malice

public
Star0
Watch0
70 commits 2 branches 0 tags 0 releases4.4 MiB
use std::sync::Arc;

use axum::{
    Router,
    extract::{DefaultBodyLimit, Multipart, Query, State},
    http::{HeaderMap, StatusCode},
    middleware,
    response::{IntoResponse, Response, Sse, sse::Event as SseEvent},
    routing::{get, post},
};
use futures_util::StreamExt;
use macltok::Retain;
use malice_core::{
    feed::subscribe,
    login::LoginInput,
    request::{Reply, Request, SendKind, dispatch},
};
use serde::{Deserialize, Serialize};
use tower_http::{
    services::{ServeDir, ServeFile},
    trace::TraceLayer,
};

use crate::{
    csrf::{csrf_guard, session_sid, set_cookie_value},
    error::{ApiError, json_ok, no_content},
    state::{AppState, RestoreError, UserSession},
};

#[derive(Debug, Deserialize)]
struct RoomIdBody {
    #[serde(default)]
    room_id: String,
}

#[derive(Debug, Deserialize)]
struct SendBody {
    #[serde(default)]
    room_id: String,
    #[serde(default)]
    body: String,
    #[serde(default)]
    formatted_body: Option<String>,
    #[serde(default)]
    reply_to: Option<String>,
    #[serde(default)]
    mentions: Vec<String>,
    #[serde(default)]
    kind: SendKind,
}

#[derive(Debug, Deserialize)]
struct PaginateBody {
    #[serde(default)]
    room_id: String,
}

#[derive(Debug, Deserialize)]
struct EventContextBody {
    #[serde(default)]
    room_id: String,
    #[serde(default)]
    event_id: String,
    #[serde(default)]
    before_limit: u32,
    #[serde(default)]
    after_limit: u32,
}

#[derive(Debug, Deserialize)]
struct EventContextPageBody {
    #[serde(default)]
    room_id: String,
    #[serde(default)]
    token: String,
    #[serde(default)]
    limit: u32,
}

#[derive(Debug, Deserialize)]
struct JoinBody {
    #[serde(default)]
    room: String,
}

#[derive(Debug, Deserialize)]
struct CreateBody {
    #[serde(default)]
    name: String,
    #[serde(default)]
    topic: Option<String>,
}

#[derive(Debug, Deserialize)]
struct ReactBody {
    #[serde(default)]
    room_id: String,
    #[serde(default)]
    event_id: String,
    #[serde(default)]
    key: String,
    #[serde(default)]
    shortcode: Option<String>,
}

#[derive(Debug, Deserialize)]
struct EditBody {
    #[serde(default)]
    room_id: String,
    #[serde(default)]
    event_id: String,
    #[serde(default)]
    body: String,
    #[serde(default)]
    formatted_body: Option<String>,
    #[serde(default)]
    mentions: Vec<String>,
}

#[derive(Debug, Deserialize)]
struct ReadBody {
    #[serde(default)]
    room_id: String,
    #[serde(default)]
    event_id: String,
}

#[derive(Debug, Deserialize)]
struct MembersQuery {
    #[serde(default)]
    room_id: String,
}
#[derive(Debug, Deserialize)]
struct RecoverBody {
    recovery_key: String,
}

#[derive(Debug, Deserialize)]
struct VerifyBody {
    action: String,
}

#[derive(Debug, Deserialize)]
struct MediaQuery {
    mxc: String,
    size: Option<u32>,
}
#[derive(Debug, Deserialize)]
struct MessageMediaQuery {
    media_id: String,
    size: String,
}

#[derive(Debug, Deserialize)]
struct TypingBody {
    #[serde(default)]
    room_id: String,
    #[serde(default)]
    typing: bool,
}

#[derive(Debug, Deserialize)]
struct AccountDataQuery {
    event_type: String,
}

#[derive(Debug, Deserialize)]
struct UrlPreviewQuery {
    #[serde(default)]
    room_id: String,
    #[serde(default)]
    url: String,
}

#[derive(Debug, Deserialize)]
struct AccountDataBody {
    event_type: String,
    content: serde_json::Value,
}

#[derive(Debug, Serialize)]
struct SoftLogoutInfo {
    user_id: String,
    homeserver: String,
}

#[derive(Debug, Serialize)]
struct SessionResponse {
    user_id: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    soft_logout: Option<SoftLogoutInfo>,
}

async fn auth(
    state: &AppState,
    headers: &HeaderMap,
) -> Result<(Arc<UserSession>, String), ApiError> {
    let Some(sid) = session_sid(headers) else {
        return Err(ApiError::unauthorized("not signed in"));
    };
    match state.get_or_restore(&sid).await {
        Ok(user) => Ok((user, sid)),
        Err(RestoreError::NotFound) => Err(ApiError::unauthorized_stale(
            "session expired; sign in again",
            state.cookie_secure(),
        )),
        Err(RestoreError::SoftLoggedOut { .. }) => Err(ApiError::unauthorized(
            "signed out by the server, sign in again",
        )),
        Err(RestoreError::Stale(message)) => {
            state.remove_session(&sid, Retain::Nothing).await;
            Err(ApiError::unauthorized_stale(message, state.cookie_secure()))
        }
        Err(RestoreError::Unavailable(message)) => {
            Err(ApiError::new(StatusCode::BAD_GATEWAY, message))
        }
    }
}

fn avatar_response(bytes: Vec<u8>, content_type: &'static str) -> Response {
    (
        [
            (axum::http::header::CONTENT_TYPE, content_type),
            // mxc uris name immutable content, a changed avatar gets a new uri
            (
                axum::http::header::CACHE_CONTROL,
                "private, max-age=31536000, immutable",
            ),
            (axum::http::header::X_CONTENT_TYPE_OPTIONS, "nosniff"),
        ],
        bytes,
    )
        .into_response()
}

/// commands answer when they're done, so the browser gets the outcome in the response
fn respond(result: Result<Reply, malice_core::error::CoreError>) -> Response {
    match result {
        Ok(Reply::Done) => no_content(None),
        Ok(Reply::Json(value)) => json_ok(&value, None),
        Ok(Reply::Avatar(source)) => {
            let (bytes, content_type) = source.render();
            avatar_response(bytes, content_type)
        }
        Ok(Reply::Attachment {
            bytes,
            content_type,
        }) => (
            [
                (
                    axum::http::header::CONTENT_TYPE,
                    content_type.unwrap_or("application/octet-stream"),
                ),
                (
                    axum::http::header::CONTENT_DISPOSITION,
                    if content_type.is_some() {
                        "inline"
                    } else {
                        "attachment"
                    },
                ),
                (axum::http::header::CACHE_CONTROL, "private, max-age=3600"),
                (axum::http::header::X_CONTENT_TYPE_OPTIONS, "nosniff"),
                (axum::http::header::CONTENT_SECURITY_POLICY, "sandbox"),
            ],
            bytes,
        )
            .into_response(),
        Err(error) => ApiError::from(error).into_response(),
    }
}

async fn get_session(State(state): State<AppState>, headers: HeaderMap) -> Response {
    let Some(sid) = session_sid(&headers) else {
        return json_ok(
            &SessionResponse {
                user_id: None,
                soft_logout: None,
            },
            None,
        );
    };
    match state.get_or_restore(&sid).await {
        Ok(user) => json_ok(
            &SessionResponse {
                user_id: Some(user.user_id.clone()),
                soft_logout: None,
            },
            None,
        ),
        Err(RestoreError::NotFound) => json_ok(
            &SessionResponse {
                user_id: None,
                soft_logout: None,
            },
            None,
        ),
        Err(RestoreError::SoftLoggedOut {
            user_id,
            homeserver,
        }) => json_ok(
            &SessionResponse {
                user_id: None,
                soft_logout: Some(SoftLogoutInfo {
                    user_id,
                    homeserver,
                }),
            },
            None,
        ),
        Err(RestoreError::Stale(message)) => {
            state.remove_session(&sid, Retain::Nothing).await;
            ApiError::unauthorized_stale(message, state.cookie_secure()).into_response()
        }
        Err(RestoreError::Unavailable(message)) => {
            ApiError::new(StatusCode::BAD_GATEWAY, message).into_response()
        }
    }
}

async fn post_login(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<LoginInput>,
) -> Response {
    let username = body.0.username.trim().to_owned();
    let password = body.0.password.clone();
    let login = match body.0.into_login(state.allow_http_homeserver()) {
        Ok(login) => login,
        Err(error) => return ApiError::from(error).into_response(),
    };
    let cookie_sid = session_sid(&headers);
    match state
        .login(cookie_sid.as_deref(), login, &username, password)
        .await
    {
        Ok(user) => json_ok(
            &serde_json::json!({ "user_id": user.user_id }),
            Some(set_cookie_value(&user.sid, state.cookie_secure())),
        ),
        Err(error) => ApiError::from(error).into_response(),
    }
}

async fn post_logout(State(state): State<AppState>, headers: HeaderMap) -> Response {
    if let Some(sid) = session_sid(&headers) {
        state.logout(&sid).await;
    }
    let mut response = no_content(Some(crate::csrf::clear_cookie_value(state.cookie_secure())));
    response.headers_mut().insert(
        axum::http::header::HeaderName::from_static("clear-site-data"),
        axum::http::HeaderValue::from_static("\"cache\""),
    );
    response
}

async fn get_rooms(State(state): State<AppState>, headers: HeaderMap) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(dispatch(&user.handle, &user.mirror, Request::Rooms).await)
}

async fn get_members(
    State(state): State<AppState>,
    headers: HeaderMap,
    Query(query): Query<MembersQuery>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Members {
                room_id: query.room_id,
            },
        )
        .await,
    )
}

async fn rooms_open(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<RoomIdBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Open {
                room_id: body.0.room_id,
            },
        )
        .await,
    )
}

async fn rooms_close(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<RoomIdBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Close {
                room_id: body.0.room_id,
            },
        )
        .await,
    )
}

async fn rooms_send(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<SendBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Send {
                room_id: body.0.room_id,
                body: body.0.body,
                formatted_body: body.0.formatted_body,
                reply_to: body.0.reply_to,
                mentions: body.0.mentions,
                kind: body.0.kind,
            },
        )
        .await,
    )
}

async fn rooms_upload(
    State(state): State<AppState>,
    headers: HeaderMap,
    mut upload: Multipart,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    let mut room_id = None;
    let mut caption = None;
    let mut formatted_caption = None;
    let mut reply_to = None;
    let mut mentions = Vec::new();
    let mut file = None;
    loop {
        let field = match upload.next_field().await {
            Ok(Some(field)) => field,
            Ok(None) => break,
            Err(_) => return ApiError::bad_request("invalid upload form").into_response(),
        };
        match field.name() {
            Some("room_id") if room_id.is_none() => {
                room_id = match field.text().await {
                    Ok(value) => Some(value),
                    Err(_) => return ApiError::bad_request("invalid room_id").into_response(),
                };
            }
            Some("caption") if caption.is_none() => {
                caption = match field.text().await {
                    Ok(value) => Some(value),
                    Err(_) => return ApiError::bad_request("invalid caption").into_response(),
                };
            }
            Some("formatted_caption") if formatted_caption.is_none() => {
                formatted_caption = match field.text().await {
                    Ok(value) => Some(value),
                    Err(_) => return ApiError::bad_request("invalid caption").into_response(),
                };
            }
            Some("reply_to") if reply_to.is_none() => {
                reply_to = match field.text().await {
                    Ok(value) => Some(value),
                    Err(_) => return ApiError::bad_request("invalid reply_to").into_response(),
                };
            }
            Some("mentions") => match field.text().await {
                Ok(value) => mentions.push(value),
                Err(_) => return ApiError::bad_request("invalid mention").into_response(),
            },
            Some("file") if file.is_none() => {
                let filename = field.file_name().unwrap_or("attachment").to_owned();
                let mimetype = field
                    .content_type()
                    .unwrap_or("application/octet-stream")
                    .to_owned();
                let bytes = match field.bytes().await {
                    Ok(bytes) => bytes,
                    Err(_) => return ApiError::bad_request("invalid file").into_response(),
                };
                if bytes.is_empty() || bytes.len() > 20 * 1024 * 1024 {
                    return ApiError::bad_request("file must be between 1 byte and 20 MiB")
                        .into_response();
                }
                file = Some((filename, mimetype, bytes));
            }
            _ => return ApiError::bad_request("unexpected upload field").into_response(),
        }
    }
    let Some(room_id) = room_id else {
        return ApiError::bad_request("room_id is required").into_response();
    };
    let Some((filename, mimetype, bytes)) = file else {
        return ApiError::bad_request("file is required").into_response();
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Upload {
                room_id,
                filename,
                mimetype,
                caption,
                formatted_caption,
                reply_to,
                mentions,
                bytes: bytes.to_vec(),
            },
        )
        .await,
    )
}

/// Ops added after the per-route handlers, taken as the core request JSON. Anything
/// carrying bytes stays on its own route.
async fn post_command(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<Request>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    let request = body.0;
    if !matches!(
        request,
        Request::MentionsPage { .. }
            | Request::MentionContext { .. }
            | Request::RetryMentionContext { .. }
            | Request::SetMentionsRead { .. }
            | Request::MarkMentionsReadThrough { .. }
            | Request::RecoverMentions
            | Request::HistoryRepair { .. }
            | Request::ContinueHistoryRepair { .. }
            | Request::CancelHistoryRepair { .. }
            | Request::StartRecentHistory { .. }
            | Request::FillHistoryGap { .. }
            | Request::HistoryRepairPolicy
            | Request::SetHistoryRepairPolicy { .. }
            | Request::Kick { .. }
            | Request::Ban { .. }
            | Request::Unban { .. }
            | Request::SetPowerLevel { .. }
            | Request::SetDisplayName { .. }
            | Request::SetAvatar { .. }
            | Request::Invite { .. }
            | Request::Direct { .. }
            | Request::Redact { .. }
            | Request::SetFavourite { .. }
            | Request::ReorderSpaces { .. }
            | Request::SetRoomDisplayName { .. }
            | Request::SetRoomAvatar { .. }
            | Request::Mute { .. }
            | Request::Ignore { .. }
            | Request::Unignore { .. }
            | Request::PowerLevels { .. }
            | Request::OpenPinned { .. }
            | Request::ClosePinned { .. }
            | Request::SetPinned { .. }
            | Request::SendSticker { .. }
            | Request::CreateRoomPack { .. }
            | Request::DeletePack { .. }
            | Request::SetPackMeta { .. }
            | Request::PutPackImage { .. }
            | Request::RenamePackImage { .. }
            | Request::RemovePackImage { .. }
            | Request::SetPackEnabled { .. }
            | Request::ClonePackImage { .. }
            | Request::CloneSticker { .. }
            | Request::ClonePack { .. }
    ) {
        return ApiError::bad_request("op is not available as a command").into_response();
    }
    respond(dispatch(&user.handle, &user.mirror, request).await)
}

async fn profile_avatar(
    State(state): State<AppState>,
    headers: HeaderMap,
    bytes: axum::body::Bytes,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::UploadAvatar {
                bytes: bytes.to_vec(),
            },
        )
        .await,
    )
}

#[derive(Debug, Deserialize)]
struct RoomAvatarQuery {
    room_id: String,
}

async fn rooms_avatar(
    State(state): State<AppState>,
    headers: HeaderMap,
    Query(query): Query<RoomAvatarQuery>,
    bytes: axum::body::Bytes,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::UploadRoomAvatar {
                room_id: query.room_id,
                bytes: bytes.to_vec(),
            },
        )
        .await,
    )
}

async fn media_upload(
    State(state): State<AppState>,
    headers: HeaderMap,
    bytes: axum::body::Bytes,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::UploadMedia {
                bytes: bytes.to_vec(),
            },
        )
        .await,
    )
}

async fn rooms_paginate(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<PaginateBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Paginate {
                room_id: body.0.room_id,
            },
        )
        .await,
    )
}

async fn rooms_context(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<EventContextBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::EventContext {
                room_id: body.0.room_id,
                event_id: body.0.event_id,
                before_limit: body.0.before_limit,
                after_limit: body.0.after_limit,
            },
        )
        .await,
    )
}

async fn rooms_context_before(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<EventContextPageBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::EventContextBefore {
                room_id: body.0.room_id,
                token: body.0.token,
                limit: body.0.limit,
            },
        )
        .await,
    )
}

async fn rooms_context_after(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<EventContextPageBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::EventContextAfter {
                room_id: body.0.room_id,
                token: body.0.token,
                limit: body.0.limit,
            },
        )
        .await,
    )
}

async fn rooms_join(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<JoinBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Join { room: body.0.room },
        )
        .await,
    )
}

async fn rooms_create(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<CreateBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Create {
                name: body.0.name,
                topic: body.0.topic,
            },
        )
        .await,
    )
}

async fn rooms_leave(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<RoomIdBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Leave {
                room_id: body.0.room_id,
            },
        )
        .await,
    )
}

async fn rooms_edit(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<EditBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Edit {
                room_id: body.0.room_id,
                event_id: body.0.event_id,
                body: body.0.body,
                formatted_body: body.0.formatted_body,
                mentions: body.0.mentions,
            },
        )
        .await,
    )
}

async fn rooms_react(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<ReactBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::React {
                room_id: body.0.room_id,
                event_id: body.0.event_id,
                key: body.0.key,
                shortcode: body.0.shortcode,
            },
        )
        .await,
    )
}

async fn rooms_read(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<ReadBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Read {
                room_id: body.0.room_id,
                event_id: body.0.event_id,
            },
        )
        .await,
    )
}

async fn get_profile(State(state): State<AppState>, headers: HeaderMap) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(dispatch(&user.handle, &user.mirror, Request::Profile).await)
}

async fn get_space_children(
    State(state): State<AppState>,
    headers: HeaderMap,
    Query(query): Query<MembersQuery>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::SpaceChildren {
                room_id: query.room_id,
            },
        )
        .await,
    )
}

async fn get_media(
    State(state): State<AppState>,
    headers: HeaderMap,
    Query(query): Query<MediaQuery>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    let request = Request::Avatar {
        mxc: query.mxc,
        size: query.size.unwrap_or(malice_core::media::AVATAR_SIZE),
    };
    match dispatch(&user.handle, &user.mirror, request).await {
        Ok(Reply::Avatar(source)) => {
            match tokio::task::spawn_blocking(move || source.render()).await {
                Ok((bytes, content_type)) => avatar_response(bytes, content_type),
                Err(_) => ApiError::new(
                    StatusCode::INTERNAL_SERVER_ERROR,
                    "avatar could not be rendered",
                )
                .into_response(),
            }
        }
        other => respond(other),
    }
}

async fn get_message_media(
    State(state): State<AppState>,
    headers: HeaderMap,
    Query(query): Query<MessageMediaQuery>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    // the declared mimetype is the sender's claim, so the bytes get sniffed instead
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Media {
                media_id: query.media_id,
                size: query.size,
            },
        )
        .await,
    )
}

async fn get_encryption(State(state): State<AppState>, headers: HeaderMap) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(dispatch(&user.handle, &user.mirror, Request::Encryption).await)
}

async fn recover_encryption(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<RecoverBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Recover {
                recovery_key: body.0.recovery_key,
            },
        )
        .await,
    )
}

async fn start_verification(State(state): State<AppState>, headers: HeaderMap) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(dispatch(&user.handle, &user.mirror, Request::StartVerification).await)
}

async fn verify_encryption(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<VerifyBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Verify {
                action: body.0.action,
            },
        )
        .await,
    )
}

async fn rooms_typing(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<TypingBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::Typing {
                room_id: body.0.room_id,
                typing: body.0.typing,
            },
        )
        .await,
    )
}

async fn get_account_data(
    State(state): State<AppState>,
    headers: HeaderMap,
    Query(query): Query<AccountDataQuery>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::GetAccountData {
                event_type: query.event_type,
            },
        )
        .await,
    )
}

async fn get_url_preview(
    State(state): State<AppState>,
    headers: HeaderMap,
    Query(query): Query<UrlPreviewQuery>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::UrlPreview {
                room_id: query.room_id,
                url: query.url,
            },
        )
        .await,
    )
}

async fn set_account_data(
    State(state): State<AppState>,
    headers: HeaderMap,
    body: axum::Json<AccountDataBody>,
) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    let body = body.0;
    respond(
        dispatch(
            &user.handle,
            &user.mirror,
            Request::SetAccountData {
                event_type: body.event_type,
                content: body.content,
            },
        )
        .await,
    )
}

async fn get_events(State(state): State<AppState>, headers: HeaderMap) -> Response {
    let (user, _) = match auth(&state, &headers).await {
        Ok(pair) => pair,
        Err(error) => return error.into_response(),
    };
    let body = subscribe(&user.mirror).map(|event| {
        let json = serde_json::to_string(&event).unwrap_or_else(|_| "{\"type\":\"error\"}".into());
        Ok::<_, std::convert::Infallible>(SseEvent::default().data(json))
    });
    Sse::new(body).into_response()
}

async fn get_health() -> Response {
    json_ok(&serde_json::json!({ "status": "ok" }), None)
}

async fn static_shell() -> Response {
    (
        StatusCode::SERVICE_UNAVAILABLE,
        axum::Json(serde_json::json!({ "message": "frontend assets missing; run npm --prefix web run build or use the Nix package" })),
    )
        .into_response()
}

pub fn router(state: AppState, web_dir: Option<String>) -> Router {
    let api = Router::new()
        .route("/session", get(get_session))
        .route("/login", post(post_login))
        .route("/logout", post(post_logout))
        .route("/rooms", get(get_rooms))
        .route("/events", get(get_events))
        .route("/health", get(get_health))
        .route("/rooms/open", post(rooms_open))
        .route("/rooms/close", post(rooms_close))
        .route("/rooms/send", post(rooms_send))
        .route("/rooms/paginate", post(rooms_paginate))
        .route("/rooms/context", post(rooms_context))
        .route("/rooms/context/before", post(rooms_context_before))
        .route("/rooms/context/after", post(rooms_context_after))
        .route(
            "/rooms/upload",
            post(rooms_upload).layer(DefaultBodyLimit::max(21 * 1024 * 1024)),
        )
        .route("/rooms/join", post(rooms_join))
        .route("/rooms/create", post(rooms_create))
        .route("/rooms/leave", post(rooms_leave))
        .route("/rooms/react", post(rooms_react))
        .route("/rooms/edit", post(rooms_edit))
        .route("/rooms/read", post(rooms_read))
        .route("/rooms/typing", post(rooms_typing))
        .route(
            "/account-data",
            get(get_account_data).post(set_account_data),
        )
        .route("/url-preview", get(get_url_preview))
        .route("/profile", get(get_profile))
        .route(
            "/profile/avatar",
            post(profile_avatar).layer(DefaultBodyLimit::max(10 * 1024 * 1024)),
        )
        .route("/command", post(post_command))
        .route(
            "/rooms/avatar",
            post(rooms_avatar).layer(DefaultBodyLimit::max(10 * 1024 * 1024)),
        )
        .route(
            "/media/upload",
            post(media_upload).layer(DefaultBodyLimit::max(10 * 1024 * 1024)),
        )
        .route("/media", get(get_media))
        .route("/message-media", get(get_message_media))
        .route("/spaces/children", get(get_space_children))
        .route("/rooms/members", get(get_members))
        .route("/encryption", get(get_encryption))
        .route("/encryption/recover", post(recover_encryption))
        .route("/encryption/start", post(start_verification))
        .route("/encryption/verify", post(verify_encryption));
    let api = Router::new()
        .nest("/api", api)
        .layer(middleware::from_fn(csrf_guard));
    let router = api.with_state(state).layer(TraceLayer::new_for_http());
    match web_dir {
        Some(dir) => {
            let files =
                ServeDir::new(&dir).not_found_service(ServeFile::new(format!("{dir}/index.html")));
            router.fallback_service(files)
        }
        None => router.fallback(static_shell),
    }
}