        {
            "description": "Batch minor and patch GitHub Actions updates",
            "matchManagers": ["github-actions"],
@@ -10,7 +10,7 @@

 [toolchain]
 profile = "minimal"
-channel = "1.97.0"
+channel = "1.97.1"
 components = [
    # For rust-analyzer
    "rust-src",
@@ -486,7 +486,7 @@ pub(super) async fn get_remote_pdu(
 						.services
 						.rooms
 						.event_handler
-						.parse_incoming_pdu(&response.pdu)
+						.parse_incoming_pdu(&response.pdu, None)
 						.boxed()
 						.await;

@@ -832,7 +832,7 @@ pub(super) async fn force_set_room_state_from_server(
 				.services
 				.rooms
 				.event_handler
-				.parse_incoming_pdu(&pdu)
+				.parse_incoming_pdu(&pdu, Some(&room_version_rules))
 				.await
 			{
 				| Ok(t) => t,
@@ -1014,7 +1014,7 @@ pub(super) async fn resolve_true_destination(
 		let resolver: &MatrixResolver = if no_cache {
 			&MatrixResolverBuilder::new()
 				.dangerous_tls_accept_invalid_certs(self.services.server.config.allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure)
-				.http_client(self.services.client.default.clone())
+				.http_client(self.services.client.dns.clone())
 				.build()?
 		} else {
 			&self.services.client.matrix_resolver
@@ -54,7 +54,7 @@ pub(super) async fn fetch_support_well_known(&self, server_name: OwnedServerName
 		let response = self
 			.services
 			.client
-			.default
+			.external_resource
 			.get(format!("https://{server_name}/.well-known/matrix/support"))
 			.send()
 			.await?;
@@ -3,7 +3,7 @@
 use service::registration_tokens::TokenExpires;

 impl crate::Context<'_> {
-	pub(super) async fn issue_token(&self, expires: super::TokenExpires) -> Result {
+	pub(super) async fn issue_registration_token(&self, expires: super::TokenExpires) -> Result {
 		let expires = {
 			if expires.immortal {
 				None
@@ -10,7 +10,7 @@
 pub enum TokenCommand {
 	/// Issue a new registration token
 	#[clap(name = "issue")]
-	IssueToken {
+	IssueRegistrationToken {
 		/// When this token will expire.
 		#[command(flatten)]
 		expires: TokenExpires,
@@ -20,7 +20,7 @@
 		tag::{TagEvent, TagEventContent, TagInfo},
 	},
 };
-use service::users::{AccountStatus, HashedPassword};
+use service::users::{AccountStatus, DeviceToken, HashedPassword};

 use crate::{
 	get_room_info,
@@ -59,13 +59,42 @@ pub(super) async fn create_user(&self, username: String, password: Option<String

 		self.services
 			.users
-			.create_local_account(&user_id, Some(HashedPassword::new(password)?), None)
+			.create_local_account(
+				&user_id,
+				Some(HashedPassword::new(password)?),
+				None,
+				None,
+				None,
+			)
 			.await?;

 		self.write_str(&format!("Created user {user_id} with password `{password}`"))
 			.await
 	}

+	pub(super) async fn issue_access_token(&self, username: String, password: String) -> Result {
+		let user_id = parse_active_local_user_id(self.services, &username).await?;
+
+		let user_id = self
+			.services
+			.users
+			.check_password(&user_id, &password)
+			.await?;
+		let token = DeviceToken::new_random();
+
+		let device_id = self
+			.services
+			.users
+			.create_device(&user_id, None, Some(token.clone()), None, None)
+			.await?;
+
+		self.write_str(&format!(
+			"Created device `{device_id}` with access token `{}` for {user_id}",
+			token.into_token()
+		))
+		.await
+	}
+
 	pub(super) async fn deactivate(&self, no_leave_rooms: bool, user_id: String) -> Result {
 		// Validate user id
 		let user_id = parse_local_user_id(self.services, &user_id)?;
@@ -102,7 +131,6 @@ pub(super) async fn deactivate(&self, no_leave_rooms: bool, user_id: String) ->
 	}

 	pub(super) async fn suspend(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;

 		if user_id == self.services.globals.server_user {
@@ -123,7 +151,6 @@ pub(super) async fn suspend(&self, user_id: String) -> Result {
 	}

 	pub(super) async fn unsuspend(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;

 		if user_id == self.services.globals.server_user {
@@ -935,7 +962,6 @@ pub(super) async fn force_leave_remote_room(
 	}

 	pub(super) async fn lock(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;

 		if user_id == self.services.globals.server_user {
@@ -956,7 +982,6 @@ pub(super) async fn lock(&self, user_id: String) -> Result {
 	}

 	pub(super) async fn unlock(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;

 		self.services.users.unlock_account(&user_id).await;
@@ -966,7 +991,6 @@ pub(super) async fn unlock(&self, user_id: String) -> Result {
 	}

 	pub(super) async fn logout(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;

 		if user_id == self.services.globals.server_user {
@@ -992,7 +1016,6 @@ pub(super) async fn logout(&self, user_id: String) -> Result {
 	}

 	pub(super) async fn disable_login(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;

 		if user_id == self.services.globals.server_user {
@@ -1011,7 +1034,6 @@ pub(super) async fn disable_login(&self, user_id: String) -> Result {
 	}

 	pub(super) async fn enable_login(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;

 		self.services.users.enable_login(&user_id);
@@ -1020,7 +1042,6 @@ pub(super) async fn enable_login(&self, user_id: String) -> Result {
 	}

 	pub(super) async fn get_email(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_local_user_id(self.services, &user_id)?;

 		match self
@@ -1039,8 +1060,6 @@ pub(super) async fn get_email(&self, user_id: String) -> Result {
 	}

 	pub(super) async fn get_user_by_email(&self, email: String) -> Result {
-		self.bail_restricted()?;
-
 		let Ok(email) = Address::try_from(email) else {
 			return Err!("Invalid email address.");
 		};
@@ -1063,8 +1082,6 @@ pub(super) async fn get_user_by_email(&self, email: String) -> Result {
 	}

 	pub(super) async fn change_email(&self, user_id: String, email: Option<String>) -> Result {
-		self.bail_restricted()?;
-
 		let user_id = parse_local_user_id(self.services, &user_id)?;
 		let Ok(new_email) = email.map(Address::try_from).transpose() else {
 			return Err!("Invalid email address.");
@@ -18,6 +18,15 @@ pub enum UserCommand {
 		password: Option<String>,
 	},

+	/// Issue an access token for a user. This command will not work on
+	/// shadow users, such as appservice puppets or accounts imported from
+	/// an identity provider.
+	#[clap(name = "issue-token")]
+	IssueAccessToken {
+		username: String,
+		password: String,
+	},
+
 	/// Reset user password
 	ResetPassword {
 		/// Log out existing sessions
@@ -64,11 +64,11 @@ zstd_compression = [

 [dependencies]
 async-trait.workspace = true
-axum-client-ip.workspace = true
 axum-extra.workspace = true
 axum.workspace = true
 base64.workspace = true
 bytes.workspace = true
+client-ip.workspace = true
 conduwuit-core.workspace = true
 conduwuit-macros.workspace = true
 conduwuit-service.workspace = true
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err, info,
 	pdu::PartialPdu,
@@ -26,7 +25,6 @@
 };
 use service::{mailer::messages, uiaa::UiaaInitiator, users::HashedPassword};

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::{Ruma, router::ClientIdentity};

 pub(crate) mod register;
@@ -43,10 +41,9 @@
 ///
 /// Note: This will not reserve the username, so the username might become
 /// invalid when trying to register
-#[tracing::instrument(skip_all, fields(%client), name = "register_available", level = "info")]
+#[tracing::instrument(skip_all, name = "register_available", level = "info")]
 pub(crate) async fn get_register_available_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_username_availability::v3::Request>,
 ) -> Result<get_username_availability::v3::Response> {
 	let _ = services
@@ -80,10 +77,9 @@ pub(crate) async fn get_register_available_route(
 ///   last seen ts)
 /// - Forgets to-device events
 /// - Triggers device list updates
-#[tracing::instrument(skip_all, fields(%client), name = "change_password", level = "info")]
+#[tracing::instrument(skip_all, name = "change_password", level = "info")]
 pub(crate) async fn change_password_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<change_password::v3::Request>,
 ) -> Result<change_password::v3::Response> {
 	let identity = if let Some(identity) = body.identity.as_ref() {
@@ -248,10 +244,9 @@ pub(crate) async fn whoami_route(
 /// - Forgets all to-device events
 /// - Triggers device list updates
 /// - Removes ability to log in again
-#[tracing::instrument(skip_all, fields(%client), name = "deactivate", level = "info")]
+#[tracing::instrument(skip_all, name = "deactivate", level = "info")]
 pub(crate) async fn deactivate_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<deactivate::v3::Request>,
 ) -> Result<deactivate::v3::Response> {
 	// Authentication for this endpoint is technically optional,
@@ -1,11 +1,7 @@
 use std::collections::HashMap;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
-use conduwuit::{
-	Err, Result, debug_info, info,
-	utils::{self},
-};
+use conduwuit::{Err, Result, debug_info, info};
 use conduwuit_service::Services;
 use futures::StreamExt;
 use lettre::{Address, message::Mailbox};
@@ -20,10 +16,12 @@
 	assign,
 };
 use serde_json::value::RawValue;
-use service::{mailer::messages, users::HashedPassword};
+use service::{
+	mailer::messages,
+	users::{DeviceToken, HashedPassword},
+};

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/client/v3/register`
 ///
@@ -33,10 +31,10 @@
 /// /_matrix/client/v3/register/available`](fn.get_register_available_route.
 /// html) to check if the user id is valid and available.
 #[allow(clippy::doc_markdown)]
-#[tracing::instrument(skip_all, fields(%client), name = "register", level = "info")]
+#[tracing::instrument(skip_all, name = "register", level = "info")]
 pub(crate) async fn register_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for metadata.
 	body: Ruma<register::v3::Request>,
 ) -> Result<register::v3::Response> {
 	if body.kind != RegistrationKind::User {
@@ -97,7 +95,13 @@ pub(crate) async fn register_route(

 		services
 			.users
-			.create_local_account(&user_id, Some(password), identity.email)
+			.create_local_account(
+				&user_id,
+				Some(password),
+				identity.email,
+				Some(&client),
+				body.initial_device_display_name.as_deref(),
+			)
 			.await?;

 		user_id
@@ -112,27 +116,21 @@ pub(crate) async fn register_route(
 			)));
 		}

-		// Generate new device id if the user didn't specify one
-		let device_id = body
-			.device_id
-			.clone()
-			.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
-
 		// Generate new token for the device
-		let new_token = utils::random_string(TOKEN_LENGTH);
+		let new_token = DeviceToken::new_random();

 		// Create device for this account
-		services
+		let device_id = services
 			.users
 			.create_device(
 				&user_id,
-				&device_id,
-				&new_token,
-				None,
+				body.device_id.clone(),
+				Some(new_token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
 			.await?;
+
 		(Some(new_token), Some(device_id))
 	} else {
 		// Don't create a device for inhibited logins
@@ -142,7 +140,7 @@ pub(crate) async fn register_route(
 	debug_info!(%user_id, ?device, "New account created via legacy registration");

 	Ok(assign!(register::v3::Response::new(user_id), {
-		access_token: token,
+		access_token: token.map(DeviceToken::into_token),
 		device_id: device,
 		refresh_token: None,
 		expires_in: None,
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, at};
 use futures::StreamExt;
 use ruma::{
@@ -19,10 +18,9 @@
 /// # `PUT /_matrix/client/../dehydrated_device`
 ///
 /// Creates or overwrites the user's dehydrated device.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn put_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<put_dehydrated_device::Request>,
 ) -> Result<put_dehydrated_device::Response> {
 	let device_id = body.device_id.clone();
@@ -38,10 +36,9 @@ pub(crate) async fn put_dehydrated_device_route(
 /// # `DELETE /_matrix/client/../dehydrated_device`
 ///
 /// Deletes the user's dehydrated device without replacement.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn delete_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<delete_dehydrated_device::Request>,
 ) -> Result<delete_dehydrated_device::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -56,10 +53,9 @@ pub(crate) async fn delete_dehydrated_device_route(
 /// # `GET /_matrix/client/../dehydrated_device`
 ///
 /// Gets the user's dehydrated device
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn get_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_dehydrated_device::Request>,
 ) -> Result<get_dehydrated_device::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -72,10 +68,9 @@ pub(crate) async fn get_dehydrated_device_route(
 /// # `GET /_matrix/client/../dehydrated_device/{device_id}/events`
 ///
 /// Paginates the events of the dehydrated device.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn get_dehydrated_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_events::Request>,
 ) -> Result<get_events::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,15 +1,14 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
-use conduwuit::{Err, Result, debug, err, utils};
+use conduwuit::{Err, Result, debug, err};
 use futures::StreamExt;
 use ruma::{
-	MilliSecondsSinceUnixEpoch, OwnedDeviceId,
+	MilliSecondsSinceUnixEpoch,
 	api::client::device::{
 		self, delete_device, delete_devices, get_device, get_devices, update_device,
 	},
 };

-use crate::{Ruma, client::DEVICE_ID_LENGTH};
+use crate::{Ruma, client_ip::ClientIp};

 /// # `GET /_matrix/client/r0/devices`
 ///
@@ -46,10 +45,10 @@ pub(crate) async fn get_device_route(
 /// # `PUT /_matrix/client/r0/devices/{deviceId}`
 ///
 /// Updates the metadata on a given device of the sender user.
-#[tracing::instrument(skip_all, fields(%client), name = "update_device", level = "debug")]
+#[tracing::instrument(skip_all, name = "update_device", level = "debug")]
 pub(crate) async fn update_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<update_device::v3::Request>,
 ) -> Result<update_device::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -85,16 +84,13 @@ pub(crate) async fn update_device_route(
 				appservice.registration.id
 			);

-			let device_id = OwnedDeviceId::from(utils::random_string(DEVICE_ID_LENGTH));
-
 			services
 				.users
 				.create_device(
 					sender_user,
-					&device_id,
-					&appservice.registration.as_token,
-					None,
+					Some(body.device_id.clone()),
 					None,
+					body.display_name.clone(),
 					Some(client.to_string()),
 				)
 				.await?;
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err, info,
 	utils::{
@@ -35,10 +34,9 @@
 /// Lists the public rooms on this server.
 ///
 /// - Rooms are ordered by the number of joined members
-#[tracing::instrument(skip_all, fields(%client), name = "publicrooms", level = "info")]
+#[tracing::instrument(skip_all, name = "publicrooms", level = "info")]
 pub(crate) async fn get_public_rooms_filtered_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_public_rooms_filtered::v3::Request>,
 ) -> Result<get_public_rooms_filtered::v3::Response> {
 	if let Some(server) = &body.server {
@@ -71,10 +69,9 @@ pub(crate) async fn get_public_rooms_filtered_route(
 /// Lists the public rooms on this server.
 ///
 /// - Rooms are ordered by the number of joined members
-#[tracing::instrument(skip_all, fields(%client), name = "publicrooms", level = "info")]
+#[tracing::instrument(skip_all, name = "publicrooms", level = "info")]
 pub(crate) async fn get_public_rooms_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_public_rooms::v3::Request>,
 ) -> Result<get_public_rooms::v3::Response> {
 	if let Some(server) = &body.server {
@@ -106,10 +103,9 @@ pub(crate) async fn get_public_rooms_route(
 /// # `PUT /_matrix/client/r0/directory/list/room/{roomId}`
 ///
 /// Sets the visibility of a given room in the room directory.
-#[tracing::instrument(skip_all, fields(%client), name = "room_directory", level = "info")]
+#[tracing::instrument(skip_all, name = "room_directory", level = "info")]
 pub(crate) async fn set_room_visibility_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<set_room_visibility::v3::Request>,
 ) -> Result<set_room_visibility::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,7 +1,6 @@
 use std::time::Duration;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err,
 	utils::{self, content_disposition::make_content_disposition, math::ruma_from_usize},
@@ -42,15 +41,8 @@ pub(crate) async fn get_media_config_route(
 ///
 /// - Some metadata will be saved in the database
 /// - Media will be saved in the media/ directory
-#[tracing::instrument(
-	name = "media_upload",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn create_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<create_content::v3::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -81,15 +73,8 @@ pub(crate) async fn create_content_route(
 /// # `GET /_matrix/client/v1/media/thumbnail/{serverName}/{mediaId}`
 ///
 /// Load media thumbnail from our server or over federation.
-#[tracing::instrument(
-	name = "media_thumbnail_get",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_thumbnail_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v1::Request>,
 ) -> Result<get_content_thumbnail::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -131,15 +116,8 @@ pub(crate) async fn get_content_thumbnail_route(
 /// # `GET /_matrix/client/v1/media/download/{serverName}/{mediaId}`
 ///
 /// Load media from our server or over federation.
-#[tracing::instrument(
-	name = "media_get",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v1::Request>,
 ) -> Result<get_content::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -178,15 +156,8 @@ pub(crate) async fn get_content_route(
 /// # `GET /_matrix/client/v1/media/download/{serverName}/{mediaId}/{fileName}`
 ///
 /// Load media from our server or over federation as fileName.
-#[tracing::instrument(
-	name = "media_get_af",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_as_filename_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v1::Request>,
 ) -> Result<get_content_as_filename::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -229,15 +200,8 @@ pub(crate) async fn get_content_as_filename_route(
 /// # `GET /_matrix/client/v1/media/preview_url`
 ///
 /// Returns URL preview.
-#[tracing::instrument(
-	name = "url_preview",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_media_preview_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v1::Request>,
 ) -> Result<get_media_preview::v1::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,7 +1,6 @@
 #![allow(deprecated)]

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err,
 	utils::{content_disposition::make_content_disposition, math::ruma_from_usize},
@@ -50,10 +49,8 @@ pub(crate) async fn get_media_config_legacy_legacy_route(
 /// # `GET /_matrix/media/v3/preview_url`
 ///
 /// Returns URL preview.
-#[tracing::instrument(skip_all, fields(%client), name = "url_preview_legacy", level = "debug")]
 pub(crate) async fn get_media_preview_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<get_media_preview::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -95,10 +92,9 @@ pub(crate) async fn get_media_preview_legacy_route(
 /// Returns URL preview.
 pub(crate) async fn get_media_preview_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<RumaResponse<get_media_preview::v3::Response>> {
-	get_media_preview_legacy_route(State(services), ClientIp(client), body)
+	get_media_preview_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -115,10 +111,9 @@ pub(crate) async fn get_media_preview_legacy_legacy_route(
 /// - Media will be saved in the media/ directory
 pub(crate) async fn create_content_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<RumaResponse<create_content::v3::Response>> {
-	create_content_route(State(services), ClientIp(client), body)
+	create_content_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -131,10 +126,8 @@ pub(crate) async fn create_content_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v3::Request>,
 ) -> Result<get_content::v3::Response> {
 	let mxc = Mxc {
@@ -209,13 +202,11 @@ pub(crate) async fn get_content_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v3::Request>,
 ) -> Result<RumaResponse<get_content::v3::Response>> {
-	get_content_legacy_route(State(services), ClientIp(client), body)
+	get_content_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -228,10 +219,8 @@ pub(crate) async fn get_content_legacy_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_as_filename_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v3::Request>,
 ) -> Result<get_content_as_filename::v3::Response> {
 	let mxc = Mxc {
@@ -307,10 +296,9 @@ pub(crate) async fn get_content_as_filename_legacy_route(
 ///   seconds
 pub(crate) async fn get_content_as_filename_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v3::Request>,
 ) -> Result<RumaResponse<get_content_as_filename::v3::Response>> {
-	get_content_as_filename_legacy_route(State(services), ClientIp(client), body)
+	get_content_as_filename_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -323,10 +311,8 @@ pub(crate) async fn get_content_as_filename_legacy_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_thumbnail_get_legacy", level = "debug")]
 pub(crate) async fn get_content_thumbnail_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v3::Request>,
 ) -> Result<get_content_thumbnail::v3::Response> {
 	let mxc = Mxc {
@@ -404,10 +390,9 @@ pub(crate) async fn get_content_thumbnail_legacy_route(
 ///   seconds
 pub(crate) async fn get_content_thumbnail_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v3::Request>,
 ) -> Result<RumaResponse<get_content_thumbnail::v3::Response>> {
-	get_content_thumbnail_legacy_route(State(services), ClientIp(client), body)
+	get_content_thumbnail_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -1,9 +1,8 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug_error, err, info,
 	matrix::{event::gen_event_id_canonical_json, pdu::PartialPdu},
-	warn,
+	trace, warn,
 };
 use futures::FutureExt;
 use ruma::{
@@ -23,10 +22,9 @@
 /// # `POST /_matrix/client/r0/rooms/{roomId}/invite`
 ///
 /// Tries to send an invite event into the room.
-#[tracing::instrument(skip_all, fields(%client), name = "invite", level = "info")]
+#[tracing::instrument(skip_all, name = "invite", level = "info")]
 pub(crate) async fn invite_user_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<invite_user::v3::Request>,
 ) -> Result<invite_user::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -42,14 +40,8 @@ pub(crate) async fn invite_user_route(
 		return Err!(Request(Forbidden("Invites are not allowed on this server.")));
 	}

-	banned_room_check(
-		&services,
-		sender_user,
-		Some(&body.room_id),
-		body.room_id.server_name(),
-		client,
-	)
-	.await?;
+	banned_room_check(&services, sender_user, Some(&body.room_id), body.room_id.server_name())
+		.await?;

 	match &body.recipient {
 		| invite_user::v3::InvitationRecipient::UserId(InviteUserId {
@@ -166,7 +158,7 @@ pub(crate) async fn invite_helper(
 			let invite_room_state = services
 				.rooms
 				.state
-				.summary_stripped(&pdu, room_id, recipient_user)
+				.summary_stripped(&pdu, room_id, recipient_user, true)
 				.await;

 			drop(state_lock);
@@ -193,6 +185,7 @@ pub(crate) async fn invite_helper(
 			.await
 			.ok();

+		trace!(?request, "Sending invite");
 		let response = services
 			.sending
 			.send_federation_request(recipient_user.server_name(), request)
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug,
 	result::FlatOk,
@@ -22,10 +21,9 @@
 ///   rules locally
 /// - If the server does not know about the room: asks other servers over
 ///   federation
-#[tracing::instrument(skip_all, fields(%client), name = "join", level = "info")]
+#[tracing::instrument(skip_all, name = "join", level = "info")]
 pub(crate) async fn join_room_by_id_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<join_room_by_id::v3::Request>,
 ) -> Result<join_room_by_id::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -33,14 +31,8 @@ pub(crate) async fn join_room_by_id_route(
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}

-	banned_room_check(
-		&services,
-		sender_user,
-		Some(&body.room_id),
-		body.room_id.server_name(),
-		client,
-	)
-	.await?;
+	banned_room_check(&services, sender_user, Some(&body.room_id), body.room_id.server_name())
+		.await?;

 	// There is no body.server_name for /roomId/join
 	let mut servers: Vec<_> = services
@@ -91,10 +83,9 @@ pub(crate) async fn join_room_by_id_route(
 /// - If the server does not know about the room: use the server name query
 ///   param if specified. if not specified, asks other servers over federation
 ///   via room alias server name and room ID server name
-#[tracing::instrument(skip_all, fields(%client), name = "join", level = "info")]
+#[tracing::instrument(skip_all, name = "join", level = "info")]
 pub(crate) async fn join_room_by_id_or_alias_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<join_room_by_id_or_alias::v3::Request>,
 ) -> Result<join_room_by_id_or_alias::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -105,15 +96,9 @@ pub(crate) async fn join_room_by_id_or_alias_route(

 	let (servers, room_id) = match OwnedRoomId::try_from(body.room_id_or_alias.clone()) {
 		| Ok(room_id) => {
-			banned_room_check(
-				&services,
-				sender_user,
-				Some(&room_id),
-				room_id.server_name(),
-				client,
-			)
-			.boxed()
-			.await?;
+			banned_room_check(&services, sender_user, Some(&room_id), room_id.server_name())
+				.boxed()
+				.await?;

 			let mut servers = body.via.clone();
 			if servers.is_empty() {
@@ -159,7 +144,6 @@ pub(crate) async fn join_room_by_id_or_alias_route(
 				sender_user,
 				Some(&room_id),
 				Some(room_alias.server_name()),
-				client,
 			)
 			.await?;

@@ -1,7 +1,6 @@
 use std::{borrow::Borrow, collections::HashMap, iter::once, sync::Arc};

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug, debug_info, debug_warn, err, info,
 	matrix::{
@@ -45,10 +44,9 @@
 /// # `POST /_matrix/client/*/knock/{roomIdOrAlias}`
 ///
 /// Tries to knock the room to ask permission to join for the sender user.
-#[tracing::instrument(skip_all, fields(%client), name = "knock", level = "info")]
+#[tracing::instrument(skip_all, name = "knock", level = "info")]
 pub(crate) async fn knock_room_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<knock_room::v3::Request>,
 ) -> Result<knock_room::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -59,14 +57,8 @@ pub(crate) async fn knock_room_route(

 	let (servers, room_id) = match OwnedRoomId::try_from(body.room_id_or_alias.clone()) {
 		| Ok(room_id) => {
-			banned_room_check(
-				&services,
-				sender_user,
-				Some(&room_id),
-				room_id.server_name(),
-				client,
-			)
-			.await?;
+			banned_room_check(&services, sender_user, Some(&room_id), room_id.server_name())
+				.await?;

 			let mut servers = body.via.clone();
 			servers.extend(
@@ -109,7 +101,6 @@ pub(crate) async fn knock_room_route(
 				sender_user,
 				Some(&room_id),
 				Some(room_alias.server_name()),
-				client,
 			)
 			.await?;

@@ -8,8 +8,6 @@
 mod members;
 mod unban;

-use std::net::IpAddr;
-
 use axum::extract::State;
 use conduwuit::{Err, Result, warn};
 use futures::{FutureExt, StreamExt};
@@ -58,7 +56,6 @@ pub(crate) async fn banned_room_check(
 	user_id: &UserId,
 	room_id: Option<&RoomId>,
 	server_name: Option<&ServerName>,
-	client_ip: IpAddr,
 ) -> Result {
 	if services.users.is_admin(user_id).await {
 		return Ok(());
@@ -85,7 +82,7 @@ pub(crate) async fn banned_room_check(
 						.admin
 						.send_text(&format!(
 							"Automatically deactivating user {user_id} due to attempted banned \
-							 room join from IP {client_ip}"
+							 room join"
 						))
 						.await;
 				}
@@ -121,7 +118,7 @@ pub(crate) async fn banned_room_check(
 						.admin
 						.send_text(&format!(
 							"Automatically deactivating user {user_id} due to attempted banned \
-							 room join from IP {client_ip}"
+							 room join"
 						))
 						.await;
 				}
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Error, Result, at, debug_warn,
 	matrix::{
@@ -38,7 +37,7 @@
 };
 use ruminuwuity::invite_permission_config::FilterLevel;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// list of safe and common non-state events to ignore if the user is ignored
 const IGNORED_MESSAGE_TYPES: &[TimelineEventType] = &[
@@ -72,7 +71,7 @@
 ///   where the user was joined, depending on `history_visibility`)
 pub(crate) async fn get_message_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<get_message_events::v3::Request>,
 ) -> Result<get_message_events::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -90,8 +90,5 @@
 pub(super) use voip::*;
 pub(super) use well_known::*;

-/// generated device ID length
-const DEVICE_ID_LENGTH: usize = 10;
-
 /// generated user access token length
 const TOKEN_LENGTH: usize = 32;
@@ -0,0 +1,13 @@
+use axum::{Form, Json, extract::State, response::IntoResponse};
+use http::StatusCode;
+use service::oauth::grant::DeviceCodeRequest;
+
+pub(crate) async fn device_authorization_route(
+	State(services): State<crate::State>,
+	Form(request): Form<DeviceCodeRequest>,
+) -> impl IntoResponse {
+	match services.oauth.request_device_code(request).await {
+		| Ok(response) => Ok(Json(response)),
+		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
+	}
+}
@@ -10,6 +10,7 @@
 use serde_json::json;
 pub(crate) use server_metadata::*;

+mod device;
 mod register_client;
 mod server_metadata;
 mod token;
@@ -20,6 +21,7 @@
 const CLIENT_REGISTER_PATH: &str = "client/register";
 const TOKEN_REVOKE_PATH: &str = "client/revoke";
 const TOKEN_PATH: &str = "grant/token";
+const DEVICE_AUTHORIZATION_PATH: &str = "device";
 const ACCOUNT_MANAGEMENT_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/account/deeplink");

 pub(crate) fn router(state: crate::State) -> Router<crate::State> {
@@ -53,4 +55,5 @@ fn oauth_router() -> Router<crate::State> {
 		.route(concat!("/", JWKS_URI_PATH), get(async || Json(json!({"keys": []}))))
 		.route(concat!("/", TOKEN_PATH), post(token::token_route))
 		.route(concat!("/", TOKEN_REVOKE_PATH), post(token::revoke_token_route))
+		.route(concat!("/", DEVICE_AUTHORIZATION_PATH), post(device::device_authorization_route))
 }
@@ -24,5 +24,5 @@ pub(crate) async fn register_client_route(
 		.await
 		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;

-	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
+	Ok((StatusCode::CREATED, Json(RegisteredClient { client_id, metadata })).into_response())
 }
@@ -12,8 +12,8 @@
 use crate::{
 	Ruma,
 	client::oauth::{
-		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, JWKS_URI_PATH, TOKEN_PATH,
-		TOKEN_REVOKE_PATH,
+		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, DEVICE_AUTHORIZATION_PATH,
+		JWKS_URI_PATH, TOKEN_PATH, TOKEN_REVOKE_PATH,
 	},
 };

@@ -37,6 +37,17 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		.join(super::BASE_PATH)
 		.unwrap();

+	let prompt_values_supported = if services
+		.uiaa
+		.registration_flow_status()
+		.await
+		.any_available()
+	{
+		json!(["create"])
+	} else {
+		json!([])
+	};
+
 	json!({
 		"account_management_uri": endpoint_base.join(ACCOUNT_MANAGEMENT_PATH).unwrap(),
 		"account_management_actions_supported": [
@@ -49,10 +60,11 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		],
 		"authorization_endpoint": endpoint_base.join(AUTH_CODE_PATH).unwrap(),
 		"code_challenge_methods_supported": ["S256"],
-		"grant_types_supported": ["authorization_code", "refresh_token"],
+		"device_authorization_endpoint": endpoint_base.join(DEVICE_AUTHORIZATION_PATH).unwrap(),
+		"grant_types_supported": ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
 		"issuer": services.config.get_client_domain(),
 		"jwks_uri": endpoint_base.join(JWKS_URI_PATH).unwrap(),
-		"prompt_values_supported": ["create"],
+		"prompt_values_supported": prompt_values_supported,
 		"registration_endpoint": endpoint_base.join(CLIENT_REGISTER_PATH).unwrap(),
 		"response_modes_supported": ["query", "fragment"],
 		"response_types_supported": ["code"],
@@ -1,7 +1,6 @@
 use std::collections::BTreeMap;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, PduCount, Result, err};
 use ruma::{
 	MilliSecondsSinceUnixEpoch,
@@ -13,7 +12,7 @@
 	},
 };

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/client/r0/rooms/{roomId}/read_markers`
 ///
@@ -117,7 +116,7 @@ pub(crate) async fn set_read_marker_route(
 /// Sets private read marker and public read receipt EDU.
 pub(crate) async fn create_receipt_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<create_receipt::v3::Request>,
 ) -> Result<create_receipt::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,11 +1,10 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, matrix::pdu::PartialPdu};
 use ruma::{
 	api::client::redact::redact_event, assign, events::room::redaction::RoomRedactionEventContent,
 };

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `PUT /_matrix/client/r0/rooms/{roomId}/redact/{eventId}/{txnId}`
 ///
@@ -14,7 +13,7 @@
 /// - TODO: Handle txn id
 pub(crate) async fn redact_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: required for updating device metadata
 	body: Ruma<redact_event::v3::Request>,
 ) -> Result<redact_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,7 +1,6 @@
 use std::{fmt::Write as _, time::Duration};

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Event, Result, debug_info, info, matrix::pdu::PduEvent, utils::ReadyExt};
 use conduwuit_service::Services;
 use ruma::{
@@ -30,10 +29,9 @@ struct Report {
 /// # `POST /_matrix/client/v3/rooms/{roomId}/report`
 ///
 /// Reports an abusive room to homeserver admins
-#[tracing::instrument(skip_all, fields(%client), name = "report_room", level = "info")]
+#[tracing::instrument(skip_all, name = "report_room", level = "info")]
 pub(crate) async fn report_room_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_room::v3::Request>,
 ) -> Result<report_room::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -85,10 +83,9 @@ pub(crate) async fn report_room_route(
 /// # `POST /_matrix/client/v3/rooms/{roomId}/report/{eventId}`
 ///
 /// Reports an inappropriate event to homeserver admins
-#[tracing::instrument(skip_all, fields(%client), name = "report_event", level = "info")]
+#[tracing::instrument(skip_all, name = "report_event", level = "info")]
 pub(crate) async fn report_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_content::v3::Request>,
 ) -> Result<report_content::v3::Response> {
 	// user authentication
@@ -129,10 +126,9 @@ pub(crate) async fn report_event_route(
 	Ok(report_content::v3::Response::new())
 }

-#[tracing::instrument(skip_all, fields(%client), name = "report_user", level = "info")]
+#[tracing::instrument(skip_all, name = "report_user", level = "info")]
 pub(crate) async fn report_user_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_user::v3::Request>,
 ) -> Result<report_user::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -2,7 +2,7 @@

 use axum::extract::State;
 use conduwuit::{
-	Err, Result, debug, debug_info, err, info,
+	Err, Error, Result, debug, debug_info, err, info,
 	matrix::{StateKey, pdu::PartialPdu},
 	trace, warn,
 };
@@ -11,10 +11,13 @@
 use ruma::{
 	CanonicalJsonObject, CanonicalJsonValue, Int, MilliSecondsSinceUnixEpoch, OwnedRoomAliasId,
 	OwnedUserId, RoomAliasId, RoomId, RoomVersionId, UserId,
-	api::client::room::{self, create_room},
+	api::{
+		client::room::{self, create_room},
+		error::ErrorKind::Forbidden,
+	},
 	assign,
 	events::{
-		TimelineEventType,
+		AnyStateEventContent, StateEventType, TimelineEventType,
 		room::{
 			canonical_alias::RoomCanonicalAliasEventContent,
 			create::RoomCreateEventContent,
@@ -512,30 +515,42 @@ pub(crate) async fn create_room_route(

 	// 7. Events listed in initial_state
 	for event in &body.initial_state {
-		let mut partial_pdu = event
-			.deserialize_as_unchecked::<PartialPdu>()
-			.map_err(|e| {
-				err!(Request(InvalidParam(warn!("Invalid initial state event: {e:?}"))))
+		let event_type: StateEventType = event.get_field("type")?.ok_or_else(|| {
+			err!(Request(InvalidParam(warn!(
+				r#"Invalid initial state event: missing "type" field "#
+			))))
+		})?;
+
+		let content: Raw<AnyStateEventContent> =
+			event.get_field("content")?.ok_or_else(|| {
+				err!(Request(InvalidParam(warn!(
+					r#"Invalid initial state event: missing "content" field "#
+				))))
 			})?;

-		debug_info!("Room creation initial state event: {event:?}");
+		let state_key: String = event.get_field("state_key")?.unwrap_or_default();

-		// Implicit state key defaults to ""
-		partial_pdu.state_key.get_or_insert_with(StateKey::new);
-
-		// Silently skip encryption events if they are not allowed
-		if partial_pdu.event_type == TimelineEventType::RoomEncryption
-			&& !services.config.allow_encryption
-		{
-			continue;
-		}
-
-		services
+		match services
 			.rooms
 			.timeline
-			.build_and_append_pdu(partial_pdu, sender_user, Some(&room_id), &state_lock)
+			.send_state_event_for_key(
+				sender_user,
+				&room_id,
+				&state_lock,
+				&event_type,
+				&content,
+				&state_key,
+				None,
+			)
 			.boxed()
-			.await?;
+			.await
+		{
+			| Err(Error::Request(Forbidden, ..)) => {
+				// Silently skip forbidden events
+				continue;
+			},
+			| r => r,
+		}?;
 	}

 	// 8. Events implied by name and topic
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result};
 use ruma::api::client::room::get_summary;
 use service::rooms::summary::Accessibility;
@@ -9,10 +8,9 @@
 /// # `GET /_matrix/client/v1/room_summary/{roomIdOrAlias}`
 ///
 /// Returns a short description of the state of a room.
-#[tracing::instrument(skip_all, fields(%client), name = "room_summary", level = "info")]
+#[tracing::instrument(skip_all, name = "room_summary", level = "info")]
 pub(crate) async fn get_room_summary(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_summary::v1::Request>,
 ) -> Result<get_summary::v1::Response> {
 	let (room_id, servers) = services
@@ -1,12 +1,11 @@
 use std::collections::BTreeMap;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, err, matrix::pdu::PartialPdu, utils};
 use ruma::{api::client::message::send_message_event, events::MessageLikeEventType};
 use serde_json::from_str;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `PUT /_matrix/client/v3/rooms/{roomId}/send/{eventType}/{txnId}`
 ///
@@ -19,7 +18,7 @@
 ///   allowed
 pub(crate) async fn send_message_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: required for updating device metadata
 	body: Ruma<send_message_event::v3::Request>,
 ) -> Result<send_message_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,10 +1,9 @@
 use std::time::Duration;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug, err, info,
-	utils::{self, ReadyExt, stream::BroadbandExt},
+	utils::{ReadyExt, stream::BroadbandExt},
 	warn,
 };
 use conduwuit_service::Services;
@@ -29,18 +28,17 @@
 	},
 	assign,
 };
+use service::users::DeviceToken;

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `GET /_matrix/client/v3/login`
 ///
 /// Get the supported login types of this server. One of these should be used as
 /// the `type` field when logging in.
-#[tracing::instrument(skip_all, fields(%client), name = "login", level = "info")]
+#[tracing::instrument(skip_all, name = "login", level = "info")]
 pub(crate) async fn get_login_types_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	_body: Ruma<get_login_types::v3::Request>,
 ) -> Result<get_login_types::v3::Response> {
 	if !services.config.oauth.compatibility_mode().uiaa_available() {
@@ -114,10 +112,10 @@ pub async fn handle_login(
 /// Note: You can use [`GET
 /// /_matrix/client/r0/login`](fn.get_supported_versions_route.html) to see
 /// supported login types.
-#[tracing::instrument(skip_all, fields(%client), name = "login", level = "info")]
+#[tracing::instrument(skip_all, name = "login", level = "info")]
 pub(crate) async fn login_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for device metadata
 	body: Ruma<login::v3::Request>,
 ) -> Result<login::v3::Response> {
 	if !services.config.oauth.compatibility_mode().uiaa_available() {
@@ -190,44 +188,39 @@ pub(crate) async fn login_route(
 		},
 	};

-	// Generate new device id if the user didn't specify one
-	let device_id = body
-		.device_id
-		.clone()
-		.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
-
-	// Generate a new token for the device (ensuring no collisions)
-	let token = services.users.generate_unique_token().await;
+	// Generate a new token for the device
+	let token = DeviceToken::new_random();

 	// Determine if device_id was provided and exists in the db for this user
-	let device_exists = if body.device_id.is_some() {
+	let existing_device_id = if let Some(device_id) = &body.device_id {
 		services
 			.users
 			.all_device_ids(&user_id)
-			.ready_any(|v| v == device_id)
+			.ready_find(|v| v == device_id)
 			.await
 	} else {
-		false
+		None
 	};

-	if device_exists {
+	let device_id = if let Some(existing_device_id) = existing_device_id {
 		services
 			.users
-			.set_token(&user_id, &device_id, &token, None)
+			.set_token(&user_id, &existing_device_id, token.clone())
 			.await?;
+
+		existing_device_id
 	} else {
 		services
 			.users
 			.create_device(
 				&user_id,
-				&device_id,
-				&token,
-				None,
+				body.device_id.clone(),
+				Some(token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
-			.await?;
-	}
+			.await?
+	};

 	// send client well-known if specified so the client knows to reconfigure itself
 	let client_discovery_info: Option<DiscoveryInfo> = services
@@ -241,7 +234,7 @@ pub(crate) async fn login_route(
 	info!("{user_id} logged in");

 	#[allow(deprecated)]
-	Ok(assign!(login::v3::Response::new(user_id, token, device_id), {
+	Ok(assign!(login::v3::Response::new(user_id, token.into_token(), device_id), {
 		well_known: client_discovery_info,
 		expires_in: None,
 		home_server: Some(services.config.server_name.clone()),
@@ -255,10 +248,9 @@ pub(crate) async fn login_route(
 /// to log in with the m.login.token flow.
 ///
 /// <https://spec.matrix.org/v1.13/client-server-api/#post_matrixclientv1loginget_token>
-#[tracing::instrument(skip_all, fields(%client), name = "login_token", level = "info")]
+#[tracing::instrument(skip_all, name = "login_token", level = "info")]
 pub(crate) async fn login_token_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_login_token::v1::Request>,
 ) -> Result<get_login_token::v1::Response> {
 	if !services.config.login_via_existing_session {
@@ -273,7 +265,7 @@ pub(crate) async fn login_token_route(
 		.authenticate_password(&body.auth, sender_user, body.identity.sender_device(), None)
 		.await?;

-	let login_token = utils::random_string(TOKEN_LENGTH);
+	let login_token = DeviceToken::new_random().into_token();
 	let expires_in = services.users.create_login_token(sender_user, &login_token);

 	Ok(get_login_token::v1::Response::new(
@@ -291,10 +283,9 @@ pub(crate) async fn login_token_route(
 ///   last seen ts)
 /// - Forgets to-device events
 /// - Triggers device list updates
-#[tracing::instrument(skip_all, fields(%client), name = "logout", level = "info")]
+#[tracing::instrument(skip_all, name = "logout", level = "info")]
 pub(crate) async fn logout_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<logout::v3::Request>,
 ) -> Result<logout::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -339,10 +330,9 @@ pub(crate) async fn logout_route(
 /// Note: This is equivalent to calling [`GET
 /// /_matrix/client/r0/logout`](fn.logout_route.html) from each device of this
 /// user.
-#[tracing::instrument(skip_all, fields(%client), name = "logout", level = "info")]
+#[tracing::instrument(skip_all, name = "logout", level = "info")]
 pub(crate) async fn logout_all_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<logout_all::v3::Request>,
 ) -> Result<logout_all::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -19,9 +19,10 @@ pub(crate) async fn get_hierarchy_route(
 	// there's no reasonable way to handle a space hierarchy changing during
 	// pagination.

-	let max_depth = body
-		.max_depth
-		.map(|max_depth| max_depth.min(UInt::from(MAX_MAX_DEPTH)));
+	// Default to MAX_MAX_DEPTH when the client doesn't specify one, so an
+	// unbounded traversal can never happen.
+	let max_max_depth = UInt::from(MAX_MAX_DEPTH);
+	let max_depth = Some(body.max_depth.unwrap_or(max_max_depth).min(max_max_depth));

 	let hierarchy = services
 		.rooms
@@ -1,41 +1,25 @@
 #[cfg(test)]
 mod tests;
 use axum::extract::State;
-use axum_client_ip::ClientIp;
-use conduwuit::{
-	Err, Result, err,
-	matrix::{Event, pdu::PartialPdu},
-};
-use conduwuit_service::Services;
+use conduwuit::{Err, Result, err, matrix::Event};
 use futures::{FutureExt, TryStreamExt};
 use ruma::{
-	MilliSecondsSinceUnixEpoch, OwnedEventId, RoomId, UserId,
+	RoomId,
 	api::client::state::{
 		get_state_event_for_key::{self, v3::StateEventFormat},
 		get_state_events, send_state_event,
 	},
-	events::{
-		AnyStateEventContent, StateEventType,
-		room::{
-			canonical_alias::RoomCanonicalAliasEventContent,
-			history_visibility::{HistoryVisibility, RoomHistoryVisibilityEventContent},
-			join_rules::{JoinRule, RoomJoinRulesEventContent},
-			member::{MembershipState, RoomMemberEventContent},
-			server_acl::RoomServerAclEventContent,
-		},
-	},
-	serde::Raw,
 };
 use serde_json::{json, value::to_raw_value};

-use crate::{Ruma, RumaResponse};
+use crate::{Ruma, RumaResponse, client_ip::ClientIp};

 /// # `PUT /_matrix/client/*/rooms/{roomId}/state/{eventType}/{stateKey}`
 ///
 /// Sends a state event into the room.
 pub(crate) async fn send_state_event_for_key_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<send_state_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -48,21 +32,31 @@ pub(crate) async fn send_state_event_for_key_route(
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}

-	let event_id = send_state_event_for_key_helper(
-		&services,
-		sender_user,
-		&body.room_id,
-		&body.event_type,
-		&body.body.body,
-		&body.state_key,
-		if body.identity.is_appservice() {
-			body.timestamp
-		} else {
-			None
-		},
-	)
-	.boxed()
-	.await?;
+	let state_lock = services
+		.rooms
+		.state
+		.mutex
+		.lock::<RoomId>(&body.room_id)
+		.await;
+
+	let event_id = services
+		.rooms
+		.timeline
+		.send_state_event_for_key(
+			sender_user,
+			&body.room_id,
+			&state_lock,
+			&body.event_type,
+			&body.body.body,
+			&body.state_key,
+			if body.identity.is_appservice() {
+				body.timestamp
+			} else {
+				None
+			},
+		)
+		.boxed()
+		.await?;

 	Ok(send_state_event::v3::Response::new(event_id))
 }
@@ -72,7 +66,7 @@ pub(crate) async fn send_state_event_for_key_route(
 /// Sends a state event into the room.
 pub(crate) async fn send_state_event_for_empty_key_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<RumaResponse<send_state_event::v3::Response>> {
 	send_state_event_for_key_route(State(services), ClientIp(ip), body)
@@ -186,257 +180,3 @@ pub(crate) async fn get_state_events_for_empty_key_route(
 		.await
 		.map(RumaResponse)
 }
-
-async fn send_state_event_for_key_helper(
-	services: &Services,
-	sender: &UserId,
-	room_id: &RoomId,
-	event_type: &StateEventType,
-	json: &Raw<AnyStateEventContent>,
-	state_key: &str,
-	timestamp: Option<MilliSecondsSinceUnixEpoch>,
-) -> Result<OwnedEventId> {
-	let json: &mut Raw<AnyStateEventContent> = &mut json.clone();
-	allowed_to_send_state_event(services, room_id, event_type, state_key, json).await?;
-	let state_lock = services.rooms.state.mutex.lock(room_id).await;
-	let event_id = services
-		.rooms
-		.timeline
-		.build_and_append_pdu(
-			PartialPdu {
-				event_type: event_type.to_string().into(),
-				content: serde_json::from_str(json.json().get())?,
-				state_key: Some(state_key.into()),
-				timestamp,
-				..Default::default()
-			},
-			sender,
-			Some(room_id),
-			&state_lock,
-		)
-		.await?;
-
-	Ok(event_id)
-}
-
-async fn allowed_to_send_state_event(
-	services: &Services,
-	room_id: &RoomId,
-	event_type: &StateEventType,
-	state_key: &str,
-	json: &mut Raw<AnyStateEventContent>,
-) -> Result {
-	match event_type {
-		| StateEventType::RoomCreate => {
-			return Err!(Request(BadJson(debug_warn!(
-				%room_id,
-				"You cannot update m.room.create after a room has been created."
-			))));
-		},
-		| StateEventType::RoomServerAcl => {
-			// prevents common ACL paw-guns as ACL management is difficult and prone to
-			// irreversible mistakes
-			match json.deserialize_as_unchecked::<RoomServerAclEventContent>() {
-				| Ok(acl_content) => {
-					let allow_has_wildcard = acl_content.allow.iter().any(|entry| entry == "*");
-					let deny_has_wildcard = acl_content.deny.iter().any(|entry| entry == "*");
-					let allow_has_server = acl_content
-						.allow
-						.iter()
-						.any(|entry| entry == services.globals.server_name().as_str());
-
-					if acl_content.allow.is_empty() {
-						return Err!(Request(BadJson(debug_warn!(
-							%room_id,
-							"Sending an ACL event with an empty allow key will permanently \
-							 brick the room for non-conduwuit's as this equates to no servers \
-							 being allowed to participate in this room."
-						))));
-					}
-
-					if allow_has_wildcard && deny_has_wildcard {
-						return Err!(Request(BadJson(debug_warn!(
-							%room_id,
-							"Sending an ACL event with a deny and allow key value of \"*\" will \
-							 permanently brick the room for non-conduwuit's as this equates to \
-							 no servers being allowed to participate in this room."
-						))));
-					}
-
-					if deny_has_wildcard
-						&& !acl_content.is_allowed(services.globals.server_name())
-						&& !allow_has_server
-					{
-						return Err!(Request(BadJson(debug_warn!(
-							%room_id,
-							"Sending an ACL event with a deny key value of \"*\" and without \
-							 your own server name in the allow key will result in you being \
-							 unable to participate in this room."
-						))));
-					}
-
-					if !allow_has_wildcard
-						&& !acl_content.is_allowed(services.globals.server_name())
-						&& !allow_has_server
-					{
-						return Err!(Request(BadJson(debug_warn!(
-							%room_id,
-							"Sending an ACL event for an allow key without \"*\" and without \
-							 your own server name in the allow key will result in you being \
-							 unable to participate in this room."
-						))));
-					}
-				},
-				| Err(e) => {
-					return Err!(Request(BadJson(debug_warn!(
-						"Room server ACL event is invalid: {e}"
-					))));
-				},
-			}
-		},
-		| StateEventType::RoomEncryption =>
-		// Forbid m.room.encryption if encryption is disabled
-			if !services.config.allow_encryption {
-				return Err!(Request(Forbidden("Encryption is disabled on this homeserver.")));
-			},
-		| StateEventType::RoomJoinRules => {
-			// admin room is a sensitive room, it should not ever be made public
-			if let Ok(admin_room_id) = services.admin.get_admin_room().await {
-				if admin_room_id == room_id {
-					match json.deserialize_as_unchecked::<RoomJoinRulesEventContent>() {
-						| Ok(join_rule) =>
-							if join_rule.join_rule == JoinRule::Public {
-								return Err!(Request(Forbidden(
-									"Admin room is a sensitive room, it cannot be made public"
-								)));
-							},
-						| Err(e) => {
-							return Err!(Request(BadJson(debug_warn!(
-								"Room join rules event is invalid: {e}"
-							))));
-						},
-					}
-				}
-			}
-		},
-		| StateEventType::RoomHistoryVisibility => {
-			// admin room is a sensitive room, it should not ever be made world readable
-			if let Ok(admin_room_id) = services.admin.get_admin_room().await {
-				match json.deserialize_as_unchecked::<RoomHistoryVisibilityEventContent>() {
-					| Ok(visibility_content) => {
-						if admin_room_id == room_id
-							&& visibility_content.history_visibility
-								== HistoryVisibility::WorldReadable
-						{
-							return Err!(Request(Forbidden(
-								"Admin room is a sensitive room, it cannot be made world \
-								 readable (public room history)."
-							)));
-						}
-					},
-					| Err(e) => {
-						return Err!(Request(BadJson(debug_warn!(
-							"Room history visibility event is invalid: {e}"
-						))));
-					},
-				}
-			}
-		},
-		| StateEventType::RoomCanonicalAlias => {
-			match json.deserialize_as_unchecked::<RoomCanonicalAliasEventContent>() {
-				| Ok(canonical_alias_content) => {
-					let mut aliases = canonical_alias_content.alt_aliases.clone();
-
-					if let Some(alias) = canonical_alias_content.alias {
-						aliases.push(alias);
-					}
-
-					for alias in aliases {
-						let (alias_room_id, _) = services
-							.rooms
-							.alias
-							.resolve_alias(&alias)
-							.await
-							.map_err(|e| {
-								err!(Request(Unknown("Failed resolving alias \"{alias}\": {e}")))
-							})?;
-
-						if alias_room_id != room_id {
-							return Err!(Request(BadAlias(
-								"Room alias {alias} does not belong to room {room_id}"
-							)));
-						}
-					}
-				},
-				| Err(e) => {
-					return Err!(Request(InvalidParam(debug_warn!(
-						"Room canonical alias event is invalid: {e}"
-					))));
-				},
-			}
-		},
-		| StateEventType::RoomMember =>
-			match json.deserialize_as_unchecked::<RoomMemberEventContent>() {
-				| Ok(mut membership_content) => {
-					let Ok(state_key) = UserId::parse(state_key) else {
-						return Err!(Request(BadJson(
-							"Membership event has invalid or non-existent state key"
-						)));
-					};
-
-					if let Some(authorising_user) =
-						membership_content.join_authorized_via_users_server
-					{
-						// join_authorized_via_users_server must be thrown away, if user is
-						// already a member of the room.
-						if services
-							.rooms
-							.state_cache
-							.is_joined(&state_key, room_id)
-							.await
-						{
-							membership_content.join_authorized_via_users_server = None;
-							*json = Raw::<AnyStateEventContent>::from_json_string(
-								serde_json::to_string(&membership_content)?,
-							)?;
-							return Ok(());
-						}
-
-						if membership_content.membership != MembershipState::Join {
-							return Err!(Request(BadJson(
-								"join_authorised_via_users_server is only for member joins"
-							)));
-						}
-
-						if !services.globals.user_is_local(&authorising_user) {
-							return Err!(Request(InvalidParam(
-								"Authorising user {authorising_user} does not belong to this \
-								 homeserver"
-							)));
-						}
-
-						if !services
-							.rooms
-							.state_cache
-							.is_joined(&authorising_user, room_id)
-							.await
-						{
-							return Err!(Request(InvalidParam(
-								"Authorising user {authorising_user} is not in the room, they \
-								 cannot authorise the join."
-							)));
-						}
-					}
-				},
-				| Err(e) => {
-					return Err!(Request(BadJson(
-						"Membership content must have a valid JSON body with at least a valid \
-						 membership state: {e}"
-					)));
-				},
-			},
-		| _ => (),
-	}
-
-	Ok(())
-}
@@ -1,3 +1,8 @@
+use ruma::{
+	events::{AnyStateEventContent, room::member::RoomMemberEventContent},
+	serde::Raw,
+};
+
 use super::*;

 #[test]
@@ -269,13 +269,22 @@ async fn build_state_and_timeline(
 	)
 	.await?;

-	let (state_events, notification_counts, joined_since_last_sync) = try_join3(
-		build_state_events(services, sync_context, room_id, shortstatehashes, &timeline),
+	let (notification_counts, joined_since_last_sync) = try_join(
 		build_notification_counts(services, sync_context, room_id, &timeline),
 		check_joined_since_last_sync(services, shortstatehashes, sync_context),
 	)
 	.await?;

+	let state_events = build_state_events(
+		services,
+		sync_context,
+		room_id,
+		shortstatehashes,
+		&timeline,
+		joined_since_last_sync,
+	)
+	.await?;
+
 	// the timeline should always include at least one PDU if the syncing user
 	// joined since the last sync, that being the syncing user's join event. if
 	// it's empty something is wrong.
@@ -459,6 +468,7 @@ async fn build_state_events(
 	room_id: &RoomId,
 	shortstatehashes: ShortStateHashes,
 	timeline: &TimelinePdus,
+	joined_since_last_sync: bool,
 ) -> Result<Vec<PduEvent>> {
 	let SyncContext {
 		syncing_user,
@@ -488,9 +498,10 @@ async fn build_state_events(
 		/*
 		if `last_sync_end_count` is Some (meaning this is an incremental sync), and `last_sync_end_shortstatehash`
 		is Some (meaning the syncing user didn't just join this room for the first time ever), and `full_state` is false,
-		then use `build_state_incremental`.
+		and the user didn't just join the room since the last sync, then use `build_state_incremental`.
 		*/
-		| (Some(_), Some(last_sync_end_shortstatehash)) if !full_state =>
+		| (Some(_), Some(last_sync_end_shortstatehash))
+			if !full_state && !joined_since_last_sync =>
 			build_state_incremental(
 				services,
 				syncing_user,
@@ -230,7 +230,7 @@ async fn build_left_state_and_timeline(
 		.and_then(|limit| limit.try_into().ok())
 		.unwrap_or(DEFAULT_TIMELINE_LIMIT);

-	let timeline = load_timeline(
+	let mut timeline = load_timeline(
 		services,
 		syncing_user,
 		room_id,
@@ -240,6 +240,20 @@ async fn build_left_state_and_timeline(
 	)
 	.await?;

+	// the timeline index can lag behind the leave PDU, so `load_timeline` may omit
+	// it. we already hold the leave event, so ensure it's always synced to the
+	// client.
+	let leave_synced = timeline
+		.pdus
+		.iter()
+		.any(|(_, pdu)| pdu.event_id() == leave_membership_event.event_id());
+
+	if !leave_synced {
+		timeline
+			.pdus
+			.push_back((timeline_end_count, leave_membership_event));
+	}
+
 	let lazily_loaded_members =
 		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders()).await;

@@ -9,7 +9,6 @@
 };

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, at, error, extract_variant,
 	utils::{
@@ -48,6 +47,7 @@
 		is_ignored_invite,
 		sync::v3::{joined::load_joined_room, left::load_left_room},
 	},
+	client_ip::ClientIp,
 };

 /// The default maximum number of events to return in the `timeline` key of
@@ -181,7 +181,7 @@ fn lazy_loading_enabled(&self) -> bool {
 )]
 pub(crate) async fn sync_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<sync_events::v3::Request>,
 ) -> Result<sync_events::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -6,7 +6,6 @@
 };

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Error, Result, at, error, extract_variant, is_equal_to,
 	matrix::{Event, TypeStateKey, pdu::PduCount},
@@ -49,6 +48,7 @@
 	client::{
 		DEFAULT_BUMP_TYPES, TimelinePdus, ignored_filter, is_ignored_invite, sync::load_timeline,
 	},
+	client_ip::ClientIp,
 };

 type SyncInfo<'a> = (&'a UserId, &'a DeviceId, u64, &'a sync_events::v5::Request);
@@ -67,7 +67,7 @@
 /// [MSC4186]: https://github.com/matrix-org/matrix-spec-proposals/pull/4186
 pub(crate) async fn sync_events_v5_route(
 	State(ref services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<sync_events::v5::Request>,
 ) -> Result<sync_events::v5::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -203,16 +203,27 @@ pub(crate) async fn sync_events_v5_route(
 	)
 	.await?;

-	if response.rooms.iter().all(|(id, r)| {
+	let no_account_data = response.extensions.account_data.global.is_empty()
+		&& response
+			.extensions
+			.account_data
+			.rooms
+			.values()
+			.all(Vec::is_empty);
+
+	let no_room_data = response.rooms.iter().all(|(id, r)| {
 		r.timeline.is_empty()
 			&& r.required_state.is_empty()
 			&& !response.extensions.receipts.rooms.contains_key(id)
-	}) && response
+	});
+
+	let no_to_device_messages = response
 		.extensions
 		.to_device
 		.clone()
-		.is_none_or(|to| to.events.is_empty())
-	{
+		.is_none_or(|to| to.events.is_empty());
+
+	if no_account_data && no_room_data && no_to_device_messages {
 		// Hang a few seconds so requests are not spammed
 		// Stop hanging if new info arrives
 		let default = Duration::from_secs(30);
@@ -1,16 +1,15 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, utils, utils::math::Tried};
 use ruma::api::client::typing::create_typing_event::{self, v3::TypingInfo};

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `PUT /_matrix/client/r0/rooms/{roomId}/typing/{userId}`
 ///
 /// Sets the typing state of the sender user.
 pub(crate) async fn create_typing_event_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<create_typing_event::v3::Request>,
 ) -> Result<create_typing_event::v3::Response> {
 	use create_typing_event::v3::Typing;
@@ -44,11 +44,25 @@ pub(crate) async fn continuwuity_server_version() -> Result<impl IntoResponse> {
 ///
 /// conduwuit-specific API to return the amount of users registered on this
 /// homeserver. Endpoint is disabled if federation is disabled for privacy. This
+///
 /// only includes active users (not deactivated, etc)
 pub(crate) async fn continuwuity_local_user_count(
 	State(services): State<crate::State>,
 ) -> Result<impl IntoResponse> {
-	let user_count = services.users.stream_local_users().count().await;
+	let user_count = services
+		.users
+		.stream_local_users()
+		.filter_map(async |user_id| {
+			if !services.users.status(&user_id).await.is_active()
+				|| services.appservice.is_exclusive_user_id(&user_id).await
+			{
+				None
+			} else {
+				Some(user_id)
+			}
+		})
+		.count()
+		.await;

 	Ok(Json(serde_json::json!({
 		"count": user_count
@@ -0,0 +1,212 @@
+use core::net::{IpAddr, SocketAddr};
+use std::ops::Deref;
+
+use axum::{
+	extract::{ConnectInfo, FromRequestParts},
+	response::{IntoResponse, Response},
+};
+use conduwuit::{debug_info, debug_warn};
+use http::{HeaderMap, StatusCode, request::Parts};
+use service::Services;
+
+#[derive(Debug, PartialEq)]
+pub enum ClientIpError {
+	Header(client_ip::Error),
+	Direct,
+}
+
+impl IntoResponse for ClientIpError {
+	fn into_response(self) -> Response {
+		let text = match self {
+			| Self::Header(e) => format!("{e}"),
+			| Self::Direct => "Failed to extract IP from ConnectionInfo".to_owned(),
+		};
+		(StatusCode::INTERNAL_SERVER_ERROR, text).into_response()
+	}
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct ClientIp(pub IpAddr);
+
+type PartsToIpFn = Box<dyn Fn(&Parts) -> Result<ClientIp, ClientIpError>>;
+
+impl ClientIp {
+	fn from_header<T>(func: T) -> PartsToIpFn
+	where
+		T: Fn(&HeaderMap) -> Result<IpAddr, client_ip::Error> + 'static,
+	{
+		Box::new(move |parts: &Parts| {
+			func(&parts.headers)
+				.map(Self)
+				.map_err(ClientIpError::Header)
+		})
+	}
+
+	fn from_connection_info(parts: &Parts) -> Result<Self, ClientIpError> {
+		parts
+			.extensions
+			.get::<ConnectInfo<SocketAddr>>()
+			.ok_or_else(|| ClientIpError::Direct)
+			.map(|ConnectInfo(addr)| Self(addr.ip()))
+	}
+
+	fn for_source(source: &str) -> Option<PartsToIpFn> {
+		match source {
+			| "cf_connecting_ip" => Some(Self::from_header(client_ip::cf_connecting_ip)),
+			| "cloudfront_viewer_address" =>
+				Some(Self::from_header(client_ip::cloudfront_viewer_address)),
+			| "fly_client_ip" => Some(Self::from_header(client_ip::fly_client_ip)),
+			| "x_forwarded_for" => Some(Self::from_header(client_ip::rightmost_x_forwarded_for)),
+			| "true_client_ip" => Some(Self::from_header(client_ip::true_client_ip)),
+			| "x_envoy_external_address" =>
+				Some(Self::from_header(client_ip::x_envoy_external_address)),
+			| "x_real_ip" => Some(Self::from_header(client_ip::x_real_ip)),
+			| "direct" => Some(Box::new(Self::from_connection_info)),
+			| s => {
+				debug_warn!("Invalid client IP source option supplied, skipping: {s}");
+				None
+			},
+		}
+	}
+
+	fn for_config(
+		parts: &Parts,
+		accepted_ip_sources: &[String],
+		request_ip_source: Option<&String>,
+	) -> Result<Self, ClientIpError> {
+		accepted_ip_sources
+			.iter()
+			.filter_map(|s| Self::for_source(s))
+			.map(|f| f(parts))
+			.reduce(Result::or)
+			.or_else(|| {
+				debug_info!(
+					"No (valid) options set in `accepted_ip_sources`; falling back to \
+					 `request_ip_source`"
+				);
+				request_ip_source
+					.and_then(|s| Self::for_source(s))
+					.map(|f| f(parts).or_else(|_| Self::from_connection_info(parts)))
+			})
+			.unwrap_or_else(|| {
+				debug_info!(
+					"No (valid) options set in `accepted_ip_sources` or `request_ip_source`; \
+					 using peer address"
+				);
+				Self::from_connection_info(parts)
+			})
+	}
+}
+
+impl<S> FromRequestParts<S> for ClientIp
+where
+	S: Deref<Target = Services> + Sync,
+{
+	type Rejection = ClientIpError;
+
+	async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
+		Self::for_config(
+			parts,
+			&state.config.accepted_ip_sources,
+			state.config.request_ip_source.as_ref(),
+		)
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use std::net::{Ipv4Addr, Ipv6Addr};
+
+	use super::*;
+
+	const SOCKET_V4: IpAddr = IpAddr::V4(Ipv4Addr::new(198, 51, 100, 1));
+	const HEADER_V4: IpAddr = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1));
+
+	const SOCKET_V6: IpAddr = IpAddr::V6(Ipv6Addr::new(0x2001, 0xDB8, 0, 0, 0, 0, 0, 1));
+	const HEADER_V6: IpAddr = IpAddr::V6(Ipv6Addr::new(0x2001, 0xDB8, 0, 0, 0, 0, 0, 2));
+
+	fn parts(peer: Option<IpAddr>, headers: &[(&str, &str)]) -> Parts {
+		let mut builder = http::Request::builder();
+		for (name, value) in headers {
+			builder = builder.header(*name, *value);
+		}
+
+		let (mut parts, ()) = builder.body(()).unwrap().into_parts();
+		if let Some(peer) = peer {
+			parts
+				.extensions
+				.insert(ConnectInfo(SocketAddr::new(peer, 8448)));
+		}
+
+		parts
+	}
+
+	fn extract(
+		parts: &Parts,
+		accepted_ip_sources: &[String],
+		request_ip_source: Option<&String>,
+	) -> Result<IpAddr, ClientIpError> {
+		ClientIp::for_config(parts, accepted_ip_sources, request_ip_source).map(|ClientIp(ip)| ip)
+	}
+
+	#[tokio::test]
+	async fn resolves_from_configured_source_ipv4() {
+		let parts = parts(Some(SOCKET_V4), &[("x-real-ip", &HEADER_V4.to_string())]);
+
+		assert_eq!(extract(&parts, &["x_real_ip".to_owned()], None), Ok(HEADER_V4));
+		assert_eq!(extract(&parts, &[], Some(&"x_real_ip".to_owned())), Ok(HEADER_V4));
+	}
+
+	#[tokio::test]
+	async fn resolves_from_configured_source_ipv6() {
+		let parts = parts(Some(SOCKET_V6), &[("x-real-ip", &HEADER_V6.to_string())]);
+
+		assert_eq!(extract(&parts, &["x_real_ip".to_owned()], None), Ok(HEADER_V6));
+		assert_eq!(extract(&parts, &[], Some(&"x_real_ip".to_owned())), Ok(HEADER_V6));
+	}
+
+	#[tokio::test]
+	async fn accepted_ip_sources_no_fall_back_to_peer_when_header_missing() {
+		let parts = parts(Some(SOCKET_V4), &[]);
+
+		extract(&parts, &["x_real_ip".to_owned()], None).unwrap_err();
+	}
+
+	#[tokio::test]
+	async fn request_ip_source_falls_back_to_peer_when_header_missing() {
+		let parts = parts(Some(SOCKET_V4), &[]);
+
+		assert_eq!(extract(&parts, &[], Some(&"x_real_ip".to_owned())), Ok(SOCKET_V4));
+	}
+
+	#[tokio::test]
+	async fn accepted_ip_sources_no_fall_back_to_peer_when_header_unparsable() {
+		let parts = parts(Some(SOCKET_V4), &[("x-real-ip", "not-an-ip")]);
+
+		extract(&parts, &["x_real_ip".to_owned()], None).unwrap_err();
+	}
+
+	#[tokio::test]
+	async fn request_ip_source_falls_back_to_peer_when_header_unparsable() {
+		let parts = parts(Some(SOCKET_V4), &[("x-real-ip", "not-an-ip")]);
+
+		assert_eq!(extract(&parts, &[], Some(&"x_real_ip".to_owned())), Ok(SOCKET_V4));
+	}
+
+	#[tokio::test]
+	async fn accepted_ip_sources_falls_back_when_configured() {
+		let parts = parts(Some(SOCKET_V4), &[]);
+
+		assert_eq!(
+			extract(&parts, &["x_real_ip".to_owned(), "direct".to_owned()], None),
+			Ok(SOCKET_V4)
+		);
+	}
+
+	#[tokio::test]
+	async fn falls_back_to_peer_no_configuration() {
+		let parts = parts(Some(SOCKET_V4), &[("x-real-ip", &HEADER_V4.to_string())]);
+
+		assert_eq!(extract(&parts, &[], None), Ok(SOCKET_V4));
+	}
+}
@@ -11,6 +11,8 @@
 pub mod router;
 pub mod server;

+pub mod client_ip;
+
 pub mod admin;

 pub(crate) use self::router::{Ruma, RumaResponse, State};
@@ -15,10 +15,9 @@
 #[derive(Deserialize)]
 pub(crate) struct AuthQueryParams {
 	pub(super) user_id: Option<String>,
-	/// Device ID for appservice device masquerading (MSC3202/MSC4190).
-	/// Can be provided as `device_id` or `org.matrix.msc3202.device_id`.
-	#[serde(alias = "org.matrix.msc3202.device_id")]
 	pub(super) device_id: Option<String>,
+	#[serde(rename = "org.matrix.msc3202.device_id")]
+	pub(super) legacy_device_id: Option<String>,
 }

 /// Extractor for Ruma request structs
@@ -219,25 +219,29 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
 			// The device_id can be provided via `device_id` or
 			// `org.matrix.msc3202.device_id` query parameter.
-			let sender_device =
-				if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
-					// Verify the device exists for this user
-					if services
-						.users
-						.get_device_metadata(&sender_user, device_id)
-						.await
-						.is_err()
-					{
-						return Err!(Request(Forbidden(
-							"Device does not exist for user or appservice cannot masquerade as \
-							 this device."
-						)));
-					}
+			let sender_device = if let Some(device_id) = query
+				.device_id
+				.or(query.legacy_device_id)
+				.as_deref()
+				.map(Into::into)
+			{
+				// Verify the device exists for this user
+				if services
+					.users
+					.get_device_metadata(&sender_user, device_id)
+					.await
+					.is_err()
+				{
+					return Err!(Request(Forbidden(
+						"Device does not exist for user or appservice cannot masquerade as this \
+						 device."
+					)));
+				}

-					Some(device_id.to_owned())
-				} else {
-					None
-				};
+				Some(device_id.to_owned())
+			} else {
+				None
+			};

 			Ok(ClientIdentity::Appservice {
 				sender_user,
@@ -1,57 +1,47 @@
+use std::collections::{HashMap, hash_map::Entry};
+
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use base64::{Engine as _, engine::general_purpose};
 use conduwuit::{
-	Err, Error, PduEvent, Result, err, error,
-	matrix::{Event, event::gen_event_id},
-	utils::{self, hash::sha256},
+	Err, Error, EventTypeExt, PduEvent, Result, debug, err, error,
+	matrix::{Event, StateKey},
+	result::FlatOk,
+	state_res, trace,
+	utils::hash::sha256,
 	warn,
 };
 use ruma::{
-	CanonicalJsonValue, UserId,
+	CanonicalJsonObject, CanonicalJsonValue, OwnedEventId, OwnedRoomId, OwnedUserId, ServerName,
+	UserId,
 	api::{
 		error::{ErrorKind, IncompatibleRoomVersionErrorData},
 		federation::membership::{RawStrippedState, create_invite},
 	},
-	events::room::member::{MembershipState, RoomMemberEventContent},
-	serde::JsonObject,
+	events::{StateEventType, room::member::MembershipState},
+	room_version_rules::RoomVersionRules,
 };
+use serde::Deserialize;

-use crate::Ruma;
+use crate::{Ruma, server::utils::validate_any_membership_event};

 /// # `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}`
 ///
 /// Invites a remote user to a room.
-#[tracing::instrument(skip_all, fields(%client), name = "invite", level = "info")]
+#[tracing::instrument(skip_all, name = "invite", level = "info")]
 pub(crate) async fn create_invite_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<create_invite::v2::Request>,
 ) -> Result<create_invite::v2::Response> {
-	// ACL check origin
-	services
-		.rooms
-		.event_handler
-		.acl_check(&body.identity, &body.room_id)
-		.await?;
-
 	if !services.server.supported_room_version(&body.room_version) {
 		return Err(Error::BadRequest(
 			ErrorKind::IncompatibleRoomVersion(IncompatibleRoomVersionErrorData::new(
 				body.room_version.clone(),
 			)),
-			"Server does not support this room version.",
+			"This server does not support that room version",
 		));
 	}
-
 	let room_version_rules = body.room_version.rules().unwrap();

-	if let Some(server) = body.room_id.server_name() {
-		if services.moderation.is_remote_server_forbidden(server) {
-			return Err!(Request(Forbidden("Server is banned on this homeserver.")));
-		}
-	}
-
 	if services
 		.moderation
 		.is_remote_server_forbidden(&body.identity)
@@ -61,90 +51,61 @@ pub(crate) async fn create_invite_route(
 			body.identity, body.room_id
 		);

-		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
+		return Err!(Request(Forbidden("Federation denied with {}", body.identity)));
 	}

-	let mut signed_event = utils::to_canonical_object(&body.event)
-		.map_err(|_| err!(Request(InvalidParam("Invite event is invalid."))))?;
-
-	// Ensure this is a membership event
-	if signed_event
-		.get("type")
-		.expect("event must have a type")
-		.as_str()
-		.expect("type must be a string")
-		!= "m.room.member"
-	{
-		return Err!(Request(BadJson(
-			"Not allowed to send non-membership event to invite endpoint."
-		)));
-	}
-
-	let content: RoomMemberEventContent = serde_json::from_value(
-		signed_event
-			.get("content")
-			.ok_or_else(|| err!(Request(BadJson("Event missing content property"))))?
-			.clone()
-			.into(),
+	// First, validate the invite room state, so we can compare with the create
+	// event.
+	debug!(
+		event_id=%body.event_id,
+		room_id=%body.room_id,
+		room_version=?body.room_version,
+		via=?body.via,
+		"Validating invite room state for invite request"
+	);
+	let (create_event_id, state) = validate_invite_state(
+		&services,
+		&body.invite_room_state,
+		&room_version_rules,
+		body.room_id.clone(),
 	)
-	.map_err(|e| err!(Request(BadJson(warn!("Event content is empty or invalid: {e}")))))?;
+	.await?;
+	let create_event_json = state
+		.get(&StateEventType::RoomCreate.with_state_key(""))
+		.expect("must have create event in invite state by this point");

-	// Ensure this is an invite membership event
-	if content.membership != MembershipState::Invite {
-		return Err!(Request(BadJson(
-			"Not allowed to send a non-invite membership event to invite endpoint."
-		)));
-	}
-
-	// Ensure the sending user isn't a lying bozo
-	let sender_user = signed_event
+	// We can now perform the banned remote server check with the create event.
+	// N.B. this checks the sender field, which is technically incorrect for rooms
+	// v10 and below. This usually isn't the case though so sue me
+	let creator = create_event_json
 		.get("sender")
 		.and_then(|v| v.as_str())
 		.map(UserId::parse)
-		.and_then(Result::ok)
-		.ok_or_else(|| err!(Request(InvalidParam("Invalid sender property"))))?;
-
-	if sender_user.server_name() != body.identity {
-		return Err!(Request(Forbidden("Sender's server does not match the origin server.",)));
-	}
-
-	// Ensure the target user belongs to this server
-	let recipient_user = signed_event
-		.get("state_key")
-		.and_then(|v| v.as_str())
-		.map(UserId::parse)
-		.and_then(Result::ok)
-		.ok_or_else(|| err!(Request(InvalidParam("Invalid state_key property"))))?;
-
-	if !services
-		.globals
-		.server_is_ours(recipient_user.server_name())
+		.flat_ok()
+		.expect("must have valid sender in create event");
+	if services
+		.moderation
+		.is_remote_server_forbidden(creator.server_name())
 	{
-		return Err!(Request(InvalidParam("User does not belong to this homeserver.")));
+		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
 	}

-	// Make sure we're not ACL'ed from their room.
-	services
-		.rooms
-		.event_handler
-		.acl_check(recipient_user.server_name(), &body.room_id)
-		.await?;
-
-	services
-		.server_keys
-		.hash_and_sign_event(&mut signed_event, &room_version_rules)
-		.map_err(|e| err!(Request(InvalidParam("Failed to sign event: {e}"))))?;
-
-	// Generate event id
-	let event_id = gen_event_id(&signed_event, &room_version_rules)?;
-
-	// Add event_id back
-	signed_event.insert("event_id".to_owned(), CanonicalJsonValue::String(event_id.to_string()));
+	// And then we can validate the member event itself
+	let (mut signed_event, sender_user, recipient_user) = validate_invite_membership_event(
+		&services,
+		&body.event,
+		&room_version_rules,
+		&body.identity,
+		create_event_id.clone(),
+		body.room_id.clone(),
+		body.event_id.clone(),
+	)
+	.await?;

 	if services.rooms.metadata.is_banned(&body.room_id).await
 		&& !services.users.is_admin(&recipient_user).await
 	{
-		return Err!(Request(Forbidden("This room is banned on this homeserver.")));
+		return Err!(Request(Forbidden("That room is banned on this homeserver.")));
 	}

 	if services.config.block_non_admin_invites && !services.users.is_admin(&recipient_user).await
@@ -161,30 +122,57 @@ pub(crate) async fn create_invite_route(
 		return Err!(Request(Forbidden("Invite rejected by antispam service.")));
 	}

+	// If we're already in the room, ensure that neither the origin nor ourselves
+	// are ACL'd.
+	let resident = services
+		.rooms
+		.state_cache
+		.server_in_room(services.globals.server_name(), &body.room_id)
+		.await;
+	if resident {
+		services
+			.rooms
+			.event_handler
+			.acl_check(&body.identity, &body.room_id)
+			.await?;
+		services
+			.rooms
+			.event_handler
+			.acl_check(recipient_user.server_name(), &body.room_id)
+			.await
+			.map_err(|_| err!(Request(Forbidden("This server is ACL'd from that room"))))?;
+	}
+
+	services
+		.server_keys
+		.hash_and_sign_event(&mut signed_event, &room_version_rules)
+		.map_err(|e| err!(Request(InvalidParam("Failed to sign event: {e}"))))?;
+
+	// Add event_id back
+	signed_event
+		.insert("event_id".to_owned(), CanonicalJsonValue::String(body.event_id.to_string()));
+
 	let mut invite_state = body.invite_room_state.clone();
-
-	let mut event: JsonObject = serde_json::from_str(body.event.get())
-		.map_err(|e| err!(Request(BadJson("Invalid invite event PDU: {e}"))))?;
-
-	event.insert("event_id".to_owned(), "$placeholder".into());
-
-	let pdu: PduEvent = serde_json::from_value(event.into())
-		.map_err(|e| err!(Request(BadJson("Invalid invite event PDU: {e}"))))?;
-
-	invite_state.push(RawStrippedState::Pdu(
-		serde_json::value::to_raw_value(&pdu).expect("PDU was just created, it must be valid"),
-	));
+	let pdu = PduEvent::from_id_val(&body.event_id, signed_event.clone())
+		.expect("must be able to create PDU object");
+	invite_state.push(RawStrippedState::Pdu(serde_json::value::to_raw_value(&signed_event)?));

 	// If we are active in the room, the remote server will notify us about the
 	// join/invite through /send. If we are not in the room, we need to manually
 	// record the invited state for client /sync through update_membership(), and
 	// send the invite PDU to the relevant appservices.
-	if !services
-		.rooms
-		.state_cache
-		.server_in_room(services.globals.server_name(), &body.room_id)
-		.await
-	{
+	if !resident {
+		// We will start by recording the room's create event as an outlier.
+		// This will allow us to recognise it later in case the sender revokes the
+		// invite over federation later. We could store more state from the invite
+		// request, but we will get that during send_join anyway.
+		// This is safe to just add directly as an outlier as we already auth checked it
+		// during validation.
+		services
+			.rooms
+			.outlier
+			.add_pdu_outlier(&create_event_id, create_event_json);
+
 		services
 			.rooms
 			.state_cache
@@ -240,3 +228,197 @@ pub(crate) async fn create_invite_route(
 			.await,
 	))
 }
+
+/// Validates the *membership event* in the invite request, per the steps listed
+/// under the invite endpoint's [spec].
+///
+/// Returns the validated JSON body, sender user ID, and recipient user ID.
+///
+/// Since this function performs a PDU format check, the create event must be
+/// known ahead of time. This implies validating the invite state before the
+/// invite event itself.
+///
+/// [spec]: https://spec.matrix.org/v1.19/server-server-api/#put_matrixfederationv2inviteroomideventid
+async fn validate_invite_membership_event(
+	services: &crate::State,
+	body: &serde_json::value::RawValue,
+	room_version_rules: &RoomVersionRules,
+	origin: &ServerName,
+	create_event_id: OwnedEventId,
+	room_id: OwnedRoomId,
+	event_id: OwnedEventId,
+) -> Result<(CanonicalJsonObject, OwnedUserId, OwnedUserId)> {
+	trace!(?body, "Invite membership event");
+	let (pdu, target_membership, sender_user, recipient_user) = validate_any_membership_event(
+		services,
+		body,
+		room_version_rules,
+		create_event_id,
+		room_id,
+		event_id,
+	)
+	.await?;
+
+	// Ensure the sender belongs to the remote that is sending the invite
+	if sender_user.server_name() != origin {
+		return Err!(Request(Forbidden("Sender belongs to a different server")));
+	}
+
+	// Ensure the target user belongs to this server
+	if !services
+		.globals
+		.server_is_ours(recipient_user.server_name())
+	{
+		return Err!(Request(InvalidParam("Recipient does not belong to this homeserver")));
+	}
+
+	if target_membership != MembershipState::Invite {
+		return Err!(Request(BadJson("Invalid membership (expected `invite`)")));
+	}
+
+	Ok((pdu, sender_user, recipient_user))
+}
+
+/// Validates the *invite state* of an invite request, per the steps listed
+/// under the endpoint's [spec].
+///
+/// Returns the create event's event ID, and the partial state map.
+///
+/// [spec]: https://spec.matrix.org/v1.19/server-server-api/#put_matrixfederationv2inviteroomideventid
+async fn validate_invite_state(
+	services: &crate::State,
+	invite_state: &[RawStrippedState],
+	room_version_rules: &RoomVersionRules,
+	room_id: OwnedRoomId,
+) -> Result<(OwnedEventId, HashMap<(StateEventType, StateKey), CanonicalJsonObject>)> {
+	trace!(?invite_state, "Raw invite state");
+	let mut invite_state_map: HashMap<(StateEventType, StateKey), _> =
+		HashMap::with_capacity(invite_state.len());
+	let mut create_event_id: Option<OwnedEventId> = None;
+
+	for (idx, invite_state_event) in invite_state.iter().cloned().enumerate() {
+		trace!(%idx, ?invite_state_event, "Invite state event");
+		// Stripped state hasn't been sent over federation since v1.16.
+		let RawStrippedState::Pdu(raw_pdu) = invite_state_event else {
+			debug!(%idx, "Invite state event is not a PDU");
+			return Err!(Request(InvalidParam(
+				"PDU in invite state (index {idx}) violates the room event format"
+			)));
+		};
+		let (state_event_room_id, state_event_id, state_event_json) = services
+			.rooms
+			.event_handler
+			.parse_incoming_pdu(&raw_pdu, Some(room_version_rules))
+			.await
+			.map_err(|e| {
+				err!(Request(InvalidParam(debug_warn!("Invalid PDU in invite state: {e}"))))
+			})?;
+
+		if state_event_room_id != room_id {
+			return Err!(Request(InvalidParam(debug_warn!(
+				%state_event_room_id,
+				%room_id,
+				"PDU in invite state ({state_event_id}) belongs to the wrong room"
+			))));
+		}
+
+		services
+			.server_keys
+			.verify_event(&state_event_json, room_version_rules)
+			.await
+			.map_err(|e| {
+				err!(Request(InvalidParam("Signature verification failed on invite event: {e}")))
+			})?;
+
+		let Some(state_key) = state_event_json.get("state_key").and_then(|k| k.as_str()) else {
+			return Err!(Request(InvalidParam(debug_info!(
+				"PDU in invite state ({state_event_id}) is not a state event"
+			))));
+		};
+		let Some(event_type) = state_event_json.get("type").and_then(|k| k.as_str()) else {
+			return Err!(Request(InvalidParam(debug_warn!(
+				"PDU in invite state ({state_event_id}) is not an event?"
+			))));
+		};
+
+		let key = StateEventType::from(event_type).with_state_key(state_key);
+		match invite_state_map.entry(key) {
+			| Entry::Occupied(entry) =>
+				return Err!(Request(InvalidParam(
+					"Duplicate state events in invite state for state key: {:?}",
+					entry.key(),
+				))),
+			| Entry::Vacant(entry) => {
+				if entry.key().0 == StateEventType::RoomCreate {
+					// Ensure this is a legal create event.
+					let pdu_event =
+						PduEvent::from_id_val(&state_event_id, state_event_json.clone())
+							.expect("must be able to create pdu event from event json");
+					debug!("Validating discovered create event in invite room state");
+					validate_invite_create_event(&pdu_event, room_version_rules).await?;
+					create_event_id = Some(state_event_id);
+				}
+				entry.insert(state_event_json);
+			},
+		}
+	}
+	let Some(create_event_id) = create_event_id else {
+		return Err!(Request(InvalidParam(debug_warn!(
+			parsed_state=?invite_state_map,
+			"Invite state does not contain the m.room.create event"
+		))));
+	};
+	invite_state_map.iter().try_for_each(|(key, event_json)| {
+		service::rooms::event_handler::Service::pdu_format_check_1(
+			event_json,
+			room_version_rules,
+			&create_event_id,
+		)
+		.map_err(|e| {
+			err!(Request(InvalidParam(
+				"PDU in invite state for {key:?} violates the room event format: {e}"
+			)))
+		})
+	})?;
+
+	Ok((create_event_id, invite_state_map))
+}
+
+#[derive(Deserialize)]
+struct MFederate {
+	#[serde(rename = "m.federate")]
+	mfederate: Option<bool>,
+}
+
+/// Validates that a create event is suitable for the invite, namely:
+///
+/// 1. It passes auth checks (aka is valid)
+/// 2. The room is federated (there's no point persisting unfederated rooms)
+async fn validate_invite_create_event(
+	pdu: &PduEvent,
+	room_version_rules: &RoomVersionRules,
+) -> Result {
+	if !state_res::auth_check(
+		room_version_rules,
+		pdu,
+		None,
+		|_, _| async {
+			unreachable!("No state should be fetched when processing a lone create event");
+		},
+		pdu,
+	)
+	.await
+	.unwrap_or_default()
+	{
+		return Err!(Request(InvalidParam("m.room.create event fails auth check")));
+	}
+
+	let can_federate = pdu.get_content::<MFederate>()?.mfederate;
+	if !can_federate.unwrap_or(true) {
+		return Err!(Request(InvalidParam(
+			"Cannot receive invites to a room with m.federate=false"
+		)));
+	}
+
+	Ok(())
+}
@@ -75,14 +75,6 @@ pub(crate) async fn create_join_event_template_route(
 		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
 	}

-	if let Some(server) = body.room_id.server_name() {
-		if services.moderation.is_remote_server_forbidden(server) {
-			return Err!(Request(Forbidden(warn!(
-				"Room ID server name {server} is banned on this homeserver."
-			))));
-		}
-	}
-
 	let room_version = services.rooms.state.get_room_version(&body.room_id).await?;
 	let room_version_rules = room_version.rules().unwrap();
 	if !body.ver.contains(&room_version) {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ginger	4a40290514	chore: News fragment	2026-07-27 14:36:42 -04:00
Ginger	226a3917af	feat: Show dehydrated devices in account panel	2026-07-27 14:36:01 -04:00
timedoutandEllis Git	7920127391	fix: Explicit type error	2026-07-27 16:01:33 +00:00
timedoutandEllis Git	65ff23bd48	fix: Don't treat policy server signing keys as required for signature verification	2026-07-27 16:01:33 +00:00
Renovate BotandEllis Git	3e8bf4a3c7	chore(deps): update rust crate syn to v3	2026-07-27 16:01:11 +00:00
timedout	399005abc6	chore: Move registration notice logic	2026-07-27 16:46:36 +01:00
timedoutandEllis Git	7fdc7f9216	fix: Ensure client IP is logged in all registration alert paths	2026-07-27 15:20:07 +00:00
timedoutandEllis Git	c677847e29	chore: Add newsfrag	2026-07-27 15:20:07 +00:00
timedoutandEllis Git	795cdd3740	fix: Re-introduce registration alerts	2026-07-27 15:20:07 +00:00
timedoutandEllis Git	9894e2a6d1	fix: Rephrase newsfrag	2026-07-27 14:21:38 +00:00
GingerandEllis Git	c8a9eb41c5	refactor: Remove redundant bail_restricted calls	2026-07-27 14:21:38 +00:00
GingerandEllis Git	e431a13a1a	chore: News fragment	2026-07-27 14:21:38 +00:00
GingerandEllis Git	9a3496ae70	feat: Add admin command to issue access tokens	2026-07-27 14:21:38 +00:00
Renovate BotandEllis Git	4cf743883a	chore(deps): update rust-zerover-patch-updates	2026-07-27 01:50:47 +00:00
Renovate Bot	2d719e45fb	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.281.1	2026-07-27 00:29:00 +00:00
Renovate BotandEllis Git	0b456e3492	chore(deps): update rust-non-major	2026-07-27 00:24:50 +00:00
Renovate Bot	eee7a22e26	chore(deps): update ruma digest to 3ad0471	2026-07-26 22:57:51 +00:00
Renovate BotandEllis Git	bc3168ef31	chore(deps): update node-patch-updates to v2.0.18	2026-07-26 22:55:24 +00:00
Renovate BotandEllis Git	a6fd464f32	chore(deps): update dependency cargo-bins/cargo-binstall to v1.21.1	2026-07-26 22:55:18 +00:00
Renovate Bot Ellis Git Ginger	8addb41b5a	chore(deps): Update ruma digest to 04d5d68 Co-authored-by: Ginger <ginger@gingershaped.computer>	2026-07-26 22:54:42 +00:00
Renovate BotandEllis Git	3e10875f86	chore(deps): update https://github.com/actions/setup-node action to v7	2026-07-26 19:26:49 +00:00
Erwan LeboucherandEllis Git	e161b5f01e	perf: Fetch joined member count once per event when notifying	2026-07-26 14:40:34 +00:00
Erwan LeboucherandEllis Git	a0fa4cf0fe	fix: Deliver simplified sliding sync account data without hanging	2026-07-26 14:17:21 +00:00
Erwan LeboucherandEllis Git	08c22b5fcc	fix(sync): Wake local target user after membership changes are committed	2026-07-26 14:12:37 +00:00
timedout	a7892b296f	chore: Resolve clippy lints post-rebase	2026-07-26 15:09:52 +01:00
new-years-eveandtimedout	7f8c2aedc8	refactor: Use a shared helper function for submitting state events at room creation On room creation, A list of initial state events may be provided that should be submitted to the room after creation. These events should be treated as any other state event and submitted to the same checks. With this change, state events submitted on room creation will be submitted through the same helper as those through the usual endpoint. The submission helper is moved to the timeline service to make it available everywhere. This will be useful for implementing MSC4140 (issue #903).	2026-07-26 15:06:38 +01:00
Ginger	8cde2ad0cc	fix: Fix missing migration logic	2026-07-25 15:18:13 -04:00
GingerandEllis Git	64b14cfad2	chore: News fragment	2026-07-25 14:16:34 +00:00
GingerandEllis Git	7cc5e44093	fix: Exclude deactivated users and AS puppets from user count	2026-07-25 14:16:34 +00:00
reasterandEllis Git	a838d59cfc	make clippy happy again	2026-07-25 13:55:30 +00:00
reasterandEllis Git	fb7a378d63	deduplicate rooms in hierarchy traversal	2026-07-25 13:55:30 +00:00
Erwan LeboucherandEllis Git	4727f07e26	fix: Correct roomuserid_lastnotificationread table alias roomuserid_lastnotificationread was mapped to userroomid_highlightcount instead of its own table, so last_notification_read() read the highlight count and reset_notification_counts clobbered the highlight table when setting a read marker. Add the missing table definition and fix the alias.	2026-07-24 01:13:42 +00:00
lvenerisandEllis Git	aa612baef3	fix(nix): use correct toolchain for rustfmt	2026-07-22 23:53:35 +00:00
Erwan Leboucher	b144b18aef	fix(sync): Verify state for newly-left rooms is in incremental sync	2026-07-21 18:32:34 +00:00
gingerandEllis Git	4f1af01bdc	chore: Formatting	2026-07-21 18:26:02 +00:00
gingerandEllis Git	1ff0d8d5a4	fix: Fix oauth auth code flow grant page being broken	2026-07-21 18:23:39 +00:00
Omar PakkerandEllis Git	bee92b58e7	chore: Add towncrier news fragment	2026-07-21 14:35:55 +00:00
Omar PakkerandEllis Git	b9c6d5956f	feat: Introduce `accepted_ip_sources` as a multiple options variant of `request_ip_source` The current `request_ip_source` setting only allows a single option. While it does fall back to the peer IP if the header is missing as of !2003, which likely covers a lot of regular use, only allowing a single option limits the deployment options available to more advanced deployments. Setups where internal and external traffic use different reverse proxies will end up with the wrong IP and the implicitness of the fallback allows for situations where the used IP is not the IP expected. By introducing a setting that allows multiple options to be set, this limitation is resolved and it becomes possible to have client IP resolution behind different reverse proxies and also making it possible to decide if and/or what the fallback should be. If set, options are evaluated in order. If all fail, the request fails.	2026-07-21 14:35:55 +00:00
Logan DevineandEllis Git	480e975877	chore: clean up unused imports of ClientIp	2026-07-21 14:31:16 +00:00
timedoutandEllis Git	6ce0d63733	meta: Update expectations section and call out attribution	2026-07-21 14:19:42 +00:00
timedoutandEllis Git	e54252651b	meta: Update security policy	2026-07-21 14:19:42 +00:00
GingerandEllis Git	8f60648009	fix: Use correct error code for invalid client ID	2026-07-21 13:42:50 +00:00
GingerandEllis Git	4c9426a13f	feat: Add support for OAuth2 device auth flow	2026-07-21 13:42:50 +00:00
Deniel9204	25264308ab	fix: Use the requested device ID when an appservice creates a device The appservice branch of update_device_route (MSC4190 device creation) generated a random device ID instead of using the one from the request path, and dropped the requested display name. The PUT returned 200, but the device the appservice asked for never existed, so every subsequent request masquerading as that device failed with M_FORBIDDEN and one orphaned random-ID device was left behind per attempt. This made encrypted mautrix (bridgev2) bridges unable to start on OIDC-enabled servers, where MSC4190 is the only available device creation mechanism: /keys/upload failed on first start and /keys/query on every restart. Combined with the pre-1f5e178c3f behaviour (400 "Token conflicts with an existing appservice token"), MSC4190 device creation has never worked end-to-end in any release. Create the device under the requested ID and forward the requested display name.	2026-07-21 08:21:09 +02:00
Renovate Bot	bcd57b9598	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.272.6	2026-07-21 05:10:42 +00:00
Renovate Bot	b2dee05ccf	chore(deps): update github-actions-digest	2026-07-21 05:02:36 +00:00
timedout	8b3be67860	feat: Increase access token length Reviewed-By: ginger <ginger@gingershaped.computer>	2026-07-19 15:06:23 +01:00
Jade Ellis	153ef3a173	ci: Attempt to delay major rust toolchain updates	2026-07-17 19:18:38 +01:00
renovateandEllis Git	2441dfe436	chore(Nix): Updated flake hashes	2026-07-17 17:58:23 +00:00
Renovate BotandEllis Git	d149833b7a	chore(deps): update rust to v1.97.1	2026-07-17 17:58:23 +00:00
Erwan LeboucherandEllis Git	b1632ee60b	fix(register): Resolve alias service by correct name for auto-join	2026-07-17 17:57:51 +00:00
timedoutandEllis Git	789589ef37	chore: Remove redundant client IP extractions on individual routes	2026-07-17 12:57:48 +00:00
timedoutandEllis Git	1e47090f5d	feat: Log client IP in router layer	2026-07-17 12:57:48 +00:00
GingerandEllis Git	3e55d08488	fix: Only return create prompt if registration is enabled	2026-07-17 12:49:15 +00:00
Erwan LeboucherandEllis Git	3a74ce6151	fix(client-ip): Fall back to peer IP instead of returning 500	2026-07-17 12:46:11 +00:00
Erwan LeboucherandEllis Git	eff454218c	fix(sync): Send full state for newly-joined rooms in incremental sync	2026-07-17 02:48:28 +00:00
Erwan Leboucher	e2eb980b5e	fix(sync): Stop waking sync loops when removing to-device events	2026-07-16 22:15:27 +02:00
Erwan Leboucher	8945cc9e10	fix(federation): Sign restricted join events before verification	2026-07-16 19:46:42 +00:00
Julian Anderson	78adeccda1	docs(deploying/rpm): Update out-of-date statement about Oracle Linux version availability	2026-07-15 23:23:10 -04:00
Renovate Bot	8195373d81	chore(deps): update rust-non-major	2026-07-15 05:05:03 +00:00
Erwan Leboucher	1ac05838dd	docs: Add back binstall with a link to the deps	2026-07-14 19:44:28 +02:00
Erwan Leboucher	7ecd2aa5e2	fix(pdu): Exempt m.room.create from auth_events check	2026-07-14 19:27:46 +02:00
Renovate BotandEllis Git	69a3145983	chore(deps): update rust-zerover-patch-updates	2026-07-14 13:10:32 +00:00
N00byKing	73b7553b1e	chore: Add changelog entry for #1984	2026-07-14 13:40:28 +02:00
N00byKing	232ec3f620	fix: Return 201 instead of 200 on oauth registration See RFC 7591 at 3.2.1: "The server responds with an HTTP 201 Created status code [...]" Fixes a failure in matrix-dart-sdk	2026-07-14 11:00:34 +02:00
N00byKing	e52bbeaf94	fix: Correct link for code style guide in CONTRIBUTING.md	2026-07-14 08:59:08 +00:00
Renovate Bot	ad1c194fb0	chore(deps): update github-actions-digest	2026-07-14 05:01:52 +00:00
GingerandEllis Git	5e2dcd8e79	chore: News fragment	2026-07-13 20:38:10 +00:00
GingerandEllis Git	24c6474bd1	fix: Allow unstable and stable device id query together	2026-07-13 20:38:10 +00:00
gingerandEllis Git	642d05048b	chore: announce	2026-07-13 18:54:04 +00:00
Koen OostveenandEllis Git	446ae93ad7	fix(web): Change incorrect deeplink for deleting a device	2026-07-13 13:45:46 +00:00
Renovate BotandEllis Git	9ca0774b2d	chore(deps): lock file maintenance	2026-07-13 13:44:47 +00:00
Ginger	ce494eb0c0	fix: Properly sync newly created rooms	2026-07-13 08:50:53 -04:00
Ginger	1f5e178c3f	fix: Properly handle appservice device creation	2026-07-13 08:50:48 -04:00
Renovate Bot	ddd050d402	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.260.2	2026-07-13 05:03:24 +00:00
Ginger	6ad3e679bc	chore: Release	2026-07-12 17:34:16 -04:00
Ginger	65812bb246	chore: Update changelog	2026-07-12 17:33:52 -04:00
theS1LV3R	9f3a7994c7	chore: Changelog	2026-07-12 20:22:19 +02:00
theS1LV3R	baef3289fe	fix(service/admin): Prevent console from being spawned when no TTY is available	2026-07-12 20:22:18 +02:00
Ginger	9a94b93ddd	fix: Fix new database migrations running on every server startup	2026-07-12 12:31:12 -04:00
Gingerandtimedout	0ac0bd93ae	fix: Default deserialize for `compatibility_mode`	2026-07-12 16:28:27 +01:00
Gingerandtimedout	fe9f718c6e	fix: Stop using the federation DNS resolver for non-federation requests	2026-07-12 16:11:00 +01:00
nexandEllis Git	e333f5a8e5	chore: announce	2026-07-12 04:14:23 +00:00
Ginger	b8c64a68d4	chore: Release	2026-07-12 00:09:26 -04:00
Ginger	163f049757	chore: Update changelog	2026-07-12 00:07:20 -04:00
Ginger	f48125c37a	fix: Remove dependency on aws-lc-rs	2026-07-11 22:48:30 -04:00
timedoutandEllis Git	4001b99261	style: Make send_join's docstring more useful	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	b6e5a106ff	fix: Don't unhelpfully panic when encountering an unrecognised room version	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	e1eea45fd6	style: Fix EOL	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	7cb53f41d6	chore: Add newsfrag	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	fbf81fcdeb	fix: Opportunistically re-use room format rules when parsing incoming PDUs	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	87030a3a22	fix: Ensure PDU returned by `create_hash_and_sign_event` is itself signed	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	4f509fa113	fix: Convert room summary to federation format when sending invites	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	aa7ed885c0	fix: Check correct field name when determining event type	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	d5e6e617d1	fix: Remove redundant banned room server checks These don't make sense here anyway	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	1f7680ad5f	feat: Give send_join the invite treatment	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	0c37a542d4	feat: Give send_leave the invite treatment	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	efd07da0d7	feat: Give send_knock the invite treatment	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	f0590e882a	fix: Only run ACL checks when we know we have live state Prevents a potential bug where we might inadvertently reject valid invites because we have a stale state cache that blocks the sender or even ourselves Also fixes the banned remote server room check by using the create event instead of room ID	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	7225bf25ae	feat: Persist create events received during the invite process	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	e52bb5db69	style: Move invite validation into own functions	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	995726923b	feat: Enforce new federation invite checks These were introduced in spec v1.16 however we didn't implement them until now for compatibility.	2026-07-12 02:11:50 +00:00
GingerandEllis Git	556141b404	fix: Trim whitespace from OIDC client secret file	2026-07-12 02:06:48 +00:00
				`@@ -0,0 +1 @@`
				`Added support for the OAuth2 device authorization flow. Contributed by @ginger`
				`@@ -0,0 +1 @@`
				Fixed requests returning `500 Internal Server Error` when the header selected by `request_ip_source` is absent, duplicated, or malformed (for example Envoy omitting `X-Envoy-External-Address` on internal requests). The client IP now falls back to the connection peer address instead of failing the request. Contributed by @eleboucher
				`@@ -0,0 +1 @@`
				`Appservices are now properly able to create devices for E2EE.`
				`@@ -0,0 +1 @@`
				`Resolve alias service by correct name for auto-join. Contributed by @eleboucher`
				`@@ -0,0 +1 @@`
				`Fixed newly joined rooms failing to sync their full state (including the room name) to clients using legacy sync.`
				`@@ -1 +0,0 @@`
				`Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.`
				`@@ -0,0 +1 @@`
				Fixed `roomuserid_lastnotificationread` being aliased to the highlight count table, which clobbered highlight counts when setting a read marker. Contributed by @eleboucher
				`@@ -0,0 +1 @@`
				Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
				`@@ -0,0 +1 @@`
				`Fetch the joined member count once per event instead of once per notified user.`