chore: News fragment

Co-authored-by: Ginger <ginger@gingershaped.computer>

.forgejo/actions/timelord/action.yml

@@ -71,7 +71,7 @@ runs:
 
     - name: Install timelord-cli and git-warp-time
       if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
+      uses: https://github.com/taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # v2
       with:
         tool: git-warp-time,timelord-cli@3.0.1
 

.forgejo/workflows/build-debian.yml

@@ -43,7 +43,7 @@ jobs:
       #    fi
 
       - name: Checkout repository with full history
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           ref: ${{ github.ref_name }}

.forgejo/workflows/build-nix.yml

@@ -65,7 +65,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           draft: true
           files: binaries/*

.forgejo/workflows/documentation.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Sync repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -32,7 +32,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 22
 

.forgejo/workflows/element.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: "22"
 

.forgejo/workflows/mirror-images.yml

@@ -41,7 +41,7 @@ jobs:
       DOCKER_MIRROR_TOKEN: ${{ secrets.DOCKER_MIRROR_TOKEN }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -55,7 +55,7 @@ jobs:
       #     repositories: continuwuity
 
       - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@39bf30ced4be9d147faaabbde2682e9725fb8bd1 # main
+        uses: https://github.com/regclient/actions/regsync-installer@c48159175b58fb90cccd0f98410927a81e04a166 # main
 
       - name: Check what images need mirroring
         run: |

.forgejo/workflows/prek-checks.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -48,7 +48,7 @@ jobs:
       rust: ${{ steps.filter.outputs.rust }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
@@ -70,7 +70,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 

.forgejo/workflows/release-image.yml

@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Prepare Docker build environment
@@ -101,7 +101,7 @@ jobs:
     needs: build-release
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Create multi-platform manifest
@@ -134,7 +134,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Prepare max-perf Docker build environment
@@ -189,7 +189,7 @@ jobs:
     needs: build-maxperf
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Create max-perf manifest
@@ -218,7 +218,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           draft: true
           files: binaries/*

.forgejo/workflows/renovate.yml

@@ -43,11 +43,11 @@ jobs:
     name: Renovate
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/renovatebot/renovate:43.252.1@sha256:121eb04ef758537019fb58f587aa53c99e5fda4e703993ce2ca01bd4b3926bd4
+      image: ghcr.io/renovatebot/renovate:43.281.1@sha256:34c2dd58f58e8976be2024a24fec23bbee805f0bf887837d9aaee7daeb09ccfc
       options: --tmpfs /tmp:exec
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           show-progress: false
 

.forgejo/workflows/update-flake-hashes.yml

@@ -14,7 +14,7 @@ jobs:
   update-flake-hashes:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: true
           token: ${{ secrets.FORGEJO_TOKEN }}

CHANGELOG.md

@@ -1,3 +1,27 @@
+# Continuwuity 26.6.2 (2026-07-12)
+
+## Bugfixes
+
+- Fixed the server returning 500 errors if `admin_console_automatic` is enabled and no TTY is available. Contributed by @s1lv3r. (#1975)
+- Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
+- Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.
+
+
+# Continuwuity 26.6.1 (2026-07-12)
+
+## Features
+
+- Added enforcement for new federated invite checks and corrected a bunch of related spec compliance issues along the way. Contributed by @nex. (#1952)
+
+## Bugfixes
+
+- Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`. (#1942)
+- Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint. (#1953)
+- Fixed newly created rooms failing to sync properly in clients using legacy sync.
+- Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.
+- Whitespace will now automatically be trimmed from the start and end of the `global.oauth.oidc.client_secret_file`.
+
+
 # Continuwuity 26.6.0 (2026-07-10)
 
 ## Features

CONTRIBUTING.md

@@ -26,7 +26,7 @@ ### Pre-commit Checks
 
 
 ```bash
-# Install prek using cargo-binstall
+# Install prek using cargo-binstall https://github.com/cargo-bins/cargo-binstall
 cargo binstall prek
 
 # Install git hooks to run checks automatically
@@ -155,7 +155,7 @@ ### Creating pull requests
 
 Before submitting a pull request, please ensure:
 1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
-2. Your code follows the [code style guide](/development/code_style.md)
+2. Your code follows the [code style guide](docs/development/code_style.mdx)
 3. Your commit messages follow the conventional commits format
 4. Tests are added for new functionality
 5. Documentation is updated if needed

Cargo.toml

@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.6.0"
+version = "26.6.2"
 
 [workspace.metadata.crane]
 name = "conduwuit"
@@ -115,8 +115,8 @@ git = "https://github.com/vinchona/axum-server-dual-protocol.git"
 rev = "ca6db055254255b74238673ce4135698e347d71c" # feat!: bump axum_server to 0.8.0
 default-features = false
 
-[workspace.dependencies.axum-client-ip]
-version = "1.3"
+[workspace.dependencies.client-ip]
+version = "0.2"
 
 [workspace.dependencies.tower]
 version = "0.5.2"
@@ -141,12 +141,6 @@ features = [
 version = "0.23.25"
 default-features = false
 
-[workspace.dependencies.aws-lc-sys]
-version = "0.41.0"
-
-[workspace.dependencies.aws-lc-rs]
-version = "1.17.0"
-
 [workspace.dependencies.reqwest]
 version = "0.13.2"
 default-features = false
@@ -350,7 +344,7 @@ version = "1.1.1"
 [workspace.dependencies.ruma]
 # version = "0.14.1"
 git = "https://github.com/ruma/ruma.git"
-rev = "9b6a2e7323649af926e4b5363d87239ee4247f4a"
+rev = "3ad047126b321d5fdcf170e1f2e545fed820cf75"
 features = [
     "appservice-api-c",
     "client-api",
@@ -509,7 +503,7 @@ default-features = false
 version = "0.1"
 
 [workspace.dependencies.syn]
-version = "2.0"
+version = "3.0"
 default-features = false
 features = ["full", "extra-traits"]
 
@@ -570,7 +564,7 @@ features = ["std"]
 version = "0.3.0"
 
 [workspace.dependencies.resolvematrix]
-version = "1.1.0"
+version = "1.2.0"
 
 [workspace.dependencies.serde_urlencoded]
 version = "0.7.1"

ROADMAP.md

@@ -1,34 +0,0 @@
-# Roadmap for PDU versioning
-
-Currently, PDUs are one monolithic `PduEvent` struct which applies a one-size-fits-all approach to PDUs, however as we
-support a wide range of room versions, this only just about currently works, and will cause more and more problems as
-time progresses. This branch will split the `PduEvent` struct into multiple versioned structs that represent the proper
-format for appropriate room versions, and will drop the `Event` trait in favour of Ruma's `ruma::state_res::Event`
-trait.
-
-This will require a lot of work, and since I forget everything the moment I look out the window, here be a list (waow):
-
-- [x] Split `PduEvent` into multiple versioned structs, implementing `ruma::state_res::Event` for each of them.
-- [ ] Refactor out all references to `PduEvent`.
-- [ ] Refactor out all references to `conduwuit_core::event::Event` trait in favour of `ruma::state_res::Event`.
-- [ ] Centralise PDU struct creation in a way that allows us to greater control the deserialization process.
-    - Developers can't be trusted to read documentation so we can't store the PDU metadata (things like event ID and
-      rejection status) in the PDU struct itself, as this may end up being leaked to consumers. Instead, PDU metadata
-      should be stored seprately from the PDU struct itself, but needs to be strongly associated with it (i.e. fetched
-      at the same time, always returned together, etc). This may take a form similar to
-      `StoredPdu<T: Event> { pdu: T, metadata: PduMetadata }`.
-- [ ] Stop storing generated data in the `unsigned` field, but instead calculate it on demand(?).
-    - Storing generated data in the `unsigned` field results in:
-        - History visibility cannot be enforced on `prev_content` or `redacted_because`.
-        - `age` is manually calculated but only sometimes.
-        - `membership` is not provided at all.
-        - `prev_content` can leak redacted state event content ([#1103]).
-        - `prev_content` cannot easily be populated for backfilled events, leaving them contextless.
-        - It is easy to accidentally leak `transaction_id`.
-
-Once `PduEvent` is gone, we can then do the following lovely things:
-
-- Drop our local state resolution logic and event authorisation logic and instead use Ruma's, which naturally receives
-  more love and attention. Our current `Event` trait and `PduEvent` implementations are incompatible with what Ruma
-  needs, and do not store the appropriate information required.
-- There's something else but I forgot just trust me

SECURITY.md

@@ -1,47 +1,90 @@
 # Security Policy for Continuwuity
 
-This document outlines the security policy for Continuwuity. Our goal is to maintain a secure platform for all users, and we take security matters seriously.
+This document outlines the security policy for Continuwuity. Our goal is to maintain a secure platform for all users,
+and we take security matters seriously.
 
 ## Supported Versions
 
 We provide security updates for the following versions of Continuwuity:
 
-| Version        | Supported        |
-| -------------- |:----------------:|
-| Latest release |        ✅        |
-| Main branch    |        ✅        |
-| Older releases |        ❌        |
+| Version        | Supported |
+|----------------|:---------:|
+| Latest release |     ✅     |
+| Main branch    |     ✅     |
+| Older releases |     ❌     |
 
-We may backport fixes to the previous release at our discretion, but we don't guarantee this.
+We may backport fixes to the previous release at our discretion, but we don't guarantee this; our versioning is designed
+to encourage users to stay up-to-date with the latest release, and we have no concept of "long term support".
 
 ## Reporting a Vulnerability
 
 ### Responsible Disclosure
 
-We appreciate the efforts of security researchers and the community in identifying and reporting vulnerabilities. To ensure that potential vulnerabilities are addressed properly, please follow these guidelines:
+We appreciate the efforts of security researchers and the community in identifying and reporting vulnerabilities. To
+ensure that potential vulnerabilities are addressed properly, please follow these guidelines:
 
 1. **Contact members of the team directly** over E2EE private message.
-   - [@jade:ellis.link](https://matrix.to/#/@jade:ellis.link)
-   - [@nex:nexy7574.co.uk](https://matrix.to/#/@nex:nexy7574.co.uk)
-   - [@ginger:gingershaped.computer](https://matrix.to/#/@ginger:gingershaped.computer)
-2. **Email the security team** at [security@continuwuity.org](mailto:security@continuwuity.org). This is not E2EE, so don't include sensitive details.
-3. **Do not disclose the vulnerability publicly** until it has been addressed
+    - [@jade:ellis.link](https://matrix.to/#/@jade:ellis.link)
+    - [@nex:nexy7574.co.uk](https://matrix.to/#/@nex:nexy7574.co.uk)
+    - [@ginger:gingershaped.computer](https://matrix.to/#/@ginger:gingershaped.computer)
+2. **Email the security team** at [security@continuwuity.org](mailto:security@continuwuity.org). This is not E2EE, so
+   don't include sensitive details.
+3. **Do not disclose the vulnerability publicly** until a fix has been pushed to the main branch.
 4. **Provide detailed information** about the vulnerability, including:
-   - A clear description of the issue
-   - Steps to reproduce
-   - Potential impact
-   - Any possible mitigations
-   - Version(s) affected, including specific commits if possible
+    - A clear description of the issue
+    - Steps to reproduce
+    - Potential impact
+    - Any possible mitigations
+    - Version(s) affected, including specific commits if possible
+    - How you want to be attributed if your report is accepted (website, social media handle, Matrix user ID, etc).
+      **Please state explicitly if you wish to remain anonymous.**
 
-If you have any doubts about a potential security vulnerability, contact us via private channels first! We'd prefer that you bother us, instead of having a vulnerability disclosed without a fix.
+If you have any doubts about a potential security vulnerability, contact us via private channels first! We'd prefer that
+you bother us, instead of having a vulnerability disclosed without a fix.
 
-### What to Expect
+### Terms for credit
+
+Before reporting a vulnerability, please remember that we are a small team maintaining a large codebase depended upon by
+a vast unknown number of users in our free time. While we always investigate *all* security reports, we may not
+acknowledge or credit your report under certain circumstances.
+
+#### Following the security policy
+
+If you do not report the vulnerability following this security policy, your report may be ignored and/or may not be
+credited if fixed. This includes filing for GitHub security advisories without contacting us directly first (we do not
+get notified about these!).
+
+#### Automation-assisted reports
+
+Reports assisted by automatic tooling such as LLMs MUST disclose such in the report.
+Assisted reports must also produce a working proof-of-concept (PoC) demonstrating the vulnerability against the latest
+release and/or main commit with no modifications to the codebase. This is to demonstrate that not only does
+the author understand the vulnerability that they are reporting, but also that the vulnerability is reproducible
+and not a false positive.
+
+#### Reports for known issues
+
+Reports for issues we are already aware of will only be credited if subsequent reporters provide new information.
+
+#### Audits and CVE farming
+
+Sweeping audits (vulnerability hunting) **must** be coordinated with the team first - receiving a rapsheet of new
+vulnerabilities is explicitly not helpful to us and only harms the project. If you are interested in performing a
+security audit, please contact us first to discuss the scope and methodology.
+
+Likewise, CVE farming (reporting vulnerabilities with the primary intent to get a CVE number) is actively harmful to the
+project, and will not be credited. Severe violations of this policy will result in a permanent ban from collaborating
+with the project in any capacity. We are attempting to build high quality free software, not flesh out your CV/resume.
+
+### What to expect
 
 When you report a security vulnerability:
 
-1. **Acknowledgment**: We will acknowledge receipt of your report.
-2. **Assessment**: We will assess the vulnerability and determine its impact on our users
-3. **Updates**: We will provide updates on our progress in addressing the vulnerability, and may request you help test mitigations
+1. **Acknowledgment**: We will acknowledge receipt of your report. We may ask for further information.
+2. **Triage**: The report will be triaged into our internal tracker, and you will be provided with a reference number (
+   in case you end up with multiple reports). An ETA for a fix will be provided if feasible.
+3. **Updates**: We will provide updates on our progress in addressing the vulnerability, including a heads-up for when
+   we plan to release a fix.
 4. **Resolution**: Once resolved, we will notify you and discuss coordinated disclosure
 5. **Credit**: We will recognize your contribution (unless you prefer to remain anonymous)
 
@@ -51,7 +94,8 @@ ## Security Update Process
 
 1. We will develop and test fixes in a private fork
 2. Security updates will be released as soon as possible
-3. Release notes will include information about the vulnerabilities, avoiding details that could facilitate exploitation where possible
+3. Release notes will include information about the vulnerabilities, avoiding details that could facilitate exploitation
+   where possible
 4. Critical security updates may be backported to the previous stable release
 
 ## Additional Resources

changelog.d/+16e3dce7.feature.md

@@ -0,0 +1 @@
+Added support for the OAuth2 device authorization flow. Contributed by @ginger

changelog.d/+30d4369c.bugfix.md

@@ -0,0 +1 @@
+Fixed requests returning `500 Internal Server Error` when the header selected by `request_ip_source` is absent, duplicated, or malformed (for example Envoy omitting `X-Envoy-External-Address` on internal requests). The client IP now falls back to the connection peer address instead of failing the request. Contributed by @eleboucher

changelog.d/+39fcec3a.bugfix.md

@@ -0,0 +1 @@
+Appservices are now properly able to create devices for E2EE.

changelog.d/+724f9fed.bugfix.md

@@ -0,0 +1 @@
+Resolve alias service by correct name for auto-join. Contributed by @eleboucher

changelog.d/+8b3a57647.bugfix.md

@@ -0,0 +1 @@
+Fixed newly joined rooms failing to sync their full state (including the room name) to clients using legacy sync.

changelog.d/+91e96207.bugfix.md

@@ -1 +0,0 @@
-Stopped appservice users from being erroneously marked as deactivated during a 26.6 database migration.

changelog.d/+a3260bd06.bugfix.md

@@ -0,0 +1 @@
+Fixed `roomuserid_lastnotificationread` being aliased to the highlight count table, which clobbered highlight counts when setting a read marker. Contributed by @eleboucher

changelog.d/+cde4a9ec3.bugfix.md

@@ -0,0 +1 @@
+Fixed freshly left room failing to sync.

changelog.d/+df2f1c78.bugfix.md

@@ -0,0 +1 @@
+Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.

changelog.d/+push-joined-count.perf.md

@@ -0,0 +1 @@
+Fetch the joined member count once per event instead of once per notified user.

changelog.d/1942.bugfix.md

@@ -1 +0,0 @@
-Fixed existing accounts failing to link when logging in with OIDC if `prompt_for_localpart` was `false`.

changelog.d/1953.bugfix.md

@@ -1 +0,0 @@
-Authentication is no longer required on the `/_matrix/client/v3/account/3pid/email/requestToken` endpoint.

changelog.d/1965.bugfix

@@ -0,0 +1 @@
+Fixed the deeplink redirect for deleting devices. Contributed by @koen

changelog.d/1970.feature.md

@@ -0,0 +1 @@
+Dehydrated devices are now visible in the account panel. Contributed by @ginger.

changelog.d/1984.bugfix

@@ -0,0 +1 @@
+Fix status code for oauth registration. Contributed by @n00byking

changelog.d/1985.feature

@@ -0,0 +1 @@
+Introduce `accepted_ip_sources` as a multiple options variant of `request_ip_source`, allowing for more advanced deployments and making fallbacks an explicit choice. Contributed by @Omar007

changelog.d/1987.bugfix

@@ -0,0 +1 @@
+Exempt m.room.create from auth_events check. Contributed by @eleboucher

changelog.d/1994.bugfix.md

@@ -0,0 +1 @@
+Fixed `create` being returned as a supported prompt value regardless of if registration is enabled or not. Contributed by @ginger

changelog.d/1999.doc

@@ -0,0 +1 @@
+Updated an out-of-date statement about Oracle Linux release cadences.

changelog.d/2006.bugfix

@@ -0,0 +1 @@
+Fixed high CPU usage when multiple clients from the same account were connected at once. Each sync woke the account's other sync loops, causing them to wake each other in a loop.

changelog.d/2015.bugfix.md

@@ -0,0 +1 @@
+Fixed MSC4190 appservice device creation registering a random device ID instead of the requested one (and dropping the requested display name), which prevented encrypted mautrix bridges from starting on OIDC-enabled servers and leaked an orphan device on the bridge bot per startup attempt.

changelog.d/2040.bugfix.md

@@ -0,0 +1 @@
+Deactivated users and appservice puppets are no longer counted by `/_continuwuity/local_user_count`. Contributed by @ginger.

changelog.d/2044.feature.md

@@ -0,0 +1 @@
+Added an admin command to issue an access token for a bot account, to allow legacy bots to function while legacy authentication is disabled.

changelog.d/2057.bugfix.md

@@ -0,0 +1 @@
+Re-introduced admin room registration alerts that were accidentally removed in the OAuth2 update.

changelog.d/fix-federation-signature.bugfix

@@ -0,0 +1 @@
+Fix joining restricted rooms over federation failing with signature verification error.

changelog.d/space-hierarchy-cycle.bugfix.md

@@ -0,0 +1 @@
+Fixed the client space hierarchy endpoint returning a 500 "Space hierarchy is unreasonably large" error for cyclic space graphs (e.g. a space containing itself). Rooms are now deduplicated during traversal as required by the spec, and the traversal depth is bounded even when the client does not specify `max_depth`.

changelog.d/sss-account-data-longpoll.bugfix.md

@@ -0,0 +1 @@
+Fixed simplified sliding sync holding account data for up to 30 seconds, which made encryption setup and cross-signing resets appear to hang.

changelog.d/wake-local-member-sync.bugfix.md

@@ -0,0 +1 @@
+Fixed local invites and invite acceptances not being reflected in sync promptly. Contributed by @eleboucher

conduwuit-example.toml

@@ -290,7 +290,7 @@
 #
 #ip_lookup_strategy = 5
 
-# The source to use for discovering the real connecting client IP.
+# The preferred source to use for getting the real client IP.
 #
 # Takes any of the following options:
 #
@@ -301,16 +301,47 @@
 # "true_client_ip" - `True-Client-Ip` header
 # "x_envoy_external_address" - `X-Envoy-External-Address` header
 # "x_real_ip" - `X-Real-Ip` header
+# "direct" - the directly connected IP address (fallback for other
+# options)
 #
 # Only set this if you are certain only your reverse proxy
 # will send the expected header. There is no "is the connecting IP allowed
 # to set this header" check; if the header selected is present, it is
 # used.
 #
-# Defaults to the IP address actually making the connection.
+# Ignored if `accepted_ip_sources` is set.
+#
+# If not set set, `direct` is used. Additionally, `direct` is used
+# as a fallback if the chosen header is not found.
 #
 #request_ip_source = false
 
+# The accepted source(s) for the real client IP.
+#
+# Takes any combination of the following options:
+#
+# "cf_connecting_ip" - `Cf-Connecting-Ip` header
+# "cloudfront_viewer_address" - `CloudFront-Viewer-Address` header
+# "fly_client_ip" - `Fly-Client-IP` header
+# "x_forwarded_for" - rightmost value of the `X-Forwarded-For` header
+# "true_client_ip" - `True-Client-Ip` header
+# "x_envoy_external_address" - `X-Envoy-External-Address` header
+# "x_real_ip" - `X-Real-Ip` header
+# "direct" - the directly connected IP address
+#
+# Only set this if you are certain only your reverse proxy
+# will send the expected header. There is no "is the connecting IP allowed
+# to set this header" check; if the header selected is present, it is
+# used.
+#
+# One of the configured sources must be available or the request is
+# rejected. If you want a fallback (including `direct`!), you have to
+# configure it. Priority is based on configuration order.
+#
+# If not set, `request_ip_source` configuration is used.
+#
+#accepted_ip_sources = []
+
 # Max request size for file uploads in bytes. Defaults to 20MB.
 # Also limits incoming federated media.
 #

docker/Dockerfile

@@ -50,7 +50,7 @@ EOF
 
 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.20.1
+ENV BINSTALL_VERSION=1.21.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree

docker/musl.Dockerfile

@@ -18,7 +18,7 @@ RUN --mount=type=cache,target=/etc/apk/cache apk add \
 
 # Developer tool versions
 # renovate: datasource=github-releases depName=cargo-bins/cargo-binstall
-ENV BINSTALL_VERSION=1.20.1
+ENV BINSTALL_VERSION=1.21.1
 # renovate: datasource=github-releases depName=psastras/sbom-rs
 ENV CARGO_SBOM_VERSION=0.9.1
 # renovate: datasource=crate depName=lddtree

docs/deploying/rpm.mdx

@@ -15,8 +15,8 @@ ## Overview
 
 :::warning Oracle Linux support
 Due to upstream limitations, Terra is only usable on Oracle Linux if you use [upstream EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/)
-rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, as of the time of writing, 10.2 has been
-available for over a month through other ELs, but Oracle has not yet released corresponding updates—so you may encounter further compatibility issues with EPEL.
+rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, Oracle's release of 10.2 lagged
+approximately 1.5 months behind other ELs—so you may encounter further compatibility issues with EPEL.
 **For this reason, it is recommended that you use another EL distribution if at all possible.**
 :::
 

docs/public/.well-known/continuwuity/announcements

@@ -6,10 +6,10 @@
             "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
         },
         {
-            "id": 15,
+            "id": 16,
             "mention_room": true,
-            "date": "2026-07-10",
-            "message": "[Continuwuity 26.6.0](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.0) is finally out! This is by far our largest release yet, and it wouldn't have been possible without our community. Thank you so much for all of your patience, support, and/or development time over the last three months <3"
+            "date": "2026-07-13",
+            "message": "[Continuwuity 26.6.2](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release fixes a severe bug with OIDC that could cause users' accounts to be flagged as deactivated. If you use OIDC, please update as soon as possible."
         }
     ]
 }

flake.lock

@@ -3,11 +3,11 @@
     "advisory-db": {
       "flake": false,
       "locked": {
-        "lastModified": 1781566179,
-        "narHash": "sha256-Tqv8I586fYzWpEW/Smq/JqESFa3DVVzVWsnAMtvhy/I=",
+        "lastModified": 1783840254,
+        "narHash": "sha256-XjyvZk0f3YiinVHmkGOotmLBAzvK+LwEJYj2QqJ5pn8=",
         "owner": "rustsec",
         "repo": "advisory-db",
-        "rev": "74e084413d979d52d2f93b1d93b1ab7b9ee648f5",
+        "rev": "6e3286f4efa8c142fb33e5ea4342c8db6693cf34",
         "type": "github"
       },
       "original": {
@@ -18,11 +18,11 @@
     },
     "crane": {
       "locked": {
-        "lastModified": 1780532242,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
+        "lastModified": 1783203018,
+        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
+        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
         "type": "github"
       },
       "original": {
@@ -39,11 +39,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1781527054,
-        "narHash": "sha256-1fX9ev2Fh5QoKQ41G9dYutjo5j/jywu6tZse5Eb1Ck4=",
+        "lastModified": 1783844668,
+        "narHash": "sha256-3MOpw4y3reoErRLvFBDz0t9aG6FWXUj7leKvUns5eQA=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "8c2e51dffefc040a21975da7abf6f252c8c9b783",
+        "rev": "4e49ef62eedaa5c149d62b63b3f53844e1cc45d7",
         "type": "github"
       },
       "original": {
@@ -74,11 +74,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -89,11 +89,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "lastModified": 1783776592,
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
         "type": "github"
       },
       "original": {
@@ -105,11 +105,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1777168982,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -132,11 +132,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1781453968,
-        "narHash": "sha256-+V3nK4pCngbmgyVGXY6Kkrlevp4ocPkJJLf2aqwkDNA=",
+        "lastModified": 1783779020,
+        "narHash": "sha256-vpm418WZa9l1KUl6HRs+Ga+SIfE+D2/sV4olwTlilYc=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "cc272809a173c2c11d0e479d639c811c1eacf049",
+        "rev": "5be5e89cf0145d73a85c805726821b4adfc3af48",
         "type": "github"
       },
       "original": {

nix/devshell.nix

@@ -9,7 +9,7 @@
     {
       # basic nix shell containing all things necessary to build continuwuity in all flavors manually (on x86_64-linux)
       devShells.default =
-        ((inputs.crane.mkLib pkgs).overrideToolchain (pkgs: self'.packages.stable-toolchain)).devShell
+        ((inputs.crane.mkLib pkgs).overrideToolchain (pkgs: self'.packages.dev-toolchain)).devShell
           {
             packages = [
               self'.packages.rocksdb

nix/rust.nix

@@ -12,7 +12,7 @@
         target:
         target.fromToolchainName {
           name = (lib.importTOML "${inputs.self}/rust-toolchain.toml").toolchain.channel;
-          sha256 = "sha256-OATSZm98Es5kIFuqaba+UvkQtFsVgJEBMmS+t6od5/U=";
+          sha256 = "sha256-A1abGIbOtcBSdrUMhDGrER3pRM1hQP4fp9gh3Y4PKc8=";
         };
     in
     {
@@ -27,9 +27,9 @@
           inherit stable-toolchain;
 
           dev-toolchain = fnx.combine [
-            stable-toolchain
             # use the nightly rustfmt because we use nightly features
             fnx.complete.rustfmt
+            stable-toolchain
           ];
         };
     };

package-lock.json

@@ -419,9 +419,9 @@
       }
     },
     "node_modules/@rspress/core": {
-      "version": "2.0.17",
-      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.17.tgz",
-      "integrity": "sha512-oynYHE2aBj7BFzD/UgqKnrj/PyYxfWGrmRPlTmjLL22UPcocdUdFYLb/6nijyseAST59VMr5Gj4wOfFUeJT5vw==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/@rspress/core/-/core-2.0.18.tgz",
+      "integrity": "sha512-DBpsr/6XAItQkZPL5FSjthLGuzdG9ks/7EOxkqaaXp93uAT54LO0PD5Dkoy6ydup1PnvkpHyiHpUyDcnHHTVhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -429,7 +429,7 @@
         "@mdx-js/react": "^3.1.1",
         "@rsbuild/core": "^2.1.5",
         "@rsbuild/plugin-react": "~2.1.0",
-        "@rspress/shared": "2.0.17",
+        "@rspress/shared": "2.0.18",
         "@shikijs/rehype": "^4.2.0",
         "@types/unist": "^3.0.3",
         "@unhead/react": "^2.1.15",
@@ -472,9 +472,9 @@
       }
     },
     "node_modules/@rspress/plugin-client-redirects": {
-      "version": "2.0.17",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.17.tgz",
-      "integrity": "sha512-HJMlW5xsQe2cAFYNHw3LhMy8WcuqRb4l0ey3E3OIu121ymbSLqIQJVPS/IF/NuoyPoxCAmV58LYIaCxGEriUww==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-client-redirects/-/plugin-client-redirects-2.0.18.tgz",
+      "integrity": "sha512-q70ufN0S125kl0QlucO7JuiZ0WJaxFOtPPoGu7eWwam9fb+i4YsWnOWtAKSKGH4JP5+897mgpDPP+dmfl9DPCw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -485,9 +485,9 @@
       }
     },
     "node_modules/@rspress/plugin-sitemap": {
-      "version": "2.0.17",
-      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.17.tgz",
-      "integrity": "sha512-MpNxF+hFK7zsk8t+Ta7KYI/Py6Csjyw0AMGrWf3XG/kr0+fisVxbT/jUanXRLSoj2m9VX9CVsi180rPnezUpbQ==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/@rspress/plugin-sitemap/-/plugin-sitemap-2.0.18.tgz",
+      "integrity": "sha512-XfaXzZx+ASN9OMTc0fOvW8QmbmyCyDWkO8xJj4XF4E0YJtsu7j/65+v8/KXXdwpywOfUIQ6M94/meRTy2urNmQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -498,9 +498,9 @@
       }
     },
     "node_modules/@rspress/shared": {
-      "version": "2.0.17",
-      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.17.tgz",
-      "integrity": "sha512-ZzpZ4hm5svgwU0w5CpTLZy4vFD3uPo8+gXtWMOREYMzwfzJeHqwOyXwxHf6byGpx85mVK5DQqMDi61meAS7ZUw==",
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/@rspress/shared/-/shared-2.0.18.tgz",
+      "integrity": "sha512-GJswqJQCPSxvBt5r+gJzz8Em8EEK/sOmCQjTpemTvldvxr1Lva85BGVnSQZOgofnM0nrjt18kn4mmnuuSstbpA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -510,14 +510,14 @@
       }
     },
     "node_modules/@shikijs/core": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.2.0.tgz",
-      "integrity": "sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
+      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@shikijs/primitive": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/primitive": "4.3.1",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "@types/hast": "^3.0.4",
         "hast-util-to-html": "^9.0.5"
@@ -527,13 +527,13 @@
       }
     },
     "node_modules/@shikijs/engine-javascript": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.2.0.tgz",
-      "integrity": "sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
+      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "oniguruma-to-es": "^4.3.6"
       },
@@ -542,13 +542,13 @@
       }
     },
     "node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.2.0.tgz",
-      "integrity": "sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.3.1.tgz",
+      "integrity": "sha512-OXyNMzg0pews+msMj4cHeqT4xiYKKvbnn6VbdAXxfoFl3SSx4fJTc8FadECuc5/H9p3BzhNAoAUXKwAu9rWYhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2"
       },
       "engines": {
@@ -556,26 +556,26 @@
       }
     },
     "node_modules/@shikijs/langs": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.2.0.tgz",
-      "integrity": "sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
+      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@shikijs/primitive": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.2.0.tgz",
-      "integrity": "sha512-NOq+DtUkVBJtZMVXL5A0vI0Xk8nvDYaXetFHSJFlOqjDZIVhIPRYFdGkSoElDqNuegikcc3A76SNUa8dTqtAYA==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.3.1.tgz",
+      "integrity": "sha512-CXQRQOYy1leqQ8ceTeJdmXv/bsUY++6QyLpXJ94LZAAYj5X2SKRdc5ipguv4NPyGVKItB2PPwUpRNe0Sjh5S1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "@types/hast": "^3.0.4"
       },
@@ -584,16 +584,16 @@
       }
     },
     "node_modules/@shikijs/rehype": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.2.0.tgz",
-      "integrity": "sha512-ST3EWye/dwF1gWskczJNBnwFtDzEQ9ceytXZtyc/GfwR5V0qJrkoSGZO55O3SAKDDsXkTDcsfwd9pVe7ROlAHg==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.3.1.tgz",
+      "integrity": "sha512-oshrlfUF3VPUJfnp5K1lLwsS/SRBKrIxONpdWebSKZXdBE3UsZnxgqpvRUA8UsofS7vmjFOCAHIT71ECbmOxTw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
         "@types/hast": "^3.0.4",
         "hast-util-to-string": "^3.0.1",
-        "shiki": "4.2.0",
+        "shiki": "4.3.1",
         "unified": "^11.0.5",
         "unist-util-visit": "^5.1.0"
       },
@@ -602,22 +602,22 @@
       }
     },
     "node_modules/@shikijs/themes": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
-      "integrity": "sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
+      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
       },
       "engines": {
         "node": ">=20"
       }
     },
     "node_modules/@shikijs/types": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -684,9 +684,9 @@
       }
     },
     "node_modules/@types/hast": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.4.tgz",
-      "integrity": "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==",
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
+      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1076,9 +1076,9 @@
       }
     },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
+      "integrity": "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==",
       "dev": true,
       "license": "ISC"
     },
@@ -3589,18 +3589,18 @@
       "license": "MIT"
     },
     "node_modules/shiki": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz",
-      "integrity": "sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.3.1.tgz",
+      "integrity": "sha512-oR+qDVi2OjX1tmDpyv+3KviX01KzO6Af+0NNnKnsp9491UEGz2YpxTuJboS/6VhYpTdqzmuJBuiTlrAWWJAssw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@shikijs/core": "4.2.0",
-        "@shikijs/engine-javascript": "4.2.0",
-        "@shikijs/engine-oniguruma": "4.2.0",
-        "@shikijs/langs": "4.2.0",
-        "@shikijs/themes": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/core": "4.3.1",
+        "@shikijs/engine-javascript": "4.3.1",
+        "@shikijs/engine-oniguruma": "4.3.1",
+        "@shikijs/langs": "4.3.1",
+        "@shikijs/themes": "4.3.1",
+        "@shikijs/types": "4.3.1",
         "@shikijs/vscode-textmate": "^10.0.2",
         "@types/hast": "^3.0.4"
       },

renovate.json

@@ -60,6 +60,13 @@
             "matchPackageNames": ["rust", "rustc", "cargo"],
             "groupName": "rust-toolchain"
         },
+        {
+            "description": "Delay major rust toolchain updates",
+            "matchManagers": ["custom.regex"],
+            "matchPackageNames": ["rust", "rustc", "cargo"],
+            "matchUpdateTypes": ["major"],
+            "minimumReleaseAge": "30 days"
+        },
         {
             "description": "Batch minor and patch GitHub Actions updates",
             "matchManagers": ["github-actions"],

rust-toolchain.toml

@@ -10,7 +10,7 @@
 
 [toolchain]
 profile = "minimal"
-channel = "1.97.0"
+channel = "1.97.1"
 components = [
     # For rust-analyzer
     "rust-src",

src/admin/debug/commands.rs

@@ -486,7 +486,7 @@ pub(super) async fn get_remote_pdu(
 						.services
 						.rooms
 						.event_handler
-						.parse_incoming_pdu(&response.pdu)
+						.parse_incoming_pdu(&response.pdu, None)
 						.boxed()
 						.await;
 
@@ -832,7 +832,7 @@ pub(super) async fn force_set_room_state_from_server(
 				.services
 				.rooms
 				.event_handler
-				.parse_incoming_pdu(&pdu)
+				.parse_incoming_pdu(&pdu, Some(&room_version_rules))
 				.await
 			{
 				| Ok(t) => t,
@@ -1014,7 +1014,7 @@ pub(super) async fn resolve_true_destination(
 		let resolver: &MatrixResolver = if no_cache {
 			&MatrixResolverBuilder::new()
 				.dangerous_tls_accept_invalid_certs(self.services.server.config.allow_invalid_tls_certificates_yes_i_know_what_the_fuck_i_am_doing_with_this_and_i_know_this_is_insecure)
-				.http_client(self.services.client.default.clone())
+				.http_client(self.services.client.dns.clone())
 				.build()?
 		} else {
 			&self.services.client.matrix_resolver

src/admin/federation/commands.rs

@@ -54,7 +54,7 @@ pub(super) async fn fetch_support_well_known(&self, server_name: OwnedServerName
 		let response = self
 			.services
 			.client
-			.default
+			.external_resource
 			.get(format!("https://{server_name}/.well-known/matrix/support"))
 			.send()
 			.await?;

src/admin/token/commands.rs

@@ -3,7 +3,7 @@
 use service::registration_tokens::TokenExpires;
 
 impl crate::Context<'_> {
-	pub(super) async fn issue_token(&self, expires: super::TokenExpires) -> Result {
+	pub(super) async fn issue_registration_token(&self, expires: super::TokenExpires) -> Result {
 		let expires = {
 			if expires.immortal {
 				None

src/admin/token/mod.rs

@@ -10,7 +10,7 @@
 pub enum TokenCommand {
 	/// Issue a new registration token
 	#[clap(name = "issue")]
-	IssueToken {
+	IssueRegistrationToken {
 		/// When this token will expire.
 		#[command(flatten)]
 		expires: TokenExpires,

src/admin/user/commands.rs

@@ -20,7 +20,7 @@
 		tag::{TagEvent, TagEventContent, TagInfo},
 	},
 };
-use service::users::{AccountStatus, HashedPassword};
+use service::users::{AccountStatus, DeviceToken, HashedPassword};
 
 use crate::{
 	get_room_info,
@@ -59,13 +59,42 @@ pub(super) async fn create_user(&self, username: String, password: Option<String
 
 		self.services
 			.users
-			.create_local_account(&user_id, Some(HashedPassword::new(password)?), None)
+			.create_local_account(
+				&user_id,
+				Some(HashedPassword::new(password)?),
+				None,
+				None,
+				None,
+			)
 			.await?;
 
 		self.write_str(&format!("Created user {user_id} with password `{password}`"))
 			.await
 	}
 
+	pub(super) async fn issue_access_token(&self, username: String, password: String) -> Result {
+		let user_id = parse_active_local_user_id(self.services, &username).await?;
+
+		let user_id = self
+			.services
+			.users
+			.check_password(&user_id, &password)
+			.await?;
+		let token = DeviceToken::new_random();
+
+		let device_id = self
+			.services
+			.users
+			.create_device(&user_id, None, Some(token.clone()), None, None)
+			.await?;
+
+		self.write_str(&format!(
+			"Created device `{device_id}` with access token `{}` for {user_id}",
+			token.into_token()
+		))
+		.await
+	}
+
 	pub(super) async fn deactivate(&self, no_leave_rooms: bool, user_id: String) -> Result {
 		// Validate user id
 		let user_id = parse_local_user_id(self.services, &user_id)?;
@@ -102,7 +131,6 @@ pub(super) async fn deactivate(&self, no_leave_rooms: bool, user_id: String) ->
 	}
 
 	pub(super) async fn suspend(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -123,7 +151,6 @@ pub(super) async fn suspend(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn unsuspend(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -935,7 +962,6 @@ pub(super) async fn force_leave_remote_room(
 	}
 
 	pub(super) async fn lock(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -956,7 +982,6 @@ pub(super) async fn lock(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn unlock(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		self.services.users.unlock_account(&user_id).await;
@@ -966,7 +991,6 @@ pub(super) async fn unlock(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn logout(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -992,7 +1016,6 @@ pub(super) async fn logout(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn disable_login(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		if user_id == self.services.globals.server_user {
@@ -1011,7 +1034,6 @@ pub(super) async fn disable_login(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn enable_login(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_active_local_user_id(self.services, &user_id).await?;
 
 		self.services.users.enable_login(&user_id);
@@ -1020,7 +1042,6 @@ pub(super) async fn enable_login(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn get_email(&self, user_id: String) -> Result {
-		self.bail_restricted()?;
 		let user_id = parse_local_user_id(self.services, &user_id)?;
 
 		match self
@@ -1039,8 +1060,6 @@ pub(super) async fn get_email(&self, user_id: String) -> Result {
 	}
 
 	pub(super) async fn get_user_by_email(&self, email: String) -> Result {
-		self.bail_restricted()?;
-
 		let Ok(email) = Address::try_from(email) else {
 			return Err!("Invalid email address.");
 		};
@@ -1063,8 +1082,6 @@ pub(super) async fn get_user_by_email(&self, email: String) -> Result {
 	}
 
 	pub(super) async fn change_email(&self, user_id: String, email: Option<String>) -> Result {
-		self.bail_restricted()?;
-
 		let user_id = parse_local_user_id(self.services, &user_id)?;
 		let Ok(new_email) = email.map(Address::try_from).transpose() else {
 			return Err!("Invalid email address.");

src/admin/user/mod.rs

@@ -18,6 +18,15 @@ pub enum UserCommand {
 		password: Option<String>,
 	},
 
+	/// Issue an access token for a user. This command will not work on
+	/// shadow users, such as appservice puppets or accounts imported from
+	/// an identity provider.
+	#[clap(name = "issue-token")]
+	IssueAccessToken {
+		username: String,
+		password: String,
+	},
+
 	/// Reset user password
 	ResetPassword {
 		/// Log out existing sessions

src/api/Cargo.toml

@@ -64,11 +64,11 @@ zstd_compression = [
 
 [dependencies]
 async-trait.workspace = true
-axum-client-ip.workspace = true
 axum-extra.workspace = true
 axum.workspace = true
 base64.workspace = true
 bytes.workspace = true
+client-ip.workspace = true
 conduwuit-core.workspace = true
 conduwuit-macros.workspace = true
 conduwuit-service.workspace = true

src/api/client/account/mod.rs

@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err, info,
 	pdu::PartialPdu,
@@ -26,7 +25,6 @@
 };
 use service::{mailer::messages, uiaa::UiaaInitiator, users::HashedPassword};
 
-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::{Ruma, router::ClientIdentity};
 
 pub(crate) mod register;
@@ -43,10 +41,9 @@
 ///
 /// Note: This will not reserve the username, so the username might become
 /// invalid when trying to register
-#[tracing::instrument(skip_all, fields(%client), name = "register_available", level = "info")]
+#[tracing::instrument(skip_all, name = "register_available", level = "info")]
 pub(crate) async fn get_register_available_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_username_availability::v3::Request>,
 ) -> Result<get_username_availability::v3::Response> {
 	let _ = services
@@ -80,10 +77,9 @@ pub(crate) async fn get_register_available_route(
 ///   last seen ts)
 /// - Forgets to-device events
 /// - Triggers device list updates
-#[tracing::instrument(skip_all, fields(%client), name = "change_password", level = "info")]
+#[tracing::instrument(skip_all, name = "change_password", level = "info")]
 pub(crate) async fn change_password_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<change_password::v3::Request>,
 ) -> Result<change_password::v3::Response> {
 	let identity = if let Some(identity) = body.identity.as_ref() {
@@ -248,10 +244,9 @@ pub(crate) async fn whoami_route(
 /// - Forgets all to-device events
 /// - Triggers device list updates
 /// - Removes ability to log in again
-#[tracing::instrument(skip_all, fields(%client), name = "deactivate", level = "info")]
+#[tracing::instrument(skip_all, name = "deactivate", level = "info")]
 pub(crate) async fn deactivate_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<deactivate::v3::Request>,
 ) -> Result<deactivate::v3::Response> {
 	// Authentication for this endpoint is technically optional,

src/api/client/account/register.rs

@@ -1,11 +1,7 @@
 use std::collections::HashMap;
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
-use conduwuit::{
-	Err, Result, debug_info, info,
-	utils::{self},
-};
+use conduwuit::{Err, Result, debug_info, info};
 use conduwuit_service::Services;
 use futures::StreamExt;
 use lettre::{Address, message::Mailbox};
@@ -20,10 +16,12 @@
 	assign,
 };
 use serde_json::value::RawValue;
-use service::{mailer::messages, users::HashedPassword};
+use service::{
+	mailer::messages,
+	users::{DeviceToken, HashedPassword},
+};
 
-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};
 
 /// # `POST /_matrix/client/v3/register`
 ///
@@ -33,10 +31,10 @@
 /// /_matrix/client/v3/register/available`](fn.get_register_available_route.
 /// html) to check if the user id is valid and available.
 #[allow(clippy::doc_markdown)]
-#[tracing::instrument(skip_all, fields(%client), name = "register", level = "info")]
+#[tracing::instrument(skip_all, name = "register", level = "info")]
 pub(crate) async fn register_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for metadata.
 	body: Ruma<register::v3::Request>,
 ) -> Result<register::v3::Response> {
 	if body.kind != RegistrationKind::User {
@@ -97,7 +95,13 @@ pub(crate) async fn register_route(
 
 		services
 			.users
-			.create_local_account(&user_id, Some(password), identity.email)
+			.create_local_account(
+				&user_id,
+				Some(password),
+				identity.email,
+				Some(&client),
+				body.initial_device_display_name.as_deref(),
+			)
 			.await?;
 
 		user_id
@@ -112,27 +116,21 @@ pub(crate) async fn register_route(
 			)));
 		}
 
-		// Generate new device id if the user didn't specify one
-		let device_id = body
-			.device_id
-			.clone()
-			.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
-
 		// Generate new token for the device
-		let new_token = utils::random_string(TOKEN_LENGTH);
+		let new_token = DeviceToken::new_random();
 
 		// Create device for this account
-		services
+		let device_id = services
 			.users
 			.create_device(
 				&user_id,
-				&device_id,
-				&new_token,
-				None,
+				body.device_id.clone(),
+				Some(new_token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
 			.await?;
+
 		(Some(new_token), Some(device_id))
 	} else {
 		// Don't create a device for inhibited logins
@@ -142,7 +140,7 @@ pub(crate) async fn register_route(
 	debug_info!(%user_id, ?device, "New account created via legacy registration");
 
 	Ok(assign!(register::v3::Response::new(user_id), {
-		access_token: token,
+		access_token: token.map(DeviceToken::into_token),
 		device_id: device,
 		refresh_token: None,
 		expires_in: None,

src/api/client/dehydrated_device.rs

@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, at};
 use futures::StreamExt;
 use ruma::{
@@ -19,10 +18,9 @@
 /// # `PUT /_matrix/client/../dehydrated_device`
 ///
 /// Creates or overwrites the user's dehydrated device.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn put_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<put_dehydrated_device::Request>,
 ) -> Result<put_dehydrated_device::Response> {
 	let device_id = body.device_id.clone();
@@ -38,10 +36,9 @@ pub(crate) async fn put_dehydrated_device_route(
 /// # `DELETE /_matrix/client/../dehydrated_device`
 ///
 /// Deletes the user's dehydrated device without replacement.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn delete_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<delete_dehydrated_device::Request>,
 ) -> Result<delete_dehydrated_device::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -56,10 +53,9 @@ pub(crate) async fn delete_dehydrated_device_route(
 /// # `GET /_matrix/client/../dehydrated_device`
 ///
 /// Gets the user's dehydrated device
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn get_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_dehydrated_device::Request>,
 ) -> Result<get_dehydrated_device::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -72,10 +68,9 @@ pub(crate) async fn get_dehydrated_device_route(
 /// # `GET /_matrix/client/../dehydrated_device/{device_id}/events`
 ///
 /// Paginates the events of the dehydrated device.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn get_dehydrated_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_events::Request>,
 ) -> Result<get_events::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/device.rs

@@ -1,15 +1,14 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
-use conduwuit::{Err, Result, debug, err, utils};
+use conduwuit::{Err, Result, debug, err};
 use futures::StreamExt;
 use ruma::{
-	MilliSecondsSinceUnixEpoch, OwnedDeviceId,
+	MilliSecondsSinceUnixEpoch,
 	api::client::device::{
 		self, delete_device, delete_devices, get_device, get_devices, update_device,
 	},
 };
 
-use crate::{Ruma, client::DEVICE_ID_LENGTH};
+use crate::{Ruma, client_ip::ClientIp};
 
 /// # `GET /_matrix/client/r0/devices`
 ///
@@ -46,10 +45,10 @@ pub(crate) async fn get_device_route(
 /// # `PUT /_matrix/client/r0/devices/{deviceId}`
 ///
 /// Updates the metadata on a given device of the sender user.
-#[tracing::instrument(skip_all, fields(%client), name = "update_device", level = "debug")]
+#[tracing::instrument(skip_all, name = "update_device", level = "debug")]
 pub(crate) async fn update_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<update_device::v3::Request>,
 ) -> Result<update_device::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -85,16 +84,13 @@ pub(crate) async fn update_device_route(
 				appservice.registration.id
 			);
 
-			let device_id = OwnedDeviceId::from(utils::random_string(DEVICE_ID_LENGTH));
-
 			services
 				.users
 				.create_device(
 					sender_user,
-					&device_id,
-					&appservice.registration.as_token,
-					None,
+					Some(body.device_id.clone()),
 					None,
+					body.display_name.clone(),
 					Some(client.to_string()),
 				)
 				.await?;

src/api/client/directory.rs

@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err, info,
 	utils::{
@@ -35,10 +34,9 @@
 /// Lists the public rooms on this server.
 ///
 /// - Rooms are ordered by the number of joined members
-#[tracing::instrument(skip_all, fields(%client), name = "publicrooms", level = "info")]
+#[tracing::instrument(skip_all, name = "publicrooms", level = "info")]
 pub(crate) async fn get_public_rooms_filtered_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_public_rooms_filtered::v3::Request>,
 ) -> Result<get_public_rooms_filtered::v3::Response> {
 	if let Some(server) = &body.server {
@@ -71,10 +69,9 @@ pub(crate) async fn get_public_rooms_filtered_route(
 /// Lists the public rooms on this server.
 ///
 /// - Rooms are ordered by the number of joined members
-#[tracing::instrument(skip_all, fields(%client), name = "publicrooms", level = "info")]
+#[tracing::instrument(skip_all, name = "publicrooms", level = "info")]
 pub(crate) async fn get_public_rooms_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_public_rooms::v3::Request>,
 ) -> Result<get_public_rooms::v3::Response> {
 	if let Some(server) = &body.server {
@@ -106,10 +103,9 @@ pub(crate) async fn get_public_rooms_route(
 /// # `PUT /_matrix/client/r0/directory/list/room/{roomId}`
 ///
 /// Sets the visibility of a given room in the room directory.
-#[tracing::instrument(skip_all, fields(%client), name = "room_directory", level = "info")]
+#[tracing::instrument(skip_all, name = "room_directory", level = "info")]
 pub(crate) async fn set_room_visibility_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<set_room_visibility::v3::Request>,
 ) -> Result<set_room_visibility::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/media.rs

@@ -1,7 +1,6 @@
 use std::time::Duration;
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err,
 	utils::{self, content_disposition::make_content_disposition, math::ruma_from_usize},
@@ -42,15 +41,8 @@ pub(crate) async fn get_media_config_route(
 ///
 /// - Some metadata will be saved in the database
 /// - Media will be saved in the media/ directory
-#[tracing::instrument(
-	name = "media_upload",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn create_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<create_content::v3::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -81,15 +73,8 @@ pub(crate) async fn create_content_route(
 /// # `GET /_matrix/client/v1/media/thumbnail/{serverName}/{mediaId}`
 ///
 /// Load media thumbnail from our server or over federation.
-#[tracing::instrument(
-	name = "media_thumbnail_get",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_thumbnail_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v1::Request>,
 ) -> Result<get_content_thumbnail::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -131,15 +116,8 @@ pub(crate) async fn get_content_thumbnail_route(
 /// # `GET /_matrix/client/v1/media/download/{serverName}/{mediaId}`
 ///
 /// Load media from our server or over federation.
-#[tracing::instrument(
-	name = "media_get",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v1::Request>,
 ) -> Result<get_content::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -178,15 +156,8 @@ pub(crate) async fn get_content_route(
 /// # `GET /_matrix/client/v1/media/download/{serverName}/{mediaId}/{fileName}`
 ///
 /// Load media from our server or over federation as fileName.
-#[tracing::instrument(
-	name = "media_get_af",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_as_filename_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v1::Request>,
 ) -> Result<get_content_as_filename::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -229,15 +200,8 @@ pub(crate) async fn get_content_as_filename_route(
 /// # `GET /_matrix/client/v1/media/preview_url`
 ///
 /// Returns URL preview.
-#[tracing::instrument(
-	name = "url_preview",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_media_preview_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v1::Request>,
 ) -> Result<get_media_preview::v1::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/media_legacy.rs

@@ -1,7 +1,6 @@
 #![allow(deprecated)]
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err,
 	utils::{content_disposition::make_content_disposition, math::ruma_from_usize},
@@ -50,10 +49,8 @@ pub(crate) async fn get_media_config_legacy_legacy_route(
 /// # `GET /_matrix/media/v3/preview_url`
 ///
 /// Returns URL preview.
-#[tracing::instrument(skip_all, fields(%client), name = "url_preview_legacy", level = "debug")]
 pub(crate) async fn get_media_preview_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<get_media_preview::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -95,10 +92,9 @@ pub(crate) async fn get_media_preview_legacy_route(
 /// Returns URL preview.
 pub(crate) async fn get_media_preview_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<RumaResponse<get_media_preview::v3::Response>> {
-	get_media_preview_legacy_route(State(services), ClientIp(client), body)
+	get_media_preview_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -115,10 +111,9 @@ pub(crate) async fn get_media_preview_legacy_legacy_route(
 /// - Media will be saved in the media/ directory
 pub(crate) async fn create_content_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<RumaResponse<create_content::v3::Response>> {
-	create_content_route(State(services), ClientIp(client), body)
+	create_content_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -131,10 +126,8 @@ pub(crate) async fn create_content_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v3::Request>,
 ) -> Result<get_content::v3::Response> {
 	let mxc = Mxc {
@@ -209,13 +202,11 @@ pub(crate) async fn get_content_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v3::Request>,
 ) -> Result<RumaResponse<get_content::v3::Response>> {
-	get_content_legacy_route(State(services), ClientIp(client), body)
+	get_content_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -228,10 +219,8 @@ pub(crate) async fn get_content_legacy_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_as_filename_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v3::Request>,
 ) -> Result<get_content_as_filename::v3::Response> {
 	let mxc = Mxc {
@@ -307,10 +296,9 @@ pub(crate) async fn get_content_as_filename_legacy_route(
 ///   seconds
 pub(crate) async fn get_content_as_filename_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v3::Request>,
 ) -> Result<RumaResponse<get_content_as_filename::v3::Response>> {
-	get_content_as_filename_legacy_route(State(services), ClientIp(client), body)
+	get_content_as_filename_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -323,10 +311,8 @@ pub(crate) async fn get_content_as_filename_legacy_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_thumbnail_get_legacy", level = "debug")]
 pub(crate) async fn get_content_thumbnail_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v3::Request>,
 ) -> Result<get_content_thumbnail::v3::Response> {
 	let mxc = Mxc {
@@ -404,10 +390,9 @@ pub(crate) async fn get_content_thumbnail_legacy_route(
 ///   seconds
 pub(crate) async fn get_content_thumbnail_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v3::Request>,
 ) -> Result<RumaResponse<get_content_thumbnail::v3::Response>> {
-	get_content_thumbnail_legacy_route(State(services), ClientIp(client), body)
+	get_content_thumbnail_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }

src/api/client/membership/invite.rs

@@ -1,9 +1,8 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug_error, err, info,
 	matrix::{event::gen_event_id_canonical_json, pdu::PartialPdu},
-	warn,
+	trace, warn,
 };
 use futures::FutureExt;
 use ruma::{
@@ -23,10 +22,9 @@
 /// # `POST /_matrix/client/r0/rooms/{roomId}/invite`
 ///
 /// Tries to send an invite event into the room.
-#[tracing::instrument(skip_all, fields(%client), name = "invite", level = "info")]
+#[tracing::instrument(skip_all, name = "invite", level = "info")]
 pub(crate) async fn invite_user_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<invite_user::v3::Request>,
 ) -> Result<invite_user::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -42,14 +40,8 @@ pub(crate) async fn invite_user_route(
 		return Err!(Request(Forbidden("Invites are not allowed on this server.")));
 	}
 
-	banned_room_check(
-		&services,
-		sender_user,
-		Some(&body.room_id),
-		body.room_id.server_name(),
-		client,
-	)
-	.await?;
+	banned_room_check(&services, sender_user, Some(&body.room_id), body.room_id.server_name())
+		.await?;
 
 	match &body.recipient {
 		| invite_user::v3::InvitationRecipient::UserId(InviteUserId {
@@ -166,7 +158,7 @@ pub(crate) async fn invite_helper(
 			let invite_room_state = services
 				.rooms
 				.state
-				.summary_stripped(&pdu, room_id, recipient_user)
+				.summary_stripped(&pdu, room_id, recipient_user, true)
 				.await;
 
 			drop(state_lock);
@@ -193,6 +185,7 @@ pub(crate) async fn invite_helper(
 			.await
 			.ok();
 
+		trace!(?request, "Sending invite");
 		let response = services
 			.sending
 			.send_federation_request(recipient_user.server_name(), request)

src/api/client/membership/join.rs

@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug,
 	result::FlatOk,
@@ -22,10 +21,9 @@
 ///   rules locally
 /// - If the server does not know about the room: asks other servers over
 ///   federation
-#[tracing::instrument(skip_all, fields(%client), name = "join", level = "info")]
+#[tracing::instrument(skip_all, name = "join", level = "info")]
 pub(crate) async fn join_room_by_id_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<join_room_by_id::v3::Request>,
 ) -> Result<join_room_by_id::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -33,14 +31,8 @@ pub(crate) async fn join_room_by_id_route(
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
 
-	banned_room_check(
-		&services,
-		sender_user,
-		Some(&body.room_id),
-		body.room_id.server_name(),
-		client,
-	)
-	.await?;
+	banned_room_check(&services, sender_user, Some(&body.room_id), body.room_id.server_name())
+		.await?;
 
 	// There is no body.server_name for /roomId/join
 	let mut servers: Vec<_> = services
@@ -91,10 +83,9 @@ pub(crate) async fn join_room_by_id_route(
 /// - If the server does not know about the room: use the server name query
 ///   param if specified. if not specified, asks other servers over federation
 ///   via room alias server name and room ID server name
-#[tracing::instrument(skip_all, fields(%client), name = "join", level = "info")]
+#[tracing::instrument(skip_all, name = "join", level = "info")]
 pub(crate) async fn join_room_by_id_or_alias_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<join_room_by_id_or_alias::v3::Request>,
 ) -> Result<join_room_by_id_or_alias::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -105,15 +96,9 @@ pub(crate) async fn join_room_by_id_or_alias_route(
 
 	let (servers, room_id) = match OwnedRoomId::try_from(body.room_id_or_alias.clone()) {
 		| Ok(room_id) => {
-			banned_room_check(
-				&services,
-				sender_user,
-				Some(&room_id),
-				room_id.server_name(),
-				client,
-			)
-			.boxed()
-			.await?;
+			banned_room_check(&services, sender_user, Some(&room_id), room_id.server_name())
+				.boxed()
+				.await?;
 
 			let mut servers = body.via.clone();
 			if servers.is_empty() {
@@ -159,7 +144,6 @@ pub(crate) async fn join_room_by_id_or_alias_route(
 				sender_user,
 				Some(&room_id),
 				Some(room_alias.server_name()),
-				client,
 			)
 			.await?;
 

src/api/client/membership/knock.rs

@@ -1,7 +1,6 @@
 use std::{borrow::Borrow, collections::HashMap, iter::once, sync::Arc};
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug, debug_info, debug_warn, err, info,
 	matrix::{
@@ -45,10 +44,9 @@
 /// # `POST /_matrix/client/*/knock/{roomIdOrAlias}`
 ///
 /// Tries to knock the room to ask permission to join for the sender user.
-#[tracing::instrument(skip_all, fields(%client), name = "knock", level = "info")]
+#[tracing::instrument(skip_all, name = "knock", level = "info")]
 pub(crate) async fn knock_room_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<knock_room::v3::Request>,
 ) -> Result<knock_room::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -59,14 +57,8 @@ pub(crate) async fn knock_room_route(
 
 	let (servers, room_id) = match OwnedRoomId::try_from(body.room_id_or_alias.clone()) {
 		| Ok(room_id) => {
-			banned_room_check(
-				&services,
-				sender_user,
-				Some(&room_id),
-				room_id.server_name(),
-				client,
-			)
-			.await?;
+			banned_room_check(&services, sender_user, Some(&room_id), room_id.server_name())
+				.await?;
 
 			let mut servers = body.via.clone();
 			servers.extend(
@@ -109,7 +101,6 @@ pub(crate) async fn knock_room_route(
 				sender_user,
 				Some(&room_id),
 				Some(room_alias.server_name()),
-				client,
 			)
 			.await?;
 

src/api/client/membership/leave.rs

@@ -1,11 +1,9 @@
 use std::collections::HashSet;
 
-use assign::assign;
 use axum::extract::State;
 use conduwuit::{
 	Err, Pdu, Result, debug_info, debug_warn, err,
 	matrix::{event::gen_event_id, pdu::PartialPdu},
-	pdu::{AnyPDU, metadata::PduMetadata, new_pdu},
 	utils::{self, FutureBoolExt, future::ReadyEqExt},
 	warn,
 };
@@ -218,7 +216,7 @@ pub async fn remote_leave_room<S: ::std::hash::BuildHasher>(
 	room_id: &RoomId,
 	reason: Option<String>,
 	mut servers: HashSet<OwnedServerName, S>,
-) -> Result<AnyPDU> {
+) -> Result<Pdu> {
 	let mut make_leave_response_and_server =
 		Err!(BadServerResponse("No remote server available to assist in leaving {room_id}."));
 
@@ -408,14 +406,9 @@ pub async fn remote_leave_room<S: ::std::hash::BuildHasher>(
 		.outlier
 		.add_pdu_outlier(&event_id, &leave_event);
 
-	let leave_pdu = new_pdu(
-		room_version_rules.into(),
-		PduMetadata::new(event_id),
-		serde_json::to_value(leave_event)?,
-	)?;
-	// let leave_pdu = Pdu::from_id_val(&event_id, leave_event).map_err(|e| {
-	// 	err!(BadServerResponse("Invalid leave PDU received during federated leave:
-	// {e:?}")) })?;
+	let leave_pdu = Pdu::from_id_val(&event_id, leave_event).map_err(|e| {
+		err!(BadServerResponse("Invalid leave PDU received during federated leave: {e:?}"))
+	})?;
 
 	Ok(leave_pdu)
 }

src/api/client/membership/mod.rs

@@ -8,8 +8,6 @@
 mod members;
 mod unban;
 
-use std::net::IpAddr;
-
 use axum::extract::State;
 use conduwuit::{Err, Result, warn};
 use futures::{FutureExt, StreamExt};
@@ -58,7 +56,6 @@ pub(crate) async fn banned_room_check(
 	user_id: &UserId,
 	room_id: Option<&RoomId>,
 	server_name: Option<&ServerName>,
-	client_ip: IpAddr,
 ) -> Result {
 	if services.users.is_admin(user_id).await {
 		return Ok(());
@@ -85,7 +82,7 @@ pub(crate) async fn banned_room_check(
 						.admin
 						.send_text(&format!(
 							"Automatically deactivating user {user_id} due to attempted banned \
-							 room join from IP {client_ip}"
+							 room join"
 						))
 						.await;
 				}
@@ -121,7 +118,7 @@ pub(crate) async fn banned_room_check(
 						.admin
 						.send_text(&format!(
 							"Automatically deactivating user {user_id} due to attempted banned \
-							 room join from IP {client_ip}"
+							 room join"
 						))
 						.await;
 				}

src/api/client/message.rs

@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Error, Result, at, debug_warn,
 	matrix::{
@@ -38,7 +37,7 @@
 };
 use ruminuwuity::invite_permission_config::FilterLevel;
 
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};
 
 /// list of safe and common non-state events to ignore if the user is ignored
 const IGNORED_MESSAGE_TYPES: &[TimelineEventType] = &[
@@ -72,7 +71,7 @@
 ///   where the user was joined, depending on `history_visibility`)
 pub(crate) async fn get_message_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<get_message_events::v3::Request>,
 ) -> Result<get_message_events::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/mod.rs

@@ -90,8 +90,5 @@
 pub(super) use voip::*;
 pub(super) use well_known::*;
 
-/// generated device ID length
-const DEVICE_ID_LENGTH: usize = 10;
-
 /// generated user access token length
 const TOKEN_LENGTH: usize = 32;

src/api/client/oauth/device.rs

@@ -0,0 +1,13 @@
+use axum::{Form, Json, extract::State, response::IntoResponse};
+use http::StatusCode;
+use service::oauth::grant::DeviceCodeRequest;
+
+pub(crate) async fn device_authorization_route(
+	State(services): State<crate::State>,
+	Form(request): Form<DeviceCodeRequest>,
+) -> impl IntoResponse {
+	match services.oauth.request_device_code(request).await {
+		| Ok(response) => Ok(Json(response)),
+		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
+	}
+}

src/api/client/oauth/mod.rs

@@ -10,6 +10,7 @@
 use serde_json::json;
 pub(crate) use server_metadata::*;
 
+mod device;
 mod register_client;
 mod server_metadata;
 mod token;
@@ -20,6 +21,7 @@
 const CLIENT_REGISTER_PATH: &str = "client/register";
 const TOKEN_REVOKE_PATH: &str = "client/revoke";
 const TOKEN_PATH: &str = "grant/token";
+const DEVICE_AUTHORIZATION_PATH: &str = "device";
 const ACCOUNT_MANAGEMENT_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/account/deeplink");
 
 pub(crate) fn router(state: crate::State) -> Router<crate::State> {
@@ -53,4 +55,5 @@ fn oauth_router() -> Router<crate::State> {
 		.route(concat!("/", JWKS_URI_PATH), get(async || Json(json!({"keys": []}))))
 		.route(concat!("/", TOKEN_PATH), post(token::token_route))
 		.route(concat!("/", TOKEN_REVOKE_PATH), post(token::revoke_token_route))
+		.route(concat!("/", DEVICE_AUTHORIZATION_PATH), post(device::device_authorization_route))
 }

src/api/client/oauth/register_client.rs

@@ -24,5 +24,5 @@ pub(crate) async fn register_client_route(
 		.await
 		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;
 
-	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
+	Ok((StatusCode::CREATED, Json(RegisteredClient { client_id, metadata })).into_response())
 }

src/api/client/oauth/server_metadata.rs

@@ -12,8 +12,8 @@
 use crate::{
 	Ruma,
 	client::oauth::{
-		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, JWKS_URI_PATH, TOKEN_PATH,
-		TOKEN_REVOKE_PATH,
+		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, DEVICE_AUTHORIZATION_PATH,
+		JWKS_URI_PATH, TOKEN_PATH, TOKEN_REVOKE_PATH,
 	},
 };
 
@@ -37,6 +37,17 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		.join(super::BASE_PATH)
 		.unwrap();
 
+	let prompt_values_supported = if services
+		.uiaa
+		.registration_flow_status()
+		.await
+		.any_available()
+	{
+		json!(["create"])
+	} else {
+		json!([])
+	};
+
 	json!({
 		"account_management_uri": endpoint_base.join(ACCOUNT_MANAGEMENT_PATH).unwrap(),
 		"account_management_actions_supported": [
@@ -49,10 +60,11 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		],
 		"authorization_endpoint": endpoint_base.join(AUTH_CODE_PATH).unwrap(),
 		"code_challenge_methods_supported": ["S256"],
-		"grant_types_supported": ["authorization_code", "refresh_token"],
+		"device_authorization_endpoint": endpoint_base.join(DEVICE_AUTHORIZATION_PATH).unwrap(),
+		"grant_types_supported": ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
 		"issuer": services.config.get_client_domain(),
 		"jwks_uri": endpoint_base.join(JWKS_URI_PATH).unwrap(),
-		"prompt_values_supported": ["create"],
+		"prompt_values_supported": prompt_values_supported,
 		"registration_endpoint": endpoint_base.join(CLIENT_REGISTER_PATH).unwrap(),
 		"response_modes_supported": ["query", "fragment"],
 		"response_types_supported": ["code"],

src/api/client/read_marker.rs

@@ -1,7 +1,6 @@
 use std::collections::BTreeMap;
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, PduCount, Result, err};
 use ruma::{
 	MilliSecondsSinceUnixEpoch,
@@ -13,7 +12,7 @@
 	},
 };
 
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};
 
 /// # `POST /_matrix/client/r0/rooms/{roomId}/read_markers`
 ///
@@ -117,7 +116,7 @@ pub(crate) async fn set_read_marker_route(
 /// Sets private read marker and public read receipt EDU.
 pub(crate) async fn create_receipt_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<create_receipt::v3::Request>,
 ) -> Result<create_receipt::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/redact.rs

@@ -1,11 +1,10 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, matrix::pdu::PartialPdu};
 use ruma::{
 	api::client::redact::redact_event, assign, events::room::redaction::RoomRedactionEventContent,
 };
 
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};
 
 /// # `PUT /_matrix/client/r0/rooms/{roomId}/redact/{eventId}/{txnId}`
 ///
@@ -14,7 +13,7 @@
 /// - TODO: Handle txn id
 pub(crate) async fn redact_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: required for updating device metadata
 	body: Ruma<redact_event::v3::Request>,
 ) -> Result<redact_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/report.rs

@@ -1,7 +1,6 @@
 use std::{fmt::Write as _, time::Duration};
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Event, Result, debug_info, info, matrix::pdu::PduEvent, utils::ReadyExt};
 use conduwuit_service::Services;
 use ruma::{
@@ -30,10 +29,9 @@ struct Report {
 /// # `POST /_matrix/client/v3/rooms/{roomId}/report`
 ///
 /// Reports an abusive room to homeserver admins
-#[tracing::instrument(skip_all, fields(%client), name = "report_room", level = "info")]
+#[tracing::instrument(skip_all, name = "report_room", level = "info")]
 pub(crate) async fn report_room_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_room::v3::Request>,
 ) -> Result<report_room::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -85,10 +83,9 @@ pub(crate) async fn report_room_route(
 /// # `POST /_matrix/client/v3/rooms/{roomId}/report/{eventId}`
 ///
 /// Reports an inappropriate event to homeserver admins
-#[tracing::instrument(skip_all, fields(%client), name = "report_event", level = "info")]
+#[tracing::instrument(skip_all, name = "report_event", level = "info")]
 pub(crate) async fn report_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_content::v3::Request>,
 ) -> Result<report_content::v3::Response> {
 	// user authentication
@@ -129,10 +126,9 @@ pub(crate) async fn report_event_route(
 	Ok(report_content::v3::Response::new())
 }
 
-#[tracing::instrument(skip_all, fields(%client), name = "report_user", level = "info")]
+#[tracing::instrument(skip_all, name = "report_user", level = "info")]
 pub(crate) async fn report_user_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_user::v3::Request>,
 ) -> Result<report_user::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/room/create.rs

@@ -2,7 +2,7 @@
 
 use axum::extract::State;
 use conduwuit::{
-	Err, Result, debug, debug_info, err, info,
+	Err, Error, Result, debug, debug_info, err, info,
 	matrix::{StateKey, pdu::PartialPdu},
 	trace, warn,
 };
@@ -11,10 +11,13 @@
 use ruma::{
 	CanonicalJsonObject, CanonicalJsonValue, Int, MilliSecondsSinceUnixEpoch, OwnedRoomAliasId,
 	OwnedUserId, RoomAliasId, RoomId, RoomVersionId, UserId,
-	api::client::room::{self, create_room},
+	api::{
+		client::room::{self, create_room},
+		error::ErrorKind::Forbidden,
+	},
 	assign,
 	events::{
-		TimelineEventType,
+		AnyStateEventContent, StateEventType, TimelineEventType,
 		room::{
 			canonical_alias::RoomCanonicalAliasEventContent,
 			create::RoomCreateEventContent,
@@ -512,30 +515,42 @@ pub(crate) async fn create_room_route(
 
 	// 7. Events listed in initial_state
 	for event in &body.initial_state {
-		let mut partial_pdu = event
-			.deserialize_as_unchecked::<PartialPdu>()
-			.map_err(|e| {
-				err!(Request(InvalidParam(warn!("Invalid initial state event: {e:?}"))))
+		let event_type: StateEventType = event.get_field("type")?.ok_or_else(|| {
+			err!(Request(InvalidParam(warn!(
+				r#"Invalid initial state event: missing "type" field "#
+			))))
+		})?;
+
+		let content: Raw<AnyStateEventContent> =
+			event.get_field("content")?.ok_or_else(|| {
+				err!(Request(InvalidParam(warn!(
+					r#"Invalid initial state event: missing "content" field "#
+				))))
 			})?;
 
-		debug_info!("Room creation initial state event: {event:?}");
+		let state_key: String = event.get_field("state_key")?.unwrap_or_default();
 
-		// Implicit state key defaults to ""
-		partial_pdu.state_key.get_or_insert_with(StateKey::new);
-
-		// Silently skip encryption events if they are not allowed
-		if partial_pdu.event_type == TimelineEventType::RoomEncryption
-			&& !services.config.allow_encryption
-		{
-			continue;
-		}
-
-		services
+		match services
 			.rooms
 			.timeline
-			.build_and_append_pdu(partial_pdu, sender_user, Some(&room_id), &state_lock)
+			.send_state_event_for_key(
+				sender_user,
+				&room_id,
+				&state_lock,
+				&event_type,
+				&content,
+				&state_key,
+				None,
+			)
 			.boxed()
-			.await?;
+			.await
+		{
+			| Err(Error::Request(Forbidden, ..)) => {
+				// Silently skip forbidden events
+				continue;
+			},
+			| r => r,
+		}?;
 	}
 
 	// 8. Events implied by name and topic

src/api/client/room/summary.rs

@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result};
 use ruma::api::client::room::get_summary;
 use service::rooms::summary::Accessibility;
@@ -9,10 +8,9 @@
 /// # `GET /_matrix/client/v1/room_summary/{roomIdOrAlias}`
 ///
 /// Returns a short description of the state of a room.
-#[tracing::instrument(skip_all, fields(%client), name = "room_summary", level = "info")]
+#[tracing::instrument(skip_all, name = "room_summary", level = "info")]
 pub(crate) async fn get_room_summary(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_summary::v1::Request>,
 ) -> Result<get_summary::v1::Response> {
 	let (room_id, servers) = services

src/api/client/send.rs

@@ -1,12 +1,11 @@
 use std::collections::BTreeMap;
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, err, matrix::pdu::PartialPdu, utils};
 use ruma::{api::client::message::send_message_event, events::MessageLikeEventType};
 use serde_json::from_str;
 
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};
 
 /// # `PUT /_matrix/client/v3/rooms/{roomId}/send/{eventType}/{txnId}`
 ///
@@ -19,7 +18,7 @@
 ///   allowed
 pub(crate) async fn send_message_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: required for updating device metadata
 	body: Ruma<send_message_event::v3::Request>,
 ) -> Result<send_message_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/session.rs

@@ -1,10 +1,9 @@
 use std::time::Duration;
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug, err, info,
-	utils::{self, ReadyExt, stream::BroadbandExt},
+	utils::{ReadyExt, stream::BroadbandExt},
 	warn,
 };
 use conduwuit_service::Services;
@@ -29,18 +28,17 @@
 	},
 	assign,
 };
+use service::users::DeviceToken;
 
-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};
 
 /// # `GET /_matrix/client/v3/login`
 ///
 /// Get the supported login types of this server. One of these should be used as
 /// the `type` field when logging in.
-#[tracing::instrument(skip_all, fields(%client), name = "login", level = "info")]
+#[tracing::instrument(skip_all, name = "login", level = "info")]
 pub(crate) async fn get_login_types_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	_body: Ruma<get_login_types::v3::Request>,
 ) -> Result<get_login_types::v3::Response> {
 	if !services.config.oauth.compatibility_mode().uiaa_available() {
@@ -114,10 +112,10 @@ pub async fn handle_login(
 /// Note: You can use [`GET
 /// /_matrix/client/r0/login`](fn.get_supported_versions_route.html) to see
 /// supported login types.
-#[tracing::instrument(skip_all, fields(%client), name = "login", level = "info")]
+#[tracing::instrument(skip_all, name = "login", level = "info")]
 pub(crate) async fn login_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for device metadata
 	body: Ruma<login::v3::Request>,
 ) -> Result<login::v3::Response> {
 	if !services.config.oauth.compatibility_mode().uiaa_available() {
@@ -190,44 +188,39 @@ pub(crate) async fn login_route(
 		},
 	};
 
-	// Generate new device id if the user didn't specify one
-	let device_id = body
-		.device_id
-		.clone()
-		.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
-
-	// Generate a new token for the device (ensuring no collisions)
-	let token = services.users.generate_unique_token().await;
+	// Generate a new token for the device
+	let token = DeviceToken::new_random();
 
 	// Determine if device_id was provided and exists in the db for this user
-	let device_exists = if body.device_id.is_some() {
+	let existing_device_id = if let Some(device_id) = &body.device_id {
 		services
 			.users
 			.all_device_ids(&user_id)
-			.ready_any(|v| v == device_id)
+			.ready_find(|v| v == device_id)
 			.await
 	} else {
-		false
+		None
 	};
 
-	if device_exists {
+	let device_id = if let Some(existing_device_id) = existing_device_id {
 		services
 			.users
-			.set_token(&user_id, &device_id, &token, None)
+			.set_token(&user_id, &existing_device_id, token.clone())
 			.await?;
+
+		existing_device_id
 	} else {
 		services
 			.users
 			.create_device(
 				&user_id,
-				&device_id,
-				&token,
-				None,
+				body.device_id.clone(),
+				Some(token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
-			.await?;
-	}
+			.await?
+	};
 
 	// send client well-known if specified so the client knows to reconfigure itself
 	let client_discovery_info: Option<DiscoveryInfo> = services
@@ -241,7 +234,7 @@ pub(crate) async fn login_route(
 	info!("{user_id} logged in");
 
 	#[allow(deprecated)]
-	Ok(assign!(login::v3::Response::new(user_id, token, device_id), {
+	Ok(assign!(login::v3::Response::new(user_id, token.into_token(), device_id), {
 		well_known: client_discovery_info,
 		expires_in: None,
 		home_server: Some(services.config.server_name.clone()),
@@ -255,10 +248,9 @@ pub(crate) async fn login_route(
 /// to log in with the m.login.token flow.
 ///
 /// <https://spec.matrix.org/v1.13/client-server-api/#post_matrixclientv1loginget_token>
-#[tracing::instrument(skip_all, fields(%client), name = "login_token", level = "info")]
+#[tracing::instrument(skip_all, name = "login_token", level = "info")]
 pub(crate) async fn login_token_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_login_token::v1::Request>,
 ) -> Result<get_login_token::v1::Response> {
 	if !services.config.login_via_existing_session {
@@ -273,7 +265,7 @@ pub(crate) async fn login_token_route(
 		.authenticate_password(&body.auth, sender_user, body.identity.sender_device(), None)
 		.await?;
 
-	let login_token = utils::random_string(TOKEN_LENGTH);
+	let login_token = DeviceToken::new_random().into_token();
 	let expires_in = services.users.create_login_token(sender_user, &login_token);
 
 	Ok(get_login_token::v1::Response::new(
@@ -291,10 +283,9 @@ pub(crate) async fn login_token_route(
 ///   last seen ts)
 /// - Forgets to-device events
 /// - Triggers device list updates
-#[tracing::instrument(skip_all, fields(%client), name = "logout", level = "info")]
+#[tracing::instrument(skip_all, name = "logout", level = "info")]
 pub(crate) async fn logout_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<logout::v3::Request>,
 ) -> Result<logout::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -339,10 +330,9 @@ pub(crate) async fn logout_route(
 /// Note: This is equivalent to calling [`GET
 /// /_matrix/client/r0/logout`](fn.logout_route.html) from each device of this
 /// user.
-#[tracing::instrument(skip_all, fields(%client), name = "logout", level = "info")]
+#[tracing::instrument(skip_all, name = "logout", level = "info")]
 pub(crate) async fn logout_all_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<logout_all::v3::Request>,
 ) -> Result<logout_all::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/space.rs

@@ -19,9 +19,10 @@ pub(crate) async fn get_hierarchy_route(
 	// there's no reasonable way to handle a space hierarchy changing during
 	// pagination.
 
-	let max_depth = body
-		.max_depth
-		.map(|max_depth| max_depth.min(UInt::from(MAX_MAX_DEPTH)));
+	// Default to MAX_MAX_DEPTH when the client doesn't specify one, so an
+	// unbounded traversal can never happen.
+	let max_max_depth = UInt::from(MAX_MAX_DEPTH);
+	let max_depth = Some(body.max_depth.unwrap_or(max_max_depth).min(max_max_depth));
 
 	let hierarchy = services
 		.rooms

src/api/client/state.rs

@@ -1,41 +1,25 @@
 #[cfg(test)]
 mod tests;
 use axum::extract::State;
-use axum_client_ip::ClientIp;
-use conduwuit::{
-	Err, Result, err,
-	matrix::{Event, pdu::PartialPdu},
-};
-use conduwuit_service::Services;
+use conduwuit::{Err, Result, err, matrix::Event};
 use futures::{FutureExt, TryStreamExt};
 use ruma::{
-	MilliSecondsSinceUnixEpoch, OwnedEventId, RoomId, UserId,
+	RoomId,
 	api::client::state::{
 		get_state_event_for_key::{self, v3::StateEventFormat},
 		get_state_events, send_state_event,
 	},
-	events::{
-		AnyStateEventContent, StateEventType,
-		room::{
-			canonical_alias::RoomCanonicalAliasEventContent,
-			history_visibility::{HistoryVisibility, RoomHistoryVisibilityEventContent},
-			join_rules::{JoinRule, RoomJoinRulesEventContent},
-			member::{MembershipState, RoomMemberEventContent},
-			server_acl::RoomServerAclEventContent,
-		},
-	},
-	serde::Raw,
 };
 use serde_json::{json, value::to_raw_value};
 
-use crate::{Ruma, RumaResponse};
+use crate::{Ruma, RumaResponse, client_ip::ClientIp};
 
 /// # `PUT /_matrix/client/*/rooms/{roomId}/state/{eventType}/{stateKey}`
 ///
 /// Sends a state event into the room.
 pub(crate) async fn send_state_event_for_key_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<send_state_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -48,21 +32,31 @@ pub(crate) async fn send_state_event_for_key_route(
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}
 
-	let event_id = send_state_event_for_key_helper(
-		&services,
-		sender_user,
-		&body.room_id,
-		&body.event_type,
-		&body.body.body,
-		&body.state_key,
-		if body.identity.is_appservice() {
-			body.timestamp
-		} else {
-			None
-		},
-	)
-	.boxed()
-	.await?;
+	let state_lock = services
+		.rooms
+		.state
+		.mutex
+		.lock::<RoomId>(&body.room_id)
+		.await;
+
+	let event_id = services
+		.rooms
+		.timeline
+		.send_state_event_for_key(
+			sender_user,
+			&body.room_id,
+			&state_lock,
+			&body.event_type,
+			&body.body.body,
+			&body.state_key,
+			if body.identity.is_appservice() {
+				body.timestamp
+			} else {
+				None
+			},
+		)
+		.boxed()
+		.await?;
 
 	Ok(send_state_event::v3::Response::new(event_id))
 }
@@ -72,7 +66,7 @@ pub(crate) async fn send_state_event_for_key_route(
 /// Sends a state event into the room.
 pub(crate) async fn send_state_event_for_empty_key_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<RumaResponse<send_state_event::v3::Response>> {
 	send_state_event_for_key_route(State(services), ClientIp(ip), body)
@@ -186,257 +180,3 @@ pub(crate) async fn get_state_events_for_empty_key_route(
 		.await
 		.map(RumaResponse)
 }
-
-async fn send_state_event_for_key_helper(
-	services: &Services,
-	sender: &UserId,
-	room_id: &RoomId,
-	event_type: &StateEventType,
-	json: &Raw<AnyStateEventContent>,
-	state_key: &str,
-	timestamp: Option<MilliSecondsSinceUnixEpoch>,
-) -> Result<OwnedEventId> {
-	let json: &mut Raw<AnyStateEventContent> = &mut json.clone();
-	allowed_to_send_state_event(services, room_id, event_type, state_key, json).await?;
-	let state_lock = services.rooms.state.mutex.lock(room_id).await;
-	let event_id = services
-		.rooms
-		.timeline
-		.build_and_append_pdu(
-			PartialPdu {
-				event_type: event_type.to_string().into(),
-				content: serde_json::from_str(json.json().get())?,
-				state_key: Some(state_key.into()),
-				timestamp,
-				..Default::default()
-			},
-			sender,
-			Some(room_id),
-			&state_lock,
-		)
-		.await?;
-
-	Ok(event_id)
-}
-
-async fn allowed_to_send_state_event(
-	services: &Services,
-	room_id: &RoomId,
-	event_type: &StateEventType,
-	state_key: &str,
-	json: &mut Raw<AnyStateEventContent>,
-) -> Result {
-	match event_type {
-		| StateEventType::RoomCreate => {
-			return Err!(Request(BadJson(debug_warn!(
-				%room_id,
-				"You cannot update m.room.create after a room has been created."
-			))));
-		},
-		| StateEventType::RoomServerAcl => {
-			// prevents common ACL paw-guns as ACL management is difficult and prone to
-			// irreversible mistakes
-			match json.deserialize_as_unchecked::<RoomServerAclEventContent>() {
-				| Ok(acl_content) => {
-					let allow_has_wildcard = acl_content.allow.iter().any(|entry| entry == "*");
-					let deny_has_wildcard = acl_content.deny.iter().any(|entry| entry == "*");
-					let allow_has_server = acl_content
-						.allow
-						.iter()
-						.any(|entry| entry == services.globals.server_name().as_str());
-
-					if acl_content.allow.is_empty() {
-						return Err!(Request(BadJson(debug_warn!(
-							%room_id,
-							"Sending an ACL event with an empty allow key will permanently \
-							 brick the room for non-conduwuit's as this equates to no servers \
-							 being allowed to participate in this room."
-						))));
-					}
-
-					if allow_has_wildcard && deny_has_wildcard {
-						return Err!(Request(BadJson(debug_warn!(
-							%room_id,
-							"Sending an ACL event with a deny and allow key value of \"*\" will \
-							 permanently brick the room for non-conduwuit's as this equates to \
-							 no servers being allowed to participate in this room."
-						))));
-					}
-
-					if deny_has_wildcard
-						&& !acl_content.is_allowed(services.globals.server_name())
-						&& !allow_has_server
-					{
-						return Err!(Request(BadJson(debug_warn!(
-							%room_id,
-							"Sending an ACL event with a deny key value of \"*\" and without \
-							 your own server name in the allow key will result in you being \
-							 unable to participate in this room."
-						))));
-					}
-
-					if !allow_has_wildcard
-						&& !acl_content.is_allowed(services.globals.server_name())
-						&& !allow_has_server
-					{
-						return Err!(Request(BadJson(debug_warn!(
-							%room_id,
-							"Sending an ACL event for an allow key without \"*\" and without \
-							 your own server name in the allow key will result in you being \
-							 unable to participate in this room."
-						))));
-					}
-				},
-				| Err(e) => {
-					return Err!(Request(BadJson(debug_warn!(
-						"Room server ACL event is invalid: {e}"
-					))));
-				},
-			}
-		},
-		| StateEventType::RoomEncryption =>
-		// Forbid m.room.encryption if encryption is disabled
-			if !services.config.allow_encryption {
-				return Err!(Request(Forbidden("Encryption is disabled on this homeserver.")));
-			},
-		| StateEventType::RoomJoinRules => {
-			// admin room is a sensitive room, it should not ever be made public
-			if let Ok(admin_room_id) = services.admin.get_admin_room().await {
-				if admin_room_id == room_id {
-					match json.deserialize_as_unchecked::<RoomJoinRulesEventContent>() {
-						| Ok(join_rule) =>
-							if join_rule.join_rule == JoinRule::Public {
-								return Err!(Request(Forbidden(
-									"Admin room is a sensitive room, it cannot be made public"
-								)));
-							},
-						| Err(e) => {
-							return Err!(Request(BadJson(debug_warn!(
-								"Room join rules event is invalid: {e}"
-							))));
-						},
-					}
-				}
-			}
-		},
-		| StateEventType::RoomHistoryVisibility => {
-			// admin room is a sensitive room, it should not ever be made world readable
-			if let Ok(admin_room_id) = services.admin.get_admin_room().await {
-				match json.deserialize_as_unchecked::<RoomHistoryVisibilityEventContent>() {
-					| Ok(visibility_content) => {
-						if admin_room_id == room_id
-							&& visibility_content.history_visibility
-								== HistoryVisibility::WorldReadable
-						{
-							return Err!(Request(Forbidden(
-								"Admin room is a sensitive room, it cannot be made world \
-								 readable (public room history)."
-							)));
-						}
-					},
-					| Err(e) => {
-						return Err!(Request(BadJson(debug_warn!(
-							"Room history visibility event is invalid: {e}"
-						))));
-					},
-				}
-			}
-		},
-		| StateEventType::RoomCanonicalAlias => {
-			match json.deserialize_as_unchecked::<RoomCanonicalAliasEventContent>() {
-				| Ok(canonical_alias_content) => {
-					let mut aliases = canonical_alias_content.alt_aliases.clone();
-
-					if let Some(alias) = canonical_alias_content.alias {
-						aliases.push(alias);
-					}
-
-					for alias in aliases {
-						let (alias_room_id, _) = services
-							.rooms
-							.alias
-							.resolve_alias(&alias)
-							.await
-							.map_err(|e| {
-								err!(Request(Unknown("Failed resolving alias \"{alias}\": {e}")))
-							})?;
-
-						if alias_room_id != room_id {
-							return Err!(Request(BadAlias(
-								"Room alias {alias} does not belong to room {room_id}"
-							)));
-						}
-					}
-				},
-				| Err(e) => {
-					return Err!(Request(InvalidParam(debug_warn!(
-						"Room canonical alias event is invalid: {e}"
-					))));
-				},
-			}
-		},
-		| StateEventType::RoomMember =>
-			match json.deserialize_as_unchecked::<RoomMemberEventContent>() {
-				| Ok(mut membership_content) => {
-					let Ok(state_key) = UserId::parse(state_key) else {
-						return Err!(Request(BadJson(
-							"Membership event has invalid or non-existent state key"
-						)));
-					};
-
-					if let Some(authorising_user) =
-						membership_content.join_authorized_via_users_server
-					{
-						// join_authorized_via_users_server must be thrown away, if user is
-						// already a member of the room.
-						if services
-							.rooms
-							.state_cache
-							.is_joined(&state_key, room_id)
-							.await
-						{
-							membership_content.join_authorized_via_users_server = None;
-							*json = Raw::<AnyStateEventContent>::from_json_string(
-								serde_json::to_string(&membership_content)?,
-							)?;
-							return Ok(());
-						}
-
-						if membership_content.membership != MembershipState::Join {
-							return Err!(Request(BadJson(
-								"join_authorised_via_users_server is only for member joins"
-							)));
-						}
-
-						if !services.globals.user_is_local(&authorising_user) {
-							return Err!(Request(InvalidParam(
-								"Authorising user {authorising_user} does not belong to this \
-								 homeserver"
-							)));
-						}
-
-						if !services
-							.rooms
-							.state_cache
-							.is_joined(&authorising_user, room_id)
-							.await
-						{
-							return Err!(Request(InvalidParam(
-								"Authorising user {authorising_user} is not in the room, they \
-								 cannot authorise the join."
-							)));
-						}
-					}
-				},
-				| Err(e) => {
-					return Err!(Request(BadJson(
-						"Membership content must have a valid JSON body with at least a valid \
-						 membership state: {e}"
-					)));
-				},
-			},
-		| _ => (),
-	}
-
-	Ok(())
-}

src/api/client/state/tests.rs

@@ -1,3 +1,8 @@
+use ruma::{
+	events::{AnyStateEventContent, room::member::RoomMemberEventContent},
+	serde::Raw,
+};
+
 use super::*;
 
 #[test]

src/api/client/sync/v3/joined.rs

@@ -269,13 +269,22 @@ async fn build_state_and_timeline(
 	)
 	.await?;
 
-	let (state_events, notification_counts, joined_since_last_sync) = try_join3(
-		build_state_events(services, sync_context, room_id, shortstatehashes, &timeline),
+	let (notification_counts, joined_since_last_sync) = try_join(
 		build_notification_counts(services, sync_context, room_id, &timeline),
 		check_joined_since_last_sync(services, shortstatehashes, sync_context),
 	)
 	.await?;
 
+	let state_events = build_state_events(
+		services,
+		sync_context,
+		room_id,
+		shortstatehashes,
+		&timeline,
+		joined_since_last_sync,
+	)
+	.await?;
+
 	// the timeline should always include at least one PDU if the syncing user
 	// joined since the last sync, that being the syncing user's join event. if
 	// it's empty something is wrong.
@@ -459,6 +468,7 @@ async fn build_state_events(
 	room_id: &RoomId,
 	shortstatehashes: ShortStateHashes,
 	timeline: &TimelinePdus,
+	joined_since_last_sync: bool,
 ) -> Result<Vec<PduEvent>> {
 	let SyncContext {
 		syncing_user,
@@ -488,9 +498,10 @@ async fn build_state_events(
 		/*
 		if `last_sync_end_count` is Some (meaning this is an incremental sync), and `last_sync_end_shortstatehash`
 		is Some (meaning the syncing user didn't just join this room for the first time ever), and `full_state` is false,
-		then use `build_state_incremental`.
+		and the user didn't just join the room since the last sync, then use `build_state_incremental`.
 		*/
-		| (Some(_), Some(last_sync_end_shortstatehash)) if !full_state =>
+		| (Some(_), Some(last_sync_end_shortstatehash))
+			if !full_state && !joined_since_last_sync =>
 			build_state_incremental(
 				services,
 				syncing_user,

src/api/client/sync/v3/left.rs

@@ -230,7 +230,7 @@ async fn build_left_state_and_timeline(
 		.and_then(|limit| limit.try_into().ok())
 		.unwrap_or(DEFAULT_TIMELINE_LIMIT);
 
-	let timeline = load_timeline(
+	let mut timeline = load_timeline(
 		services,
 		syncing_user,
 		room_id,
@@ -240,6 +240,20 @@ async fn build_left_state_and_timeline(
 	)
 	.await?;
 
+	// the timeline index can lag behind the leave PDU, so `load_timeline` may omit
+	// it. we already hold the leave event, so ensure it's always synced to the
+	// client.
+	let leave_synced = timeline
+		.pdus
+		.iter()
+		.any(|(_, pdu)| pdu.event_id() == leave_membership_event.event_id());
+
+	if !leave_synced {
+		timeline
+			.pdus
+			.push_back((timeline_end_count, leave_membership_event));
+	}
+
 	let lazily_loaded_members =
 		prepare_lazily_loaded_members(services, sync_context, room_id, timeline.senders()).await;
 

src/api/client/sync/v3/mod.rs

@@ -9,7 +9,6 @@
 };
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, at, error, extract_variant,
 	utils::{
@@ -48,6 +47,7 @@
 		is_ignored_invite,
 		sync::v3::{joined::load_joined_room, left::load_left_room},
 	},
+	client_ip::ClientIp,
 };
 
 /// The default maximum number of events to return in the `timeline` key of
@@ -181,7 +181,7 @@ fn lazy_loading_enabled(&self) -> bool {
 )]
 pub(crate) async fn sync_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<sync_events::v3::Request>,
 ) -> Result<sync_events::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;

src/api/client/sync/v5.rs

@@ -6,7 +6,6 @@
 };
 
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Error, Result, at, error, extract_variant, is_equal_to,
 	matrix::{Event, TypeStateKey, pdu::PduCount},
@@ -49,6 +48,7 @@
 	client::{
 		DEFAULT_BUMP_TYPES, TimelinePdus, ignored_filter, is_ignored_invite, sync::load_timeline,
 	},
+	client_ip::ClientIp,
 };
 
 type SyncInfo<'a> = (&'a UserId, &'a DeviceId, u64, &'a sync_events::v5::Request);
@@ -67,7 +67,7 @@
 /// [MSC4186]: https://github.com/matrix-org/matrix-spec-proposals/pull/4186
 pub(crate) async fn sync_events_v5_route(
 	State(ref services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<sync_events::v5::Request>,
 ) -> Result<sync_events::v5::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -203,16 +203,27 @@ pub(crate) async fn sync_events_v5_route(
 	)
 	.await?;
 
-	if response.rooms.iter().all(|(id, r)| {
+	let no_account_data = response.extensions.account_data.global.is_empty()
+		&& response
+			.extensions
+			.account_data
+			.rooms
+			.values()
+			.all(Vec::is_empty);
+
+	let no_room_data = response.rooms.iter().all(|(id, r)| {
 		r.timeline.is_empty()
 			&& r.required_state.is_empty()
 			&& !response.extensions.receipts.rooms.contains_key(id)
-	}) && response
+	});
+
+	let no_to_device_messages = response
 		.extensions
 		.to_device
 		.clone()
-		.is_none_or(|to| to.events.is_empty())
-	{
+		.is_none_or(|to| to.events.is_empty());
+
+	if no_account_data && no_room_data && no_to_device_messages {
 		// Hang a few seconds so requests are not spammed
 		// Stop hanging if new info arrives
 		let default = Duration::from_secs(30);

src/api/client/typing.rs

@@ -1,16 +1,15 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, utils, utils::math::Tried};
 use ruma::api::client::typing::create_typing_event::{self, v3::TypingInfo};
 
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};
 
 /// # `PUT /_matrix/client/r0/rooms/{roomId}/typing/{userId}`
 ///
 /// Sets the typing state of the sender user.
 pub(crate) async fn create_typing_event_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<create_typing_event::v3::Request>,
 ) -> Result<create_typing_event::v3::Response> {
 	use create_typing_event::v3::Typing;

src/api/client/unversioned.rs

@@ -44,11 +44,25 @@ pub(crate) async fn continuwuity_server_version() -> Result<impl IntoResponse> {
 ///
 /// conduwuit-specific API to return the amount of users registered on this
 /// homeserver. Endpoint is disabled if federation is disabled for privacy. This
+///
 /// only includes active users (not deactivated, etc)
 pub(crate) async fn continuwuity_local_user_count(
 	State(services): State<crate::State>,
 ) -> Result<impl IntoResponse> {
-	let user_count = services.users.stream_local_users().count().await;
+	let user_count = services
+		.users
+		.stream_local_users()
+		.filter_map(async |user_id| {
+			if !services.users.status(&user_id).await.is_active()
+				|| services.appservice.is_exclusive_user_id(&user_id).await
+			{
+				None
+			} else {
+				Some(user_id)
+			}
+		})
+		.count()
+		.await;
 
 	Ok(Json(serde_json::json!({
 		"count": user_count

src/api/client_ip.rs

@@ -0,0 +1,212 @@
+use core::net::{IpAddr, SocketAddr};
+use std::ops::Deref;
+
+use axum::{
+	extract::{ConnectInfo, FromRequestParts},
+	response::{IntoResponse, Response},
+};
+use conduwuit::{debug_info, debug_warn};
+use http::{HeaderMap, StatusCode, request::Parts};
+use service::Services;
+
+#[derive(Debug, PartialEq)]
+pub enum ClientIpError {
+	Header(client_ip::Error),
+	Direct,
+}
+
+impl IntoResponse for ClientIpError {
+	fn into_response(self) -> Response {
+		let text = match self {
+			| Self::Header(e) => format!("{e}"),
+			| Self::Direct => "Failed to extract IP from ConnectionInfo".to_owned(),
+		};
+		(StatusCode::INTERNAL_SERVER_ERROR, text).into_response()
+	}
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct ClientIp(pub IpAddr);
+
+type PartsToIpFn = Box<dyn Fn(&Parts) -> Result<ClientIp, ClientIpError>>;
+
+impl ClientIp {
+	fn from_header<T>(func: T) -> PartsToIpFn
+	where
+		T: Fn(&HeaderMap) -> Result<IpAddr, client_ip::Error> + 'static,
+	{
+		Box::new(move |parts: &Parts| {
+			func(&parts.headers)
+				.map(Self)
+				.map_err(ClientIpError::Header)
+		})
+	}
+
+	fn from_connection_info(parts: &Parts) -> Result<Self, ClientIpError> {
+		parts
+			.extensions
+			.get::<ConnectInfo<SocketAddr>>()
+			.ok_or_else(|| ClientIpError::Direct)
+			.map(|ConnectInfo(addr)| Self(addr.ip()))
+	}
+
+	fn for_source(source: &str) -> Option<PartsToIpFn> {
+		match source {
+			| "cf_connecting_ip" => Some(Self::from_header(client_ip::cf_connecting_ip)),
+			| "cloudfront_viewer_address" =>
+				Some(Self::from_header(client_ip::cloudfront_viewer_address)),
+			| "fly_client_ip" => Some(Self::from_header(client_ip::fly_client_ip)),
+			| "x_forwarded_for" => Some(Self::from_header(client_ip::rightmost_x_forwarded_for)),
+			| "true_client_ip" => Some(Self::from_header(client_ip::true_client_ip)),
+			| "x_envoy_external_address" =>
+				Some(Self::from_header(client_ip::x_envoy_external_address)),
+			| "x_real_ip" => Some(Self::from_header(client_ip::x_real_ip)),
+			| "direct" => Some(Box::new(Self::from_connection_info)),
+			| s => {
+				debug_warn!("Invalid client IP source option supplied, skipping: {s}");
+				None
+			},
+		}
+	}
+
+	fn for_config(
+		parts: &Parts,
+		accepted_ip_sources: &[String],
+		request_ip_source: Option<&String>,
+	) -> Result<Self, ClientIpError> {
+		accepted_ip_sources
+			.iter()
+			.filter_map(|s| Self::for_source(s))
+			.map(|f| f(parts))
+			.reduce(Result::or)
+			.or_else(|| {
+				debug_info!(
+					"No (valid) options set in `accepted_ip_sources`; falling back to \
+					 `request_ip_source`"
+				);
+				request_ip_source
+					.and_then(|s| Self::for_source(s))
+					.map(|f| f(parts).or_else(|_| Self::from_connection_info(parts)))
+			})
+			.unwrap_or_else(|| {
+				debug_info!(
+					"No (valid) options set in `accepted_ip_sources` or `request_ip_source`; \
+					 using peer address"
+				);
+				Self::from_connection_info(parts)
+			})
+	}
+}
+
+impl<S> FromRequestParts<S> for ClientIp
+where
+	S: Deref<Target = Services> + Sync,
+{
+	type Rejection = ClientIpError;
+
+	async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
+		Self::for_config(
+			parts,
+			&state.config.accepted_ip_sources,
+			state.config.request_ip_source.as_ref(),
+		)
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use std::net::{Ipv4Addr, Ipv6Addr};
+
+	use super::*;
+
+	const SOCKET_V4: IpAddr = IpAddr::V4(Ipv4Addr::new(198, 51, 100, 1));
+	const HEADER_V4: IpAddr = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 1));
+
+	const SOCKET_V6: IpAddr = IpAddr::V6(Ipv6Addr::new(0x2001, 0xDB8, 0, 0, 0, 0, 0, 1));
+	const HEADER_V6: IpAddr = IpAddr::V6(Ipv6Addr::new(0x2001, 0xDB8, 0, 0, 0, 0, 0, 2));
+
+	fn parts(peer: Option<IpAddr>, headers: &[(&str, &str)]) -> Parts {
+		let mut builder = http::Request::builder();
+		for (name, value) in headers {
+			builder = builder.header(*name, *value);
+		}
+
+		let (mut parts, ()) = builder.body(()).unwrap().into_parts();
+		if let Some(peer) = peer {
+			parts
+				.extensions
+				.insert(ConnectInfo(SocketAddr::new(peer, 8448)));
+		}
+
+		parts
+	}
+
+	fn extract(
+		parts: &Parts,
+		accepted_ip_sources: &[String],
+		request_ip_source: Option<&String>,
+	) -> Result<IpAddr, ClientIpError> {
+		ClientIp::for_config(parts, accepted_ip_sources, request_ip_source).map(|ClientIp(ip)| ip)
+	}
+
+	#[tokio::test]
+	async fn resolves_from_configured_source_ipv4() {
+		let parts = parts(Some(SOCKET_V4), &[("x-real-ip", &HEADER_V4.to_string())]);
+
+		assert_eq!(extract(&parts, &["x_real_ip".to_owned()], None), Ok(HEADER_V4));
+		assert_eq!(extract(&parts, &[], Some(&"x_real_ip".to_owned())), Ok(HEADER_V4));
+	}
+
+	#[tokio::test]
+	async fn resolves_from_configured_source_ipv6() {
+		let parts = parts(Some(SOCKET_V6), &[("x-real-ip", &HEADER_V6.to_string())]);
+
+		assert_eq!(extract(&parts, &["x_real_ip".to_owned()], None), Ok(HEADER_V6));
+		assert_eq!(extract(&parts, &[], Some(&"x_real_ip".to_owned())), Ok(HEADER_V6));
+	}
+
+	#[tokio::test]
+	async fn accepted_ip_sources_no_fall_back_to_peer_when_header_missing() {
+		let parts = parts(Some(SOCKET_V4), &[]);
+
+		extract(&parts, &["x_real_ip".to_owned()], None).unwrap_err();
+	}
+
+	#[tokio::test]
+	async fn request_ip_source_falls_back_to_peer_when_header_missing() {
+		let parts = parts(Some(SOCKET_V4), &[]);
+
+		assert_eq!(extract(&parts, &[], Some(&"x_real_ip".to_owned())), Ok(SOCKET_V4));
+	}
+
+	#[tokio::test]
+	async fn accepted_ip_sources_no_fall_back_to_peer_when_header_unparsable() {
+		let parts = parts(Some(SOCKET_V4), &[("x-real-ip", "not-an-ip")]);
+
+		extract(&parts, &["x_real_ip".to_owned()], None).unwrap_err();
+	}
+
+	#[tokio::test]
+	async fn request_ip_source_falls_back_to_peer_when_header_unparsable() {
+		let parts = parts(Some(SOCKET_V4), &[("x-real-ip", "not-an-ip")]);
+
+		assert_eq!(extract(&parts, &[], Some(&"x_real_ip".to_owned())), Ok(SOCKET_V4));
+	}
+
+	#[tokio::test]
+	async fn accepted_ip_sources_falls_back_when_configured() {
+		let parts = parts(Some(SOCKET_V4), &[]);
+
+		assert_eq!(
+			extract(&parts, &["x_real_ip".to_owned(), "direct".to_owned()], None),
+			Ok(SOCKET_V4)
+		);
+	}
+
+	#[tokio::test]
+	async fn falls_back_to_peer_no_configuration() {
+		let parts = parts(Some(SOCKET_V4), &[("x-real-ip", &HEADER_V4.to_string())]);
+
+		assert_eq!(extract(&parts, &[], None), Ok(SOCKET_V4));
+	}
+}

src/api/mod.rs

@@ -11,6 +11,8 @@
 pub mod router;
 pub mod server;
 
+pub mod client_ip;
+
 pub mod admin;
 
 pub(crate) use self::router::{Ruma, RumaResponse, State};

src/api/router/args.rs

@@ -15,10 +15,9 @@
 #[derive(Deserialize)]
 pub(crate) struct AuthQueryParams {
 	pub(super) user_id: Option<String>,
-	/// Device ID for appservice device masquerading (MSC3202/MSC4190).
-	/// Can be provided as `device_id` or `org.matrix.msc3202.device_id`.
-	#[serde(alias = "org.matrix.msc3202.device_id")]
 	pub(super) device_id: Option<String>,
+	#[serde(rename = "org.matrix.msc3202.device_id")]
+	pub(super) legacy_device_id: Option<String>,
 }
 
 /// Extractor for Ruma request structs

src/api/router/auth.rs

@@ -219,25 +219,29 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
 			// The device_id can be provided via `device_id` or
 			// `org.matrix.msc3202.device_id` query parameter.
-			let sender_device =
-				if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
-					// Verify the device exists for this user
-					if services
-						.users
-						.get_device_metadata(&sender_user, device_id)
-						.await
-						.is_err()
-					{
-						return Err!(Request(Forbidden(
-							"Device does not exist for user or appservice cannot masquerade as \
-							 this device."
-						)));
-					}
+			let sender_device = if let Some(device_id) = query
+				.device_id
+				.or(query.legacy_device_id)
+				.as_deref()
+				.map(Into::into)
+			{
+				// Verify the device exists for this user
+				if services
+					.users
+					.get_device_metadata(&sender_user, device_id)
+					.await
+					.is_err()
+				{
+					return Err!(Request(Forbidden(
+						"Device does not exist for user or appservice cannot masquerade as this \
+						 device."
+					)));
+				}
 
-					Some(device_id.to_owned())
-				} else {
-					None
-				};
+				Some(device_id.to_owned())
+			} else {
+				None
+			};
 
 			Ok(ClientIdentity::Appservice {
 				sender_user,