Phase 9: application services and admin completion

Implements PLAN.md Phase 9. internal/appservice reads registration files
(appservice.config_files), matches namespaces the way Synapse does
(anchored at the start), and delivers events to each service as
transactions read from the roomserver's event stream at a cursor kept in
appservice_state. A transaction in flight is recorded, so after a restart
it is resent under the same ID; failures back off from 2s to 5m, and a
successful ping cuts the backoff short.

In the Client-Server API an as_token acts as the service's sender or, with
?user_id=, as any existing user in its namespace. Services register and
log in their users with m.login.application_service; exclusive user and
alias namespaces are refused to everybody else with M_EXCLUSIVE. Unknown
aliases and users in a namespace are asked of the service first. The
ping endpoint reports M_URL_NOT_SET, M_BAD_STATUS, M_CONNECTION_FAILED
and M_CONNECTION_TIMEOUT. Services' own requests, and their users' when
rate_limited is false, skip the rate limiter.

Users can change their password (POST /account/password) and deactivate
their account (POST /account/deactivate), both behind the password.
Deactivation revokes tokens, deletes devices, optionally erases the
profile and leaves every room through a new userapi.AccountObserver.

The admin API is complete: user detail, the admin flag, deactivation and
reactivation, password resets, devices, media quotas
(media.max_user_storage_bytes plus per-user overrides), registration
tokens with use limits and expiry (registration.require_token), server
notices (internal/servernotices, server_notices.*), an editor for the
federation allow/deny lists persisted in server_settings, a delivery view
of the application services, and an audit log of every change.

Migration 0011 adds the registration token, server notice room, media
quota, audit log and appservice cursor tables. Policy lists are now
returned sorted. The Complement entrypoint loads the registrations
Complement mounts in /complement/appservice.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/internal/mediaapi/http.go

@@ -185,6 +185,11 @@ func HTTPError(err error) error {
 		return httputil.NotFound("Media not found")
 	case errors.Is(err, ErrTooLarge):
 		return httputil.NewError(http.StatusRequestEntityTooLarge, httputil.ErrCodeTooLarge, "Media is larger than this server allows")
+	case errors.Is(err, ErrQuotaExceeded):
+		// M_TOO_LARGE rather than a code of its own: every client already
+		// tells the user an upload was too big, and that is what it was.
+		return httputil.NewError(http.StatusRequestEntityTooLarge, httputil.ErrCodeTooLarge,
+			"This upload would take you over your media quota")
 	case errors.Is(err, ErrNotYetUploaded):
 		return httputil.NewError(http.StatusGatewayTimeout, httputil.ErrCodeNotYetUploaded, "Media has not been uploaded yet")
 	case errors.Is(err, ErrCannotOverwrite):

server/internal/mediaapi/mediaapi.go

@@ -40,6 +40,10 @@ var (
 	// ErrTooLarge means content is larger than media.max_upload_bytes.
 	ErrTooLarge = errors.New("media is too large")
 
+	// ErrQuotaExceeded means the upload would take the user past their
+	// media quota.
+	ErrQuotaExceeded = errors.New("media quota exceeded")
+
 	// ErrNotYetUploaded means the media ID was reserved and its content
 	// has not arrived within the time the request was willing to wait.
 	ErrNotYetUploaded = errors.New("media has not been uploaded yet")
@@ -325,9 +329,24 @@ func (a *API) UploadTo(ctx context.Context, origin, mediaID string, up Upload) e
 }
 
 // storeContent writes an upload's body to the blob store.
+//
+// The user's quota is applied by lowering the limit the content is
+// written with to what the quota has left, so an upload that would go
+// over is cut off as it arrives rather than stored and then refused. Two
+// uploads racing for the last of a quota can both get in; a quota is a
+// bound on what a user keeps here, not an accounting system.
 func (a *API) storeContent(ctx context.Context, up Upload) (storage.MediaContent, error) {
-	blob, err := a.blobs.Put(ctx, up.Body, a.cfg.MaxUploadBytes)
+	limit, quotaBound, err := a.uploadLimit(ctx, up.UserID)
+	if err != nil {
+		return storage.MediaContent{}, err
+	}
+	if limit <= 0 {
+		return storage.MediaContent{}, ErrQuotaExceeded
+	}
+	blob, err := a.blobs.Put(ctx, up.Body, limit)
 	switch {
+	case errors.Is(err, storage.ErrBlobTooLarge) && quotaBound:
+		return storage.MediaContent{}, ErrQuotaExceeded
 	case errors.Is(err, storage.ErrBlobTooLarge):
 		return storage.MediaContent{}, ErrTooLarge
 	case err != nil:
@@ -341,6 +360,63 @@ func (a *API) storeContent(ctx context.Context, up Upload) (storage.MediaContent
 	}, nil
 }
 
+// uploadLimit is the most one upload by a user may be: the server's
+// upload limit, or what is left of the user's quota if that is less, in
+// which case quotaBound is set.
+func (a *API) uploadLimit(ctx context.Context, userID string) (limit int64, quotaBound bool, err error) {
+	quota, err := a.Quota(ctx, userID)
+	if err != nil {
+		return 0, false, err
+	}
+	if quota.MaxBytes == 0 {
+		return a.cfg.MaxUploadBytes, false, nil
+	}
+	left := quota.MaxBytes - quota.Usage.Bytes
+	if left < a.cfg.MaxUploadBytes {
+		return left, true, nil
+	}
+	return a.cfg.MaxUploadBytes, false, nil
+}
+
+// Quota is a user's media quota and what they are using of it.
+type Quota struct {
+	Usage storage.MediaUsage
+
+	// MaxBytes is the quota in force; 0 is no limit.
+	MaxBytes int64
+
+	// Custom reports a quota set for this user through the admin API,
+	// rather than media.max_user_storage_bytes.
+	Custom bool
+}
+
+// Quota reads a user's quota and usage.
+func (a *API) Quota(ctx context.Context, userID string) (Quota, error) {
+	usage, err := a.store.MediaUsage(ctx, a.serverName, userID)
+	if err != nil {
+		return Quota{}, err
+	}
+	q := Quota{Usage: usage, MaxBytes: a.cfg.MaxUserStorageBytes}
+	custom, ok, err := a.store.MediaQuota(ctx, userID)
+	if err != nil {
+		return Quota{}, err
+	}
+	if ok {
+		q.MaxBytes, q.Custom = custom, true
+	}
+	return q, nil
+}
+
+// SetQuota gives a user a quota of their own; 0 is no limit.
+func (a *API) SetQuota(ctx context.Context, userID string, maxBytes int64) error {
+	return a.store.SetMediaQuota(ctx, userID, maxBytes)
+}
+
+// ResetQuota puts a user back on media.max_user_storage_bytes.
+func (a *API) ResetQuota(ctx context.Context, userID string) error {
+	return a.store.DeleteMediaQuota(ctx, userID)
+}
+
 // normaliseContentType keeps a Content-Type that parses and replaces one
 // that does not. What is stored is what downloads are served with, and a
 // header that does not parse is one every client would guess at.