malice

public

Star0

Fork 0

Watch0

17 commits 2 branches 0 tags 0 releases4.4 MiB

Commit `e4c64c36f105`

tarball

atagen <boss@atagen.co>2026-10-24 07:36 UTC

11 files changed+529-17

web: add slash commands for messaging, moderation and your profile

Commands go through a single /api/command route that accepts the core request JSON for an allowlisted set of ops, so each new operation needs no hand-written handler. Targets resolve by matrix id or the longest matching display name in the room, refusing ambiguous names rather than guessing. Avatar uploads take raw bytes on their own route and the server sniffs the image type instead of trusting the client mimetype.

Modified file: crates/malice-core/src/parse.rs+17 additions−1 deletions@@ -1,5 +1,5 @@
 use macltok::MessageMentions;
-use macltok::ruma::{OwnedEventId, OwnedRoomId, OwnedRoomOrAliasId, OwnedUserId};
+use macltok::ruma::{OwnedEventId, OwnedMxcUri, OwnedRoomId, OwnedRoomOrAliasId, OwnedUserId};
 
 use crate::error::CoreError;
 
@@ -27,6 +27,22 @@ pub fn parse_room_or_alias(raw: &str) -> Result<OwnedRoomOrAliasId, CoreError> {
     OwnedRoomOrAliasId::try_from(trimmed).map_err(|_| CoreError::bad_request("invalid room"))
 }
 
+pub fn parse_user_id(raw: &str) -> Result<OwnedUserId, CoreError> {
+    let trimmed = raw.trim();
+    if trimmed.is_empty() {
+        return Err(CoreError::bad_request("user_id is required"));
+    }
+    OwnedUserId::try_from(trimmed).map_err(|_| CoreError::bad_request("invalid user_id"))
+}
+
+pub fn parse_mxc(raw: &str) -> Result<OwnedMxcUri, CoreError> {
+    let mxc = OwnedMxcUri::from(raw.trim());
+    if !mxc.is_valid() {
+        return Err(CoreError::bad_request("invalid mxc URI"));
+    }
+    Ok(mxc)
+}
+
 pub fn parse_mentions(raw: &[String]) -> Result<MessageMentions, CoreError> {
     if raw.len() > 100 {
         return Err(CoreError::bad_request("too many mentions"));

Modified file: crates/malice-core/src/request.rs+176 additions−1 deletions@@ -10,7 +10,10 @@ use serde_json::json;
 use crate::{
     error::CoreError,
     media::{AVATAR_SIZE, THUMBNAIL_SIZE, attachment_content_type, image_content_type},
-    parse::{parse_event_id, parse_mentions, parse_room_id, parse_room_or_alias},
+    parse::{
+        parse_event_id, parse_mentions, parse_mxc, parse_room_id, parse_room_or_alias,
+        parse_user_id,
+    },
 };
 
 #[derive(Debug, Deserialize)]
@@ -40,6 +43,8 @@ pub enum Request {
         reply_to: Option<String>,
         #[serde(default)]
         mentions: Vec<String>,
+        #[serde(default)]
+        emote: bool,
     },
     Edit {
         #[serde(default)]
@@ -141,6 +146,54 @@ pub enum Request {
         #[serde(default)]
         url: String,
     },
+    Kick {
+        room_id: String,
+        user_id: String,
+        #[serde(default)]
+        reason: Option<String>,
+    },
+    Ban {
+        room_id: String,
+        user_id: String,
+        #[serde(default)]
+        reason: Option<String>,
+    },
+    Unban {
+        room_id: String,
+        user_id: String,
+        #[serde(default)]
+        reason: Option<String>,
+    },
+    SetPowerLevel {
+        room_id: String,
+        user_id: String,
+        level: i64,
+    },
+    SetDisplayName {
+        #[serde(default)]
+        name: Option<String>,
+    },
+    SetAvatar {
+        #[serde(default)]
+        mxc: Option<String>,
+    },
+    UploadAvatar {
+        #[serde(skip)]
+        bytes: Vec<u8>,
+    },
+    Invite {
+        room_id: String,
+        user_id: String,
+    },
+    Direct {
+        user_id: String,
+    },
+    Redact {
+        room_id: String,
+        event_id: String,
+        #[serde(default)]
+        reason: Option<String>,
+    },
 }
 
 pub enum Reply {
@@ -187,6 +240,7 @@ pub async fn dispatch(
             formatted_body,
             reply_to,
             mentions,
+            emote,
         } => {
             let room_id = parse_room_id(&room_id)?;
             if body.trim().is_empty() {
@@ -201,6 +255,10 @@ pub async fn dispatch(
             };
             let mentions = parse_mentions(&mentions)?;
             let content = match reply_to {
+                _ if emote => MessageContent::Emote {
+                    content: text,
+                    mentions,
+                },
                 Some(event_id) => MessageContent::reply(parse_event_id(&event_id)?, text, mentions),
                 None => MessageContent::Text {
                     content: text,
@@ -468,7 +526,124 @@ pub async fn dispatch(
                 .map_err(|_| CoreError::bad_request("preview is not valid json"))?;
             Ok(Reply::Json(value))
         }
+        Request::Kick {
+            room_id,
+            user_id,
+            reason,
+        } => {
+            handle
+                .kick_user(
+                    parse_room_id(&room_id)?,
+                    parse_user_id(&user_id)?,
+                    reason_text(reason)?,
+                )
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::Ban {
+            room_id,
+            user_id,
+            reason,
+        } => {
+            handle
+                .ban_user(
+                    parse_room_id(&room_id)?,
+                    parse_user_id(&user_id)?,
+                    reason_text(reason)?,
+                )
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::Unban {
+            room_id,
+            user_id,
+            reason,
+        } => {
+            handle
+                .unban_user(
+                    parse_room_id(&room_id)?,
+                    parse_user_id(&user_id)?,
+                    reason_text(reason)?,
+                )
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::SetPowerLevel {
+            room_id,
+            user_id,
+            level,
+        } => {
+            if !(-MAX_POWER_LEVEL..=MAX_POWER_LEVEL).contains(&level) {
+                return Err(CoreError::bad_request("power level is out of range"));
+            }
+            handle
+                .set_user_power_level(parse_room_id(&room_id)?, parse_user_id(&user_id)?, level)
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::SetDisplayName { name } => {
+            let name = name.map(|n| n.trim().to_owned()).filter(|n| !n.is_empty());
+            if name.as_ref().is_some_and(|n| n.len() > 256) {
+                return Err(CoreError::bad_request("display name is too long"));
+            }
+            handle.set_display_name(name).await?;
+            Ok(Reply::Done)
+        }
+        Request::SetAvatar { mxc } => {
+            let mxc = mxc.as_deref().map(parse_mxc).transpose()?;
+            handle.set_avatar(mxc).await?;
+            Ok(Reply::Done)
+        }
+        Request::UploadAvatar { bytes } => {
+            if bytes.is_empty() || bytes.len() > 10 * 1024 * 1024 {
+                return Err(CoreError::bad_request(
+                    "avatar must be between 1 byte and 10 MiB",
+                ));
+            }
+            let Some(content_type) = image_content_type(&bytes) else {
+                return Err(CoreError::unsupported("avatar is not a supported image"));
+            };
+            handle.upload_avatar(content_type, bytes).await?;
+            Ok(Reply::Done)
+        }
+        Request::Invite { room_id, user_id } => {
+            handle
+                .invite_user(parse_room_id(&room_id)?, parse_user_id(&user_id)?)
+                .await?;
+            Ok(Reply::Done)
+        }
+        Request::Direct { user_id } => {
+            let room_id = handle.create_direct(parse_user_id(&user_id)?).await?;
+            Ok(Reply::Json(json!({ "room_id": room_id })))
+        }
+        Request::Redact {
+            room_id,
+            event_id,
+            reason,
+        } => {
+            handle
+                .redact(
+                    TimelineId::Room(parse_room_id(&room_id)?),
+                    parse_event_id(&event_id)?,
+                    reason_text(reason)?,
+                )
+                .await?;
+            Ok(Reply::Done)
+        }
+    }
+}
+
+// The spec's power level range is a canonical-JSON integer, which tops out at 2^53 - 1.
+const MAX_POWER_LEVEL: i64 = (1 << 53) - 1;
+
+fn reason_text(reason: Option<String>) -> Result<Option<String>, CoreError> {
+    let reason = reason
+        .map(|r| r.trim().to_owned())
+        .filter(|r| !r.is_empty());
+    if reason.as_ref().is_some_and(|r| r.len() > 1024) {
+        return Err(CoreError::bad_request("reason is too long"));
     }
+    Ok(reason)
 }
 
 fn parse_media_id(media_id: String) -> Result<MediaId, CoreError> {

Modified file: crates/malice-server/src/routes.rs+58 additions@@ -45,6 +45,8 @@ struct SendBody {
     reply_to: Option<String>,
     #[serde(default)]
     mentions: Vec<String>,
+    #[serde(default)]
+    emote: bool,
 }
 
 #[derive(Debug, Deserialize)]
@@ -415,6 +417,7 @@ async fn rooms_send(
                 formatted_body: body.0.formatted_body,
                 reply_to: body.0.reply_to,
                 mentions: body.0.mentions,
+                emote: body.0.emote,
             },
         )
         .await,
@@ -515,6 +518,56 @@ async fn rooms_upload(
     )
 }
 
+/// Ops added after the per-route handlers, taken as the core request JSON. Anything
+/// carrying bytes or reading state stays on its own route.
+async fn post_command(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    body: axum::Json<Request>,
+) -> Response {
+    let (user, _) = match auth(&state, &headers).await {
+        Ok(pair) => pair,
+        Err(error) => return error.into_response(),
+    };
+    let request = body.0;
+    if !matches!(
+        request,
+        Request::Kick { .. }
+            | Request::Ban { .. }
+            | Request::Unban { .. }
+            | Request::SetPowerLevel { .. }
+            | Request::SetDisplayName { .. }
+            | Request::SetAvatar { .. }
+            | Request::Invite { .. }
+            | Request::Direct { .. }
+            | Request::Redact { .. }
+    ) {
+        return ApiError::bad_request("op is not available as a command").into_response();
+    }
+    respond(dispatch(&user.handle, &user.mirror, request).await)
+}
+
+async fn profile_avatar(
+    State(state): State<AppState>,
+    headers: HeaderMap,
+    bytes: axum::body::Bytes,
+) -> Response {
+    let (user, _) = match auth(&state, &headers).await {
+        Ok(pair) => pair,
+        Err(error) => return error.into_response(),
+    };
+    respond(
+        dispatch(
+            &user.handle,
+            &user.mirror,
+            Request::UploadAvatar {
+                bytes: bytes.to_vec(),
+            },
+        )
+        .await,
+    )
+}
+
 async fn rooms_paginate(
     State(state): State<AppState>,
     headers: HeaderMap,
@@ -939,6 +992,11 @@ pub fn router(state: AppState, web_dir: Option<String>) -> Router {
         )
         .route("/url-preview", get(get_url_preview))
         .route("/profile", get(get_profile))
+        .route(
+            "/profile/avatar",
+            post(profile_avatar).layer(DefaultBodyLimit::max(10 * 1024 * 1024)),
+        )
+        .route("/command", post(post_command))
         .route("/media", get(get_media))
         .route("/message-media", get(get_message_media))
         .route("/spaces/children", get(get_space_children))

Modified file: crates/malice-worker/src/lib.rs+3 additions−1 deletions@@ -170,7 +170,9 @@ impl Host {
         };
         let mut request: Request = serde_json::from_str(&request_json)
             .map_err(|error| error_value("bad_request", error.to_string()))?;
-        if let Request::Upload { bytes: slot, .. } = &mut request {
+        if let Request::Upload { bytes: slot, .. } | Request::UploadAvatar { bytes: slot } =
+            &mut request
+        {
             *slot = bytes.map(|array| array.to_vec()).unwrap_or_default();
         }
         match dispatch(&handle, &mirror, request).await {

Modified file: web/src/App.svelte+123 additions−4 deletions@@ -22,9 +22,14 @@
     openRoom,
     paginateRoom,
     reactToMessage,
+    runCommand,
+    sendMessage,
     uploadAttachment,
+    uploadAvatar,
     editMessage
   } from './lib/api';
+  import { isKnownCommand, parseCommand, splitTarget, unescapeCommand } from './lib/commands';
+  import type { ParsedCommand } from './lib/commands';
   import {
     banners,
     blocked,
@@ -87,6 +92,7 @@
   let timelineEl: HTMLElement | null = null;
   let composerEl: HTMLTextAreaElement | null = null;
   let fileInput: HTMLInputElement | null = null;
+  let avatarInput: HTMLInputElement | null = null;
   let uploadBusy = false;
   let uploadName: string | null = null;
   interface StagedAttachment {
@@ -590,24 +596,129 @@
       return;
     }
     if (attachments.length > 0 && uploadBusy) return;
+    const command = attachments.length === 0 ? parseCommand(body) : null;
+    if (command && !isKnownCommand(command.name)) {
+      pushBanner(`Unknown command /${command.name}`);
+      return;
+    }
     composer = '';
     if (roomId in drafts) delete drafts[roomId];
     stickToBottom = true;
     const reply = replyingTo;
     replyingTo = null;
-    const mentions = resolveMentions(body, pickedMentions[roomId] ?? []);
+    const text = unescapeCommand(body);
+    const mentions = resolveMentions(text, pickedMentions[roomId] ?? []);
     pickedMentions = { ...pickedMentions, [roomId]: [] };
     mentionQuery = null;
-    if (attachments.length === 0) {
-      queueSend(roomId, body, reply, mentions, $markdownEnabled);
+    if (command) {
+      void execute(roomId, command, reply, mentions);
+    } else if (attachments.length === 0) {
+      queueSend(roomId, text, reply, mentions, $markdownEnabled);
     } else {
       const { [roomId]: _sent, ...rest } = staged;
       staged = rest;
-      void sendAttachments(roomId, body, reply, mentions, attachments);
+      void sendAttachments(roomId, text, reply, mentions, attachments);
     }
     composerEl?.focus();
   }
 
+  function lastOwnEventId(): string | null {
+    for (let i = items.length - 1; i >= 0; i -= 1) {
+      const entry = items[i];
+      if (entry.kind === 'event' && entry.event.own && entry.event.event_id && entry.event.content.kind !== 'Redacted') {
+        return entry.event.event_id;
+      }
+    }
+    return null;
+  }
+
+  async function execute(roomId: string, command: ParsedCommand, reply: ReplyReference | null, mentions: Mention[]): Promise<void> {
+    const { name, args } = command;
+    const target = () => {
+      const found = splitTarget(args, Object.values(people));
+      if ('error' in found) throw new Error(found.error);
+      return found;
+    };
+    const required = (what: string) => {
+      if (!args) throw new Error(`/${name} needs ${what}`);
+      return args;
+    };
+    try {
+      switch (name) {
+        case 'me':
+          await sendMessage(roomId, required('something to say'), null, mentions, $markdownEnabled, true);
+          break;
+        case 'msg': {
+          const { user_id, rest } = target();
+          const res = (await runCommand({ op: 'direct', user_id })) as { room_id: string };
+          await refreshRooms();
+          await selectRoom(res.room_id);
+          if (rest) queueSend(res.room_id, rest, null, [], $markdownEnabled);
+          break;
+        }
+        case 'join':
+          await join(required('a room id or alias'));
+          break;
+        case 'leave':
+          await leave();
+          break;
+        case 'invite':
+          await runCommand({ op: 'invite', room_id: roomId, user_id: target().user_id });
+          break;
+        case 'disinvite':
+        case 'kick':
+        case 'ban':
+        case 'unban': {
+          const { user_id, rest } = target();
+          const op = name === 'disinvite' ? 'kick' : name;
+          await runCommand({ op, room_id: roomId, user_id, reason: rest || null });
+          break;
+        }
+        case 'powerlevel': {
+          const { user_id, rest } = target();
+          const level = Number(rest);
+          if (!rest || !Number.isInteger(level)) throw new Error('/powerlevel needs a whole number after the name');
+          await runCommand({ op: 'set_power_level', room_id: roomId, user_id, level });
+          break;
+        }
+        case 'delete': {
+          const eventId = reply?.event_id ?? lastOwnEventId();
+          if (!eventId) throw new Error('Nothing of yours to delete here');
+          await runCommand({ op: 'redact', room_id: roomId, event_id: eventId, reason: args || null });
+          break;
+        }
+        case 'globalnick':
+          await runCommand({ op: 'set_display_name', name: required('a name') });
+          await loadProfile();
+          break;
+        case 'globalavatar':
+          if (!args) {
+            avatarInput?.click();
+          } else if (args.startsWith('mxc://')) {
+            await runCommand({ op: 'set_avatar', mxc: args });
+            await loadProfile();
+          } else {
+            throw new Error('/globalavatar takes an mxc:// link, or nothing to pick a file');
+          }
+          break;
+      }
+    } catch (e) {
+      pushBanner(e instanceof Error ? e.message : `/${name} failed`);
+    }
+  }
+
+  async function onAvatarChosen(): Promise<void> {
+    const file = avatarInput?.files?.[0];
+    if (avatarInput) avatarInput.value = '';
+    if (!file) return;
+    try {
+      await uploadAvatar(file);
+      await loadProfile();
+    } catch (e) {
+      pushBanner(e instanceof Error ? e.message : 'Avatar upload failed');
+    }
+  }
+
   async function sendAttachments(
     roomId: string,
     body: string,
@@ -1634,6 +1745,14 @@
               aria-label="Attach a file"
               on:change={() => void onFileChosen()}
             />
+            <input
+              type="file"
+              accept="image/*"
+              bind:this={avatarInput}
+              class="visually-hidden"
+              aria-label="Choose a new avatar"
+              on:change={() => void onAvatarChosen()}
+            />
             <button
               type="button"
               class="ghost-btn"

Modified file: web/src/lib/api.ts+6 additions−3 deletions@@ -4,7 +4,7 @@ import type { MemberSummary, RoomSummary } from './types';
 import { formatBody } from './markdown';
 import { mentionedUserIds, type Mention } from './mentions';
 import { HttpTransport } from './transport-http';
-import type { SessionInfo, Transport, VerifyAction } from './transport';
+import type { CommandRequest, SessionInfo, Transport, VerifyAction } from './transport';
 import { createDeviceTransport } from 'malice:device-transport';
 
 export { ApiError } from './transport';
@@ -40,8 +40,11 @@ export const sendMessage = (
   body: string,
   reply_to: string | null = null,
   mentions: Mention[] = [],
-  markdown = false
-) => transport.sendMessage(room_id, body, formatBody(body, mentions, markdown), reply_to, mentionedUserIds(mentions));
+  markdown = false,
+  emote = false
+) => transport.sendMessage(room_id, body, formatBody(body, mentions, markdown), reply_to, mentionedUserIds(mentions), emote);
+export const runCommand = (request: CommandRequest) => transport.command(request);
+export const uploadAvatar = (file: File) => transport.uploadAvatar(file);
 export const paginateRoom = (room_id: string) => transport.paginateRoom(room_id);
 export const setTyping = (room_id: string, typing: boolean) => transport.setTyping(room_id, typing);
 export const getAccountData = (eventType: string) => transport.getAccountData(eventType);

Added file: web/src/lib/commands.ts+67 additions@@ -0,0 +1,67 @@
+import type { Person } from './types';
+
+export interface ParsedCommand {
+  name: string;
+  args: string;
+}
+
+export const COMMANDS = [
+  'me',
+  'msg',
+  'join',
+  'leave',
+  'invite',
+  'disinvite',
+  'kick',
+  'ban',
+  'unban',
+  'powerlevel',
+  'delete',
+  'globalnick',
+  'globalavatar'
+] as const;
+export type CommandName = (typeof COMMANDS)[number];
+
+/** A leading `/word`, or null for plain text. `//text` sends `/text` as a message. */
+export function parseCommand(text: string): ParsedCommand | null {
+  const match = /^\/([a-z]+)(?:\s+([\s\S]*))?$/i.exec(text.trim());
+  if (!match) return null;
+  return { name: match[1].toLowerCase(), args: (match[2] ?? '').trim() };
+}
+
+export function isKnownCommand(name: string): name is CommandName {
+  return (COMMANDS as readonly string[]).includes(name);
+}
+
+export function unescapeCommand(text: string): string {
+  return text.startsWith('//') ? text.slice(1) : text;
+}
+
+export type Target = { user_id: string; rest: string } | { error: string };
+
+/** The user an argument string starts with, by matrix id or by a known display name. */
+export function splitTarget(args: string, people: Person[]): Target {
+  if (!args) return { error: 'Name someone' };
+  if (args.startsWith('@')) {
+    const [id, ...rest] = args.split(/\s+/);
+    if (/^@[^:\s]+:\S+$/.test(id)) return { user_id: id, rest: rest.join(' ') };
+  }
+  const lower = args.toLowerCase();
+  let best: Person[] = [];
+  let bestLength = 0;
+  for (const person of people) {
+    const name = person.name.toLowerCase();
+    if (!name || name.length < bestLength) continue;
+    if (lower !== name && !lower.startsWith(`${name} `)) continue;
+    if (name.length > bestLength) {
+      best = [person];
+      bestLength = name.length;
+    } else {
+      best.push(person);
+    }
+  }
+  const ids = [...new Set(best.map((p) => p.user_id))];
+  if (ids.length === 0) return { error: `No one here is called ${args.split(/\s+/)[0]}` };
+  if (ids.length > 1) return { error: `Several people are called ${best[0].name}, use their @id` };
+  return { user_id: ids[0], rest: args.slice(bestLength).trim() };
+}

Modified file: web/src/lib/transport-http.ts+24 additions−3 deletions@@ -1,5 +1,5 @@
 import type { MemberSummary, RoomSummary } from './types';
-import { ApiError, type SessionInfo, type Transport, type UploadExtras, type VerifyAction } from './transport';
+import { ApiError, type CommandRequest, type SessionInfo, type Transport, type UploadExtras, type VerifyAction } from './transport';
 
 async function parseFailure(res: Response, fallback: string): Promise<never> {
   let message = fallback;
@@ -95,9 +95,10 @@ export class HttpTransport implements Transport {
     body: string,
     formatted_body: string | null,
     reply_to: string | null,
-    mentions: string[]
+    mentions: string[],
+    emote = false
   ): Promise<void> {
-    return this.roomCommand(ROOM_COMMAND_PATHS.send, { room_id, body, formatted_body, reply_to, mentions });
+    return this.roomCommand(ROOM_COMMAND_PATHS.send, { room_id, body, formatted_body, reply_to, mentions, emote });
   }
   paginateRoom(room_id: string): Promise<void> {
     return this.roomCommand(ROOM_COMMAND_PATHS.paginate, { room_id });
@@ -217,6 +218,26 @@ export class HttpTransport implements Transport {
     return json(res, 'Verification action failed');
   }
 
+  async command(request: CommandRequest): Promise<unknown> {
+    const res = await fetch('/api/command', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(request)
+    });
+    return json(res, 'Command failed');
+  }
+
+  async uploadAvatar(file: File): Promise<void> {
+    const res = await fetch('/api/profile/avatar', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': file.type || 'application/octet-stream' },
+      body: file
+    });
+    return json(res, 'Avatar upload failed');
+  }
+
   async uploadAttachment(room_id: string, file: File, extras: UploadExtras): Promise<void> {
     const form = new FormData();
     form.append('room_id', room_id);

Modified file: web/src/lib/transport-worker.ts+12 additions−3 deletions@@ -1,5 +1,5 @@
 import type { MemberSummary, RoomSummary } from './types';
-import { ApiError, type SessionInfo, type SoftLogout, type Transport, type UploadExtras, type VerifyAction } from './transport';
+import { ApiError, type CommandRequest, type SessionInfo, type SoftLogout, type Transport, type UploadExtras, type VerifyAction } from './transport';
 import { statusForKind } from './wire-status';
 
 function toApiError(error: { kind: string; message: string }): ApiError {
@@ -221,9 +221,10 @@ export class WorkerTransport implements Transport {
     body: string,
     formatted_body: string | null,
     reply_to: string | null,
-    mentions: string[]
+    mentions: string[],
+    emote = false
   ): Promise<void> {
-    return this.client.call('send', { room_id, body, formatted_body, reply_to, mentions });
+    return this.client.call('send', { room_id, body, formatted_body, reply_to, mentions, emote });
   }
   paginateRoom(room_id: string): Promise<void> {
     return this.client.call('paginate', { room_id });
@@ -280,6 +281,14 @@ export class WorkerTransport implements Transport {
     return this.client.call('verify', { action });
   }
 
+  command({ op, ...fields }: CommandRequest): Promise<unknown> {
+    return this.client.call(op, fields);
+  }
+
+  async uploadAvatar(file: File): Promise<void> {
+    await this.client.call('upload_avatar', {}, await file.arrayBuffer());
+  }
+
   async uploadAttachment(room_id: string, file: File, extras: UploadExtras): Promise<void> {
     const bytes = await file.arrayBuffer();
     await this.client.call(

Modified file: web/src/lib/transport.ts+14 additions−1 deletions@@ -21,6 +21,15 @@ export interface SessionInfo {
   blocked?: boolean;
 }
 
+export type CommandRequest =
+  | { op: 'kick' | 'ban' | 'unban'; room_id: string; user_id: string; reason: string | null }
+  | { op: 'set_power_level'; room_id: string; user_id: string; level: number }
+  | { op: 'set_display_name'; name: string | null }
+  | { op: 'set_avatar'; mxc: string | null }
+  | { op: 'invite'; room_id: string; user_id: string }
+  | { op: 'direct'; user_id: string }
+  | { op: 'redact'; room_id: string; event_id: string; reason: string | null };
+
 export interface UploadExtras {
   caption: string | null;
   formatted_caption: string | null;
@@ -47,7 +56,8 @@ export interface Transport {
     body: string,
     formatted_body: string | null,
     reply_to: string | null,
-    mentions: string[]
+    mentions: string[],
+    emote?: boolean
   ): Promise<void>;
   paginateRoom(room_id: string): Promise<void>;
   setTyping(room_id: string, typing: boolean): Promise<void>;
@@ -68,6 +78,9 @@ export interface Transport {
   startVerification(): Promise<void>;
   verifyEncryption(action: VerifyAction): Promise<void>;
   uploadAttachment(room_id: string, file: File, extras: UploadExtras): Promise<void>;
+  /** A core request with no bytes, as `{ op, ...fields }`. */
+  command(request: CommandRequest): Promise<unknown>;
+  uploadAvatar(file: File): Promise<void>;
   /**
    * Wire events as raw JSON text, snapshot first. Returns an unsubscribe
    * function. onDisconnect fires whenever the underlying connection drops;

Added file: web/test/commands.test.ts+29 additions@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { isKnownCommand, parseCommand, splitTarget, unescapeCommand } from '../src/lib/commands.ts';
+
+const people = [
+  { user_id: '@alice:example.org', name: 'Alice Liddell', avatar: null },
+  { user_id: '@al:example.org', name: 'Alice', avatar: null },
+  { user_id: '@bob:example.org', name: 'Bob', avatar: null },
+  { user_id: '@bob2:example.org', name: 'Bob', avatar: null }
+];
+
+test('parses a leading command and leaves text alone', () => {
+  assert.deepEqual(parseCommand('/kick  Bob  being rude '), { name: 'kick', args: 'Bob  being rude' });
+  assert.deepEqual(parseCommand('/leave'), { name: 'leave', args: '' });
+  assert.equal(parseCommand('hello /kick'), null);
+  assert.equal(parseCommand('//kick bob'), null);
+  assert.equal(unescapeCommand('//kick bob'), '/kick bob');
+  assert.equal(isKnownCommand('kick'), true);
+  assert.equal(isKnownCommand('shrug'), false);
+});
+
+test('finds targets by id or the longest display name', () => {
+  assert.deepEqual(splitTarget('@carol:example.org 50', people), { user_id: '@carol:example.org', rest: '50' });
+  assert.deepEqual(splitTarget('Alice Liddell spam', people), { user_id: '@alice:example.org', rest: 'spam' });
+  assert.deepEqual(splitTarget('alice', people), { user_id: '@al:example.org', rest: '' });
+  assert.ok('error' in splitTarget('Bob', people));
+  assert.ok('error' in splitTarget('Zed', people));
+  assert.ok('error' in splitTarget('', people));
+});

malice

Commit e4c64c36f105

Commit `e4c64c36f105`