fix: Use correct error code for invalid client ID

feat: Add support for OAuth2 device auth flow
2026-07-17 09:31:58 +00:00 · 2026-07-13 10:01:50 -04:00 · 2026-07-12 17:32:13 -04:00
47 changed files with 922 additions and 448 deletions
@@ -71,7 +71,7 @@ runs:
    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2
+      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1
@@ -65,7 +65,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
        with:
          draft: true
          files: binaries/*
@@ -32,7 +32,7 @@ jobs:
      - name: Setup Node.js
        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 22
@@ -24,7 +24,7 @@ jobs:
    steps:
      - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "22"
@@ -218,7 +218,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
        with:
          draft: true
          files: binaries/*
@@ -43,7 +43,7 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.260.2@sha256:60d830108d9ff6408d11a55d5f110ee0976bed78a6b82b08211e3ddb72f72952
+      image: ghcr.io/renovatebot/renovate:43.252.1@sha256:121eb04ef758537019fb58f587aa53c99e5fda4e703993ce2ca01bd4b3926bd4
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
@@ -1,12 +1,3 @@
 # Continuwuity 26.6.2 (2026-07-12)
 ## Bugfixes
 - Fixed the server returning 500 errors if `admin_console_automatic` is enabled and no TTY is available. Contributed by @s1lv3r. (#1975)
 - Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
 - Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.
 # Continuwuity 26.6.1 (2026-07-12)
 ## Features
@@ -26,7 +26,7 @@ ### Pre-commit Checks
 ```bash
-# Install prek using cargo-binstall https://github.com/cargo-bins/cargo-binstall
+# Install prek using cargo-binstall
 cargo binstall prek
 # Install git hooks to run checks automatically
@@ -155,7 +155,7 @@ ### Creating pull requests
 Before submitting a pull request, please ensure:
 1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
-2. Your code follows the [code style guide](docs/development/code_style.mdx)
+2. Your code follows the [code style guide](/development/code_style.md)
 3. Your commit messages follow the conventional commits format
 4. Tests are added for new functionality
 5. Documentation is updated if needed
@@ -259,9 +259,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 [[package]]
 name = "aws-lc-rs"
-version = "1.17.1"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
 dependencies = [
 "aws-lc-sys",
 "zeroize",
@@ -269,15 +269,14 @@ dependencies = [
 [[package]]
 name = "aws-lc-sys"
-version = "0.42.0"
+version = "0.41.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
 dependencies = [
 "cc",
 "cmake",
 "dunce",
 "fs_extra",
 "pkg-config",
 ]
 [[package]]
@@ -558,9 +557,9 @@ checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 [[package]]
 name = "bytemuck"
-version = "1.25.1"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6aedf8ae72766347502cf3cb4f41cf5e9cc37d28bee90f1fdaaae15f9cf9424"
+checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
 [[package]]
 name = "byteorder"
@@ -576,9 +575,9 @@ checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
 [[package]]
 name = "bytes"
-version = "1.12.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+checksum = "8ae3f5d315924270530207e2a68396c3cc547f6dca3fbdca317cfb1a51edb593"
 [[package]]
 name = "bytesize"
@@ -642,9 +641,9 @@ dependencies = [
 [[package]]
 name = "cc"
-version = "1.2.67"
+version = "1.2.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
+checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
 dependencies = [
 "find-msvc-tools",
 "jobserver",
@@ -827,7 +826,7 @@ dependencies = [
 [[package]]
 name = "conduwuit"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "aws-lc-rs",
 "clap",
@@ -865,7 +864,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_admin"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "assign",
 "clap",
@@ -891,7 +890,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_api"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "assign",
 "async-trait",
@@ -929,7 +928,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_build_metadata"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "built",
 "cargo_metadata",
@@ -937,7 +936,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_core"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "argon2",
 "arrayvec",
@@ -1005,7 +1004,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_database"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "async-channel",
 "conduwuit_core",
@@ -1026,7 +1025,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_macros"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "cargo_toml",
 "itertools 0.15.0",
@@ -1037,7 +1036,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_router"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "assign",
 "axum",
@@ -1075,7 +1074,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_service"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "askama",
 "assign",
@@ -1127,7 +1126,7 @@ dependencies = [
 [[package]]
 name = "conduwuit_web"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "askama",
 "assign",
@@ -1362,18 +1361,18 @@ dependencies = [
 [[package]]
 name = "crossbeam-channel"
-version = "0.5.16"
+version = "0.5.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d85363c37faeca707aef026efa9f3b34d077bce547e48f770770625c6013679e"
+checksum = "82b8f8f868b36967f9606790d1903570de9ceaf870a7bf9fbbd3016d636a2cb2"
 dependencies = [
 "crossbeam-utils",
 ]
 [[package]]
 name = "crossbeam-deque"
-version = "0.8.7"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5181e0de7b61eb03a81e347d6dd8797bae9da5146707b51077e2d71a54ec0ceb"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
 dependencies = [
 "crossbeam-epoch",
 "crossbeam-utils",
@@ -1381,27 +1380,27 @@ dependencies = [
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.20"
+version = "0.9.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
 dependencies = [
 "crossbeam-utils",
 ]
 [[package]]
 name = "crossbeam-queue"
-version = "0.3.13"
+version = "0.3.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "803d13fb3b09d88be9f4dbc29062c66b19bf7170867ceb746d2a8689bf6c7a26"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
 dependencies = [
 "crossbeam-utils",
 ]
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.22"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 [[package]]
 name = "crossterm"
@@ -1464,9 +1463,9 @@ dependencies = [
 [[package]]
 name = "ctor"
-version = "1.0.8"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb22e947478ccf9dc44d8922042c677a63fbb88f2cb468521d1145816e5087cb"
+checksum = "01334b89b69ff726750c5ce5073fc8bd860e99aa9a8fc5ca11b04730e3aee97a"
 dependencies = [
 "link-section",
 "linktime-proc-macro",
@@ -1514,14 +1513,38 @@ version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "817fa642fb0ee7fe42e95783e00e0969927b96091bdd4b9b1af082acd943913b"
 [[package]]
 name = "darling"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
 dependencies = [
 "darling_core 0.20.11",
 "darling_macro 0.20.11",
 ]
 [[package]]
 name = "darling"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
 dependencies = [
- "darling_core",
+ "darling_core 0.23.0",
- "darling_macro",
+ "darling_macro 0.23.0",
 ]
 [[package]]
 name = "darling_core"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0d00b9596d185e565c2207a0b01f8bd1a135483d02d9b7b0a54b11da8d53412e"
 dependencies = [
 "fnv",
 "ident_case",
 "proc-macro2",
 "quote",
 "strsim",
 "syn",
 ]
 [[package]]
@@ -1537,13 +1560,24 @@ dependencies = [
 "syn",
 ]
 [[package]]
 name = "darling_macro"
 version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
 "darling_core 0.20.11",
 "quote",
 "syn",
 ]
 [[package]]
 name = "darling_macro"
 version = "0.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
 dependencies = [
- "darling_core",
+ "darling_core 0.23.0",
 "quote",
 "syn",
 ]
@@ -2088,11 +2122,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
 "cfg-if",
 "js-sys",
 "libc",
 "r-efi 6.0.0",
 "rand_core 0.10.1",
 "wasm-bindgen",
 ]
 [[package]]
@@ -2258,7 +2290,7 @@ dependencies = [
 "http",
 "httpdate",
 "mime",
- "sha1 0.10.7",
+ "sha1 0.10.6",
 ]
 [[package]]
@@ -2443,9 +2475,9 @@ dependencies = [
 [[package]]
 name = "http-body-util"
-version = "0.1.4"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9f41fd6a08e4d4ec69df65976da761afd5ad5e58a9d4acb46bd1c953a9e3ff2"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
 "bytes",
 "futures-core",
@@ -2874,11 +2906,11 @@ dependencies = [
 [[package]]
 name = "jobserver"
-version = "0.1.35"
+version = "0.1.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
 dependencies = [
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
 "libc",
 ]
@@ -3028,9 +3060,9 @@ dependencies = [
 [[package]]
 name = "link-section"
-version = "0.19.0"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e333fe507b738576d6da5bb3f1a7d7a1c80307ed9ef31624c057d844c19c93e9"
+checksum = "24670b639492630905459a6c7d47f063d33c2d4fcd5362f6e5827c5613976c9f"
 [[package]]
 name = "linked-hash-map"
@@ -3167,20 +3199,19 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 [[package]]
 name = "memchr"
-version = "2.8.3"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
 [[package]]
 name = "memory-serve"
-version = "2.3.0"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18718e8f7eefb3194d346474ac95f50ada065ff043e0074e5b8e85b85148122f"
+checksum = "81b5bbad2035f57b1e95f66da606832edd935b47d82312e38e1ccffbcfb8a427"
 dependencies = [
 "axum",
 "brotli",
 "flate2",
 "fs-err",
 "mime_guess",
 "sha256",
 "tracing",
@@ -3364,9 +3395,9 @@ dependencies = [
 [[package]]
 name = "num-bigint"
-version = "0.4.8"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+checksum = "c863e9ab5e7bf9c99ba75e1050f1e4d624ae87ed3532d6238ffbdc7b585dbbe6"
 dependencies = [
 "num-integer",
 "num-traits",
@@ -3383,7 +3414,7 @@ dependencies = [
 "num-integer",
 "num-iter",
 "num-traits",
- "rand 0.8.7",
+ "rand 0.8.6",
 "smallvec",
 "zeroize",
 ]
@@ -3414,10 +3445,11 @@ dependencies = [
 [[package]]
 name = "num-iter"
-version = "0.1.46"
+version = "0.1.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c92800bd69a1eac91786bcfe9da64a897eb72911b8dc3095decbd07429e8048b"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
 dependencies = [
 "autocfg",
 "num-integer",
 "num-traits",
 ]
@@ -3463,7 +3495,7 @@ dependencies = [
 "chrono",
 "getrandom 0.2.17",
 "http",
- "rand 0.8.7",
+ "rand 0.8.6",
 "reqwest 0.12.28",
 "serde",
 "serde_json",
@@ -3668,7 +3700,7 @@ dependencies = [
 "oauth2",
 "p256",
 "p384",
- "rand 0.8.7",
+ "rand 0.8.6",
 "rsa",
 "serde",
 "serde-value",
@@ -3759,7 +3791,7 @@ dependencies = [
 "opentelemetry",
 "percent-encoding",
 "portable-atomic",
- "rand 0.9.5",
+ "rand 0.9.4",
 "thiserror 2.0.18",
 "tokio",
 "tokio-stream",
@@ -3936,7 +3968,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
 dependencies = [
 "phf_shared",
- "rand 0.8.7",
+ "rand 0.8.6",
 ]
 [[package]]
@@ -4080,22 +4112,22 @@ dependencies = [
 ]
 [[package]]
-name = "proc-macro-error-attr3"
+name = "proc-macro-error-attr2"
-version = "3.0.2"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34e4dd828515431dd6c4a030d26f7eaed7dd4778226e9d2bb968d65ca4ec3d4d"
+checksum = "96de42df36bb9bba5542fe9f1a054b8cc87e172759a1868aa05c1f3acc89dfc5"
 dependencies = [
 "proc-macro2",
 "quote",
 ]
 [[package]]
-name = "proc-macro-error3"
+name = "proc-macro-error2"
-version = "3.0.2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ee475e440453418ff1335189eddf7101ba502cd818ab7ae04209bc83aa925aa"
+checksum = "11ec05c52be0a07b08061f7dd003e7d7092e0472bc731b4af7bb1ef876109802"
 dependencies = [
- "proc-macro-error-attr3",
+ "proc-macro-error-attr2",
 "proc-macro2",
 "quote",
 "syn",
@@ -4175,9 +4207,9 @@ checksum = "007d8adb5ddab6f8e3f491ac63566a7d5002cc7ed73901f72057943fa71ae1ae"
 [[package]]
 name = "pxfm"
-version = "0.1.30"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d55d956fa96f5ec02be2e13af0e20391a5aa83d6a074e3ad368959d0fab299ea"
+checksum = "e0c5ccf5294c6ccd63a74f1565028353830a9c2f5eb0c682c355c471726a6e3f"
 [[package]]
 name = "quick-error"
@@ -4208,16 +4240,15 @@ dependencies = [
 [[package]]
 name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
 "aws-lc-rs",
 "bytes",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
 "lru-slab",
- "rand 0.10.2",
+ "rand 0.9.4",
 "rand_pcg",
 "ring",
 "rustc-hash",
 "rustls",
@@ -4231,16 +4262,16 @@ dependencies = [
 [[package]]
 name = "quinn-udp"
-version = "0.5.15"
+version = "0.5.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
 dependencies = [
 "cfg_aliases",
 "libc",
 "once_cell",
 "socket2",
 "tracing",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 [[package]]
@@ -4272,9 +4303,9 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 [[package]]
 name = "rand"
-version = "0.8.7"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
 "libc",
 "rand_chacha 0.3.1",
@@ -4283,9 +4314,9 @@ dependencies = [
 [[package]]
 name = "rand"
-version = "0.9.5"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
 "rand_chacha 0.9.0",
 "rand_core 0.9.5",
@@ -4346,15 +4377,6 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 [[package]]
 name = "rand_pcg"
 version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
 dependencies = [
 "rand_core 0.10.1",
 ]
 [[package]]
 name = "recaptcha-verify"
 version = "0.2.0"
@@ -4397,9 +4419,9 @@ dependencies = [
 [[package]]
 name = "regex"
-version = "1.13.0"
+version = "1.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0e75113e14dc5acb068cd0786884f214f1312650a3d36d269f5c4f3cdee8a2"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -4409,9 +4431,9 @@ dependencies = [
 [[package]]
 name = "regex-automata"
-version = "0.4.15"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f388202e4b80542a0921078cc23b6333bcf1409c1e3f86404cae4766a6131db"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -4777,7 +4799,7 @@ dependencies = [
 [[package]]
 name = "ruminuwuity"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "assign",
 "ruma",
@@ -4815,9 +4837,9 @@ dependencies = [
 [[package]]
 name = "rustc-demangle"
-version = "0.1.28"
+version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b74b56ffa8bb2830709a538c2cbcae9aa062db0d2a42563bfb09bdaae44020eb"
+checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 [[package]]
 name = "rustc-hash"
@@ -4849,9 +4871,9 @@ dependencies = [
 [[package]]
 name = "rustls"
-version = "0.23.42"
+version = "0.23.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
 "aws-lc-rs",
 "log",
@@ -4926,9 +4948,9 @@ dependencies = [
 [[package]]
 name = "rustversion"
-version = "1.0.23"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 [[package]]
 name = "rustyline-async"
@@ -5114,7 +5136,7 @@ version = "0.48.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8c44ee52fa3d30581f951b57aec754ef9cd70186df5fb788367804360c48097"
 dependencies = [
- "rand 0.9.5",
+ "rand 0.9.4",
 "sentry-types",
 "serde",
 "serde_json",
@@ -5187,7 +5209,7 @@ checksum = "1be93ef0435a5ab91f88178fb7681249437e875d004f996ecb35be94dc99a0e0"
 dependencies = [
 "debugid",
 "hex",
- "rand 0.9.5",
+ "rand 0.9.4",
 "serde",
 "serde_json",
 "thiserror 2.0.18",
@@ -5367,7 +5389,7 @@ version = "3.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "84d57bc0c8b9a17920c178daa6bb924850d54a9c97ab45194bb8c17ad66bb660"
 dependencies = [
- "darling",
+ "darling 0.23.0",
 "proc-macro2",
 "quote",
 "syn",
@@ -5375,9 +5397,9 @@ dependencies = [
 [[package]]
 name = "sha1"
-version = "0.10.7"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a978451301f4db1d02937a4ab3ccce137717b81826e79b7d49ffe3244a13c3b8"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
 "cfg-if",
 "cpufeatures 0.2.17",
@@ -5700,9 +5722,9 @@ dependencies = [
 [[package]]
 name = "termimad"
-version = "0.35.1"
+version = "0.35.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d53d4b1294b87e81925b7ae7f8f4d000376e3a5b3349d978429665428a793fcb"
+checksum = "903906afabf58273a7a90b47e0e60701cbd01731ca72ba88508b38b5539647f4"
 dependencies = [
 "coolor",
 "crokey",
@@ -5766,9 +5788,9 @@ dependencies = [
 [[package]]
 name = "thread_local"
-version = "1.1.10"
+version = "1.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
 dependencies = [
 "cfg-if",
 ]
@@ -5843,9 +5865,9 @@ dependencies = [
 [[package]]
 name = "tinyvec"
-version = "1.12.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb4ebadaa0af04fab11ae01eb5f9fdb5f9c5b875506e210e71c07873528baa7f"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
 dependencies = [
 "tinyvec_macros",
 ]
@@ -6208,7 +6230,7 @@ dependencies = [
 "futures",
 "http",
 "parking_lot",
- "rand 0.9.5",
+ "rand 0.9.4",
 "serde",
 "serde_json",
 "thiserror 2.0.18",
@@ -6422,9 +6444,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 [[package]]
 name = "uuid"
-version = "1.23.5"
+version = "1.23.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5fab0d6c3c01ae70085a09cb03d4c7a1d6314e2b3e075392783396d724ca0a"
+checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
@@ -6450,12 +6472,13 @@ dependencies = [
 [[package]]
 name = "validator_derive"
-version = "0.20.1"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240e4b81c20a1d6d50d1d7265c658dfbd204e8b9ac4d80f3c931f39462196335"
+checksum = "b7df16e474ef958526d1205f6dda359fdfab79d9aa6d54bafcb92dcd07673dca"
 dependencies = [
- "darling",
+ "darling 0.20.11",
- "proc-macro-error3",
+ "once_cell",
 "proc-macro-error2",
 "proc-macro2",
 "quote",
 "syn",
@@ -6756,7 +6779,16 @@ version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
 ]
 [[package]]
 name = "windows-sys"
 version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
 dependencies = [
 "windows-targets 0.53.5",
 ]
 [[package]]
@@ -6774,14 +6806,31 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm",
+ "windows_aarch64_gnullvm 0.52.6",
- "windows_aarch64_msvc",
+ "windows_aarch64_msvc 0.52.6",
- "windows_i686_gnu",
+ "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm",
+ "windows_i686_gnullvm 0.52.6",
- "windows_i686_msvc",
+ "windows_i686_msvc 0.52.6",
- "windows_x86_64_gnu",
+ "windows_x86_64_gnu 0.52.6",
- "windows_x86_64_gnullvm",
+ "windows_x86_64_gnullvm 0.52.6",
- "windows_x86_64_msvc",
+ "windows_x86_64_msvc 0.52.6",
 ]
 [[package]]
 name = "windows-targets"
 version = "0.53.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
 dependencies = [
 "windows-link",
 "windows_aarch64_gnullvm 0.53.1",
 "windows_aarch64_msvc 0.53.1",
 "windows_i686_gnu 0.53.1",
 "windows_i686_gnullvm 0.53.1",
 "windows_i686_msvc 0.53.1",
 "windows_x86_64_gnu 0.53.1",
 "windows_x86_64_gnullvm 0.53.1",
 "windows_x86_64_msvc 0.53.1",
 ]
 [[package]]
@@ -6790,48 +6839,96 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 [[package]]
 name = "windows_i686_gnu"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 [[package]]
 name = "windows_i686_msvc"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 [[package]]
 name = "winnow"
 version = "0.7.15"
@@ -6875,7 +6972,7 @@ dependencies = [
 [[package]]
 name = "xtask"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
 "askama",
 "cargo_metadata",
@@ -6915,18 +7012,18 @@ dependencies = [
 [[package]]
 name = "zerocopy"
-version = "0.8.54"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7cbbc0a705a0fd05cc3676525980d2bf5a9bc4adac6d6475209a7887cf59d19"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
 dependencies = [
 "zerocopy-derive",
 ]
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.54"
+version = "0.8.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e817b7b52d0c7358d3246da9d69935ebb18116b2b102b4230dac079b4862f5"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -6995,9 +7092,9 @@ dependencies = [
 [[package]]
 name = "zmij"
-version = "1.0.22"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd2f034a4bebf216c9e4b7083603e024cf930873fd67830cfb083c9fa33129d9"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
 [[package]]
 name = "zstd"
@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.6.2"
+version = "26.6.1"
 [workspace.metadata.crane]
 name = "conduwuit"
@@ -0,0 +1 @@
 Added support for the OAuth2 device authorization flow. Contributed by @ginger
@@ -1 +0,0 @@
 Appservices are now properly able to create devices for E2EE.
@@ -0,0 +1 @@
 Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
@@ -0,0 +1 @@
 Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.
@@ -1 +0,0 @@
 Fixed newly created rooms failing to sync properly in clients using legacy sync.
@@ -1 +0,0 @@
 Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
@@ -1 +0,0 @@
 Fixed the deeplink redirect for deleting devices. Contributed by @koen
@@ -1 +0,0 @@
 Fix status code for oauth registration. Contributed by @n00byking
@@ -1 +0,0 @@
 Exempt m.room.create from auth_events check. Contributed by @eleboucher
@@ -6,10 +6,10 @@
            "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
        },
        {
-            "id": 16,
+            "id": 15,
            "mention_room": true,
-            "date": "2026-07-13",
+            "date": "2026-07-10",
-            "message": "[Continuwuity 26.6.2](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release fixes a severe bug with OIDC that could cause users' accounts to be flagged as deactivated. If you use OIDC, please update as soon as possible."
+            "message": "[Continuwuity 26.6.1](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release contains a bunch of bugfixes for bugs found initially after 26.6.0's release - please read the changelog before updating!"
        }
    ]
 }
@@ -3,11 +3,11 @@
    "advisory-db": {
      "flake": false,
      "locked": {
-        "lastModified": 1783840254,
+        "lastModified": 1781566179,
-        "narHash": "sha256-XjyvZk0f3YiinVHmkGOotmLBAzvK+LwEJYj2QqJ5pn8=",
+        "narHash": "sha256-Tqv8I586fYzWpEW/Smq/JqESFa3DVVzVWsnAMtvhy/I=",
        "owner": "rustsec",
        "repo": "advisory-db",
-        "rev": "6e3286f4efa8c142fb33e5ea4342c8db6693cf34",
+        "rev": "74e084413d979d52d2f93b1d93b1ab7b9ee648f5",
        "type": "github"
      },
      "original": {
@@ -18,11 +18,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1783203018,
+        "lastModified": 1780532242,
-        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
+        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
+        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
        "type": "github"
      },
      "original": {
@@ -39,11 +39,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1783844668,
+        "lastModified": 1781527054,
-        "narHash": "sha256-3MOpw4y3reoErRLvFBDz0t9aG6FWXUj7leKvUns5eQA=",
+        "narHash": "sha256-1fX9ev2Fh5QoKQ41G9dYutjo5j/jywu6tZse5Eb1Ck4=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "4e49ef62eedaa5c149d62b63b3f53844e1cc45d7",
+        "rev": "8c2e51dffefc040a21975da7abf6f252c8c9b783",
        "type": "github"
      },
      "original": {
@@ -74,11 +74,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1778716662,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
        "type": "github"
      },
      "original": {
@@ -89,11 +89,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1783776592,
+        "lastModified": 1781074563,
-        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
+        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
+        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
        "type": "github"
      },
      "original": {
@@ -105,11 +105,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1782614948,
+        "lastModified": 1777168982,
-        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
        "type": "github"
      },
      "original": {
@@ -132,11 +132,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1783779020,
+        "lastModified": 1781453968,
-        "narHash": "sha256-vpm418WZa9l1KUl6HRs+Ga+SIfE+D2/sV4olwTlilYc=",
+        "narHash": "sha256-+V3nK4pCngbmgyVGXY6Kkrlevp4ocPkJJLf2aqwkDNA=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "5be5e89cf0145d73a85c805726821b4adfc3af48",
+        "rev": "cc272809a173c2c11d0e479d639c811c1eacf049",
        "type": "github"
      },
      "original": {
@@ -510,14 +510,14 @@
      }
    },
    "node_modules/@shikijs/core": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.2.0.tgz",
-      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
+      "integrity": "sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/primitive": "4.3.1",
+        "@shikijs/primitive": "4.2.0",
-        "@shikijs/types": "4.3.1",
+        "@shikijs/types": "4.2.0",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4",
        "hast-util-to-html": "^9.0.5"
@@ -527,13 +527,13 @@
      }
    },
    "node_modules/@shikijs/engine-javascript": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.2.0.tgz",
-      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
+      "integrity": "sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.3.1",
+        "@shikijs/types": "4.2.0",
        "@shikijs/vscode-textmate": "^10.0.2",
        "oniguruma-to-es": "^4.3.6"
      },
@@ -542,13 +542,13 @@
      }
    },
    "node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.2.0.tgz",
-      "integrity": "sha512-OXyNMzg0pews+msMj4cHeqT4xiYKKvbnn6VbdAXxfoFl3SSx4fJTc8FadECuc5/H9p3BzhNAoAUXKwAu9rWYhg==",
+      "integrity": "sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.3.1",
+        "@shikijs/types": "4.2.0",
        "@shikijs/vscode-textmate": "^10.0.2"
      },
      "engines": {
@@ -556,26 +556,26 @@
      }
    },
    "node_modules/@shikijs/langs": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.2.0.tgz",
-      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
+      "integrity": "sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.3.1"
+        "@shikijs/types": "4.2.0"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/primitive": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.2.0.tgz",
-      "integrity": "sha512-CXQRQOYy1leqQ8ceTeJdmXv/bsUY++6QyLpXJ94LZAAYj5X2SKRdc5ipguv4NPyGVKItB2PPwUpRNe0Sjh5S1A==",
+      "integrity": "sha512-NOq+DtUkVBJtZMVXL5A0vI0Xk8nvDYaXetFHSJFlOqjDZIVhIPRYFdGkSoElDqNuegikcc3A76SNUa8dTqtAYA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.3.1",
+        "@shikijs/types": "4.2.0",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -584,16 +584,16 @@
      }
    },
    "node_modules/@shikijs/rehype": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.2.0.tgz",
-      "integrity": "sha512-oshrlfUF3VPUJfnp5K1lLwsS/SRBKrIxONpdWebSKZXdBE3UsZnxgqpvRUA8UsofS7vmjFOCAHIT71ECbmOxTw==",
+      "integrity": "sha512-ST3EWye/dwF1gWskczJNBnwFtDzEQ9ceytXZtyc/GfwR5V0qJrkoSGZO55O3SAKDDsXkTDcsfwd9pVe7ROlAHg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.3.1",
+        "@shikijs/types": "4.2.0",
        "@types/hast": "^3.0.4",
        "hast-util-to-string": "^3.0.1",
-        "shiki": "4.3.1",
+        "shiki": "4.2.0",
        "unified": "^11.0.5",
        "unist-util-visit": "^5.1.0"
      },
@@ -602,22 +602,22 @@
      }
    },
    "node_modules/@shikijs/themes": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
-      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
+      "integrity": "sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.3.1"
+        "@shikijs/types": "4.2.0"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/types": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
+      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -684,9 +684,9 @@
      }
    },
    "node_modules/@types/hast": {
-      "version": "3.0.5",
+      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.4.tgz",
-      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
+      "integrity": "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -1076,9 +1076,9 @@
      }
    },
    "node_modules/@ungap/structured-clone": {
-      "version": "1.3.3",
+      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==",
+      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
      "dev": true,
      "license": "ISC"
    },
@@ -3589,18 +3589,18 @@
      "license": "MIT"
    },
    "node_modules/shiki": {
-      "version": "4.3.1",
+      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.3.1.tgz",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz",
-      "integrity": "sha512-oR+qDVi2OjX1tmDpyv+3KviX01KzO6Af+0NNnKnsp9491UEGz2YpxTuJboS/6VhYpTdqzmuJBuiTlrAWWJAssw==",
+      "integrity": "sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/core": "4.3.1",
+        "@shikijs/core": "4.2.0",
-        "@shikijs/engine-javascript": "4.3.1",
+        "@shikijs/engine-javascript": "4.2.0",
-        "@shikijs/engine-oniguruma": "4.3.1",
+        "@shikijs/engine-oniguruma": "4.2.0",
-        "@shikijs/langs": "4.3.1",
+        "@shikijs/langs": "4.2.0",
-        "@shikijs/themes": "4.3.1",
+        "@shikijs/themes": "4.2.0",
-        "@shikijs/types": "4.3.1",
+        "@shikijs/types": "4.2.0",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -26,7 +26,7 @@
 };
 use service::{mailer::messages, uiaa::UiaaInitiator, users::HashedPassword};
-use super::DEVICE_ID_LENGTH;
+use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::{Ruma, router::ClientIdentity};
 pub(crate) mod register;
@@ -20,12 +20,9 @@
 	assign,
 };
 use serde_json::value::RawValue;
-use service::{
+use service::{mailer::messages, users::HashedPassword};
 	mailer::messages,
 	users::{DeviceToken, HashedPassword},
 };
-use super::DEVICE_ID_LENGTH;
+use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::Ruma;
 /// # `POST /_matrix/client/v3/register`
@@ -122,7 +119,7 @@ pub(crate) async fn register_route(
 			.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
 		// Generate new token for the device
-		let new_token = DeviceToken::new_random();
+		let new_token = utils::random_string(TOKEN_LENGTH);
 		// Create device for this account
 		services
@@ -130,7 +127,8 @@ pub(crate) async fn register_route(
 			.create_device(
 				&user_id,
 				&device_id,
-				Some(new_token.clone()),
+				&new_token,
 				None,
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -144,7 +142,7 @@ pub(crate) async fn register_route(
 	debug_info!(%user_id, ?device, "New account created via legacy registration");
 	Ok(assign!(register::v3::Response::new(user_id), {
-		access_token: token.map(DeviceToken::into_token),
+		access_token: token,
 		device_id: device,
 		refresh_token: None,
 		expires_in: None,
@@ -89,7 +89,14 @@ pub(crate) async fn update_device_route(
 			services
 				.users
-				.create_device(sender_user, &device_id, None, None, Some(client.to_string()))
+				.create_device(
 					sender_user,
 					&device_id,
 					&appservice.registration.as_token,
 					None,
 					None,
 					Some(client.to_string()),
 				)
 				.await?;
 			return Ok(update_device::v3::Response::new());
@@ -0,0 +1,13 @@
 use axum::{Form, Json, extract::State, response::IntoResponse};
 use http::StatusCode;
 use service::oauth::grant::DeviceCodeRequest;
 pub(crate) async fn device_authorization_route(
 	State(services): State<crate::State>,
 	Form(request): Form<DeviceCodeRequest>,
 ) -> impl IntoResponse {
 	match services.oauth.request_device_code(request).await {
 		| Ok(response) => Ok(Json(response)),
 		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
 	}
 }
@@ -10,6 +10,7 @@
 use serde_json::json;
 pub(crate) use server_metadata::*;
 mod device;
 mod register_client;
 mod server_metadata;
 mod token;
@@ -20,6 +21,7 @@
 const CLIENT_REGISTER_PATH: &str = "client/register";
 const TOKEN_REVOKE_PATH: &str = "client/revoke";
 const TOKEN_PATH: &str = "grant/token";
 const DEVICE_AUTHORIZATION_PATH: &str = "device";
 const ACCOUNT_MANAGEMENT_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/account/deeplink");
 pub(crate) fn router(state: crate::State) -> Router<crate::State> {
@@ -53,4 +55,5 @@ fn oauth_router() -> Router<crate::State> {
 		.route(concat!("/", JWKS_URI_PATH), get(async || Json(json!({"keys": []}))))
 		.route(concat!("/", TOKEN_PATH), post(token::token_route))
 		.route(concat!("/", TOKEN_REVOKE_PATH), post(token::revoke_token_route))
 		.route(concat!("/", DEVICE_AUTHORIZATION_PATH), post(device::device_authorization_route))
 }
@@ -24,5 +24,5 @@ pub(crate) async fn register_client_route(
 		.await
 		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;
-	Ok((StatusCode::CREATED, Json(RegisteredClient { client_id, metadata })).into_response())
+	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
 }
@@ -12,8 +12,8 @@
 use crate::{
 	Ruma,
 	client::oauth::{
-		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, JWKS_URI_PATH, TOKEN_PATH,
+		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, DEVICE_AUTHORIZATION_PATH,
-		TOKEN_REVOKE_PATH,
+		JWKS_URI_PATH, TOKEN_PATH, TOKEN_REVOKE_PATH,
 	},
 };
@@ -49,7 +49,8 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		],
 		"authorization_endpoint": endpoint_base.join(AUTH_CODE_PATH).unwrap(),
 		"code_challenge_methods_supported": ["S256"],
-		"grant_types_supported": ["authorization_code", "refresh_token"],
+		"device_authorization_endpoint": endpoint_base.join(DEVICE_AUTHORIZATION_PATH).unwrap(),
 		"grant_types_supported": ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
 		"issuer": services.config.get_client_domain(),
 		"jwks_uri": endpoint_base.join(JWKS_URI_PATH).unwrap(),
 		"prompt_values_supported": ["create"],
@@ -29,9 +29,8 @@
 	},
 	assign,
 };
 use service::users::DeviceToken;
-use super::DEVICE_ID_LENGTH;
+use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
 use crate::Ruma;
 /// # `GET /_matrix/client/v3/login`
@@ -197,8 +196,8 @@ pub(crate) async fn login_route(
 		.clone()
 		.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());
-	// Generate a new token for the device
+	// Generate a new token for the device (ensuring no collisions)
-	let token = DeviceToken::new_random();
+	let token = services.users.generate_unique_token().await;
 	// Determine if device_id was provided and exists in the db for this user
 	let device_exists = if body.device_id.is_some() {
@@ -214,7 +213,7 @@ pub(crate) async fn login_route(
 	if device_exists {
 		services
 			.users
-			.set_token(&user_id, &device_id, token.clone())
+			.set_token(&user_id, &device_id, &token, None)
 			.await?;
 	} else {
 		services
@@ -222,7 +221,8 @@ pub(crate) async fn login_route(
 			.create_device(
 				&user_id,
 				&device_id,
-				Some(token.clone()),
+				&token,
 				None,
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -241,7 +241,7 @@ pub(crate) async fn login_route(
 	info!("{user_id} logged in");
 	#[allow(deprecated)]
-	Ok(assign!(login::v3::Response::new(user_id, token.into_token(), device_id), {
+	Ok(assign!(login::v3::Response::new(user_id, token, device_id), {
 		well_known: client_discovery_info,
 		expires_in: None,
 		home_server: Some(services.config.server_name.clone()),
@@ -273,7 +273,7 @@ pub(crate) async fn login_token_route(
 		.authenticate_password(&body.auth, sender_user, body.identity.sender_device(), None)
 		.await?;
-	let login_token = DeviceToken::new_random().into_token();
+	let login_token = utils::random_string(TOKEN_LENGTH);
 	let expires_in = services.users.create_login_token(sender_user, &login_token);
 	Ok(get_login_token::v1::Response::new(
@@ -15,9 +15,10 @@
 #[derive(Deserialize)]
 pub(crate) struct AuthQueryParams {
 	pub(super) user_id: Option<String>,
 	/// Device ID for appservice device masquerading (MSC3202/MSC4190).
 	/// Can be provided as `device_id` or `org.matrix.msc3202.device_id`.
 	#[serde(alias = "org.matrix.msc3202.device_id")]
 	pub(super) device_id: Option<String>,
 	#[serde(rename = "org.matrix.msc3202.device_id")]
 	pub(super) legacy_device_id: Option<String>,
 }
 /// Extractor for Ruma request structs
@@ -219,12 +219,8 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
 			// The device_id can be provided via `device_id` or
 			// `org.matrix.msc3202.device_id` query parameter.
-			let sender_device = if let Some(device_id) = query
+			let sender_device =
-				.device_id
+				if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
 				.or(query.legacy_device_id)
 				.as_deref()
 				.map(Into::into)
 			{
 					// Verify the device exists for this user
 					if services
 						.users
@@ -233,8 +229,8 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 						.is_err()
 					{
 						return Err!(Request(Forbidden(
-						"Device does not exist for user or appservice cannot masquerade as this \
+							"Device does not exist for user or appservice cannot masquerade as \
-						 device."
+							 this device."
 						)));
 					}
@@ -1,6 +1,4 @@
-use std::io::IsTerminal;
+use conduwuit::{Err, Result, debug, debug_info, error, info};
 use conduwuit::{Err, Result, debug, debug_info, error, info, warn};
 use ruma::events::room::message::RoomMessageEventContent;
 use tokio::time::{Duration, sleep};
@@ -9,16 +7,10 @@
 pub(super) const SIGNAL: &str = "SIGUSR2";
 impl super::Service {
-	/// Possibly spawn the terminal console at startup if configured and a TTY
+	/// Possibly spawn the terminal console at startup if configured.
 	/// is available.
 	pub(super) async fn console_auto_start(&self) {
 		#[cfg(feature = "console")]
 		if self.services.server.config.admin_console_automatic {
 			if !std::io::stdin().is_terminal() {
 				warn!("Console enabled without a tty available; Not enabling console");
 				return;
 			}
 			// Allow more of the startup sequence to execute before spawning
 			tokio::task::yield_now().await;
 			self.console.start().await;
@@ -132,6 +132,8 @@ pub enum ApplicationType {
 #[serde(rename_all = "snake_case")]
 pub enum GrantType {
 	AuthorizationCode,
 	#[serde(rename = "urn:ietf:params:oauth:grant-type:device_code")]
 	DeviceCode,
 	RefreshToken,
 }
@@ -13,6 +13,7 @@
 use url::Url;
 use super::client_metadata::ResponseType;
 use crate::oauth::client_metadata::GrantType;
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct AuthorizationCodeQuery {
@@ -29,6 +30,33 @@ pub struct AuthorizationCodeQuery {
 	pub prompt: Option<Prompt>,
 }
 #[derive(Deserialize, Serialize)]
 pub struct AuthorizationCodeResponse {
 	pub state: String,
 	pub code: String,
 }
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct DeviceCodeRequest {
 	pub client_id: String,
 	pub scope: RawScopes,
 }
 #[derive(Deserialize, Serialize)]
 pub struct DeviceCodeResponse {
 	pub device_code: String,
 	pub user_code: String,
 	pub verification_uri: Url,
 	#[serde(skip_serializing_if = "Option::is_none")]
 	pub verification_uri_complete: Option<Url>,
 	pub expires_in: u64,
 }
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct DeviceCodeVerifyQuery {
 	pub user_code: Option<String>,
 }
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 #[non_exhaustive]
@@ -126,19 +154,29 @@ pub struct OAuthError {
 impl OAuthError {
 	#[must_use]
-	pub const fn invalid_request(error_description: &'static str) -> Self {
+	pub fn new(error: ErrorCode, error_description: String) -> Self {
 		Self {
-			error: ErrorCode::InvalidRequest,
+			error,
 			error_description: Cow::Owned(error_description),
 		}
 	}
 	#[must_use]
 	pub const fn new_static(error: ErrorCode, error_description: &'static str) -> Self {
 		Self {
 			error,
 			error_description: Cow::Borrowed(error_description),
 		}
 	}
 	#[must_use]
-	pub const fn invalid_grant(error_description: &'static str) -> Self {
+	pub const fn invalid_request(error_description: &'static str) -> Self {
-		Self {
+		Self::new_static(ErrorCode::InvalidRequest, error_description)
 			error: ErrorCode::InvalidGrant,
 			error_description: Cow::Borrowed(error_description),
 	}
 	#[must_use]
 	pub const fn invalid_grant(error_description: &'static str) -> Self {
 		Self::new_static(ErrorCode::InvalidGrant, error_description)
 	}
 }
@@ -157,36 +195,43 @@ pub enum ErrorCode {
 	AccessDenied,
 	InvalidScope,
 	InvalidGrant,
 	InvalidClient,
 	InvalidClientMetadata,
 	AuthorizationPending,
 	ExpiredToken,
 }
-#[derive(Serialize, Deserialize)]
+#[derive(Deserialize)]
-pub struct AuthorizationCodeResponse {
+pub struct TokenRequest {
-	pub state: String,
+	pub client_id: String,
-	pub code: String,
+	#[serde(flatten)]
 	pub request: TokenRequestType,
 }
 #[derive(Deserialize)]
 #[serde(tag = "grant_type", rename_all = "snake_case")]
-pub enum TokenRequest {
+pub enum TokenRequestType {
 	AuthorizationCode {
 		code: String,
 		redirect_uri: Url,
 		client_id: String,
 		code_verifier: String,
 	},
 	#[serde(rename = "urn:ietf:params:oauth:grant-type:device_code")]
 	DeviceCode {
 		device_code: String,
 	},
 	RefreshToken {
 		client_id: String,
 		refresh_token: String,
 	},
 }
-impl TokenRequest {
+impl TokenRequestType {
 	#[must_use]
-	pub fn client_id(&self) -> &str {
+	pub fn grant_type(&self) -> GrantType {
 		match self {
-			| Self::AuthorizationCode { client_id, .. }
+			| Self::AuthorizationCode { .. } => GrantType::AuthorizationCode,
-			| Self::RefreshToken { client_id, .. } => client_id,
+			| Self::DeviceCode { .. } => GrantType::DeviceCode,
 			| Self::RefreshToken { .. } => GrantType::RefreshToken,
 		}
 	}
 }
@@ -12,20 +12,22 @@
 use database::{Deserialized, Json, Map};
 use itertools::Itertools;
 use lru_cache::LruCache;
 use rand::distr::{Distribution, slice::Choose};
 use ruma::{DeviceId, OwnedDeviceId, OwnedUserId, UserId};
 use serde::{Deserialize, Serialize};
 use url::Url;
 use crate::{
-	Dep,
+	Dep, config,
 	oauth::{
 		client_metadata::{ApplicationType, ClientMetadata, ResponseType},
 		grant::{
-			AuthorizationCodeQuery, AuthorizationCodeResponse, CodeChallengeMethod, ErrorCode,
+			AuthorizationCodeQuery, AuthorizationCodeResponse, CodeChallengeMethod,
-			OAuthError, ResponseMode, Scope, TokenRequest, TokenResponse, TokenType,
+			DeviceCodeRequest, DeviceCodeResponse, ErrorCode, OAuthError, ResponseMode, Scope,
 			TokenRequest, TokenRequestType, TokenResponse, TokenType,
 		},
 	},
-	users::{self, DeviceToken},
+	users,
 };
 pub mod client_metadata;
@@ -35,7 +37,8 @@ pub struct Service {
 	services: Services,
 	db: Data,
 	tickets: Mutex<HashMap<String, HashMap<OAuthTicket, SystemTime>>>,
-	pending_code_grants: tokio::sync::Mutex<LruCache<String, PendingCodeGrant>>,
+	pending_auth_code_grants: tokio::sync::Mutex<LruCache<String, PendingAuthCodeGrant>>,
 	pending_device_code_grants: tokio::sync::Mutex<LruCache<String, PendingDeviceCodeGrant>>,
 }
 struct Data {
@@ -46,6 +49,7 @@ struct Data {
 struct Services {
 	users: Dep<users::Service>,
 	config: Dep<config::Service>,
 }
 #[derive(Debug, Deserialize, Serialize)]
@@ -62,7 +66,7 @@ struct RefreshTokenInfo {
 	device_id: OwnedDeviceId,
 }
-struct PendingCodeGrant {
+struct PendingAuthCodeGrant {
 	authorizing_user: OwnedUserId,
 	requested_scopes: BTreeSet<Scope>,
 	client_name: Option<String>,
@@ -72,12 +76,8 @@ struct PendingCodeGrant {
 	requested_at: SystemTime,
 }
-impl PendingCodeGrant {
+impl PendingAuthCodeGrant {
 	const MAX_AGE: Duration = Duration::from_mins(1);
 	const RANDOM_CODE_LENGTH: usize = 32;
 	#[must_use]
 	pub(crate) fn generate_code() -> String { utils::random_string(Self::RANDOM_CODE_LENGTH) }
 	#[must_use]
 	pub(crate) fn is_valid_for(&self, client_id: &str) -> bool {
@@ -90,6 +90,43 @@ pub(crate) fn is_valid_for(&self, client_id: &str) -> bool {
 	}
 }
 struct PendingDeviceCodeGrant {
 	state: DeviceCodeGrantState,
 	requested_scopes: BTreeSet<Scope>,
 	client_name: Option<String>,
 	client_id: String,
 	requested_at: SystemTime,
 }
 enum DeviceCodeGrantState {
 	Unverified {
 		user_code: String,
 	},
 	Verified {
 		authorizing_user: OwnedUserId,
 	},
 }
 impl PendingDeviceCodeGrant {
 	const MAX_AGE: Duration = Duration::from_mins(1);
 	#[must_use]
 	pub(crate) fn is_valid_for(&self, client_id: &str) -> bool {
 		let now = SystemTime::now();
 		self.client_id == client_id
 			&& now
 				.duration_since(self.requested_at)
 				.is_ok_and(|age| age < Self::MAX_AGE)
 	}
 }
 pub struct DeviceCodeGrantInfo {
 	pub device_code: String,
 	pub client_metadata: ClientMetadata,
 	pub requested_scopes: BTreeSet<Scope>,
 }
 /// A time-limited grant for a client to perform some sensitive action.
 #[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub enum OAuthTicket {
@@ -112,6 +149,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		Ok(Arc::new(Self {
 			services: Services {
 				users: args.depend::<users::Service>("users"),
 				config: args.depend::<config::Service>("config"),
 			},
 			db: Data {
 				clientid_clientmetadata: args.db["clientid_clientmetadata"].clone(),
@@ -119,8 +157,11 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				refreshtoken_refreshtokeninfo: args.db["refreshtoken_refreshtokeninfo"].clone(),
 			},
 			tickets: Mutex::default(),
-			pending_code_grants: tokio::sync::Mutex::new(LruCache::new(
+			pending_auth_code_grants: tokio::sync::Mutex::new(LruCache::new(
-				Self::MAX_PENDING_CODE_GRANTS,
+				Self::MAX_PENDING_GRANTS,
 			)),
 			pending_device_code_grants: tokio::sync::Mutex::new(LruCache::new(
 				Self::MAX_PENDING_GRANTS,
 			)),
 		}))
 	}
@@ -133,11 +174,21 @@ impl Service {
 	// Maximum number of pending code grants which will be held in memory at once,
 	// to prevent unbounded memory use if someone decides to repeatedly reload the
 	// grant page.
-	const MAX_PENDING_CODE_GRANTS: usize = 100;
+	const MAX_PENDING_GRANTS: usize = 100;
 	const RANDOM_TOKEN_LENGTH: usize = 32;
 	const USER_CODE_CHARACTERS: &[char] = &['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'];
 	const USER_CODE_LENGTH: usize = 6;
 	fn generate_token() -> String { utils::random_string(Self::RANDOM_TOKEN_LENGTH) }
 	fn generate_user_code() -> String {
 		Choose::new(Self::USER_CODE_CHARACTERS)
 			.unwrap()
 			.sample_iter(&mut rand::rng())
 			.take(Self::USER_CODE_LENGTH)
 			.collect()
 	}
 	pub async fn register_client(&self, metadata: &ClientMetadata) -> Result<String, OAuthError> {
 		metadata.validate().map_err(|error| OAuthError {
 			error: ErrorCode::InvalidClientMetadata,
@@ -231,14 +282,14 @@ pub async fn request_authorization_code(
 			| ResponseMode::Query => '?',
 		};
-		let code = PendingCodeGrant::generate_code();
+		let code = Self::generate_token();
 		info!(
 			client_id = &query.client_id,
 			client_name = &client_metadata.client_name,
 			?requested_scopes,
 			?authorizing_user,
-			"Issuing oauth authorization code"
+			"Issuing OAuth authorization code"
 		);
 		let redirect_uri = format!(
@@ -252,7 +303,7 @@ pub async fn request_authorization_code(
 			.unwrap(),
 		);
-		let pending_grant = PendingCodeGrant {
+		let pending_grant = PendingAuthCodeGrant {
 			authorizing_user,
 			requested_scopes,
 			client_name: client_metadata.client_name,
@@ -262,7 +313,7 @@ pub async fn request_authorization_code(
 			requested_at: SystemTime::now(),
 		};
-		self.pending_code_grants
+		self.pending_auth_code_grants
 			.lock()
 			.await
 			.insert(code, pending_grant);
@@ -270,15 +321,129 @@ pub async fn request_authorization_code(
 		Ok(redirect_uri)
 	}
 	pub async fn request_device_code(
 		&self,
 		query: DeviceCodeRequest,
 	) -> Result<DeviceCodeResponse, OAuthError> {
 		let Some(client_metadata) = self.get_client_metadata(&query.client_id).await else {
 			return Err(OAuthError::new_static(ErrorCode::InvalidClient, "Invalid client ID"));
 		};
 		let requested_scopes = query
 			.scope
 			.to_scopes()
 			.map_err(|err| OAuthError::new(ErrorCode::InvalidGrant, err))?;
 		let device_code = Self::generate_token();
 		let user_code = Self::generate_user_code();
 		let verification_uri = self
 			.services
 			.config
 			.get_client_domain()
 			.join(&format!("{}/oauth2/grant/device_code", conduwuit::ROUTE_PREFIX))
 			.unwrap();
 		let mut verification_uri_complete = verification_uri.clone();
 		verification_uri_complete
 			.query_pairs_mut()
 			.append_pair("user_code", &user_code);
 		info!(
 			client_id = &query.client_id,
 			client_name = &client_metadata.client_name,
 			?requested_scopes,
 			"Issuing OAuth device code"
 		);
 		let pending_grant = PendingDeviceCodeGrant {
 			state: DeviceCodeGrantState::Unverified { user_code: user_code.clone() },
 			requested_scopes,
 			client_name: client_metadata.client_name,
 			client_id: query.client_id,
 			requested_at: SystemTime::now(),
 		};
 		self.pending_device_code_grants
 			.lock()
 			.await
 			.insert(device_code.clone(), pending_grant);
 		Ok(DeviceCodeResponse {
 			device_code,
 			user_code,
 			verification_uri,
 			verification_uri_complete: Some(verification_uri_complete),
 			expires_in: PendingDeviceCodeGrant::MAX_AGE.as_secs(),
 		})
 	}
 	pub async fn grant_info_for_user_code(
 		&self,
 		supplied_user_code: &str,
 	) -> Option<DeviceCodeGrantInfo> {
 		let pending_grants = self.pending_device_code_grants.lock().await;
 		let (device_code, grant) = pending_grants
 			.iter()
 			.find(|(_, grant)| {
 				matches!(&grant.state, DeviceCodeGrantState::Unverified { user_code } if user_code == supplied_user_code)
 			})?;
 		let client_metadata = self
 			.get_client_metadata(&grant.client_id)
 			.await
 			.expect("client should exist");
 		Some(DeviceCodeGrantInfo {
 			device_code: device_code.clone(),
 			client_metadata,
 			requested_scopes: grant.requested_scopes.clone(),
 		})
 	}
 	pub async fn validate_device_code(
 		&self,
 		authorizing_user: OwnedUserId,
 		device_code: &str,
 	) -> Result<(), String> {
 		let mut pending_grants = self.pending_device_code_grants.lock().await;
 		let Some(pending_grant) = pending_grants.get_mut(device_code) else {
 			return Err("Invalid device code".to_owned());
 		};
 		match &mut pending_grant.state {
 			| state @ DeviceCodeGrantState::Unverified { .. } => {
 				*state = DeviceCodeGrantState::Verified { authorizing_user };
 				Ok(())
 			},
 			| DeviceCodeGrantState::Verified {
 				authorizing_user: previous_authorizing_user,
 			} =>
 				if *previous_authorizing_user == authorizing_user {
 					Ok(())
 				} else {
 					Err("Device code is already verified".to_owned())
 				},
 		}
 	}
 	pub async fn issue_token(&self, request: TokenRequest) -> Result<TokenResponse, OAuthError> {
 		let TokenRequest { client_id, request } = request;
 		let Some(client_metadata) = self.get_client_metadata(&client_id).await else {
 			return Err(OAuthError::new_static(ErrorCode::InvalidClient, "Invalid client ID"));
 		};
 		if !client_metadata.grant_types.contains(&request.grant_type()) {
 			return Err(OAuthError::invalid_grant("Client cannot request this grant type"));
 		}
 		match request {
-			| TokenRequest::AuthorizationCode {
+			| TokenRequestType::AuthorizationCode { code, redirect_uri, code_verifier } => {
-				code,
+				let mut pending_grants = self.pending_auth_code_grants.lock().await;
 				redirect_uri,
 				client_id,
 				code_verifier,
 			} => {
 				let mut pending_grants = self.pending_code_grants.lock().await;
 				let Some(pending_grant) = pending_grants
 					.remove(&code)
@@ -305,7 +470,39 @@ pub async fn issue_token(&self, request: TokenRequest) -> Result<TokenResponse,
 				)
 				.await
 			},
-			| TokenRequest::RefreshToken { client_id, refresh_token } =>
+			| TokenRequestType::DeviceCode { device_code } => {
 				let mut pending_grants = self.pending_device_code_grants.lock().await;
 				let Some(pending_grant) = pending_grants
 					.remove(&device_code)
 					.filter(|grant| grant.is_valid_for(&client_id))
 				else {
 					return Err(OAuthError::new_static(
 						ErrorCode::ExpiredToken,
 						"Invalid device code",
 					));
 				};
 				match &pending_grant.state {
 					| DeviceCodeGrantState::Unverified { .. } => {
 						pending_grants.insert(device_code, pending_grant);
 						Err(OAuthError::new_static(
 							ErrorCode::AuthorizationPending,
 							"Authorization is pending",
 						))
 					},
 					| DeviceCodeGrantState::Verified { authorizing_user } =>
 						self.create_session(
 							authorizing_user.to_owned(),
 							pending_grant.requested_scopes,
 							pending_grant.client_name,
 							client_id,
 						)
 						.await,
 				}
 			},
 			| TokenRequestType::RefreshToken { refresh_token } =>
 				self.refresh_session(client_id, refresh_token).await,
 		}
 	}
@@ -343,7 +540,7 @@ async fn create_session(
 		client_name: Option<String>,
 		client_id: String,
 	) -> Result<TokenResponse, OAuthError> {
-		let access_token = DeviceToken::new_random().with_max_age(Self::ACCESS_TOKEN_MAX_AGE);
+		let access_token = Self::generate_token();
 		let refresh_token = Self::generate_token();
 		let device_id = requested_scopes
@@ -364,11 +561,10 @@ async fn create_session(
 			.await
 			.is_ok()
 		{
-			return Err(OAuthError {
+			return Err(OAuthError::new_static(
-				error: ErrorCode::InvalidScope,
+				ErrorCode::InvalidScope,
-				error_description: "A device with the supplied ID already exists for this user"
+				"A device with the supplied ID already exists for this user",
-					.into(),
+			));
 			});
 		}
 		self.services
@@ -376,7 +572,8 @@ async fn create_session(
 			.create_device(
 				&authorizing_user,
 				device_id,
-				Some(access_token.clone()),
+				&access_token,
 				Some(Self::ACCESS_TOKEN_MAX_AGE),
 				client_name,
 				None,
 			)
@@ -412,7 +609,7 @@ async fn create_session(
 		);
 		Ok(TokenResponse {
-			access_token: access_token.into_token(),
+			access_token,
 			token_type: TokenType::Bearer,
 			expires_in: Self::ACCESS_TOKEN_MAX_AGE.as_secs(),
 			scope: requested_scopes.iter().join(" "),
@@ -448,7 +645,7 @@ async fn refresh_session(
 		assert_eq!(&client_id, &session_info.client_id, "session info client id mismatch");
-		let new_access_token = DeviceToken::new_random().with_max_age(Self::ACCESS_TOKEN_MAX_AGE);
+		let new_access_token = Self::generate_token();
 		let new_refresh_token = Self::generate_token();
 		let scope = session_info.scopes.iter().join(" ");
 		session_info
@@ -460,7 +657,8 @@ async fn refresh_session(
 			.set_token(
 				&refresh_token_info.user_id,
 				&refresh_token_info.device_id,
-				new_access_token.clone(),
+				&new_access_token,
 				Some(Self::ACCESS_TOKEN_MAX_AGE),
 			)
 			.await
 			.expect("should be able to set token");
@@ -477,7 +675,7 @@ async fn refresh_session(
 			.raw_put(&new_refresh_token, Json(refresh_token_info));
 		Ok(TokenResponse {
-			access_token: new_access_token.into_token(),
+			access_token: new_access_token,
 			token_type: TokenType::Bearer,
 			expires_in: Self::ACCESS_TOKEN_MAX_AGE.as_secs(),
 			scope,
@@ -6,9 +6,8 @@
 };
 use futures::future::ready;
 use ruma::{
-	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, ServerName,
+	CanonicalJsonObject, EventId, OwnedEventId, ServerName, api::error::ErrorKind,
-	api::error::ErrorKind, canonical_json::redact, events::StateEventType,
+	canonical_json::redact, events::StateEventType, room_version_rules::RoomVersionRules,
 	room_version_rules::RoomVersionRules,
 };
 use crate::rooms::{
@@ -43,28 +42,12 @@ pub fn pdu_format_check_1(
 			return Err!(Request(BadJson("PDU has too many auth events")));
 		}
 		// The m.room.create event is the genesis event and has empty auth_events
 		// by definition, so it is exempt from the checks below requiring or
 		// forbidding the create event in auth_events (it cannot reference itself).
 		let Some(event_type) = pdu_json.get("type").and_then(CanonicalJsonValue::as_str) else {
 			return Err!(Request(BadJson("PDU is missing a type")));
 		};
 		let state_key = pdu_json
 			.get("state_key")
 			.and_then(CanonicalJsonValue::as_str);
 		let is_create_event = event_type == "m.room.create" && state_key == Some("");
 		if !is_create_event {
 		let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
 		if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
 			return Err!(Request(BadJson("PDU references a create event")));
-			} else if event_format.allow_room_create_in_auth_events
+		} else if event_format.allow_room_create_in_auth_events && !create_event_in_auth_events {
 				&& !create_event_in_auth_events
 			{
 			return Err!(Request(BadJson("PDU does not reference the room create event")));
 		}
 		}
 		let prev_events = expect_event_id_array(pdu_json, "prev_events")?;
 		if prev_events.len() > 20 {
@@ -41,6 +41,7 @@ pub async fn set_dehydrated_device(&self, user_id: &UserId, request: Request) ->
 		self.create_device(
 			user_id,
 			&request.device_id,
 			"",
 			None,
 			request.initial_device_display_name.clone(),
 			None,
@@ -11,44 +11,20 @@
 use futures::{Stream, StreamExt};
 use ruma::{
 	DeviceId, MilliSecondsSinceUnixEpoch, OwnedDeviceId, OwnedUserId, UserId,
-	api::client::device::Device, assign, events::AnyToDeviceEvent, serde::Raw, uint,
+	api::client::device::Device, events::AnyToDeviceEvent, serde::Raw, uint,
 };
 use serde_json::json;
 use crate::users::increment;
 #[must_use]
 #[derive(Clone)]
 pub struct DeviceToken {
 	token: String,
 	max_age: Option<Duration>,
 }
 impl DeviceToken {
 	const DEVICE_ID_LENGTH: usize = 10;
 	pub fn new(token: String) -> Self { Self { token, max_age: None } }
 	pub fn new_random() -> Self { Self::new(utils::random_string(Self::DEVICE_ID_LENGTH)) }
 	pub fn with_max_age(self, max_age: Duration) -> Self {
 		assign!(self, { max_age: Some(max_age) })
 	}
 	#[must_use]
 	pub fn into_token(self) -> String { self.token }
 }
 impl super::Service {
 	/// Adds a new device to a user.
 	///
 	/// If no `token` is provided, the device will not be able to be logged
 	/// into.
 	pub async fn create_device(
 		&self,
 		user_id: &UserId,
 		device_id: &DeviceId,
-		token: Option<DeviceToken>,
+		token: &str,
 		token_max_age: Option<Duration>,
 		initial_device_display_name: Option<String>,
 		client_ip: Option<String>,
 	) -> Result<()> {
@@ -62,12 +38,8 @@ pub async fn create_device(
 		increment(&self.db.userid_devicelistversion, user_id.as_bytes());
 		self.db.userdeviceid_metadata.put(key, Json(device));
-
+		self.set_token(user_id, device_id, token, token_max_age)
-		if let Some(token) = token {
+			.await
 			self.set_token(user_id, device_id, token).await?;
 		}
 		Ok(())
 	}
 	/// Removes a device from a user.
@@ -125,12 +97,31 @@ pub async fn get_token(&self, user_id: &UserId, device_id: &DeviceId) -> Result<
 		self.db.userdeviceid_token.qry(&key).await.deserialized()
 	}
 	/// Generate a unique access token that doesn't collide with existing tokens
 	pub async fn generate_unique_token(&self) -> String {
 		loop {
 			let token = utils::random_string(32);
 			// Check for collision with existing appservice and user tokens
 			let (appservice, usr) = tokio::join!(
 				self.services.appservice.find_from_token(&token),
 				self.db.token_userdeviceid.get(&token)
 			);
 			if appservice.is_ok() || usr.is_ok() {
 				continue;
 			}
 			return token;
 		}
 	}
 	/// Replaces the access token of one device.
 	pub async fn set_token(
 		&self,
 		user_id: &UserId,
 		device_id: &DeviceId,
-		DeviceToken { token, max_age }: DeviceToken,
+		token: &str,
 		token_max_age: Option<Duration>,
 	) -> Result<()> {
 		let key = (user_id, device_id);
 		if self.db.userdeviceid_metadata.qry(&key).await.is_err() {
@@ -145,7 +136,7 @@ pub async fn set_token(
 		if self
 			.services
 			.appservice
-			.find_from_token(&token)
+			.find_from_token(token)
 			.await
 			.is_ok()
 		{
@@ -162,10 +153,10 @@ pub async fn set_token(
 		}
 		// Assign token to user device combination
-		self.db.userdeviceid_token.put_raw(key, &token);
+		self.db.userdeviceid_token.put_raw(key, token);
-		self.db.token_userdeviceid.raw_put(&token, key);
+		self.db.token_userdeviceid.raw_put(token, key);
-		if let Some(max_age) = max_age {
+		if let Some(max_age) = token_max_age {
 			let expires = SystemTime::now()
 				.duration_since(SystemTime::UNIX_EPOCH)
 				.expect("system time should not be before the epoch")
@@ -14,7 +14,6 @@
 	utils::{self},
 };
 use database::Map;
 pub use device::DeviceToken;
 pub use profile::ProfileFieldChange;
 use ruma::{UserId, api::error::ErrorKind, encryption::CrossSigningKey, serde::Raw};
 use serde::{Deserialize, Serialize};
@@ -155,7 +155,7 @@ async fn get_account_deeplink(
 				));
 			};
-			format!("device/{device_id}/remove")
+			format!("device/{device_id}/delete")
 		},
 		| AccountManagementAction::DeviceView => {
 			let Some(device_id) = query.device_id else {
@@ -65,17 +65,17 @@ pub(super) async fn for_local_user(services: &Services, user_id: &UserId) -> Sel
 	}
 	pub(super) fn for_device(
-		oauth_metadata: Option<&ClientMetadata>,
+		client_metadata: Option<&ClientMetadata>,
 		display_name: Option<&str>,
 	) -> Self {
-		let avatar_src = oauth_metadata
+		let avatar_src = client_metadata
 			.and_then(|metadata| metadata.logo_uri.as_ref())
 			.map(|uri| uri.as_str().to_owned());
 		let avatar_type = if let Some(avatar_src) = avatar_src {
 			AvatarType::Image(avatar_src)
 		} else if let Some(initial) = display_name.and_then(|name| name.chars().next()) {
-			if oauth_metadata.is_some() {
+			if client_metadata.is_some() {
 				AvatarType::Initial(initial)
 			} else {
 				AvatarType::Initial('❖')
@@ -86,6 +86,20 @@ pub(super) fn for_device(
 		Self { avatar_type }
 	}
 	pub(super) fn for_client(client_metadata: &ClientMetadata) -> Self {
 		let avatar_type = if let Some(logo) = &client_metadata.logo_uri {
 			AvatarType::Image(logo.to_string())
 		} else if let Some(name) = &client_metadata.client_name
 			&& let Some(char) = name.chars().next()
 		{
 			AvatarType::Initial(char)
 		} else {
 			AvatarType::Initial('?')
 		};
 		Self { avatar_type }
 	}
 }
 #[derive(Debug, Template)]
@@ -4,9 +4,12 @@
 	response::Redirect,
 	routing::on,
 };
-use conduwuit_service::oauth::grant::{AuthorizationCodeQuery, Prompt};
+use conduwuit_service::oauth::{
 	client_metadata::ClientMetadata,
 	grant::{AuthorizationCodeQuery, DeviceCodeVerifyQuery, Prompt},
 };
 use ruma::OwnedUserId;
-use url::Url;
+use serde::Deserialize;
 use crate::{
 	ROUTE_PREFIX, WebError,
@@ -14,7 +17,7 @@
 	pages::{
 		GET_POST, Result, TemplateContext,
 		account::register::{RegisterQuery, RequestedRegistrationFlow},
-		components::{Avatar, AvatarType, ClientScopes},
+		components::{Avatar, ClientScopes, UserCard},
 	},
 	response,
 	session::{LoginIntent, LoginQuery, LoginTarget, User},
@@ -22,7 +25,9 @@
 };
 pub(crate) fn build() -> Router<crate::State> {
-	Router::new().route("/authorization_code", on(GET_POST, route_authorization_code))
+	Router::new()
 		.route("/authorization_code", on(GET_POST, route_authorization_code))
 		.route("/device_code", on(GET_POST, route_device_code))
 }
 template! {
@@ -30,12 +35,9 @@ struct Grant use "grant.html.j2" {
 		logout_query: String,
 		user_id: OwnedUserId,
 		user_avatar: Avatar,
-		client_uri: Url,
+		client_metadata: ClientMetadata,
-		client_name: String,
+		scopes: ClientScopes,
-		client_avatar: Avatar,
+		device_code: Option<String>
 		policy_uri: Option<Url>,
 		tos_uri: Option<Url>,
 		scopes: ClientScopes
 	}
 }
@@ -102,27 +104,6 @@ async fn route_authorization_code(
 	let scopes = query.scope.to_scopes().map_err(WebError::BadRequest)?;
 	let client_name = if let Some(name) = &client.client_name {
 		name
 	} else {
 		"Unknown application"
 	}
 	.to_owned();
 	let client_avatar = {
 		let avatar_type = if let Some(logo) = &client.logo_uri {
 			AvatarType::Image(logo.to_string())
 		} else if let Some(name) = &client.client_name
 			&& let Some(char) = name.chars().next()
 		{
 			AvatarType::Initial(char)
 		} else {
 			AvatarType::Initial('?')
 		};
 		Avatar { avatar_type }
 	};
 	let user_avatar = Avatar::for_local_user(&services, &user_id).await;
 	response!(Grant::new(
@@ -135,11 +116,102 @@ async fn route_authorization_code(
 		.unwrap(),
 		user_id,
 		user_avatar,
-		client.client_uri.clone(),
+		client,
 		client_name,
 		client_avatar,
 		client.policy_uri.clone(),
 		client.tos_uri.clone(),
 		ClientScopes { scopes },
 		None,
 	))
 }
 #[derive(Deserialize)]
 #[serde(tag = "stage", rename_all = "snake_case")]
 enum DeviceCodeForm {
 	Lookup {
 		user_code: String,
 	},
 	Confirm {
 		device_code: String,
 	},
 }
 template! {
 	struct DeviceCodeGrant use "device_code_grant.html.j2" {
 		user_card: UserCard,
 		body: DeviceCodeGrantBody
 	}
 }
 #[derive(Debug)]
 enum DeviceCodeGrantBody {
 	Lookup {
 		user_code_error: bool,
 	},
 	Success,
 }
 async fn route_device_code(
 	State(services): State<crate::State>,
 	Extension(context): Extension<TemplateContext>,
 	user: User<true>,
 	Expect(Query(query)): Expect<Query<DeviceCodeVerifyQuery>>,
 	PostForm(form): PostForm<DeviceCodeForm>,
 ) -> Result {
 	let user_id = if let Some(user) = user.into_session() {
 		user.user_id
 	} else {
 		let next = LoginTarget::DeviceCode(query.clone());
 		let uri = format!(
 			"{}/account/login?{}",
 			ROUTE_PREFIX,
 			serde_urlencoded::to_string(LoginQuery { next: Some(next), ..Default::default() })
 				.unwrap()
 		);
 		return response!(Redirect::to(&uri));
 	};
 	let user_card = UserCard::for_local_user(&services, user_id.clone()).await;
 	match (form, query.user_code.clone()) {
 		| (None, Some(user_code)) | (Some(DeviceCodeForm::Lookup { user_code }), _) => {
 			let Some(grant_info) = services.oauth.grant_info_for_user_code(&user_code).await
 			else {
 				return response!(DeviceCodeGrant::new(
 					context,
 					user_card,
 					DeviceCodeGrantBody::Lookup { user_code_error: true }
 				));
 			};
 			let user_avatar = Avatar::for_local_user(&services, &user_id).await;
 			response!(Grant::new(
 				context,
 				serde_urlencoded::to_string(LoginQuery {
 					next: Some(LoginTarget::DeviceCode(query)),
 					intent: Some(LoginIntent::SwitchAccounts),
 					..Default::default()
 				})
 				.unwrap(),
 				user_id,
 				user_avatar,
 				grant_info.client_metadata,
 				ClientScopes { scopes: grant_info.requested_scopes },
 				Some(grant_info.device_code),
 			))
 		},
 		| (Some(DeviceCodeForm::Confirm { device_code }), _) => {
 			services
 				.oauth
 				.validate_device_code(user_id, &device_code)
 				.await
 				.map_err(WebError::BadRequest)?;
 			response!(DeviceCodeGrant::new(context, user_card, DeviceCodeGrantBody::Success))
 		},
 		| (None, None) =>
 			response!(DeviceCodeGrant::new(context, user_card, DeviceCodeGrantBody::Lookup {
 				user_code_error: false
 			})),
 	}
 }
@@ -20,3 +20,17 @@
    font-style: italic;
    text-align: center;
 }
 .user-code {
    display: flex;
    flex-direction: column;
    align-items: center;
    input {
        text-align: center;
        font-weight: bold;
        font-size: 200%;
        padding: 0.2em;
        width: 6em !important;
    }
 }
@@ -0,0 +1,50 @@
 {% extends "_layout.html.j2" %}
 {%- block head -%}
 <link rel="stylesheet" href="{{ crate::ROUTE_PREFIX }}/resources/grant.css">
 {%- endblock -%}
 {%- block title -%}
 Authorize client
 {%- endblock -%}
 {%- block content -%}
 <div class="panel narrow">
    <h1>Authorize device</h1>
    {{ user_card }}
    {% match body %}
        {% when DeviceCodeGrantBody::Lookup { user_code_error }  %}
            <p>
                Enter the code displayed on your device, or in the app you're signing into.
            </p>
            <p>
                <em class="negative">Never enter a code given to you by someone else.</em>
                Your homeserver administrator will never ask you to enter a code on this page.
            </p>
            <form method="post">
                <p>
                    <div class="user-code">
                        <label for="user_code">Validation code</label>
                        <input
                            type="text"
                            id="user_code"
                            name="user_code"
                            maxlength="6"
                            spellcheck="false"
                            pattern="\d{6}"
                            title="Enter the six-digit validation code"
                        >
                    </div>
                    {% if user_code_error %}
                        <small class="error">Invalid code</small>
                    {% endif %}
                </p>
                <input type="hidden" name="stage" value="lookup">
                <button type="submit">Continue</button>
            </form>
        {% when DeviceCodeGrantBody::Success %}
            <p>Success! 🎉 You can close this tab and return to your device.</p>
    {% endmatch %}
 </div>
 {% endblock %}
@@ -9,6 +9,7 @@ Authorize client
 {%- endblock -%}
 {%- block content -%}
 {% let client_name = client_metadata.client_name.as_deref().unwrap_or("Unknown application") %}
 <div class="panel narrow">
    <h1>Authorize {{ client_name }}</h1>
    <div class="avatars">
@@ -18,17 +19,17 @@ Authorize client
        <div class="separator" aria-hidden="true">
            ⇄
        </div>
-        {{ client_avatar }}
+        {{ Avatar::for_client(client_metadata) }}
    </div>
    <div class="identity">
        Signed in as <code>{{ user_id }}</code>. <a href="{{ crate::ROUTE_PREFIX }}/account/logout?{{ logout_query }}">Switch accounts</a>
    </div>
    <p>
-        <b>{{ client_name }}</b> (<a href="{{ client_uri }}">{{ client_uri.domain().unwrap() }}</a>) would like
+        <b>{{ client_name }}</b> (<a href="{{ client_metadata.client_uri }}">{{ client_metadata.client_uri.domain().unwrap() }}</a>) would like
        your permission to:
        {{ scopes }}
    </p>
-    {% match (&policy_uri, &tos_uri) %}
+    {% match (&client_metadata.policy_uri, &client_metadata.tos_uri) %}
        {% when (Some(policy_uri), Some(tos_uri)) %}
            <p>
                {{ client_name }}'s <a href="{{ policy_uri }}">policies</a>
@@ -49,6 +50,10 @@ Authorize client
    {% endmatch %}
    <form method="post">
        <input type="hidden" name="stage" value="confirm">
        {% if let Some(device_code) = device_code %}
            <input type="hidden" name="device_code" value="{{ device_code }}">
        {% endif %}
        <button type="submit">Continue</button>
    </form>
 </div>
@@ -9,7 +9,7 @@
 	http::request::Parts,
 	response::{IntoResponse, Redirect, Response},
 };
-use conduwuit_service::oauth::grant::AuthorizationCodeQuery;
+use conduwuit_service::oauth::grant::{AuthorizationCodeQuery, DeviceCodeVerifyQuery};
 use ruma::{OwnedUserId, UserId};
 use serde::{Deserialize, Serialize};
 use tower_sessions::Session;
@@ -38,6 +38,7 @@ pub(crate) enum LoginTarget {
 	ChangeEmail,
 	CrossSigningReset,
 	Deactivate,
 	DeviceCode(DeviceCodeVerifyQuery),
 	DeviceInfo(DevicePath),
 	RemoveDevice(DevicePath),
 }
@@ -59,6 +60,9 @@ pub(crate) fn target_path(&self) -> String {
 			| Self::ChangeEmail => "account/email/change/".into(),
 			| Self::CrossSigningReset => "account/cross_signing_reset".into(),
 			| Self::Deactivate => "account/deactivate".into(),
 			| Self::DeviceCode(code) =>
 				format!("oauth2/grant/device_code?{}", serde_urlencoded::to_string(code).unwrap())
 					.into(),
 			| Self::DeviceInfo(path) => format!("account/device/{}/", path.device).into(),
 			| Self::RemoveDevice(path) => format!("account/device/{}/remove", path.device).into(),
 		};
Author	SHA1	Message	Date
Ginger	64189263ba	fix: Use correct error code for invalid client ID	2026-07-13 10:01:50 -04:00
Ginger	14b8333183	feat: Add support for OAuth2 device auth flow	2026-07-12 17:32:13 -04:00
		`@@ -0,0 +1 @@`
							`Added support for the OAuth2 device authorization flow. Contributed by @ginger`
		`@@ -1 +0,0 @@`
			`Appservices are now properly able to create devices for E2EE.`
		`@@ -0,0 +1 @@`
							Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
		`@@ -0,0 +1 @@`
							Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.
		`@@ -1 +0,0 @@`
			`Fixed newly created rooms failing to sync properly in clients using legacy sync.`
		`@@ -1 +0,0 @@`
			Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
		`@@ -1 +0,0 @@`
			`Fixed the deeplink redirect for deleting devices. Contributed by @koen`
		`@@ -1 +0,0 @@`
			`Fix status code for oauth registration. Contributed by @n00byking`
		`@@ -1 +0,0 @@`
			`Exempt m.room.create from auth_events check. Contributed by @eleboucher`