chore(deps): update rust-zerover-patch-updates to v0.48.5

chore(deps): update rust-non-major
docs: Add back binstall with a link to the deps
2026-07-16 21:52:06 +00:00 · 2026-07-16 05:03:24 +00:00 · 2026-07-15 05:05:03 +00:00 · 2026-07-14 19:44:28 +02:00 · 2026-07-14 19:27:46 +02:00 · 2026-07-14 13:10:32 +00:00
62 changed files with 1038 additions and 969 deletions
@@ -71,7 +71,7 @@ runs:

    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
+      uses: https://github.com/taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1

@@ -65,7 +65,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          draft: true
          files: binaries/*
@@ -32,7 +32,7 @@ jobs:

      - name: Setup Node.js
        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 22

@@ -24,7 +24,7 @@ jobs:

    steps:
      - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "22"

@@ -218,7 +218,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          draft: true
          files: binaries/*
@@ -43,7 +43,7 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.252.1@sha256:121eb04ef758537019fb58f587aa53c99e5fda4e703993ce2ca01bd4b3926bd4
+      image: ghcr.io/renovatebot/renovate:43.260.2@sha256:60d830108d9ff6408d11a55d5f110ee0976bed78a6b82b08211e3ddb72f72952
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
@@ -1,3 +1,27 @@
+# Continuwuity 26.6.2 (2026-07-12)
+
+## Bugfixes
+
+- Fixed the server returning 500 errors if `admin_console_automatic` is enabled and no TTY is available. Contributed by @s1lv3r. (#1975)
+- Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
+- Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.
+
+
+# Continuwuity 26.6.1 (2026-07-12)
+
+## Features
+
+- Added enforcement for new federated invite checks and corrected a bunch of related spec compliance issues along the way. Contributed by @nex. (#1952)
+
+## Bugfixes
+
+- Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`. (#1942)
+- Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint. (#1953)
+- Fixed newly created rooms failing to sync properly in clients using legacy sync.
+- Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.
+- Whitespace will now automatically be trimmed from the start and end of the `global.oauth.oidc.client_secret_file`.
+
+
 # Continuwuity 26.6.0 (2026-07-10)

 ## Features
@@ -26,7 +26,7 @@ ### Pre-commit Checks


 ```bash
-# Install prek using cargo-binstall
+# Install prek using cargo-binstall https://github.com/cargo-bins/cargo-binstall
 cargo binstall prek

 # Install git hooks to run checks automatically
@@ -155,7 +155,7 @@ ### Creating pull requests

 Before submitting a pull request, please ensure:
 1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
-2. Your code follows the [code style guide](/development/code_style.md)
+2. Your code follows the [code style guide](docs/development/code_style.mdx)
 3. Your commit messages follow the conventional commits format
 4. Tests are added for new functionality
 5. Documentation is updated if needed
@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.6.0"
+version = "26.6.2"

 [workspace.metadata.crane]
 name = "conduwuit"
@@ -141,12 +141,6 @@ features = [
 version = "0.23.25"
 default-features = false

-[workspace.dependencies.aws-lc-sys]
-version = "0.41.0"
-
-[workspace.dependencies.aws-lc-rs]
-version = "1.17.0"
-
 [workspace.dependencies.reqwest]
 version = "0.13.2"
 default-features = false
@@ -570,7 +564,7 @@ features = ["std"]
 version = "0.3.0"

 [workspace.dependencies.resolvematrix]
-version = "1.1.0"
+version = "1.2.0"

 [workspace.dependencies.serde_urlencoded]
 version = "0.7.1"
@@ -0,0 +1 @@
+Appservices are now properly able to create devices for E2EE.
@@ -1 +0,0 @@
-Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.
@@ -0,0 +1 @@
+Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
@@ -1 +0,0 @@
-Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`.
@@ -1 +0,0 @@
-Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint.
@@ -0,0 +1 @@
+Fixed the deeplink redirect for deleting devices. Contributed by @koen
@@ -0,0 +1 @@
+Fix status code for oauth registration. Contributed by @n00byking
@@ -0,0 +1 @@
+Exempt m.room.create from auth_events check. Contributed by @eleboucher
@@ -6,10 +6,10 @@
            "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
        },
        {
-            "id": 15,
+            "id": 16,
            "mention_room": true,
-            "date": "2026-07-10",
-            "message": "[Continuwuity 26.6.0](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.0) is finally out! This is by far our largest release yet, and it wouldn't have been possible without our community. Thank you so much for all of your patience, support, and/or development time over the last three months <3"
+            "date": "2026-07-13",
+            "message": "[Continuwuity 26.6.2](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release fixes a severe bug with OIDC that could cause users' accounts to be flagged as deactivated. If you use OIDC, please update as soon as possible."
        }
    ]
 }
@@ -3,11 +3,11 @@
    "advisory-db": {
      "flake": false,
      "locked": {
-        "lastModified": 1781566179,
-        "narHash": "sha256-Tqv8I586fYzWpEW/Smq/JqESFa3DVVzVWsnAMtvhy/I=",
+        "lastModified": 1783840254,
+        "narHash": "sha256-XjyvZk0f3YiinVHmkGOotmLBAzvK+LwEJYj2QqJ5pn8=",
        "owner": "rustsec",
        "repo": "advisory-db",
-        "rev": "74e084413d979d52d2f93b1d93b1ab7b9ee648f5",
+        "rev": "6e3286f4efa8c142fb33e5ea4342c8db6693cf34",
        "type": "github"
      },
      "original": {
@@ -18,11 +18,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1780532242,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
+        "lastModified": 1783203018,
+        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
+        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
        "type": "github"
      },
      "original": {
@@ -39,11 +39,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1781527054,
-        "narHash": "sha256-1fX9ev2Fh5QoKQ41G9dYutjo5j/jywu6tZse5Eb1Ck4=",
+        "lastModified": 1783844668,
+        "narHash": "sha256-3MOpw4y3reoErRLvFBDz0t9aG6FWXUj7leKvUns5eQA=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "8c2e51dffefc040a21975da7abf6f252c8c9b783",
+        "rev": "4e49ef62eedaa5c149d62b63b3f53844e1cc45d7",
        "type": "github"
      },
      "original": {
@@ -74,11 +74,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
        "type": "github"
      },
      "original": {
@@ -89,11 +89,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "lastModified": 1783776592,
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
        "type": "github"
      },
      "original": {
@@ -105,11 +105,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1777168982,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
        "type": "github"
      },
      "original": {
@@ -132,11 +132,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1781453968,
-        "narHash": "sha256-+V3nK4pCngbmgyVGXY6Kkrlevp4ocPkJJLf2aqwkDNA=",
+        "lastModified": 1783779020,
+        "narHash": "sha256-vpm418WZa9l1KUl6HRs+Ga+SIfE+D2/sV4olwTlilYc=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "cc272809a173c2c11d0e479d639c811c1eacf049",
+        "rev": "5be5e89cf0145d73a85c805726821b4adfc3af48",
        "type": "github"
      },
      "original": {
@@ -510,14 +510,14 @@
      }
    },
    "node_modules/@shikijs/core": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.2.0.tgz",
-      "integrity": "sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
+      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/primitive": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/primitive": "4.3.1",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4",
        "hast-util-to-html": "^9.0.5"
@@ -527,13 +527,13 @@
      }
    },
    "node_modules/@shikijs/engine-javascript": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.2.0.tgz",
-      "integrity": "sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
+      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "oniguruma-to-es": "^4.3.6"
      },
@@ -542,13 +542,13 @@
      }
    },
    "node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.2.0.tgz",
-      "integrity": "sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.3.1.tgz",
+      "integrity": "sha512-OXyNMzg0pews+msMj4cHeqT4xiYKKvbnn6VbdAXxfoFl3SSx4fJTc8FadECuc5/H9p3BzhNAoAUXKwAu9rWYhg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2"
      },
      "engines": {
@@ -556,26 +556,26 @@
      }
    },
    "node_modules/@shikijs/langs": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.2.0.tgz",
-      "integrity": "sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
+      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/primitive": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.2.0.tgz",
-      "integrity": "sha512-NOq+DtUkVBJtZMVXL5A0vI0Xk8nvDYaXetFHSJFlOqjDZIVhIPRYFdGkSoElDqNuegikcc3A76SNUa8dTqtAYA==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.3.1.tgz",
+      "integrity": "sha512-CXQRQOYy1leqQ8ceTeJdmXv/bsUY++6QyLpXJ94LZAAYj5X2SKRdc5ipguv4NPyGVKItB2PPwUpRNe0Sjh5S1A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -584,16 +584,16 @@
      }
    },
    "node_modules/@shikijs/rehype": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.2.0.tgz",
-      "integrity": "sha512-ST3EWye/dwF1gWskczJNBnwFtDzEQ9ceytXZtyc/GfwR5V0qJrkoSGZO55O3SAKDDsXkTDcsfwd9pVe7ROlAHg==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.3.1.tgz",
+      "integrity": "sha512-oshrlfUF3VPUJfnp5K1lLwsS/SRBKrIxONpdWebSKZXdBE3UsZnxgqpvRUA8UsofS7vmjFOCAHIT71ECbmOxTw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@types/hast": "^3.0.4",
        "hast-util-to-string": "^3.0.1",
-        "shiki": "4.2.0",
+        "shiki": "4.3.1",
        "unified": "^11.0.5",
        "unist-util-visit": "^5.1.0"
      },
@@ -602,22 +602,22 @@
      }
    },
    "node_modules/@shikijs/themes": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
-      "integrity": "sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
+      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/types": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -684,9 +684,9 @@
      }
    },
    "node_modules/@types/hast": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.4.tgz",
-      "integrity": "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==",
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
+      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -1076,9 +1076,9 @@
      }
    },
    "node_modules/@ungap/structured-clone": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
+      "integrity": "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==",
      "dev": true,
      "license": "ISC"
    },
@@ -3589,18 +3589,18 @@
      "license": "MIT"
    },
    "node_modules/shiki": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz",
-      "integrity": "sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.3.1.tgz",
+      "integrity": "sha512-oR+qDVi2OjX1tmDpyv+3KviX01KzO6Af+0NNnKnsp9491UEGz2YpxTuJboS/6VhYpTdqzmuJBuiTlrAWWJAssw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/core": "4.2.0",
-        "@shikijs/engine-javascript": "4.2.0",
-        "@shikijs/engine-oniguruma": "4.2.0",
-        "@shikijs/langs": "4.2.0",
-        "@shikijs/themes": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/core": "4.3.1",
+        "@shikijs/engine-javascript": "4.3.1",
+        "@shikijs/engine-oniguruma": "4.3.1",
+        "@shikijs/langs": "4.3.1",
+        "@shikijs/themes": "4.3.1",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -486,7 +486,7 @@ pub(super) async fn get_remote_pdu(
 						.services
 						.rooms
 						.event_handler
-						.parse_incoming_pdu(&response.pdu)
+						.parse_incoming_pdu(&response.pdu, None)
 						.boxed()
 						.await;

@@ -832,7 +832,7 @@ pub(super) async fn force_set_room_state_from_server(
 				.services
 				.rooms
 				.event_handler
-				.parse_incoming_pdu(&pdu)
+				.parse_incoming_pdu(&pdu, Some(&room_version_rules))
 				.await
 			{
 				| Ok(t) => t,
@@ -1014,7 +1014,7 @@ pub(super) async fn resolve_true_destination(
 		let resolver: &MatrixResolver = if no_cache {
 			&MatrixResolverBuilder::new()
 				.dangerous_tls_accept_invalid_certs(self.services.server.config.allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure)
-				.http_client(self.services.client.default.clone())
+				.http_client(self.services.client.dns.clone())
 				.build()?
 		} else {
 			&self.services.client.matrix_resolver
@@ -54,7 +54,7 @@ pub(super) async fn fetch_support_well_known(&self, server_name: OwnedServerName
 		let response = self
 			.services
 			.client
-			.default
+			.external_resource
 			.get(format!("https://{server_name}/.well-known/matrix/support"))
 			.send()
 			.await?;
@@ -26,7 +26,7 @@
 };
 use service::{mailer::messages, uiaa::UiaaInitiator, users::HashedPassword};

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
+use super::DEVICE_ID_LENGTH;
 use crate::{Ruma, router::ClientIdentity};

 pub(crate) mod register;
@@ -20,9 +20,12 @@
 	assign,
 };
 use serde_json::value::RawValue;
-use service::{mailer::messages, users::HashedPassword};
+use service::{
+	mailer::messages,
+	users::{DeviceToken, HashedPassword},
+};

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
+use super::DEVICE_ID_LENGTH;
 use crate::Ruma;

 /// # `POST /_matrix/client/v3/register`
@@ -119,7 +122,7 @@ pub(crate) async fn register_route(
 			.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());

 		// Generate new token for the device
-		let new_token = utils::random_string(TOKEN_LENGTH);
+		let new_token = DeviceToken::new_random();

 		// Create device for this account
 		services
@@ -127,8 +130,7 @@ pub(crate) async fn register_route(
 			.create_device(
 				&user_id,
 				&device_id,
-				&new_token,
-				None,
+				Some(new_token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -142,7 +144,7 @@ pub(crate) async fn register_route(
 	debug_info!(%user_id, ?device, "New account created via legacy registration");

 	Ok(assign!(register::v3::Response::new(user_id), {
-		access_token: token,
+		access_token: token.map(DeviceToken::into_token),
 		device_id: device,
 		refresh_token: None,
 		expires_in: None,
@@ -89,14 +89,7 @@ pub(crate) async fn update_device_route(

 			services
 				.users
-				.create_device(
-					sender_user,
-					&device_id,
-					&appservice.registration.as_token,
-					None,
-					None,
-					Some(client.to_string()),
-				)
+				.create_device(sender_user, &device_id, None, None, Some(client.to_string()))
 				.await?;

 			return Ok(update_device::v3::Response::new());
@@ -3,7 +3,7 @@
 use conduwuit::{
 	Err, Result, debug_error, err, info,
 	matrix::{event::gen_event_id_canonical_json, pdu::PartialPdu},
-	warn,
+	trace, warn,
 };
 use futures::FutureExt;
 use ruma::{
@@ -166,7 +166,7 @@ pub(crate) async fn invite_helper(
 			let invite_room_state = services
 				.rooms
 				.state
-				.summary_stripped(&pdu, room_id, recipient_user)
+				.summary_stripped(&pdu, room_id, recipient_user, true)
 				.await;

 			drop(state_lock);
@@ -193,6 +193,7 @@ pub(crate) async fn invite_helper(
 			.await
 			.ok();

+		trace!(?request, "Sending invite");
 		let response = services
 			.sending
 			.send_federation_request(recipient_user.server_name(), request)
@@ -24,5 +24,5 @@ pub(crate) async fn register_client_route(
 		.await
 		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;

-	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
+	Ok((StatusCode::CREATED, Json(RegisteredClient { client_id, metadata })).into_response())
 }
@@ -29,8 +29,9 @@
 	},
 	assign,
 };
+use service::users::DeviceToken;

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
+use super::DEVICE_ID_LENGTH;
 use crate::Ruma;

 /// # `GET /_matrix/client/v3/login`
@@ -196,8 +197,8 @@ pub(crate) async fn login_route(
 		.clone()
 		.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());

-	// Generate a new token for the device (ensuring no collisions)
-	let token = services.users.generate_unique_token().await;
+	// Generate a new token for the device
+	let token = DeviceToken::new_random();

 	// Determine if device_id was provided and exists in the db for this user
 	let device_exists = if body.device_id.is_some() {
@@ -213,7 +214,7 @@ pub(crate) async fn login_route(
 	if device_exists {
 		services
 			.users
-			.set_token(&user_id, &device_id, &token, None)
+			.set_token(&user_id, &device_id, token.clone())
 			.await?;
 	} else {
 		services
@@ -221,8 +222,7 @@ pub(crate) async fn login_route(
 			.create_device(
 				&user_id,
 				&device_id,
-				&token,
-				None,
+				Some(token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -241,7 +241,7 @@ pub(crate) async fn login_route(
 	info!("{user_id} logged in");

 	#[allow(deprecated)]
-	Ok(assign!(login::v3::Response::new(user_id, token, device_id), {
+	Ok(assign!(login::v3::Response::new(user_id, token.into_token(), device_id), {
 		well_known: client_discovery_info,
 		expires_in: None,
 		home_server: Some(services.config.server_name.clone()),
@@ -273,7 +273,7 @@ pub(crate) async fn login_token_route(
 		.authenticate_password(&body.auth, sender_user, body.identity.sender_device(), None)
 		.await?;

-	let login_token = utils::random_string(TOKEN_LENGTH);
+	let login_token = DeviceToken::new_random().into_token();
 	let expires_in = services.users.create_login_token(sender_user, &login_token);

 	Ok(get_login_token::v1::Response::new(
@@ -15,10 +15,9 @@
 #[derive(Deserialize)]
 pub(crate) struct AuthQueryParams {
 	pub(super) user_id: Option<String>,
-	/// Device ID for appservice device masquerading (MSC3202/MSC4190).
-	/// Can be provided as `device_id` or `org.matrix.msc3202.device_id`.
-	#[serde(alias = "org.matrix.msc3202.device_id")]
 	pub(super) device_id: Option<String>,
+	#[serde(rename = "org.matrix.msc3202.device_id")]
+	pub(super) legacy_device_id: Option<String>,
 }

 /// Extractor for Ruma request structs
@@ -219,25 +219,29 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
 			// The device_id can be provided via `device_id` or
 			// `org.matrix.msc3202.device_id` query parameter.
-			let sender_device =
-				if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
-					// Verify the device exists for this user
-					if services
-						.users
-						.get_device_metadata(&sender_user, device_id)
-						.await
-						.is_err()
-					{
-						return Err!(Request(Forbidden(
-							"Device does not exist for user or appservice cannot masquerade as \
-							 this device."
-						)));
-					}
+			let sender_device = if let Some(device_id) = query
+				.device_id
+				.or(query.legacy_device_id)
+				.as_deref()
+				.map(Into::into)
+			{
+				// Verify the device exists for this user
+				if services
+					.users
+					.get_device_metadata(&sender_user, device_id)
+					.await
+					.is_err()
+				{
+					return Err!(Request(Forbidden(
+						"Device does not exist for user or appservice cannot masquerade as this \
+						 device."
+					)));
+				}

-					Some(device_id.to_owned())
-				} else {
-					None
-				};
+				Some(device_id.to_owned())
+			} else {
+				None
+			};

 			Ok(ClientIdentity::Appservice {
 				sender_user,
@@ -1,23 +1,29 @@
+use std::collections::{HashMap, hash_map::Entry};
+
 use axum::extract::State;
 use axum_client_ip::ClientIp;
 use base64::{Engine as _, engine::general_purpose};
 use conduwuit::{
-	Err, Error, PduEvent, Result, err, error,
-	matrix::{Event, event::gen_event_id},
-	utils::{self, hash::sha256},
+	Err, Error, EventTypeExt, PduEvent, Result, debug, err, error,
+	matrix::{Event, StateKey},
+	result::FlatOk,
+	state_res, trace,
+	utils::hash::sha256,
 	warn,
 };
 use ruma::{
-	CanonicalJsonValue, UserId,
+	CanonicalJsonObject, CanonicalJsonValue, OwnedEventId, OwnedRoomId, OwnedUserId, ServerName,
+	UserId,
 	api::{
 		error::{ErrorKind, IncompatibleRoomVersionErrorData},
 		federation::membership::{RawStrippedState, create_invite},
 	},
-	events::room::member::{MembershipState, RoomMemberEventContent},
-	serde::JsonObject,
+	events::{StateEventType, room::member::MembershipState},
+	room_version_rules::RoomVersionRules,
 };
+use serde::Deserialize;

-use crate::Ruma;
+use crate::{Ruma, server::utils::validate_any_membership_event};

 /// # `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}`
 ///
@@ -28,30 +34,16 @@ pub(crate) async fn create_invite_route(
 	ClientIp(client): ClientIp,
 	body: Ruma<create_invite::v2::Request>,
 ) -> Result<create_invite::v2::Response> {
-	// ACL check origin
-	services
-		.rooms
-		.event_handler
-		.acl_check(&body.identity, &body.room_id)
-		.await?;
-
 	if !services.server.supported_room_version(&body.room_version) {
 		return Err(Error::BadRequest(
 			ErrorKind::IncompatibleRoomVersion(IncompatibleRoomVersionErrorData::new(
 				body.room_version.clone(),
 			)),
-			"Server does not support this room version.",
+			"This server does not support that room version",
 		));
 	}
-
 	let room_version_rules = body.room_version.rules().unwrap();

-	if let Some(server) = body.room_id.server_name() {
-		if services.moderation.is_remote_server_forbidden(server) {
-			return Err!(Request(Forbidden("Server is banned on this homeserver.")));
-		}
-	}
-
 	if services
 		.moderation
 		.is_remote_server_forbidden(&body.identity)
@@ -61,90 +53,61 @@ pub(crate) async fn create_invite_route(
 			body.identity, body.room_id
 		);

-		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
+		return Err!(Request(Forbidden("Federation denied with {}", body.identity)));
 	}

-	let mut signed_event = utils::to_canonical_object(&body.event)
-		.map_err(|_| err!(Request(InvalidParam("Invite event is invalid."))))?;
-
-	// Ensure this is a membership event
-	if signed_event
-		.get("type")
-		.expect("event must have a type")
-		.as_str()
-		.expect("type must be a string")
-		!= "m.room.member"
-	{
-		return Err!(Request(BadJson(
-			"Not allowed to send non-membership event to invite endpoint."
-		)));
-	}
-
-	let content: RoomMemberEventContent = serde_json::from_value(
-		signed_event
-			.get("content")
-			.ok_or_else(|| err!(Request(BadJson("Event missing content property"))))?
-			.clone()
-			.into(),
+	// First, validate the invite room state, so we can compare with the create
+	// event.
+	debug!(
+		event_id=%body.event_id,
+		room_id=%body.room_id,
+		room_version=?body.room_version,
+		via=?body.via,
+		"Validating invite room state for invite request"
+	);
+	let (create_event_id, state) = validate_invite_state(
+		&services,
+		&body.invite_room_state,
+		&room_version_rules,
+		body.room_id.clone(),
 	)
-	.map_err(|e| err!(Request(BadJson(warn!("Event content is empty or invalid: {e}")))))?;
+	.await?;
+	let create_event_json = state
+		.get(&StateEventType::RoomCreate.with_state_key(""))
+		.expect("must have create event in invite state by this point");

-	// Ensure this is an invite membership event
-	if content.membership != MembershipState::Invite {
-		return Err!(Request(BadJson(
-			"Not allowed to send a non-invite membership event to invite endpoint."
-		)));
-	}
-
-	// Ensure the sending user isn't a lying bozo
-	let sender_user = signed_event
+	// We can now perform the banned remote server check with the create event.
+	// N.B. this checks the sender field, which is technically incorrect for rooms
+	// v10 and below. This usually isn't the case though so sue me
+	let creator = create_event_json
 		.get("sender")
 		.and_then(|v| v.as_str())
 		.map(UserId::parse)
-		.and_then(Result::ok)
-		.ok_or_else(|| err!(Request(InvalidParam("Invalid sender property"))))?;
-
-	if sender_user.server_name() != body.identity {
-		return Err!(Request(Forbidden("Sender's server does not match the origin server.",)));
-	}
-
-	// Ensure the target user belongs to this server
-	let recipient_user = signed_event
-		.get("state_key")
-		.and_then(|v| v.as_str())
-		.map(UserId::parse)
-		.and_then(Result::ok)
-		.ok_or_else(|| err!(Request(InvalidParam("Invalid state_key property"))))?;
-
-	if !services
-		.globals
-		.server_is_ours(recipient_user.server_name())
+		.flat_ok()
+		.expect("must have valid sender in create event");
+	if services
+		.moderation
+		.is_remote_server_forbidden(creator.server_name())
 	{
-		return Err!(Request(InvalidParam("User does not belong to this homeserver.")));
+		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
 	}

-	// Make sure we're not ACL'ed from their room.
-	services
-		.rooms
-		.event_handler
-		.acl_check(recipient_user.server_name(), &body.room_id)
-		.await?;
-
-	services
-		.server_keys
-		.hash_and_sign_event(&mut signed_event, &room_version_rules)
-		.map_err(|e| err!(Request(InvalidParam("Failed to sign event: {e}"))))?;
-
-	// Generate event id
-	let event_id = gen_event_id(&signed_event, &room_version_rules)?;
-
-	// Add event_id back
-	signed_event.insert("event_id".to_owned(), CanonicalJsonValue::String(event_id.to_string()));
+	// And then we can validate the member event itself
+	let (mut signed_event, sender_user, recipient_user) = validate_invite_membership_event(
+		&services,
+		&body.event,
+		&room_version_rules,
+		&body.identity,
+		create_event_id.clone(),
+		body.room_id.clone(),
+		body.event_id.clone(),
+	)
+	.await?;

 	if services.rooms.metadata.is_banned(&body.room_id).await
 		&& !services.users.is_admin(&recipient_user).await
 	{
-		return Err!(Request(Forbidden("This room is banned on this homeserver.")));
+		return Err!(Request(Forbidden("That room is banned on this homeserver.")));
 	}

 	if services.config.block_non_admin_invites && !services.users.is_admin(&recipient_user).await
@@ -161,30 +124,57 @@ pub(crate) async fn create_invite_route(
 		return Err!(Request(Forbidden("Invite rejected by antispam service.")));
 	}

+	// If we're already in the room, ensure that neither the origin nor ourselves
+	// are ACL'd.
+	let resident = services
+		.rooms
+		.state_cache
+		.server_in_room(services.globals.server_name(), &body.room_id)
+		.await;
+	if resident {
+		services
+			.rooms
+			.event_handler
+			.acl_check(&body.identity, &body.room_id)
+			.await?;
+		services
+			.rooms
+			.event_handler
+			.acl_check(recipient_user.server_name(), &body.room_id)
+			.await
+			.map_err(|_| err!(Request(Forbidden("This server is ACL'd from that room"))))?;
+	}
+
+	services
+		.server_keys
+		.hash_and_sign_event(&mut signed_event, &room_version_rules)
+		.map_err(|e| err!(Request(InvalidParam("Failed to sign event: {e}"))))?;
+
+	// Add event_id back
+	signed_event
+		.insert("event_id".to_owned(), CanonicalJsonValue::String(body.event_id.to_string()));
+
 	let mut invite_state = body.invite_room_state.clone();
-
-	let mut event: JsonObject = serde_json::from_str(body.event.get())
-		.map_err(|e| err!(Request(BadJson("Invalid invite event PDU: {e}"))))?;
-
-	event.insert("event_id".to_owned(), "$placeholder".into());
-
-	let pdu: PduEvent = serde_json::from_value(event.into())
-		.map_err(|e| err!(Request(BadJson("Invalid invite event PDU: {e}"))))?;
-
-	invite_state.push(RawStrippedState::Pdu(
-		serde_json::value::to_raw_value(&pdu).expect("PDU was just created, it must be valid"),
-	));
+	let pdu = PduEvent::from_id_val(&body.event_id, signed_event.clone())
+		.expect("must be able to create PDU object");
+	invite_state.push(RawStrippedState::Pdu(serde_json::value::to_raw_value(&signed_event)?));

 	// If we are active in the room, the remote server will notify us about the
 	// join/invite through /send. If we are not in the room, we need to manually
 	// record the invited state for client /sync through update_membership(), and
 	// send the invite PDU to the relevant appservices.
-	if !services
-		.rooms
-		.state_cache
-		.server_in_room(services.globals.server_name(), &body.room_id)
-		.await
-	{
+	if !resident {
+		// We will start by recording the room's create event as an outlier.
+		// This will allow us to recognise it later in case the sender revokes the
+		// invite over federation later. We could store more state from the invite
+		// request, but we will get that during send_join anyway.
+		// This is safe to just add directly as an outlier as we already auth checked it
+		// during validation.
+		services
+			.rooms
+			.outlier
+			.add_pdu_outlier(&create_event_id, create_event_json);
+
 		services
 			.rooms
 			.state_cache
@@ -240,3 +230,197 @@ pub(crate) async fn create_invite_route(
 			.await,
 	))
 }
+
+/// Validates the *membership event* in the invite request, per the steps listed
+/// under the invite endpoint's [spec].
+///
+/// Returns the validated JSON body, sender user ID, and recipient user ID.
+///
+/// Since this function performs a PDU format check, the create event must be
+/// known ahead of time. This implies validating the invite state before the
+/// invite event itself.
+///
+/// [spec]: https://spec.matrix.org/v1.19/server-server-api/#put_matrixfederationv2inviteroomideventid
+async fn validate_invite_membership_event(
+	services: &crate::State,
+	body: &serde_json::value::RawValue,
+	room_version_rules: &RoomVersionRules,
+	origin: &ServerName,
+	create_event_id: OwnedEventId,
+	room_id: OwnedRoomId,
+	event_id: OwnedEventId,
+) -> Result<(CanonicalJsonObject, OwnedUserId, OwnedUserId)> {
+	trace!(?body, "Invite membership event");
+	let (pdu, target_membership, sender_user, recipient_user) = validate_any_membership_event(
+		services,
+		body,
+		room_version_rules,
+		create_event_id,
+		room_id,
+		event_id,
+	)
+	.await?;
+
+	// Ensure the sender belongs to the remote that is sending the invite
+	if sender_user.server_name() != origin {
+		return Err!(Request(Forbidden("Sender belongs to a different server")));
+	}
+
+	// Ensure the target user belongs to this server
+	if !services
+		.globals
+		.server_is_ours(recipient_user.server_name())
+	{
+		return Err!(Request(InvalidParam("Recipient does not belong to this homeserver")));
+	}
+
+	if target_membership != MembershipState::Invite {
+		return Err!(Request(BadJson("Invalid membership (expected `invite`)")));
+	}
+
+	Ok((pdu, sender_user, recipient_user))
+}
+
+/// Validates the *invite state* of an invite request, per the steps listed
+/// under the endpoint's [spec].
+///
+/// Returns the create event's event ID, and the partial state map.
+///
+/// [spec]: https://spec.matrix.org/v1.19/server-server-api/#put_matrixfederationv2inviteroomideventid
+async fn validate_invite_state(
+	services: &crate::State,
+	invite_state: &[RawStrippedState],
+	room_version_rules: &RoomVersionRules,
+	room_id: OwnedRoomId,
+) -> Result<(OwnedEventId, HashMap<(StateEventType, StateKey), CanonicalJsonObject>)> {
+	trace!(?invite_state, "Raw invite state");
+	let mut invite_state_map: HashMap<(StateEventType, StateKey), _> =
+		HashMap::with_capacity(invite_state.len());
+	let mut create_event_id: Option<OwnedEventId> = None;
+
+	for (idx, invite_state_event) in invite_state.iter().cloned().enumerate() {
+		trace!(%idx, ?invite_state_event, "Invite state event");
+		// Stripped state hasn't been sent over federation since v1.16.
+		let RawStrippedState::Pdu(raw_pdu) = invite_state_event else {
+			debug!(%idx, "Invite state event is not a PDU");
+			return Err!(Request(InvalidParam(
+				"PDU in invite state (index {idx}) violates the room event format"
+			)));
+		};
+		let (state_event_room_id, state_event_id, state_event_json) = services
+			.rooms
+			.event_handler
+			.parse_incoming_pdu(&raw_pdu, Some(room_version_rules))
+			.await
+			.map_err(|e| {
+				err!(Request(InvalidParam(debug_warn!("Invalid PDU in invite state: {e}"))))
+			})?;
+
+		if state_event_room_id != room_id {
+			return Err!(Request(InvalidParam(debug_warn!(
+				%state_event_room_id,
+				%room_id,
+				"PDU in invite state ({state_event_id}) belongs to the wrong room"
+			))));
+		}
+
+		services
+			.server_keys
+			.verify_event(&state_event_json, room_version_rules)
+			.await
+			.map_err(|e| {
+				err!(Request(InvalidParam("Signature verification failed on invite event: {e}")))
+			})?;
+
+		let Some(state_key) = state_event_json.get("state_key").and_then(|k| k.as_str()) else {
+			return Err!(Request(InvalidParam(debug_info!(
+				"PDU in invite state ({state_event_id}) is not a state event"
+			))));
+		};
+		let Some(event_type) = state_event_json.get("type").and_then(|k| k.as_str()) else {
+			return Err!(Request(InvalidParam(debug_warn!(
+				"PDU in invite state ({state_event_id}) is not an event?"
+			))));
+		};
+
+		let key = StateEventType::from(event_type).with_state_key(state_key);
+		match invite_state_map.entry(key) {
+			| Entry::Occupied(entry) =>
+				return Err!(Request(InvalidParam(
+					"Duplicate state events in invite state for state key: {:?}",
+					entry.key(),
+				))),
+			| Entry::Vacant(entry) => {
+				if entry.key().0 == StateEventType::RoomCreate {
+					// Ensure this is a legal create event.
+					let pdu_event =
+						PduEvent::from_id_val(&state_event_id, state_event_json.clone())
+							.expect("must be able to create pdu event from event json");
+					debug!("Validating discovered create event in invite room state");
+					validate_invite_create_event(&pdu_event, room_version_rules).await?;
+					create_event_id = Some(state_event_id);
+				}
+				entry.insert(state_event_json);
+			},
+		}
+	}
+	let Some(create_event_id) = create_event_id else {
+		return Err!(Request(InvalidParam(debug_warn!(
+			parsed_state=?invite_state_map,
+			"Invite state does not contain the m.room.create event"
+		))));
+	};
+	invite_state_map.iter().try_for_each(|(key, event_json)| {
+		service::rooms::event_handler::Service::pdu_format_check_1(
+			event_json,
+			room_version_rules,
+			&create_event_id,
+		)
+		.map_err(|e| {
+			err!(Request(InvalidParam(
+				"PDU in invite state for {key:?} violates the room event format: {e}"
+			)))
+		})
+	})?;
+
+	Ok((create_event_id, invite_state_map))
+}
+
+#[derive(Deserialize)]
+struct MFederate {
+	#[serde(rename = "m.federate")]
+	mfederate: Option<bool>,
+}
+
+/// Validates that a create event is suitable for the invite, namely:
+///
+/// 1. It passes auth checks (aka is valid)
+/// 2. The room is federated (there's no point persisting unfederated rooms)
+async fn validate_invite_create_event(
+	pdu: &PduEvent,
+	room_version_rules: &RoomVersionRules,
+) -> Result {
+	if !state_res::auth_check(
+		room_version_rules,
+		pdu,
+		None,
+		|_, _| async {
+			unreachable!("No state should be fetched when processing a lone create event");
+		},
+		pdu,
+	)
+	.await
+	.unwrap_or_default()
+	{
+		return Err!(Request(InvalidParam("m.room.create event fails auth check")));
+	}
+
+	let can_federate = pdu.get_content::<MFederate>()?.mfederate;
+	if !can_federate.unwrap_or(true) {
+		return Err!(Request(InvalidParam(
+			"Cannot receive invites to a room with m.federate=false"
+		)));
+	}
+
+	Ok(())
+}
@@ -75,14 +75,6 @@ pub(crate) async fn create_join_event_template_route(
 		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
 	}

-	if let Some(server) = body.room_id.server_name() {
-		if services.moderation.is_remote_server_forbidden(server) {
-			return Err!(Request(Forbidden(warn!(
-				"Room ID server name {server} is banned on this homeserver."
-			))));
-		}
-	}
-
 	let room_version = services.rooms.state.get_room_version(&body.room_id).await?;
 	let room_version_rules = room_version.rules().unwrap();
 	if !body.ver.contains(&room_version) {
@@ -58,12 +58,6 @@ pub(crate) async fn create_knock_event_template_route(
 		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
 	}

-	if let Some(server) = body.room_id.server_name() {
-		if services.moderation.is_remote_server_forbidden(server) {
-			return Err!(Request(Forbidden("Server is banned on this homeserver.")));
-		}
-	}
-
 	let room_version = services.rooms.state.get_room_version(&body.room_id).await?;
 	let room_version_rules = room_version.rules().unwrap();

@@ -27,6 +27,7 @@ pub(crate) async fn create_leave_event_template_route(
 	{
 		info!(
 			origin = body.identity.as_str(),
+			room_id = %body.room_id,
 			"Refusing to serve make_leave for room we aren't participating in"
 		);
 		return Err!(Request(NotFound("This server is not participating in that room.")));
@@ -150,7 +150,7 @@ async fn process_inbound_transaction(
 		.pdus
 		.iter()
 		.stream()
-		.broad_then(|pdu| services.rooms.event_handler.parse_incoming_pdu(pdu))
+		.broad_then(|pdu| services.rooms.event_handler.parse_incoming_pdu(pdu, None))
 		.inspect_err(|e| warn!("Could not parse incoming PDU: {e}"))
 		.ready_filter_map(Result::ok);

@@ -2,34 +2,36 @@

 use axum::extract::State;
 use conduwuit::{
-	Err, Event, Result, at, debug, err, info,
-	matrix::event::gen_event_id_canonical_json,
-	trace,
+	Err, Event, Result, at, debug, err, info, trace,
 	utils::stream::{BroadbandExt, IterStream, TryBroadbandExt},
 	warn,
 };
 use conduwuit_service::Services;
 use futures::{FutureExt, StreamExt, TryStreamExt};
 use ruma::{
-	CanonicalJsonValue, OwnedEventId, OwnedRoomId, OwnedUserId, RoomId, ServerName,
+	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, RoomId, ServerName, UserId,
 	api::federation::membership::create_join_event,
 	assign,
 	events::{
-		StateEventType, TimelineEventType,
+		TimelineEventType,
 		room::member::{MembershipState, RoomMemberEventContent},
 	},
+	room_version_rules::RoomVersionRules,
 };
-use serde_json::value::{RawValue as RawJsonValue, to_raw_value};
+use serde_json::value::to_raw_value;

-use crate::Ruma;
+use crate::{Ruma, server::utils::validate_any_membership_event};

-/// helper method for /send_join v1 and v2
+/// Creates a join membership event for the target, returning a computed
+/// response with room state, auth chains, etc.
 #[tracing::instrument(skip(services, pdu, omit_members), fields(room_id = room_id.as_str(), origin = origin.as_str()), level = "info")]
 async fn create_join_event(
 	services: &Services,
 	origin: &ServerName,
 	room_id: &RoomId,
-	pdu: &RawJsonValue,
+	event_id: &EventId,
+	room_version_rules: &RoomVersionRules,
+	mut pdu: CanonicalJsonObject,
 	omit_members: bool,
 ) -> Result<create_join_event::v2::RoomState> {
 	if !services.rooms.metadata.exists(room_id).await {
@@ -43,6 +45,7 @@ async fn create_join_event(
 	{
 		info!(
 			origin = origin.as_str(),
+			room_id = %room_id,
 			"Refusing to serve send_join for room we aren't participating in"
 		);
 		return Err!(Request(NotFound("This server is not participating in that room.")));
@@ -64,94 +67,25 @@ async fn create_join_event(
 		.await
 		.map_err(|e| err!(Request(NotFound(error!("Room has no state: {e}")))))?;

-	// We do not add the event_id field to the pdu here because of signature and
-	// hashes checks
-	trace!("Getting room version");
-	let room_version = services.rooms.state.get_room_version(room_id).await?;
-	let room_version_rules = room_version.rules().unwrap();
-
-	trace!("Generating event ID and converting to canonical json");
-	let Ok((event_id, mut value)) = gen_event_id_canonical_json(pdu, &room_version_rules) else {
-		// Event could not be converted to canonical json
-		return Err!(Request(BadJson("Could not convert event to canonical json.")));
-	};
-
-	let event_room_id: OwnedRoomId = serde_json::from_value(
-		value
-			.get("room_id")
-			.ok_or_else(|| err!(Request(BadJson("Event missing room_id property."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson(warn!("room_id field is not a valid room ID: {e}")))))?;
-
-	if event_room_id != room_id {
-		return Err!(Request(BadJson("Event room_id does not match request path room ID.")));
-	}
-
-	let event_type: StateEventType = serde_json::from_value(
-		value
-			.get("type")
-			.ok_or_else(|| err!(Request(BadJson("Event missing type property."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson(warn!("Event has invalid state event type: {e}")))))?;
-
-	if event_type != StateEventType::RoomMember {
-		return Err!(Request(BadJson(
-			"Not allowed to send non-membership state event to join endpoint."
-		)));
-	}
+	let sender = pdu
+		.get("sender")
+		.and_then(|v| v.as_str())
+		.map(UserId::parse)
+		.and_then(Result::ok)
+		.expect("sender was already validated");

 	let content: RoomMemberEventContent = serde_json::from_value(
-		value
-			.get("content")
+		pdu.get("content")
 			.ok_or_else(|| err!(Request(BadJson("Event missing content property"))))?
 			.clone()
 			.into(),
 	)
 	.map_err(|e| err!(Request(BadJson(warn!("Event content is empty or invalid: {e}")))))?;

-	if content.membership != MembershipState::Join {
-		return Err!(Request(BadJson(
-			"Not allowed to send a non-join membership event to join endpoint."
-		)));
-	}
-
-	let sender: OwnedUserId = serde_json::from_value(
-		value
-			.get("sender")
-			.ok_or_else(|| err!(Request(BadJson("Event missing sender property."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson(warn!("sender property is not a valid user ID: {e}")))))?;
-
-	// check if origin server is trying to send for another server
-	if sender.server_name() != origin {
-		return Err!(Request(Forbidden("Not allowed to join on behalf of another server.")));
-	}
-
-	let state_key: OwnedUserId = serde_json::from_value(
-		value
-			.get("state_key")
-			.ok_or_else(|| err!(Request(BadJson("Event missing state_key property."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson(warn!("State key is not a valid user ID: {e}")))))?;
-
-	if state_key != sender {
-		return Err!(Request(BadJson("State key does not match sender user.")));
-	}
-
 	if let Some(authorising_user) = content.join_authorized_via_users_server {
-		use ruma::RoomVersionId::*;
-
-		if matches!(room_version, V1 | V2 | V3 | V4 | V5 | V6 | V7) {
+		if !room_version_rules.authorization.restricted_join_rule {
 			return Err!(Request(InvalidParam(
-				"Room version {room_version} does not support restricted rooms but \
+				"Room version does not support restricted rooms but \
 				 join_authorised_via_users_server ({authorising_user}) was found in the event."
 			)));
 		}
@@ -174,8 +108,7 @@ async fn create_join_event(
 				 they cannot authorise your join."
 			)));
 		}
-
-		if !super::user_can_perform_restricted_join(services, &state_key, room_id).await? {
+		if !super::user_can_perform_restricted_join(services, &sender, room_id).await? {
 			return Err!(Request(UnableToAuthorizeJoin(
 				"Joining user did not pass restricted room's rules."
 			)));
@@ -183,7 +116,7 @@ async fn create_join_event(

 		services
 			.server_keys
-			.hash_and_sign_event(&mut value, &room_version_rules)
+			.hash_and_sign_event(&mut pdu, room_version_rules)
 			.map_err(|e| {
 				err!(Request(InvalidParam(warn!("Failed to sign send_join event: {e}"))))
 			})?;
@@ -200,7 +133,7 @@ async fn create_join_event(
 	let pdu_id = services
 		.rooms
 		.event_handler
-		.handle_incoming_pdu(sender.server_name(), room_id, &event_id, value.clone(), false)
+		.handle_incoming_pdu(sender.server_name(), room_id, event_id, pdu.clone(), false)
 		.boxed()
 		.await?
 		.ok_or_else(|| err!(Request(InvalidParam("Could not accept as timeline event."))))?;
@@ -220,14 +153,12 @@ async fn create_join_event(
 		.iter()
 		.try_stream()
 		.broad_filter_map(|event_id| async move {
-			if omit_members {
-				if let Ok(e) = event_id.as_ref() {
-					let pdu = services.rooms.timeline.get_pdu(e).await;
-					if pdu.is_ok_and(|p| *p.kind() == TimelineEventType::RoomMember) {
-						trace!("omitting member event {e:?} from returned state");
-						// skip members
-						return None;
-					}
+			if omit_members && let Ok(e) = event_id.as_ref() {
+				let pdu = services.rooms.timeline.get_pdu(e).await;
+				if pdu.is_ok_and(|p| *p.kind() == TimelineEventType::RoomMember) {
+					trace!("omitting member event {e:?} from returned state");
+					// skip members
+					return None;
 				}
 			}
 			Some(event_id)
@@ -289,7 +220,7 @@ async fn create_join_event(
 	Ok(assign!(create_join_event::v2::RoomState::new(), {
 		auth_chain,
 		state,
-		event: to_raw_value(&CanonicalJsonValue::Object(value)).ok(),
+		event: to_raw_value(&CanonicalJsonValue::Object(pdu)).ok(),
 		members_omitted: omit_members,
 		servers_in_room,
 	}))
@@ -309,24 +240,45 @@ pub(crate) async fn create_join_event_v2_route(
 		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
 	}

-	if let Some(server) = body.room_id.server_name() {
-		if services.moderation.is_remote_server_forbidden(server) {
-			warn!(
-				"Server {} tried joining room ID {} through us which has a server name that is \
-				 globally forbidden. Rejecting.",
-				body.identity, &body.room_id,
-			);
-			return Err!(Request(Forbidden(warn!(
-				"Room ID server name {server} is banned on this homeserver."
-			))));
-		}
+	let room_version = services.rooms.state.get_room_version(&body.room_id).await?;
+	let create_event = services
+		.rooms
+		.state_accessor
+		.get_room_create_event(&body.room_id)
+		.await;
+	let room_version_rules = room_version.rules().unwrap();
+
+	let (value, membership, sender, target) = validate_any_membership_event(
+		&services,
+		&body.pdu,
+		&room_version_rules,
+		create_event.event_id.clone(),
+		body.room_id.clone(),
+		body.event_id.clone(),
+	)
+	.await?;
+	if membership != MembershipState::Join {
+		return Err!(Request(InvalidParam("Invalid membership (expected `join`)")));
+	}
+	if sender.server_name() != body.identity {
+		return Err!(Request(InvalidParam("Sender belongs to a different server")));
+	}
+	if sender != target {
+		return Err!(Request(InvalidParam("Sender does not match state key")));
 	}

 	let now = Instant::now();
-	let room_state =
-		create_join_event(&services, &body.identity, &body.room_id, &body.pdu, body.omit_members)
-			.boxed()
-			.await?;
+	let room_state = create_join_event(
+		&services,
+		&body.identity,
+		&body.room_id,
+		&body.event_id,
+		&room_version_rules,
+		value,
+		body.omit_members,
+	)
+	.boxed()
+	.await?;
 	info!(
 		"Finished sending a join for {} in {} in {:?}",
 		body.identity,
@@ -1,21 +1,11 @@
 use axum::extract::State;
-use conduwuit::{
-	Err, Result, err, info,
-	matrix::{event::gen_event_id_canonical_json, pdu::PduEvent},
-	warn,
-};
+use conduwuit::{Err, Event, Result, debug_info, err, matrix::pdu::PduEvent, warn};
 use futures::FutureExt;
 use ruma::{
-	OwnedUserId,
-	api::federation::membership::create_knock_event,
-	events::{
-		StateEventType,
-		room::member::{MembershipState, RoomMemberEventContent},
-	},
-	serde::JsonObject,
+	api::federation::membership::create_knock_event, events::room::member::MembershipState,
 };

-use crate::Ruma;
+use crate::{Ruma, server::utils::validate_any_membership_event};

 /// # `PUT /_matrix/federation/v1/send_knock/{roomId}/{eventId}`
 ///
@@ -33,18 +23,7 @@ pub(crate) async fn create_knock_event_v1_route(
 			 forbidden. Rejecting.",
 			body.identity, &body.room_id,
 		);
-		return Err!(Request(Forbidden("Server is banned on this homeserver.")));
-	}
-
-	if let Some(server) = body.room_id.server_name() {
-		if services.moderation.is_remote_server_forbidden(server) {
-			warn!(
-				"Server {} tried knocking room ID {} which has a server name that is globally \
-				 forbidden. Rejecting.",
-				body.identity, &body.room_id,
-			);
-			return Err!(Request(Forbidden("Server is banned on this homeserver.")));
-		}
+		return Err!(Request(Forbidden("Federation denied with {}", body.identity)));
 	}

 	if !services.rooms.metadata.exists(&body.room_id).await {
@@ -57,8 +36,9 @@ pub(crate) async fn create_knock_event_v1_route(
 		.server_in_room(services.globals.server_name(), &body.room_id)
 		.await
 	{
-		info!(
+		debug_info!(
 			origin = body.identity.as_str(),
+			room_id = %body.room_id,
 			"Refusing to serve send_knock for room we aren't participating in"
 		);
 		return Err!(Request(NotFound("This server is not participating in that room.")));
@@ -72,88 +52,40 @@ pub(crate) async fn create_knock_event_v1_route(
 		.await?;

 	let room_version = services.rooms.state.get_room_version(&body.room_id).await?;
+	let create_event = services
+		.rooms
+		.state_accessor
+		.get_room_create_event(&body.room_id)
+		.await;
 	let room_version_rules = room_version.rules().unwrap();

 	if !room_version_rules.authorization.knocking {
 		return Err!(Request(Forbidden("Room version does not support knocking.")));
 	}

-	let Ok((event_id, value)) = gen_event_id_canonical_json(&body.pdu, &room_version_rules)
-	else {
-		// Event could not be converted to canonical json
-		return Err!(Request(InvalidParam("Could not convert event to canonical json.")));
-	};
-
-	let event_type: StateEventType = serde_json::from_value(
-		value
-			.get("type")
-			.ok_or_else(|| err!(Request(InvalidParam("Event has no event type."))))?
-			.clone()
-			.into(),
+	let (mut event, target_membership, sender, target) = validate_any_membership_event(
+		&services,
+		&body.pdu,
+		&room_version_rules,
+		create_event.event_id().to_owned(),
+		body.room_id.clone(),
+		body.event_id.clone(),
 	)
-	.map_err(|e| err!(Request(InvalidParam("Event has invalid event type: {e}"))))?;
+	.await?;

-	if event_type != StateEventType::RoomMember {
-		return Err!(Request(InvalidParam(
-			"Not allowed to send non-membership state event to knock endpoint.",
-		)));
+	if target_membership != MembershipState::Knock {
+		return Err!(Request(InvalidParam("Invalid membership (expected `knock`)")));
 	}
-
-	let content: RoomMemberEventContent = serde_json::from_value(
-		value
-			.get("content")
-			.ok_or_else(|| err!(Request(InvalidParam("Membership event has no content"))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(InvalidParam("Event has invalid membership content: {e}"))))?;
-
-	if content.membership != MembershipState::Knock {
-		return Err!(Request(InvalidParam(
-			"Not allowed to send a non-knock membership event to knock endpoint."
-		)));
-	}
-
-	// ACL check sender server name
-	let sender: OwnedUserId = serde_json::from_value(
-		value
-			.get("sender")
-			.ok_or_else(|| err!(Request(InvalidParam("Event has no sender user ID."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson("Event sender is not a valid user ID: {e}"))))?;
-
-	services
-		.rooms
-		.event_handler
-		.acl_check(sender.server_name(), &body.room_id)
-		.await?;
-
-	// check if origin server is trying to send for another server
 	if sender.server_name() != body.identity {
-		return Err!(Request(BadJson("Not allowed to knock on behalf of another server/user.")));
+		return Err!(Request(InvalidParam("Sender belongs to a different server")));
+	}
+	if sender != target {
+		return Err!(Request(InvalidParam("Sender does not match state key")));
 	}

-	let state_key: OwnedUserId = serde_json::from_value(
-		value
-			.get("state_key")
-			.ok_or_else(|| err!(Request(InvalidParam("Event does not have a state_key"))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson("Event does not have a valid state_key: {e}"))))?;
+	event.insert("event_id".to_owned(), body.event_id.as_str().into());

-	if state_key != sender {
-		return Err!(Request(InvalidParam("state_key does not match sender user of event.")));
-	}
-
-	let mut event: JsonObject = serde_json::from_str(body.pdu.get())
-		.map_err(|e| err!(Request(InvalidParam("Invalid knock event PDU: {e}"))))?;
-
-	event.insert("event_id".to_owned(), "$placeholder".into());
-
-	let pdu: PduEvent = serde_json::from_value(event.into())
+	let pdu = PduEvent::from_id_val(&body.event_id, event.clone())
 		.map_err(|e| err!(Request(InvalidParam("Invalid knock event PDU: {e}"))))?;

 	let mutex_lock = services
@@ -166,7 +98,7 @@ pub(crate) async fn create_knock_event_v1_route(
 	let pdu_id = services
 		.rooms
 		.event_handler
-		.handle_incoming_pdu(sender.server_name(), &body.room_id, &event_id, value.clone(), false)
+		.handle_incoming_pdu(sender.server_name(), &body.room_id, &body.event_id, event, false)
 		.boxed()
 		.await?
 		.ok_or_else(|| err!(Request(InvalidParam("Could not accept as timeline event."))))?;
@@ -181,7 +113,7 @@ pub(crate) async fn create_knock_event_v1_route(
 	let knock_room_state = services
 		.rooms
 		.state
-		.summary_stripped(&pdu, &body.room_id, &sender)
+		.summary_stripped(&pdu, &body.room_id, &sender, true)
 		.await;

 	Ok(create_knock_event::v1::Response::new(knock_room_state))
@@ -1,18 +1,11 @@
 use axum::extract::State;
-use conduwuit::{Err, Result, err, info, matrix::event::gen_event_id_canonical_json};
-use conduwuit_service::Services;
+use conduwuit::{Err, Result, debug_info, err};
 use futures::FutureExt;
 use ruma::{
-	OwnedRoomId, OwnedUserId, RoomId, ServerName,
-	api::federation::membership::create_leave_event,
-	events::{
-		StateEventType,
-		room::member::{MembershipState, RoomMemberEventContent},
-	},
+	api::federation::membership::create_leave_event, events::room::member::MembershipState,
 };
-use serde_json::value::RawValue as RawJsonValue;

-use crate::Ruma;
+use crate::{Ruma, server::utils::validate_any_membership_event};

 /// # `PUT /_matrix/federation/v2/send_leave/{roomId}/{eventId}`
 ///
@@ -21,17 +14,8 @@ pub(crate) async fn create_leave_event_v2_route(
 	State(services): State<crate::State>,
 	body: Ruma<create_leave_event::v2::Request>,
 ) -> Result<create_leave_event::v2::Response> {
-	create_leave_event(&services, &body.identity, &body.room_id, &body.pdu).await?;
-
-	Ok(create_leave_event::v2::Response::new())
-}
-
-async fn create_leave_event(
-	services: &Services,
-	origin: &ServerName,
-	room_id: &RoomId,
-	pdu: &RawJsonValue,
-) -> Result {
+	let room_id = body.room_id.as_ref();
+	let origin = &body.identity;
 	if !services.rooms.metadata.exists(room_id).await {
 		return Err!(Request(NotFound("Room is unknown to this server.")));
 	}
@@ -42,9 +26,10 @@ async fn create_leave_event(
 		.server_in_room(services.globals.server_name(), room_id)
 		.await
 	{
-		info!(
+		debug_info!(
 			origin = origin.as_str(),
-			"Refusing to serve backfill for room we aren't participating in"
+			room_id = %room_id,
+			"Refusing to send_leave for room we aren't participating in"
 		);
 		return Err!(Request(NotFound("This server is not participating in that room.")));
 	}
@@ -56,91 +41,31 @@ async fn create_leave_event(
 		.acl_check(origin, room_id)
 		.await?;

-	// We do not add the event_id field to the pdu here because of signature and
-	// hashes checks
 	let room_version = services.rooms.state.get_room_version(room_id).await?;
+	let create_event = services
+		.rooms
+		.state_accessor
+		.get_room_create_event(room_id)
+		.await;
 	let room_version_rules = room_version.rules().unwrap();

-	let Ok((event_id, value)) = gen_event_id_canonical_json(pdu, &room_version_rules) else {
-		// Event could not be converted to canonical json
-		return Err!(Request(BadJson("Could not convert event to canonical json.")));
-	};
-
-	let event_room_id: OwnedRoomId = serde_json::from_value(
-		serde_json::to_value(
-			value
-				.get("room_id")
-				.ok_or_else(|| err!(Request(BadJson("Event missing room_id property."))))?,
-		)
-		.expect("CanonicalJson is valid json value"),
+	let (value, membership, sender, target) = validate_any_membership_event(
+		&services,
+		&body.pdu,
+		&room_version_rules,
+		create_event.event_id.clone(),
+		body.room_id.clone(),
+		body.event_id.clone(),
 	)
-	.map_err(|e| err!(Request(BadJson(warn!("room_id field is not a valid room ID: {e}")))))?;
-
-	if event_room_id != room_id {
-		return Err!(Request(BadJson("Event room_id does not match request path room ID.")));
+	.await?;
+	if membership != MembershipState::Leave {
+		return Err!(Request(InvalidParam("Invalid membership (expected `leave`)")));
 	}
-
-	let content: RoomMemberEventContent = serde_json::from_value(
-		value
-			.get("content")
-			.ok_or_else(|| err!(Request(BadJson("Event missing content property."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson(warn!("Event content is empty or invalid: {e}")))))?;
-
-	if content.membership != MembershipState::Leave {
-		return Err!(Request(BadJson(
-			"Not allowed to send a non-leave membership event to leave endpoint."
-		)));
+	if sender.server_name() != body.identity {
+		return Err!(Request(InvalidParam("Sender belongs to a different server")));
 	}
-
-	let event_type: StateEventType = serde_json::from_value(
-		value
-			.get("type")
-			.ok_or_else(|| err!(Request(BadJson("Event missing type property."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson(warn!("Event has invalid state event type: {e}")))))?;
-
-	if event_type != StateEventType::RoomMember {
-		return Err!(Request(BadJson(
-			"Not allowed to send non-membership state event to leave endpoint."
-		)));
-	}
-
-	// ACL check sender server name
-	let sender: OwnedUserId = serde_json::from_value(
-		value
-			.get("sender")
-			.ok_or_else(|| err!(Request(BadJson("Event missing sender property."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson(warn!("sender property is not a valid user ID: {e}")))))?;
-
-	services
-		.rooms
-		.event_handler
-		.acl_check(sender.server_name(), room_id)
-		.await?;
-
-	if sender.server_name() != origin {
-		return Err!(Request(BadJson("Not allowed to leave on behalf of another server/user.")));
-	}
-
-	let state_key: OwnedUserId = serde_json::from_value(
-		value
-			.get("state_key")
-			.ok_or_else(|| err!(Request(BadJson("Event missing state_key property."))))?
-			.clone()
-			.into(),
-	)
-	.map_err(|e| err!(Request(BadJson(warn!("State key is not a valid user ID: {e}")))))?;
-
-	if state_key != sender {
-		return Err!(Request(BadJson("State key does not match sender user.")));
+	if sender != target {
+		return Err!(Request(InvalidParam("Sender does not match state key")));
 	}

 	let mutex_lock = services
@@ -153,7 +78,7 @@ async fn create_leave_event(
 	let pdu_id = services
 		.rooms
 		.event_handler
-		.handle_incoming_pdu(origin, room_id, &event_id, value, false)
+		.handle_incoming_pdu(origin, room_id, &body.event_id, value, false)
 		.boxed()
 		.await?
 		.ok_or_else(|| err!(Request(InvalidParam("Could not accept as timeline event."))))?;
@@ -164,5 +89,7 @@ async fn create_leave_event(
 		.sending
 		.send_pdu_room(room_id, &pdu_id)
 		.boxed()
-		.await
+		.await?;
+
+	Ok(create_leave_event::v2::Response::new())
 }
@@ -1,7 +1,10 @@
-use conduwuit::{Err, Result, is_false};
+use conduwuit::{Err, Result, err, is_false};
 use conduwuit_service::Services;
 use futures::{FutureExt, future::OptionFuture, join};
-use ruma::{EventId, RoomId, ServerName};
+use ruma::{
+	CanonicalJsonObject, EventId, OwnedEventId, OwnedRoomId, OwnedUserId, RoomId, ServerName,
+	UserId, events::room::member::MembershipState, room_version_rules::RoomVersionRules,
+};

 pub(super) struct AccessCheck<'a> {
 	pub(super) services: &'a Services,
@@ -63,3 +66,103 @@ pub(super) async fn assert(&self) -> Result {
 		Ok(())
 	}
 }
+
+/// Performs validation on a membership event that should be run on any event a
+/// remote is trying to send via us.
+///
+/// ## Checks performed
+///
+/// 1. PDU room ID matches request path room ID
+/// 2. PDU event ID matches request path event ID
+/// 3. Signature check
+/// 4. Event type check
+/// 5. `sender` field presence (and parsing)
+/// 6. `state_key` field presence (and parsing)
+/// 7. PDU room format check (PDU check 1)
+///
+/// ## Returns
+///
+/// A resulting tuple of (PDU JSON, target membership state, sender, recipient).
+pub(crate) async fn validate_any_membership_event(
+	services: &crate::State,
+	body: &serde_json::value::RawValue,
+	room_version_rules: &RoomVersionRules,
+	create_event_id: OwnedEventId,
+	expected_room_id: OwnedRoomId,
+	expected_event_id: OwnedEventId,
+) -> Result<(CanonicalJsonObject, MembershipState, OwnedUserId, OwnedUserId)> {
+	let (template_room_id, template_event_id, pdu) = services
+		.rooms
+		.event_handler
+		.parse_incoming_pdu(body, Some(room_version_rules))
+		.await
+		.map_err(|e| err!(Request(BadJson("Invalid membership PDU: {e}"))))?;
+
+	if template_room_id != expected_room_id {
+		return Err!(Request(InvalidParam("Membership event does not belong to requested room")));
+	}
+	if template_event_id != expected_event_id {
+		return Err!(Request(InvalidParam(debug_warn!(
+			%template_event_id,
+			%expected_event_id,
+			"Membership event ID does not match provided event ID"
+		))));
+	}
+
+	services
+		.server_keys
+		.verify_event(&pdu, room_version_rules)
+		.await
+		.map_err(|e| {
+			err!(Request(InvalidParam("Signature verification failed on membership event: {e}")))
+		})?;
+
+	// Ensure this is a membership event
+	if pdu
+		.get("type")
+		.expect("event must have a type")
+		.as_str()
+		.expect("type must be a string")
+		!= "m.room.member"
+	{
+		return Err!(Request(BadJson(
+			"Not allowed to send non-membership event to this endpoint"
+		)));
+	}
+	let membership = pdu
+		.get("content")
+		.ok_or_else(|| err!(Request(BadJson("Event missing content property"))))?
+		.as_object()
+		.ok_or_else(|| err!(Request(BadJson("Event content is not an object"))))?
+		.get("membership")
+		.ok_or_else(|| err!(Request(BadJson("Event missing membership property"))))?
+		.as_str()
+		.ok_or_else(|| err!(Request(BadJson("Event is not a string"))))?
+		.to_owned();
+
+	let sender_user = pdu
+		.get("sender")
+		.and_then(|v| v.as_str())
+		.map(UserId::parse)
+		.and_then(Result::ok)
+		.ok_or_else(|| err!(Request(InvalidParam("Invalid sender property"))))?;
+	let recipient_user = pdu
+		.get("state_key")
+		.and_then(|v| v.as_str())
+		.map(UserId::parse)
+		.and_then(Result::ok)
+		.ok_or_else(|| err!(Request(InvalidParam("Invalid state_key property"))))?;
+
+	// Do a quick format check. The spec doesn't suggest this, but it's probably
+	// a good idea nonetheless.
+	service::rooms::event_handler::Service::pdu_format_check_1(
+		&pdu,
+		room_version_rules,
+		&create_event_id,
+	)
+	.map_err(|e| {
+		err!(Request(InvalidParam("Membership event violates the room event format: {e}")))
+	})?;
+
+	Ok((pdu, membership.into(), sender_user, recipient_user))
+}
@@ -2442,6 +2442,7 @@ pub struct OauthConfig {
 	///   legacy authentication will be unable to log in.
 	///
 	/// default: "hybrid"
+	#[serde(default)]
 	compatibility_mode: OAuthMode,

 	/// display: hidden
@@ -1,4 +1,6 @@
-use conduwuit::{Err, Result, debug, debug_info, error, info};
+use std::io::IsTerminal;
+
+use conduwuit::{Err, Result, debug, debug_info, error, info, warn};
 use ruma::events::room::message::RoomMessageEventContent;
 use tokio::time::{Duration, sleep};

@@ -7,10 +9,16 @@
 pub(super) const SIGNAL: &str = "SIGUSR2";

 impl super::Service {
-	/// Possibly spawn the terminal console at startup if configured.
+	/// Possibly spawn the terminal console at startup if configured and a TTY
+	/// is available.
 	pub(super) async fn console_auto_start(&self) {
 		#[cfg(feature = "console")]
 		if self.services.server.config.admin_console_automatic {
+			if !std::io::stdin().is_terminal() {
+				warn!("Console enabled without a tty available; Not enabling console");
+				return;
+			}
+
 			// Allow more of the startup sequence to execute before spawning
 			tokio::task::yield_now().await;
 			self.console.start().await;
@@ -134,7 +134,7 @@ async fn check(&self) -> Result<()> {
 		let response = self
 			.services
 			.client
-			.default
+			.external_resource
 			.get(CHECK_FOR_ANNOUNCEMENTS_URL)
 			.send()
 			.await?
@@ -16,9 +16,9 @@ pub struct Service {
 	pub matrix_resolver: Arc<MatrixResolver>,
 	pub dns_resolver: Arc<TokioResolver>,

-	pub default: reqwest::Client,
+	pub dns: reqwest::Client,
 	pub url_preview: reqwest::Client,
-	pub extern_media: reqwest::Client,
+	pub external_resource: reqwest::Client,
 	pub federation: reqwest::Client,
 	pub federation_slow: reqwest::Client,
 	pub sender: reqwest::Client,
@@ -35,17 +35,17 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {

 		let dns_resolver = get_dns_resolver(args.server)?;

+		let dns_client = base(&args.server.config)?
+			.connect_timeout(Duration::from_secs(args.server.config.well_known_conn_timeout))
+			.read_timeout(Duration::from_secs(args.server.config.well_known_timeout))
+			.timeout(Duration::from_secs(args.server.config.well_known_timeout))
+			.pool_max_idle_per_host(0)
+			.redirect(redirect::Policy::limited(4))
+			.build()?;
+
 		let matrix_resolver = Arc::new(MatrixResolverBuilder::new()
 			.dangerous_tls_accept_invalid_certs(args.server.config.allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure)
-			.http_client(
-				base(&args.server.config)?
-					.connect_timeout(Duration::from_secs(args.server.config.well_known_conn_timeout))
-					.read_timeout(Duration::from_secs(args.server.config.well_known_timeout))
-					.timeout(Duration::from_secs(args.server.config.well_known_timeout))
-					.pool_max_idle_per_host(0)
-					.redirect(redirect::Policy::limited(4))
-					.build()?
-			)
+			.http_client(dns_client.clone())
 			.dns_resolver(dns_resolver.clone())
 			.build()?);
 		let matrix_dns_resolver = matrix_resolver.create_dns_resolver();
@@ -69,23 +69,19 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 			matrix_resolver,
 			dns_resolver,

-			default: base(config)?
-				.dns_resolver(matrix_dns_resolver.clone())
-				.build()?,
+			dns: dns_client,

 			url_preview: base(config)
 				.and_then(|builder| {
 					builder_interface(builder, url_preview_bind_iface.as_deref())
 				})?
 				.local_address(url_preview_bind_addr)
-				.dns_resolver(matrix_dns_resolver.clone())
 				.timeout(Duration::from_secs(config.url_preview_timeout))
 				.redirect(redirect::Policy::limited(3))
 				.user_agent(url_preview_user_agent)
 				.build()?,

-			extern_media: base(config)?
-				.dns_resolver(matrix_dns_resolver.clone())
+			external_resource: base(config)?
 				.redirect(redirect::Policy::limited(3))
 				.build()?,

@@ -128,7 +124,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				.build()?,

 			appservice: base(config)?
-				.dns_resolver(matrix_dns_resolver.clone())
+				.dns_resolver(matrix_dns_resolver)
 				.connect_timeout(Duration::from_secs(5))
 				.read_timeout(Duration::from_secs(config.appservice_timeout))
 				.timeout(Duration::from_secs(config.appservice_timeout))
@@ -138,7 +134,6 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				.build()?,

 			pusher: base(config)?
-				.dns_resolver(matrix_dns_resolver)
 				.connect_timeout(Duration::from_secs(config.pusher_conn_timeout))
 				.timeout(Duration::from_secs(config.pusher_timeout))
 				.pool_max_idle_per_host(1)
@@ -260,7 +260,7 @@ async fn location_request(&self, location: &str) -> Result<FileMeta> {
 		let response = self
 			.services
 			.client
-			.extern_media
+			.external_resource
 			.get(location)
 			.send()
 			.await?;
@@ -829,7 +829,7 @@ async fn fix_local_invite_state(services: &Services) -> Result {
 				&& services.globals.user_is_local(&membership_event.sender) {

 				// build and save stripped state for their invite in the database
-				let stripped_state = services.rooms.state.summary_stripped(&membership_event, &room_id, &user_id).await;
+				let stripped_state = services.rooms.state.summary_stripped(&membership_event, &room_id, &user_id, false).await;
 				userroomid_invitestate.put((&user_id, &room_id), Json(stripped_state));
 				fixed = fixed.saturating_add(1);
 			}
@@ -882,7 +882,7 @@ async fn split_userid_password(services: &Services) -> Result {
 	drop(cork);
 	info!(?remote_users, "Split userid_password.");

-	db["global"].insert(FIXED_LOCAL_INVITE_STATE_MARKER, []);
+	db["global"].insert(SPLIT_USERID_PASSWORD, []);
 	db.db.sort()?;
 	Ok(())
 }
@@ -895,5 +895,7 @@ async fn obliterate_roomsynctoken_shortstatehash_with_extreme_prejudice(

 	info!("Cleared roomsynctoken_shortstatehash.");

+	services.db["global"].insert(DROP_ROOMSYNCTOKEN_SHORTSTATEHASH, []);
+
 	Ok(())
 }
@@ -25,7 +25,7 @@
 			OAuthError, ResponseMode, Scope, TokenRequest, TokenResponse, TokenType,
 		},
 	},
-	users,
+	users::{self, DeviceToken},
 };

 pub mod client_metadata;
@@ -343,7 +343,7 @@ async fn create_session(
 		client_name: Option<String>,
 		client_id: String,
 	) -> Result<TokenResponse, OAuthError> {
-		let access_token = Self::generate_token();
+		let access_token = DeviceToken::new_random().with_max_age(Self::ACCESS_TOKEN_MAX_AGE);
 		let refresh_token = Self::generate_token();

 		let device_id = requested_scopes
@@ -376,8 +376,7 @@ async fn create_session(
 			.create_device(
 				&authorizing_user,
 				device_id,
-				&access_token,
-				Some(Self::ACCESS_TOKEN_MAX_AGE),
+				Some(access_token.clone()),
 				client_name,
 				None,
 			)
@@ -413,7 +412,7 @@ async fn create_session(
 		);

 		Ok(TokenResponse {
-			access_token,
+			access_token: access_token.into_token(),
 			token_type: TokenType::Bearer,
 			expires_in: Self::ACCESS_TOKEN_MAX_AGE.as_secs(),
 			scope: requested_scopes.iter().join(" "),
@@ -449,7 +448,7 @@ async fn refresh_session(

 		assert_eq!(&client_id, &session_info.client_id, "session info client id mismatch");

-		let new_access_token = Self::generate_token();
+		let new_access_token = DeviceToken::new_random().with_max_age(Self::ACCESS_TOKEN_MAX_AGE);
 		let new_refresh_token = Self::generate_token();
 		let scope = session_info.scopes.iter().join(" ");
 		session_info
@@ -461,8 +460,7 @@ async fn refresh_session(
 			.set_token(
 				&refresh_token_info.user_id,
 				&refresh_token_info.device_id,
-				&new_access_token,
-				Some(Self::ACCESS_TOKEN_MAX_AGE),
+				new_access_token.clone(),
 			)
 			.await
 			.expect("should be able to set token");
@@ -479,7 +477,7 @@ async fn refresh_session(
 			.raw_put(&new_refresh_token, Json(refresh_token_info));

 		Ok(TokenResponse {
-			access_token: new_access_token,
+			access_token: new_access_token.into_token(),
 			token_type: TokenType::Bearer,
 			expires_in: Self::ACCESS_TOKEN_MAX_AGE.as_secs(),
 			scope,
@@ -151,6 +151,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
                    config: config.clone(),
 					client_secret: if let Some(client_secret_file) = &config.client_secret_file {
 						std::fs::read_to_string(client_secret_file)
+							.map(|client_secret| client_secret.trim().to_owned())
 							.map(ClientSecret::new)
 							.map_err(|err| err!("Failed to read OIDC client secret file: {err}"))?
 					} else if let Some(client_secret) = &config.client_secret {
@@ -241,7 +241,7 @@ pub async fn get_missing_events(

 			latest_events.clear();
 			for raw_event in response.events {
-				let (_, event_id, pdu_json) = self.parse_incoming_pdu(&raw_event).await?;
+				let (_, event_id, pdu_json) = self.parse_incoming_pdu(&raw_event, None).await?;
 				let pdu = PduEvent::from_id_val(&event_id, pdu_json).map_err(|e| {
 					err!(Request(BadJson("Failed to parse gapfilled event {event_id}: {e}")))
 				})?;
@@ -384,8 +384,9 @@ async fn fetch_event_via(
 			.send_federation_request(&remote, get_event::v1::Request::new(event_id.clone()))
 			.await?;

-		let (calculated_event_id, value) =
-			Self::parse_incoming_pdu_with_known_room(&res.pdu, room_version_rules)?;
+		let (_, calculated_event_id, value) = self
+			.parse_incoming_pdu(&res.pdu, Some(room_version_rules))
+			.await?;

 		if calculated_event_id != event_id {
 			Err!(Request(BadJson(warn!(
@@ -48,14 +48,16 @@ pub(super) async fn fetch_and_persist_event_auth<Pdu>(
 		let mut auth_chain_map = HashMap::with_capacity(event_auth.auth_chain.len());

 		for auth_pdu_json in event_auth.auth_chain {
-			let (auth_event_room_id, auth_event_id, auth_pdu_json) =
-				match self.parse_incoming_pdu(&auth_pdu_json).await {
-					| Ok(parsed) => parsed,
-					| Err(e) => {
-						warn!(error=?e, "Dropping auth chain event as it could not be parsed");
-						continue;
-					},
-				};
+			let (auth_event_room_id, auth_event_id, auth_pdu_json) = match self
+				.parse_incoming_pdu(&auth_pdu_json, Some(room_version_rules))
+				.await
+			{
+				| Ok(parsed) => parsed,
+				| Err(e) => {
+					warn!(error=?e, "Dropping auth chain event as it could not be parsed");
+					continue;
+				},
+			};
 			if let Err(e) = Self::pdu_format_check_1(
 				&auth_pdu_json,
 				room_version_rules,
@@ -314,7 +314,7 @@ pub(super) async fn fetch_full_state(
 			.iter()
 			.stream()
 			.broad_filter_map(|raw_event_json| async {
-				if let Some(parsed) = self.parse_incoming_pdu(raw_event_json).await.ok()
+				if let Some(parsed) = self.parse_incoming_pdu(raw_event_json, None).await.ok()
 					&& parsed.0 == room_id
 				{
 					Some(parsed)
@@ -351,7 +351,7 @@ pub(super) async fn fetch_full_state(
 			.iter()
 			.stream()
 			.broad_filter_map(|raw_event_json| async {
-				if let Some(parsed) = self.parse_incoming_pdu(raw_event_json).await.ok()
+				if let Some(parsed) = self.parse_incoming_pdu(raw_event_json, None).await.ok()
 					&& parsed.0 == room_id
 				{
 					Some(parsed)
@@ -14,10 +14,12 @@ impl super::Service {
 	/// This performs steps 1 through 4 of [S-S section 5.1][spec], returning
 	/// the parsed PDU and modified JSON object.
 	///
+	/// **External callers likely want `handle_incoming_pdu` instead.**
+	///
 	/// [spec]: https://spec.matrix.org/v1.19/server-server-api/#checks-performed-on-receipt-of-a-pdu
 	#[allow(clippy::too_many_arguments)]
 	#[tracing::instrument(name = "handle_outlier", skip_all)]
-	pub(super) async fn handle_outlier_pdu<'a, Pdu>(
+	pub async fn handle_outlier_pdu<'a, Pdu>(
 		&self,
 		origin: &'a ServerName,
 		create_event: &'a Pdu,
@@ -54,7 +56,6 @@ pub(super) async fn handle_outlier_pdu<'a, Pdu>(
 			})?;

 		value.remove("unsigned");
-		let room_version_rules = get_room_version_rules(create_event)?;

 		// 2. Check signatures, otherwise drop.
 		// 3. Check content hash, redacting the event if it fails.
@@ -82,25 +82,14 @@ pub(super) fn expect_event_id_array(
 }

 impl super::Service {
-	/// Parses an incoming PDU JSON object, generating an event ID for it. Does
-	/// not insert the event ID into the returned object. Does not discover the
-	/// room ID.
-	pub(super) fn parse_incoming_pdu_with_known_room(
-		pdu: &RawJsonValue,
-		room_version_rules: &RoomVersionRules,
-	) -> Result<(OwnedEventId, CanonicalJsonObject)> {
-		let (event_id, value) =
-			gen_event_id_canonical_json(pdu, room_version_rules).map_err(|e| {
-				err!(Request(InvalidParam("Could not convert event to canonical json: {e}")))
-			})?;
-		// NOTE: validation checks are now performed by `pdu_format_check_1`.
-		Ok((event_id, value))
-	}
-
 	/// Parses an incoming PDU JSON object, generating an event ID for it and
 	/// attempts to discover the associated room ID. Does not insert the event
 	/// ID into the returned object.
-	pub async fn parse_incoming_pdu(&self, pdu: &RawJsonValue) -> Result<Parsed> {
+	pub async fn parse_incoming_pdu(
+		&self,
+		pdu: &RawJsonValue,
+		room_version_rules: Option<&RoomVersionRules>,
+	) -> Result<Parsed> {
 		let value = serde_json::from_str::<CanonicalJsonObject>(pdu.get()).map_err(|e| {
 			err!(BadServerResponse(debug_warn!("Error parsing incoming event {e:?}")))
 		})?;
@@ -111,17 +100,20 @@ pub async fn parse_incoming_pdu(&self, pdu: &RawJsonValue) -> Result<Parsed> {

 		let room_id = extract_room_id(event_type, &value)?;

-		let room_version_rules = self
-			.services
-			.state
-			.get_room_version(&room_id)
-			.await
-			.unwrap_or(RoomVersionId::V1)
-			.rules()
-			.unwrap();
+		let room_version_rules = match room_version_rules {
+			| Some(r) => r,
+			| None => &self
+				.services
+				.state
+				.get_room_version(&room_id)
+				.await
+				.unwrap_or(RoomVersionId::V1)
+				.rules()
+				.expect("room version must be supported"),
+		};

 		let (event_id, value) =
-			gen_event_id_canonical_json(pdu, &room_version_rules).map_err(|e| {
+			gen_event_id_canonical_json(pdu, room_version_rules).map_err(|e| {
 				err!(Request(InvalidParam("Could not convert event to canonical json: {e}")))
 			})?;
 		// NOTE: validation checks are now performed by `pdu_format_check_1`.
@@ -6,8 +6,9 @@
 };
 use futures::future::ready;
 use ruma::{
-	CanonicalJsonObject, EventId, OwnedEventId, ServerName, api::error::ErrorKind,
-	canonical_json::redact, events::StateEventType, room_version_rules::RoomVersionRules,
+	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, ServerName,
+	api::error::ErrorKind, canonical_json::redact, events::StateEventType,
+	room_version_rules::RoomVersionRules,
 };

 use crate::rooms::{
@@ -18,7 +19,7 @@ impl super::Service {
 	/// Checks that the PDU conforms to the PDU format (check 1). This is
 	/// already mostly done during deserialisation, so this function just checks
 	/// that the PDU isn't a too large.
-	pub(super) fn pdu_format_check_1(
+	pub fn pdu_format_check_1(
 		pdu_json: &CanonicalJsonObject,
 		room_version_rules: &RoomVersionRules,
 		create_event_id: &EventId,
@@ -42,9 +43,27 @@ pub(super) fn pdu_format_check_1(
 			return Err!(Request(BadJson("PDU has too many auth events")));
 		}

-		let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
-		if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
-			return Err!(Request(BadJson("PDU references a create event")));
+		// The m.room.create event is the genesis event and has empty auth_events
+		// by definition, so it is exempt from the checks below requiring or
+		// forbidding the create event in auth_events (it cannot reference itself).
+		let Some(event_type) = pdu_json.get("type").and_then(CanonicalJsonValue::as_str) else {
+			return Err!(Request(BadJson("PDU is missing a type")));
+		};
+		let state_key = pdu_json
+			.get("state_key")
+			.and_then(CanonicalJsonValue::as_str);
+
+		let is_create_event = event_type == "m.room.create" && state_key == Some("");
+
+		if !is_create_event {
+			let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
+			if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
+				return Err!(Request(BadJson("PDU references a create event")));
+			} else if event_format.allow_room_create_in_auth_events
+				&& !create_event_in_auth_events
+			{
+				return Err!(Request(BadJson("PDU does not reference the room create event")));
+			}
 		}

 		let prev_events = expect_event_id_array(pdu_json, "prev_events")?;
@@ -59,7 +78,7 @@ pub(super) fn pdu_format_check_1(
 	/// the content hash verification fails (check 3), returning the
 	/// potentially modified JSON. Returns an error if the PDU cannot be
 	/// redacted, or fails signature verification.
-	pub(super) async fn signature_hash_check_2_3(
+	pub async fn signature_hash_check_2_3(
 		&self,
 		pdu_json: CanonicalJsonObject,
 		room_version_rules: &RoomVersionRules,
@@ -92,7 +111,7 @@ pub(super) async fn signature_hash_check_2_3(
 	/// If the auth check fails, false is returned, otherwise true.
 	///
 	/// [spec]: https://spec.matrix.org/v1.19/server-server-api/#checks-performed-on-receipt-of-a-pdu
-	pub(super) async fn auth_state_check_4(
+	pub async fn auth_state_check_4(
 		&self,
 		pdu: &PduEvent,
 		room_version_rules: &RoomVersionRules,
@@ -1,7 +1,7 @@
 use std::{collections::HashMap, fmt::Write, sync::Arc};

 use async_trait::async_trait;
-use conduwuit::debug;
+use conduwuit::{debug, utils::stream::WidebandExt};
 use conduwuit_core::{
 	Event, PduEvent, Result, err,
 	result::FlatOk,
@@ -30,7 +30,7 @@
 		short::{ShortEventId, ShortStateHash},
 		state_compressor::{CompressedState, parse_compressed_state_event},
 	},
-	sync,
+	sending, sync,
 };

 pub struct Service {
@@ -45,6 +45,7 @@ struct Services {
 	state_cache: Dep<rooms::state_cache::Service>,
 	state_accessor: Dep<rooms::state_accessor::Service>,
 	state_compressor: Dep<rooms::state_compressor::Service>,
+	sending: Dep<sending::Service>,
 	sync: Dep<sync::Service>,
 	timeline: Dep<rooms::timeline::Service>,
 }
@@ -71,6 +72,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 					.depend::<rooms::state_accessor::Service>("rooms::state_accessor"),
 				state_compressor: args
 					.depend::<rooms::state_compressor::Service>("rooms::state_compressor"),
+				sending: args.depend::<sending::Service>("sending"),
 				sync: args.depend::<sync::Service>("sync"),
 				timeline: args.depend::<rooms::timeline::Service>("rooms::timeline"),
 			},
@@ -307,6 +309,7 @@ pub async fn summary_stripped(
 		event: &PduEvent,
 		room_id: &RoomId,
 		target_user: &UserId,
+		federation: bool,
 	) -> Vec<RawStrippedState> {
 		let mut state_events = [
 			(&StateEventType::RoomCreate, ""),
@@ -343,8 +346,20 @@ pub async fn summary_stripped(
 			.await
 			.into_iter()
 			.filter_map(Result::ok)
-			.map(|pdu| RawStrippedState::Pdu(serde_json::value::to_raw_value(&pdu).unwrap()))
+			.stream()
+			.wide_then(async |pdu| {
+				let formatted = if federation {
+					self.services
+						.sending
+						.convert_to_outgoing_federation_event(pdu.to_canonical_object())
+						.await
+				} else {
+					serde_json::value::to_raw_value(&pdu).unwrap()
+				};
+				RawStrippedState::Pdu(formatted)
+			})
 			.collect()
+			.await
 	}

 	/// Set the state hash to a new version, but does not update state_cache.
@@ -114,7 +114,7 @@ pub async fn update_membership(
 				let invite_state = if is_local {
 					self.services
 						.state
-						.summary_stripped(pdu, room_id, user_id)
+						.summary_stripped(pdu, room_id, user_id, false)
 						.await
 				} else {
 					vec![]
@@ -166,8 +166,11 @@ pub async fn get_remote_pdu(&self, room_id: &RoomId, event_id: &EventId) -> Resu
 	/// Backfills a single PDU.
 	#[tracing::instrument(skip(self, pdu), level = "debug")]
 	pub async fn backfill_pdu(&self, origin: &ServerName, pdu: Box<RawJsonValue>) -> Result<()> {
-		let (room_id, event_id, value) =
-			self.services.event_handler.parse_incoming_pdu(&pdu).await?;
+		let (room_id, event_id, value) = self
+			.services
+			.event_handler
+			.parse_incoming_pdu(&pdu, None)
+			.await?;

 		// Lock so we cannot backfill the same pdu twice at the same time
 		let mutex_lock = self
@@ -308,6 +308,21 @@ pub async fn create_hash_and_sign_event(
 				| _ => Err!(Request(Unknown(warn!("Signing event failed: {e}")))),
 			};
 		}
+
+		// Evil hack because only the PDU JSON gets signed
+		pdu.hashes = serde_json::from_value(serde_json::to_value(
+			pdu_json
+				.get("hashes")
+				.expect("must have hashes after signing")
+				.clone(),
+		)?)?;
+		pdu.signatures = serde_json::from_value(serde_json::to_value(
+			pdu_json
+				.get("signatures")
+				.expect("must have signatures after signing")
+				.clone(),
+		)?)?;
+
 		// Generate event id
 		pdu.event_id = gen_event_id(&pdu_json, &room_version_rules)?;
 		pdu_json
@@ -41,7 +41,6 @@ pub async fn set_dehydrated_device(&self, user_id: &UserId, request: Request) ->
 		self.create_device(
 			user_id,
 			&request.device_id,
-			"",
 			None,
 			request.initial_device_display_name.clone(),
 			None,
@@ -11,20 +11,44 @@
 use futures::{Stream, StreamExt};
 use ruma::{
 	DeviceId, MilliSecondsSinceUnixEpoch, OwnedDeviceId, OwnedUserId, UserId,
-	api::client::device::Device, events::AnyToDeviceEvent, serde::Raw, uint,
+	api::client::device::Device, assign, events::AnyToDeviceEvent, serde::Raw, uint,
 };
 use serde_json::json;

 use crate::users::increment;

+#[must_use]
+#[derive(Clone)]
+pub struct DeviceToken {
+	token: String,
+	max_age: Option<Duration>,
+}
+
+impl DeviceToken {
+	const DEVICE_ID_LENGTH: usize = 10;
+
+	pub fn new(token: String) -> Self { Self { token, max_age: None } }
+
+	pub fn new_random() -> Self { Self::new(utils::random_string(Self::DEVICE_ID_LENGTH)) }
+
+	pub fn with_max_age(self, max_age: Duration) -> Self {
+		assign!(self, { max_age: Some(max_age) })
+	}
+
+	#[must_use]
+	pub fn into_token(self) -> String { self.token }
+}
+
 impl super::Service {
 	/// Adds a new device to a user.
+	///
+	/// If no `token` is provided, the device will not be able to be logged
+	/// into.
 	pub async fn create_device(
 		&self,
 		user_id: &UserId,
 		device_id: &DeviceId,
-		token: &str,
-		token_max_age: Option<Duration>,
+		token: Option<DeviceToken>,
 		initial_device_display_name: Option<String>,
 		client_ip: Option<String>,
 	) -> Result<()> {
@@ -38,8 +62,12 @@ pub async fn create_device(

 		increment(&self.db.userid_devicelistversion, user_id.as_bytes());
 		self.db.userdeviceid_metadata.put(key, Json(device));
-		self.set_token(user_id, device_id, token, token_max_age)
-			.await
+
+		if let Some(token) = token {
+			self.set_token(user_id, device_id, token).await?;
+		}
+
+		Ok(())
 	}

 	/// Removes a device from a user.
@@ -97,31 +125,12 @@ pub async fn get_token(&self, user_id: &UserId, device_id: &DeviceId) -> Result<
 		self.db.userdeviceid_token.qry(&key).await.deserialized()
 	}

-	/// Generate a unique access token that doesn't collide with existing tokens
-	pub async fn generate_unique_token(&self) -> String {
-		loop {
-			let token = utils::random_string(32);
-
-			// Check for collision with existing appservice and user tokens
-			let (appservice, usr) = tokio::join!(
-				self.services.appservice.find_from_token(&token),
-				self.db.token_userdeviceid.get(&token)
-			);
-			if appservice.is_ok() || usr.is_ok() {
-				continue;
-			}
-
-			return token;
-		}
-	}
-
 	/// Replaces the access token of one device.
 	pub async fn set_token(
 		&self,
 		user_id: &UserId,
 		device_id: &DeviceId,
-		token: &str,
-		token_max_age: Option<Duration>,
+		DeviceToken { token, max_age }: DeviceToken,
 	) -> Result<()> {
 		let key = (user_id, device_id);
 		if self.db.userdeviceid_metadata.qry(&key).await.is_err() {
@@ -136,7 +145,7 @@ pub async fn set_token(
 		if self
 			.services
 			.appservice
-			.find_from_token(token)
+			.find_from_token(&token)
 			.await
 			.is_ok()
 		{
@@ -153,10 +162,10 @@ pub async fn set_token(
 		}

 		// Assign token to user device combination
-		self.db.userdeviceid_token.put_raw(key, token);
-		self.db.token_userdeviceid.raw_put(token, key);
+		self.db.userdeviceid_token.put_raw(key, &token);
+		self.db.token_userdeviceid.raw_put(&token, key);

-		if let Some(max_age) = token_max_age {
+		if let Some(max_age) = max_age {
 			let expires = SystemTime::now()
 				.duration_since(SystemTime::UNIX_EPOCH)
 				.expect("system time should not be before the epoch")
@@ -14,6 +14,7 @@
 	utils::{self},
 };
 use database::Map;
+pub use device::DeviceToken;
 pub use profile::ProfileFieldChange;
 use ruma::{UserId, api::error::ErrorKind, encryption::CrossSigningKey, serde::Raw};
 use serde::{Deserialize, Serialize};
@@ -155,7 +155,7 @@ async fn get_account_deeplink(
 				));
 			};

-			format!("device/{device_id}/delete")
+			format!("device/{device_id}/remove")
 		},
 		| AccountManagementAction::DeviceView => {
 			let Some(device_id) = query.device_id else {
Author	SHA1	Message	Date
Renovate Bot	6316dea4b5	chore(deps): update rust-zerover-patch-updates to v0.48.5	2026-07-16 05:03:24 +00:00
Renovate Bot	8195373d81	chore(deps): update rust-non-major	2026-07-15 05:05:03 +00:00
Erwan Leboucher	1ac05838dd	docs: Add back binstall with a link to the deps	2026-07-14 19:44:28 +02:00
Erwan Leboucher	7ecd2aa5e2	fix(pdu): Exempt m.room.create from auth_events check	2026-07-14 19:27:46 +02:00
Renovate BotandEllis Git	69a3145983	chore(deps): update rust-zerover-patch-updates	2026-07-14 13:10:32 +00:00
N00byKing	73b7553b1e	chore: Add changelog entry for #1984	2026-07-14 13:40:28 +02:00
N00byKing	232ec3f620	fix: Return 201 instead of 200 on oauth registration See RFC 7591 at 3.2.1: "The server responds with an HTTP 201 Created status code [...]" Fixes a failure in matrix-dart-sdk	2026-07-14 11:00:34 +02:00
N00byKing	e52bbeaf94	fix: Correct link for code style guide in CONTRIBUTING.md	2026-07-14 08:59:08 +00:00
Renovate Bot	ad1c194fb0	chore(deps): update github-actions-digest	2026-07-14 05:01:52 +00:00
GingerandEllis Git	5e2dcd8e79	chore: News fragment	2026-07-13 20:38:10 +00:00
GingerandEllis Git	24c6474bd1	fix: Allow unstable and stable device id query together	2026-07-13 20:38:10 +00:00
gingerandEllis Git	642d05048b	chore: announce	2026-07-13 18:54:04 +00:00
Koen OostveenandEllis Git	446ae93ad7	fix(web): Change incorrect deeplink for deleting a device	2026-07-13 13:45:46 +00:00
Renovate BotandEllis Git	9ca0774b2d	chore(deps): lock file maintenance	2026-07-13 13:44:47 +00:00
Ginger	ce494eb0c0	fix: Properly sync newly created rooms	2026-07-13 08:50:53 -04:00
Ginger	1f5e178c3f	fix: Properly handle appservice device creation	2026-07-13 08:50:48 -04:00
Renovate Bot	ddd050d402	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.260.2	2026-07-13 05:03:24 +00:00
Ginger	6ad3e679bc	chore: Release	2026-07-12 17:34:16 -04:00
Ginger	65812bb246	chore: Update changelog	2026-07-12 17:33:52 -04:00
theS1LV3R	9f3a7994c7	chore: Changelog	2026-07-12 20:22:19 +02:00
theS1LV3R	baef3289fe	fix(service/admin): Prevent console from being spawned when no TTY is available	2026-07-12 20:22:18 +02:00
Ginger	9a94b93ddd	fix: Fix new database migrations running on every server startup	2026-07-12 12:31:12 -04:00
Gingerandtimedout	0ac0bd93ae	fix: Default deserialize for `compatibility_mode`	2026-07-12 16:28:27 +01:00
Gingerandtimedout	fe9f718c6e	fix: Stop using the federation DNS resolver for non-federation requests	2026-07-12 16:11:00 +01:00
nexandEllis Git	e333f5a8e5	chore: announce	2026-07-12 04:14:23 +00:00
Ginger	b8c64a68d4	chore: Release	2026-07-12 00:09:26 -04:00
Ginger	163f049757	chore: Update changelog	2026-07-12 00:07:20 -04:00
Ginger	f48125c37a	fix: Remove dependency on aws-lc-rs	2026-07-11 22:48:30 -04:00
timedoutandEllis Git	4001b99261	style: Make send_join's docstring more useful	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	b6e5a106ff	fix: Don't unhelpfully panic when encountering an unrecognised room version	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	e1eea45fd6	style: Fix EOL	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	7cb53f41d6	chore: Add newsfrag	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	fbf81fcdeb	fix: Opportunistically re-use room format rules when parsing incoming PDUs	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	87030a3a22	fix: Ensure PDU returned by `create_hash_and_sign_event` is itself signed	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	4f509fa113	fix: Convert room summary to federation format when sending invites	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	aa7ed885c0	fix: Check correct field name when determining event type	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	d5e6e617d1	fix: Remove redundant banned room server checks These don't make sense here anyway	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	1f7680ad5f	feat: Give send_join the invite treatment	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	0c37a542d4	feat: Give send_leave the invite treatment	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	efd07da0d7	feat: Give send_knock the invite treatment	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	f0590e882a	fix: Only run ACL checks when we know we have live state Prevents a potential bug where we might inadvertently reject valid invites because we have a stale state cache that blocks the sender or even ourselves Also fixes the banned remote server room check by using the create event instead of room ID	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	7225bf25ae	feat: Persist create events received during the invite process	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	e52bb5db69	style: Move invite validation into own functions	2026-07-12 02:11:50 +00:00
timedoutandEllis Git	995726923b	feat: Enforce new federation invite checks These were introduced in spec v1.16 however we didn't implement them until now for compatibility.	2026-07-12 02:11:50 +00:00
GingerandEllis Git	556141b404	fix: Trim whitespace from OIDC client secret file	2026-07-12 02:06:48 +00:00
				`@@ -0,0 +1 @@`
				`Appservices are now properly able to create devices for E2EE.`
				`@@ -1 +0,0 @@`
				`Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.`
				`@@ -0,0 +1 @@`
				Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
				`@@ -1 +0,0 @@`
				Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`.
				`@@ -1 +0,0 @@`
				Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint.
				`@@ -0,0 +1 @@`
				`Fixed the deeplink redirect for deleting devices. Contributed by @koen`
				`@@ -0,0 +1 @@`
				`Fix status code for oauth registration. Contributed by @n00byking`
				`@@ -0,0 +1 @@`
				`Exempt m.room.create from auth_events check. Contributed by @eleboucher`