Phase 9: application services and admin completion

Implements PLAN.md Phase 9. internal/appservice reads registration files
(appservice.config_files), matches namespaces the way Synapse does
(anchored at the start), and delivers events to each service as
transactions read from the roomserver's event stream at a cursor kept in
appservice_state. A transaction in flight is recorded, so after a restart
it is resent under the same ID; failures back off from 2s to 5m, and a
successful ping cuts the backoff short.

In the Client-Server API an as_token acts as the service's sender or, with
?user_id=, as any existing user in its namespace. Services register and
log in their users with m.login.application_service; exclusive user and
alias namespaces are refused to everybody else with M_EXCLUSIVE. Unknown
aliases and users in a namespace are asked of the service first. The
ping endpoint reports M_URL_NOT_SET, M_BAD_STATUS, M_CONNECTION_FAILED
and M_CONNECTION_TIMEOUT. Services' own requests, and their users' when
rate_limited is false, skip the rate limiter.

Users can change their password (POST /account/password) and deactivate
their account (POST /account/deactivate), both behind the password.
Deactivation revokes tokens, deletes devices, optionally erases the
profile and leaves every room through a new userapi.AccountObserver.

The admin API is complete: user detail, the admin flag, deactivation and
reactivation, password resets, devices, media quotas
(media.max_user_storage_bytes plus per-user overrides), registration
tokens with use limits and expiry (registration.require_token), server
notices (internal/servernotices, server_notices.*), an editor for the
federation allow/deny lists persisted in server_settings, a delivery view
of the application services, and an audit log of every change.

Migration 0011 adds the registration token, server notice room, media
quota, audit log and appservice cursor tables. Policy lists are now
returned sorted. The Complement entrypoint loads the registrations
Complement mounts in /complement/appservice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/clientapi/register.go

@@ -11,6 +11,10 @@ import (
 
 // registerRequest is the body of POST /register.
 type registerRequest struct {
+	// Type is m.login.application_service for an application service
+	// registering one of its users, and otherwise absent.
+	Type string `json:"type"`
+
 	Username string `json:"username"`
 	Password string `json:"password"`
 
@@ -65,6 +69,12 @@ func (c *ClientAPI) handleRegister(w http.ResponseWriter, r *http.Request) error
 		return httputil.InvalidParam("Unknown registration kind %q", kind)
 	}
 
+	// An application service registering one of its users is not a
+	// sign-up: it needs neither the registration switch nor the flow.
+	if req.Type == loginAppService || (req.Auth != nil && req.Auth.Type == loginAppService) {
+		return c.registerAppServiceUser(w, r, req)
+	}
+
 	if !c.settings.RegistrationEnabled() {
 		return httputil.Forbidden("Registration is disabled on this server")
 	}
@@ -81,10 +91,16 @@ func (c *ClientAPI) handleRegister(w http.ResponseWriter, r *http.Request) error
 		if taken {
 			return httputil.UserInUse()
 		}
+		if err := c.checkExclusiveUser(c.users.UserID(localpart), ""); err != nil {
+			return err
+		}
 	}
 
 	flows := c.registrationFlows()
-	sessionID, done, err := c.beginOrAdvanceUIA(w, flows, req.Auth, c.registrationStage)
+	sessionID, done, err := c.beginOrAdvanceUIA(w, flows, req.Auth,
+		func(stage string, auth *uiaRequest) (*httputil.MatrixError, error) {
+			return c.registrationStage(r, stage, auth)
+		})
 	if err != nil || !done {
 		return err
 	}
@@ -111,10 +127,30 @@ func (c *ClientAPI) handleRegister(w http.ResponseWriter, r *http.Request) error
 		}
 	}
 
+	// The token is spent now that an account is about to exist, not when
+	// the stage was passed: a sign-up abandoned halfway costs no use. A
+	// token that ran out in between is refused here.
+	release := func() {}
+	if c.regTokens.Required() {
+		var token string
+		if session := c.uia.get(sessionID); session != nil {
+			token = session.registrationToken
+		}
+		release, err = c.regTokens.Spend(r.Context(), token)
+		switch {
+		case errors.Is(err, userapi.ErrNoSuchRegistrationToken):
+			c.uia.remove(sessionID)
+			return httputil.Forbidden("The registration token is no longer valid")
+		case err != nil:
+			return err
+		}
+	}
+
 	if _, err := c.users.CreateAccount(r.Context(), userapi.NewAccountRequest{
 		Localpart: localpart,
 		Password:  req.Password,
 	}); err != nil {
+		release()
 		switch {
 		case errors.Is(err, userapi.ErrUserExists):
 			// Lost the race against another registration of the same name
@@ -167,14 +203,14 @@ func (c *ClientAPI) handleRegister(w http.ResponseWriter, r *http.Request) error
 // interactive, and a server with no real requirements still has to offer
 // something for the client to complete.
 func (c *ClientAPI) registrationFlows() []uiaFlow {
-	if c.registration.RequiresToken() {
+	if c.regTokens.Required() {
 		return []uiaFlow{{Stages: []string{stageRegistrationToken, stageDummy}}}
 	}
 	return []uiaFlow{{Stages: []string{stageDummy}}}
 }
 
 // registrationStage checks one stage of the registration flow.
-func (c *ClientAPI) registrationStage(stage string, auth *uiaRequest) (*httputil.MatrixError, error) {
+func (c *ClientAPI) registrationStage(r *http.Request, stage string, auth *uiaRequest) (*httputil.MatrixError, error) {
 	switch stage {
 	case stageDummy:
 		return nil, nil
@@ -182,9 +218,14 @@ func (c *ClientAPI) registrationStage(stage string, auth *uiaRequest) (*httputil
 		if auth.Token == "" {
 			return httputil.MissingParam("A registration token is required"), nil
 		}
-		if !c.registration.TokenValid(auth.Token) {
+		valid, err := c.regTokens.Valid(r.Context(), auth.Token)
+		if err != nil {
+			return nil, err
+		}
+		if !valid {
 			return httputil.Forbidden("Invalid registration token"), nil
 		}
+		c.uia.setRegistrationToken(auth.Session, auth.Token)
 		return nil, nil
 	default:
 		// beginOrAdvanceUIA only calls this for stages it offered, so
@@ -212,6 +253,9 @@ func (c *ClientAPI) handleRegisterAvailable(w http.ResponseWriter, r *http.Reque
 	if taken {
 		return httputil.UserInUse()
 	}
+	if err := c.checkExclusiveUser(c.users.UserID(localpart), ""); err != nil {
+		return err
+	}
 
 	httputil.WriteJSON(w, http.StatusOK, map[string]bool{"available": true})
 	return nil
@@ -226,7 +270,78 @@ func (c *ClientAPI) handleRegistrationTokenValidity(w http.ResponseWriter, r *ht
 	if token == "" {
 		return httputil.MissingParam("The token query parameter is required")
 	}
-	httputil.WriteJSON(w, http.StatusOK, map[string]bool{"valid": c.registration.TokenValid(token)})
+	valid, err := c.regTokens.Valid(r.Context(), token)
+	if err != nil {
+		return err
+	}
+	httputil.WriteJSON(w, http.StatusOK, map[string]bool{"valid": valid})
+	return nil
+}
+
+// registerAppServiceUser registers a user for the application service
+// whose token the request carries.
+//
+// The user has to be in the service's user namespace. There is no
+// password: an application service's users are only ever used through
+// the service, which needs none, or through an m.login.application_service
+// login, which needs the service's token rather than a password.
+func (c *ClientAPI) registerAppServiceUser(w http.ResponseWriter, r *http.Request, req registerRequest) error {
+	token := accessTokenFrom(r)
+	if token == "" {
+		return httputil.MissingToken()
+	}
+	svc := c.appservices.Registry().ByToken(token)
+	if svc == nil {
+		return httputil.UnknownToken(false)
+	}
+	if req.Username == "" {
+		return httputil.MissingParam("An application service has to name the user it registers")
+	}
+	localpart := userapi.NormaliseLocalpart(req.Username)
+	if err := userapi.ValidateLocalpart(localpart, c.serverName); err != nil {
+		return httputil.InvalidUsername("%s", err.Error())
+	}
+	userID := c.users.UserID(localpart)
+	if !svc.OwnsUser(userID) {
+		return httputil.Exclusive("%s is not in the namespace of application service %s", userID, svc.ID)
+	}
+	if req.DeviceID != "" {
+		if err := userapi.ValidateDeviceID(req.DeviceID); err != nil {
+			return httputil.InvalidParam("%s", err.Error())
+		}
+	}
+
+	_, err := c.users.CreateAccount(r.Context(), userapi.NewAccountRequest{Localpart: localpart})
+	switch {
+	case errors.Is(err, userapi.ErrUserExists):
+		return httputil.UserInUse()
+	case errors.Is(err, userapi.ErrInvalidLocalpart):
+		return httputil.InvalidUsername("%s", err.Error())
+	case err != nil:
+		return err
+	}
+
+	resp := registerResponse{UserID: userID, HomeServer: c.serverName}
+	if req.InhibitLogin {
+		httputil.WriteJSON(w, http.StatusOK, resp)
+		return nil
+	}
+	session, err := c.users.CreateSession(r.Context(), userapi.SessionRequest{
+		Localpart:        localpart,
+		DeviceID:         req.DeviceID,
+		DisplayName:      req.InitialDeviceDisplayName,
+		WithRefreshToken: req.RefreshToken,
+		IP:               c.clientIP(r),
+		UserAgent:        r.UserAgent(),
+	})
+	if err != nil {
+		return err
+	}
+	resp.AccessToken = session.AccessToken
+	resp.DeviceID = session.DeviceID
+	resp.RefreshToken = session.RefreshToken
+	resp.ExpiresInMS = session.ExpiresInMS
+	httputil.WriteJSON(w, http.StatusOK, resp)
 	return nil
 }