chore(deps): update rust-non-major

ci: Attempt to delay major rust toolchain updates
chore(Nix): Updated flake hashes
2026-07-20 17:30:54 +00:00 · 2026-07-19 05:04:35 +00:00 · 2026-07-17 19:18:38 +01:00 · 2026-07-17 17:58:23 +00:00 · 2026-07-17 17:58:23 +00:00 · 2026-07-17 17:57:51 +00:00
72 changed files with 868 additions and 845 deletions
@@ -71,7 +71,7 @@ runs:

    - name: Install timelord-cli and git-warp-time
      if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@50414676f9f5d50a65992c6dd2ed02641263226c # v2
+      uses: https://github.com/taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853 # v2
      with:
        tool: git-warp-time,timelord-cli@3.0.1

@@ -65,7 +65,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          draft: true
          files: binaries/*
@@ -32,7 +32,7 @@ jobs:

      - name: Setup Node.js
        if: steps.runner-env.outputs.node_major == '' || steps.runner-env.outputs.node_major < '20'
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: 22

@@ -24,7 +24,7 @@ jobs:

    steps:
      - name: 📦 Setup Node.js
-        uses: https://github.com/actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: https://github.com/actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
        with:
          node-version: "22"

@@ -218,7 +218,7 @@ jobs:
          path: binaries
          merge-multiple: true
      - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
+        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
        with:
          draft: true
          files: binaries/*
@@ -43,7 +43,7 @@ jobs:
    name: Renovate
    runs-on: ubuntu-latest
    container:
-      image: ghcr.io/renovatebot/renovate:43.252.1@sha256:121eb04ef758537019fb58f587aa53c99e5fda4e703993ce2ca01bd4b3926bd4
+      image: ghcr.io/renovatebot/renovate:43.260.2@sha256:60d830108d9ff6408d11a55d5f110ee0976bed78a6b82b08211e3ddb72f72952
      options: --tmpfs /tmp:exec
    steps:
      - name: Checkout
@@ -26,7 +26,7 @@ ### Pre-commit Checks


 ```bash
-# Install prek using cargo-binstall
+# Install prek using cargo-binstall https://github.com/cargo-bins/cargo-binstall
 cargo binstall prek

 # Install git hooks to run checks automatically
@@ -155,7 +155,7 @@ ### Creating pull requests

 Before submitting a pull request, please ensure:
 1. Your code passes all CI checks (formatting, linting, typo detection, etc.)
-2. Your code follows the [code style guide](/development/code_style.md)
+2. Your code follows the [code style guide](docs/development/code_style.mdx)
 3. Your commit messages follow the conventional commits format
 4. Tests are added for new functionality
 5. Documentation is updated if needed
@@ -0,0 +1 @@
+Fixed requests returning `500 Internal Server Error` when the header selected by `request_ip_source` is absent, duplicated, or malformed (for example Envoy omitting `X-Envoy-External-Address` on internal requests). The client IP now falls back to the connection peer address instead of failing the request. Contributed by @eleboucher
@@ -0,0 +1 @@
+Appservices are now properly able to create devices for E2EE.
@@ -0,0 +1 @@
+Resolve alias service by correct name for auto-join. Contributed by @eleboucher
@@ -0,0 +1 @@
+Fixed newly created rooms failing to sync properly in clients using legacy sync.
@@ -0,0 +1 @@
+Fixed newly joined rooms failing to sync their full state (including the room name) to clients using legacy sync.
@@ -0,0 +1 @@
+Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
@@ -0,0 +1 @@
+Fixed the deeplink redirect for deleting devices. Contributed by @koen
@@ -0,0 +1 @@
+Fix status code for oauth registration. Contributed by @n00byking
@@ -0,0 +1 @@
+Exempt m.room.create from auth_events check. Contributed by @eleboucher
@@ -0,0 +1 @@
+Fixed `create` being returned as a supported prompt value regardless of if registration is enabled or not. Contributed by @ginger
@@ -0,0 +1 @@
+Updated an out-of-date statement about Oracle Linux release cadences.
@@ -0,0 +1 @@
+Fixed high CPU usage when multiple clients from the same account were connected at once. Each sync woke the account's other sync loops, causing them to wake each other in a loop.
@@ -0,0 +1 @@
+Fix joining restricted rooms over federation failing with signature verification error.
@@ -15,8 +15,8 @@ ## Overview

 :::warning Oracle Linux support
 Due to upstream limitations, Terra is only usable on Oracle Linux if you use [upstream EPEL](https://docs.fedoraproject.org/en-US/epel/getting-started/)
-rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, as of the time of writing, 10.2 has been
-available for over a month through other ELs, but Oracle has not yet released corresponding updates—so you may encounter further compatibility issues with EPEL.
+rather than Oracle's rebuilds of EPEL. Oracle tends to lag behind on new EL versions, both major and minor—for example, Oracle's release of 10.2 lagged
+approximately 1.5 months behind other ELs—so you may encounter further compatibility issues with EPEL.
 **For this reason, it is recommended that you use another EL distribution if at all possible.**
 :::

@@ -6,10 +6,10 @@
            "message": "Welcome to Continuwuity! Important announcements about the project will appear here."
        },
        {
-            "id": 15,
+            "id": 16,
            "mention_room": true,
-            "date": "2026-07-10",
-            "message": "[Continuwuity 26.6.1](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release contains a bunch of bugfixes for bugs found initially after 26.6.0's release - please read the changelog before updating!"
+            "date": "2026-07-13",
+            "message": "[Continuwuity 26.6.2](https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.6.1) has just been released! This release fixes a severe bug with OIDC that could cause users' accounts to be flagged as deactivated. If you use OIDC, please update as soon as possible."
        }
    ]
 }
@@ -3,11 +3,11 @@
    "advisory-db": {
      "flake": false,
      "locked": {
-        "lastModified": 1781566179,
-        "narHash": "sha256-Tqv8I586fYzWpEW/Smq/JqESFa3DVVzVWsnAMtvhy/I=",
+        "lastModified": 1783840254,
+        "narHash": "sha256-XjyvZk0f3YiinVHmkGOotmLBAzvK+LwEJYj2QqJ5pn8=",
        "owner": "rustsec",
        "repo": "advisory-db",
-        "rev": "74e084413d979d52d2f93b1d93b1ab7b9ee648f5",
+        "rev": "6e3286f4efa8c142fb33e5ea4342c8db6693cf34",
        "type": "github"
      },
      "original": {
@@ -18,11 +18,11 @@
    },
    "crane": {
      "locked": {
-        "lastModified": 1780532242,
-        "narHash": "sha256-D+BsdpxmtUwtqGoY0IXPhHgTlmqgcZKCEo1oMyn7ep0=",
+        "lastModified": 1783203018,
+        "narHash": "sha256-G6R9IT/xwFuu+CYBWDUAok6AdC4ERC4ZfPPFtEpxnZE=",
        "owner": "ipetkov",
        "repo": "crane",
-        "rev": "59a82a1222dd3b2080b5cc52a1a2e8d5f1b77f37",
+        "rev": "80db5bdc391be8a1794f6d8a2d56e3a84ebcede2",
        "type": "github"
      },
      "original": {
@@ -39,11 +39,11 @@
        "rust-analyzer-src": "rust-analyzer-src"
      },
      "locked": {
-        "lastModified": 1781527054,
-        "narHash": "sha256-1fX9ev2Fh5QoKQ41G9dYutjo5j/jywu6tZse5Eb1Ck4=",
+        "lastModified": 1783844668,
+        "narHash": "sha256-3MOpw4y3reoErRLvFBDz0t9aG6FWXUj7leKvUns5eQA=",
        "owner": "nix-community",
        "repo": "fenix",
-        "rev": "8c2e51dffefc040a21975da7abf6f252c8c9b783",
+        "rev": "4e49ef62eedaa5c149d62b63b3f53844e1cc45d7",
        "type": "github"
      },
      "original": {
@@ -74,11 +74,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
        "type": "github"
      },
      "original": {
@@ -89,11 +89,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1781074563,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "lastModified": 1783776592,
+        "narHash": "sha256-UgCQzxeWI75XM8G+hPrPh+MKzEPjG3SpAj7dtqSbksA=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "rev": "e7a3ca8092b61ff85b6a45bf863ea2b2d6a661b3",
        "type": "github"
      },
      "original": {
@@ -105,11 +105,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1777168982,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
        "type": "github"
      },
      "original": {
@@ -132,11 +132,11 @@
    "rust-analyzer-src": {
      "flake": false,
      "locked": {
-        "lastModified": 1781453968,
-        "narHash": "sha256-+V3nK4pCngbmgyVGXY6Kkrlevp4ocPkJJLf2aqwkDNA=",
+        "lastModified": 1783779020,
+        "narHash": "sha256-vpm418WZa9l1KUl6HRs+Ga+SIfE+D2/sV4olwTlilYc=",
        "owner": "rust-lang",
        "repo": "rust-analyzer",
-        "rev": "cc272809a173c2c11d0e479d639c811c1eacf049",
+        "rev": "5be5e89cf0145d73a85c805726821b4adfc3af48",
        "type": "github"
      },
      "original": {
@@ -12,7 +12,7 @@
        target:
        target.fromToolchainName {
          name = (lib.importTOML "${inputs.self}/rust-toolchain.toml").toolchain.channel;
-          sha256 = "sha256-OATSZm98Es5kIFuqaba+UvkQtFsVgJEBMmS+t6od5/U=";
+          sha256 = "sha256-A1abGIbOtcBSdrUMhDGrER3pRM1hQP4fp9gh3Y4PKc8=";
        };
    in
    {
@@ -510,14 +510,14 @@
      }
    },
    "node_modules/@shikijs/core": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.2.0.tgz",
-      "integrity": "sha512-Hc87Ab1Ld/vEbZRCbwx344I5v+4RU8CVToUTRkqXL1+TjbuOp9U5Xa0M23V4GEWHxVn+yO5otb+HkQVm3ptWQQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/core/-/core-4.3.1.tgz",
+      "integrity": "sha512-ANMDxuaPsNMdDC1m4vfvhlDmJweMwkE5XitTwrq2rWHx5jM+dlm4MmHt2PP6t0uejfR77SuhrhJ0zEijIF/uhA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/primitive": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/primitive": "4.3.1",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4",
        "hast-util-to-html": "^9.0.5"
@@ -527,13 +527,13 @@
      }
    },
    "node_modules/@shikijs/engine-javascript": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.2.0.tgz",
-      "integrity": "sha512-fjETeq1k5ffyXqRgS6+3hpvqseLalp1kjNfRbXpUgWR8FpZ1CmQfiNHovc5lncYjt/Vg5JK/WJEmLahjwMa0og==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-javascript/-/engine-javascript-4.3.1.tgz",
+      "integrity": "sha512-JBItcnPuYq7jVJdZo/vMj94r+szT7XEjHFX+mvFDGSEIbVAXAGyHAHzhbWzpGOwYidCZrErJLLgn2PVeiokHnQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "oniguruma-to-es": "^4.3.6"
      },
@@ -542,13 +542,13 @@
      }
    },
    "node_modules/@shikijs/engine-oniguruma": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.2.0.tgz",
-      "integrity": "sha512-hTorK1dffPkpbMUk6Z+828PgRo7d07HbnizoP0hNPFjhxMHctj0Px/qoHeGMYafc6ju+u9iMldN4JbVzNQM++g==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/engine-oniguruma/-/engine-oniguruma-4.3.1.tgz",
+      "integrity": "sha512-OXyNMzg0pews+msMj4cHeqT4xiYKKvbnn6VbdAXxfoFl3SSx4fJTc8FadECuc5/H9p3BzhNAoAUXKwAu9rWYhg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2"
      },
      "engines": {
@@ -556,26 +556,26 @@
      }
    },
    "node_modules/@shikijs/langs": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.2.0.tgz",
-      "integrity": "sha512-bwrVRlJ0wUhZxAbVdvBbv2TTC9yLsh4C/IO5Ofz0T8MQntgDvyVnkbjw9vi50r1kx7RCIJdnJnjZAwmAsXFLZQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/langs/-/langs-4.3.1.tgz",
+      "integrity": "sha512-m0l9nsDqgBHvbZbk7A0/kXz/impK3uB/c6rAn6Gpg/uPtdZRQ+alsN/17MU5thb68XTj/4DxkZAotrM0GGSpDQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/primitive": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.2.0.tgz",
-      "integrity": "sha512-NOq+DtUkVBJtZMVXL5A0vI0Xk8nvDYaXetFHSJFlOqjDZIVhIPRYFdGkSoElDqNuegikcc3A76SNUa8dTqtAYA==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/primitive/-/primitive-4.3.1.tgz",
+      "integrity": "sha512-CXQRQOYy1leqQ8ceTeJdmXv/bsUY++6QyLpXJ94LZAAYj5X2SKRdc5ipguv4NPyGVKItB2PPwUpRNe0Sjh5S1A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -584,16 +584,16 @@
      }
    },
    "node_modules/@shikijs/rehype": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.2.0.tgz",
-      "integrity": "sha512-ST3EWye/dwF1gWskczJNBnwFtDzEQ9ceytXZtyc/GfwR5V0qJrkoSGZO55O3SAKDDsXkTDcsfwd9pVe7ROlAHg==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/rehype/-/rehype-4.3.1.tgz",
+      "integrity": "sha512-oshrlfUF3VPUJfnp5K1lLwsS/SRBKrIxONpdWebSKZXdBE3UsZnxgqpvRUA8UsofS7vmjFOCAHIT71ECbmOxTw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0",
+        "@shikijs/types": "4.3.1",
        "@types/hast": "^3.0.4",
        "hast-util-to-string": "^3.0.1",
-        "shiki": "4.2.0",
+        "shiki": "4.3.1",
        "unified": "^11.0.5",
        "unist-util-visit": "^5.1.0"
      },
@@ -602,22 +602,22 @@
      }
    },
    "node_modules/@shikijs/themes": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.2.0.tgz",
-      "integrity": "sha512-RX8IHYeLv8Cu2W6ruc3RxUqWn0IYCqSrMBzi/uRGAmfyDNOnNO5BF/Px7o97n4XTpmFTo5GbRaazuOWj+2ak2w==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/themes/-/themes-4.3.1.tgz",
+      "integrity": "sha512-dgpoJ4WqNi2yTmizQHBJ5zcX6j2lE6icN/0yt4l1kkf16jrY/pwPLoTb1ETsWMz0OBLf9ZNvwmxft+cH+N9qSA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/types": "4.2.0"
+        "@shikijs/types": "4.3.1"
      },
      "engines": {
        "node": ">=20"
      }
    },
    "node_modules/@shikijs/types": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.2.0.tgz",
-      "integrity": "sha512-VT/MKtlpOhEPZloSH3Pb9WCZEBDoQVMa9jedp5UAwmJOar1DVc9DRODAxmYPW9M93IK4ryuqRejFfmlvlVDemw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@shikijs/types/-/types-4.3.1.tgz",
+      "integrity": "sha512-CHFxE0jztBIZRHH6gxXE7DXUCFXjReEGxZ/j0rfSLGKZuwp2xBYycEP14875DSa9KLL/6700oxIq6oO6ef9K2g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -684,9 +684,9 @@
      }
    },
    "node_modules/@types/hast": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.4.tgz",
-      "integrity": "sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==",
+      "version": "3.0.5",
+      "resolved": "https://registry.npmjs.org/@types/hast/-/hast-3.0.5.tgz",
+      "integrity": "sha512-rp/ezSWaD1m44dPKICGhiskI13nVr7qTloFwDa/IYkhhf5nzwP+zIQcIJh3WIFSBOy/H1PzB40jPjMDksN4F+g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -1076,9 +1076,9 @@
      }
    },
    "node_modules/@ungap/structured-clone": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
+      "integrity": "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==",
      "dev": true,
      "license": "ISC"
    },
@@ -3589,18 +3589,18 @@
      "license": "MIT"
    },
    "node_modules/shiki": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.2.0.tgz",
-      "integrity": "sha512-hjNax6o/ylDy9lefQEaSDtzaT3iVNtZ3WmpQnbuQNoG4xvnSKf2kSKbihZVO4JRG1TTMejs7CmNRYlWgAL66pQ==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/shiki/-/shiki-4.3.1.tgz",
+      "integrity": "sha512-oR+qDVi2OjX1tmDpyv+3KviX01KzO6Af+0NNnKnsp9491UEGz2YpxTuJboS/6VhYpTdqzmuJBuiTlrAWWJAssw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@shikijs/core": "4.2.0",
-        "@shikijs/engine-javascript": "4.2.0",
-        "@shikijs/engine-oniguruma": "4.2.0",
-        "@shikijs/langs": "4.2.0",
-        "@shikijs/themes": "4.2.0",
-        "@shikijs/types": "4.2.0",
+        "@shikijs/core": "4.3.1",
+        "@shikijs/engine-javascript": "4.3.1",
+        "@shikijs/engine-oniguruma": "4.3.1",
+        "@shikijs/langs": "4.3.1",
+        "@shikijs/themes": "4.3.1",
+        "@shikijs/types": "4.3.1",
        "@shikijs/vscode-textmate": "^10.0.2",
        "@types/hast": "^3.0.4"
      },
@@ -60,6 +60,13 @@
            "matchPackageNames": ["rust", "rustc", "cargo"],
            "groupName": "rust-toolchain"
        },
+        {
+            "description": "Delay major rust toolchain updates",
+            "matchManagers": ["custom.regex"],
+            "matchPackageNames": ["rust", "rustc", "cargo"],
+            "matchUpdateTypes": ["major"],
+            "minimumReleaseAge": "30 days"
+        },
        {
            "description": "Batch minor and patch GitHub Actions updates",
            "matchManagers": ["github-actions"],
@@ -10,7 +10,7 @@

 [toolchain]
 profile = "minimal"
-channel = "1.97.0"
+channel = "1.97.1"
 components = [
    # For rust-analyzer
    "rust-src",
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err, info,
 	pdu::PartialPdu,
@@ -26,8 +25,8 @@
 };
 use service::{mailer::messages, uiaa::UiaaInitiator, users::HashedPassword};

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
-use crate::{Ruma, router::ClientIdentity};
+use super::DEVICE_ID_LENGTH;
+use crate::{Ruma, client_ip::ClientIp, router::ClientIdentity};

 pub(crate) mod register;
 pub(crate) mod threepid;
@@ -43,10 +42,9 @@
 ///
 /// Note: This will not reserve the username, so the username might become
 /// invalid when trying to register
-#[tracing::instrument(skip_all, fields(%client), name = "register_available", level = "info")]
+#[tracing::instrument(skip_all, name = "register_available", level = "info")]
 pub(crate) async fn get_register_available_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_username_availability::v3::Request>,
 ) -> Result<get_username_availability::v3::Response> {
 	let _ = services
@@ -80,10 +78,9 @@ pub(crate) async fn get_register_available_route(
 ///   last seen ts)
 /// - Forgets to-device events
 /// - Triggers device list updates
-#[tracing::instrument(skip_all, fields(%client), name = "change_password", level = "info")]
+#[tracing::instrument(skip_all, name = "change_password", level = "info")]
 pub(crate) async fn change_password_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<change_password::v3::Request>,
 ) -> Result<change_password::v3::Response> {
 	let identity = if let Some(identity) = body.identity.as_ref() {
@@ -248,10 +245,9 @@ pub(crate) async fn whoami_route(
 /// - Forgets all to-device events
 /// - Triggers device list updates
 /// - Removes ability to log in again
-#[tracing::instrument(skip_all, fields(%client), name = "deactivate", level = "info")]
+#[tracing::instrument(skip_all, name = "deactivate", level = "info")]
 pub(crate) async fn deactivate_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<deactivate::v3::Request>,
 ) -> Result<deactivate::v3::Response> {
 	// Authentication for this endpoint is technically optional,
@@ -1,7 +1,6 @@
 use std::collections::HashMap;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug_info, info,
 	utils::{self},
@@ -20,10 +19,13 @@
 	assign,
 };
 use serde_json::value::RawValue;
-use service::{mailer::messages, users::HashedPassword};
+use service::{
+	mailer::messages,
+	users::{DeviceToken, HashedPassword},
+};

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
-use crate::Ruma;
+use super::DEVICE_ID_LENGTH;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/client/v3/register`
 ///
@@ -33,10 +35,10 @@
 /// /_matrix/client/v3/register/available`](fn.get_register_available_route.
 /// html) to check if the user id is valid and available.
 #[allow(clippy::doc_markdown)]
-#[tracing::instrument(skip_all, fields(%client), name = "register", level = "info")]
+#[tracing::instrument(skip_all, name = "register", level = "info")]
 pub(crate) async fn register_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for metadata.
 	body: Ruma<register::v3::Request>,
 ) -> Result<register::v3::Response> {
 	if body.kind != RegistrationKind::User {
@@ -119,7 +121,7 @@ pub(crate) async fn register_route(
 			.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());

 		// Generate new token for the device
-		let new_token = utils::random_string(TOKEN_LENGTH);
+		let new_token = DeviceToken::new_random();

 		// Create device for this account
 		services
@@ -127,8 +129,7 @@ pub(crate) async fn register_route(
 			.create_device(
 				&user_id,
 				&device_id,
-				&new_token,
-				None,
+				Some(new_token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -142,7 +143,7 @@ pub(crate) async fn register_route(
 	debug_info!(%user_id, ?device, "New account created via legacy registration");

 	Ok(assign!(register::v3::Response::new(user_id), {
-		access_token: token,
+		access_token: token.map(DeviceToken::into_token),
 		device_id: device,
 		refresh_token: None,
 		expires_in: None,
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, at};
 use futures::StreamExt;
 use ruma::{
@@ -12,17 +11,16 @@
 	assign,
 };

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 const MAX_BATCH_EVENTS: usize = 50;

 /// # `PUT /_matrix/client/../dehydrated_device`
 ///
 /// Creates or overwrites the user's dehydrated device.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn put_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<put_dehydrated_device::Request>,
 ) -> Result<put_dehydrated_device::Response> {
 	let device_id = body.device_id.clone();
@@ -38,10 +36,9 @@ pub(crate) async fn put_dehydrated_device_route(
 /// # `DELETE /_matrix/client/../dehydrated_device`
 ///
 /// Deletes the user's dehydrated device without replacement.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn delete_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<delete_dehydrated_device::Request>,
 ) -> Result<delete_dehydrated_device::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -56,10 +53,9 @@ pub(crate) async fn delete_dehydrated_device_route(
 /// # `GET /_matrix/client/../dehydrated_device`
 ///
 /// Gets the user's dehydrated device
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn get_dehydrated_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_dehydrated_device::Request>,
 ) -> Result<get_dehydrated_device::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -72,10 +68,9 @@ pub(crate) async fn get_dehydrated_device_route(
 /// # `GET /_matrix/client/../dehydrated_device/{device_id}/events`
 ///
 /// Paginates the events of the dehydrated device.
-#[tracing::instrument(skip_all, fields(%client))]
+#[tracing::instrument(skip_all)]
 pub(crate) async fn get_dehydrated_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_events::Request>,
 ) -> Result<get_events::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, debug, err, utils};
 use futures::StreamExt;
 use ruma::{
@@ -9,7 +8,7 @@
 	},
 };

-use crate::{Ruma, client::DEVICE_ID_LENGTH};
+use crate::{Ruma, client::DEVICE_ID_LENGTH, client_ip::ClientIp};

 /// # `GET /_matrix/client/r0/devices`
 ///
@@ -46,10 +45,10 @@ pub(crate) async fn get_device_route(
 /// # `PUT /_matrix/client/r0/devices/{deviceId}`
 ///
 /// Updates the metadata on a given device of the sender user.
-#[tracing::instrument(skip_all, fields(%client), name = "update_device", level = "debug")]
+#[tracing::instrument(skip_all, name = "update_device", level = "debug")]
 pub(crate) async fn update_device_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<update_device::v3::Request>,
 ) -> Result<update_device::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -89,14 +88,7 @@ pub(crate) async fn update_device_route(

 			services
 				.users
-				.create_device(
-					sender_user,
-					&device_id,
-					&appservice.registration.as_token,
-					None,
-					None,
-					Some(client.to_string()),
-				)
+				.create_device(sender_user, &device_id, None, None, Some(client.to_string()))
 				.await?;

 			return Ok(update_device::v3::Response::new());
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err, info,
 	utils::{
@@ -28,17 +27,16 @@
 };
 use tokio::join;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/client/v3/publicRooms`
 ///
 /// Lists the public rooms on this server.
 ///
 /// - Rooms are ordered by the number of joined members
-#[tracing::instrument(skip_all, fields(%client), name = "publicrooms", level = "info")]
+#[tracing::instrument(skip_all, name = "publicrooms", level = "info")]
 pub(crate) async fn get_public_rooms_filtered_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_public_rooms_filtered::v3::Request>,
 ) -> Result<get_public_rooms_filtered::v3::Response> {
 	if let Some(server) = &body.server {
@@ -71,10 +69,9 @@ pub(crate) async fn get_public_rooms_filtered_route(
 /// Lists the public rooms on this server.
 ///
 /// - Rooms are ordered by the number of joined members
-#[tracing::instrument(skip_all, fields(%client), name = "publicrooms", level = "info")]
+#[tracing::instrument(skip_all, name = "publicrooms", level = "info")]
 pub(crate) async fn get_public_rooms_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_public_rooms::v3::Request>,
 ) -> Result<get_public_rooms::v3::Response> {
 	if let Some(server) = &body.server {
@@ -106,10 +103,9 @@ pub(crate) async fn get_public_rooms_route(
 /// # `PUT /_matrix/client/r0/directory/list/room/{roomId}`
 ///
 /// Sets the visibility of a given room in the room directory.
-#[tracing::instrument(skip_all, fields(%client), name = "room_directory", level = "info")]
+#[tracing::instrument(skip_all, name = "room_directory", level = "info")]
 pub(crate) async fn set_room_visibility_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<set_room_visibility::v3::Request>,
 ) -> Result<set_room_visibility::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,7 +1,6 @@
 use std::time::Duration;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err,
 	utils::{self, content_disposition::make_content_disposition, math::ruma_from_usize},
@@ -24,7 +23,7 @@
 };
 use service::media::mxc::Mxc;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `GET /_matrix/client/v1/media/config`
 pub(crate) async fn get_media_config_route(
@@ -42,15 +41,8 @@ pub(crate) async fn get_media_config_route(
 ///
 /// - Some metadata will be saved in the database
 /// - Media will be saved in the media/ directory
-#[tracing::instrument(
-	name = "media_upload",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn create_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<create_content::v3::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -81,15 +73,8 @@ pub(crate) async fn create_content_route(
 /// # `GET /_matrix/client/v1/media/thumbnail/{serverName}/{mediaId}`
 ///
 /// Load media thumbnail from our server or over federation.
-#[tracing::instrument(
-	name = "media_thumbnail_get",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_thumbnail_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v1::Request>,
 ) -> Result<get_content_thumbnail::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -131,15 +116,8 @@ pub(crate) async fn get_content_thumbnail_route(
 /// # `GET /_matrix/client/v1/media/download/{serverName}/{mediaId}`
 ///
 /// Load media from our server or over federation.
-#[tracing::instrument(
-	name = "media_get",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v1::Request>,
 ) -> Result<get_content::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -178,15 +156,8 @@ pub(crate) async fn get_content_route(
 /// # `GET /_matrix/client/v1/media/download/{serverName}/{mediaId}/{fileName}`
 ///
 /// Load media from our server or over federation as fileName.
-#[tracing::instrument(
-	name = "media_get_af",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_content_as_filename_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v1::Request>,
 ) -> Result<get_content_as_filename::v1::Response> {
 	let user = body.identity.expect_sender_user()?;
@@ -229,15 +200,8 @@ pub(crate) async fn get_content_as_filename_route(
 /// # `GET /_matrix/client/v1/media/preview_url`
 ///
 /// Returns URL preview.
-#[tracing::instrument(
-	name = "url_preview",
-	level = "debug",
-	skip_all,
-	fields(%client),
-)]
 pub(crate) async fn get_media_preview_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v1::Request>,
 ) -> Result<get_media_preview::v1::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,7 +1,6 @@
 #![allow(deprecated)]

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err,
 	utils::{content_disposition::make_content_disposition, math::ruma_from_usize},
@@ -17,7 +16,7 @@
 };
 use service::media::mxc::Mxc;

-use crate::{Ruma, RumaResponse, client::create_content_route};
+use crate::{Ruma, RumaResponse, client::create_content_route, client_ip::ClientIp};

 /// # `GET /_matrix/media/v3/config`
 ///
@@ -50,10 +49,8 @@ pub(crate) async fn get_media_config_legacy_legacy_route(
 /// # `GET /_matrix/media/v3/preview_url`
 ///
 /// Returns URL preview.
-#[tracing::instrument(skip_all, fields(%client), name = "url_preview_legacy", level = "debug")]
 pub(crate) async fn get_media_preview_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<get_media_preview::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -95,10 +92,9 @@ pub(crate) async fn get_media_preview_legacy_route(
 /// Returns URL preview.
 pub(crate) async fn get_media_preview_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_media_preview::v3::Request>,
 ) -> Result<RumaResponse<get_media_preview::v3::Response>> {
-	get_media_preview_legacy_route(State(services), ClientIp(client), body)
+	get_media_preview_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -115,10 +111,9 @@ pub(crate) async fn get_media_preview_legacy_legacy_route(
 /// - Media will be saved in the media/ directory
 pub(crate) async fn create_content_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<create_content::v3::Request>,
 ) -> Result<RumaResponse<create_content::v3::Response>> {
-	create_content_route(State(services), ClientIp(client), body)
+	create_content_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -131,10 +126,8 @@ pub(crate) async fn create_content_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v3::Request>,
 ) -> Result<get_content::v3::Response> {
 	let mxc = Mxc {
@@ -209,13 +202,11 @@ pub(crate) async fn get_content_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v3::Request>,
 ) -> Result<RumaResponse<get_content::v3::Response>> {
-	get_content_legacy_route(State(services), ClientIp(client), body)
+	get_content_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -228,10 +219,8 @@ pub(crate) async fn get_content_legacy_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_get_legacy", level = "debug")]
 pub(crate) async fn get_content_as_filename_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v3::Request>,
 ) -> Result<get_content_as_filename::v3::Response> {
 	let mxc = Mxc {
@@ -307,10 +296,9 @@ pub(crate) async fn get_content_as_filename_legacy_route(
 ///   seconds
 pub(crate) async fn get_content_as_filename_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_as_filename::v3::Request>,
 ) -> Result<RumaResponse<get_content_as_filename::v3::Response>> {
-	get_content_as_filename_legacy_route(State(services), ClientIp(client), body)
+	get_content_as_filename_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -323,10 +311,8 @@ pub(crate) async fn get_content_as_filename_legacy_legacy_route(
 /// - Only redirects if `allow_redirect` is true
 /// - Uses client-provided `timeout_ms` if available, else defaults to 20
 ///   seconds
-#[tracing::instrument(skip_all, fields(%client), name = "media_thumbnail_get_legacy", level = "debug")]
 pub(crate) async fn get_content_thumbnail_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v3::Request>,
 ) -> Result<get_content_thumbnail::v3::Response> {
 	let mxc = Mxc {
@@ -404,10 +390,9 @@ pub(crate) async fn get_content_thumbnail_legacy_route(
 ///   seconds
 pub(crate) async fn get_content_thumbnail_legacy_legacy_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v3::Request>,
 ) -> Result<RumaResponse<get_content_thumbnail::v3::Response>> {
-	get_content_thumbnail_legacy_route(State(services), ClientIp(client), body)
+	get_content_thumbnail_legacy_route(State(services), body)
 		.await
 		.map(RumaResponse)
 }
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug_error, err, info,
 	matrix::{event::gen_event_id_canonical_json, pdu::PartialPdu},
@@ -18,15 +17,14 @@
 use service::Services;

 use super::banned_room_check;
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/client/r0/rooms/{roomId}/invite`
 ///
 /// Tries to send an invite event into the room.
-#[tracing::instrument(skip_all, fields(%client), name = "invite", level = "info")]
+#[tracing::instrument(skip_all, name = "invite", level = "info")]
 pub(crate) async fn invite_user_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<invite_user::v3::Request>,
 ) -> Result<invite_user::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -42,14 +40,8 @@ pub(crate) async fn invite_user_route(
 		return Err!(Request(Forbidden("Invites are not allowed on this server.")));
 	}

-	banned_room_check(
-		&services,
-		sender_user,
-		Some(&body.room_id),
-		body.room_id.server_name(),
-		client,
-	)
-	.await?;
+	banned_room_check(&services, sender_user, Some(&body.room_id), body.room_id.server_name())
+		.await?;

 	match &body.recipient {
 		| invite_user::v3::InvitationRecipient::UserId(InviteUserId {
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug,
 	result::FlatOk,
@@ -12,7 +11,7 @@
 };

 use super::banned_room_check;
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/client/r0/rooms/{roomId}/join`
 ///
@@ -22,10 +21,9 @@
 ///   rules locally
 /// - If the server does not know about the room: asks other servers over
 ///   federation
-#[tracing::instrument(skip_all, fields(%client), name = "join", level = "info")]
+#[tracing::instrument(skip_all, name = "join", level = "info")]
 pub(crate) async fn join_room_by_id_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<join_room_by_id::v3::Request>,
 ) -> Result<join_room_by_id::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -33,14 +31,8 @@ pub(crate) async fn join_room_by_id_route(
 		return Err!(Request(UserSuspended("You cannot perform this action while suspended.")));
 	}

-	banned_room_check(
-		&services,
-		sender_user,
-		Some(&body.room_id),
-		body.room_id.server_name(),
-		client,
-	)
-	.await?;
+	banned_room_check(&services, sender_user, Some(&body.room_id), body.room_id.server_name())
+		.await?;

 	// There is no body.server_name for /roomId/join
 	let mut servers: Vec<_> = services
@@ -91,10 +83,9 @@ pub(crate) async fn join_room_by_id_route(
 /// - If the server does not know about the room: use the server name query
 ///   param if specified. if not specified, asks other servers over federation
 ///   via room alias server name and room ID server name
-#[tracing::instrument(skip_all, fields(%client), name = "join", level = "info")]
+#[tracing::instrument(skip_all, name = "join", level = "info")]
 pub(crate) async fn join_room_by_id_or_alias_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<join_room_by_id_or_alias::v3::Request>,
 ) -> Result<join_room_by_id_or_alias::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -105,15 +96,9 @@ pub(crate) async fn join_room_by_id_or_alias_route(

 	let (servers, room_id) = match OwnedRoomId::try_from(body.room_id_or_alias.clone()) {
 		| Ok(room_id) => {
-			banned_room_check(
-				&services,
-				sender_user,
-				Some(&room_id),
-				room_id.server_name(),
-				client,
-			)
-			.boxed()
-			.await?;
+			banned_room_check(&services, sender_user, Some(&room_id), room_id.server_name())
+				.boxed()
+				.await?;

 			let mut servers = body.via.clone();
 			if servers.is_empty() {
@@ -159,7 +144,6 @@ pub(crate) async fn join_room_by_id_or_alias_route(
 				sender_user,
 				Some(&room_id),
 				Some(room_alias.server_name()),
-				client,
 			)
 			.await?;

@@ -1,7 +1,6 @@
 use std::{borrow::Borrow, collections::HashMap, iter::once, sync::Arc};

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug, debug_info, debug_warn, err, info,
 	matrix::{
@@ -40,15 +39,14 @@
 };

 use super::banned_room_check;
-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/client/*/knock/{roomIdOrAlias}`
 ///
 /// Tries to knock the room to ask permission to join for the sender user.
-#[tracing::instrument(skip_all, fields(%client), name = "knock", level = "info")]
+#[tracing::instrument(skip_all, name = "knock", level = "info")]
 pub(crate) async fn knock_room_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<knock_room::v3::Request>,
 ) -> Result<knock_room::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -59,14 +57,8 @@ pub(crate) async fn knock_room_route(

 	let (servers, room_id) = match OwnedRoomId::try_from(body.room_id_or_alias.clone()) {
 		| Ok(room_id) => {
-			banned_room_check(
-				&services,
-				sender_user,
-				Some(&room_id),
-				room_id.server_name(),
-				client,
-			)
-			.await?;
+			banned_room_check(&services, sender_user, Some(&room_id), room_id.server_name())
+				.await?;

 			let mut servers = body.via.clone();
 			servers.extend(
@@ -109,7 +101,6 @@ pub(crate) async fn knock_room_route(
 				sender_user,
 				Some(&room_id),
 				Some(room_alias.server_name()),
-				client,
 			)
 			.await?;

@@ -8,8 +8,6 @@
 mod members;
 mod unban;

-use std::net::IpAddr;
-
 use axum::extract::State;
 use conduwuit::{Err, Result, warn};
 use futures::{FutureExt, StreamExt};
@@ -58,7 +56,6 @@ pub(crate) async fn banned_room_check(
 	user_id: &UserId,
 	room_id: Option<&RoomId>,
 	server_name: Option<&ServerName>,
-	client_ip: IpAddr,
 ) -> Result {
 	if services.users.is_admin(user_id).await {
 		return Ok(());
@@ -85,7 +82,7 @@ pub(crate) async fn banned_room_check(
 						.admin
 						.send_text(&format!(
 							"Automatically deactivating user {user_id} due to attempted banned \
-							 room join from IP {client_ip}"
+							 room join"
 						))
 						.await;
 				}
@@ -121,7 +118,7 @@ pub(crate) async fn banned_room_check(
 						.admin
 						.send_text(&format!(
 							"Automatically deactivating user {user_id} due to attempted banned \
-							 room join from IP {client_ip}"
+							 room join"
 						))
 						.await;
 				}
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Error, Result, at, debug_warn,
 	matrix::{
@@ -38,7 +37,7 @@
 };
 use ruminuwuity::invite_permission_config::FilterLevel;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// list of safe and common non-state events to ignore if the user is ignored
 const IGNORED_MESSAGE_TYPES: &[TimelineEventType] = &[
@@ -72,7 +71,7 @@
 ///   where the user was joined, depending on `history_visibility`)
 pub(crate) async fn get_message_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<get_message_events::v3::Request>,
 ) -> Result<get_message_events::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -24,5 +24,5 @@ pub(crate) async fn register_client_route(
 		.await
 		.map_err(|err| (StatusCode::BAD_REQUEST, Json(err)).into_response())?;

-	Ok(Json(RegisteredClient { client_id, metadata }).into_response())
+	Ok((StatusCode::CREATED, Json(RegisteredClient { client_id, metadata })).into_response())
 }
@@ -37,6 +37,17 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		.join(super::BASE_PATH)
 		.unwrap();

+	let prompt_values_supported = if services
+		.uiaa
+		.registration_flow_status()
+		.await
+		.any_available()
+	{
+		json!(["create"])
+	} else {
+		json!([])
+	};
+
 	json!({
 		"account_management_uri": endpoint_base.join(ACCOUNT_MANAGEMENT_PATH).unwrap(),
 		"account_management_actions_supported": [
@@ -52,7 +63,7 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		"grant_types_supported": ["authorization_code", "refresh_token"],
 		"issuer": services.config.get_client_domain(),
 		"jwks_uri": endpoint_base.join(JWKS_URI_PATH).unwrap(),
-		"prompt_values_supported": ["create"],
+		"prompt_values_supported": prompt_values_supported,
 		"registration_endpoint": endpoint_base.join(CLIENT_REGISTER_PATH).unwrap(),
 		"response_modes_supported": ["query", "fragment"],
 		"response_types_supported": ["code"],
@@ -1,7 +1,6 @@
 use std::collections::BTreeMap;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, PduCount, Result, err};
 use ruma::{
 	MilliSecondsSinceUnixEpoch,
@@ -13,7 +12,7 @@
 	},
 };

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/client/r0/rooms/{roomId}/read_markers`
 ///
@@ -117,7 +116,7 @@ pub(crate) async fn set_read_marker_route(
 /// Sets private read marker and public read receipt EDU.
 pub(crate) async fn create_receipt_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<create_receipt::v3::Request>,
 ) -> Result<create_receipt::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,11 +1,10 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, matrix::pdu::PartialPdu};
 use ruma::{
 	api::client::redact::redact_event, assign, events::room::redaction::RoomRedactionEventContent,
 };

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `PUT /_matrix/client/r0/rooms/{roomId}/redact/{eventId}/{txnId}`
 ///
@@ -14,7 +13,7 @@
 /// - TODO: Handle txn id
 pub(crate) async fn redact_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: required for updating device metadata
 	body: Ruma<redact_event::v3::Request>,
 ) -> Result<redact_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,7 +1,6 @@
 use std::{fmt::Write as _, time::Duration};

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Event, Result, debug_info, info, matrix::pdu::PduEvent, utils::ReadyExt};
 use conduwuit_service::Services;
 use ruma::{
@@ -14,7 +13,7 @@
 };
 use tokio::time::sleep;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 struct Report {
 	sender: OwnedUserId,
@@ -30,10 +29,9 @@ struct Report {
 /// # `POST /_matrix/client/v3/rooms/{roomId}/report`
 ///
 /// Reports an abusive room to homeserver admins
-#[tracing::instrument(skip_all, fields(%client), name = "report_room", level = "info")]
+#[tracing::instrument(skip_all, name = "report_room", level = "info")]
 pub(crate) async fn report_room_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_room::v3::Request>,
 ) -> Result<report_room::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -85,10 +83,9 @@ pub(crate) async fn report_room_route(
 /// # `POST /_matrix/client/v3/rooms/{roomId}/report/{eventId}`
 ///
 /// Reports an inappropriate event to homeserver admins
-#[tracing::instrument(skip_all, fields(%client), name = "report_event", level = "info")]
+#[tracing::instrument(skip_all, name = "report_event", level = "info")]
 pub(crate) async fn report_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_content::v3::Request>,
 ) -> Result<report_content::v3::Response> {
 	// user authentication
@@ -129,10 +126,9 @@ pub(crate) async fn report_event_route(
 	Ok(report_content::v3::Response::new())
 }

-#[tracing::instrument(skip_all, fields(%client), name = "report_user", level = "info")]
+#[tracing::instrument(skip_all, name = "report_user", level = "info")]
 pub(crate) async fn report_user_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<report_user::v3::Request>,
 ) -> Result<report_user::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,18 +1,16 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result};
 use ruma::api::client::room::get_summary;
 use service::rooms::summary::Accessibility;

-use crate::{Ruma, router::ClientIdentity};
+use crate::{Ruma, client_ip::ClientIp, router::ClientIdentity};

 /// # `GET /_matrix/client/v1/room_summary/{roomIdOrAlias}`
 ///
 /// Returns a short description of the state of a room.
-#[tracing::instrument(skip_all, fields(%client), name = "room_summary", level = "info")]
+#[tracing::instrument(skip_all, name = "room_summary", level = "info")]
 pub(crate) async fn get_room_summary(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_summary::v1::Request>,
 ) -> Result<get_summary::v1::Response> {
 	let (room_id, servers) = services
@@ -1,12 +1,11 @@
 use std::collections::BTreeMap;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, err, matrix::pdu::PartialPdu, utils};
 use ruma::{api::client::message::send_message_event, events::MessageLikeEventType};
 use serde_json::from_str;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `PUT /_matrix/client/v3/rooms/{roomId}/send/{eventType}/{txnId}`
 ///
@@ -19,7 +18,7 @@
 ///   allowed
 pub(crate) async fn send_message_event_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: required for updating device metadata
 	body: Ruma<send_message_event::v3::Request>,
 ) -> Result<send_message_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,7 +1,6 @@
 use std::time::Duration;

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, debug, err, info,
 	utils::{self, ReadyExt, stream::BroadbandExt},
@@ -29,18 +28,18 @@
 	},
 	assign,
 };
+use service::users::DeviceToken;

-use super::{DEVICE_ID_LENGTH, TOKEN_LENGTH};
-use crate::Ruma;
+use super::DEVICE_ID_LENGTH;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `GET /_matrix/client/v3/login`
 ///
 /// Get the supported login types of this server. One of these should be used as
 /// the `type` field when logging in.
-#[tracing::instrument(skip_all, fields(%client), name = "login", level = "info")]
+#[tracing::instrument(skip_all, name = "login", level = "info")]
 pub(crate) async fn get_login_types_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	_body: Ruma<get_login_types::v3::Request>,
 ) -> Result<get_login_types::v3::Response> {
 	if !services.config.oauth.compatibility_mode().uiaa_available() {
@@ -114,10 +113,10 @@ pub async fn handle_login(
 /// Note: You can use [`GET
 /// /_matrix/client/r0/login`](fn.get_supported_versions_route.html) to see
 /// supported login types.
-#[tracing::instrument(skip_all, fields(%client), name = "login", level = "info")]
+#[tracing::instrument(skip_all, name = "login", level = "info")]
 pub(crate) async fn login_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
+	ClientIp(client): ClientIp, // NOTE: Required for device metadata
 	body: Ruma<login::v3::Request>,
 ) -> Result<login::v3::Response> {
 	if !services.config.oauth.compatibility_mode().uiaa_available() {
@@ -196,8 +195,8 @@ pub(crate) async fn login_route(
 		.clone()
 		.unwrap_or_else(|| utils::random_string(DEVICE_ID_LENGTH).into());

-	// Generate a new token for the device (ensuring no collisions)
-	let token = services.users.generate_unique_token().await;
+	// Generate a new token for the device
+	let token = DeviceToken::new_random();

 	// Determine if device_id was provided and exists in the db for this user
 	let device_exists = if body.device_id.is_some() {
@@ -213,7 +212,7 @@ pub(crate) async fn login_route(
 	if device_exists {
 		services
 			.users
-			.set_token(&user_id, &device_id, &token, None)
+			.set_token(&user_id, &device_id, token.clone())
 			.await?;
 	} else {
 		services
@@ -221,8 +220,7 @@ pub(crate) async fn login_route(
 			.create_device(
 				&user_id,
 				&device_id,
-				&token,
-				None,
+				Some(token.clone()),
 				body.initial_device_display_name.clone(),
 				Some(client.to_string()),
 			)
@@ -241,7 +239,7 @@ pub(crate) async fn login_route(
 	info!("{user_id} logged in");

 	#[allow(deprecated)]
-	Ok(assign!(login::v3::Response::new(user_id, token, device_id), {
+	Ok(assign!(login::v3::Response::new(user_id, token.into_token(), device_id), {
 		well_known: client_discovery_info,
 		expires_in: None,
 		home_server: Some(services.config.server_name.clone()),
@@ -255,10 +253,9 @@ pub(crate) async fn login_route(
 /// to log in with the m.login.token flow.
 ///
 /// <https://spec.matrix.org/v1.13/client-server-api/#post_matrixclientv1loginget_token>
-#[tracing::instrument(skip_all, fields(%client), name = "login_token", level = "info")]
+#[tracing::instrument(skip_all, name = "login_token", level = "info")]
 pub(crate) async fn login_token_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_login_token::v1::Request>,
 ) -> Result<get_login_token::v1::Response> {
 	if !services.config.login_via_existing_session {
@@ -273,7 +270,7 @@ pub(crate) async fn login_token_route(
 		.authenticate_password(&body.auth, sender_user, body.identity.sender_device(), None)
 		.await?;

-	let login_token = utils::random_string(TOKEN_LENGTH);
+	let login_token = DeviceToken::new_random().into_token();
 	let expires_in = services.users.create_login_token(sender_user, &login_token);

 	Ok(get_login_token::v1::Response::new(
@@ -291,10 +288,9 @@ pub(crate) async fn login_token_route(
 ///   last seen ts)
 /// - Forgets to-device events
 /// - Triggers device list updates
-#[tracing::instrument(skip_all, fields(%client), name = "logout", level = "info")]
+#[tracing::instrument(skip_all, name = "logout", level = "info")]
 pub(crate) async fn logout_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<logout::v3::Request>,
 ) -> Result<logout::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -339,10 +335,9 @@ pub(crate) async fn logout_route(
 /// Note: This is equivalent to calling [`GET
 /// /_matrix/client/r0/logout`](fn.logout_route.html) from each device of this
 /// user.
-#[tracing::instrument(skip_all, fields(%client), name = "logout", level = "info")]
+#[tracing::instrument(skip_all, name = "logout", level = "info")]
 pub(crate) async fn logout_all_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<logout_all::v3::Request>,
 ) -> Result<logout_all::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,7 +1,6 @@
 #[cfg(test)]
 mod tests;
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, err,
 	matrix::{Event, pdu::PartialPdu},
@@ -28,14 +27,14 @@
 };
 use serde_json::{json, value::to_raw_value};

-use crate::{Ruma, RumaResponse};
+use crate::{Ruma, RumaResponse, client_ip::ClientIp};

 /// # `PUT /_matrix/client/*/rooms/{roomId}/state/{eventType}/{stateKey}`
 ///
 /// Sends a state event into the room.
 pub(crate) async fn send_state_event_for_key_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<send_state_event::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -72,7 +71,7 @@ pub(crate) async fn send_state_event_for_key_route(
 /// Sends a state event into the room.
 pub(crate) async fn send_state_event_for_empty_key_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<send_state_event::v3::Request>,
 ) -> Result<RumaResponse<send_state_event::v3::Response>> {
 	send_state_event_for_key_route(State(services), ClientIp(ip), body)
@@ -269,13 +269,22 @@ async fn build_state_and_timeline(
 	)
 	.await?;

-	let (state_events, notification_counts, joined_since_last_sync) = try_join3(
-		build_state_events(services, sync_context, room_id, shortstatehashes, &timeline),
+	let (notification_counts, joined_since_last_sync) = try_join(
 		build_notification_counts(services, sync_context, room_id, &timeline),
 		check_joined_since_last_sync(services, shortstatehashes, sync_context),
 	)
 	.await?;

+	let state_events = build_state_events(
+		services,
+		sync_context,
+		room_id,
+		shortstatehashes,
+		&timeline,
+		joined_since_last_sync,
+	)
+	.await?;
+
 	// the timeline should always include at least one PDU if the syncing user
 	// joined since the last sync, that being the syncing user's join event. if
 	// it's empty something is wrong.
@@ -459,6 +468,7 @@ async fn build_state_events(
 	room_id: &RoomId,
 	shortstatehashes: ShortStateHashes,
 	timeline: &TimelinePdus,
+	joined_since_last_sync: bool,
 ) -> Result<Vec<PduEvent>> {
 	let SyncContext {
 		syncing_user,
@@ -488,9 +498,10 @@ async fn build_state_events(
 		/*
 		if `last_sync_end_count` is Some (meaning this is an incremental sync), and `last_sync_end_shortstatehash`
 		is Some (meaning the syncing user didn't just join this room for the first time ever), and `full_state` is false,
-		then use `build_state_incremental`.
+		and the user didn't just join the room since the last sync, then use `build_state_incremental`.
 		*/
-		| (Some(_), Some(last_sync_end_shortstatehash)) if !full_state =>
+		| (Some(_), Some(last_sync_end_shortstatehash))
+			if !full_state && !joined_since_last_sync =>
 			build_state_incremental(
 				services,
 				syncing_user,
@@ -9,7 +9,6 @@
 };

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Result, at, error, extract_variant,
 	utils::{
@@ -48,6 +47,7 @@
 		is_ignored_invite,
 		sync::v3::{joined::load_joined_room, left::load_left_room},
 	},
+	client_ip::ClientIp,
 };

 /// The default maximum number of events to return in the `timeline` key of
@@ -181,7 +181,7 @@ fn lazy_loading_enabled(&self) -> bool {
 )]
 pub(crate) async fn sync_events_route(
 	State(services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<sync_events::v3::Request>,
 ) -> Result<sync_events::v3::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -6,7 +6,6 @@
 };

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Error, Result, at, error, extract_variant, is_equal_to,
 	matrix::{Event, TypeStateKey, pdu::PduCount},
@@ -49,6 +48,7 @@
 	client::{
 		DEFAULT_BUMP_TYPES, TimelinePdus, ignored_filter, is_ignored_invite, sync::load_timeline,
 	},
+	client_ip::ClientIp,
 };

 type SyncInfo<'a> = (&'a UserId, &'a DeviceId, u64, &'a sync_events::v5::Request);
@@ -67,7 +67,7 @@
 /// [MSC4186]: https://github.com/matrix-org/matrix-spec-proposals/pull/4186
 pub(crate) async fn sync_events_v5_route(
 	State(ref services): State<crate::State>,
-	ClientIp(client_ip): ClientIp,
+	ClientIp(client_ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<sync_events::v5::Request>,
 ) -> Result<sync_events::v5::Response> {
 	let sender_user = body.identity.expect_sender_user()?;
@@ -1,16 +1,15 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, utils, utils::math::Tried};
 use ruma::api::client::typing::create_typing_event::{self, v3::TypingInfo};

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `PUT /_matrix/client/r0/rooms/{roomId}/typing/{userId}`
 ///
 /// Sets the typing state of the sender user.
 pub(crate) async fn create_typing_event_route(
 	State(services): State<crate::State>,
-	ClientIp(ip): ClientIp,
+	ClientIp(ip): ClientIp, // NOTE: Required for updating device metadata
 	body: Ruma<create_typing_event::v3::Request>,
 ) -> Result<create_typing_event::v3::Response> {
 	use create_typing_event::v3::Typing;
@@ -0,0 +1,135 @@
+use std::{
+	convert::Infallible,
+	net::{IpAddr, Ipv4Addr, SocketAddr},
+};
+
+use axum::extract::{ConnectInfo, FromRequestParts};
+use axum_client_ip::ClientIp as SourcedClientIp;
+use conduwuit::debug_warn;
+use http::request::Parts;
+
+const UNKNOWN_IP: IpAddr = IpAddr::V4(Ipv4Addr::UNSPECIFIED);
+
+/// [`ClientIp`] extractor that falls back to the connection peer address
+/// instead of rejecting the request when `request_ip_source` can't be resolved.
+#[derive(Debug, Clone, Copy)]
+pub(crate) struct ClientIp(pub IpAddr);
+
+impl<S> FromRequestParts<S> for ClientIp
+where
+	S: Sync,
+{
+	type Rejection = Infallible;
+
+	async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
+		let ip = match SourcedClientIp::from_request_parts(parts, state).await {
+			| Ok(SourcedClientIp(ip)) => ip,
+			| Err(rejection) => {
+				debug_warn!(
+					%rejection,
+					"Could not resolve client IP from request_ip_source; using peer address"
+				);
+				parts
+					.extensions
+					.get::<ConnectInfo<SocketAddr>>()
+					.map_or(UNKNOWN_IP, |ConnectInfo(addr)| addr.ip())
+			},
+		};
+
+		Ok(Self(ip))
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use std::net::Ipv6Addr;
+
+	use axum_client_ip::ClientIpSource;
+
+	use super::*;
+
+	const PEER: SocketAddr = SocketAddr::new(IpAddr::V4(Ipv4Addr::new(198, 51, 100, 7)), 8448);
+	const PEER_V6: SocketAddr =
+		SocketAddr::new(IpAddr::V6(Ipv6Addr::new(0x2001, 0xDB8, 0, 0, 0, 0, 0, 1)), 8448);
+
+	fn parts(
+		source: Option<ClientIpSource>,
+		peer: Option<SocketAddr>,
+		headers: &[(&str, &str)],
+	) -> Parts {
+		let mut builder = http::Request::builder();
+		for (name, value) in headers {
+			builder = builder.header(*name, *value);
+		}
+
+		let (mut parts, ()) = builder.body(()).unwrap().into_parts();
+		if let Some(source) = source {
+			parts.extensions.insert(source);
+		}
+		if let Some(peer) = peer {
+			parts.extensions.insert(ConnectInfo(peer));
+		}
+
+		parts
+	}
+
+	async fn extract(mut parts: Parts) -> IpAddr {
+		let ClientIp(ip) = ClientIp::from_request_parts(&mut parts, &()).await.unwrap();
+		ip
+	}
+
+	#[tokio::test]
+	async fn resolves_from_configured_source() {
+		let parts =
+			parts(Some(ClientIpSource::XRealIp), Some(PEER), &[("x-real-ip", "203.0.113.5")]);
+
+		assert_eq!(extract(parts).await, IpAddr::V4(Ipv4Addr::new(203, 0, 113, 5)));
+	}
+
+	#[tokio::test]
+	async fn resolves_ipv6_from_configured_source() {
+		let parts =
+			parts(Some(ClientIpSource::XRealIp), Some(PEER), &[("x-real-ip", "2001:db8::2")]);
+
+		assert_eq!(
+			extract(parts).await,
+			IpAddr::V6(Ipv6Addr::new(0x2001, 0xDB8, 0, 0, 0, 0, 0, 2))
+		);
+	}
+
+	#[tokio::test]
+	async fn falls_back_to_peer_when_header_missing() {
+		let parts = parts(Some(ClientIpSource::XRealIp), Some(PEER), &[]);
+
+		assert_eq!(extract(parts).await, PEER.ip());
+	}
+
+	#[tokio::test]
+	async fn falls_back_to_ipv6_peer_when_header_missing() {
+		let parts = parts(Some(ClientIpSource::XRealIp), Some(PEER_V6), &[]);
+
+		assert_eq!(extract(parts).await, PEER_V6.ip());
+	}
+
+	#[tokio::test]
+	async fn falls_back_to_peer_when_header_unparsable() {
+		let parts =
+			parts(Some(ClientIpSource::XRealIp), Some(PEER), &[("x-real-ip", "not-an-ip")]);
+
+		assert_eq!(extract(parts).await, PEER.ip());
+	}
+
+	#[tokio::test]
+	async fn falls_back_to_peer_when_source_unset() {
+		let parts = parts(None, Some(PEER), &[("x-real-ip", "203.0.113.5")]);
+
+		assert_eq!(extract(parts).await, PEER.ip());
+	}
+
+	#[tokio::test]
+	async fn falls_back_to_unspecified_without_peer() {
+		let parts = parts(Some(ClientIpSource::XRealIp), None, &[]);
+
+		assert_eq!(extract(parts).await, UNKNOWN_IP);
+	}
+}
@@ -11,6 +11,8 @@
 pub mod router;
 pub mod server;

+pub(crate) mod client_ip;
+
 pub mod admin;

 pub(crate) use self::router::{Ruma, RumaResponse, State};
@@ -15,10 +15,9 @@
 #[derive(Deserialize)]
 pub(crate) struct AuthQueryParams {
 	pub(super) user_id: Option<String>,
-	/// Device ID for appservice device masquerading (MSC3202/MSC4190).
-	/// Can be provided as `device_id` or `org.matrix.msc3202.device_id`.
-	#[serde(alias = "org.matrix.msc3202.device_id")]
 	pub(super) device_id: Option<String>,
+	#[serde(rename = "org.matrix.msc3202.device_id")]
+	pub(super) legacy_device_id: Option<String>,
 }

 /// Extractor for Ruma request structs
@@ -219,25 +219,29 @@ async fn verify<B: AsRef<[u8]> + Sync>(
 			// MSC3202/MSC4190: Handle device_id masquerading for appservices.
 			// The device_id can be provided via `device_id` or
 			// `org.matrix.msc3202.device_id` query parameter.
-			let sender_device =
-				if let Some(device_id) = query.device_id.as_deref().map(Into::into) {
-					// Verify the device exists for this user
-					if services
-						.users
-						.get_device_metadata(&sender_user, device_id)
-						.await
-						.is_err()
-					{
-						return Err!(Request(Forbidden(
-							"Device does not exist for user or appservice cannot masquerade as \
-							 this device."
-						)));
-					}
+			let sender_device = if let Some(device_id) = query
+				.device_id
+				.or(query.legacy_device_id)
+				.as_deref()
+				.map(Into::into)
+			{
+				// Verify the device exists for this user
+				if services
+					.users
+					.get_device_metadata(&sender_user, device_id)
+					.await
+					.is_err()
+				{
+					return Err!(Request(Forbidden(
+						"Device does not exist for user or appservice cannot masquerade as this \
+						 device."
+					)));
+				}

-					Some(device_id.to_owned())
-				} else {
-					None
-				};
+				Some(device_id.to_owned())
+			} else {
+				None
+			};

 			Ok(ClientIdentity::Appservice {
 				sender_user,
@@ -1,7 +1,6 @@
 use std::collections::{HashMap, hash_map::Entry};

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use base64::{Engine as _, engine::general_purpose};
 use conduwuit::{
 	Err, Error, EventTypeExt, PduEvent, Result, debug, err, error,
@@ -23,15 +22,14 @@
 };
 use serde::Deserialize;

-use crate::{Ruma, server::utils::validate_any_membership_event};
+use crate::{Ruma, client_ip::ClientIp, server::utils::validate_any_membership_event};

 /// # `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}`
 ///
 /// Invites a remote user to a room.
-#[tracing::instrument(skip_all, fields(%client), name = "invite", level = "info")]
+#[tracing::instrument(skip_all, name = "invite", level = "info")]
 pub(crate) async fn create_invite_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<create_invite::v2::Request>,
 ) -> Result<create_invite::v2::Response> {
 	if !services.server.supported_room_version(&body.room_version) {
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, utils::content_disposition::make_content_disposition};
 use conduwuit_service::media::{Dim, FileMeta};
 use ruma::api::federation::authenticated_media::{
@@ -7,20 +6,14 @@
 };
 use service::media::mxc::Mxc;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `GET /_matrix/federation/v1/media/download/{mediaId}`
 ///
 /// Load media from our server.
-#[tracing::instrument(
-	name = "media_get",
-	level = "debug",
-	skip_all,
-	fields(%client)
-)]
+#[tracing::instrument(name = "media_get", level = "debug", skip_all)]
 pub(crate) async fn get_content_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content::v1::Request>,
 ) -> Result<get_content::v1::Response> {
 	let mxc = Mxc {
@@ -54,15 +47,9 @@ pub(crate) async fn get_content_route(
 /// # `GET /_matrix/federation/v1/media/thumbnail/{mediaId}`
 ///
 /// Load media thumbnail from our server.
-#[tracing::instrument(
-	name = "media_thumbnail_get",
-	level = "debug",
-	skip_all,
-	fields(%client)
-)]
+#[tracing::instrument(name = "media_thumbnail_get", level = "debug", skip_all)]
 pub(crate) async fn get_content_thumbnail_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_content_thumbnail::v1::Request>,
 ) -> Result<get_content_thumbnail::v1::Response> {
 	let dim = Dim::from_ruma(body.width, body.height, body.method.clone())?;
@@ -1,5 +1,4 @@
 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{Err, Result, err};
 use ruma::{
 	api::federation::directory::{get_public_rooms, get_public_rooms_filtered},
@@ -7,15 +6,14 @@
 	directory::Filter,
 };

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 /// # `POST /_matrix/federation/v1/publicRooms`
 ///
 /// Lists the public rooms on this server.
-#[tracing::instrument(name = "publicrooms", level = "debug", skip_all, fields(%client))]
+#[tracing::instrument(name = "publicrooms", level = "debug", skip_all)]
 pub(crate) async fn get_public_rooms_filtered_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_public_rooms_filtered::v1::Request>,
 ) -> Result<get_public_rooms_filtered::v1::Response> {
 	if !services
@@ -48,10 +46,9 @@ pub(crate) async fn get_public_rooms_filtered_route(
 /// # `GET /_matrix/federation/v1/publicRooms`
 ///
 /// Lists the public rooms on this server.
-#[tracing::instrument(name = "publicrooms", level = "debug", skip_all, fields(%client))]
+#[tracing::instrument(name = "publicrooms", level = "debug", skip_all)]
 pub(crate) async fn get_public_rooms_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<get_public_rooms::v1::Request>,
 ) -> Result<get_public_rooms::v1::Response> {
 	if !services
@@ -1,11 +1,9 @@
 use std::{
 	collections::{BTreeMap, HashMap},
-	net::IpAddr,
 	time::{Duration, Instant},
 };

 use axum::extract::State;
-use axum_client_ip::ClientIp;
 use conduwuit::{
 	Err, Error, Result, debug, debug_error, debug_warn, err, error,
 	result::LogErr,
@@ -47,7 +45,7 @@
 use tokio::sync::watch::{Receiver, Sender};
 use tracing::instrument;

-use crate::Ruma;
+use crate::{Ruma, client_ip::ClientIp};

 type ResolvedMap = BTreeMap<OwnedEventId, Result>;
 type Pdu = (OwnedRoomId, OwnedEventId, CanonicalJsonObject);
@@ -57,7 +55,6 @@
 /// Push EDUs and PDUs to this server.
 pub(crate) async fn send_transaction_message_route(
 	State(services): State<crate::State>,
-	ClientIp(client): ClientIp,
 	body: Ruma<send_transaction_message::v1::Request>,
 ) -> Result<send_transaction_message::v1::Response> {
 	if body.identity != body.body.origin {
@@ -98,7 +95,7 @@ pub(crate) async fn send_transaction_message_route(
 			services
 				.server
 				.runtime()
-				.spawn(process_inbound_transaction(services, body, client, txn_key, sender));
+				.spawn(process_inbound_transaction(services, body, txn_key, sender));
 			// and wait for it
 			wait_for_result(receiver).await
 		},
@@ -141,7 +138,6 @@ async fn wait_for_result(
 async fn process_inbound_transaction(
 	services: crate::State,
 	body: Ruma<send_transaction_message::v1::Request>,
-	client: IpAddr,
 	txn_key: TxnKey,
 	sender: Sender<WrappedTransactionResponse>,
 ) {
@@ -163,7 +159,7 @@ async fn process_inbound_transaction(
 		.stream();

 	debug!(pdus = body.pdus.len(), edus = body.edus.len(), "Processing transaction",);
-	let results = match handle(&services, &client, &body.identity, pdus, edus).await {
+	let results = match handle(&services, &body.identity, pdus, edus).await {
 		| Ok(results) => results,
 		| Err(err) => {
 			fail_federation_txn(services, &txn_key, &sender, err);
@@ -236,7 +232,6 @@ fn transaction_error_to_response(err: &TransactionError) -> Error {
 }
 async fn handle(
 	services: &Services,
-	client: &IpAddr,
 	origin: &ServerName,
 	pdus: impl Stream<Item = Pdu> + Send,
 	edus: impl Stream<Item = Edu> + Send,
@@ -257,7 +252,7 @@ async fn handle(
 		.into_iter()
 		.try_stream()
 		.broad_and_then(|(room_id, pdus): (_, Vec<_>)| {
-			handle_room(services, client, origin, room_id, pdus.into_iter())
+			handle_room(services, origin, room_id, pdus.into_iter())
 				.map_ok(Vec::into_iter)
 				.map_ok(IterStream::try_stream)
 		})
@@ -267,7 +262,7 @@ async fn handle(
 		.await?;

 	// Evaluate EDUs after PDUs in case some of the PDUs then forbid some EDUs.
-	edus.for_each_concurrent(automatic_width(), |edu| handle_edu(services, client, origin, edu))
+	edus.for_each_concurrent(automatic_width(), |edu| handle_edu(services, origin, edu))
 		.boxed()
 		.await;

@@ -276,7 +271,6 @@ async fn handle(

 async fn handle_room(
 	services: &Services,
-	_client: &IpAddr,
 	origin: &ServerName,
 	room_id: OwnedRoomId,
 	pdus: impl Iterator<Item = Pdu> + Send,
@@ -323,25 +317,25 @@ async fn handle_room(
 	Ok(results)
 }

-async fn handle_edu(services: &Services, client: &IpAddr, origin: &ServerName, edu: Edu) {
+async fn handle_edu(services: &Services, origin: &ServerName, edu: Edu) {
 	match edu {
 		| Edu::Presence(presence) if services.server.config.allow_incoming_presence =>
-			handle_edu_presence(services, client, origin, presence).await,
+			handle_edu_presence(services, origin, presence).await,

 		| Edu::Receipt(receipt) if services.server.config.allow_incoming_read_receipts =>
-			handle_edu_receipt(services, client, origin, receipt).await,
+			handle_edu_receipt(services, origin, receipt).await,

 		| Edu::Typing(typing) if services.server.config.allow_incoming_typing =>
-			handle_edu_typing(services, client, origin, typing).await,
+			handle_edu_typing(services, origin, typing).await,

 		| Edu::DeviceListUpdate(content) =>
-			handle_edu_device_list_update(services, client, origin, content).await,
+			handle_edu_device_list_update(services, origin, content).await,

 		| Edu::DirectToDevice(content) =>
-			handle_edu_direct_to_device(services, client, origin, content).await,
+			handle_edu_direct_to_device(services, origin, content).await,

 		| Edu::SigningKeyUpdate(content) =>
-			handle_edu_signing_key_update(services, client, origin, content).await,
+			handle_edu_signing_key_update(services, origin, content).await,

 		| Edu::_Custom(ref _custom) => debug_warn!(?edu, "received custom/unknown EDU"),

@@ -351,7 +345,6 @@ async fn handle_edu(services: &Services, client: &IpAddr, origin: &ServerName, e

 async fn handle_edu_presence(
 	services: &Services,
-	_client: &IpAddr,
 	origin: &ServerName,
 	presence: PresenceContent,
 ) {
@@ -392,12 +385,7 @@ async fn handle_edu_presence_update(
 		.ok();
 }

-async fn handle_edu_receipt(
-	services: &Services,
-	_client: &IpAddr,
-	origin: &ServerName,
-	receipt: ReceiptContent,
-) {
+async fn handle_edu_receipt(services: &Services, origin: &ServerName, receipt: ReceiptContent) {
 	receipt
 		.receipts
 		.into_iter()
@@ -492,12 +480,7 @@ async fn handle_edu_receipt_room_user(
 		.await;
 }

-async fn handle_edu_typing(
-	services: &Services,
-	_client: &IpAddr,
-	origin: &ServerName,
-	typing: TypingContent,
-) {
+async fn handle_edu_typing(services: &Services, origin: &ServerName, typing: TypingContent) {
 	if typing.user_id.server_name() != origin {
 		debug_warn!(
 			%typing.user_id, %origin,
@@ -557,7 +540,6 @@ async fn handle_edu_typing(

 async fn handle_edu_device_list_update(
 	services: &Services,
-	_client: &IpAddr,
 	origin: &ServerName,
 	content: DeviceListUpdateContent,
 ) {
@@ -576,7 +558,6 @@ async fn handle_edu_device_list_update(

 async fn handle_edu_direct_to_device(
 	services: &Services,
-	_client: &IpAddr,
 	origin: &ServerName,
 	content: DirectDeviceContent,
 ) {
@@ -696,7 +677,6 @@ async fn handle_edu_direct_to_device_event(

 async fn handle_edu_signing_key_update(
 	services: &Services,
-	_client: &IpAddr,
 	origin: &ServerName,
 	content: SigningKeyUpdateContent,
 ) {
@@ -91,7 +91,7 @@ pub(crate) async fn validate_any_membership_event(
 	expected_room_id: OwnedRoomId,
 	expected_event_id: OwnedEventId,
 ) -> Result<(CanonicalJsonObject, MembershipState, OwnedUserId, OwnedUserId)> {
-	let (template_room_id, template_event_id, pdu) = services
+	let (template_room_id, template_event_id, mut pdu) = services
 		.rooms
 		.event_handler
 		.parse_incoming_pdu(body, Some(room_version_rules))
@@ -109,6 +109,37 @@ pub(crate) async fn validate_any_membership_event(
 		))));
 	}

+	// Only `join` events carry `join_authorised_via_users_server`; co-sign
+	// restricted joins so verification passes. Authorisation is enforced in
+	// create_join_event.
+	let membership_is_join = pdu
+		.get("content")
+		.and_then(|v| v.as_object())
+		.and_then(|c| c.get("membership"))
+		.and_then(|v| v.as_str())
+		.is_some_and(|m| m == "join");
+
+	let authorising_user = pdu
+		.get("content")
+		.and_then(|v| v.as_object())
+		.and_then(|c| c.get("join_authorised_via_users_server"))
+		.and_then(|v| v.as_str())
+		.map(UserId::parse)
+		.and_then(Result::ok);
+
+	if room_version_rules.authorization.restricted_join_rule
+		&& membership_is_join
+		&& let Some(authorising_user) = authorising_user
+		&& services.globals.user_is_local(&authorising_user)
+	{
+		services
+			.server_keys
+			.hash_and_sign_event(&mut pdu, room_version_rules)
+			.map_err(|e| {
+				err!(Request(InvalidParam("Failed to sign restricted join event: {e}")))
+			})?;
+	}
+
 	services
 		.server_keys
 		.verify_event(&pdu, room_version_rules)
@@ -1,10 +1,10 @@
 use std::{any::Any, sync::Arc, time::Duration};

 use axum::{
-	Router,
-	extract::{DefaultBodyLimit, MatchedPath},
+	Router, extract,
+	extract::{DefaultBodyLimit, FromRequestParts, MatchedPath},
 };
-use axum_client_ip::ClientIpSource;
+use axum_client_ip::{ClientIp, ClientIpSource};
 use conduwuit::{Result, Server, debug, error};
 use conduwuit_service::{Services, state::Guard};
 use http::{
@@ -20,7 +20,6 @@
 	timeout::{RequestBodyTimeoutLayer, ResponseBodyTimeoutLayer, TimeoutLayer},
 	trace::{DefaultOnFailure, DefaultOnRequest, DefaultOnResponse, TraceLayer},
 };
-use tracing::Level;

 use crate::{request, router};

@@ -67,15 +66,16 @@ pub(crate) fn build(services: &Arc<Services>) -> Result<(Router, Guard)> {
 	let services_ = services.clone();
 	let layers = layers
 		.layer(SetSensitiveHeadersLayer::new([header::AUTHORIZATION]))
+		.layer(client_ip_layer.into_extension())
 		.layer(
 			TraceLayer::new_for_http()
 				.make_span_with(tracing_span::<_>)
-				.on_failure(DefaultOnFailure::new().level(Level::ERROR))
-				.on_request(DefaultOnRequest::new().level(Level::TRACE))
-				.on_response(DefaultOnResponse::new().level(Level::DEBUG)),
+				.on_failure(DefaultOnFailure::new().level(tracing::Level::ERROR))
+				.on_request(DefaultOnRequest::new().level(tracing::Level::TRACE))
+				.on_response(DefaultOnResponse::new().level(tracing::Level::DEBUG)),
 		)
+		.layer(axum::middleware::from_fn(request_ip))
 		.layer(axum::middleware::from_fn_with_state(Arc::clone(services), request::handle))
-		.layer(client_ip_layer.into_extension())
 		.layer(ResponseBodyTimeoutLayer::new(Duration::from_secs(
 			server.config.client_response_timeout,
 		)))
@@ -230,11 +230,25 @@ fn tracing_span<T>(request: &http::Request<T>) -> tracing::Span {
 		parent: None,
 		debug::INFO_SPAN_LEVEL,
 		"router",
+		ip=tracing::field::Empty,
 		method = %request.method(),
 		%path,
 	}
 }

+/// Annotates the tracing span with the client IP
+async fn request_ip(
+	request: extract::Request,
+	next: axum::middleware::Next,
+) -> axum::response::Response {
+	let (mut parts, body) = request.into_parts();
+	if let Ok(ip) = ClientIp::from_request_parts(&mut parts, &()).await {
+		let span = tracing::Span::current();
+		span.record("ip", ip.0.to_string());
+	}
+	next.run(extract::Request::from_parts(parts, body)).await
+}
+
 fn request_path_str<T>(request: &http::Request<T>) -> &str {
 	request
 		.uri()
@@ -25,7 +25,7 @@
 			OAuthError, ResponseMode, Scope, TokenRequest, TokenResponse, TokenType,
 		},
 	},
-	users,
+	users::{self, DeviceToken},
 };

 pub mod client_metadata;
@@ -343,7 +343,7 @@ async fn create_session(
 		client_name: Option<String>,
 		client_id: String,
 	) -> Result<TokenResponse, OAuthError> {
-		let access_token = Self::generate_token();
+		let access_token = DeviceToken::new_random().with_max_age(Self::ACCESS_TOKEN_MAX_AGE);
 		let refresh_token = Self::generate_token();

 		let device_id = requested_scopes
@@ -376,8 +376,7 @@ async fn create_session(
 			.create_device(
 				&authorizing_user,
 				device_id,
-				&access_token,
-				Some(Self::ACCESS_TOKEN_MAX_AGE),
+				Some(access_token.clone()),
 				client_name,
 				None,
 			)
@@ -413,7 +412,7 @@ async fn create_session(
 		);

 		Ok(TokenResponse {
-			access_token,
+			access_token: access_token.into_token(),
 			token_type: TokenType::Bearer,
 			expires_in: Self::ACCESS_TOKEN_MAX_AGE.as_secs(),
 			scope: requested_scopes.iter().join(" "),
@@ -449,7 +448,7 @@ async fn refresh_session(

 		assert_eq!(&client_id, &session_info.client_id, "session info client id mismatch");

-		let new_access_token = Self::generate_token();
+		let new_access_token = DeviceToken::new_random().with_max_age(Self::ACCESS_TOKEN_MAX_AGE);
 		let new_refresh_token = Self::generate_token();
 		let scope = session_info.scopes.iter().join(" ");
 		session_info
@@ -461,8 +460,7 @@ async fn refresh_session(
 			.set_token(
 				&refresh_token_info.user_id,
 				&refresh_token_info.device_id,
-				&new_access_token,
-				Some(Self::ACCESS_TOKEN_MAX_AGE),
+				new_access_token.clone(),
 			)
 			.await
 			.expect("should be able to set token");
@@ -479,7 +477,7 @@ async fn refresh_session(
 			.raw_put(&new_refresh_token, Json(refresh_token_info));

 		Ok(TokenResponse {
-			access_token: new_access_token,
+			access_token: new_access_token.into_token(),
 			token_type: TokenType::Bearer,
 			expires_in: Self::ACCESS_TOKEN_MAX_AGE.as_secs(),
 			scope,
@@ -6,8 +6,9 @@
 };
 use futures::future::ready;
 use ruma::{
-	CanonicalJsonObject, EventId, OwnedEventId, ServerName, api::error::ErrorKind,
-	canonical_json::redact, events::StateEventType, room_version_rules::RoomVersionRules,
+	CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, ServerName,
+	api::error::ErrorKind, canonical_json::redact, events::StateEventType,
+	room_version_rules::RoomVersionRules,
 };

 use crate::rooms::{
@@ -42,11 +43,27 @@ pub fn pdu_format_check_1(
 			return Err!(Request(BadJson("PDU has too many auth events")));
 		}

-		let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
-		if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
-			return Err!(Request(BadJson("PDU references a create event")));
-		} else if event_format.allow_room_create_in_auth_events && !create_event_in_auth_events {
-			return Err!(Request(BadJson("PDU does not reference the room create event")));
+		// The m.room.create event is the genesis event and has empty auth_events
+		// by definition, so it is exempt from the checks below requiring or
+		// forbidding the create event in auth_events (it cannot reference itself).
+		let Some(event_type) = pdu_json.get("type").and_then(CanonicalJsonValue::as_str) else {
+			return Err!(Request(BadJson("PDU is missing a type")));
+		};
+		let state_key = pdu_json
+			.get("state_key")
+			.and_then(CanonicalJsonValue::as_str);
+
+		let is_create_event = event_type == "m.room.create" && state_key == Some("");
+
+		if !is_create_event {
+			let create_event_in_auth_events = auth_events.iter().any(|id| id == create_event_id);
+			if !event_format.allow_room_create_in_auth_events && create_event_in_auth_events {
+				return Err!(Request(BadJson("PDU references a create event")));
+			} else if event_format.allow_room_create_in_auth_events
+				&& !create_event_in_auth_events
+			{
+				return Err!(Request(BadJson("PDU does not reference the room create event")));
+			}
 		}

 		let prev_events = expect_event_id_array(pdu_json, "prev_events")?;
@@ -5,6 +5,7 @@
 };

 use conduwuit::{Err, Error, Result, error, utils};
+use futures::StreamExt;
 use lettre::Address;
 use ruma::{
 	DeviceId, UserId,
@@ -25,7 +26,7 @@
 use tokio::sync::Mutex;

 use crate::{
-	Dep, config, globals,
+	Dep, config, firstrun, globals,
 	oauth::{self, OAuthTicket},
 	registration_tokens, threepid, users,
 };
@@ -36,25 +37,54 @@ pub struct Service {
 }

 struct Services {
-	globals: Dep<globals::Service>,
-	users: Dep<users::Service>,
 	config: Dep<config::Service>,
+	firstrun: Dep<firstrun::Service>,
+	globals: Dep<globals::Service>,
+	oauth: Dep<oauth::Service>,
 	registration_tokens: Dep<registration_tokens::Service>,
 	threepid: Dep<threepid::Service>,
-	oauth: Dep<oauth::Service>,
+	users: Dep<users::Service>,
+}
+
+#[derive(Debug)]
+pub enum TrustedFlowStatus {
+	Unavailable,
+	Available,
+}
+
+#[derive(Debug)]
+pub enum UntrustedFlowStatus {
+	Unavailable,
+	Available {
+		require_email: bool,
+	},
+}
+
+pub struct FlowStatus {
+	pub trusted: TrustedFlowStatus,
+	pub untrusted: UntrustedFlowStatus,
+}
+
+impl FlowStatus {
+	#[must_use]
+	pub fn any_available(&self) -> bool {
+		matches!(self.trusted, TrustedFlowStatus::Available)
+			|| matches!(self.untrusted, UntrustedFlowStatus::Available { .. })
+	}
 }

 impl crate::Service for Service {
 	fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		Ok(Arc::new(Self {
 			services: Services {
-				globals: args.depend::<globals::Service>("globals"),
-				users: args.depend::<users::Service>("users"),
 				config: args.depend::<config::Service>("config"),
+				firstrun: args.depend::<firstrun::Service>("firstrun"),
+				globals: args.depend::<globals::Service>("globals"),
+				oauth: args.depend::<oauth::Service>("oauth"),
 				registration_tokens: args
 					.depend::<registration_tokens::Service>("registration_tokens"),
 				threepid: args.depend::<threepid::Service>("threepid"),
-				oauth: args.depend::<oauth::Service>("oauth"),
+				users: args.depend::<users::Service>("users"),
 			},
 			uiaa_sessions: Mutex::new(HashMap::new()),
 		}))
@@ -595,4 +625,56 @@ async fn check_stage(

 		Ok((completed_auth_type, session_metadata))
 	}
+
+	pub async fn registration_flow_status(&self) -> FlowStatus {
+		// Allow registration if it's enabled in the config file or if this is the first
+		// run (so the first user account can be created)
+		let allow_registration =
+			self.services.config.allow_registration || self.services.firstrun.is_first_run();
+
+		// Trusted flow is only available if any registration tokens exist
+		let trusted = {
+			if !allow_registration {
+				TrustedFlowStatus::Unavailable
+			} else if self
+				.services
+				.registration_tokens
+				.iterate_tokens()
+				.next()
+				.await
+				.is_some()
+			{
+				TrustedFlowStatus::Available
+			} else {
+				TrustedFlowStatus::Unavailable
+			}
+		};
+
+		// Untrusted flow is available if email is required for registration,
+		// or reCAPTCHA is configured, or open registration is enabled
+		let untrusted = {
+			let require_email = self
+				.services
+				.config
+				.smtp
+				.as_ref()
+				.is_some_and(|smtp| smtp.require_email_for_registration);
+
+			if !allow_registration || self.services.firstrun.is_first_run() {
+				UntrustedFlowStatus::Unavailable
+			} else if self.services.config.recaptcha_private_site_key.is_some() || require_email {
+				UntrustedFlowStatus::Available { require_email }
+			} else if self
+				.services
+				.config
+				.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
+			{
+				UntrustedFlowStatus::Available { require_email: false }
+			} else {
+				UntrustedFlowStatus::Unavailable
+			}
+		};
+
+		FlowStatus { trusted, untrusted }
+	}
 }
@@ -41,7 +41,6 @@ pub async fn set_dehydrated_device(&self, user_id: &UserId, request: Request) ->
 		self.create_device(
 			user_id,
 			&request.device_id,
-			"",
 			None,
 			request.initial_device_display_name.clone(),
 			None,
@@ -11,20 +11,44 @@
 use futures::{Stream, StreamExt};
 use ruma::{
 	DeviceId, MilliSecondsSinceUnixEpoch, OwnedDeviceId, OwnedUserId, UserId,
-	api::client::device::Device, events::AnyToDeviceEvent, serde::Raw, uint,
+	api::client::device::Device, assign, events::AnyToDeviceEvent, serde::Raw, uint,
 };
 use serde_json::json;

 use crate::users::increment;

+#[must_use]
+#[derive(Clone)]
+pub struct DeviceToken {
+	token: String,
+	max_age: Option<Duration>,
+}
+
+impl DeviceToken {
+	const DEVICE_ID_LENGTH: usize = 10;
+
+	pub fn new(token: String) -> Self { Self { token, max_age: None } }
+
+	pub fn new_random() -> Self { Self::new(utils::random_string(Self::DEVICE_ID_LENGTH)) }
+
+	pub fn with_max_age(self, max_age: Duration) -> Self {
+		assign!(self, { max_age: Some(max_age) })
+	}
+
+	#[must_use]
+	pub fn into_token(self) -> String { self.token }
+}
+
 impl super::Service {
 	/// Adds a new device to a user.
+	///
+	/// If no `token` is provided, the device will not be able to be logged
+	/// into.
 	pub async fn create_device(
 		&self,
 		user_id: &UserId,
 		device_id: &DeviceId,
-		token: &str,
-		token_max_age: Option<Duration>,
+		token: Option<DeviceToken>,
 		initial_device_display_name: Option<String>,
 		client_ip: Option<String>,
 	) -> Result<()> {
@@ -38,8 +62,12 @@ pub async fn create_device(

 		increment(&self.db.userid_devicelistversion, user_id.as_bytes());
 		self.db.userdeviceid_metadata.put(key, Json(device));
-		self.set_token(user_id, device_id, token, token_max_age)
-			.await
+
+		if let Some(token) = token {
+			self.set_token(user_id, device_id, token).await?;
+		}
+
+		Ok(())
 	}

 	/// Removes a device from a user.
@@ -97,31 +125,12 @@ pub async fn get_token(&self, user_id: &UserId, device_id: &DeviceId) -> Result<
 		self.db.userdeviceid_token.qry(&key).await.deserialized()
 	}

-	/// Generate a unique access token that doesn't collide with existing tokens
-	pub async fn generate_unique_token(&self) -> String {
-		loop {
-			let token = utils::random_string(32);
-
-			// Check for collision with existing appservice and user tokens
-			let (appservice, usr) = tokio::join!(
-				self.services.appservice.find_from_token(&token),
-				self.db.token_userdeviceid.get(&token)
-			);
-			if appservice.is_ok() || usr.is_ok() {
-				continue;
-			}
-
-			return token;
-		}
-	}
-
 	/// Replaces the access token of one device.
 	pub async fn set_token(
 		&self,
 		user_id: &UserId,
 		device_id: &DeviceId,
-		token: &str,
-		token_max_age: Option<Duration>,
+		DeviceToken { token, max_age }: DeviceToken,
 	) -> Result<()> {
 		let key = (user_id, device_id);
 		if self.db.userdeviceid_metadata.qry(&key).await.is_err() {
@@ -136,7 +145,7 @@ pub async fn set_token(
 		if self
 			.services
 			.appservice
-			.find_from_token(token)
+			.find_from_token(&token)
 			.await
 			.is_ok()
 		{
@@ -153,10 +162,10 @@ pub async fn set_token(
 		}

 		// Assign token to user device combination
-		self.db.userdeviceid_token.put_raw(key, token);
-		self.db.token_userdeviceid.raw_put(token, key);
+		self.db.userdeviceid_token.put_raw(key, &token);
+		self.db.token_userdeviceid.raw_put(&token, key);

-		if let Some(max_age) = token_max_age {
+		if let Some(max_age) = max_age {
 			let expires = SystemTime::now()
 				.duration_since(SystemTime::UNIX_EPOCH)
 				.expect("system time should not be before the epoch")
@@ -244,8 +253,6 @@ pub async fn remove_to_device_events<Until>(
 				self.db.todeviceid_events.del(key);
 			})
 			.await;
-
-		self.services.sync.wake(user_id).await;
 	}

 	/// Updates device metadata and increments the device list version.
@@ -14,6 +14,7 @@
 	utils::{self},
 };
 use database::Map;
+pub use device::DeviceToken;
 pub use profile::ProfileFieldChange;
 use ruma::{UserId, api::error::ErrorKind, encryption::CrossSigningKey, serde::Raw};
 use serde::{Deserialize, Serialize};
@@ -108,7 +109,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 			services: Services {
 				account_data: args.depend::<account_data::Service>("account_data"),
 				admin: args.depend::<admin::Service>("admin"),
-				alias: args.depend::<alias::Service>("alias"),
+				alias: args.depend::<alias::Service>("rooms::alias"),
 				appservice: args.depend::<appservice::Service>("appservice"),
 				config: args.depend::<config::Service>("config"),
 				firstrun: args.depend::<firstrun::Service>("firstrun"),
@@ -21,7 +21,6 @@
 	extract::{Expect, PostForm},
 	pages::{
 		GET_POST, Result, TemplateContext,
-		account::register::{TrustedFlowStatus, UntrustedFlowStatus, registration_flow_status},
 		components::UserCard,
 		oidc::{OIDC_SESSION_ID_KEY, OidcSession, OidcSessionState},
 	},
@@ -101,13 +100,13 @@ async fn route_login(

 		LoginType::Oidc { redirect_url }
 	} else {
-		let (trusted_flow_status, untrusted_flow_status) =
-			registration_flow_status(&services).await;
-
-		let registration_available = matches!(trusted_flow_status, TrustedFlowStatus::Available)
-			|| matches!(untrusted_flow_status, UntrustedFlowStatus::Available { .. });
-
-		LoginType::Interactive { registration_available }
+		LoginType::Interactive {
+			registration_available: services
+				.uiaa
+				.registration_flow_status()
+				.await
+				.any_available(),
+		}
 	};

 	let body = match &user_id {
@@ -155,7 +155,7 @@ async fn get_account_deeplink(
 				));
 			};

-			format!("device/{device_id}/delete")
+			format!("device/{device_id}/remove")
 		},
 		| AccountManagementAction::DeviceView => {
 			let Some(device_id) = query.device_id else {
@@ -8,9 +8,12 @@
 };
 use conduwuit_core::{config::TermsDocument, warn};
 use conduwuit_service::{
-	mailer::messages, registration_tokens::ValidToken, users::HashedPassword,
+	mailer::messages,
+	registration_tokens::ValidToken,
+	uiaa::{FlowStatus, TrustedFlowStatus, UntrustedFlowStatus},
+	users::HashedPassword,
 };
-use futures::{FutureExt, StreamExt};
+use futures::FutureExt;
 use lettre::{Address, message::Mailbox};
 use ruma::{ClientSecret, OwnedClientSecret, OwnedServerName, OwnedSessionId, OwnedUserId};
 use serde::{Deserialize, Serialize, de::IgnoredAny};
@@ -61,20 +64,6 @@ enum RegisterBody {
 	},
 }

-#[derive(Debug)]
-pub(super) enum TrustedFlowStatus {
-	Unavailable,
-	Available,
-}
-
-#[derive(Debug)]
-pub(super) enum UntrustedFlowStatus {
-	Unavailable,
-	Available {
-		require_email: bool,
-	},
-}
-
 #[derive(Default, Deserialize, Serialize)]
 pub(crate) struct RegisterQuery {
 	pub username: Option<String>,
@@ -169,7 +158,10 @@ async fn route_register(
 		ValidationErrors::new()
 	};

-	let (trusted_flow_status, untrusted_flow_status) = registration_flow_status(&services).await;
+	let FlowStatus {
+		trusted: trusted_flow_status,
+		untrusted: untrusted_flow_status,
+	} = services.uiaa.registration_flow_status().await;

 	if matches!(trusted_flow_status, TrustedFlowStatus::Unavailable)
 		&& matches!(untrusted_flow_status, UntrustedFlowStatus::Unavailable)
@@ -540,54 +532,3 @@ async fn complete_registration(

 	Ok(Redirect::to(&next.unwrap_or_default().target_path()))
 }
-
-pub(super) async fn registration_flow_status(
-	services: &crate::State,
-) -> (TrustedFlowStatus, UntrustedFlowStatus) {
-	// Allow registration if it's enabled in the config file or if this is the first
-	// run (so the first user account can be created)
-	let allow_registration =
-		services.config.allow_registration || services.firstrun.is_first_run();
-
-	// Trusted flow is only available if any registration tokens exist
-	let trusted_flow_status = {
-		if !allow_registration {
-			TrustedFlowStatus::Unavailable
-		} else if services
-			.registration_tokens
-			.iterate_tokens()
-			.next()
-			.await
-			.is_some()
-		{
-			TrustedFlowStatus::Available
-		} else {
-			TrustedFlowStatus::Unavailable
-		}
-	};
-
-	// Untrusted flow is available if email is required for registration,
-	// or reCAPTCHA is configured, or open registration is enabled
-	let untrusted_flow_status = {
-		let require_email = services
-			.config
-			.smtp
-			.as_ref()
-			.is_some_and(|smtp| smtp.require_email_for_registration);
-
-		if !allow_registration || services.firstrun.is_first_run() {
-			UntrustedFlowStatus::Unavailable
-		} else if services.config.recaptcha_private_site_key.is_some() || require_email {
-			UntrustedFlowStatus::Available { require_email }
-		} else if services
-			.config
-			.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse
-		{
-			UntrustedFlowStatus::Available { require_email: false }
-		} else {
-			UntrustedFlowStatus::Unavailable
-		}
-	};
-
-	(trusted_flow_status, untrusted_flow_status)
-}
Author	SHA1	Message	Date
Renovate Bot	7eca462c8a	chore(deps): update rust-non-major	2026-07-19 05:04:35 +00:00
Jade Ellis	153ef3a173	ci: Attempt to delay major rust toolchain updates	2026-07-17 19:18:38 +01:00
renovateandEllis Git	2441dfe436	chore(Nix): Updated flake hashes	2026-07-17 17:58:23 +00:00
Renovate BotandEllis Git	d149833b7a	chore(deps): update rust to v1.97.1	2026-07-17 17:58:23 +00:00
Erwan LeboucherandEllis Git	b1632ee60b	fix(register): Resolve alias service by correct name for auto-join	2026-07-17 17:57:51 +00:00
timedoutandEllis Git	789589ef37	chore: Remove redundant client IP extractions on individual routes	2026-07-17 12:57:48 +00:00
timedoutandEllis Git	1e47090f5d	feat: Log client IP in router layer	2026-07-17 12:57:48 +00:00
GingerandEllis Git	3e55d08488	fix: Only return create prompt if registration is enabled	2026-07-17 12:49:15 +00:00
Erwan LeboucherandEllis Git	3a74ce6151	fix(client-ip): Fall back to peer IP instead of returning 500	2026-07-17 12:46:11 +00:00
Erwan LeboucherandEllis Git	eff454218c	fix(sync): Send full state for newly-joined rooms in incremental sync	2026-07-17 02:48:28 +00:00
Erwan Leboucher	e2eb980b5e	fix(sync): Stop waking sync loops when removing to-device events	2026-07-16 22:15:27 +02:00
Erwan Leboucher	8945cc9e10	fix(federation): Sign restricted join events before verification	2026-07-16 19:46:42 +00:00
Julian Anderson	78adeccda1	docs(deploying/rpm): Update out-of-date statement about Oracle Linux version availability	2026-07-15 23:23:10 -04:00
Renovate Bot	8195373d81	chore(deps): update rust-non-major	2026-07-15 05:05:03 +00:00
Erwan Leboucher	1ac05838dd	docs: Add back binstall with a link to the deps	2026-07-14 19:44:28 +02:00
Erwan Leboucher	7ecd2aa5e2	fix(pdu): Exempt m.room.create from auth_events check	2026-07-14 19:27:46 +02:00
Renovate BotandEllis Git	69a3145983	chore(deps): update rust-zerover-patch-updates	2026-07-14 13:10:32 +00:00
N00byKing	73b7553b1e	chore: Add changelog entry for #1984	2026-07-14 13:40:28 +02:00
N00byKing	232ec3f620	fix: Return 201 instead of 200 on oauth registration See RFC 7591 at 3.2.1: "The server responds with an HTTP 201 Created status code [...]" Fixes a failure in matrix-dart-sdk	2026-07-14 11:00:34 +02:00
N00byKing	e52bbeaf94	fix: Correct link for code style guide in CONTRIBUTING.md	2026-07-14 08:59:08 +00:00
Renovate Bot	ad1c194fb0	chore(deps): update github-actions-digest	2026-07-14 05:01:52 +00:00
GingerandEllis Git	5e2dcd8e79	chore: News fragment	2026-07-13 20:38:10 +00:00
GingerandEllis Git	24c6474bd1	fix: Allow unstable and stable device id query together	2026-07-13 20:38:10 +00:00
gingerandEllis Git	642d05048b	chore: announce	2026-07-13 18:54:04 +00:00
Koen OostveenandEllis Git	446ae93ad7	fix(web): Change incorrect deeplink for deleting a device	2026-07-13 13:45:46 +00:00
Renovate BotandEllis Git	9ca0774b2d	chore(deps): lock file maintenance	2026-07-13 13:44:47 +00:00
Ginger	ce494eb0c0	fix: Properly sync newly created rooms	2026-07-13 08:50:53 -04:00
Ginger	1f5e178c3f	fix: Properly handle appservice device creation	2026-07-13 08:50:48 -04:00
Renovate Bot	ddd050d402	chore(deps): update ghcr.io/renovatebot/renovate docker tag to v43.260.2	2026-07-13 05:03:24 +00:00
				`@@ -0,0 +1 @@`
				Fixed requests returning `500 Internal Server Error` when the header selected by `request_ip_source` is absent, duplicated, or malformed (for example Envoy omitting `X-Envoy-External-Address` on internal requests). The client IP now falls back to the connection peer address instead of failing the request. Contributed by @eleboucher
				`@@ -0,0 +1 @@`
				`Appservices are now properly able to create devices for E2EE.`
				`@@ -0,0 +1 @@`
				`Resolve alias service by correct name for auto-join. Contributed by @eleboucher`
				`@@ -0,0 +1 @@`
				`Fixed newly created rooms failing to sync properly in clients using legacy sync.`
				`@@ -0,0 +1 @@`
				`Fixed newly joined rooms failing to sync their full state (including the room name) to clients using legacy sync.`
				`@@ -0,0 +1 @@`
				Appservices may now specify both the unstable and stable `device_id` query parameters in a request. The stable parameter will take priority. Contributed by @ginger.
				`@@ -0,0 +1 @@`
				`Fixed the deeplink redirect for deleting devices. Contributed by @koen`
				`@@ -0,0 +1 @@`
				`Fix status code for oauth registration. Contributed by @n00byking`
				`@@ -0,0 +1 @@`
				`Exempt m.room.create from auth_events check. Contributed by @eleboucher`