Struct Service 

pub struct Service {
    services: Arc<OnceServices>,
    db: Data,
    device_list_mutex: MutexMap<OwnedUserId, ()>,
}

Fields

services: Arc<OnceServices>

db: Data

device_list_mutex: MutexMap<OwnedUserId, ()>

Implementations

impl Service

pub(super) fn create_disabled(&self, user_id: &UserId, origin: &str)

impl Service

pub async fn set_dehydrated_device( &self, user_id: &UserId, request: Request, ) -> Result

Creates or recreates the user’s dehydrated device.

impl Service

pub(super) async fn remove_dehydrated_device( &self, user_id: &UserId, maybe_device_id: Option<&DeviceId>, ) -> Result<OwnedDeviceId>

Removes a user’s dehydrated device.

Calling this directly will remove the dehydrated data but leak the frontage device. Thus this is called by the regular device interface such that the dehydrated data will not leak instead.

If device_id is given, the user’s dehydrated device must match or this is a no-op, but an Err is still returned to indicate that. Otherwise returns the removed dehydrated device_id.

impl Service

pub async fn get_dehydrated_device_id( &self, user_id: &UserId, ) -> Result<OwnedDeviceId>

Get the device_id of the user’s dehydrated device.

impl Service

pub async fn get_dehydrated_device( &self, user_id: &UserId, ) -> Result<DehydratedDevice>

Get the dehydrated device private data

impl Service

pub async fn create_device( &self, user_id: &UserId, device_id: Option<&DeviceId>, __arg3: (Option<&str>, Option<Duration>), refresh_token: Option<&str>, initial_device_display_name: Option<&str>, client_ip: Option<IpAddr>, ) -> Result<OwnedDeviceId>

Adds a new device to a user.

A device ID coinciding with one of the user’s cross-signing key IDs is refused, since both share the device key row space.

impl Service

pub async fn remove_device(&self, user_id: &UserId, device_id: &DeviceId)

Removes a device from a user.

Everything keyed by the device goes with it, its identity keys included, so a later session under the same ID starts with none.

impl Service

pub fn all_device_ids<'a>( &'a self, user_id: &'a UserId, ) -> impl Stream<Item = &DeviceId> + Send + 'a

Returns an iterator over all device ids of this user.

impl Service

pub async fn find_from_token( &self, token: &str, ) -> Result<(OwnedUserId, OwnedDeviceId, Option<SystemTime>)>

Find out which user an access or refresh token belongs to.

impl Service

pub async fn remove_tokens(&self, user_id: &UserId, device_id: &DeviceId)

impl Service

pub async fn set_access_token( &self, user_id: &UserId, device_id: &DeviceId, access_token: &str, expires_in: Option<Duration>, refresh_token: Option<&str>, ) -> Result

Replaces the access token of one device.

impl Service

pub async fn remove_access_token( &self, user_id: &UserId, device_id: &DeviceId, ) -> Result

Revoke every access token of one device, without deleting the device. Take care to not leave dangling devices if using this method.

impl Service

pub async fn remove_access_token_value(&self, access_token: &str)

Revoke a single access token by value, leaving the device and any other tokens it holds intact.

impl Service

pub fn generate_access_token(&self, expires: bool) -> (String, Option<Duration>)

impl Service

pub async fn set_refresh_token( &self, user_id: &UserId, device_id: &DeviceId, refresh_token: &str, ) -> Result

Replaces the refresh token of one device.

impl Service

async fn find_refresh_token_expires_at( &self, user_id: &UserId, device_id: &DeviceId, ) -> Option<SystemTime>

Look up the expiry stored alongside the current refresh token for this device, if one is recorded. Pre-rotation entries carry no expiry and return None.

impl Service

pub async fn remove_refresh_token( &self, user_id: &UserId, device_id: &DeviceId, ) -> Result

Revoke the refresh token without deleting the device. Take care to not leave dangling devices if using this method.

impl Service

async fn forget_spent_refresh_token( &self, user_id: &UserId, device_id: &DeviceId, txn: &mut Txn, )

Drop the spent (previous-generation) refresh token retained for reuse detection, if any.

impl Service

pub async fn classify_refresh_token(&self, presented: &str) -> RefreshToken

Classify a presented refresh token for the token-endpoint rotation path.

impl Service

pub fn add_to_device_event( &self, sender: &UserId, target_user_id: &UserId, target_device_id: &DeviceId, event_type: &str, content: &Value, ) -> u64

impl Service

pub fn get_to_device_events<'a>( &'a self, user_id: &'a UserId, device_id: &'a DeviceId, since: Option<u64>, to: Option<u64>, ) -> impl Stream<Item = (u64, Raw<AnyToDeviceEvent>)> + Send + 'a

impl Service

pub async fn remove_to_device_events<Until>( &self, user_id: &UserId, device_id: &DeviceId, until: Until, )

where Until: Into<Option<u64>> + Send,

impl Service

pub async fn update_device_last_seen( &self, user_id: &UserId, device_id: &DeviceId, last_seen_ip: Option<IpAddr>, last_seen_ts: Option<MilliSecondsSinceUnixEpoch>, ) -> Result

impl Service

pub async fn put_device_metadata( &self, user_id: &UserId, notify: bool, device: &Device, )

Persists device metadata and optionally announces the changed device.

Silent updates leave the device-list version and notification rows unchanged.

impl Service

pub async fn get_device_metadata( &self, user_id: &UserId, device_id: &DeviceId, ) -> Result<Device>

Get device metadata.

impl Service

pub async fn device_exists( &self, user_id: &UserId, device_id: &DeviceId, ) -> bool

impl Service

pub async fn is_oidc_device( &self, user_id: &UserId, device_id: &DeviceId, ) -> bool

impl Service

pub async fn get_oidc_device_idp( &self, user_id: &UserId, device_id: &DeviceId, ) -> Option<String>

Returns the IdP that originally authenticated this device, if known. Returns None for devices predating the idp_id field or non-OIDC devices.

impl Service

pub fn mark_oidc_device( &self, user_id: &UserId, device_id: &DeviceId, idp_id: &str, )

impl Service

pub fn allow_cross_signing_replacement(&self, user_id: &UserId) -> SystemTime

Allow cross-signing key replacement without UIAA for the next 10 minutes. Returns the expiry timestamp in milliseconds.

impl Service

pub async fn can_replace_cross_signing_keys(&self, user_id: &UserId) -> bool

Check if the user is allowed to replace cross-signing keys without UIAA.

impl Service

pub async fn get_devicelist_version(&self, user_id: &UserId) -> Result<u64>

impl Service

pub fn all_devices_metadata<'a>( &'a self, user_id: &'a UserId, ) -> impl Stream<Item = Device> + Send + 'a

impl Service

pub async fn invite_filter(&self, recipient: &UserId) -> InviteFilter

Fetch the invite filtering state a recipient has configured.

The four account data slots are read concurrently, and a slot that is absent or malformed drops out rather than failing the others.

impl Service

async fn stable_config( &self, recipient: &UserId, ) -> Option<InvitePermissionConfigEventContent>

The stable slot, keeping its blanket switch even when its lists are not.

MSC4155 invalidates the whole event when a rule list is not an array, but the blanket block is stable spec and outranks the lists, so it is read back on its own rather than lost with them.

impl Service

pub async fn invite_permission( &self, sender: &UserId, recipient: &UserId, ) -> InvitePermission

The recipient’s verdict on a single invite from one sender.

Fetches the filtering state and discards it, so a caller judging several senders should hold an InviteFilter instead.

impl Service

pub async fn add_one_time_keys( &self, user_id: &UserId, device_id: &DeviceId, keys: &BTreeMap<OwnedOneTimeKeyId, Raw<OneTimeKey>>, limit: usize, ) -> Result

impl Service

pub async fn add_one_time_key( &self, user_id: &UserId, device_id: &DeviceId, one_time_key_key: &KeyId<OneTimeKeyAlgorithm, OneTimeKeyName>, one_time_key_value: &Raw<OneTimeKey>, txn: &mut Txn, ) -> Result<Option<impl Deref<Target = u64> + Send + use<>>>

impl Service

pub async fn add_fallback_keys<'a, Keys>( &self, user_id: &UserId, device_id: &DeviceId, keys: Keys, ) -> Result

where Keys: Iterator<Item = (&'a OneTimeKeyId, &'a Raw<OneTimeKey>)> + Send + 'a,

impl Service

pub async fn add_fallback_key( &self, user_id: &UserId, device_id: &DeviceId, one_time_key_key: &KeyId<OneTimeKeyAlgorithm, OneTimeKeyName>, one_time_key_value: &Raw<OneTimeKey>, txn: &mut Txn, ) -> Result<impl Deref<Target = u64> + Send + use<>>

impl Service

pub async fn take_fallback_key( &self, user_id: &UserId, device_id: &DeviceId, algorithm: &OneTimeKeyAlgorithm, ) -> Result<(OwnedKeyId<OneTimeKeyAlgorithm, OneTimeKeyName>, Raw<OneTimeKey>)>

impl Service

pub fn unused_fallback_key_algorithms<'a>( &'a self, user_id: &'a UserId, device_id: &'a DeviceId, ) -> impl Stream<Item = OneTimeKeyAlgorithm> + Send + 'a

impl Service

pub async fn last_one_time_keys_update(&self, user_id: &UserId) -> u64

impl Service

pub async fn take_one_time_key( &self, user_id: &UserId, device_id: &DeviceId, key_algorithm: &OneTimeKeyAlgorithm, ) -> Result<(OwnedKeyId<OneTimeKeyAlgorithm, OneTimeKeyName>, Raw<OneTimeKey>)>

impl Service

pub async fn count_one_time_keys( &self, user_id: &UserId, device_id: &DeviceId, ) -> BTreeMap<OneTimeKeyAlgorithm, UInt>

impl Service

pub async fn prune_one_time_keys( &self, user_id: &UserId, device_id: &DeviceId, excess: usize, )

MSC4225: drop the excess oldest rows for this (user, device). Forward iteration over the prefix runs in count_be ascending order, so take(excess) yields the earliest-uploaded rows.

impl Service

pub async fn remove_one_time_keys(&self, user_id: &UserId, device_id: &DeviceId)

Drops every one-time key still outstanding for this (user, device).

Device removal has to reach the pool as well as the MSC2732 fallback key, or a claim against the deleted device still succeeds from the rows left behind.

impl Service

pub async fn add_device_keys( &self, user_id: &UserId, device_id: &DeviceId, device_keys: &Raw<DeviceKeys>, )

impl Service

pub async fn add_cross_signing_keys( &self, user_id: &UserId, master_key: &Option<Raw<CrossSigningKey>>, self_signing_key: &Option<Raw<CrossSigningKey>>, user_signing_key: &Option<Raw<CrossSigningKey>>, notify: bool, ) -> Result

impl Service

pub async fn sign_key( &self, target_id: &UserId, key_id: &str, signatures: SmallVec<[(String, String); 1]>, sender_id: &UserId, ) -> Result

impl Service

async fn uploaded_key_role( &self, user_id: &UserId, key_id: &str, ) -> Result<Option<KeyRole>>

impl Service

pub(super) async fn is_cross_signing_key_id( &self, user_id: &UserId, key_id: &str, ) -> Result<bool>

impl Service

async fn cross_signing_pointers( &self, user_id: &UserId, row_key: &[u8], ) -> Result<[bool; 3]>

impl Service

async fn verify_key_signature( &self, sender_id: &UserId, key_id: &SigningKeyId<AnyKeyName>, role: KeyRole, signature: &str, canonical: &[u8], ) -> Result<Base64>

impl Service

pub fn keys_changed<'a>( &'a self, user_id: &'a UserId, from: u64, to: Option<u64>, ) -> impl Stream<Item = &UserId> + Send + 'a

impl Service

pub fn room_keys_changed<'a>( &'a self, room_id: &'a RoomId, from: u64, to: Option<u64>, ) -> impl Stream<Item = (&UserId, u64)> + Send + 'a

impl Service

fn keys_changed_user_or_room<'a>( &'a self, user_or_room_id: &'a str, from: u64, to: Option<u64>, ) -> impl Stream<Item = (&UserId, u64)> + Send + 'a

impl Service

pub async fn mark_device_key_update( &self, user_id: &UserId, change: DeviceListChange<&DeviceId>, )

Records a device-list change for a user and pushes it to interested peers.

The change is durable before any peer is contacted, and the unbounded sender channels refuse only once closed, so a refused flush is a shutdown race rather than a fault.

impl Service

pub async fn device_list_change(&self, count: u64) -> Result<DeviceListRecord>

Reads the mutation recorded for a local device-list notification.

Missing records return NotFound; unknown kind tags request a snapshot resync.

impl Service

pub async fn get_device_keys<'a>( &'a self, user_id: &'a UserId, device_id: &DeviceId, ) -> Result<Raw<DeviceKeys>>

impl Service

pub async fn get_key<F>( &self, key_id: &[u8], sender_user: Option<&UserId>, user_id: &UserId, allowed_signatures: &F, ) -> Result<Raw<CrossSigningKey>>

where F: Fn(&UserId) -> bool + Send + Sync,

impl Service

pub async fn get_master_key<F>( &self, sender_user: Option<&UserId>, user_id: &UserId, allowed_signatures: &F, ) -> Result<Raw<CrossSigningKey>>

where F: Fn(&UserId) -> bool + Send + Sync,

impl Service

pub async fn get_self_signing_key<F>( &self, sender_user: Option<&UserId>, user_id: &UserId, allowed_signatures: &F, ) -> Result<Raw<CrossSigningKey>>

where F: Fn(&UserId) -> bool + Send + Sync,

impl Service

pub async fn get_user_signing_key( &self, user_id: &UserId, ) -> Result<Raw<CrossSigningKey>>

impl Service

pub async fn search_ldap(&self, user_id: &UserId) -> Result<Vec<(String, bool)>>

Performs a LDAP search for the given user.

Returns the list of matching users, with a boolean for each result set to true if the user is an admin.

impl Service

pub async fn auth_ldap(&self, user_dn: &str, password: &str) -> Result

impl Service

async fn ldap_connect(&self, principal: &str) -> Result<(JoinHandle<()>, Ldap)>

impl Service

pub fn ldap_bind_dn(&self, localpart: &str) -> Option<String>

Builds the user bind DN by substituting the escaped localpart into the configured bind_dn template, or None when no {username} template is set.

impl Service

pub async fn full_register(&self, __arg1: Register<'_>) -> Result

Fully register a local user

Returns a device id and access token for the registered user

impl Service

pub async fn validate_server_user(&self) -> Result

Rejects changes to the server identity recorded by an existing database.

The localpart is stamped on the first boot and compared exactly afterwards. A database from before the stamp is backfilled from its admin room.

impl Service

async fn backfill_server_user(&self, configured: &str) -> Result

Stamps the identity on a database that pre-dates SERVER_USER_KEY.

Membership of the admin room establishes the identity, or an empty user table when there is no admin room; room creation does not, since a rebuilt admin room has a human creator. The legacy identity otherwise boots unstamped and any other is refused. A read-only database is validated but never stamped.

impl Service

async fn admin_room_joined(&self) -> Result<Option<bool>>

Reports whether the server user is joined to the admin room, or nothing without an admin alias.

An unjoined server user also means admin commands cannot work.

impl Service

pub async fn user_is_ignored( &self, sender_user: &UserId, recipient_user: &UserId, ) -> bool

Returns true/false based on whether the recipient/receiving user has blocked the sender

pub async fn ignored_users( &self, user_id: &UserId, ) -> Option<IgnoredUserListEventContent>

The users a user ignores account-wide.

Callers testing one list against many users take this rather than Self::user_is_ignored, which re-reads the list per test.

pub async fn create( &self, user_id: &UserId, password: Option<&str>, origin: Option<&str>, ) -> Result

Create a new user account on this homeserver.

User origin is by default “password” (meaning that it will login using its user_id/password). Users with other origins (currently only “ldap” is available) have special login processes.

pub async fn check_creation(&self, user_id: &UserId) -> Result

Refuses a local user ID that once joined the admin room but has no account.

Refusals return M_USER_IN_USE and log the user ID without changing account or membership state. Existing accounts and the server user remain eligible.

pub async fn deactivate_account(&self, user_id: &UserId) -> Result

Deactivate account

pub async fn exists(&self, user_id: &UserId) -> bool

Check if a user has an account on this homeserver.

pub async fn is_deactivated(&self, user_id: &UserId) -> Result<bool>

Check if account is deactivated

pub async fn is_active(&self, user_id: &UserId) -> bool

Check if account is active, infallible

pub async fn is_active_local(&self, user_id: &UserId) -> bool

Check if account is active, infallible

pub async fn check_ldap_login(&self, user_id: &UserId) -> Result

Gate an LDAP-authenticated login into an existing local account.

Only a deactivated account is rejected. A password-origin account passes, since a successful bind establishes the caller’s identity however their account was created, and a localpart with no local account passes on its way to registration.

pub async fn deactivated_check(&self, user_id: &UserId) -> Result

Reject a deactivated account with 403 M_USER_DEACTIVATED.

An account that does not exist is not deactivated, as in Synapse. One created without a password, as an appservice’s users often are, reads as deactivated, since both store an empty password.

pub async fn is_suspended(&self, user_id: &UserId) -> bool

MSC3823: account is suspended (read-mostly mode, sessions retained).

pub async fn locked_check(&self, user_id: &UserId) -> Result

MSC3939: reject a request from a locked account.

The rejection maps to 401 M_USER_LOCKED with soft_logout: true, so the client retains its session and polls for the unlock. The login and refresh routes and the request middleware share this gate.

pub async fn is_locked(&self, user_id: &UserId) -> bool

MSC3939: account is locked (401 + soft_logout, sessions retained).

The row’s presence is the entire state, and locking never invalidates access tokens, so clearing the row restores every session intact. Both locked_check and the admin lock surfaces read it.

pub async fn is_erased(&self, user_id: &UserId) -> bool

MSC4025: the user’s events serve as pruned copies to recipients not joined at the event. Presence-only for the serving gate.

pub async fn erasure_count(&self, user_id: &UserId) -> Option<PduCount>

MSC4025: the global count recorded at erasure, for admin surfacing; the serving gate never reads it.

pub async fn get_suspension(&self, user_id: &UserId) -> Option<Moderation>

MSC3823: forensic record for the active suspension, if any.

pub async fn get_lock(&self, user_id: &UserId) -> Option<Moderation>

MSC3939: forensic record for the active lock, if any.

pub fn set_suspended(&self, user_id: &UserId, by: &UserId)

pub fn clear_suspended(&self, user_id: &UserId)

pub fn set_erased(&self, user_id: &UserId)

MSC4025: mark the user erased, recording the current global count.

pub fn clear_erased(&self, user_id: &UserId)

MSC4025: erasure is reversible; clearing the marker restores the unredacted view.

pub fn set_locked(&self, user_id: &UserId, by: &UserId)

pub fn clear_locked(&self, user_id: &UserId)

pub async fn count(&self) -> usize

Returns the number of users registered on this server.

pub async fn is_empty(&self) -> Result<bool>

Returns whether the user table contains no accounts.

The lookup stops after the first account and propagates storage errors.

pub fn stream(&self) -> impl Stream<Item = &UserId> + Send

Returns an iterator over all users on this homeserver.

pub fn list_local_users(&self) -> impl Stream<Item = &UserId> + Send + '_

Returns a list of local users as list of usernames.

A user account is considered local if the length of it’s password is greater then zero.

pub async fn origin(&self, user_id: &UserId) -> Result<String>

Returns the origin of the user (password/LDAP/…).

pub async fn has_password(&self, user_id: &UserId) -> Result<bool>

Returns whether the user has a password. Disabled accounts and registrations setting a sentinel password will return false here.

pub async fn password_hash(&self, user_id: &UserId) -> Result<String>

Returns the password hash for the given user.

pub async fn set_password( &self, user_id: &UserId, password: Option<&str>, ) -> Result

Hashes and stores the user’s password.

A real password is hashed at the configured Argon2id cost and marks the account as password-origin. None stores the disabled marker and the sentinel is stored verbatim; neither is hashed. Changing the password of an account whose origin is neither password nor SSO is rejected.

pub fn create_filter( &self, user_id: &UserId, filter: &FilterDefinition, ) -> String

Creates a new sync filter. Returns the filter id.

pub async fn get_filter( &self, user_id: &UserId, filter_id: &str, ) -> Result<FilterDefinition>

pub fn create_openid_token(&self, user_id: &UserId, token: &str) -> Result<u64>

Creates an OpenID token, which can be used to prove that a user has access to an account (primarily for integrations)

pub async fn find_from_openid_token(&self, token: &str) -> Result<OwnedUserId>

Find out which user an OpenID access token belongs to.

pub fn create_login_token(&self, user_id: &UserId, token: &str) -> u64

Creates a short-lived login token, which can be used to log in using the m.login.token mechanism.

pub async fn peek_login_token(&self, token: &str) -> Result<OwnedUserId>

Verify a login token is valid and return its owner without consuming it. Unlike find_from_login_token, the token remains in the database after this call and can still be consumed later.

pub async fn find_from_login_token(&self, token: &str) -> Result<OwnedUserId>

Find out which user a login token belongs to. Removes the token to prevent double-use attacks.

Trait Implementations

impl Service for Service

fn build(args: &Args<'_>) -> Result<Arc<Self>>

Implement the construction of the service instance. Services are generally singletons so expect this to only be called once for a service type. Note that it may be called again after a server reload, but the prior instance will have been dropped first. Failure will shutdown the server with an error.

fn name(&self) -> &str

Return the name of the service. i.e. crate::service::make_name(std::module_path!())

fn worker<'async_trait>( self: Arc<Self>, ) -> Pin<Box<dyn Future<Output = Result> + Send + 'async_trait>>

where Self: 'async_trait,

Implement the service’s worker loop. The service manager spawns a task and calls this function after all services have been built.

fn interrupt<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = ()> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Interrupt the service. This is sent to initiate a graceful shutdown. The service worker should return from its work loop.

fn clear_cache<'life0, 'async_trait>( &'life0 self, ) -> Pin<Box<dyn Future<Output = ()> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait,

Clear any caches or similar runtime state.

fn memory_usage<'life0, 'life1, 'async_trait>( &'life0 self, _out: &'life1 mut (dyn Write + Send), ) -> Pin<Box<dyn Future<Output = Result> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Memory usage report in a markdown string.

fn unconstrained(&self) -> bool

Return true if the service worker opts out of the tokio cooperative budgeting. This can reduce tail latency at the risk of event loop starvation.