malice

public

Star0

Fork 0

Watch0

19 commits 2 branches 0 tags 0 releases4.4 MiB

Commit `7cca1d5628d1`

tarball

atagen <boss@atagen.co>2026-10-24 07:44 UTC

21 files changed+495-54

web: pin rooms, reorder the space rail and finish the command set

Pins are the m.favourite tag and rail order is MSC3230 space_order, so both round-trip with Element. A dragged order is shown from a local override until the next room summary carries matching orders, which avoids the rail snapping back while reorder_spaces is in flight. Mute and unmute leave the power-level policy to macltok mute_user, and its Forbidden error now reaches the UI as a 403 instead of a generic upstream failure.

Modified file: crates/malice-core/src/error.rs+2 additions@@ -4,6 +4,7 @@ use serde::Serialize;
 pub enum Failure {
     BadRequest,
     Unauthorized,
+    Forbidden,
     NotFound,
     Conflict,
     Busy,
@@ -55,6 +56,7 @@ impl From<macltok::Error> for CoreError {
                 Failure::NotFound
             }
             ErrorKind::MediaTooLarge => Failure::TooLarge,
+            ErrorKind::Forbidden => Failure::Forbidden,
             ErrorKind::Invalid | ErrorKind::EmptyBody => Failure::BadRequest,
             ErrorKind::RoomNotOpen
             | ErrorKind::TimelineNotOpen

Modified file: crates/malice-core/src/request.rs+116 additions−11 deletions@@ -44,7 +44,7 @@ pub enum Request {
         #[serde(default)]
         mentions: Vec<String>,
         #[serde(default)]
-        emote: bool,
+        kind: SendKind,
     },
     Edit {
         #[serde(default)]
@@ -194,6 +194,48 @@ pub enum Request {
         #[serde(default)]
         reason: Option<String>,
     },
+    SetFavourite {
+        room_id: String,
+        favourite: bool,
+    },
+    ReorderSpaces {
+        order: Vec<String>,
+    },
+    SetRoomDisplayName {
+        room_id: String,
+        #[serde(default)]
+        name: Option<String>,
+    },
+    SetRoomAvatar {
+        room_id: String,
+        #[serde(default)]
+        mxc: Option<String>,
+    },
+    UploadRoomAvatar {
+        room_id: String,
+        #[serde(skip)]
+        bytes: Vec<u8>,
+    },
+    Mute {
+        room_id: String,
+        user_id: String,
+        muted: bool,
+    },
+    Ignore {
+        user_id: String,
+    },
+    Unignore {
+        user_id: String,
+    },
+}
+
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum SendKind {
+    #[default]
+    Text,
+    Emote,
+    Notice,
 }
 
 pub enum Reply {
@@ -240,7 +282,7 @@ pub async fn dispatch(
             formatted_body,
             reply_to,
             mentions,
-            emote,
+            kind,
         } => {
             let room_id = parse_room_id(&room_id)?;
             if body.trim().is_empty() {
@@ -255,10 +297,11 @@ pub async fn dispatch(
             };
             let mentions = parse_mentions(&mentions)?;
             let content = match reply_to {
-                _ if emote => MessageContent::Emote {
+                _ if kind == SendKind::Emote => MessageContent::Emote {
                     content: text,
                     mentions,
                 },
+                _ if kind == SendKind::Notice => MessageContent::notice(text, mentions),
                 Some(event_id) => MessageContent::reply(parse_event_id(&event_id)?, text, mentions),
                 None => MessageContent::Text {
                     content: text,
@@ -595,14 +638,7 @@ pub async fn dispatch(
             Ok(Reply::Done)
         }
         Request::UploadAvatar { bytes } => {
-            if bytes.is_empty() || bytes.len() > 10 * 1024 * 1024 {
-                return Err(CoreError::bad_request(
-                    "avatar must be between 1 byte and 10 MiB",
-                ));
-            }
-            let Some(content_type) = image_content_type(&bytes) else {
-                return Err(CoreError::unsupported("avatar is not a supported image"));
-            };
+            let content_type = avatar_content_type(&bytes)?;
             handle.upload_avatar(content_type, bytes).await?;
             Ok(Reply::Done)
         }
@@ -630,7 +666,76 @@ pub async fn dispatch(
                 .await?;
             Ok(Reply::Done)
         }
+        Request::SetFavourite { room_id, favourite } => {
+            handle
+                .set_favourite(parse_room_id(&room_id)?, favourite)
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::ReorderSpaces { order } => {
+            if order.len() > 1000 {
+                return Err(CoreError::bad_request("too many spaces"));
+            }
+            let order = order
+                .iter()
+                .map(|id| parse_room_id(id))
+                .collect::<Result<Vec<_>, _>>()?;
+            handle.reorder_spaces(order).await?;
+            Ok(Reply::Done)
+        }
+        Request::SetRoomDisplayName { room_id, name } => {
+            let name = name.map(|n| n.trim().to_owned()).filter(|n| !n.is_empty());
+            if name.as_ref().is_some_and(|n| n.len() > 256) {
+                return Err(CoreError::bad_request("display name is too long"));
+            }
+            handle
+                .set_room_display_name(parse_room_id(&room_id)?, name)
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::SetRoomAvatar { room_id, mxc } => {
+            let mxc = mxc.as_deref().map(parse_mxc).transpose()?;
+            handle
+                .set_room_avatar(parse_room_id(&room_id)?, mxc)
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::UploadRoomAvatar { room_id, bytes } => {
+            let room_id = parse_room_id(&room_id)?;
+            let content_type = avatar_content_type(&bytes)?;
+            let mxc = handle.upload_media(content_type, bytes).await?;
+            handle.set_room_avatar(room_id, Some(mxc)).await?;
+            Ok(Reply::Done)
+        }
+        Request::Mute {
+            room_id,
+            user_id,
+            muted,
+        } => {
+            handle
+                .mute_user(parse_room_id(&room_id)?, parse_user_id(&user_id)?, muted)
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::Ignore { user_id } => {
+            handle.ignore_user(parse_user_id(&user_id)?).await?;
+            Ok(Reply::Done)
+        }
+        Request::Unignore { user_id } => {
+            handle.unignore_user(parse_user_id(&user_id)?).await?;
+            Ok(Reply::Done)
+        }
+    }
+}
+
+fn avatar_content_type(bytes: &[u8]) -> Result<&'static str, CoreError> {
+    if bytes.is_empty() || bytes.len() > 10 * 1024 * 1024 {
+        return Err(CoreError::bad_request(
+            "avatar must be between 1 byte and 10 MiB",
+        ));
     }
+    image_content_type(bytes)
+        .ok_or_else(|| CoreError::unsupported("avatar is not a supported image"))
 }
 
 // The spec's power level range is a canonical-JSON integer, which tops out at 2^53 - 1.

Modified file: crates/malice-server/src/error.rs+1

@@ -59,6 +59,7 @@ impl From<CoreError> for ApiError {

5959 let status = match error.kind {

6060 Failure::BadRequest => StatusCode::BAD_REQUEST,

6161 Failure::Unauthorized => StatusCode::UNAUTHORIZED,

62+ Failure::Forbidden => StatusCode::FORBIDDEN,

6263 Failure::NotFound => StatusCode::NOT_FOUND,

6364 Failure::Conflict => StatusCode::CONFLICT,

6465 Failure::Busy => StatusCode::TOO_MANY_REQUESTS,

Modified file: crates/malice-server/src/routes.rs+42 additions−3 deletions@@ -13,7 +13,7 @@ use macltok::Retain;
 use malice_core::{
     feed::subscribe,
     login::LoginInput,
-    request::{Reply, Request, dispatch},
+    request::{Reply, Request, SendKind, dispatch},
 };
 use serde::{Deserialize, Serialize};
 use tower_http::{
@@ -46,7 +46,7 @@ struct SendBody {
     #[serde(default)]
     mentions: Vec<String>,
     #[serde(default)]
-    emote: bool,
+    kind: SendKind,
 }
 
 #[derive(Debug, Deserialize)]
@@ -417,7 +417,7 @@ async fn rooms_send(
                 formatted_body: body.0.formatted_body,
                 reply_to: body.0.reply_to,
                 mentions: body.0.mentions,
-                emote: body.0.emote,
+                kind: body.0.kind,
             },
         )
         .await,
@@ -541,6 +541,13 @@ async fn post_command(
             | Request::Invite { .. }
             | Request::Direct { .. }
             | Request::Redact { .. }
+            | Request::SetFavourite { .. }
+            | Request::ReorderSpaces { .. }
+            | Request::SetRoomDisplayName { .. }
+            | Request::SetRoomAvatar { .. }
+            | Request::Mute { .. }
+            | Request::Ignore { .. }
+            | Request::Unignore { .. }
     ) {
         return ApiError::bad_request("op is not available as a command").into_response();
     }
@@ -568,6 +575,34 @@ async fn profile_avatar(
     )
 }
 
+#[derive(Debug, Deserialize)]
+struct RoomAvatarQuery {
+    room_id: String,
+}
+
+async fn rooms_avatar(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    Query(query): Query<RoomAvatarQuery>,
+    bytes: axum::body::Bytes,
+) -> Response {
+    let (user, _) = match auth(&state, &headers).await {
+        Ok(pair) => pair,
+        Err(error) => return error.into_response(),
+    };
+    respond(
+        dispatch(
+            &user.handle,
+            &user.mirror,
+            Request::UploadRoomAvatar {
+                room_id: query.room_id,
+                bytes: bytes.to_vec(),
+            },
+        )
+        .await,
+    )
+}
+
 async fn rooms_paginate(
     State(state): State<AppState>,
     headers: HeaderMap,
@@ -997,6 +1032,10 @@ pub fn router(state: AppState, web_dir: Option<String>) -> Router {
             post(profile_avatar).layer(DefaultBodyLimit::max(10 * 1024 * 1024)),
         )
         .route("/command", post(post_command))
+        .route(
+            "/rooms/avatar",
+            post(rooms_avatar).layer(DefaultBodyLimit::max(10 * 1024 * 1024)),
+        )
         .route("/media", get(get_media))
         .route("/message-media", get(get_message_media))
         .route("/spaces/children", get(get_space_children))

Modified file: crates/malice-worker/src/lib.rs+3 additions−2 deletions@@ -170,8 +170,9 @@ impl Host {
         };
         let mut request: Request = serde_json::from_str(&request_json)
             .map_err(|error| error_value("bad_request", error.to_string()))?;
-        if let Request::Upload { bytes: slot, .. } | Request::UploadAvatar { bytes: slot } =
-            &mut request
+        if let Request::Upload { bytes: slot, .. }
+        | Request::UploadAvatar { bytes: slot }
+        | Request::UploadRoomAvatar { bytes: slot, .. } = &mut request
         {
             *slot = bytes.map(|array| array.to_vec()).unwrap_or_default();
         }

Modified file: crates/malice-worker/src/wire.rs+1

@@ -15,6 +15,7 @@ pub fn failure_kind(failure: Failure) -> &'static str {

1515 match failure {

1616 Failure::BadRequest => "bad_request",

1717 Failure::Unauthorized => "unauthorized",

18+ Failure::Forbidden => "forbidden",

1819 Failure::NotFound => "not_found",

1920 Failure::Conflict => "conflict",

2021 Failure::Busy => "busy",

Modified file: web/src/App.svelte+135 additions−24 deletions@@ -3,6 +3,8 @@
   import LoginPanel from './lib/LoginPanel.svelte';
   import MessageRow from './lib/MessageRow.svelte';
   import MxcAvatar from './lib/MxcAvatar.svelte';
+  import PinButton from './lib/PinButton.svelte';
+  import { moveBefore, pinnedFirst, sortSpaces } from './lib/rail-order';
   import ImageLightbox from './lib/ImageLightbox.svelte';
   import { lightbox } from './lib/lightbox';
   import SecurityPanel from './lib/SecurityPanel.svelte';
@@ -26,6 +28,7 @@
     sendMessage,
     uploadAttachment,
     uploadAvatar,
+    uploadRoomAvatar,
     editMessage
   } from './lib/api';
   import { isKnownCommand, parseCommand, splitTarget, unescapeCommand } from './lib/commands';
@@ -93,6 +96,7 @@
   let composerEl: HTMLTextAreaElement | null = null;
   let fileInput: HTMLInputElement | null = null;
   let avatarInput: HTMLInputElement | null = null;
+  let avatarRoom: string | null = null;
   let uploadBusy = false;
   let uploadName: string | null = null;
   interface StagedAttachment {
@@ -139,6 +143,11 @@
   $: spaceRooms = $rooms.filter((r) => r.space);
   $: spaceParents = parentSpaceMap(spaceRooms);
   $: railSpaces = spaceRooms.filter((s) => !spaceParents.has(s.room_id));
+  let railOverride: string[] | null = null;
+  $: if (railOverride && sortSpaces(railSpaces, null).map((s) => s.room_id).join() === railOverride.join()) railOverride = null;
+  $: orderedRail = sortSpaces(railSpaces, railOverride);
+  $: pinnedRail = orderedRail.filter((s) => s.favourite);
+  $: otherRail = orderedRail.filter((s) => !s.favourite);
   $: railSelected = selectedSpaceId ? topSpaceOf(selectedSpaceId, spaceParents) : null;
   $: invites = $rooms.filter((r) => r.membership === 'Invited');
   $: query = search.trim().toLowerCase();
@@ -152,11 +161,9 @@
           r.name.toLowerCase().includes(query) || r.room_id.toLowerCase().includes(query)
       )
     : baseRooms;
-  $: directRooms = visibleRooms.filter((r) => r.direct && !r.space && r.membership !== 'Invited');
-  $: groupRooms = visibleRooms.filter(
-    (r) => !r.direct && !r.space && r.membership !== 'Invited'
-  );
-  $: spaceList = visibleRooms.filter((r) => r.space && r.membership !== 'Invited');
+  $: directRooms = pinnedFirst(visibleRooms.filter((r) => r.direct && !r.space && r.membership !== 'Invited'));
+  $: groupRooms = pinnedFirst(visibleRooms.filter((r) => !r.direct && !r.space && r.membership !== 'Invited'));
+  $: spaceList = pinnedFirst(visibleRooms.filter((r) => r.space && r.membership !== 'Invited'));
   $: channelRooms = baseRooms.filter((r) => !r.space && r.membership !== 'Invited');
   $: recoveryBanner = $encryption && ($encryption.recovery === 'Disabled' || $encryption.recovery === 'Incomplete') ? $encryption : null;
   $: verificationBanner = $verification && $verification.kind !== 'Done' ? $verification : null;
@@ -646,7 +653,8 @@
     try {
       switch (name) {
         case 'me':
-          await sendMessage(roomId, required('something to say'), null, mentions, $markdownEnabled, true);
+        case 'notice':
+          await sendMessage(roomId, required('something to say'), null, mentions, $markdownEnabled, name === 'me' ? 'emote' : 'notice');
           break;
         case 'msg': {
           const { user_id, rest } = target();
@@ -681,6 +689,27 @@
           await runCommand({ op: 'set_power_level', room_id: roomId, user_id, level });
           break;
         }
+        case 'mute':
+        case 'unmute':
+          await runCommand({ op: 'mute', room_id: roomId, user_id: target().user_id, muted: name === 'mute' });
+          break;
+        case 'ignore':
+        case 'unignore':
+          await runCommand({ op: name, user_id: target().user_id });
+          break;
+        case 'roomnick':
+          await runCommand({ op: 'set_room_display_name', room_id: roomId, name: args || null });
+          break;
+        case 'roomavatar':
+          if (!args) {
+            avatarRoom = roomId;
+            avatarInput?.click();
+          } else if (args.startsWith('mxc://')) {
+            await runCommand({ op: 'set_room_avatar', room_id: roomId, mxc: args });
+          } else {
+            throw new Error('/roomavatar takes an mxc:// link, or nothing to pick a file');
+          }
+          break;
         case 'delete': {
           const eventId = reply?.event_id ?? lastOwnEventId();
           if (!eventId) throw new Error('Nothing of yours to delete here');
@@ -693,6 +722,7 @@
           break;
         case 'globalavatar':
           if (!args) {
+            avatarRoom = null;
             avatarInput?.click();
           } else if (args.startsWith('mxc://')) {
             await runCommand({ op: 'set_avatar', mxc: args });
@@ -712,8 +742,12 @@
     if (avatarInput) avatarInput.value = '';
     if (!file) return;
     try {
-      await uploadAvatar(file);
-      await loadProfile();
+      if (avatarRoom) {
+        await uploadRoomAvatar(avatarRoom, file);
+      } else {
+        await uploadAvatar(file);
+        await loadProfile();
+      }
     } catch (e) {
       pushBanner(e instanceof Error ? e.message : 'Avatar upload failed');
     }
@@ -1088,6 +1122,55 @@
     return 'dot-off';
   }
 
+  let dragSpaceId: string | null = null;
+  let dropTarget: { id: string; after: boolean } | null = null;
+  let railMenu: { room: RoomSummary; x: number; y: number } | null = null;
+  let railMenuEl: HTMLDivElement | null = null;
+
+  async function togglePin(room: RoomSummary): Promise<void> {
+    railMenu = null;
+    try {
+      await runCommand({ op: 'set_favourite', room_id: room.room_id, favourite: !room.favourite });
+    } catch (e) {
+      pushBanner(e instanceof Error ? e.message : 'Could not change the pin');
+    }
+  }
+
+  function startRailDrag(ev: DragEvent, id: string): void {
+    dragSpaceId = id;
+    if (ev.dataTransfer) {
+      ev.dataTransfer.effectAllowed = 'move';
+      ev.dataTransfer.setData('text/plain', id);
+    }
+  }
+
+  function overRailSpace(ev: DragEvent, space: RoomSummary): void {
+    const dragged = orderedRail.find((s) => s.room_id === dragSpaceId);
+    if (!dragged || dragged.room_id === space.room_id || dragged.favourite !== space.favourite) return;
+    ev.preventDefault();
+    const rect = (ev.currentTarget as HTMLElement).getBoundingClientRect();
+    dropTarget = { id: space.room_id, after: ev.clientY > rect.top + rect.height / 2 };
+  }
+
+  async function dropRailSpace(): Promise<void> {
+    const moved = dragSpaceId;
+    const target = dropTarget;
+    dragSpaceId = null;
+    dropTarget = null;
+    if (!moved || !target) return;
+    const ids = orderedRail.map((s) => s.room_id);
+    const before = target.after ? (ids[ids.indexOf(target.id) + 1] ?? null) : target.id;
+    const order = moveBefore(ids, moved, before === moved ? null : before);
+    if (order.join() === ids.join()) return;
+    railOverride = order;
+    try {
+      await runCommand({ op: 'reorder_spaces', order });
+    } catch (e) {
+      railOverride = null;
+      pushBanner(e instanceof Error ? e.message : 'Could not reorder spaces');
+    }
+  }
+
   let roomMenuOpen = false;
   let roomMenuEl: HTMLDivElement | null = null;
 
@@ -1098,11 +1181,13 @@
 
   function closeRoomMenuOutside(ev: PointerEvent): void {
     if (roomMenuOpen && !roomMenuEl?.contains(ev.target as Node)) roomMenuOpen = false;
+    if (railMenu && !railMenuEl?.contains(ev.target as Node)) railMenu = null;
   }
 
   function onKeydown(ev: KeyboardEvent): void {
     if (ev.key === 'Escape') {
       if (roomMenuOpen) roomMenuOpen = false;
+      else if (railMenu) railMenu = null;
       else if (dialog) dialog = null;
       else if (membersOpen && window.innerWidth < 1100) membersOpen = false;
       else if (sidebarOpen) sidebarOpen = false;
@@ -1149,19 +1234,33 @@
       >
         <span aria-hidden="true">⌂</span>
       </button>
-      <div class="rail-sep" aria-hidden="true"></div>
-      {#each railSpaces as space (space.room_id)}
-        <button
-          type="button"
-          class="rail-btn rail-space"
-          class:active={railSelected === space.room_id}
-          title={space.name}
-          aria-label={`Show channels in space ${space.name}`}
-          aria-pressed={selectedSpaceId === space.room_id}
-          on:click={() => void selectSpace(space.room_id)}
-        >
-          <MxcAvatar mxc={space.avatar} label={space.name} size={44} shape="rounded" />
-        </button>
+      {#each [pinnedRail, otherRail] as group}
+        {#if group.length > 0}
+          <div class="rail-sep" aria-hidden="true"></div>
+        {/if}
+        {#each group as space (space.room_id)}
+          <button
+            type="button"
+            class="rail-btn rail-space"
+            class:active={railSelected === space.room_id}
+            class:drop-before={dropTarget?.id === space.room_id && !dropTarget.after}
+            class:drop-after={dropTarget?.id === space.room_id && dropTarget.after}
+            class:pinned={space.favourite}
+            title={space.name}
+            aria-label={`Show channels in space ${space.name}`}
+            aria-pressed={selectedSpaceId === space.room_id}
+            draggable="true"
+            on:click={() => void selectSpace(space.room_id)}
+            on:contextmenu|preventDefault={(ev) => (railMenu = { room: space, x: ev.clientX, y: ev.clientY })}
+            on:dragstart={(ev) => startRailDrag(ev, space.room_id)}
+            on:dragover={(ev) => overRailSpace(ev, space)}
+            on:dragleave={() => dropTarget?.id === space.room_id && (dropTarget = null)}
+            on:drop|preventDefault={() => void dropRailSpace()}
+            on:dragend={() => ((dragSpaceId = null), (dropTarget = null))}
+          >
+            <MxcAvatar mxc={space.avatar} label={space.name} size={44} shape="rounded" />
+          </button>
+        {/each}
       {/each}
       <button
         type="button"
@@ -1175,6 +1274,15 @@
       </button>
     </nav>
 
+    {#if railMenu}
+      {@const menuRoom = railMenu.room}
+      <div class="room-menu rail-menu" role="menu" style={`left:${railMenu.x}px;top:${railMenu.y}px`} bind:this={railMenuEl}>
+        <button type="button" role="menuitem" on:click={() => void togglePin(menuRoom)}>
+          {menuRoom.favourite ? 'Unpin' : 'Pin to top'}
+        </button>
+      </div>
+    {/if}
+
     <aside class="sidebar" class:open={sidebarOpen} aria-label="Rooms">
       <div class="side-search">
         <label class="visually-hidden" for="room-search">Search rooms</label>
@@ -1284,7 +1392,7 @@
               <h2 class="side-h">Direct messages</h2>
               <ul class="room-list">
                 {#each directRooms as room (room.room_id)}
-                  <li>
+                  <li class="room-item">
                     <button
                       type="button"
                       class="room-row"
@@ -1304,6 +1412,7 @@
                         </span>
                       {/if}
                     </button>
+                    <PinButton pinned={room.favourite} label={room.name} onToggle={() => void togglePin(room)} />
                   </li>
                 {/each}
               </ul>
@@ -1313,7 +1422,7 @@
               <h2 class="side-h">{selectedSpace ? 'Channels' : 'Rooms'}</h2>
               <ul class="room-list">
                 {#each groupRooms as room (room.room_id)}
-                  <li>
+                  <li class="room-item">
                     <button
                       type="button"
                       class="room-row"
@@ -1334,6 +1443,7 @@
                         </span>
                       {/if}
                     </button>
+                    <PinButton pinned={room.favourite} label={room.name} onToggle={() => void togglePin(room)} />
                   </li>
                 {/each}
               </ul>
@@ -1343,7 +1453,7 @@
               <h2 class="side-h">{selectedSpace ? 'Subspaces' : 'Spaces'}</h2>
               <ul class="room-list">
                 {#each spaceList as room (room.room_id)}
-                  <li>
+                  <li class="room-item">
                     <button
                       type="button"
                       class="room-row"
@@ -1355,6 +1465,7 @@
                       <span class="room-hash" aria-hidden="true">◇</span>
                       <span class="room-name">{room.name}</span>
                     </button>
+                    <PinButton pinned={room.favourite} label={room.name} onToggle={() => void togglePin(room)} />
                   </li>
                 {/each}
               </ul>

Modified file: web/src/app.css+5 additions@@ -287,6 +287,11 @@ input, textarea { font: inherit; }
   font-size: 13.5px;
 }
 .room-row:hover { background: var(--panel-2); }
+.room-item { display: flex; align-items: center; gap: 2px; }
+.room-item > .room-row { flex: 1; min-width: 0; }
+.rail-space.drop-before { box-shadow: 0 -6px 0 -3px var(--accent); }
+.rail-space.drop-after { box-shadow: 0 6px 0 -3px var(--accent); }
+.rail-menu { position: fixed; top: 0; right: auto; z-index: 70; }
 .room-row.active { background: color-mix(in srgb, var(--accent) 20%, transparent); }
 .room-row:focus-visible { outline: 2px solid var(--accent); outline-offset: -2px; }
 .room-hash { color: var(--muted); }

Modified file: web/src/lib/ImageLightbox.svelte+19 additions@@ -3,6 +3,19 @@
   import { lightbox } from './lightbox';
 
   let closeBtn: HTMLButtonElement | null = null;
+  let copied = false;
+  let copiedTimer: number | null = null;
+
+  async function copyMxc(mxc: string): Promise<void> {
+    try {
+      await navigator.clipboard.writeText(mxc);
+    } catch {
+      return;
+    }
+    copied = true;
+    if (copiedTimer !== null) window.clearTimeout(copiedTimer);
+    copiedTimer = window.setTimeout(() => (copied = false), 1500);
+  }
   let returnFocus: HTMLElement | null = null;
 
   $: if ($lightbox) void focusClose();
@@ -34,6 +47,12 @@
   <div class="lightbox" role="dialog" tabindex="-1" aria-modal="true" aria-label={$lightbox.filename} on:click|self={close}>
     <div class="lightbox-bar">
       <span class="lightbox-name">{$lightbox.filename}</span>
+      {#if $lightbox.mxc}
+        {@const mxc = $lightbox.mxc}
+        <button type="button" class="ghost-btn" title={mxc} on:click={() => void copyMxc(mxc)}>
+          {copied ? 'Copied' : 'Copy mxc'}
+        </button>
+      {/if}
       <a class="ghost-btn" href={$lightbox.src} target="_blank" rel="noopener noreferrer">Open original</a>
       <a class="ghost-btn" href={$lightbox.src} download={$lightbox.filename}>Download</a>
       <button type="button" class="icon-btn" aria-label="Close image" title="Close (Esc)" bind:this={closeBtn} on:click={close}>

Modified file: web/src/lib/MediaAttachmentView.svelte+1−1

@@ -22,7 +22,7 @@

2222 function openLightbox(ev: MouseEvent): void {

2323 if (ev.button !== 0 || ev.ctrlKey || ev.metaKey || ev.shiftKey || ev.altKey) return;

2424 ev.preventDefault();

25- lightbox.set({ src: fullUrl, alt: attachment.caption || attachment.filename, filename: attachment.filename });

+    lightbox.set({ src: fullUrl, alt: attachment.caption || attachment.filename, filename: attachment.filename, mxc: attachment.mxc });

2626 }

2727

2828 function sizeLabel(): string {

Added file: web/src/lib/PinButton.svelte+45 additions@@ -0,0 +1,45 @@
+<script lang="ts">
+  export let pinned: boolean;
+  export let label: string;
+  export let onToggle: () => void;
+</script>
+
+<button
+  type="button"
+  class="pin-btn"
+  class:pinned
+  aria-pressed={pinned}
+  aria-label={pinned ? `Unpin ${label}` : `Pin ${label}`}
+  title={pinned ? 'Unpin' : 'Pin'}
+  on:click={onToggle}
+>
+  <svg viewBox="0 0 24 24" width="14" height="14" aria-hidden="true">
+    <path
+      d="M9 3h6l-1 6 4 4v2h-5v6l-1 1-1-1v-6H6v-2l4-4z"
+      fill={pinned ? 'currentColor' : 'none'}
+      stroke="currentColor"
+      stroke-width="1.8"
+      stroke-linejoin="round"
+    />
+  </svg>
+</button>
+
+<style>
+  .pin-btn {
+    flex: none;
+    display: grid;
+    place-items: center;
+    width: 24px;
+    height: 24px;
+    padding: 0;
+    border: none;
+    border-radius: 6px;
+    background: transparent;
+    color: var(--muted);
+    cursor: pointer;
+    opacity: 0;
+  }
+  .pin-btn.pinned { opacity: 1; color: var(--accent); }
+  .pin-btn:hover { background: var(--hover); color: var(--text); }
+  :global(.room-item:hover) .pin-btn, :global(.room-item:focus-within) .pin-btn, .pin-btn:focus-visible { opacity: 1; }
+</style>

Modified file: web/src/lib/api.ts+4 additions−3 deletions@@ -4,7 +4,7 @@ import type { MemberSummary, RoomSummary } from './types';
 import { formatBody } from './markdown';
 import { mentionedUserIds, type Mention } from './mentions';
 import { HttpTransport } from './transport-http';
-import type { CommandRequest, SessionInfo, Transport, VerifyAction } from './transport';
+import type { CommandRequest, SendKind, SessionInfo, Transport, VerifyAction } from './transport';
 import { createDeviceTransport } from 'malice:device-transport';
 
 export { ApiError } from './transport';
@@ -41,10 +41,11 @@ export const sendMessage = (
   reply_to: string | null = null,
   mentions: Mention[] = [],
   markdown = false,
-  emote = false
-) => transport.sendMessage(room_id, body, formatBody(body, mentions, markdown), reply_to, mentionedUserIds(mentions), emote);
+  kind: SendKind = 'text'
+) => transport.sendMessage(room_id, body, formatBody(body, mentions, markdown), reply_to, mentionedUserIds(mentions), kind);
 export const runCommand = (request: CommandRequest) => transport.command(request);
 export const uploadAvatar = (file: File) => transport.uploadAvatar(file);
+export const uploadRoomAvatar = (room_id: string, file: File) => transport.uploadRoomAvatar(room_id, file);
 export const paginateRoom = (room_id: string) => transport.paginateRoom(room_id);
 export const setTyping = (room_id: string, typing: boolean) => transport.setTyping(room_id, typing);
 export const getAccountData = (eventType: string) => transport.getAccountData(eventType);

Modified file: web/src/lib/commands.ts+7 additions@@ -7,6 +7,7 @@ export interface ParsedCommand {
 
 export const COMMANDS = [
   'me',
+  'notice',
   'msg',
   'join',
   'leave',
@@ -16,8 +17,14 @@ export const COMMANDS = [
   'ban',
   'unban',
   'powerlevel',
+  'mute',
+  'unmute',
+  'ignore',
+  'unignore',
   'delete',
+  'roomnick',
   'globalnick',
+  'roomavatar',
   'globalavatar'
 ] as const;
 export type CommandName = (typeof COMMANDS)[number];

Modified file: web/src/lib/lightbox.ts+1

@@ -4,6 +4,7 @@ export interface LightboxImage {

44 src: string;

55 alt: string;

66 filename: string;

7+ mxc: string | null;

78 }

910 export const lightbox = writable<LightboxImage | null>(null);

Added file: web/src/lib/rail-order.ts+44 additions@@ -0,0 +1,44 @@
+interface Orderable {
+  room_id: string;
+  space_order: string | null;
+}
+
+interface Pinnable {
+  favourite: boolean;
+}
+
+function byCodeUnit(a: string, b: string): number {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+/** MSC3230: spaces with an order first, compared by code unit, then the rest by room id. */
+export function compareSpaceOrder(a: Orderable, b: Orderable): number {
+  if (a.space_order !== null && b.space_order !== null) {
+    return byCodeUnit(a.space_order, b.space_order) || byCodeUnit(a.room_id, b.room_id);
+  }
+  if (a.space_order !== null) return -1;
+  if (b.space_order !== null) return 1;
+  return byCodeUnit(a.room_id, b.room_id);
+}
+
+export function sortSpaces<T extends Orderable>(spaces: T[], override: string[] | null): T[] {
+  if (override) {
+    const rank = new Map(override.map((id, i) => [id, i]));
+    return [...spaces].sort(
+      (a, b) => (rank.get(a.room_id) ?? Infinity) - (rank.get(b.room_id) ?? Infinity) || compareSpaceOrder(a, b)
+    );
+  }
+  return [...spaces].sort(compareSpaceOrder);
+}
+
+export function pinnedFirst<T extends Pinnable>(list: T[]): T[] {
+  return [...list.filter((r) => r.favourite), ...list.filter((r) => !r.favourite)];
+}
+
+/** `ids` with `moved` placed just before `before`, or at the end when `before` is null. */
+export function moveBefore(ids: string[], moved: string, before: string | null): string[] {
+  const rest = ids.filter((id) => id !== moved);
+  const at = before === null ? rest.length : rest.indexOf(before);
+  if (at < 0) return ids;
+  return [...rest.slice(0, at), moved, ...rest.slice(at)];
+}

Modified file: web/src/lib/transport-http.ts+13 additions−3 deletions@@ -1,5 +1,5 @@
 import type { MemberSummary, RoomSummary } from './types';
-import { ApiError, type CommandRequest, type SessionInfo, type Transport, type UploadExtras, type VerifyAction } from './transport';
+import { ApiError, type CommandRequest, type SendKind, type SessionInfo, type Transport, type UploadExtras, type VerifyAction } from './transport';
 
 async function parseFailure(res: Response, fallback: string): Promise<never> {
   let message = fallback;
@@ -96,9 +96,9 @@ export class HttpTransport implements Transport {
     formatted_body: string | null,
     reply_to: string | null,
     mentions: string[],
-    emote = false
+    kind: SendKind = 'text'
   ): Promise<void> {
-    return this.roomCommand(ROOM_COMMAND_PATHS.send, { room_id, body, formatted_body, reply_to, mentions, emote });
+    return this.roomCommand(ROOM_COMMAND_PATHS.send, { room_id, body, formatted_body, reply_to, mentions, kind });
   }
   paginateRoom(room_id: string): Promise<void> {
     return this.roomCommand(ROOM_COMMAND_PATHS.paginate, { room_id });
@@ -238,6 +238,16 @@ export class HttpTransport implements Transport {
     return json(res, 'Avatar upload failed');
   }
 
+  async uploadRoomAvatar(room_id: string, file: File): Promise<void> {
+    const res = await fetch(`/api/rooms/avatar?room_id=${encodeURIComponent(room_id)}`, {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': file.type || 'application/octet-stream' },
+      body: file
+    });
+    return json(res, 'Avatar upload failed');
+  }
+
   async uploadAttachment(room_id: string, file: File, extras: UploadExtras): Promise<void> {
     const form = new FormData();
     form.append('room_id', room_id);

Modified file: web/src/lib/transport-worker.ts+7 additions−3 deletions@@ -1,5 +1,5 @@
 import type { MemberSummary, RoomSummary } from './types';
-import { ApiError, type CommandRequest, type SessionInfo, type SoftLogout, type Transport, type UploadExtras, type VerifyAction } from './transport';
+import { ApiError, type CommandRequest, type SendKind, type SessionInfo, type SoftLogout, type Transport, type UploadExtras, type VerifyAction } from './transport';
 import { statusForKind } from './wire-status';
 
 function toApiError(error: { kind: string; message: string }): ApiError {
@@ -222,9 +222,9 @@ export class WorkerTransport implements Transport {
     formatted_body: string | null,
     reply_to: string | null,
     mentions: string[],
-    emote = false
+    kind: SendKind = 'text'
   ): Promise<void> {
-    return this.client.call('send', { room_id, body, formatted_body, reply_to, mentions, emote });
+    return this.client.call('send', { room_id, body, formatted_body, reply_to, mentions, kind });
   }
   paginateRoom(room_id: string): Promise<void> {
     return this.client.call('paginate', { room_id });
@@ -289,6 +289,10 @@ export class WorkerTransport implements Transport {
     await this.client.call('upload_avatar', {}, await file.arrayBuffer());
   }
 
+  async uploadRoomAvatar(room_id: string, file: File): Promise<void> {
+    await this.client.call('upload_room_avatar', { room_id }, await file.arrayBuffer());
+  }
+
   async uploadAttachment(room_id: string, file: File, extras: UploadExtras): Promise<void> {
     const bytes = await file.arrayBuffer();
     await this.client.call(

Modified file: web/src/lib/transport.ts+11 additions−2 deletions@@ -28,7 +28,15 @@ export type CommandRequest =
   | { op: 'set_avatar'; mxc: string | null }
   | { op: 'invite'; room_id: string; user_id: string }
   | { op: 'direct'; user_id: string }
-  | { op: 'redact'; room_id: string; event_id: string; reason: string | null };
+  | { op: 'redact'; room_id: string; event_id: string; reason: string | null }
+  | { op: 'set_favourite'; room_id: string; favourite: boolean }
+  | { op: 'reorder_spaces'; order: string[] }
+  | { op: 'set_room_display_name'; room_id: string; name: string | null }
+  | { op: 'set_room_avatar'; room_id: string; mxc: string | null }
+  | { op: 'mute'; room_id: string; user_id: string; muted: boolean }
+  | { op: 'ignore' | 'unignore'; user_id: string };
+
+export type SendKind = 'text' | 'emote' | 'notice';
 
 export interface UploadExtras {
   caption: string | null;
@@ -57,7 +65,7 @@ export interface Transport {
     formatted_body: string | null,
     reply_to: string | null,
     mentions: string[],
-    emote?: boolean
+    kind?: SendKind
   ): Promise<void>;
   paginateRoom(room_id: string): Promise<void>;
   setTyping(room_id: string, typing: boolean): Promise<void>;
@@ -81,6 +89,7 @@ export interface Transport {
   /** A core request with no bytes, as `{ op, ...fields }`. */
   command(request: CommandRequest): Promise<unknown>;
   uploadAvatar(file: File): Promise<void>;
+  uploadRoomAvatar(room_id: string, file: File): Promise<void>;
   /**
    * Wire events as raw JSON text, snapshot first. Returns an unsubscribe
    * function. onDisconnect fires whenever the underlying connection drops;

Modified file: web/src/lib/types.ts+6 additions−2 deletions@@ -40,6 +40,7 @@ export interface RoomSummary {
   inviter: string | null;
   parent_spaces: string[];
   children: string[];
+  space_order: string | null;
 }
 
 export interface MemberSummary {
@@ -112,6 +113,7 @@ export interface MediaAttachment {
   duration_ms: number | null;
   blurhash: string | null;
   has_thumbnail: boolean;
+  mxc: string | null;
 }
 
 export function parseMediaAttachment(raw: unknown): MediaAttachment | null {
@@ -130,7 +132,8 @@ export function parseMediaAttachment(raw: unknown): MediaAttachment | null {
     height: optionalNumber(raw, 'height'),
     duration_ms: optionalNumber(raw, 'duration_ms'),
     blurhash: optionalString(raw, 'blurhash'),
-    has_thumbnail: raw['has_thumbnail'] === true
+    has_thumbnail: raw['has_thumbnail'] === true,
+    mxc: optionalString(raw, 'mxc')
   };
 }
 
@@ -360,7 +363,8 @@ export function parseRoomSummary(raw: unknown): RoomSummary | null {
     successor: optionalString(raw, 'successor'),
     inviter: optionalString(raw, 'inviter'),
     parent_spaces: stringList(raw['parent_spaces']),
-    children: stringList(raw['children'])
+    children: stringList(raw['children']),
+    space_order: optionalString(raw, 'space_order')
   };
 }
 

Modified file: web/src/lib/wire-status.ts+1

@@ -8,6 +8,7 @@ export const STATUS_BY_KIND: Record<string, number> = {

88 engine_stopped: 502,

99 upstream: 502,

1010 unauthorized: 401,

11+ forbidden: 403,

1112 store_in_use: 409

1213 };

1314

Added file: web/test/rail-order.test.ts+31 additions@@ -0,0 +1,31 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { moveBefore, pinnedFirst, sortSpaces } from '../src/lib/rail-order.ts';
+
+const space = (room_id: string, space_order: string | null) => ({ room_id, space_order });
+
+test('orders spaces the MSC3230 way', () => {
+  const spaces = [space('!d', null), space('!c', 'b'), space('!b', null), space('!a', 'a'), space('!e', 'b')];
+  assert.deepEqual(sortSpaces(spaces, null).map((s) => s.room_id), ['!a', '!c', '!e', '!b', '!d']);
+});
+
+test('a local override wins until the server catches up', () => {
+  const spaces = [space('!a', 'a'), space('!b', 'b'), space('!c', null)];
+  assert.deepEqual(sortSpaces(spaces, ['!c', '!a', '!b']).map((s) => s.room_id), ['!c', '!a', '!b']);
+});
+
+test('moves an id before another or to the end', () => {
+  assert.deepEqual(moveBefore(['a', 'b', 'c', 'd'], 'd', 'b'), ['a', 'd', 'b', 'c']);
+  assert.deepEqual(moveBefore(['a', 'b', 'c'], 'a', null), ['b', 'c', 'a']);
+  assert.deepEqual(moveBefore(['a', 'b'], 'a', 'zz'), ['a', 'b']);
+});
+
+test('pinned rooms come first and keep their relative order', () => {
+  const rooms = [
+    { id: 1, favourite: false },
+    { id: 2, favourite: true },
+    { id: 3, favourite: false },
+    { id: 4, favourite: true }
+  ];
+  assert.deepEqual(pinnedFirst(rooms).map((r) => r.id), [2, 4, 1, 3]);
+});

malice

Commit 7cca1d5628d1

Commit `7cca1d5628d1`