feat: allow specifying config path via command flag

feat: generate config
2024-05-05 18:47:55 +01:00 · 2024-05-05 18:47:51 +01:00
72 changed files with 2070 additions and 3704 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -103,11 +103,6 @@ artifacts:
    - ./bin/nix-build-and-cache .#static-aarch64-unknown-linux-musl
    - cp result/bin/conduit aarch64-unknown-linux-musl

-    - mkdir -p target/aarch64-unknown-linux-musl/release
-    - cp result/bin/conduit target/aarch64-unknown-linux-musl/release
-    - direnv exec . cargo deb --no-strip --no-build --target aarch64-unknown-linux-musl
-    - mv target/aarch64-unknown-linux-musl/debian/*.deb aarch64-unknown-linux-musl.deb
-
    - ./bin/nix-build-and-cache .#oci-image-aarch64-unknown-linux-musl
    - cp result oci-image-arm64v8.tar.gz

@ -119,7 +114,6 @@ artifacts:
      - x86_64-unknown-linux-musl
      - aarch64-unknown-linux-musl
      - x86_64-unknown-linux-musl.deb
-      - aarch64-unknown-linux-musl.deb
      - oci-image-amd64.tar.gz
      - oci-image-arm64v8.tar.gz
      - public
--- a/Cargo.lock
+++ b/Cargo.lock
--- a/Cargo.toml
+++ b/Cargo.toml
@ -1,25 +1,27 @@
+# Keep alphabetically sorted
 [workspace.lints.rust]
 explicit_outlives_requirements = "warn"
 unused_qualifications = "warn"

+# Keep alphabetically sorted
 [workspace.lints.clippy]
 cloned_instead_of_copied = "warn"
 dbg_macro = "warn"
 str_to_string = "warn"

 [package]
-authors = ["timokoesters <timo@koesters.xyz>"]
-description = "A Matrix homeserver written in Rust"
-edition = "2021"
-homepage = "https://conduit.rs"
-license = "Apache-2.0"
 name = "conduit"
-readme = "README.md"
+description = "A Matrix homeserver written in Rust"
+license = "Apache-2.0"
+authors = ["timokoesters <timo@koesters.xyz>"]
+homepage = "https://conduit.rs"
 repository = "https://gitlab.com/famedly/conduit"
-version = "0.10.0-alpha"
+readme = "README.md"
+version = "0.8.0-alpha"
+edition = "2021"

 # See also `rust-toolchain.toml`
-rust-version = "1.79.0"
+rust-version = "1.78.0"

 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

@ -28,24 +30,16 @@ workspace = true

 [dependencies]
 # Web framework
-axum = { version = "0.7", default-features = false, features = [
-  "form",
-  "http1",
-  "http2",
-  "json",
-  "matched-path",
-], optional = true }
-axum-extra = { version = "0.9", features = ["typed-header"] }
-axum-server = { version = "0.6", features = ["tls-rustls"] }
+axum = { version = "0.6.18", default-features = false, features = ["form", "headers", "http1", "http2", "json", "matched-path"], optional = true }
+axum-server = { version = "0.5.1", features = ["tls-rustls"] }
 tower = { version = "0.4.13", features = ["util"] }
-tower-http = { version = "0.5", features = [
-  "add-extension",
-  "cors",
-  "sensitive-headers",
-  "trace",
-  "util",
-] }
-tower-service = "0.3"
+tower-http = { version = "0.4.1", features = ["add-extension", "cors", "sensitive-headers", "trace", "util"] }
+
+# Used for matrix spec type definitions and helpers
+#ruma = { version = "0.4.0", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-pre-spec", "unstable-exhaustive-types"] }
+ruma = { git = "https://github.com/ruma/ruma", rev = "5495b85aa311c2805302edb0a7de40399e22b397", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-msc2448", "unstable-msc3575", "unstable-exhaustive-types", "ring-compat", "unstable-unspecified" ] }
+#ruma = { git = "https://github.com/timokoesters/ruma", rev = "4ec9c69bb7e09391add2382b3ebac97b6e8f4c64", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-msc2448", "unstable-msc3575", "unstable-exhaustive-types", "ring-compat", "unstable-unspecified" ] }
+#ruma = { path = "../ruma/crates/ruma", features = ["compat", "rand", "appservice-api-c", "client-api", "federation-api", "push-gateway-api-c", "state-res", "unstable-msc2448", "unstable-msc3575", "unstable-exhaustive-types", "ring-compat", "unstable-unspecified" ] }

 # Async runtime and utilities
 tokio = { version = "1.28.1", features = ["fs", "macros", "signal", "sync"] }
@ -56,7 +50,7 @@ persy = { version = "1.4.4", optional = true, features = ["background_ops"] }

 # Used for the http request / response body type for Ruma endpoints used with reqwest
 bytes = "1.4.0"
-http = "1"
+http = "0.2.9"
 # Used to find data directory for default db path
 directories = "5"
 # Used for ruma wrapper
@ -70,25 +64,12 @@ rand = "0.8.5"
 # Used to hash passwords
 rust-argon2 = "2"
 # Used to send requests
-hyper = "1.1"
-hyper-util = { version = "0.1", features = [
-  "client",
-  "client-legacy",
-  "http1",
-  "http2",
-] }
-reqwest = { version = "0.12", default-features = false, features = [
-  "rustls-tls-native-roots",
-  "socks",
-] }
+hyper = "0.14.26"
+reqwest = { version = "0.11.18", default-features = false, features = ["rustls-tls-native-roots", "socks"] }
 # Used for conduit::Error type
 thiserror = "1.0.40"
 # Used to generate thumbnails for images
-image = { version = "0.25", default-features = false, features = [
-  "gif",
-  "jpeg",
-  "png",
-] }
+image = { version = "0.25", default-features = false, features = ["jpeg", "png", "gif"] }
 # Used to encode server public key
 base64 = "0.22"
 # Used when hashing the state
@ -100,19 +81,15 @@ regex = "1.8.1"
 # jwt jsonwebtokens
 jsonwebtoken = "9.2.0"
 # Performance measurements
-opentelemetry = "0.22"
-opentelemetry-jaeger-propagator = "0.1"
-opentelemetry-otlp = "0.15"
-opentelemetry_sdk = { version = "0.22", features = ["rt-tokio"] }
-tracing = "0.1.37"
-tracing-flame = "0.2.0"
-tracing-opentelemetry = "0.23"
+tracing = { version = "0.1.37", features = [] }
 tracing-subscriber = { version = "0.3.17", features = ["env-filter"] }
-
+tracing-flame = "0.2.0"
+opentelemetry = { version = "0.18.0", features = ["rt-tokio"] }
+opentelemetry-jaeger = { version = "0.17.0", features = ["rt-tokio"] }
+tracing-opentelemetry = "0.18.0"
 lru-cache = "0.1.2"
-parking_lot = { version = "0.12.1", optional = true }
 rusqlite = { version = "0.31", optional = true, features = ["bundled"] }
-
+parking_lot = { version = "0.12.1", optional = true }
 # crossbeam = { version = "0.8.2", optional = true }
 num_cpus = "1.15.0"
 threadpool = "1.8.1"
@ -125,66 +102,44 @@ thread_local = "1.1.7"
 hmac = "0.12.1"
 sha-1 = "0.10.1"
 # used for conduit's CLI and admin room command parsing
-clap = { version = "4.3.0", default-features = false, features = [
-  "derive",
-  "error-context",
-  "help",
-  "std",
-  "string",
-  "usage",
-] }
+clap = { version = "4.3.0", default-features = false, features = ["std", "derive", "help", "usage", "error-context", "string"] }
 futures-util = { version = "0.3.28", default-features = false }
 # Used for reading the configuration from conduit.toml & environment variables
 figment = { version = "0.10.8", features = ["env", "toml"] }
+# Used to generate the default config file
+toml_edit = "0.22"

 # Validating urls in config
 url = { version = "2", features = ["serde"] }

+tikv-jemallocator = { version = "0.5.0", features = ["unprefixed_malloc_on_supported_platforms"], optional = true }
 async-trait = "0.1.68"
-tikv-jemallocator = { version = "0.5.0", features = [
-  "unprefixed_malloc_on_supported_platforms",
-], optional = true }

 sd-notify = { version = "0.4.1", optional = true }

-# Used for matrix spec type definitions and helpers
-[dependencies.ruma]
-features = [
-  "appservice-api-c",
-  "client-api",
-  "compat",
-  "federation-api",
-  "push-gateway-api-c",
-  "rand",
-  "ring-compat",
-  "server-util",
-  "state-res",
-  "unstable-exhaustive-types",
-  "unstable-msc2448",
-  "unstable-msc3575",
-  "unstable-unspecified",
-]
-git = "https://github.com/ruma/ruma"
-
 [dependencies.rocksdb]
-features = ["lz4", "multi-threaded-cf", "zstd"]
-optional = true
 package = "rust-rocksdb"
 version = "0.25"
+optional = true
+features = [
+    "multi-threaded-cf",
+    "zstd",
+    "lz4",
+]

 [target.'cfg(unix)'.dependencies]
 nix = { version = "0.28", features = ["resource"] }

 [features]
-default = ["backend_rocksdb", "backend_sqlite", "conduit_bin", "systemd"]
+default = ["conduit_bin", "backend_sqlite", "backend_rocksdb", "systemd"]
 #backend_sled = ["sled"]
-backend_persy = ["parking_lot", "persy"]
+backend_persy = ["persy", "parking_lot"]
 backend_sqlite = ["sqlite"]
 #backend_heed = ["heed", "crossbeam"]
 backend_rocksdb = ["rocksdb"]
-conduit_bin = ["axum"]
 jemalloc = ["tikv-jemallocator"]
-sqlite = ["parking_lot", "rusqlite", "tokio/signal"]
+sqlite = ["rusqlite", "parking_lot", "tokio/signal"]
+conduit_bin = ["axum"]
 systemd = ["sd-notify"]

 [[bin]]
@ -197,45 +152,35 @@ name = "conduit"
 path = "src/lib.rs"

 [package.metadata.deb]
-assets = [
-  [
-    "README.md",
-    "usr/share/doc/matrix-conduit/",
-    "644",
-  ],
-  [
-    "debian/README.md",
-    "usr/share/doc/matrix-conduit/README.Debian",
-    "644",
-  ],
-  [
-    "target/release/conduit",
-    "usr/sbin/matrix-conduit",
-    "755",
-  ],
-]
-conf-files = ["/etc/matrix-conduit/conduit.toml"]
+name = "matrix-conduit"
+maintainer = "Paul van Tilburg <paul@luon.net>"
 copyright = "2020, Timo Kösters <timo@koesters.xyz>"
+license-file = ["LICENSE", "3"]
 depends = "$auto, ca-certificates"
 extended-description = """\
 A fast Matrix homeserver that is optimized for smaller, personal servers, \
 instead of a server that has high scalability."""
-license-file = ["LICENSE", "3"]
-maintainer = "Paul van Tilburg <paul@luon.net>"
-maintainer-scripts = "debian/"
-name = "matrix-conduit"
-priority = "optional"
 section = "net"
+priority = "optional"
+assets = [
+  ["debian/README.md", "usr/share/doc/matrix-conduit/README.Debian", "644"],
+  ["README.md", "usr/share/doc/matrix-conduit/", "644"],
+  ["target/release/conduit", "usr/sbin/matrix-conduit", "755"],
+]
+conf-files = [
+  "/etc/matrix-conduit/conduit.toml"
+]
+maintainer-scripts = "debian/"
 systemd-units = { unit-name = "matrix-conduit" }

 [profile.dev]
-incremental = true
 lto = 'off'
+incremental = true

 [profile.release]
-codegen-units = 32
-incremental = true
 lto = 'thin'
+incremental = true
+codegen-units=32
 # If you want to make flamegraphs, enable debug info:
 # debug = true

--- a/README.md
+++ b/README.md
@ -56,13 +56,6 @@ If you have any questions, feel free to
 - Send an direct message to `@timokoesters:fachschaften.org` on Matrix
 - [Open an issue on GitLab](https://gitlab.com/famedly/conduit/-/issues/new)

-#### Security
-
-If you believe you have found a security issue, please send a message to [Timo](https://matrix.to/#/@timo:conduit.rs)
-and/or [Matthias](https://matrix.to/#/@matthias:ahouansou.cz) on Matrix, or send an email to
-[conduit@koesters.xyz](mailto:conduit@koesters.xyz). Please do not disclose details about the issue to anyone else before
-a fix is released publically.
-
 #### Thanks to

 Thanks to FUTO, Famedly, Prototype Fund (DLR and German BMBF) and all individuals for financially supporting this project.
--- a/book.toml
+++ b/book.toml
@ -1,21 +1,22 @@
 [book]
+title = "Conduit"
 description = "Conduit is a simple, fast and reliable chat server for the Matrix protocol"
 language = "en"
 multilingual = false
 src = "docs"
-title = "Conduit"

 [build]
 build-dir = "public"
 create-missing = true

 [output.html]
+git-repository-url = "https://gitlab.com/famedly/conduit"
 edit-url-template = "https://gitlab.com/famedly/conduit/-/edit/next/{path}"
 git-repository-icon = "fa-git-square"
-git-repository-url = "https://gitlab.com/famedly/conduit"

 [output.html.search]
 limit-results = 15

 [output.html.code.hidelines]
 json = "~"
+
--- a/complement/Dockerfile
+++ b/complement/Dockerfile
@ -1,4 +1,4 @@
-FROM rust:1.79.0
+FROM rust:1.78.0

 WORKDIR /workdir

--- a/conduit-example.toml
+++ b/conduit-example.toml
@ -22,9 +22,9 @@
 # YOU NEED TO EDIT THIS
 #server_name = "your.server.name"

-database_backend = "rocksdb"
 # This is the only directory where Conduit will save its data
 database_path = "/var/lib/matrix-conduit/"
+database_backend = "rocksdb"

 # The port Conduit will be running on. You need to set up a reverse proxy in
 # your web server (e.g. apache or nginx), so all requests to /_matrix on port
@ -44,8 +44,8 @@ allow_registration = true
 # - Start the line with '#' to remove the condition
 registration_token = ""

-allow_check_for_updates = true
 allow_federation = true
+allow_check_for_updates = true

 # Enable the display name lightning bolt on registration.
 enable_lightning_bolt = true
--- a/docs/configuration.md
+++ b/docs/configuration.md
@ -6,8 +6,6 @@

 > **Note:** If you update the configuration file, you must restart Conduit for the changes to take effect

-> **Note:** You can also configure Conduit by using `CONDUIT_{field_name}` environment variables. To set values inside a table, use `CONDUIT_{table_name}__{field_name}`. Example: `CONDUIT_SERVER_NAME="example.org"`
-
 Conduit's configuration file is divided into the following sections:

 - [Global](#global)
@ -58,8 +56,7 @@ The `global` section contains the following fields:
 | `turn_secret` | `string` | The TURN secret | `""` |
 | `turn_ttl` | `integer` | The TURN TTL in seconds | `86400` |
 | `emergency_password` | `string` | Set a password to login as the `conduit` user in case of emergency | N/A |
-| `well_known_client` | `string` | Used for [delegation](delegation.md) | See [delegation](delegation.md) |
-| `well_known_server` | `string` | Used for [delegation](delegation.md) | See [delegation](delegation.md) |
+| `well_known` | `table` | Used for [delegation](delegation.md) | See [delegation](delegation.md) |


 ### TLS
--- a/docs/delegation.md
+++ b/docs/delegation.md
@ -16,18 +16,18 @@ are connected to the server running Conduit using something like a VPN.

 > **Note**: this will automatically allow you to use [sliding sync][0] without any extra configuration

-To configure it, use the following options:
+To configure it, use the following options in the `global.well_known` table:
 | Field | Type | Description | Default |
 | --- | --- | --- | --- |
-| `well_known_client` | `String` | The URL that clients should use to connect to Conduit | `https://<server_name>` |
-| `well_known_server` | `String` | The hostname and port servers should use to connect to Conduit | `<server_name>:443` |
+| `client` | `String` | The URL that clients should use to connect to Conduit | `https://<server_name>` |
+| `server` | `String` | The hostname and port servers should use to connect to Conduit | `<server_name>:443` |

 ### Example

 ```toml
-[global]
-well_known_client = "https://matrix.example.org"
-well_known_server = "matrix.example.org:443"
+[global.well_known]
+client = "https://matrix.example.org"
+server = "matrix.example.org:443"
 ```

 ## Manual
--- a/docs/deploying/docker.md
+++ b/docs/deploying/docker.md
@ -64,7 +64,6 @@ docker run -d -p 8448:6167 \
  -e CONDUIT_MAX_REQUEST_SIZE="20000000" \
  -e CONDUIT_TRUSTED_SERVERS="[\"matrix.org\"]" \
  -e CONDUIT_MAX_CONCURRENT_REQUESTS="100" \
-  -e CONDUIT_PORT="6167" \
  --name conduit <link>
 ```

--- a/docs/deploying/generic.md
+++ b/docs/deploying/generic.md
@ -17,7 +17,6 @@ You may simply download the binary that fits your machine. Run `uname -m` to see
 | Target | Type | Download |
 |-|-|-|
 | `x86_64-unknown-linux-musl` | Statically linked Debian package | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/master/raw/x86_64-unknown-linux-musl.deb?job=artifacts) |
-| `aarch64-unknown-linux-musl` | Statically linked Debian package | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/master/raw/aarch64-unknown-linux-musl.deb?job=artifacts) |
 | `x86_64-unknown-linux-musl` | Statically linked binary | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/master/raw/x86_64-unknown-linux-musl?job=artifacts) |
 | `aarch64-unknown-linux-musl` | Statically linked binary | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/master/raw/aarch64-unknown-linux-musl?job=artifacts) |
 | `x86_64-unknown-linux-gnu` | OCI image | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/master/raw/oci-image-amd64.tar.gz?job=artifacts) |
@ -31,7 +30,6 @@ If you use a system with an older glibc version (e.g. RHEL8), you might need to
 | Target | Type | Download |
 |-|-|-|
 | `x86_64-unknown-linux-musl` | Statically linked Debian package | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/x86_64-unknown-linux-musl.deb?job=artifacts) |
-| `aarch64-unknown-linux-musl` | Statically linked Debian package | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/aarch64-unknown-linux-musl.deb?job=artifacts) |
 | `x86_64-unknown-linux-musl` | Statically linked binary | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/x86_64-unknown-linux-musl?job=artifacts) |
 | `aarch64-unknown-linux-musl` | Statically linked binary | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/aarch64-unknown-linux-musl?job=artifacts) |
 | `x86_64-unknown-linux-gnu` | OCI image | [link](https://gitlab.com/api/v4/projects/famedly%2Fconduit/jobs/artifacts/next/raw/oci-image-amd64.tar.gz?job=artifacts) |
--- a/docs/faq.md
+++ b/docs/faq.md
@ -35,7 +35,3 @@ Here is an example:

 Not really. You can reuse the domain of your current server with Conduit, but you will not be able to migrate accounts automatically.
 Rooms that were federated can be re-joined via the other participating servers, however media and the like may be deleted from remote servers after some time, and hence might not be recoverable.
-
-## How do I make someone an admin?
-
-Simply invite them to the admin room. Once joined, they can administer the server by interacting with the `@conduit:<server_name>` user.
--- a/docs/turn.md
+++ b/docs/turn.md
@ -2,7 +2,7 @@

 ## General instructions

-* It is assumed you have a [Coturn server](https://github.com/coturn/coturn) up and running. See [Synapse reference implementation](https://github.com/element-hq/synapse/blob/develop/docs/turn-howto.md).
+* It is assumed you have a [Coturn server](https://github.com/coturn/coturn) up and running. See [Synapse reference implementation](https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md).

 ## Edit/Add a few settings to your existing conduit.toml

--- a/engage.toml
+++ b/engage.toml
@ -1,48 +1,48 @@
 interpreter = ["bash", "-euo", "pipefail", "-c"]

 [[task]]
-group = "versions"
 name = "engage"
+group = "versions"
 script = "engage --version"

 [[task]]
-group = "versions"
 name = "rustc"
+group = "versions"
 script = "rustc --version"

 [[task]]
-group = "versions"
 name = "cargo"
+group = "versions"
 script = "cargo --version"

 [[task]]
-group = "versions"
 name = "cargo-fmt"
+group = "versions"
 script = "cargo fmt --version"

 [[task]]
-group = "versions"
 name = "rustdoc"
+group = "versions"
 script = "rustdoc --version"

 [[task]]
-group = "versions"
 name = "cargo-clippy"
+group = "versions"
 script = "cargo clippy -- --version"

 [[task]]
-group = "versions"
 name = "lychee"
+group = "versions"
 script = "lychee --version"

 [[task]]
-group = "lints"
 name = "cargo-fmt"
+group = "lints"
 script = "cargo fmt --check -- --color=always"

 [[task]]
-group = "lints"
 name = "cargo-doc"
+group = "lints"
 script = """
 RUSTDOCFLAGS="-D warnings" cargo doc \
    --workspace \
@ -52,23 +52,18 @@ RUSTDOCFLAGS="-D warnings" cargo doc \
 """

 [[task]]
-group = "lints"
 name = "cargo-clippy"
+group = "lints"
 script = "cargo clippy --workspace --all-targets --color=always -- -D warnings"

 [[task]]
-group = "lints"
-name = "taplo-fmt"
-script = "taplo fmt --check --colors always"
-
-[[task]]
-group = "lints"
 name = "lychee"
+group = "lints"
 script = "lychee --offline docs"

 [[task]]
-group = "tests"
 name = "cargo"
+group = "tests"
 script = """
 cargo test \
    --workspace \
--- a/flake.nix
+++ b/flake.nix
@ -59,7 +59,7 @@
            file = ./rust-toolchain.toml;

            # See also `rust-toolchain.toml`
-            sha256 = "sha256-Ngiz76YP4HTY75GGdH2P+APE/DEIx2R/Dn+BwwOyzZU=";
+            sha256 = "sha256-opUgs6ckUQCyDxcB9Wy51pqhd0MPGHUVbwRKKPGiwZU=";
          };
      });
    in
--- a/nix/pkgs/default/default.nix
+++ b/nix/pkgs/default/default.nix
@ -54,6 +54,7 @@ let
      include = [
        "Cargo.lock"
        "Cargo.toml"
+        "conduit-example.toml"
        "src"
      ];
    };
--- a/nix/shell.nix
+++ b/nix/shell.nix
@ -10,7 +10,6 @@
 , mkShell
 , olm
 , system
-, taplo
 , toolchain
 }:

@ -23,21 +22,16 @@ mkShell {
  };

  # Development tools
-  nativeBuildInputs = [
+  nativeBuildInputs = default.nativeBuildInputs ++ [
    # Always use nightly rustfmt because most of its options are unstable
    #
    # This needs to come before `toolchain` in this list, otherwise
    # `$PATH` will have stable rustfmt instead.
    inputs.fenix.packages.${system}.latest.rustfmt

-    # rust itself
-    toolchain
-
-    # CI tests
+    # Keep sorted
    engage
-
-    # format toml files
-    taplo
+    toolchain

    # Needed for producing Debian packages
    cargo-deb
@ -57,5 +51,5 @@ mkShell {

    # Useful for editing the book locally
    mdbook
-  ] ++ default.nativeBuildInputs ;
+  ];
 }
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@ -2,6 +2,7 @@
 #
 # Other files that need upkeep when this changes:
 #
+# * `.gitlab-ci.yml`
 # * `Cargo.toml`
 # * `flake.nix`
 #
@ -9,13 +10,13 @@
 # If you're having trouble making the relevant changes, bug a maintainer.

 [toolchain]
-channel = "1.79.0"
+channel = "1.78.0"
 components = [
-  # For rust-analyzer
-  "rust-src",
+    # For rust-analyzer
+    "rust-src",
 ]
 targets = [
-  "aarch64-unknown-linux-musl",
-  "x86_64-unknown-linux-gnu",
-  "x86_64-unknown-linux-musl",
+    "x86_64-unknown-linux-gnu",
+    "x86_64-unknown-linux-musl",
+    "aarch64-unknown-linux-musl",
 ]
--- a/rustfmt.toml
+++ b/rustfmt.toml
@ -1,2 +1,2 @@
-imports_granularity = "Crate"
 unstable_features = true
+imports_granularity="Crate"
--- a/src/api/client_server/account.rs
+++ b/src/api/client_server/account.rs
@ -75,9 +75,9 @@ pub async fn get_register_available_route(
 /// - Creates a new account and populates it with default account data
 /// - If `inhibit_login` is false: Creates a device and returns device id and access_token
 pub async fn register_route(body: Ruma<register::v3::Request>) -> Result<register::v3::Response> {
-    if !services().globals.allow_registration().await && body.appservice_info.is_none() {
+    if !services().globals.allow_registration() && body.appservice_info.is_none() {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "Registration has been disabled.",
        ));
    }
@ -315,11 +315,7 @@ pub async fn register_route(body: Ruma<register::v3::Request>) -> Result<registe
 pub async fn change_password_route(
    body: Ruma<change_password::v3::Request>,
 ) -> Result<change_password::v3::Response> {
-    let sender_user = body
-        .sender_user
-        .as_ref()
-        // In the future password changes could be performed with UIA with 3PIDs, but we don't support that currently
-        .ok_or_else(|| Error::BadRequest(ErrorKind::MissingToken, "Missing access token."))?;
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
    let sender_device = body.sender_device.as_ref().expect("user is authenticated");

    let mut uiaainfo = UiaaInfo {
@ -406,11 +402,7 @@ pub async fn whoami_route(body: Ruma<whoami::v3::Request>) -> Result<whoami::v3:
 pub async fn deactivate_route(
    body: Ruma<deactivate::v3::Request>,
 ) -> Result<deactivate::v3::Response> {
-    let sender_user = body
-        .sender_user
-        .as_ref()
-        // In the future password changes could be performed with UIA with SSO, but we don't support that currently
-        .ok_or_else(|| Error::BadRequest(ErrorKind::MissingToken, "Missing access token."))?;
+    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
    let sender_device = body.sender_device.as_ref().expect("user is authenticated");

    let mut uiaainfo = UiaaInfo {
@ -483,7 +475,7 @@ pub async fn request_3pid_management_token_via_email_route(
 ) -> Result<request_3pid_management_token_via_email::v3::Response> {
    Err(Error::BadRequest(
        ErrorKind::ThreepidDenied,
-        "Third party identifiers are currently unsupported by this server implementation",
+        "Third party identifier is not allowed",
    ))
 }

@ -497,6 +489,6 @@ pub async fn request_3pid_management_token_via_msisdn_route(
 ) -> Result<request_3pid_management_token_via_msisdn::v3::Response> {
    Err(Error::BadRequest(
        ErrorKind::ThreepidDenied,
-        "Third party identifiers are currently unsupported by this server implementation",
+        "Third party identifier is not allowed",
    ))
 }
--- a/src/api/client_server/alias.rs
+++ b/src/api/client_server/alias.rs
@ -18,8 +18,6 @@ use ruma::{
 pub async fn create_alias_route(
    body: Ruma<create_alias::v3::Request>,
 ) -> Result<create_alias::v3::Response> {
-    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
-
    if body.room_alias.server_name() != services().globals.server_name() {
        return Err(Error::BadRequest(
            ErrorKind::InvalidParam,
@ -57,7 +55,7 @@ pub async fn create_alias_route(
    services()
        .rooms
        .alias
-        .set_alias(&body.room_alias, &body.room_id, sender_user)?;
+        .set_alias(&body.room_alias, &body.room_id)?;

    Ok(create_alias::v3::Response::new())
 }
@ -66,12 +64,11 @@ pub async fn create_alias_route(
 ///
 /// Deletes a room alias from this server.
 ///
+/// - TODO: additional access control checks
 /// - TODO: Update canonical alias event
 pub async fn delete_alias_route(
    body: Ruma<delete_alias::v3::Request>,
 ) -> Result<delete_alias::v3::Response> {
-    let sender_user = body.sender_user.as_ref().expect("user is authenticated");
-
    if body.room_alias.server_name() != services().globals.server_name() {
        return Err(Error::BadRequest(
            ErrorKind::InvalidParam,
@ -97,10 +94,7 @@ pub async fn delete_alias_route(
        ));
    }

-    services()
-        .rooms
-        .alias
-        .remove_alias(&body.room_alias, sender_user)?;
+    services().rooms.alias.remove_alias(&body.room_alias)?;

    // TODO: update alt_aliases?

--- a/src/api/client_server/context.rs
+++ b/src/api/client_server/context.rs
@ -54,7 +54,7 @@ pub async fn get_context_route(
        .user_can_see_event(sender_user, &room_id, &body.event_id)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You don't have permission to view this event.",
        ));
    }
--- a/src/api/client_server/media.rs
+++ b/src/api/client_server/media.rs
@ -1,24 +1,12 @@
-// Unauthenticated media is deprecated
-#![allow(deprecated)]
-
 use std::time::Duration;

 use crate::{service::media::FileMeta, services, utils, Error, Result, Ruma};
-use http::header::{CONTENT_DISPOSITION, CONTENT_TYPE};
-use ruma::{
-    api::{
-        client::{
-            authenticated_media::{
-                get_content, get_content_as_filename, get_content_thumbnail, get_media_config,
-            },
-            error::ErrorKind,
-            media::{self, create_content},
-        },
-        federation::authenticated_media::{self as federation_media, FileOrLocation},
+use ruma::api::client::{
+    error::ErrorKind,
+    media::{
+        create_content, get_content, get_content_as_filename, get_content_thumbnail,
+        get_media_config,
    },
-    http_headers::{ContentDisposition, ContentDispositionType},
-    media::Method,
-    ServerName, UInt,
 };

 const MXC_LENGTH: usize = 32;
@ -27,20 +15,9 @@ const MXC_LENGTH: usize = 32;
 ///
 /// Returns max upload size.
 pub async fn get_media_config_route(
-    _body: Ruma<media::get_media_config::v3::Request>,
-) -> Result<media::get_media_config::v3::Response> {
-    Ok(media::get_media_config::v3::Response {
-        upload_size: services().globals.max_request_size().into(),
-    })
-}
-
-/// # `GET /_matrix/client/v1/media/config`
-///
-/// Returns max upload size.
-pub async fn get_media_config_auth_route(
-    _body: Ruma<get_media_config::v1::Request>,
-) -> Result<get_media_config::v1::Response> {
-    Ok(get_media_config::v1::Response {
+    _body: Ruma<get_media_config::v3::Request>,
+) -> Result<get_media_config::v3::Response> {
+    Ok(get_media_config::v3::Response {
        upload_size: services().globals.max_request_size().into(),
    })
 }
@ -64,10 +41,10 @@ pub async fn create_content_route(
        .media
        .create(
            mxc.clone(),
-            Some(
-                ContentDisposition::new(ContentDispositionType::Inline)
-                    .with_filename(body.filename.clone()),
-            ),
+            body.filename
+                .as_ref()
+                .map(|filename| "inline; filename=".to_owned() + filename)
+                .as_deref(),
            body.content_type.as_deref(),
            &body.file,
        )
@ -81,67 +58,28 @@ pub async fn create_content_route(

 pub async fn get_remote_content(
    mxc: &str,
-    server_name: &ServerName,
+    server_name: &ruma::ServerName,
    media_id: String,
-) -> Result<get_content::v1::Response, Error> {
-    let content_response = match services()
+) -> Result<get_content::v3::Response, Error> {
+    let content_response = services()
        .sending
        .send_federation_request(
            server_name,
-            federation_media::get_content::v1::Request {
-                media_id: media_id.clone(),
+            get_content::v3::Request {
+                allow_remote: false,
+                server_name: server_name.to_owned(),
+                media_id,
                timeout_ms: Duration::from_secs(20),
+                allow_redirect: false,
            },
        )
-        .await
-    {
-        Ok(federation_media::get_content::v1::Response {
-            metadata: _,
-            content: FileOrLocation::File(content),
-        }) => get_content::v1::Response {
-            file: content.file,
-            content_type: content.content_type,
-            content_disposition: content.content_disposition,
-        },
-
-        Ok(federation_media::get_content::v1::Response {
-            metadata: _,
-            content: FileOrLocation::Location(url),
-        }) => get_location_content(url).await?,
-        Err(Error::BadRequest(ErrorKind::Unrecognized, _)) => {
-            let media::get_content::v3::Response {
-                file,
-                content_type,
-                content_disposition,
-                ..
-            } = services()
-                .sending
-                .send_federation_request(
-                    server_name,
-                    media::get_content::v3::Request {
-                        server_name: server_name.to_owned(),
-                        media_id,
-                        timeout_ms: Duration::from_secs(20),
-                        allow_remote: false,
-                        allow_redirect: true,
-                    },
-                )
-                .await?;
-
-            get_content::v1::Response {
-                file,
-                content_type,
-                content_disposition,
-            }
-        }
-        Err(e) => return Err(e),
-    };
+        .await?;

    services()
        .media
        .create(
            mxc.to_owned(),
-            content_response.content_disposition.clone(),
+            content_response.content_disposition.as_deref(),
            content_response.content_type.as_deref(),
            &content_response.file,
        )
@ -156,58 +94,26 @@ pub async fn get_remote_content(
 ///
 /// - Only allows federation if `allow_remote` is true
 pub async fn get_content_route(
-    body: Ruma<media::get_content::v3::Request>,
-) -> Result<media::get_content::v3::Response> {
-    let get_content::v1::Response {
-        file,
-        content_disposition,
-        content_type,
-    } = get_content(&body.server_name, body.media_id.clone(), body.allow_remote).await?;
+    body: Ruma<get_content::v3::Request>,
+) -> Result<get_content::v3::Response> {
+    let mxc = format!("mxc://{}/{}", body.server_name, body.media_id);

-    Ok(media::get_content::v3::Response {
-        file,
-        content_type,
-        content_disposition,
-        cross_origin_resource_policy: Some("cross-origin".to_owned()),
-    })
-}
-
-/// # `GET /_matrix/client/v1/media/download/{serverName}/{mediaId}`
-///
-/// Load media from our server or over federation.
-pub async fn get_content_auth_route(
-    body: Ruma<get_content::v1::Request>,
-) -> Result<get_content::v1::Response> {
-    get_content(&body.server_name, body.media_id.clone(), true).await
-}
-
-async fn get_content(
-    server_name: &ServerName,
-    media_id: String,
-    allow_remote: bool,
-) -> Result<get_content::v1::Response, Error> {
-    let mxc = format!("mxc://{}/{}", server_name, media_id);
-
-    if let Ok(Some(FileMeta {
+    if let Some(FileMeta {
        content_disposition,
        content_type,
        file,
-    })) = services().media.get(mxc.clone()).await
+    }) = services().media.get(mxc.clone()).await?
    {
-        Ok(get_content::v1::Response {
+        Ok(get_content::v3::Response {
            file,
            content_type,
-            content_disposition: Some(content_disposition),
+            content_disposition,
+            cross_origin_resource_policy: Some("cross-origin".to_owned()),
        })
-    } else if server_name != services().globals.server_name() && allow_remote {
+    } else if &*body.server_name != services().globals.server_name() && body.allow_remote {
        let remote_content_response =
-            get_remote_content(&mxc, server_name, media_id.clone()).await?;
-
-        Ok(get_content::v1::Response {
-            content_disposition: remote_content_response.content_disposition,
-            content_type: remote_content_response.content_type,
-            file: remote_content_response.file,
-        })
+            get_remote_content(&mxc, &body.server_name, body.media_id.clone()).await?;
+        Ok(remote_content_response)
    } else {
        Err(Error::BadRequest(ErrorKind::NotFound, "Media not found."))
    }
@ -219,74 +125,31 @@ async fn get_content(
 ///
 /// - Only allows federation if `allow_remote` is true
 pub async fn get_content_as_filename_route(
-    body: Ruma<media::get_content_as_filename::v3::Request>,
-) -> Result<media::get_content_as_filename::v3::Response> {
-    let get_content_as_filename::v1::Response {
-        file,
+    body: Ruma<get_content_as_filename::v3::Request>,
+) -> Result<get_content_as_filename::v3::Response> {
+    let mxc = format!("mxc://{}/{}", body.server_name, body.media_id);
+
+    if let Some(FileMeta {
+        content_disposition: _,
        content_type,
-        content_disposition,
-    } = get_content_as_filename(
-        &body.server_name,
-        body.media_id.clone(),
-        body.filename.clone(),
-        body.allow_remote,
-    )
-    .await?;
-
-    Ok(media::get_content_as_filename::v3::Response {
        file,
-        content_type,
-        content_disposition,
-        cross_origin_resource_policy: Some("cross-origin".to_owned()),
-    })
-}
-
-/// # `GET /_matrix/client/v1/media/download/{serverName}/{mediaId}/{fileName}`
-///
-/// Load media from our server or over federation, permitting desired filename.
-pub async fn get_content_as_filename_auth_route(
-    body: Ruma<get_content_as_filename::v1::Request>,
-) -> Result<get_content_as_filename::v1::Response, Error> {
-    get_content_as_filename(
-        &body.server_name,
-        body.media_id.clone(),
-        body.filename.clone(),
-        true,
-    )
-    .await
-}
-
-async fn get_content_as_filename(
-    server_name: &ServerName,
-    media_id: String,
-    filename: String,
-    allow_remote: bool,
-) -> Result<get_content_as_filename::v1::Response, Error> {
-    let mxc = format!("mxc://{}/{}", server_name, media_id);
-
-    if let Ok(Some(FileMeta {
-        file, content_type, ..
-    })) = services().media.get(mxc.clone()).await
+    }) = services().media.get(mxc.clone()).await?
    {
-        Ok(get_content_as_filename::v1::Response {
+        Ok(get_content_as_filename::v3::Response {
            file,
            content_type,
-            content_disposition: Some(
-                ContentDisposition::new(ContentDispositionType::Inline)
-                    .with_filename(Some(filename.clone())),
-            ),
+            content_disposition: Some(format!("inline; filename={}", body.filename)),
+            cross_origin_resource_policy: Some("cross-origin".to_owned()),
        })
-    } else if server_name != services().globals.server_name() && allow_remote {
+    } else if &*body.server_name != services().globals.server_name() && body.allow_remote {
        let remote_content_response =
-            get_remote_content(&mxc, server_name, media_id.clone()).await?;
+            get_remote_content(&mxc, &body.server_name, body.media_id.clone()).await?;

-        Ok(get_content_as_filename::v1::Response {
-            content_disposition: Some(
-                ContentDisposition::new(ContentDispositionType::Inline)
-                    .with_filename(Some(filename.clone())),
-            ),
+        Ok(get_content_as_filename::v3::Response {
+            content_disposition: Some(format!("inline: filename={}", body.filename)),
            content_type: remote_content_response.content_type,
            file: remote_content_response.file,
+            cross_origin_resource_policy: Some("cross-origin".to_owned()),
        })
    } else {
        Err(Error::BadRequest(ErrorKind::NotFound, "Media not found."))
@ -299,169 +162,62 @@ async fn get_content_as_filename(
 ///
 /// - Only allows federation if `allow_remote` is true
 pub async fn get_content_thumbnail_route(
-    body: Ruma<media::get_content_thumbnail::v3::Request>,
-) -> Result<media::get_content_thumbnail::v3::Response> {
-    let get_content_thumbnail::v1::Response { file, content_type } = get_content_thumbnail(
-        &body.server_name,
-        body.media_id.clone(),
-        body.height,
-        body.width,
-        body.method.clone(),
-        body.animated,
-        body.allow_remote,
-    )
-    .await?;
+    body: Ruma<get_content_thumbnail::v3::Request>,
+) -> Result<get_content_thumbnail::v3::Response> {
+    let mxc = format!("mxc://{}/{}", body.server_name, body.media_id);

-    Ok(media::get_content_thumbnail::v3::Response {
-        file,
-        content_type,
-        cross_origin_resource_policy: Some("cross-origin".to_owned()),
-    })
-}
-
-/// # `GET /_matrix/client/v1/media/thumbnail/{serverName}/{mediaId}`
-///
-/// Load media thumbnail from our server or over federation.
-pub async fn get_content_thumbnail_auth_route(
-    body: Ruma<get_content_thumbnail::v1::Request>,
-) -> Result<get_content_thumbnail::v1::Response> {
-    get_content_thumbnail(
-        &body.server_name,
-        body.media_id.clone(),
-        body.height,
-        body.width,
-        body.method.clone(),
-        body.animated,
-        true,
-    )
-    .await
-}
-
-async fn get_content_thumbnail(
-    server_name: &ServerName,
-    media_id: String,
-    height: UInt,
-    width: UInt,
-    method: Option<Method>,
-    animated: Option<bool>,
-    allow_remote: bool,
-) -> Result<get_content_thumbnail::v1::Response, Error> {
-    let mxc = format!("mxc://{}/{}", server_name, media_id);
-
-    if let Ok(Some(FileMeta {
-        file, content_type, ..
-    })) = services()
+    if let Some(FileMeta {
+        content_type, file, ..
+    }) = services()
        .media
        .get_thumbnail(
            mxc.clone(),
-            width
+            body.width
                .try_into()
                .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Width is invalid."))?,
-            height
+            body.height
                .try_into()
-                .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Height is invalid."))?,
+                .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Width is invalid."))?,
        )
-        .await
+        .await?
    {
-        Ok(get_content_thumbnail::v1::Response { file, content_type })
-    } else if server_name != services().globals.server_name() && allow_remote {
-        let thumbnail_response = match services()
+        Ok(get_content_thumbnail::v3::Response {
+            file,
+            content_type,
+            cross_origin_resource_policy: Some("cross-origin".to_owned()),
+        })
+    } else if &*body.server_name != services().globals.server_name() && body.allow_remote {
+        let get_thumbnail_response = services()
            .sending
            .send_federation_request(
-                server_name,
-                federation_media::get_content_thumbnail::v1::Request {
-                    height,
-                    width,
-                    method: method.clone(),
-                    media_id: media_id.clone(),
+                &body.server_name,
+                get_content_thumbnail::v3::Request {
+                    allow_remote: false,
+                    height: body.height,
+                    width: body.width,
+                    method: body.method.clone(),
+                    server_name: body.server_name.clone(),
+                    media_id: body.media_id.clone(),
                    timeout_ms: Duration::from_secs(20),
-                    animated,
+                    allow_redirect: false,
                },
            )
-            .await
-        {
-            Ok(federation_media::get_content_thumbnail::v1::Response {
-                metadata: _,
-                content: FileOrLocation::File(content),
-            }) => get_content_thumbnail::v1::Response {
-                file: content.file,
-                content_type: content.content_type,
-            },
-
-            Ok(federation_media::get_content_thumbnail::v1::Response {
-                metadata: _,
-                content: FileOrLocation::Location(url),
-            }) => {
-                let get_content::v1::Response {
-                    file, content_type, ..
-                } = get_location_content(url).await?;
-
-                get_content_thumbnail::v1::Response { file, content_type }
-            }
-            Err(Error::BadRequest(ErrorKind::Unrecognized, _)) => {
-                let media::get_content_thumbnail::v3::Response {
-                    file, content_type, ..
-                } = services()
-                    .sending
-                    .send_federation_request(
-                        server_name,
-                        media::get_content_thumbnail::v3::Request {
-                            height,
-                            width,
-                            method: method.clone(),
-                            server_name: server_name.to_owned(),
-                            media_id: media_id.clone(),
-                            timeout_ms: Duration::from_secs(20),
-                            allow_redirect: false,
-                            animated,
-                            allow_remote: false,
-                        },
-                    )
-                    .await?;
-
-                get_content_thumbnail::v1::Response { file, content_type }
-            }
-            Err(e) => return Err(e),
-        };
+            .await?;

        services()
            .media
            .upload_thumbnail(
                mxc,
-                thumbnail_response.content_type.as_deref(),
-                width.try_into().expect("all UInts are valid u32s"),
-                height.try_into().expect("all UInts are valid u32s"),
-                &thumbnail_response.file,
+                None,
+                get_thumbnail_response.content_type.as_deref(),
+                body.width.try_into().expect("all UInts are valid u32s"),
+                body.height.try_into().expect("all UInts are valid u32s"),
+                &get_thumbnail_response.file,
            )
            .await?;

-        Ok(thumbnail_response)
+        Ok(get_thumbnail_response)
    } else {
        Err(Error::BadRequest(ErrorKind::NotFound, "Media not found."))
    }
 }
-
-async fn get_location_content(url: String) -> Result<get_content::v1::Response, Error> {
-    let client = services().globals.default_client();
-    let response = client.get(url).send().await?;
-    let headers = response.headers();
-
-    let content_type = headers
-        .get(CONTENT_TYPE)
-        .and_then(|header| header.to_str().ok())
-        .map(ToOwned::to_owned);
-
-    let content_disposition = headers
-        .get(CONTENT_DISPOSITION)
-        .map(|header| header.as_bytes())
-        .map(TryFrom::try_from)
-        .and_then(Result::ok);
-
-    let file = response.bytes().await?.to_vec();
-
-    Ok(get_content::v1::Response {
-        file,
-        content_type,
-        content_disposition,
-    })
-}
--- a/src/api/client_server/membership.rs
+++ b/src/api/client_server/membership.rs
@ -18,8 +18,9 @@ use ruma::{
        },
        StateEventType, TimelineEventType,
    },
-    state_res, CanonicalJsonObject, CanonicalJsonValue, EventId, MilliSecondsSinceUnixEpoch,
-    OwnedEventId, OwnedRoomId, OwnedServerName, OwnedUserId, RoomId, RoomVersionId, UserId,
+    serde::Base64,
+    state_res, CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, OwnedRoomId,
+    OwnedServerName, OwnedUserId, RoomId, RoomVersionId, UserId,
 };
 use serde_json::value::{to_raw_value, RawValue as RawJsonValue};
 use std::{
@ -31,10 +32,7 @@ use tokio::sync::RwLock;
 use tracing::{debug, error, info, warn};

 use crate::{
-    service::{
-        globals::SigningKeys,
-        pdu::{gen_event_id_canonical_json, PduBuilder},
-    },
+    service::pdu::{gen_event_id_canonical_json, PduBuilder},
    services, utils, Error, PduEvent, Result, Ruma,
 };

@ -97,7 +95,7 @@ pub async fn join_room_by_id_or_alias_route(

    let (servers, room_id) = match OwnedRoomId::try_from(body.room_id_or_alias) {
        Ok(room_id) => {
-            let mut servers = body.via.clone();
+            let mut servers = body.server_name.clone();
            servers.extend(
                services()
                    .rooms
@ -188,7 +186,15 @@ pub async fn kick_user_route(
 ) -> Result<kick_user::v3::Response> {
    let sender_user = body.sender_user.as_ref().expect("user is authenticated");

-    let event: RoomMemberEventContent = serde_json::from_str(
+    if let Ok(true) = services()
+        .rooms
+        .state_cache
+        .is_left(sender_user, &body.room_id)
+    {
+        return Ok(kick_user::v3::Response {});
+    }
+
+    let mut event: RoomMemberEventContent = serde_json::from_str(
        services()
            .rooms
            .state_accessor
@ -199,26 +205,15 @@ pub async fn kick_user_route(
            )?
            .ok_or(Error::BadRequest(
                ErrorKind::BadState,
-                "Cannot kick a user who is not in the room.",
+                "Cannot kick member that's not in the room.",
            ))?
            .content
            .get(),
    )
    .map_err(|_| Error::bad_database("Invalid member event in database."))?;

-    // If they are already kicked and the reason is unchanged, there isn't any point in sending a new event.
-    if event.membership == MembershipState::Leave && event.reason == body.reason {
-        return Ok(kick_user::v3::Response {});
-    }
-
-    let event = RoomMemberEventContent {
-        is_direct: None,
-        membership: MembershipState::Leave,
-        third_party_invite: None,
-        reason: body.reason.clone(),
-        join_authorized_via_users_server: None,
-        ..event
-    };
+    event.membership = MembershipState::Leave;
+    event.reason.clone_from(&body.reason);

    let mutex_state = Arc::clone(
        services()
@ -241,7 +236,6 @@ pub async fn kick_user_route(
                unsigned: None,
                state_key: Some(body.user_id.to_string()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &body.room_id,
@ -260,7 +254,17 @@ pub async fn kick_user_route(
 pub async fn ban_user_route(body: Ruma<ban_user::v3::Request>) -> Result<ban_user::v3::Response> {
    let sender_user = body.sender_user.as_ref().expect("user is authenticated");

-    let event = if let Some(event) = services()
+    if let Ok(Some(membership_event)) = services()
+        .rooms
+        .state_accessor
+        .get_member(&body.room_id, sender_user)
+    {
+        if membership_event.membership == MembershipState::Ban {
+            return Ok(ban_user::v3::Response {});
+        }
+    }
+
+    let event = services()
        .rooms
        .state_accessor
        .room_state_get(
@ -268,30 +272,27 @@ pub async fn ban_user_route(body: Ruma<ban_user::v3::Request>) -> Result<ban_use
            &StateEventType::RoomMember,
            body.user_id.as_ref(),
        )?
-        // Even when the previous member content is invalid, we should let the ban go through anyways.
-        .and_then(|event| serde_json::from_str::<RoomMemberEventContent>(event.content.get()).ok())
-    {
-        // If they are already banned and the reason is unchanged, there isn't any point in sending a new event.
-        if event.membership == MembershipState::Ban && event.reason == body.reason {
-            return Ok(ban_user::v3::Response {});
-        }
-
-        RoomMemberEventContent {
-            membership: MembershipState::Ban,
-            join_authorized_via_users_server: None,
-            reason: body.reason.clone(),
-            third_party_invite: None,
-            is_direct: None,
-            avatar_url: event.avatar_url,
-            displayname: event.displayname,
-            blurhash: event.blurhash,
-        }
-    } else {
-        RoomMemberEventContent {
-            reason: body.reason.clone(),
-            ..RoomMemberEventContent::new(MembershipState::Ban)
-        }
-    };
+        .map_or(
+            Ok(RoomMemberEventContent {
+                membership: MembershipState::Ban,
+                displayname: services().users.displayname(&body.user_id)?,
+                avatar_url: services().users.avatar_url(&body.user_id)?,
+                is_direct: None,
+                third_party_invite: None,
+                blurhash: services().users.blurhash(&body.user_id)?,
+                reason: body.reason.clone(),
+                join_authorized_via_users_server: None,
+            }),
+            |event| {
+                serde_json::from_str(event.content.get())
+                    .map(|event: RoomMemberEventContent| RoomMemberEventContent {
+                        membership: MembershipState::Ban,
+                        join_authorized_via_users_server: None,
+                        ..event
+                    })
+                    .map_err(|_| Error::bad_database("Invalid member event in database."))
+            },
+        )?;

    let mutex_state = Arc::clone(
        services()
@ -314,7 +315,6 @@ pub async fn ban_user_route(body: Ruma<ban_user::v3::Request>) -> Result<ban_use
                unsigned: None,
                state_key: Some(body.user_id.to_string()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &body.room_id,
@ -335,7 +335,17 @@ pub async fn unban_user_route(
 ) -> Result<unban_user::v3::Response> {
    let sender_user = body.sender_user.as_ref().expect("user is authenticated");

-    let event: RoomMemberEventContent = serde_json::from_str(
+    if let Ok(Some(membership_event)) = services()
+        .rooms
+        .state_accessor
+        .get_member(&body.room_id, sender_user)
+    {
+        if membership_event.membership != MembershipState::Ban {
+            return Ok(unban_user::v3::Response {});
+        }
+    }
+
+    let mut event: RoomMemberEventContent = serde_json::from_str(
        services()
            .rooms
            .state_accessor
@ -353,19 +363,8 @@ pub async fn unban_user_route(
    )
    .map_err(|_| Error::bad_database("Invalid member event in database."))?;

-    // If they are already unbanned and the reason is unchanged, there isn't any point in sending a new event.
-    if event.membership == MembershipState::Leave && event.reason == body.reason {
-        return Ok(unban_user::v3::Response {});
-    }
-
-    let event = RoomMemberEventContent {
-        is_direct: None,
-        membership: MembershipState::Leave,
-        third_party_invite: None,
-        reason: body.reason.clone(),
-        join_authorized_via_users_server: None,
-        ..event
-    };
+    event.membership = MembershipState::Leave;
+    event.reason.clone_from(&body.reason);

    let mutex_state = Arc::clone(
        services()
@ -388,7 +387,6 @@ pub async fn unban_user_route(
                unsigned: None,
                state_key: Some(body.user_id.to_string()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &body.room_id,
@ -456,7 +454,7 @@ pub async fn get_member_events_route(
        .user_can_see_state_events(sender_user, &body.room_id)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You don't have permission to view this room.",
        ));
    }
@ -491,7 +489,7 @@ pub async fn joined_members_route(
        .user_can_see_state_events(sender_user, &body.room_id)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You don't have permission to view this room.",
        ));
    }
@ -627,7 +625,7 @@ async fn join_room_by_id_helper(
        let event_id = format!(
            "${}",
            ruma::signatures::reference_hash(&join_event_stub, &room_version_id)
-                .expect("Event format validated when event was hashed")
+                .expect("ruma can calculate reference hashes")
        );
        let event_id = <&EventId>::try_from(event_id.as_str())
            .expect("ruma's reference hashes are valid event ids");
@ -941,7 +939,6 @@ async fn join_room_by_id_helper(
                    unsigned: None,
                    state_key: Some(sender_user.to_string()),
                    redacts: None,
-                    timestamp: None,
                },
                sender_user,
                room_id,
@ -987,8 +984,6 @@ async fn join_room_by_id_helper(
                        .as_str()
                })
                .and_then(|s| OwnedUserId::try_from(s.unwrap_or_default()).ok());
-            let restricted_join = join_authorized_via_users_server.is_some();
-
            // TODO: Is origin needed?
            join_event_stub.insert(
                "origin".to_owned(),
@ -1035,7 +1030,7 @@ async fn join_room_by_id_helper(
                ruma::signatures::reference_hash(&join_event_stub, &room_version_id)
                    .expect("ruma can calculate reference hashes")
            );
-            let event_id = OwnedEventId::try_from(event_id)
+            let event_id = <&EventId>::try_from(event_id.as_str())
                .expect("ruma's reference hashes are valid event ids");

            // Add event_id back
@ -1060,32 +1055,43 @@ async fn join_room_by_id_helper(
                )
                .await?;

-            let pdu = if let Some(signed_raw) = send_join_response.room_state.event {
-                let (signed_event_id, signed_pdu) =
-                    gen_event_id_canonical_json(&signed_raw, &room_version_id)?;
+            if let Some(signed_raw) = send_join_response.room_state.event {
+                let (signed_event_id, signed_value) =
+                    match gen_event_id_canonical_json(&signed_raw, &room_version_id) {
+                        Ok(t) => t,
+                        Err(_) => {
+                            // Event could not be converted to canonical json
+                            return Err(Error::BadRequest(
+                                ErrorKind::InvalidParam,
+                                "Could not convert event to canonical json.",
+                            ));
+                        }
+                    };

                if signed_event_id != event_id {
-                    return Err(Error::BadServerResponse(
+                    return Err(Error::BadRequest(
+                        ErrorKind::InvalidParam,
                        "Server sent event with wrong event id",
                    ));
                }

-                signed_pdu
-            } else if restricted_join {
-                return Err(Error::BadServerResponse(
-                    "No signed event was returned, despite just performing a restricted join",
-                ));
+                drop(state_lock);
+                let pub_key_map = RwLock::new(BTreeMap::new());
+                services()
+                    .rooms
+                    .event_handler
+                    .handle_incoming_pdu(
+                        &remote_server,
+                        &signed_event_id,
+                        room_id,
+                        signed_value,
+                        true,
+                        &pub_key_map,
+                    )
+                    .await?;
            } else {
-                join_event
-            };
-
-            drop(state_lock);
-            let pub_key_map = RwLock::new(BTreeMap::new());
-            services()
-                .rooms
-                .event_handler
-                .handle_incoming_pdu(&remote_server, &event_id, room_id, pdu, true, &pub_key_map)
-                .await?;
+                return Err(error);
+            }
        } else {
            return Err(error);
        }
@ -1136,7 +1142,7 @@ async fn make_join_request(
 async fn validate_and_add_event_id(
    pdu: &RawJsonValue,
    room_version: &RoomVersionId,
-    pub_key_map: &RwLock<BTreeMap<String, SigningKeys>>,
+    pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
 ) -> Result<(OwnedEventId, CanonicalJsonObject)> {
    let mut value: CanonicalJsonObject = serde_json::from_str(pdu.get()).map_err(|e| {
        error!("Invalid PDU in server response: {:?}: {:?}", pdu, e);
@ -1145,7 +1151,7 @@ async fn validate_and_add_event_id(
    let event_id = EventId::parse(format!(
        "${}",
        ruma::signatures::reference_hash(&value, room_version)
-            .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Invalid PDU format"))?
+            .expect("ruma can calculate reference hashes")
    ))
    .expect("ruma's reference hashes are valid event ids");

@ -1183,35 +1189,8 @@ async fn validate_and_add_event_id(
        }
    }

-    let origin_server_ts = value.get("origin_server_ts").ok_or_else(|| {
-        error!("Invalid PDU, no origin_server_ts field");
-        Error::BadRequest(
-            ErrorKind::MissingParam,
-            "Invalid PDU, no origin_server_ts field",
-        )
-    })?;
-
-    let origin_server_ts: MilliSecondsSinceUnixEpoch = {
-        let ts = origin_server_ts.as_integer().ok_or_else(|| {
-            Error::BadRequest(
-                ErrorKind::InvalidParam,
-                "origin_server_ts must be an integer",
-            )
-        })?;
-
-        MilliSecondsSinceUnixEpoch(i64::from(ts).try_into().map_err(|_| {
-            Error::BadRequest(ErrorKind::InvalidParam, "Time must be after the unix epoch")
-        })?)
-    };
-
-    let unfiltered_keys = (*pub_key_map.read().await).clone();
-
-    let keys =
-        services()
-            .globals
-            .filter_keys_server_map(unfiltered_keys, origin_server_ts, room_version);
-
-    if let Err(e) = ruma::signatures::verify_event(&keys, &value, room_version) {
+    if let Err(e) = ruma::signatures::verify_event(&*pub_key_map.read().await, &value, room_version)
+    {
        warn!("Event {} failed verification {:?} {}", event_id, pdu, e);
        back_off(event_id).await;
        return Err(Error::BadServerResponse("Event failed verification."));
@ -1264,7 +1243,6 @@ pub(crate) async fn invite_helper<'a>(
                    unsigned: None,
                    state_key: Some(user_id.to_string()),
                    redacts: None,
-                    timestamp: None,
                },
                sender_user,
                room_id,
@ -1341,61 +1319,61 @@ pub(crate) async fn invite_helper<'a>(
            .filter(|server| &**server != services().globals.server_name());

        services().sending.send_pdu(servers, &pdu_id)?;
-    } else {
-        if !services()
-            .rooms
-            .state_cache
-            .is_joined(sender_user, room_id)?
-        {
-            return Err(Error::BadRequest(
-                ErrorKind::forbidden(),
-                "You don't have permission to view this room.",
-            ));
-        }

-        let mutex_state = Arc::clone(
-            services()
-                .globals
-                .roomid_mutex_state
-                .write()
-                .await
-                .entry(room_id.to_owned())
-                .or_default(),
-        );
-        let state_lock = mutex_state.lock().await;
-
-        services()
-            .rooms
-            .timeline
-            .build_and_append_pdu(
-                PduBuilder {
-                    event_type: TimelineEventType::RoomMember,
-                    content: to_raw_value(&RoomMemberEventContent {
-                        membership: MembershipState::Invite,
-                        displayname: services().users.displayname(user_id)?,
-                        avatar_url: services().users.avatar_url(user_id)?,
-                        is_direct: Some(is_direct),
-                        third_party_invite: None,
-                        blurhash: services().users.blurhash(user_id)?,
-                        reason,
-                        join_authorized_via_users_server: None,
-                    })
-                    .expect("event is valid, we just created it"),
-                    unsigned: None,
-                    state_key: Some(user_id.to_string()),
-                    redacts: None,
-                    timestamp: None,
-                },
-                sender_user,
-                room_id,
-                &state_lock,
-            )
-            .await?;
-
-        // Critical point ends
-        drop(state_lock);
+        return Ok(());
    }

+    if !services()
+        .rooms
+        .state_cache
+        .is_joined(sender_user, room_id)?
+    {
+        return Err(Error::BadRequest(
+            ErrorKind::Forbidden,
+            "You don't have permission to view this room.",
+        ));
+    }
+
+    let mutex_state = Arc::clone(
+        services()
+            .globals
+            .roomid_mutex_state
+            .write()
+            .await
+            .entry(room_id.to_owned())
+            .or_default(),
+    );
+    let state_lock = mutex_state.lock().await;
+
+    services()
+        .rooms
+        .timeline
+        .build_and_append_pdu(
+            PduBuilder {
+                event_type: TimelineEventType::RoomMember,
+                content: to_raw_value(&RoomMemberEventContent {
+                    membership: MembershipState::Invite,
+                    displayname: services().users.displayname(user_id)?,
+                    avatar_url: services().users.avatar_url(user_id)?,
+                    is_direct: Some(is_direct),
+                    third_party_invite: None,
+                    blurhash: services().users.blurhash(user_id)?,
+                    reason,
+                    join_authorized_via_users_server: None,
+                })
+                .expect("event is valid, we just created it"),
+                unsigned: None,
+                state_key: Some(user_id.to_string()),
+                redacts: None,
+            },
+            sender_user,
+            room_id,
+            &state_lock,
+        )
+        .await?;
+
+    drop(state_lock);
+
    Ok(())
 }

@ -1492,15 +1470,12 @@ pub async fn leave_room(user_id: &UserId, room_id: &RoomId, reason: Option<Strin
            Some(e) => e,
        };

-        let event = RoomMemberEventContent {
-            is_direct: None,
-            membership: MembershipState::Leave,
-            third_party_invite: None,
-            reason,
-            join_authorized_via_users_server: None,
-            ..serde_json::from_str(member_event.content.get())
-                .map_err(|_| Error::bad_database("Invalid member event in database."))?
-        };
+        let mut event: RoomMemberEventContent = serde_json::from_str(member_event.content.get())
+            .map_err(|_| Error::bad_database("Invalid member event in database."))?;
+
+        event.membership = MembershipState::Leave;
+        event.reason = reason;
+        event.join_authorized_via_users_server = None;

        services()
            .rooms
@ -1512,7 +1487,6 @@ pub async fn leave_room(user_id: &UserId, room_id: &RoomId, reason: Option<Strin
                    unsigned: None,
                    state_key: Some(user_id.to_string()),
                    redacts: None,
-                    timestamp: None,
                },
                user_id,
                room_id,
@ -1614,7 +1588,7 @@ async fn remote_leave_room(user_id: &UserId, room_id: &RoomId) -> Result<()> {
    let event_id = EventId::parse(format!(
        "${}",
        ruma::signatures::reference_hash(&leave_event_stub, &room_version_id)
-            .expect("Event format validated when event was hashed")
+            .expect("ruma can calculate reference hashes")
    ))
    .expect("ruma's reference hashes are valid event ids");

--- a/src/api/client_server/message.rs
+++ b/src/api/client_server/message.rs
@ -43,7 +43,7 @@ pub async fn send_message_event_route(
        && !services().globals.allow_encryption()
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "Encryption has been disabled",
        ));
    }
@ -84,11 +84,6 @@ pub async fn send_message_event_route(
                unsigned: Some(unsigned),
                state_key: None,
                redacts: None,
-                timestamp: if body.appservice_info.is_some() {
-                    body.timestamp
-                } else {
-                    None
-                },
            },
            sender_user,
            &body.room_id,
--- a/src/api/client_server/mod.rs
+++ b/src/api/client_server/mod.rs
@ -11,7 +11,6 @@ mod keys;
 mod media;
 mod membership;
 mod message;
-mod openid;
 mod presence;
 mod profile;
 mod push;
@ -48,7 +47,6 @@ pub use keys::*;
 pub use media::*;
 pub use membership::*;
 pub use message::*;
-pub use openid::*;
 pub use presence::*;
 pub use profile::*;
 pub use push::*;
--- a/src/api/client_server/openid.rs
+++ b/src/api/client_server/openid.rs
@ -1,23 +0,0 @@
-use std::time::Duration;
-
-use ruma::{api::client::account, authentication::TokenType};
-
-use crate::{services, Result, Ruma};
-
-/// # `POST /_matrix/client/r0/user/{userId}/openid/request_token`
-///
-/// Request an OpenID token to verify identity with third-party services.
-///
-/// - The token generated is only valid for the OpenID API.
-pub async fn create_openid_token_route(
-    body: Ruma<account::request_openid_token::v3::Request>,
-) -> Result<account::request_openid_token::v3::Response> {
-    let (access_token, expires_in) = services().users.create_openid_token(&body.user_id)?;
-
-    Ok(account::request_openid_token::v3::Response {
-        access_token,
-        token_type: TokenType::Bearer,
-        matrix_server_name: services().globals.server_name().to_owned(),
-        expires_in: Duration::from_secs(expires_in),
-    })
-}
--- a/src/api/client_server/profile.rs
+++ b/src/api/client_server/profile.rs
@ -65,7 +65,6 @@ pub async fn set_displayname_route(
                    unsigned: None,
                    state_key: Some(sender_user.to_string()),
                    redacts: None,
-                    timestamp: None,
                },
                room_id,
            ))
@ -201,7 +200,6 @@ pub async fn set_avatar_url_route(
                    unsigned: None,
                    state_key: Some(sender_user.to_string()),
                    redacts: None,
-                    timestamp: None,
                },
                room_id,
            ))
--- a/src/api/client_server/redact.rs
+++ b/src/api/client_server/redact.rs
@ -44,7 +44,6 @@ pub async fn redact_event_route(
                unsigned: None,
                state_key: None,
                redacts: Some(body.event_id.into()),
-                timestamp: None,
            },
            sender_user,
            &body.room_id,
--- a/src/api/client_server/relations.rs
+++ b/src/api/client_server/relations.rs
@ -3,7 +3,7 @@ use ruma::api::client::relations::{
    get_relating_events_with_rel_type_and_event_type,
 };

-use crate::{services, Result, Ruma};
+use crate::{service::rooms::timeline::PduCount, services, Result, Ruma};

 /// # `GET /_matrix/client/r0/rooms/{roomId}/relations/{eventId}/{relType}/{eventType}`
 pub async fn get_relating_events_with_rel_type_and_event_type_route(
@ -11,6 +11,27 @@ pub async fn get_relating_events_with_rel_type_and_event_type_route(
 ) -> Result<get_relating_events_with_rel_type_and_event_type::v1::Response> {
    let sender_user = body.sender_user.as_ref().expect("user is authenticated");

+    let from = match body.from.clone() {
+        Some(from) => PduCount::try_from_string(&from)?,
+        None => match ruma::api::Direction::Backward {
+            // TODO: fix ruma so `body.dir` exists
+            ruma::api::Direction::Forward => PduCount::min(),
+            ruma::api::Direction::Backward => PduCount::max(),
+        },
+    };
+
+    let to = body
+        .to
+        .as_ref()
+        .and_then(|t| PduCount::try_from_string(t).ok());
+
+    // Use limit or else 10, with maximum 100
+    let limit = body
+        .limit
+        .and_then(|u| u32::try_from(u).ok())
+        .map_or(10_usize, |u| u as usize)
+        .min(100);
+
    let res = services()
        .rooms
        .pdu_metadata
@ -20,11 +41,9 @@ pub async fn get_relating_events_with_rel_type_and_event_type_route(
            &body.event_id,
            Some(body.event_type.clone()),
            Some(body.rel_type.clone()),
-            body.from.clone(),
-            body.to.clone(),
-            body.limit,
-            body.recurse,
-            &body.dir,
+            from,
+            to,
+            limit,
        )?;

    Ok(
@ -32,7 +51,6 @@ pub async fn get_relating_events_with_rel_type_and_event_type_route(
            chunk: res.chunk,
            next_batch: res.next_batch,
            prev_batch: res.prev_batch,
-            recursion_depth: res.recursion_depth,
        },
    )
 }
@ -43,6 +61,27 @@ pub async fn get_relating_events_with_rel_type_route(
 ) -> Result<get_relating_events_with_rel_type::v1::Response> {
    let sender_user = body.sender_user.as_ref().expect("user is authenticated");

+    let from = match body.from.clone() {
+        Some(from) => PduCount::try_from_string(&from)?,
+        None => match ruma::api::Direction::Backward {
+            // TODO: fix ruma so `body.dir` exists
+            ruma::api::Direction::Forward => PduCount::min(),
+            ruma::api::Direction::Backward => PduCount::max(),
+        },
+    };
+
+    let to = body
+        .to
+        .as_ref()
+        .and_then(|t| PduCount::try_from_string(t).ok());
+
+    // Use limit or else 10, with maximum 100
+    let limit = body
+        .limit
+        .and_then(|u| u32::try_from(u).ok())
+        .map_or(10_usize, |u| u as usize)
+        .min(100);
+
    let res = services()
        .rooms
        .pdu_metadata
@ -52,18 +91,15 @@ pub async fn get_relating_events_with_rel_type_route(
            &body.event_id,
            None,
            Some(body.rel_type.clone()),
-            body.from.clone(),
-            body.to.clone(),
-            body.limit,
-            body.recurse,
-            &body.dir,
+            from,
+            to,
+            limit,
        )?;

    Ok(get_relating_events_with_rel_type::v1::Response {
        chunk: res.chunk,
        next_batch: res.next_batch,
        prev_batch: res.prev_batch,
-        recursion_depth: res.recursion_depth,
    })
 }

@ -73,6 +109,27 @@ pub async fn get_relating_events_route(
 ) -> Result<get_relating_events::v1::Response> {
    let sender_user = body.sender_user.as_ref().expect("user is authenticated");

+    let from = match body.from.clone() {
+        Some(from) => PduCount::try_from_string(&from)?,
+        None => match ruma::api::Direction::Backward {
+            // TODO: fix ruma so `body.dir` exists
+            ruma::api::Direction::Forward => PduCount::min(),
+            ruma::api::Direction::Backward => PduCount::max(),
+        },
+    };
+
+    let to = body
+        .to
+        .as_ref()
+        .and_then(|t| PduCount::try_from_string(t).ok());
+
+    // Use limit or else 10, with maximum 100
+    let limit = body
+        .limit
+        .and_then(|u| u32::try_from(u).ok())
+        .map_or(10_usize, |u| u as usize)
+        .min(100);
+
    services()
        .rooms
        .pdu_metadata
@ -82,10 +139,8 @@ pub async fn get_relating_events_route(
            &body.event_id,
            None,
            None,
-            body.from.clone(),
-            body.to.clone(),
-            body.limit,
-            body.recurse,
-            &body.dir,
+            from,
+            to,
+            limit,
        )
 }
--- a/src/api/client_server/room.rs
+++ b/src/api/client_server/room.rs
@ -72,7 +72,7 @@ pub async fn create_room_route(
        && !services().users.is_admin(sender_user)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "Room creation has been disabled.",
        ));
    }
@ -230,7 +230,6 @@ pub async fn create_room_route(
                unsigned: None,
                state_key: Some("".to_owned()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &room_id,
@ -259,7 +258,6 @@ pub async fn create_room_route(
                unsigned: None,
                state_key: Some(sender_user.to_string()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &room_id,
@ -313,7 +311,6 @@ pub async fn create_room_route(
                unsigned: None,
                state_key: Some("".to_owned()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &room_id,
@ -337,7 +334,6 @@ pub async fn create_room_route(
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
                sender_user,
                &room_id,
@ -364,7 +360,6 @@ pub async fn create_room_route(
                unsigned: None,
                state_key: Some("".to_owned()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &room_id,
@ -386,7 +381,6 @@ pub async fn create_room_route(
                unsigned: None,
                state_key: Some("".to_owned()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &room_id,
@ -409,7 +403,6 @@ pub async fn create_room_route(
                unsigned: None,
                state_key: Some("".to_owned()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &room_id,
@ -454,7 +447,6 @@ pub async fn create_room_route(
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
                sender_user,
                &room_id,
@ -477,7 +469,6 @@ pub async fn create_room_route(
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
                sender_user,
                &room_id,
@ -494,10 +485,7 @@ pub async fn create_room_route(

    // Homeserver specific stuff
    if let Some(alias) = alias {
-        services()
-            .rooms
-            .alias
-            .set_alias(&alias, &room_id, sender_user)?;
+        services().rooms.alias.set_alias(&alias, &room_id)?;
    }

    if body.visibility == room::Visibility::Public {
@ -534,7 +522,7 @@ pub async fn get_room_event_route(
        &body.event_id,
    )? {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You don't have permission to view this event.",
        ));
    }
@ -563,7 +551,7 @@ pub async fn get_room_aliases_route(
        .is_joined(sender_user, &body.room_id)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You don't have permission to view this room.",
        ));
    }
@ -638,7 +626,6 @@ pub async fn upgrade_room_route(
                unsigned: None,
                state_key: Some("".to_owned()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &body.room_id,
@ -740,7 +727,6 @@ pub async fn upgrade_room_route(
                unsigned: None,
                state_key: Some("".to_owned()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &replacement_room,
@ -769,7 +755,6 @@ pub async fn upgrade_room_route(
                unsigned: None,
                state_key: Some(sender_user.to_string()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &replacement_room,
@ -812,7 +797,6 @@ pub async fn upgrade_room_route(
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
                sender_user,
                &replacement_room,
@ -831,7 +815,7 @@ pub async fn upgrade_room_route(
        services()
            .rooms
            .alias
-            .set_alias(&alias, &replacement_room, sender_user)?;
+            .set_alias(&alias, &replacement_room)?;
    }

    // Get the old room power levels
@ -863,7 +847,6 @@ pub async fn upgrade_room_route(
                unsigned: None,
                state_key: Some("".to_owned()),
                redacts: None,
-                timestamp: None,
            },
            sender_user,
            &body.room_id,
--- a/src/api/client_server/search.rs
+++ b/src/api/client_server/search.rs
@ -43,7 +43,7 @@ pub async fn search_events_route(
            .is_joined(sender_user, &room_id)?
        {
            return Err(Error::BadRequest(
-                ErrorKind::forbidden(),
+                ErrorKind::Forbidden,
                "You don't have permission to view this room.",
            ));
        }
@ -89,12 +89,11 @@ pub async fn search_events_route(
                .get_pdu_from_id(result)
                .ok()?
                .filter(|pdu| {
-                    !pdu.is_redacted()
-                        && services()
-                            .rooms
-                            .state_accessor
-                            .user_can_see_event(sender_user, &pdu.room_id, &pdu.event_id)
-                            .unwrap_or(false)
+                    services()
+                        .rooms
+                        .state_accessor
+                        .user_can_see_event(sender_user, &pdu.room_id, &pdu.event_id)
+                        .unwrap_or(false)
                })
                .map(|pdu| pdu.to_room_event())
        })
--- a/src/api/client_server/session.rs
+++ b/src/api/client_server/session.rs
@ -63,7 +63,7 @@ pub async fn login_route(body: Ruma<login::v3::Request>) -> Result<login::v3::Re
                UserId::parse(user)
            } else {
                warn!("Bad login type: {:?}", &body.login_info);
-                return Err(Error::BadRequest(ErrorKind::forbidden(), "Bad login type."));
+                return Err(Error::BadRequest(ErrorKind::Forbidden, "Bad login type."));
            }
            .map_err(|_| Error::BadRequest(ErrorKind::InvalidUsername, "Username is invalid."))?;

@ -78,7 +78,7 @@ pub async fn login_route(body: Ruma<login::v3::Request>) -> Result<login::v3::Re
                .users
                .password_hash(&user_id)?
                .ok_or(Error::BadRequest(
-                    ErrorKind::forbidden(),
+                    ErrorKind::Forbidden,
                    "Wrong username or password.",
                ))?;

@ -93,7 +93,7 @@ pub async fn login_route(body: Ruma<login::v3::Request>) -> Result<login::v3::Re

            if !hash_matches {
                return Err(Error::BadRequest(
-                    ErrorKind::forbidden(),
+                    ErrorKind::Forbidden,
                    "Wrong username or password.",
                ));
            }
@ -143,7 +143,7 @@ pub async fn login_route(body: Ruma<login::v3::Request>) -> Result<login::v3::Re
                UserId::parse(user)
            } else {
                warn!("Bad login type: {:?}", &body.login_info);
-                return Err(Error::BadRequest(ErrorKind::forbidden(), "Bad login type."));
+                return Err(Error::BadRequest(ErrorKind::Forbidden, "Bad login type."));
            }
            .map_err(|_| Error::BadRequest(ErrorKind::InvalidUsername, "Username is invalid."))?;

--- a/src/api/client_server/state.rs
+++ b/src/api/client_server/state.rs
@ -10,7 +10,7 @@ use ruma::{
        room::canonical_alias::RoomCanonicalAliasEventContent, AnyStateEventContent, StateEventType,
    },
    serde::Raw,
-    EventId, MilliSecondsSinceUnixEpoch, RoomId, UserId,
+    EventId, RoomId, UserId,
 };
 use tracing::log::warn;

@ -32,11 +32,6 @@ pub async fn send_state_event_for_key_route(
        &body.event_type,
        &body.body.body, // Yes, I hate it too
        body.state_key.to_owned(),
-        if body.appservice_info.is_some() {
-            body.timestamp
-        } else {
-            None
-        },
    )
    .await?;

@ -59,7 +54,7 @@ pub async fn send_state_event_for_empty_key_route(
    // Forbid m.room.encryption if encryption is disabled
    if body.event_type == StateEventType::RoomEncryption && !services().globals.allow_encryption() {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "Encryption has been disabled",
        ));
    }
@ -70,11 +65,6 @@ pub async fn send_state_event_for_empty_key_route(
        &body.event_type.to_string().into(),
        &body.body.body,
        body.state_key.to_owned(),
-        if body.appservice_info.is_some() {
-            body.timestamp
-        } else {
-            None
-        },
    )
    .await?;

@ -98,7 +88,7 @@ pub async fn get_state_events_route(
        .user_can_see_state_events(sender_user, &body.room_id)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You don't have permission to view the room state.",
        ));
    }
@ -131,7 +121,7 @@ pub async fn get_state_events_for_key_route(
        .user_can_see_state_events(sender_user, &body.room_id)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You don't have permission to view the room state.",
        ));
    }
@ -170,7 +160,7 @@ pub async fn get_state_events_for_empty_key_route(
        .user_can_see_state_events(sender_user, &body.room_id)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You don't have permission to view the room state.",
        ));
    }
@ -200,7 +190,6 @@ async fn send_state_event_for_key_helper(
    event_type: &StateEventType,
    json: &Raw<AnyStateEventContent>,
    state_key: String,
-    timestamp: Option<MilliSecondsSinceUnixEpoch>,
 ) -> Result<Arc<EventId>> {
    let sender_user = sender;

@ -225,7 +214,7 @@ async fn send_state_event_for_key_helper(
                    .is_none()
            {
                return Err(Error::BadRequest(
-                    ErrorKind::forbidden(),
+                    ErrorKind::Forbidden,
                    "You are only allowed to send canonical_alias \
                    events when it's aliases already exists",
                ));
@ -254,7 +243,6 @@ async fn send_state_event_for_key_helper(
                unsigned: None,
                state_key: Some(state_key),
                redacts: None,
-                timestamp,
            },
            sender_user,
            room_id,
--- a/src/api/client_server/sync.rs
+++ b/src/api/client_server/sync.rs
@ -12,7 +12,7 @@ use ruma::{
                Ephemeral, Filter, GlobalAccountData, InviteState, InvitedRoom, JoinedRoom,
                LeftRoom, Presence, RoomAccountData, RoomSummary, Rooms, State, Timeline, ToDevice,
            },
-            v4::{SlidingOp, SlidingSyncRoomHero},
+            v4::SlidingOp,
            DeviceLists, UnreadNotificationsCount,
        },
        uiaa::UiaaResponse,
@ -716,7 +716,7 @@ async fn load_joined_room(
                                        .state_cache
                                        .is_invited(&user_id, room_id)?)
                                {
-                                    Ok::<_, Error>(Some(user_id))
+                                    Ok::<_, Error>(Some(state_key.clone()))
                                } else {
                                    Ok(None)
                                }
@ -1572,7 +1572,7 @@ pub async fn sync_events_v4_route(
            sender_user.clone(),
            sender_device.clone(),
            conn_id.clone(),
-            body.room_subscriptions.clone(),
+            body.room_subscriptions,
        );
    }

@ -1638,37 +1638,33 @@ pub async fn sync_events_v4_route(
                    .get_member(room_id, &member)
                    .ok()
                    .flatten()
-                    .map(|memberevent| SlidingSyncRoomHero {
-                        user_id: member,
-                        name: memberevent.displayname,
-                        avatar: memberevent.avatar_url,
+                    .map(|memberevent| {
+                        (
+                            memberevent
+                                .displayname
+                                .unwrap_or_else(|| member.to_string()),
+                            memberevent.avatar_url,
+                        )
                    })
            })
            .take(5)
            .collect::<Vec<_>>();
        let name = match &heroes[..] {
            [] => None,
-            [only] => Some(
-                only.name
-                    .clone()
-                    .unwrap_or_else(|| only.user_id.to_string()),
-            ),
+            [only] => Some(only.0.clone()),
            [firsts @ .., last] => Some(
                firsts
                    .iter()
-                    .map(|h| h.name.clone().unwrap_or_else(|| h.user_id.to_string()))
+                    .map(|h| h.0.clone())
                    .collect::<Vec<_>>()
                    .join(", ")
                    + " and "
-                    + &last
-                        .name
-                        .clone()
-                        .unwrap_or_else(|| last.user_id.to_string()),
+                    + &last.0,
            ),
        };

        let avatar = if let [only] = &heroes[..] {
-            only.avatar.clone()
+            only.1.clone()
        } else {
            None
        };
@ -1729,16 +1725,6 @@ pub async fn sync_events_v4_route(
                ),
                num_live: None, // Count events in timeline greater than global sync counter
                timestamp: None,
-                heroes: if body
-                    .room_subscriptions
-                    .get(room_id)
-                    .map(|sub| sub.include_heroes.unwrap_or_default())
-                    .unwrap_or_default()
-                {
-                    Some(heroes)
-                } else {
-                    None
-                },
            },
        );
    }
--- a/src/api/client_server/typing.rs
+++ b/src/api/client_server/typing.rs
@ -17,7 +17,7 @@ pub async fn create_typing_event_route(
        .is_joined(sender_user, &body.room_id)?
    {
        return Err(Error::BadRequest(
-            ErrorKind::forbidden(),
+            ErrorKind::Forbidden,
            "You are not in this room.",
        ));
    }
--- a/src/api/client_server/unversioned.rs
+++ b/src/api/client_server/unversioned.rs
@ -27,10 +27,7 @@ pub async fn get_supported_versions_route(
            "v1.4".to_owned(),
            "v1.5".to_owned(),
        ],
-        unstable_features: BTreeMap::from_iter([
-            ("org.matrix.e2e_cross_signing".to_owned(), true),
-            ("org.matrix.msc3916.stable".to_owned(), true),
-        ]),
+        unstable_features: BTreeMap::from_iter([("org.matrix.e2e_cross_signing".to_owned(), true)]),
    };

    Ok(resp)
--- a/src/api/ruma_wrapper/axum.rs
+++ b/src/api/ruma_wrapper/axum.rs
@ -2,22 +2,20 @@ use std::{collections::BTreeMap, iter::FromIterator, str};

 use axum::{
    async_trait,
-    body::Body,
-    extract::{FromRequest, Path},
+    body::{Full, HttpBody},
+    extract::{rejection::TypedHeaderRejectionReason, FromRequest, Path, TypedHeader},
+    headers::{
+        authorization::{Bearer, Credentials},
+        Authorization,
+    },
    response::{IntoResponse, Response},
-    RequestExt, RequestPartsExt,
+    BoxError, RequestExt, RequestPartsExt,
 };
-use axum_extra::{
-    headers::{authorization::Bearer, Authorization},
-    typed_header::TypedHeaderRejectionReason,
-    TypedHeader,
-};
-use bytes::{BufMut, BytesMut};
+use bytes::{Buf, BufMut, Bytes, BytesMut};
 use http::{Request, StatusCode};
 use ruma::{
    api::{client::error::ErrorKind, AuthScheme, IncomingRequest, OutgoingResponse},
-    server_util::authorization::XMatrix,
-    CanonicalJsonValue, MilliSecondsSinceUnixEpoch, OwnedDeviceId, OwnedUserId, UserId,
+    CanonicalJsonValue, OwnedDeviceId, OwnedServerName, OwnedUserId, UserId,
 };
 use serde::Deserialize;
 use tracing::{debug, error, warn};
@ -33,33 +31,37 @@ enum Token {
 }

 #[async_trait]
-impl<T, S> FromRequest<S> for Ruma<T>
+impl<T, S, B> FromRequest<S, B> for Ruma<T>
 where
    T: IncomingRequest,
+    B: HttpBody + Send + 'static,
+    B::Data: Send,
+    B::Error: Into<BoxError>,
 {
    type Rejection = Error;

-    async fn from_request(req: Request<Body>, _state: &S) -> Result<Self, Self::Rejection> {
+    async fn from_request(req: Request<B>, _state: &S) -> Result<Self, Self::Rejection> {
        #[derive(Deserialize)]
        struct QueryParams {
            access_token: Option<String>,
            user_id: Option<String>,
        }

-        let (mut parts, mut body) = {
-            let limited_req = req.with_limited_body();
-            let (parts, body) = limited_req.into_parts();
-            let body = axum::body::to_bytes(
-                body,
-                services()
-                    .globals
-                    .max_request_size()
-                    .try_into()
-                    .unwrap_or(usize::MAX),
-            )
-            .await
-            .map_err(|_| Error::BadRequest(ErrorKind::MissingToken, "Missing token."))?;
-            (parts, body)
+        let (mut parts, mut body) = match req.with_limited_body() {
+            Ok(limited_req) => {
+                let (parts, body) = limited_req.into_parts();
+                let body = to_bytes(body)
+                    .await
+                    .map_err(|_| Error::BadRequest(ErrorKind::MissingToken, "Missing token."))?;
+                (parts, body)
+            }
+            Err(original_req) => {
+                let (parts, body) = original_req.into_parts();
+                let body = to_bytes(body)
+                    .await
+                    .map_err(|_| Error::BadRequest(ErrorKind::MissingToken, "Missing token."))?;
+                (parts, body)
+            }
        };

        let metadata = T::METADATA;
@ -100,15 +102,10 @@ where
        let (sender_user, sender_device, sender_servername, appservice_info) =
            match (metadata.authentication, token) {
                (_, Token::Invalid) => {
-                    // OpenID endpoint uses a query param with the same name, drop this once query params for user auth are removed from the spec
-                    if query_params.access_token.is_some() {
-                        (None, None, None, None)
-                    } else {
-                        return Err(Error::BadRequest(
-                            ErrorKind::UnknownToken { soft_logout: false },
-                            "Unknown access token.",
-                        ));
-                    }
+                    return Err(Error::BadRequest(
+                        ErrorKind::UnknownToken { soft_logout: false },
+                        "Unknown access token.",
+                    ))
                }
                (AuthScheme::AccessToken, Token::Appservice(info)) => {
                    let user_id = query_params
@ -135,7 +132,7 @@ where

                    if !services().users.exists(&user_id)? {
                        return Err(Error::BadRequest(
-                            ErrorKind::forbidden(),
+                            ErrorKind::Forbidden,
                            "User does not exist.",
                        ));
                    }
@ -175,7 +172,7 @@ where
                                _ => "Unknown header-related error",
                            };

-                            Error::BadRequest(ErrorKind::forbidden(), msg)
+                            Error::BadRequest(ErrorKind::Forbidden, msg)
                        })?;

                    if let Some(dest) = x_matrix.destination {
@ -189,17 +186,12 @@ where

                    let origin_signatures = BTreeMap::from_iter([(
                        x_matrix.key.clone(),
-                        CanonicalJsonValue::String(x_matrix.sig.to_string()),
+                        CanonicalJsonValue::String(x_matrix.sig),
                    )]);

                    let signatures = BTreeMap::from_iter([(
                        x_matrix.origin.as_str().to_owned(),
-                        CanonicalJsonValue::Object(
-                            origin_signatures
-                                .into_iter()
-                                .map(|(k, v)| (k.to_string(), v))
-                                .collect(),
-                        ),
+                        CanonicalJsonValue::Object(origin_signatures),
                    )]);

                    let mut request_map = BTreeMap::from_iter([
@ -234,7 +226,7 @@ where
                    let keys_result = services()
                        .rooms
                        .event_handler
-                        .fetch_signing_keys(&x_matrix.origin, vec![x_matrix.key.to_string()], false)
+                        .fetch_signing_keys(&x_matrix.origin, vec![x_matrix.key.to_owned()])
                        .await;

                    let keys = match keys_result {
@ -242,25 +234,14 @@ where
                        Err(e) => {
                            warn!("Failed to fetch signing keys: {}", e);
                            return Err(Error::BadRequest(
-                                ErrorKind::forbidden(),
+                                ErrorKind::Forbidden,
                                "Failed to fetch signing keys.",
                            ));
                        }
                    };

-                    // Only verify_keys that are currently valid should be used for validating requests
-                    // as per MSC4029
-                    let pub_key_map = BTreeMap::from_iter([(
-                        x_matrix.origin.as_str().to_owned(),
-                        if keys.valid_until_ts > MilliSecondsSinceUnixEpoch::now() {
-                            keys.verify_keys
-                                .into_iter()
-                                .map(|(id, key)| (id, key.key))
-                                .collect()
-                        } else {
-                            BTreeMap::new()
-                        },
-                    )]);
+                    let pub_key_map =
+                        BTreeMap::from_iter([(x_matrix.origin.as_str().to_owned(), keys)]);

                    match ruma::signatures::verify_json(&pub_key_map, &request_map) {
                        Ok(()) => (None, None, Some(x_matrix.origin), None),
@ -279,7 +260,7 @@ where
                            }

                            return Err(Error::BadRequest(
-                                ErrorKind::forbidden(),
+                                ErrorKind::Forbidden,
                                "Failed to verify X-Matrix signatures.",
                            ));
                        }
@ -359,11 +340,124 @@ where
    }
 }

+struct XMatrix {
+    destination: Option<OwnedServerName>,
+    origin: OwnedServerName,
+    key: String, // KeyName?
+    sig: String,
+}
+
+impl Credentials for XMatrix {
+    const SCHEME: &'static str = "X-Matrix";
+
+    fn decode(value: &http::HeaderValue) -> Option<Self> {
+        debug_assert!(
+            value.as_bytes().starts_with(b"X-Matrix "),
+            "HeaderValue to decode should start with \"X-Matrix ..\", received = {value:?}",
+        );
+
+        let parameters = str::from_utf8(&value.as_bytes()["X-Matrix ".len()..])
+            .ok()?
+            .trim_start();
+
+        let mut origin = None;
+        let mut key = None;
+        let mut sig = None;
+        let mut destination = None;
+
+        for entry in parameters.split_terminator(',') {
+            let (name, value) = entry.split_once('=')?;
+
+            // It's not at all clear why some fields are quoted and others not in the spec,
+            // let's simply accept either form for every field.
+            let value = value
+                .strip_prefix('"')
+                .and_then(|rest| rest.strip_suffix('"'))
+                .unwrap_or(value);
+
+            // FIXME: Catch multiple fields of the same name
+            match name {
+                "origin" => origin = Some(value.try_into().ok()?),
+                "key" => key = Some(value.to_owned()),
+                "sig" => sig = Some(value.to_owned()),
+                "destination" => destination = Some(value.try_into().ok()?),
+                _ => debug!(
+                    "Unexpected field `{}` in X-Matrix Authorization header",
+                    name
+                ),
+            }
+        }
+
+        Some(Self {
+            destination,
+            origin: origin?,
+            key: key?,
+            sig: sig?,
+        })
+    }
+
+    fn encode(&self) -> http::HeaderValue {
+        todo!()
+    }
+}
+
 impl<T: OutgoingResponse> IntoResponse for RumaResponse<T> {
    fn into_response(self) -> Response {
        match self.0.try_into_http_response::<BytesMut>() {
-            Ok(res) => res.map(BytesMut::freeze).map(Body::from).into_response(),
+            Ok(res) => res.map(BytesMut::freeze).map(Full::new).into_response(),
            Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
        }
    }
 }
+
+// copied from hyper under the following license:
+// Copyright (c) 2014-2021 Sean McArthur
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+pub(crate) async fn to_bytes<T>(body: T) -> Result<Bytes, T::Error>
+where
+    T: HttpBody,
+{
+    futures_util::pin_mut!(body);
+
+    // If there's only 1 chunk, we can just return Buf::to_bytes()
+    let mut first = if let Some(buf) = body.data().await {
+        buf?
+    } else {
+        return Ok(Bytes::new());
+    };
+
+    let second = if let Some(buf) = body.data().await {
+        buf?
+    } else {
+        return Ok(first.copy_to_bytes(first.remaining()));
+    };
+
+    // With more than 1 buf, we gotta flatten into a Vec first.
+    let cap = first.remaining() + second.remaining() + body.size_hint().lower() as usize;
+    let mut vec = Vec::with_capacity(cap);
+    vec.put(first);
+    vec.put(second);
+
+    while let Some(buf) = body.data().await {
+        vec.put(buf?);
+    }
+
+    Ok(vec.into())
+}
--- a/src/api/server_server.rs
+++ b/src/api/server_server.rs
--- a/src/clap.rs
+++ b/src/clap.rs
@ -1,6 +1,6 @@
 //! Integration with `clap`

-use clap::Parser;
+use clap::{Parser, Subcommand};

 /// Returns the current version of the crate with extra info if supplied
 ///
@ -19,7 +19,20 @@ fn version() -> String {
 /// Command line arguments
 #[derive(Parser)]
 #[clap(about, version = version())]
-pub struct Args {}
+pub struct Args {
+    #[command(subcommand)]
+    pub command: Option<Commands>,
+
+    /// Path to the config file
+    #[arg(short, long, value_name = "PATH")]
+    pub config: Option<String>,
+}
+
+#[derive(Subcommand)]
+pub enum Commands {
+    /// Generates a default config file
+    GenerateConfig,
+}

 /// Parse command line arguments into structured data
 pub fn parse() -> Args {
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@ -47,8 +47,6 @@ pub struct Config {
    #[serde(default = "false_fn")]
    pub allow_registration: bool,
    pub registration_token: Option<String>,
-    #[serde(default = "default_openid_token_ttl")]
-    pub openid_token_ttl: u64,
    #[serde(default = "true_fn")]
    pub allow_encryption: bool,
    #[serde(default = "false_fn")]
@ -59,7 +57,7 @@ pub struct Config {
    pub allow_unstable_room_versions: bool,
    #[serde(default = "default_default_room_version")]
    pub default_room_version: RoomVersionId,
-    #[serde(default, flatten)]
+    #[serde(default)]
    pub well_known: WellKnownConfig,
    #[serde(default = "false_fn")]
    pub allow_jaeger: bool,
@ -97,9 +95,7 @@ pub struct TlsConfig {

 #[derive(Clone, Debug, Deserialize, Default)]
 pub struct WellKnownConfig {
-    #[serde(rename = "well_known_client")]
    pub client: Option<Url>,
-    #[serde(rename = "well_known_server")]
    pub server: Option<OwnedServerName>,
 }

@ -306,10 +302,6 @@ fn default_turn_ttl() -> u64 {
    60 * 60 * 24
 }

-fn default_openid_token_ttl() -> u64 {
-    60 * 60
-}
-
 // I know, it's a great name
 pub fn default_default_room_version() -> RoomVersionId {
    RoomVersionId::V10
--- a/src/database/key_value/globals.rs
+++ b/src/database/key_value/globals.rs
@ -1,19 +1,15 @@
-use std::collections::HashMap;
+use std::collections::{BTreeMap, HashMap};

 use async_trait::async_trait;
 use futures_util::{stream::FuturesUnordered, StreamExt};
 use lru_cache::LruCache;
 use ruma::{
-    api::federation::discovery::{OldVerifyKey, ServerSigningKeys},
+    api::federation::discovery::{ServerSigningKeys, VerifyKey},
    signatures::Ed25519KeyPair,
-    DeviceId, ServerName, UserId,
+    DeviceId, MilliSecondsSinceUnixEpoch, OwnedServerSigningKeyId, ServerName, UserId,
 };

-use crate::{
-    database::KeyValueDatabase,
-    service::{self, globals::SigningKeys},
-    services, utils, Error, Result,
-};
+use crate::{database::KeyValueDatabase, service, services, utils, Error, Result};

 pub const COUNTER: &[u8] = b"c";
 pub const LAST_CHECK_FOR_UPDATES_COUNT: &[u8] = b"u";
@ -241,97 +237,64 @@ lasttimelinecount_cache: {lasttimelinecount_cache}\n"
        self.global.remove(b"keypair")
    }

-    fn add_signing_key_from_trusted_server(
+    fn add_signing_key(
        &self,
        origin: &ServerName,
        new_keys: ServerSigningKeys,
-    ) -> Result<SigningKeys> {
-        let prev_keys = self.server_signingkeys.get(origin.as_bytes())?;
+    ) -> Result<BTreeMap<OwnedServerSigningKeyId, VerifyKey>> {
+        // Not atomic, but this is not critical
+        let signingkeys = self.server_signingkeys.get(origin.as_bytes())?;

-        Ok(
-            if let Some(mut prev_keys) =
-                prev_keys.and_then(|keys| serde_json::from_slice::<ServerSigningKeys>(&keys).ok())
-            {
-                let ServerSigningKeys {
-                    verify_keys,
-                    old_verify_keys,
-                    ..
-                } = new_keys;
+        let mut keys = signingkeys
+            .and_then(|keys| serde_json::from_slice(&keys).ok())
+            .unwrap_or_else(|| {
+                // Just insert "now", it doesn't matter
+                ServerSigningKeys::new(origin.to_owned(), MilliSecondsSinceUnixEpoch::now())
+            });

-                prev_keys.verify_keys.extend(verify_keys);
-                prev_keys.old_verify_keys.extend(old_verify_keys);
-                prev_keys.valid_until_ts = new_keys.valid_until_ts;
+        let ServerSigningKeys {
+            verify_keys,
+            old_verify_keys,
+            ..
+        } = new_keys;

-                self.server_signingkeys.insert(
-                    origin.as_bytes(),
-                    &serde_json::to_vec(&prev_keys).expect("serversigningkeys can be serialized"),
-                )?;
+        keys.verify_keys.extend(verify_keys);
+        keys.old_verify_keys.extend(old_verify_keys);

-                prev_keys.into()
-            } else {
-                self.server_signingkeys.insert(
-                    origin.as_bytes(),
-                    &serde_json::to_vec(&new_keys).expect("serversigningkeys can be serialized"),
-                )?;
+        self.server_signingkeys.insert(
+            origin.as_bytes(),
+            &serde_json::to_vec(&keys).expect("serversigningkeys can be serialized"),
+        )?;

-                new_keys.into()
-            },
-        )
-    }
+        let mut tree = keys.verify_keys;
+        tree.extend(
+            keys.old_verify_keys
+                .into_iter()
+                .map(|old| (old.0, VerifyKey::new(old.1.key))),
+        );

-    fn add_signing_key_from_origin(
-        &self,
-        origin: &ServerName,
-        new_keys: ServerSigningKeys,
-    ) -> Result<SigningKeys> {
-        let prev_keys = self.server_signingkeys.get(origin.as_bytes())?;
-
-        Ok(
-            if let Some(mut prev_keys) =
-                prev_keys.and_then(|keys| serde_json::from_slice::<ServerSigningKeys>(&keys).ok())
-            {
-                let ServerSigningKeys {
-                    verify_keys,
-                    old_verify_keys,
-                    ..
-                } = new_keys;
-
-                // Moving `verify_keys` no longer present to `old_verify_keys`
-                for (key_id, key) in prev_keys.verify_keys {
-                    if !verify_keys.contains_key(&key_id) {
-                        prev_keys
-                            .old_verify_keys
-                            .insert(key_id, OldVerifyKey::new(prev_keys.valid_until_ts, key.key));
-                    }
-                }
-
-                prev_keys.verify_keys = verify_keys;
-                prev_keys.old_verify_keys.extend(old_verify_keys);
-                prev_keys.valid_until_ts = new_keys.valid_until_ts;
-
-                self.server_signingkeys.insert(
-                    origin.as_bytes(),
-                    &serde_json::to_vec(&prev_keys).expect("serversigningkeys can be serialized"),
-                )?;
-
-                prev_keys.into()
-            } else {
-                self.server_signingkeys.insert(
-                    origin.as_bytes(),
-                    &serde_json::to_vec(&new_keys).expect("serversigningkeys can be serialized"),
-                )?;
-
-                new_keys.into()
-            },
-        )
+        Ok(tree)
    }

    /// This returns an empty `Ok(BTreeMap<..>)` when there are no keys found for the server.
-    fn signing_keys_for(&self, origin: &ServerName) -> Result<Option<SigningKeys>> {
+    fn signing_keys_for(
+        &self,
+        origin: &ServerName,
+    ) -> Result<BTreeMap<OwnedServerSigningKeyId, VerifyKey>> {
        let signingkeys = self
            .server_signingkeys
            .get(origin.as_bytes())?
-            .and_then(|bytes| serde_json::from_slice::<SigningKeys>(&bytes).ok());
+            .and_then(|bytes| serde_json::from_slice(&bytes).ok())
+            .map(|keys: ServerSigningKeys| {
+                let mut tree = keys.verify_keys;
+                tree.extend(
+                    keys.old_verify_keys
+                        .into_iter()
+                        .map(|old| (old.0, VerifyKey::new(old.1.key))),
+                );
+                tree
+            })
+            .unwrap_or_else(BTreeMap::new);

        Ok(signingkeys)
    }
--- a/src/database/key_value/media.rs
+++ b/src/database/key_value/media.rs
@ -1,4 +1,4 @@
-use ruma::{api::client::error::ErrorKind, http_headers::ContentDisposition};
+use ruma::api::client::error::ErrorKind;

 use crate::{database::KeyValueDatabase, service, utils, Error, Result};

@ -8,7 +8,7 @@ impl service::media::Data for KeyValueDatabase {
        mxc: String,
        width: u32,
        height: u32,
-        content_disposition: &ContentDisposition,
+        content_disposition: Option<&str>,
        content_type: Option<&str>,
    ) -> Result<Vec<u8>> {
        let mut key = mxc.as_bytes().to_vec();
@ -16,7 +16,12 @@ impl service::media::Data for KeyValueDatabase {
        key.extend_from_slice(&width.to_be_bytes());
        key.extend_from_slice(&height.to_be_bytes());
        key.push(0xff);
-        key.extend_from_slice(content_disposition.to_string().as_bytes());
+        key.extend_from_slice(
+            content_disposition
+                .as_ref()
+                .map(|f| f.as_bytes())
+                .unwrap_or_default(),
+        );
        key.push(0xff);
        key.extend_from_slice(
            content_type
@ -35,7 +40,7 @@ impl service::media::Data for KeyValueDatabase {
        mxc: String,
        width: u32,
        height: u32,
-    ) -> Result<(ContentDisposition, Option<String>, Vec<u8>)> {
+    ) -> Result<(Option<String>, Option<String>, Vec<u8>)> {
        let mut prefix = mxc.as_bytes().to_vec();
        prefix.push(0xff);
        prefix.extend_from_slice(&width.to_be_bytes());
@ -63,9 +68,15 @@ impl service::media::Data for KeyValueDatabase {
            .next()
            .ok_or_else(|| Error::bad_database("Media ID in db is invalid."))?;

-        let content_disposition = content_disposition_bytes.try_into().unwrap_or_else(|_| {
-            ContentDisposition::new(ruma::http_headers::ContentDispositionType::Inline)
-        });
+        let content_disposition = if content_disposition_bytes.is_empty() {
+            None
+        } else {
+            Some(
+                utils::string_from_bytes(content_disposition_bytes).map_err(|_| {
+                    Error::bad_database("Content Disposition in mediaid_file is invalid unicode.")
+                })?,
+            )
+        };
        Ok((content_disposition, content_type, key))
    }
 }
--- a/src/database/key_value/rooms/alias.rs
+++ b/src/database/key_value/rooms/alias.rs
@ -1,15 +1,9 @@
-use ruma::{
-    api::client::error::ErrorKind, OwnedRoomAliasId, OwnedRoomId, OwnedUserId, RoomAliasId, RoomId,
-    UserId,
-};
+use ruma::{api::client::error::ErrorKind, OwnedRoomAliasId, OwnedRoomId, RoomAliasId, RoomId};

 use crate::{database::KeyValueDatabase, service, services, utils, Error, Result};

 impl service::rooms::alias::Data for KeyValueDatabase {
-    fn set_alias(&self, alias: &RoomAliasId, room_id: &RoomId, user_id: &UserId) -> Result<()> {
-        // Comes first as we don't want a stuck alias
-        self.alias_userid
-            .insert(alias.alias().as_bytes(), user_id.as_bytes())?;
+    fn set_alias(&self, alias: &RoomAliasId, room_id: &RoomId) -> Result<()> {
        self.alias_roomid
            .insert(alias.alias().as_bytes(), room_id.as_bytes())?;
        let mut aliasid = room_id.as_bytes().to_vec();
@ -28,13 +22,13 @@ impl service::rooms::alias::Data for KeyValueDatabase {
                self.aliasid_alias.remove(&key)?;
            }
            self.alias_roomid.remove(alias.alias().as_bytes())?;
-            self.alias_userid.remove(alias.alias().as_bytes())
        } else {
-            Err(Error::BadRequest(
+            return Err(Error::BadRequest(
                ErrorKind::NotFound,
                "Alias does not exist.",
-            ))
+            ));
        }
+        Ok(())
    }

    fn resolve_local_alias(&self, alias: &RoomAliasId) -> Result<Option<OwnedRoomId>> {
@ -63,16 +57,4 @@ impl service::rooms::alias::Data for KeyValueDatabase {
                .map_err(|_| Error::bad_database("Invalid alias in aliasid_alias."))
        }))
    }
-
-    fn who_created_alias(&self, alias: &RoomAliasId) -> Result<Option<OwnedUserId>> {
-        self.alias_userid
-            .get(alias.alias().as_bytes())?
-            .map(|bytes| {
-                UserId::parse(utils::string_from_bytes(&bytes).map_err(|_| {
-                    Error::bad_database("User ID in alias_userid is invalid unicode.")
-                })?)
-                .map_err(|_| Error::bad_database("User ID in alias_roomid is invalid."))
-            })
-            .transpose()
-    }
 }
--- a/src/database/key_value/rooms/search.rs
+++ b/src/database/key_value/rooms/search.rs
@ -2,46 +2,24 @@ use ruma::RoomId;

 use crate::{database::KeyValueDatabase, service, services, utils, Result};

-/// Splits a string into tokens used as keys in the search inverted index
-///
-/// This may be used to tokenize both message bodies (for indexing) or search
-/// queries (for querying).
-fn tokenize(body: &str) -> impl Iterator<Item = String> + '_ {
-    body.split_terminator(|c: char| !c.is_alphanumeric())
-        .filter(|s| !s.is_empty())
-        .filter(|word| word.len() <= 50)
-        .map(str::to_lowercase)
-}
-
 impl service::rooms::search::Data for KeyValueDatabase {
    fn index_pdu<'a>(&self, shortroomid: u64, pdu_id: &[u8], message_body: &str) -> Result<()> {
-        let mut batch = tokenize(message_body).map(|word| {
-            let mut key = shortroomid.to_be_bytes().to_vec();
-            key.extend_from_slice(word.as_bytes());
-            key.push(0xff);
-            key.extend_from_slice(pdu_id); // TODO: currently we save the room id a second time here
-            (key, Vec::new())
-        });
+        let mut batch = message_body
+            .split_terminator(|c: char| !c.is_alphanumeric())
+            .filter(|s| !s.is_empty())
+            .filter(|word| word.len() <= 50)
+            .map(str::to_lowercase)
+            .map(|word| {
+                let mut key = shortroomid.to_be_bytes().to_vec();
+                key.extend_from_slice(word.as_bytes());
+                key.push(0xff);
+                key.extend_from_slice(pdu_id); // TODO: currently we save the room id a second time here
+                (key, Vec::new())
+            });

        self.tokenids.insert_batch(&mut batch)
    }

-    fn deindex_pdu(&self, shortroomid: u64, pdu_id: &[u8], message_body: &str) -> Result<()> {
-        let batch = tokenize(message_body).map(|word| {
-            let mut key = shortroomid.to_be_bytes().to_vec();
-            key.extend_from_slice(word.as_bytes());
-            key.push(0xFF);
-            key.extend_from_slice(pdu_id); // TODO: currently we save the room id a second time here
-            key
-        });
-
-        for token in batch {
-            self.tokenids.remove(&token)?;
-        }
-
-        Ok(())
-    }
-
    fn search_pdus<'a>(
        &'a self,
        room_id: &RoomId,
@ -55,7 +33,11 @@ impl service::rooms::search::Data for KeyValueDatabase {
            .to_be_bytes()
            .to_vec();

-        let words: Vec<_> = tokenize(search_string).collect();
+        let words: Vec<_> = search_string
+            .split_terminator(|c: char| !c.is_alphanumeric())
+            .filter(|s| !s.is_empty())
+            .map(str::to_lowercase)
+            .collect();

        let iterators = words.clone().into_iter().map(move |word| {
            let mut prefix2 = prefix.clone();
--- a/src/database/key_value/uiaa.rs
+++ b/src/database/key_value/uiaa.rs
@ -80,7 +80,7 @@ impl service::uiaa::Data for KeyValueDatabase {
                .userdevicesessionid_uiaainfo
                .get(&userdevicesessionid)?
                .ok_or(Error::BadRequest(
-                    ErrorKind::forbidden(),
+                    ErrorKind::Forbidden,
                    "UIAA session does not exist.",
                ))?,
        )
--- a/src/database/key_value/users.rs
+++ b/src/database/key_value/users.rs
@ -11,7 +11,6 @@ use ruma::{
 use tracing::warn;

 use crate::{
-    api::client_server::TOKEN_LENGTH,
    database::KeyValueDatabase,
    service::{self, users::clean_signatures},
    services, utils, Error, Result,
@ -944,52 +943,6 @@ impl service::users::Data for KeyValueDatabase {
            Ok(None)
        }
    }
-
-    // Creates an OpenID token, which can be used to prove that a user has access to an account (primarily for integrations)
-    fn create_openid_token(&self, user_id: &UserId) -> Result<(String, u64)> {
-        let token = utils::random_string(TOKEN_LENGTH);
-
-        let expires_in = services().globals.config.openid_token_ttl;
-        let expires_at = utils::millis_since_unix_epoch()
-            .checked_add(expires_in * 1000)
-            .expect("time is valid");
-
-        let mut value = expires_at.to_be_bytes().to_vec();
-        value.extend_from_slice(user_id.as_bytes());
-
-        self.openidtoken_expiresatuserid
-            .insert(token.as_bytes(), value.as_slice())?;
-
-        Ok((token, expires_in))
-    }
-
-    /// Find out which user an OpenID access token belongs to.
-    fn find_from_openid_token(&self, token: &str) -> Result<Option<OwnedUserId>> {
-        let Some(value) = self.openidtoken_expiresatuserid.get(token.as_bytes())? else {
-            return Ok(None);
-        };
-        let (expires_at_bytes, user_bytes) = value.split_at(0u64.to_be_bytes().len());
-
-        let expires_at = u64::from_be_bytes(
-            expires_at_bytes
-                .try_into()
-                .map_err(|_| Error::bad_database("expires_at in openid_userid is invalid u64."))?,
-        );
-
-        if expires_at < utils::millis_since_unix_epoch() {
-            self.openidtoken_expiresatuserid.remove(token.as_bytes())?;
-
-            return Ok(None);
-        }
-
-        Some(
-            UserId::parse(utils::string_from_bytes(user_bytes).map_err(|_| {
-                Error::bad_database("User ID in openid_userid is invalid unicode.")
-            })?)
-            .map_err(|_| Error::bad_database("User ID in openid_userid is invalid.")),
-        )
-        .transpose()
-    }
 }

 impl KeyValueDatabase {}
--- a/src/database/mod.rs
+++ b/src/database/mod.rs
@ -6,7 +6,6 @@ use crate::{
    SERVICES,
 };
 use abstraction::{KeyValueDatabaseEngine, KvTree};
-use base64::{engine::general_purpose, Engine};
 use directories::ProjectDirs;
 use lru_cache::LruCache;

@ -58,7 +57,6 @@ pub struct KeyValueDatabase {
    pub(super) userid_masterkeyid: Arc<dyn KvTree>,
    pub(super) userid_selfsigningkeyid: Arc<dyn KvTree>,
    pub(super) userid_usersigningkeyid: Arc<dyn KvTree>,
-    pub(super) openidtoken_expiresatuserid: Arc<dyn KvTree>, // expiresatuserid  = expiresat + userid

    pub(super) userfilterid_filter: Arc<dyn KvTree>, // UserFilterId = UserId + FilterId

@ -102,8 +100,6 @@ pub struct KeyValueDatabase {
    pub(super) userroomid_leftstate: Arc<dyn KvTree>,
    pub(super) roomuserid_leftcount: Arc<dyn KvTree>,

-    pub(super) alias_userid: Arc<dyn KvTree>, // User who created the alias
-
    pub(super) disabledroomids: Arc<dyn KvTree>, // Rooms where incoming federation handling is disabled

    pub(super) lazyloadedids: Arc<dyn KvTree>, // LazyLoadedIds = UserId + DeviceId + RoomId + LazyLoadedUserId
@ -294,7 +290,6 @@ impl KeyValueDatabase {
            userid_masterkeyid: builder.open_tree("userid_masterkeyid")?,
            userid_selfsigningkeyid: builder.open_tree("userid_selfsigningkeyid")?,
            userid_usersigningkeyid: builder.open_tree("userid_usersigningkeyid")?,
-            openidtoken_expiresatuserid: builder.open_tree("openidtoken_expiresatuserid")?,
            userfilterid_filter: builder.open_tree("userfilterid_filter")?,
            todeviceid_events: builder.open_tree("todeviceid_events")?,

@ -330,8 +325,6 @@ impl KeyValueDatabase {
            userroomid_leftstate: builder.open_tree("userroomid_leftstate")?,
            roomuserid_leftcount: builder.open_tree("roomuserid_leftcount")?,

-            alias_userid: builder.open_tree("alias_userid")?,
-
            disabledroomids: builder.open_tree("disabledroomids")?,

            lazyloadedids: builder.open_tree("lazyloadedids")?,
@ -411,9 +404,11 @@ impl KeyValueDatabase {
        // Matrix resource ownership is based on the server name; changing it
        // requires recreating the database from scratch.
        if services().users.count()? > 0 {
-            let conduit_user = services().globals.server_user();
+            let conduit_user =
+                UserId::parse_with_server_name("conduit", services().globals.server_name())
+                    .expect("@conduit:server_name is valid");

-            if !services().users.exists(conduit_user)? {
+            if !services().users.exists(&conduit_user)? {
                error!(
                    "The {} server user does not exist, and the database is not new.",
                    conduit_user
@ -425,7 +420,7 @@ impl KeyValueDatabase {
        }

        // If the database has any data, perform data migrations before starting
-        let latest_database_version = 16;
+        let latest_database_version = 13;

        if services().users.count()? > 0 {
            // MIGRATIONS
@ -942,86 +937,6 @@ impl KeyValueDatabase {
                warn!("Migration: 12 -> 13 finished");
            }

-            if services().globals.database_version()? < 16 {
-                // Reconstruct all media using the filesystem
-                db.mediaid_file.clear().unwrap();
-
-                for file in fs::read_dir(services().globals.get_media_folder()).unwrap() {
-                    let file = file.unwrap();
-                    let mediaid = general_purpose::URL_SAFE_NO_PAD
-                        .decode(file.file_name().into_string().unwrap())
-                        .unwrap();
-
-                    let mut parts = mediaid.rsplit(|&b| b == 0xff);
-
-                    let mut removed_bytes = 0;
-
-                    let content_type_bytes = parts.next().unwrap();
-                    removed_bytes += content_type_bytes.len() + 1;
-
-                    let content_disposition_bytes = parts
-                        .next()
-                        .ok_or_else(|| Error::bad_database("Media ID in db is invalid."))?;
-                    removed_bytes += content_disposition_bytes.len();
-
-                    let mut content_disposition =
-                        utils::string_from_bytes(content_disposition_bytes).map_err(|_| {
-                            Error::bad_database("Content Disposition in mediaid_file is invalid.")
-                        })?;
-
-                    if content_disposition.contains("filename=")
-                        && !content_disposition.contains("filename=\"")
-                    {
-                        println!("{}", &content_disposition);
-                        content_disposition =
-                            content_disposition.replacen("filename=", "filename=\"", 1);
-                        content_disposition.push('"');
-                        println!("{}", &content_disposition);
-
-                        let mut new_key = mediaid[..(mediaid.len() - removed_bytes)].to_vec();
-                        assert!(*new_key.last().unwrap() == 0xff);
-
-                        let mut shorter_key = new_key.clone();
-                        shorter_key.extend(
-                            ruma::http_headers::ContentDisposition::new(
-                                ruma::http_headers::ContentDispositionType::Inline,
-                            )
-                            .to_string()
-                            .as_bytes(),
-                        );
-                        shorter_key.push(0xff);
-                        shorter_key.extend_from_slice(content_type_bytes);
-
-                        new_key.extend_from_slice(content_disposition.to_string().as_bytes());
-                        new_key.push(0xff);
-                        new_key.extend_from_slice(content_type_bytes);
-
-                        // Some file names are too long. Ignore those.
-                        match fs::rename(
-                            services().globals.get_media_file(&mediaid),
-                            services().globals.get_media_file(&new_key),
-                        ) {
-                            Ok(_) => {
-                                db.mediaid_file.insert(&new_key, &[])?;
-                            }
-                            Err(_) => {
-                                fs::rename(
-                                    services().globals.get_media_file(&mediaid),
-                                    services().globals.get_media_file(&shorter_key),
-                                )
-                                .unwrap();
-                                db.mediaid_file.insert(&shorter_key, &[])?;
-                            }
-                        }
-                    } else {
-                        db.mediaid_file.insert(&mediaid, &[])?;
-                    }
-                }
-                services().globals.bump_database_version(16)?;
-
-                warn!("Migration: 13 -> 16 finished");
-            }
-
            assert_eq!(
                services().globals.database_version().unwrap(),
                latest_database_version
@ -1187,21 +1102,22 @@ impl KeyValueDatabase {

 /// Sets the emergency password and push rules for the @conduit account in case emergency password is set
 fn set_emergency_access() -> Result<bool> {
-    let conduit_user = services().globals.server_user();
+    let conduit_user = UserId::parse_with_server_name("conduit", services().globals.server_name())
+        .expect("@conduit:server_name is a valid UserId");

    services().users.set_password(
-        conduit_user,
+        &conduit_user,
        services().globals.emergency_password().as_deref(),
    )?;

    let (ruleset, res) = match services().globals.emergency_password() {
-        Some(_) => (Ruleset::server_default(conduit_user), Ok(true)),
+        Some(_) => (Ruleset::server_default(&conduit_user), Ok(true)),
        None => (Ruleset::new(), Ok(false)),
    };

    services().account_data.update(
        None,
-        conduit_user,
+        &conduit_user,
        GlobalAccountDataEventType::PushRules.to_string().into(),
        &serde_json::to_value(&GlobalAccountDataEvent {
            content: PushRulesEventContent { global: ruleset },
--- a/src/lib.rs
+++ b/src/lib.rs
@ -3,7 +3,7 @@ pub mod clap;
 mod config;
 mod database;
 mod service;
-mod utils;
+pub mod utils;

 // Not async due to services() being used in many closures, and async closures are not stable as of writing
 // This is the case for every other occurence of sync Mutex/RwLock, except for database related ones, where
--- a/src/main.rs
+++ b/src/main.rs
@ -1,21 +1,23 @@
 use std::{future::Future, io, net::SocketAddr, sync::atomic, time::Duration};

 use axum::{
-    body::Body,
    extract::{DefaultBodyLimit, FromRequestParts, MatchedPath},
-    middleware::map_response,
-    response::{IntoResponse, Response},
+    response::IntoResponse,
    routing::{any, get, on, MethodFilter},
    Router,
 };
 use axum_server::{bind, bind_rustls, tls_rustls::RustlsConfig, Handle as ServerHandle};
-use conduit::api::{client_server, server_server};
+use conduit::{
+    api::{client_server, server_server},
+    clap::Commands,
+    utils::random_string,
+};
 use figment::{
    providers::{Env, Format, Toml},
    Figment,
 };
 use http::{
-    header::{self, HeaderName, CONTENT_SECURITY_POLICY},
+    header::{self, HeaderName},
    Method, StatusCode, Uri,
 };
 use ruma::api::{
@ -25,7 +27,12 @@ use ruma::api::{
    },
    IncomingRequest,
 };
-use tokio::signal;
+use tokio::{
+    fs::{try_exists, File},
+    io::AsyncWriteExt,
+    signal,
+};
+use toml_edit::DocumentMut;
 use tower::ServiceBuilder;
 use tower_http::{
    cors::{self, CorsLayer},
@ -46,110 +53,129 @@ static GLOBAL: Jemalloc = Jemalloc;

 #[tokio::main]
 async fn main() {
-    clap::parse();
+    let cli = clap::parse();

-    // Initialize config
-    let raw_config =
-        Figment::new()
-            .merge(
-                Toml::file(Env::var("CONDUIT_CONFIG").expect(
-                    "The CONDUIT_CONFIG env var needs to be set. Example: /etc/conduit.toml",
-                ))
-                .nested(),
-            )
-            .merge(Env::prefixed("CONDUIT_").global().split("__"));
+    let path = cli.config.unwrap_or_else(|| {
+        Env::var("CONDUIT_CONFIG")
+            .expect("The config path must either be set via the -c/--config flag or the CONDUIT_CONFIG env var. Example: /etc/conduit.toml")
+    });

-    let config = match raw_config.extract::<Config>() {
-        Ok(s) => s,
-        Err(e) => {
-            eprintln!("It looks like your config is invalid. The following error occurred: {e}");
-            std::process::exit(1);
+    match cli.command {
+        Some(Commands::GenerateConfig) => {
+            let toml = include_str!("../conduit-example.toml");
+            let mut doc = toml.parse::<DocumentMut>().expect("invalid doc");
+            doc["global"]["registration_token"] = toml_edit::value(random_string(64));
+
+            if let Ok(true) = try_exists(path.clone()).await {
+                panic!("Error: file '{}' already exists", path);
+                // Any possible error should be caught on creation
+            } else {
+                match File::create(path).await {
+                    Ok(mut file) => match file.write(&doc.to_string().into_bytes()).await {
+                        Err(e) => panic!("Error writing config file: {e}"),
+                        Ok(_) => {
+                            println!("Successfully generated config file");
+                        }
+                    },
+                    Err(e) => panic!("Error creating config file: {e}"),
+                }
+            }
        }
-    };
+        None => {
+            // Initialize config
+            let raw_config = Figment::new()
+                .merge(Toml::file(path).nested())
+                .merge(Env::prefixed("CONDUIT_").global());

-    config.warn_deprecated();
+            let config = match raw_config.extract::<Config>() {
+                Ok(s) => s,
+                Err(e) => {
+                    eprintln!(
+                        "It looks like your config is invalid. The following error occurred: {e}"
+                    );
+                    std::process::exit(1);
+                }
+            };

-    if config.allow_jaeger {
-        opentelemetry::global::set_text_map_propagator(
-            opentelemetry_jaeger_propagator::Propagator::new(),
-        );
-        let tracer = opentelemetry_otlp::new_pipeline()
-            .tracing()
-            .with_exporter(opentelemetry_otlp::new_exporter().tonic())
-            .install_batch(opentelemetry_sdk::runtime::Tokio)
-            .unwrap();
-        let telemetry = tracing_opentelemetry::layer().with_tracer(tracer);
+            config.warn_deprecated();

-        let filter_layer = match EnvFilter::try_new(&config.log) {
-            Ok(s) => s,
-            Err(e) => {
-                eprintln!(
+            if config.allow_jaeger {
+                opentelemetry::global::set_text_map_propagator(
+                    opentelemetry_jaeger::Propagator::new(),
+                );
+                let tracer = opentelemetry_jaeger::new_agent_pipeline()
+                    .with_auto_split_batch(true)
+                    .with_service_name("conduit")
+                    .install_batch(opentelemetry::runtime::Tokio)
+                    .unwrap();
+                let telemetry = tracing_opentelemetry::layer().with_tracer(tracer);
+
+                let filter_layer = match EnvFilter::try_new(&config.log) {
+                    Ok(s) => s,
+                    Err(e) => {
+                        eprintln!(
                    "It looks like your log config is invalid. The following error occurred: {e}"
                );
-                EnvFilter::try_new("warn").unwrap()
+                        EnvFilter::try_new("warn").unwrap()
+                    }
+                };
+
+                let subscriber = tracing_subscriber::Registry::default()
+                    .with(filter_layer)
+                    .with(telemetry);
+                tracing::subscriber::set_global_default(subscriber).unwrap();
+            } else if config.tracing_flame {
+                let registry = tracing_subscriber::Registry::default();
+                let (flame_layer, _guard) =
+                    tracing_flame::FlameLayer::with_file("./tracing.folded").unwrap();
+                let flame_layer = flame_layer.with_empty_samples(false);
+
+                let filter_layer = EnvFilter::new("trace,h2=off");
+
+                let subscriber = registry.with(filter_layer).with(flame_layer);
+                tracing::subscriber::set_global_default(subscriber).unwrap();
+            } else {
+                let registry = tracing_subscriber::Registry::default();
+                let fmt_layer = tracing_subscriber::fmt::Layer::new();
+                let filter_layer = match EnvFilter::try_new(&config.log) {
+                    Ok(s) => s,
+                    Err(e) => {
+                        eprintln!("It looks like your config is invalid. The following error occured while parsing it: {e}");
+                        EnvFilter::try_new("warn").unwrap()
+                    }
+                };
+
+                let subscriber = registry.with(filter_layer).with(fmt_layer);
+                tracing::subscriber::set_global_default(subscriber).unwrap();
            }
-        };

-        let subscriber = tracing_subscriber::Registry::default()
-            .with(filter_layer)
-            .with(telemetry);
-        tracing::subscriber::set_global_default(subscriber).unwrap();
-    } else if config.tracing_flame {
-        let registry = tracing_subscriber::Registry::default();
-        let (flame_layer, _guard) =
-            tracing_flame::FlameLayer::with_file("./tracing.folded").unwrap();
-        let flame_layer = flame_layer.with_empty_samples(false);
+            // This is needed for opening lots of file descriptors, which tends to
+            // happen more often when using RocksDB and making lots of federation
+            // connections at startup. The soft limit is usually 1024, and the hard
+            // limit is usually 512000; I've personally seen it hit >2000.
+            //
+            // * https://www.freedesktop.org/software/systemd/man/systemd.exec.html#id-1.12.2.1.17.6
+            // * https://github.com/systemd/systemd/commit/0abf94923b4a95a7d89bc526efc84e7ca2b71741
+            #[cfg(unix)]
+            maximize_fd_limit()
+                .expect("should be able to increase the soft limit to the hard limit");

-        let filter_layer = EnvFilter::new("trace,h2=off");
+            info!("Loading database");
+            if let Err(error) = KeyValueDatabase::load_or_create(config).await {
+                error!(?error, "The database couldn't be loaded or created");

-        let subscriber = registry.with(filter_layer).with(flame_layer);
-        tracing::subscriber::set_global_default(subscriber).unwrap();
-    } else {
-        let registry = tracing_subscriber::Registry::default();
-        let fmt_layer = tracing_subscriber::fmt::Layer::new();
-        let filter_layer = match EnvFilter::try_new(&config.log) {
-            Ok(s) => s,
-            Err(e) => {
-                eprintln!("It looks like your config is invalid. The following error occured while parsing it: {e}");
-                EnvFilter::try_new("warn").unwrap()
+                std::process::exit(1);
+            };
+            let config = &services().globals.config;
+
+            info!("Starting server");
+            run_server().await.unwrap();
+
+            if config.allow_jaeger {
+                opentelemetry::global::shutdown_tracer_provider();
            }
-        };
-
-        let subscriber = registry.with(filter_layer).with(fmt_layer);
-        tracing::subscriber::set_global_default(subscriber).unwrap();
+        }
    }
-
-    // This is needed for opening lots of file descriptors, which tends to
-    // happen more often when using RocksDB and making lots of federation
-    // connections at startup. The soft limit is usually 1024, and the hard
-    // limit is usually 512000; I've personally seen it hit >2000.
-    //
-    // * https://www.freedesktop.org/software/systemd/man/systemd.exec.html#id-1.12.2.1.17.6
-    // * https://github.com/systemd/systemd/commit/0abf94923b4a95a7d89bc526efc84e7ca2b71741
-    #[cfg(unix)]
-    maximize_fd_limit().expect("should be able to increase the soft limit to the hard limit");
-
-    info!("Loading database");
-    if let Err(error) = KeyValueDatabase::load_or_create(config).await {
-        error!(?error, "The database couldn't be loaded or created");
-
-        std::process::exit(1);
-    };
-    let config = &services().globals.config;
-
-    info!("Starting server");
-    run_server().await.unwrap();
-
-    if config.allow_jaeger {
-        opentelemetry::global::shutdown_tracer_provider();
-    }
-}
-
-/// Adds additional headers to prevent any potential XSS attacks via the media repo
-async fn set_csp_header(response: Response) -> impl IntoResponse {
-    (
-        [(CONTENT_SECURITY_POLICY, "sandbox; default-src 'none'; script-src 'none'; plugin-types application/pdf; style-src 'unsafe-inline'; object-src 'self';")], response
-    )
 }

 async fn run_server() -> io::Result<()> {
@ -192,7 +218,6 @@ async fn run_server() -> io::Result<()> {
                ])
                .max_age(Duration::from_secs(86400)),
        )
-        .layer(map_response(set_csp_header))
        .layer(DefaultBodyLimit::max(
            config
                .max_request_size
@ -228,10 +253,10 @@ async fn run_server() -> io::Result<()> {
    Ok(())
 }

-async fn spawn_task(
-    req: http::Request<Body>,
-    next: axum::middleware::Next,
-) -> std::result::Result<Response, StatusCode> {
+async fn spawn_task<B: Send + 'static>(
+    req: http::Request<B>,
+    next: axum::middleware::Next<B>,
+) -> std::result::Result<axum::response::Response, StatusCode> {
    if services().globals.shutdown.load(atomic::Ordering::Relaxed) {
        return Err(StatusCode::SERVICE_UNAVAILABLE);
    }
@ -240,10 +265,10 @@ async fn spawn_task(
        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)
 }

-async fn unrecognized_method(
-    req: http::Request<Body>,
-    next: axum::middleware::Next,
-) -> std::result::Result<Response, StatusCode> {
+async fn unrecognized_method<B: Send>(
+    req: http::Request<B>,
+    next: axum::middleware::Next<B>,
+) -> std::result::Result<axum::response::Response, StatusCode> {
    let method = req.method().clone();
    let uri = req.uri().clone();
    let inner = next.run(req).await;
@ -289,7 +314,6 @@ fn routes(config: &Config) -> Router {
        .ruma_route(client_server::get_room_aliases_route)
        .ruma_route(client_server::get_filter_route)
        .ruma_route(client_server::create_filter_route)
-        .ruma_route(client_server::create_openid_token_route)
        .ruma_route(client_server::set_global_account_data_route)
        .ruma_route(client_server::set_room_account_data_route)
        .ruma_route(client_server::get_global_account_data_route)
@ -379,14 +403,10 @@ fn routes(config: &Config) -> Router {
        .ruma_route(client_server::turn_server_route)
        .ruma_route(client_server::send_event_to_device_route)
        .ruma_route(client_server::get_media_config_route)
-        .ruma_route(client_server::get_media_config_auth_route)
        .ruma_route(client_server::create_content_route)
        .ruma_route(client_server::get_content_route)
-        .ruma_route(client_server::get_content_auth_route)
        .ruma_route(client_server::get_content_as_filename_route)
-        .ruma_route(client_server::get_content_as_filename_auth_route)
        .ruma_route(client_server::get_content_thumbnail_route)
-        .ruma_route(client_server::get_content_thumbnail_auth_route)
        .ruma_route(client_server::get_devices_route)
        .ruma_route(client_server::get_device_route)
        .ruma_route(client_server::update_device_route)
@ -444,13 +464,10 @@ fn routes(config: &Config) -> Router {
            .ruma_route(server_server::create_join_event_v2_route)
            .ruma_route(server_server::create_invite_route)
            .ruma_route(server_server::get_devices_route)
-            .ruma_route(server_server::get_content_route)
-            .ruma_route(server_server::get_content_thumbnail_route)
            .ruma_route(server_server::get_room_information_route)
            .ruma_route(server_server::get_profile_information_route)
            .ruma_route(server_server::get_keys_route)
            .ruma_route(server_server::claim_keys_route)
-            .ruma_route(server_server::get_openid_userinfo_route)
            .ruma_route(server_server::well_known_server)
    } else {
        router
--- a/src/service/admin/mod.rs
+++ b/src/service/admin/mod.rs
@ -1,4 +1,9 @@
-use std::{collections::BTreeMap, convert::TryFrom, sync::Arc, time::Instant};
+use std::{
+    collections::BTreeMap,
+    convert::{TryFrom, TryInto},
+    sync::Arc,
+    time::Instant,
+};

 use clap::Parser;
 use regex::Regex;
@ -19,8 +24,7 @@ use ruma::{
        },
        TimelineEventType,
    },
-    EventId, MilliSecondsSinceUnixEpoch, OwnedRoomAliasId, OwnedRoomId, RoomAliasId, RoomId,
-    RoomVersionId, ServerName, UserId,
+    EventId, OwnedRoomAliasId, OwnedRoomId, RoomAliasId, RoomId, RoomVersionId, ServerName, UserId,
 };
 use serde_json::value::to_raw_value;
 use tokio::sync::{mpsc, Mutex, RwLock};
@ -73,12 +77,6 @@ enum AdminCommand {
    /// List all rooms we are currently handling an incoming pdu from
    IncomingFederation,

-    /// Removes an alias from the server
-    RemoveAlias {
-        /// The alias to be removed
-        alias: Box<RoomAliasId>,
-    },
-
    /// Deactivate a user
    ///
    /// User will not be removed from all rooms by default.
@ -162,23 +160,24 @@ enum AdminCommand {
        password: Option<String>,
    },

-    /// Temporarily toggle user registration by passing either true or false as an argument, does not persist between restarts
-    AllowRegistration { status: Option<bool> },
-
    /// Disables incoming federation handling for a room.
    DisableRoom { room_id: Box<RoomId> },
    /// Enables incoming federation handling for a room again.
    EnableRoom { room_id: Box<RoomId> },

-    /// Sign a json object using Conduit's signing keys, putting the json in a codeblock
+    /// Verify json signatures
+    /// [commandbody]()
+    /// # ```
+    /// # json here
+    /// # ```
    SignJson,

-    /// Verify json signatures, putting the json in a codeblock
+    /// Verify json signatures
+    /// [commandbody]()
+    /// # ```
+    /// # json here
+    /// # ```
    VerifyJson,
-
-    /// Parses a JSON object as an event then creates a hash and signs it, putting a room
-    /// version as an argument, and the json in a codeblock
-    HashAndSignEvent { room_version_id: RoomVersionId },
 }

 #[derive(Debug)]
@ -213,7 +212,8 @@ impl Service {
        // TODO: Use futures when we have long admin commands
        //let mut futures = FuturesUnordered::new();

-        let conduit_user = services().globals.server_user();
+        let conduit_user = UserId::parse(format!("@conduit:{}", services().globals.server_name()))
+            .expect("@conduit:server_name is valid");

        if let Ok(Some(conduit_room)) = services().admin.get_admin_room() {
            loop {
@ -246,9 +246,8 @@ impl Service {
                                    unsigned: None,
                                    state_key: None,
                                    redacts: None,
-                                    timestamp: None,
                                },
-                                conduit_user,
+                                &conduit_user,
                                &conduit_room,
                                &state_lock,
                            )
@ -661,24 +660,6 @@ impl Service {
                    "Created user with user_id: {user_id} and password: {password}"
                ))
            }
-            AdminCommand::AllowRegistration { status } => {
-                if let Some(status) = status {
-                    services().globals.set_registration(status).await;
-                    RoomMessageEventContent::text_plain(if status {
-                        "Registration is now enabled"
-                    } else {
-                        "Registration is now disabled"
-                    })
-                } else {
-                    RoomMessageEventContent::text_plain(
-                        if services().globals.allow_registration().await {
-                            "Registration is currently enabled"
-                        } else {
-                            "Registration is currently disabled"
-                        },
-                    )
-                }
-            }
            AdminCommand::DisableRoom { room_id } => {
                services().rooms.metadata.disable_room(&room_id, true)?;
                RoomMessageEventContent::text_plain("Room disabled.")
@ -860,46 +841,15 @@ impl Service {
                            services()
                                .rooms
                                .event_handler
-                                // Generally we shouldn't be checking against expired keys unless required, so in the admin
-                                // room it might be best to not allow expired keys
                                .fetch_required_signing_keys(&value, &pub_key_map)
                                .await?;

-                            let mut expired_key_map = BTreeMap::new();
-                            let mut valid_key_map = BTreeMap::new();
-
-                            for (server, keys) in pub_key_map.into_inner().into_iter() {
-                                if keys.valid_until_ts > MilliSecondsSinceUnixEpoch::now() {
-                                    valid_key_map.insert(
-                                        server,
-                                        keys.verify_keys
-                                            .into_iter()
-                                            .map(|(id, key)| (id, key.key))
-                                            .collect(),
-                                    );
-                                } else {
-                                    expired_key_map.insert(
-                                        server,
-                                        keys.verify_keys
-                                            .into_iter()
-                                            .map(|(id, key)| (id, key.key))
-                                            .collect(),
-                                    );
-                                }
-                            }
-
-                            if ruma::signatures::verify_json(&valid_key_map, &value).is_ok() {
-                                RoomMessageEventContent::text_plain("Signature correct")
-                            } else if let Err(e) =
-                                ruma::signatures::verify_json(&expired_key_map, &value)
-                            {
-                                RoomMessageEventContent::text_plain(format!(
+                            let pub_key_map = pub_key_map.read().await;
+                            match ruma::signatures::verify_json(&pub_key_map, &value) {
+                                Ok(_) => RoomMessageEventContent::text_plain("Signature correct"),
+                                Err(e) => RoomMessageEventContent::text_plain(format!(
                                    "Signature verification failed: {e}"
-                                ))
-                            } else {
-                                RoomMessageEventContent::text_plain(
-                                    "Signature correct (with expired keys)",
-                                )
+                                )),
                            }
                        }
                        Err(e) => RoomMessageEventContent::text_plain(format!("Invalid json: {e}")),
@ -910,61 +860,6 @@ impl Service {
                    )
                }
            }
-            AdminCommand::HashAndSignEvent { room_version_id } => {
-                if body.len() > 2
-                    // Language may be specified as part of the codeblock (e.g. "```json")
-                    && body[0].trim().starts_with("```")
-                    && body.last().unwrap().trim() == "```"
-                {
-                    let string = body[1..body.len() - 1].join("\n");
-                    match serde_json::from_str(&string) {
-                        Ok(mut value) => {
-                            if let Err(e) = ruma::signatures::hash_and_sign_event(
-                                services().globals.server_name().as_str(),
-                                services().globals.keypair(),
-                                &mut value,
-                                &room_version_id,
-                            ) {
-                                RoomMessageEventContent::text_plain(format!("Invalid event: {e}"))
-                            } else {
-                                let json_text = serde_json::to_string_pretty(&value)
-                                    .expect("canonical json is valid json");
-                                RoomMessageEventContent::text_plain(json_text)
-                            }
-                        }
-                        Err(e) => RoomMessageEventContent::text_plain(format!("Invalid json: {e}")),
-                    }
-                } else {
-                    RoomMessageEventContent::text_plain(
-                        "Expected code block in command body. Add --help for details.",
-                    )
-                }
-            }
-            AdminCommand::RemoveAlias { alias } => {
-                if alias.server_name() != services().globals.server_name() {
-                    RoomMessageEventContent::text_plain(
-                        "Cannot remove alias which is not from this server",
-                    )
-                } else if services()
-                    .rooms
-                    .alias
-                    .resolve_local_alias(&alias)?
-                    .is_none()
-                {
-                    RoomMessageEventContent::text_plain("No such alias exists")
-                } else {
-                    // We execute this as the server user for two reasons
-                    // 1. If the user can execute commands in the admin room, they can always remove the alias.
-                    // 2. In the future, we are likely going to be able to allow users to execute commands via
-                    //   other methods, such as IPC, which would lead to us not knowing their user id
-
-                    services()
-                        .rooms
-                        .alias
-                        .remove_alias(&alias, services().globals.server_user())?;
-                    RoomMessageEventContent::text_plain("Alias removed sucessfully")
-                }
-            }
        };

        Ok(reply_message_content)
@ -1072,9 +967,11 @@ impl Service {
        let state_lock = mutex_state.lock().await;

        // Create a user for the server
-        let conduit_user = services().globals.server_user();
+        let conduit_user =
+            UserId::parse_with_server_name("conduit", services().globals.server_name())
+                .expect("@conduit:server_name is valid");

-        services().users.create(conduit_user, None)?;
+        services().users.create(&conduit_user, None)?;

        let room_version = services().globals.default_room_version();
        let mut content = match room_version {
@ -1087,7 +984,7 @@ impl Service {
            | RoomVersionId::V7
            | RoomVersionId::V8
            | RoomVersionId::V9
-            | RoomVersionId::V10 => RoomCreateEventContent::new_v1(conduit_user.to_owned()),
+            | RoomVersionId::V10 => RoomCreateEventContent::new_v1(conduit_user.clone()),
            RoomVersionId::V11 => RoomCreateEventContent::new_v11(),
            _ => unreachable!("Validity of room version already checked"),
        };
@ -1106,9 +1003,8 @@ impl Service {
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
@ -1135,9 +1031,8 @@ impl Service {
                    unsigned: None,
                    state_key: Some(conduit_user.to_string()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
@ -1145,7 +1040,7 @@ impl Service {

        // 3. Power levels
        let mut users = BTreeMap::new();
-        users.insert(conduit_user.to_owned(), 100.into());
+        users.insert(conduit_user.clone(), 100.into());

        services()
            .rooms
@ -1161,9 +1056,8 @@ impl Service {
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
@ -1181,9 +1075,8 @@ impl Service {
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
@ -1203,9 +1096,8 @@ impl Service {
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
@ -1225,9 +1117,8 @@ impl Service {
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
@ -1246,9 +1137,8 @@ impl Service {
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
@ -1267,16 +1157,17 @@ impl Service {
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
            .await?;

        // 6. Room alias
-        let alias: OwnedRoomAliasId = services().globals.admin_alias().to_owned();
+        let alias: OwnedRoomAliasId = format!("#admins:{}", services().globals.server_name())
+            .try_into()
+            .expect("#admins:server_name is a valid alias name");

        services()
            .rooms
@ -1292,18 +1183,14 @@ impl Service {
                    unsigned: None,
                    state_key: Some("".to_owned()),
                    redacts: None,
-                    timestamp: None,
                },
-                conduit_user,
+                &conduit_user,
                &room_id,
                &state_lock,
            )
            .await?;

-        services()
-            .rooms
-            .alias
-            .set_alias(&alias, &room_id, conduit_user)?;
+        services().rooms.alias.set_alias(&alias, &room_id)?;

        Ok(())
    }
@ -1312,10 +1199,15 @@ impl Service {
    ///
    /// Errors are propagated from the database, and will have None if there is no admin room
    pub(crate) fn get_admin_room(&self) -> Result<Option<OwnedRoomId>> {
+        let admin_room_alias: Box<RoomAliasId> =
+            format!("#admins:{}", services().globals.server_name())
+                .try_into()
+                .expect("#admins:server_name is a valid alias name");
+
        services()
            .rooms
            .alias
-            .resolve_local_alias(services().globals.admin_alias())
+            .resolve_local_alias(&admin_room_alias)
    }

    /// Invite the user to the conduit admin room.
@ -1339,7 +1231,9 @@ impl Service {
            let state_lock = mutex_state.lock().await;

            // Use the server user to grant the new admin's power level
-            let conduit_user = services().globals.server_user();
+            let conduit_user =
+                UserId::parse_with_server_name("conduit", services().globals.server_name())
+                    .expect("@conduit:server_name is valid");

            // Invite and join the real user
            services()
@ -1362,9 +1256,8 @@ impl Service {
                        unsigned: None,
                        state_key: Some(user_id.to_string()),
                        redacts: None,
-                        timestamp: None,
                    },
-                    conduit_user,
+                    &conduit_user,
                    &room_id,
                    &state_lock,
                )
@ -1389,7 +1282,6 @@ impl Service {
                        unsigned: None,
                        state_key: Some(user_id.to_string()),
                        redacts: None,
-                        timestamp: None,
                    },
                    user_id,
                    &room_id,
@ -1416,9 +1308,8 @@ impl Service {
                        unsigned: None,
                        state_key: Some("".to_owned()),
                        redacts: None,
-                        timestamp: None,
                    },
-                    conduit_user,
+                    &conduit_user,
                    &room_id,
                    &state_lock,
                )
@ -1436,24 +1327,14 @@ impl Service {
                unsigned: None,
                state_key: None,
                redacts: None,
-                timestamp: None,
            },
-            conduit_user,
+            &conduit_user,
            &room_id,
            &state_lock,
        ).await?;
        }
        Ok(())
    }
-
-    /// Checks whether a given user is an admin of this server
-    pub fn user_is_admin(&self, user_id: &UserId) -> Result<bool> {
-        let Some(admin_room) = self.get_admin_room()? else {
-            return Ok(false);
-        };
-
-        services().rooms.state_cache.is_joined(user_id, &admin_room)
-    }
 }

 #[cfg(test)]
--- a/src/service/globals/data.rs
+++ b/src/service/globals/data.rs
@ -1,71 +1,13 @@
-use std::{
-    collections::BTreeMap,
-    time::{Duration, SystemTime},
-};
+use std::collections::BTreeMap;

-use crate::{services, Result};
 use async_trait::async_trait;
 use ruma::{
-    api::federation::discovery::{OldVerifyKey, ServerSigningKeys, VerifyKey},
-    serde::Base64,
+    api::federation::discovery::{ServerSigningKeys, VerifyKey},
    signatures::Ed25519KeyPair,
-    DeviceId, MilliSecondsSinceUnixEpoch, ServerName, UserId,
+    DeviceId, OwnedServerSigningKeyId, ServerName, UserId,
 };
-use serde::Deserialize;

-/// Similar to ServerSigningKeys, but drops a few unnecessary fields we don't require post-validation
-#[derive(Deserialize, Debug, Clone)]
-pub struct SigningKeys {
-    pub verify_keys: BTreeMap<String, VerifyKey>,
-    pub old_verify_keys: BTreeMap<String, OldVerifyKey>,
-    pub valid_until_ts: MilliSecondsSinceUnixEpoch,
-}
-
-impl SigningKeys {
-    /// Creates the SigningKeys struct, using the keys of the current server
-    pub fn load_own_keys() -> Self {
-        let mut keys = Self {
-            verify_keys: BTreeMap::new(),
-            old_verify_keys: BTreeMap::new(),
-            valid_until_ts: MilliSecondsSinceUnixEpoch::from_system_time(
-                SystemTime::now() + Duration::from_secs(7 * 86400),
-            )
-            .expect("Should be valid until year 500,000,000"),
-        };
-
-        keys.verify_keys.insert(
-            format!("ed25519:{}", services().globals.keypair().version()),
-            VerifyKey {
-                key: Base64::new(services().globals.keypair.public_key().to_vec()),
-            },
-        );
-
-        keys
-    }
-}
-
-impl From<ServerSigningKeys> for SigningKeys {
-    fn from(value: ServerSigningKeys) -> Self {
-        let ServerSigningKeys {
-            verify_keys,
-            old_verify_keys,
-            valid_until_ts,
-            ..
-        } = value;
-
-        Self {
-            verify_keys: verify_keys
-                .into_iter()
-                .map(|(id, key)| (id.to_string(), key))
-                .collect(),
-            old_verify_keys: old_verify_keys
-                .into_iter()
-                .map(|(id, key)| (id.to_string(), key))
-                .collect(),
-            valid_until_ts,
-        }
-    }
-}
+use crate::Result;

 #[async_trait]
 pub trait Data: Send + Sync {
@ -79,23 +21,17 @@ pub trait Data: Send + Sync {
    fn clear_caches(&self, amount: u32);
    fn load_keypair(&self) -> Result<Ed25519KeyPair>;
    fn remove_keypair(&self) -> Result<()>;
-    /// Only extends the cached keys, not moving any verify_keys to old_verify_keys, as if we suddenly
-    /// recieve requests from the origin server, we want to be able to accept requests from them
-    fn add_signing_key_from_trusted_server(
+    fn add_signing_key(
        &self,
        origin: &ServerName,
        new_keys: ServerSigningKeys,
-    ) -> Result<SigningKeys>;
-    /// Extends cached keys, as well as moving verify_keys that are not present in these new keys to
-    /// old_verify_keys, so that potnetially comprimised keys cannot be used to make requests
-    fn add_signing_key_from_origin(
-        &self,
-        origin: &ServerName,
-        new_keys: ServerSigningKeys,
-    ) -> Result<SigningKeys>;
+    ) -> Result<BTreeMap<OwnedServerSigningKeyId, VerifyKey>>;

    /// This returns an empty `Ok(BTreeMap<..>)` when there are no keys found for the server.
-    fn signing_keys_for(&self, origin: &ServerName) -> Result<Option<SigningKeys>>;
+    fn signing_keys_for(
+        &self,
+        origin: &ServerName,
+    ) -> Result<BTreeMap<OwnedServerSigningKeyId, VerifyKey>>;
    fn database_version(&self) -> Result<u64>;
    fn bump_database_version(&self, new_version: u64) -> Result<()>;
 }
--- a/src/service/globals/mod.rs
+++ b/src/service/globals/mod.rs
@ -1,19 +1,25 @@
 mod data;
-pub use data::{Data, SigningKeys};
+pub use data::Data;
 use ruma::{
-    serde::Base64, MilliSecondsSinceUnixEpoch, OwnedDeviceId, OwnedEventId, OwnedRoomAliasId,
-    OwnedRoomId, OwnedServerName, OwnedUserId, RoomAliasId,
+    serde::Base64, OwnedDeviceId, OwnedEventId, OwnedRoomId, OwnedServerName,
+    OwnedServerSigningKeyId, OwnedUserId,
 };

-use crate::api::server_server::DestinationResponse;
+use crate::api::server_server::FedDest;

 use crate::{services, Config, Error, Result};
 use futures_util::FutureExt;
 use hickory_resolver::TokioAsyncResolver;
-use hyper_util::client::legacy::connect::dns::{GaiResolver, Name as HyperName};
-use reqwest::dns::{Addrs, Name, Resolve, Resolving};
+use hyper::{
+    client::connect::dns::{GaiResolver, Name},
+    service::Service as HyperService,
+};
+use reqwest::dns::{Addrs, Resolve, Resolving};
 use ruma::{
-    api::{client::sync::sync_events, federation::discovery::ServerSigningKeys},
+    api::{
+        client::sync::sync_events,
+        federation::discovery::{ServerSigningKeys, VerifyKey},
+    },
    DeviceId, RoomVersionId, ServerName, UserId,
 };
 use std::{
@ -24,7 +30,6 @@ use std::{
    iter,
    net::{IpAddr, SocketAddr},
    path::PathBuf,
-    str::FromStr,
    sync::{
        atomic::{self, AtomicBool},
        Arc, RwLock as StdRwLock,
@ -32,12 +37,11 @@ use std::{
    time::{Duration, Instant},
 };
 use tokio::sync::{broadcast, watch::Receiver, Mutex, RwLock, Semaphore};
-use tower_service::Service as TowerService;
 use tracing::{error, info};

 use base64::{engine::general_purpose, Engine as _};

-type WellKnownMap = HashMap<OwnedServerName, DestinationResponse>;
+type WellKnownMap = HashMap<OwnedServerName, (FedDest, String)>;
 type TlsNameMap = HashMap<String, (Vec<IpAddr>, u16)>;
 type RateLimitState = (Instant, u32); // Time if last failed try, number of failed tries
 type SyncHandle = (
@ -51,7 +55,6 @@ pub struct Service {
    pub actual_destination_cache: Arc<RwLock<WellKnownMap>>, // actual_destination, host
    pub tls_name_override: Arc<StdRwLock<TlsNameMap>>,
    pub config: Config,
-    allow_registration: RwLock<bool>,
    keypair: Arc<ruma::signatures::Ed25519KeyPair>,
    dns_resolver: TokioAsyncResolver,
    jwt_decoding_key: Option<jsonwebtoken::DecodingKey>,
@ -68,8 +71,6 @@ pub struct Service {
    pub roomid_mutex_state: RwLock<HashMap<OwnedRoomId, Arc<Mutex<()>>>>,
    pub roomid_mutex_federation: RwLock<HashMap<OwnedRoomId, Arc<Mutex<()>>>>, // this lock will be held longer
    pub roomid_federationhandletime: RwLock<HashMap<OwnedRoomId, (OwnedEventId, Instant)>>,
-    server_user: OwnedUserId,
-    admin_alias: OwnedRoomAliasId,
    pub stateres_mutex: Arc<Mutex<()>>,
    pub rotate: RotationHandler,

@ -136,19 +137,11 @@ impl Resolve for Resolver {
            })
            .unwrap_or_else(|| {
                let this = &mut self.inner.clone();
-                Box::pin(
-                    TowerService::<HyperName>::call(
-                        this,
-                        // Beautiful hack, please remove this in the future.
-                        HyperName::from_str(name.as_str())
-                            .expect("reqwest Name is just wrapper for hyper-util Name"),
-                    )
-                    .map(|result| {
-                        result
-                            .map(|addrs| -> Addrs { Box::new(addrs) })
-                            .map_err(|err| -> Box<dyn StdError + Send + Sync> { Box::new(err) })
-                    }),
-                )
+                Box::pin(HyperService::<Name>::call(this, name).map(|result| {
+                    result
+                        .map(|addrs| -> Addrs { Box::new(addrs) })
+                        .map_err(|err| -> Box<dyn StdError + Send + Sync> { Box::new(err) })
+                }))
            })
    }
 }
@ -191,11 +184,6 @@ impl Service {
        let unstable_room_versions = vec![RoomVersionId::V3, RoomVersionId::V4, RoomVersionId::V5];

        let mut s = Self {
-            allow_registration: RwLock::new(config.allow_registration),
-            admin_alias: RoomAliasId::parse(format!("#admins:{}", &config.server_name))
-                .expect("#admins:server_name is a valid alias name"),
-            server_user: UserId::parse(format!("@conduit:{}", &config.server_name))
-                .expect("@conduit:server_name is valid"),
            db,
            config,
            keypair: Arc::new(keypair),
@ -289,14 +277,6 @@ impl Service {
        self.config.server_name.as_ref()
    }

-    pub fn server_user(&self) -> &UserId {
-        self.server_user.as_ref()
-    }
-
-    pub fn admin_alias(&self) -> &RoomAliasId {
-        self.admin_alias.as_ref()
-    }
-
    pub fn max_request_size(&self) -> u32 {
        self.config.max_request_size
    }
@ -305,15 +285,8 @@ impl Service {
        self.config.max_fetch_prev_events
    }

-    /// Allows for the temporary (non-persistant) toggling of registration
-    pub async fn set_registration(&self, status: bool) {
-        let mut lock = self.allow_registration.write().await;
-        *lock = status;
-    }
-
-    /// Checks whether user registration is allowed
-    pub async fn allow_registration(&self) -> bool {
-        *self.allow_registration.read().await
+    pub fn allow_registration(&self) -> bool {
+        self.config.allow_registration
    }

    pub fn allow_encryption(&self) -> bool {
@ -389,89 +362,36 @@ impl Service {
        room_versions
    }

+    /// TODO: the key valid until timestamp is only honored in room version > 4
+    /// Remove the outdated keys and insert the new ones.
+    ///
    /// This doesn't actually check that the keys provided are newer than the old set.
-    pub fn add_signing_key_from_trusted_server(
+    pub fn add_signing_key(
        &self,
        origin: &ServerName,
        new_keys: ServerSigningKeys,
-    ) -> Result<SigningKeys> {
-        self.db
-            .add_signing_key_from_trusted_server(origin, new_keys)
+    ) -> Result<BTreeMap<OwnedServerSigningKeyId, VerifyKey>> {
+        self.db.add_signing_key(origin, new_keys)
    }

-    /// Same as from_trusted_server, except it will move active keys not present in `new_keys` to old_signing_keys
-    pub fn add_signing_key_from_origin(
+    /// This returns an empty `Ok(BTreeMap<..>)` when there are no keys found for the server.
+    pub fn signing_keys_for(
        &self,
        origin: &ServerName,
-        new_keys: ServerSigningKeys,
-    ) -> Result<SigningKeys> {
-        self.db.add_signing_key_from_origin(origin, new_keys)
-    }
-
-    /// This returns Ok(None) when there are no keys found for the server.
-    pub fn signing_keys_for(&self, origin: &ServerName) -> Result<Option<SigningKeys>> {
-        Ok(self.db.signing_keys_for(origin)?.or_else(|| {
-            if origin == self.server_name() {
-                Some(SigningKeys::load_own_keys())
-            } else {
-                None
-            }
-        }))
-    }
-
-    /// Filters the key map of multiple servers down to keys that should be accepted given the expiry time,
-    /// room version, and timestamp of the paramters
-    pub fn filter_keys_server_map(
-        &self,
-        keys: BTreeMap<String, SigningKeys>,
-        timestamp: MilliSecondsSinceUnixEpoch,
-        room_version_id: &RoomVersionId,
-    ) -> BTreeMap<String, BTreeMap<String, Base64>> {
-        keys.into_iter()
-            .filter_map(|(server, keys)| {
-                self.filter_keys_single_server(keys, timestamp, room_version_id)
-                    .map(|keys| (server, keys))
-            })
-            .collect()
-    }
-
-    /// Filters the keys of a single server down to keys that should be accepted given the expiry time,
-    /// room version, and timestamp of the paramters
-    pub fn filter_keys_single_server(
-        &self,
-        keys: SigningKeys,
-        timestamp: MilliSecondsSinceUnixEpoch,
-        room_version_id: &RoomVersionId,
-    ) -> Option<BTreeMap<String, Base64>> {
-        if keys.valid_until_ts > timestamp
-            // valid_until_ts MUST be ignored in room versions 1, 2, 3, and 4.
-            // https://spec.matrix.org/v1.10/server-server-api/#get_matrixkeyv2server
-                || matches!(room_version_id, RoomVersionId::V1
-                    | RoomVersionId::V2
-                    | RoomVersionId::V4
-                    | RoomVersionId::V3)
-        {
-            // Given that either the room version allows stale keys, or the valid_until_ts is
-            // in the future, all verify_keys are valid
-            let mut map: BTreeMap<_, _> = keys
-                .verify_keys
-                .into_iter()
-                .map(|(id, key)| (id, key.key))
-                .collect();
-
-            map.extend(keys.old_verify_keys.into_iter().filter_map(|(id, key)| {
-                // Even on old room versions, we don't allow old keys if they are expired
-                if key.expired_ts > timestamp {
-                    Some((id, key.key))
-                } else {
-                    None
-                }
-            }));
-
-            Some(map)
-        } else {
-            None
+    ) -> Result<BTreeMap<OwnedServerSigningKeyId, VerifyKey>> {
+        let mut keys = self.db.signing_keys_for(origin)?;
+        if origin == self.server_name() {
+            keys.insert(
+                format!("ed25519:{}", services().globals.keypair().version())
+                    .try_into()
+                    .expect("found invalid server signing keys in DB"),
+                VerifyKey {
+                    key: Base64::new(self.keypair.public_key().to_vec()),
+                },
+            );
        }
+
+        Ok(keys)
    }

    pub fn database_version(&self) -> Result<u64> {
--- a/src/service/media/data.rs
+++ b/src/service/media/data.rs
@ -1,5 +1,3 @@
-use ruma::http_headers::ContentDisposition;
-
 use crate::Result;

 pub trait Data: Send + Sync {
@ -8,7 +6,7 @@ pub trait Data: Send + Sync {
        mxc: String,
        width: u32,
        height: u32,
-        content_disposition: &ContentDisposition,
+        content_disposition: Option<&str>,
        content_type: Option<&str>,
    ) -> Result<Vec<u8>>;

@ -18,5 +16,5 @@ pub trait Data: Send + Sync {
        mxc: String,
        width: u32,
        height: u32,
-    ) -> Result<(ContentDisposition, Option<String>, Vec<u8>)>;
+    ) -> Result<(Option<String>, Option<String>, Vec<u8>)>;
 }
--- a/src/service/media/mod.rs
+++ b/src/service/media/mod.rs
@ -2,7 +2,6 @@ mod data;
 use std::io::Cursor;

 pub use data::Data;
-use ruma::http_headers::{ContentDisposition, ContentDispositionType};

 use crate::{services, Result};
 use image::imageops::FilterType;
@ -13,7 +12,7 @@ use tokio::{
 };

 pub struct FileMeta {
-    pub content_disposition: ContentDisposition,
+    pub content_disposition: Option<String>,
    pub content_type: Option<String>,
    pub file: Vec<u8>,
 }
@ -27,17 +26,14 @@ impl Service {
    pub async fn create(
        &self,
        mxc: String,
-        content_disposition: Option<ContentDisposition>,
+        content_disposition: Option<&str>,
        content_type: Option<&str>,
        file: &[u8],
    ) -> Result<()> {
-        let content_disposition =
-            content_disposition.unwrap_or(ContentDisposition::new(ContentDispositionType::Inline));
-
        // Width, Height = 0 if it's not a thumbnail
        let key = self
            .db
-            .create_file_metadata(mxc, 0, 0, &content_disposition, content_type)?;
+            .create_file_metadata(mxc, 0, 0, content_disposition, content_type)?;

        let path = services().globals.get_media_file(&key);
        let mut f = File::create(path).await?;
@ -50,18 +46,15 @@ impl Service {
    pub async fn upload_thumbnail(
        &self,
        mxc: String,
+        content_disposition: Option<&str>,
        content_type: Option<&str>,
        width: u32,
        height: u32,
        file: &[u8],
    ) -> Result<()> {
-        let key = self.db.create_file_metadata(
-            mxc,
-            width,
-            height,
-            &ContentDisposition::new(ContentDispositionType::Inline),
-            content_type,
-        )?;
+        let key =
+            self.db
+                .create_file_metadata(mxc, width, height, content_disposition, content_type)?;

        let path = services().globals.get_media_file(&key);
        let mut f = File::create(path).await?;
@ -173,20 +166,22 @@ impl Service {
                                / u64::from(original_height)
                        };
                        if use_width {
-                            if intermediate <= u64::from(u32::MAX) {
+                            if intermediate <= u64::from(::std::u32::MAX) {
                                (width, intermediate as u32)
                            } else {
                                (
-                                    (u64::from(width) * u64::from(u32::MAX) / intermediate) as u32,
-                                    u32::MAX,
+                                    (u64::from(width) * u64::from(::std::u32::MAX) / intermediate)
+                                        as u32,
+                                    ::std::u32::MAX,
                                )
                            }
-                        } else if intermediate <= u64::from(u32::MAX) {
+                        } else if intermediate <= u64::from(::std::u32::MAX) {
                            (intermediate as u32, height)
                        } else {
                            (
-                                u32::MAX,
-                                (u64::from(height) * u64::from(u32::MAX) / intermediate) as u32,
+                                ::std::u32::MAX,
+                                (u64::from(height) * u64::from(::std::u32::MAX) / intermediate)
+                                    as u32,
                            )
                        }
                    };
@ -205,7 +200,7 @@ impl Service {
                    mxc,
                    width,
                    height,
-                    &content_disposition,
+                    content_disposition.as_deref(),
                    content_type.as_deref(),
                )?;

--- a/src/service/pdu.rs
+++ b/src/service/pdu.rs
@ -1,6 +1,5 @@
 use crate::Error;
 use ruma::{
-    api::client::error::ErrorKind,
    canonical_json::redact_content_in_place,
    events::{
        room::{member::RoomMemberEventContent, redaction::RoomRedactionEventContent},
@ -73,23 +72,6 @@ impl PduEvent {
        Ok(())
    }

-    pub fn is_redacted(&self) -> bool {
-        #[derive(Deserialize)]
-        struct ExtractRedactedBecause {
-            redacted_because: Option<serde::de::IgnoredAny>,
-        }
-
-        let Some(unsigned) = &self.unsigned else {
-            return false;
-        };
-
-        let Ok(unsigned) = ExtractRedactedBecause::deserialize(&**unsigned) else {
-            return false;
-        };
-
-        unsigned.redacted_because.is_some()
-    }
-
    pub fn remove_transaction_id(&mut self) -> crate::Result<()> {
        if let Some(unsigned) = &self.unsigned {
            let mut unsigned: BTreeMap<String, Box<RawJsonValue>> =
@ -444,7 +426,7 @@ pub(crate) fn gen_event_id_canonical_json(
        "${}",
        // Anything higher than version3 behaves the same
        ruma::signatures::reference_hash(&value, room_version_id)
-            .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Invalid PDU format"))?
+            .expect("ruma can calculate reference hashes")
    )
    .try_into()
    .expect("ruma's reference hashes are valid event ids");
@ -461,8 +443,4 @@ pub struct PduBuilder {
    pub unsigned: Option<BTreeMap<String, serde_json::Value>>,
    pub state_key: Option<String>,
    pub redacts: Option<Arc<EventId>>,
-    /// For timestamped messaging, should only be used for appservices
-    ///
-    /// Will be set to current time if None
-    pub timestamp: Option<MilliSecondsSinceUnixEpoch>,
 }
--- a/src/service/rooms/alias/data.rs
+++ b/src/service/rooms/alias/data.rs
@ -1,12 +1,9 @@
 use crate::Result;
-use ruma::{OwnedRoomAliasId, OwnedRoomId, OwnedUserId, RoomAliasId, RoomId, UserId};
+use ruma::{OwnedRoomAliasId, OwnedRoomId, RoomAliasId, RoomId};

 pub trait Data: Send + Sync {
    /// Creates or updates the alias to the given room id.
-    fn set_alias(&self, alias: &RoomAliasId, room_id: &RoomId, user_id: &UserId) -> Result<()>;
-
-    /// Finds the user who assigned the given alias to a room
-    fn who_created_alias(&self, alias: &RoomAliasId) -> Result<Option<OwnedUserId>>;
+    fn set_alias(&self, alias: &RoomAliasId, room_id: &RoomId) -> Result<()>;

    /// Forgets about an alias. Returns an error if the alias did not exist.
    fn remove_alias(&self, alias: &RoomAliasId) -> Result<()>;
--- a/src/service/rooms/alias/mod.rs
+++ b/src/service/rooms/alias/mod.rs
@ -1,17 +1,9 @@
 mod data;

 pub use data::Data;
-use tracing::error;

-use crate::{services, Error, Result};
-use ruma::{
-    api::client::error::ErrorKind,
-    events::{
-        room::power_levels::{RoomPowerLevels, RoomPowerLevelsEventContent},
-        StateEventType,
-    },
-    OwnedRoomAliasId, OwnedRoomId, RoomAliasId, RoomId, UserId,
-};
+use crate::Result;
+use ruma::{OwnedRoomAliasId, OwnedRoomId, RoomAliasId, RoomId};

 pub struct Service {
    pub db: &'static dyn Data,
@ -19,71 +11,13 @@ pub struct Service {

 impl Service {
    #[tracing::instrument(skip(self))]
-    pub fn set_alias(&self, alias: &RoomAliasId, room_id: &RoomId, user_id: &UserId) -> Result<()> {
-        if alias == services().globals.admin_alias() && user_id != services().globals.server_user()
-        {
-            Err(Error::BadRequest(
-                ErrorKind::forbidden(),
-                "Only the server user can set this alias",
-            ))
-        } else {
-            self.db.set_alias(alias, room_id, user_id)
-        }
+    pub fn set_alias(&self, alias: &RoomAliasId, room_id: &RoomId) -> Result<()> {
+        self.db.set_alias(alias, room_id)
    }

    #[tracing::instrument(skip(self))]
-    fn user_can_remove_alias(&self, alias: &RoomAliasId, user_id: &UserId) -> Result<bool> {
-        let Some(room_id) = self.resolve_local_alias(alias)? else {
-            return Err(Error::BadRequest(ErrorKind::NotFound, "Alias not found."));
-        };
-
-        // The creator of an alias can remove it
-        if self
-            .db
-            .who_created_alias(alias)?
-            .map(|user| user == user_id)
-            .unwrap_or_default()
-            // Server admins can remove any local alias
-            || services().admin.user_is_admin(user_id)?
-            // Always allow the Conduit user to remove the alias, since there may not be an admin room
-            || services().globals.server_user ()== user_id
-        {
-            Ok(true)
-            // Checking whether the user is able to change canonical aliases of the room
-        } else if let Some(event) = services().rooms.state_accessor.room_state_get(
-            &room_id,
-            &StateEventType::RoomPowerLevels,
-            "",
-        )? {
-            serde_json::from_str(event.content.get())
-                .map_err(|_| Error::bad_database("Invalid event content for m.room.power_levels"))
-                .map(|content: RoomPowerLevelsEventContent| {
-                    RoomPowerLevels::from(content)
-                        .user_can_send_state(user_id, StateEventType::RoomCanonicalAlias)
-                })
-        // If there is no power levels event, only the room creator can change canonical aliases
-        } else if let Some(event) = services().rooms.state_accessor.room_state_get(
-            &room_id,
-            &StateEventType::RoomCreate,
-            "",
-        )? {
-            Ok(event.sender == user_id)
-        } else {
-            error!("Room {} has no m.room.create event (VERY BAD)!", room_id);
-            Err(Error::bad_database("Room has no m.room.create event"))
-        }
-    }
-
-    #[tracing::instrument(skip(self))]
-    pub fn remove_alias(&self, alias: &RoomAliasId, user_id: &UserId) -> Result<()> {
-        if self.user_can_remove_alias(alias, user_id)? {
-            self.db.remove_alias(alias)
-        } else {
-            Err(Error::BadRequest(
-                ErrorKind::forbidden(),
-                "User is not permitted to remove this alias.",
-            ))
-        }
+    pub fn remove_alias(&self, alias: &RoomAliasId) -> Result<()> {
+        self.db.remove_alias(alias)
    }

    #[tracing::instrument(skip(self))]
--- a/src/service/rooms/auth_chain/mod.rs
+++ b/src/service/rooms/auth_chain/mod.rs
@ -133,10 +133,7 @@ impl Service {
            match services().rooms.timeline.get_pdu(&event_id) {
                Ok(Some(pdu)) => {
                    if pdu.room_id != room_id {
-                        return Err(Error::BadRequest(
-                            ErrorKind::forbidden(),
-                            "Evil event in db",
-                        ));
+                        return Err(Error::BadRequest(ErrorKind::Forbidden, "Evil event in db"));
                    }
                    for auth_event in &pdu.auth_events {
                        let sauthevent = services()
--- a/src/service/rooms/event_handler/mod.rs
+++ b/src/service/rooms/event_handler/mod.rs
@ -9,7 +9,6 @@ use std::{
 };

 use futures_util::{stream::FuturesUnordered, Future, StreamExt};
-use globals::SigningKeys;
 use ruma::{
    api::{
        client::error::ErrorKind,
@ -31,6 +30,7 @@ use ruma::{
        StateEventType, TimelineEventType,
    },
    int,
+    serde::Base64,
    state_res::{self, RoomVersion, StateMap},
    uint, CanonicalJsonObject, CanonicalJsonValue, EventId, MilliSecondsSinceUnixEpoch,
    OwnedServerName, OwnedServerSigningKeyId, RoomId, RoomVersionId, ServerName,
@ -78,7 +78,7 @@ impl Service {
        room_id: &'a RoomId,
        value: BTreeMap<String, CanonicalJsonValue>,
        is_timeline_event: bool,
-        pub_key_map: &'a RwLock<BTreeMap<String, SigningKeys>>,
+        pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
    ) -> Result<Option<Vec<u8>>> {
        // 0. Check the server is in the room
        if !services().rooms.metadata.exists(room_id)? {
@ -90,7 +90,7 @@ impl Service {

        if services().rooms.metadata.is_disabled(room_id)? {
            return Err(Error::BadRequest(
-                ErrorKind::forbidden(),
+                ErrorKind::Forbidden,
                "Federation of this room is currently disabled on this server.",
            ));
        }
@ -162,7 +162,7 @@ impl Service {
            // Check for disabled again because it might have changed
            if services().rooms.metadata.is_disabled(room_id)? {
                return Err(Error::BadRequest(
-                    ErrorKind::forbidden(),
+                    ErrorKind::Forbidden,
                    "Federation of this room is currently disabled on this server.",
                ));
            }
@ -304,12 +304,19 @@ impl Service {
        room_id: &'a RoomId,
        mut value: BTreeMap<String, CanonicalJsonValue>,
        auth_events_known: bool,
-        pub_key_map: &'a RwLock<BTreeMap<String, SigningKeys>>,
+        pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
    ) -> AsyncRecursiveType<'a, Result<(Arc<PduEvent>, BTreeMap<String, CanonicalJsonValue>)>> {
        Box::pin(async move {
            // 1.1. Remove unsigned field
            value.remove("unsigned");

+            // TODO: For RoomVersion6 we must check that Raw<..> is canonical do we anywhere?: https://matrix.org/docs/spec/rooms/v6#canonical-json
+
+            // We go through all the signatures we see on the value and fetch the corresponding signing
+            // keys
+            self.fetch_required_signing_keys(&value, pub_key_map)
+                .await?;
+
            // 2. Check signatures, otherwise drop
            // 3. check content hash, redact if doesn't match
            let create_event_content: RoomCreateEventContent =
@ -322,80 +329,41 @@ impl Service {
            let room_version =
                RoomVersion::new(room_version_id).expect("room version is supported");

-            // TODO: For RoomVersion6 we must check that Raw<..> is canonical do we anywhere?: https://matrix.org/docs/spec/rooms/v6#canonical-json
-
-            // We go through all the signatures we see on the value and fetch the corresponding signing
-            // keys
-            self.fetch_required_signing_keys(&value, pub_key_map)
-                .await?;
-
-            let origin_server_ts = value.get("origin_server_ts").ok_or_else(|| {
-                error!("Invalid PDU, no origin_server_ts field");
-                Error::BadRequest(
-                    ErrorKind::MissingParam,
-                    "Invalid PDU, no origin_server_ts field",
-                )
-            })?;
-
-            let origin_server_ts: MilliSecondsSinceUnixEpoch = {
-                let ts = origin_server_ts.as_integer().ok_or_else(|| {
-                    Error::BadRequest(
-                        ErrorKind::InvalidParam,
-                        "origin_server_ts must be an integer",
-                    )
-                })?;
-
-                MilliSecondsSinceUnixEpoch(i64::from(ts).try_into().map_err(|_| {
-                    Error::BadRequest(ErrorKind::InvalidParam, "Time must be after the unix epoch")
-                })?)
-            };
-
            let guard = pub_key_map.read().await;
-
-            let pkey_map = (*guard).clone();
-
-            // Removing all the expired keys, unless the room version allows stale keys
-            let filtered_keys = services().globals.filter_keys_server_map(
-                pkey_map,
-                origin_server_ts,
-                room_version_id,
-            );
-
-            let mut val =
-                match ruma::signatures::verify_event(&filtered_keys, &value, room_version_id) {
-                    Err(e) => {
-                        // Drop
-                        warn!("Dropping bad event {}: {}", event_id, e,);
-                        return Err(Error::BadRequest(
-                            ErrorKind::InvalidParam,
-                            "Signature verification failed",
-                        ));
-                    }
-                    Ok(ruma::signatures::Verified::Signatures) => {
-                        // Redact
-                        warn!("Calculated hash does not match: {}", event_id);
-                        let obj = match ruma::canonical_json::redact(value, room_version_id, None) {
-                            Ok(obj) => obj,
-                            Err(_) => {
-                                return Err(Error::BadRequest(
-                                    ErrorKind::InvalidParam,
-                                    "Redaction failed",
-                                ))
-                            }
-                        };
-
-                        // Skip the PDU if it is redacted and we already have it as an outlier event
-                        if services().rooms.timeline.get_pdu_json(event_id)?.is_some() {
+            let mut val = match ruma::signatures::verify_event(&guard, &value, room_version_id) {
+                Err(e) => {
+                    // Drop
+                    warn!("Dropping bad event {}: {}", event_id, e,);
+                    return Err(Error::BadRequest(
+                        ErrorKind::InvalidParam,
+                        "Signature verification failed",
+                    ));
+                }
+                Ok(ruma::signatures::Verified::Signatures) => {
+                    // Redact
+                    warn!("Calculated hash does not match: {}", event_id);
+                    let obj = match ruma::canonical_json::redact(value, room_version_id, None) {
+                        Ok(obj) => obj,
+                        Err(_) => {
                            return Err(Error::BadRequest(
                                ErrorKind::InvalidParam,
-                                "Event was redacted and we already knew about it",
-                            ));
+                                "Redaction failed",
+                            ))
                        }
+                    };

-                        obj
+                    // Skip the PDU if it is redacted and we already have it as an outlier event
+                    if services().rooms.timeline.get_pdu_json(event_id)?.is_some() {
+                        return Err(Error::BadRequest(
+                            ErrorKind::InvalidParam,
+                            "Event was redacted and we already knew about it",
+                        ));
                    }
-                    Ok(ruma::signatures::Verified::All) => value,
-                };
+
+                    obj
+                }
+                Ok(ruma::signatures::Verified::All) => value,
+            };

            drop(guard);

@ -519,7 +487,7 @@ impl Service {
        create_event: &PduEvent,
        origin: &ServerName,
        room_id: &RoomId,
-        pub_key_map: &RwLock<BTreeMap<String, SigningKeys>>,
+        pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
    ) -> Result<Option<Vec<u8>>> {
        // Skip the PDU if we already have it as a timeline event
        if let Ok(Some(pduid)) = services().rooms.timeline.get_pdu_id(&incoming_pdu.event_id) {
@ -1129,7 +1097,7 @@ impl Service {
        create_event: &'a PduEvent,
        room_id: &'a RoomId,
        room_version_id: &'a RoomVersionId,
-        pub_key_map: &'a RwLock<BTreeMap<String, SigningKeys>>,
+        pub_key_map: &'a RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
    ) -> AsyncRecursiveType<'a, Vec<(Arc<PduEvent>, Option<BTreeMap<String, CanonicalJsonValue>>)>>
    {
        Box::pin(async move {
@ -1312,7 +1280,7 @@ impl Service {
        create_event: &PduEvent,
        room_id: &RoomId,
        room_version_id: &RoomVersionId,
-        pub_key_map: &RwLock<BTreeMap<String, SigningKeys>>,
+        pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
        initial_set: Vec<Arc<EventId>>,
    ) -> Result<(
        Vec<Arc<EventId>>,
@ -1410,7 +1378,7 @@ impl Service {
    pub(crate) async fn fetch_required_signing_keys(
        &self,
        event: &BTreeMap<String, CanonicalJsonValue>,
-        pub_key_map: &RwLock<BTreeMap<String, SigningKeys>>,
+        pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
    ) -> Result<()> {
        let signatures = event
            .get("signatures")
@ -1439,7 +1407,6 @@ impl Service {
                        )
                    })?,
                    signature_ids,
-                    true,
                )
                .await;

@ -1467,7 +1434,7 @@ impl Service {
        pdu: &RawJsonValue,
        servers: &mut BTreeMap<OwnedServerName, BTreeMap<OwnedServerSigningKeyId, QueryCriteria>>,
        room_version: &RoomVersionId,
-        pub_key_map: &mut RwLockWriteGuard<'_, BTreeMap<String, SigningKeys>>,
+        pub_key_map: &mut RwLockWriteGuard<'_, BTreeMap<String, BTreeMap<String, Base64>>>,
    ) -> Result<()> {
        let value: CanonicalJsonObject = serde_json::from_str(pdu.get()).map_err(|e| {
            error!("Invalid PDU in server response: {:?}: {:?}", pdu, e);
@ -1477,7 +1444,7 @@ impl Service {
        let event_id = format!(
            "${}",
            ruma::signatures::reference_hash(&value, room_version)
-                .map_err(|_| Error::BadRequest(ErrorKind::BadJson, "Invalid PDU format"))?
+                .expect("ruma can calculate reference hashes")
        );
        let event_id = <&EventId>::try_from(event_id.as_str())
            .expect("ruma's reference hashes are valid event ids");
@ -1518,18 +1485,8 @@ impl Service {

            let signature_ids = signature_object.keys().cloned().collect::<Vec<_>>();

-            let contains_all_ids = |keys: &SigningKeys| {
-                signature_ids.iter().all(|id| {
-                    keys.verify_keys
-                        .keys()
-                        .map(ToString::to_string)
-                        .any(|key_id| id == &key_id)
-                        || keys
-                            .old_verify_keys
-                            .keys()
-                            .map(ToString::to_string)
-                            .any(|key_id| id == &key_id)
-                })
+            let contains_all_ids = |keys: &BTreeMap<String, Base64>| {
+                signature_ids.iter().all(|id| keys.contains_key(id))
            };

            let origin = <&ServerName>::try_from(signature_server.as_str()).map_err(|_| {
@ -1542,14 +1499,19 @@ impl Service {

            trace!("Loading signing keys for {}", origin);

-            if let Some(result) = services().globals.signing_keys_for(origin)? {
-                if !contains_all_ids(&result) {
-                    trace!("Signing key not loaded for {}", origin);
-                    servers.insert(origin.to_owned(), BTreeMap::new());
-                }
+            let result: BTreeMap<_, _> = services()
+                .globals
+                .signing_keys_for(origin)?
+                .into_iter()
+                .map(|(k, v)| (k.to_string(), v.key))
+                .collect();

-                pub_key_map.insert(origin.to_string(), result);
+            if !contains_all_ids(&result) {
+                trace!("Signing key not loaded for {}", origin);
+                servers.insert(origin.to_owned(), BTreeMap::new());
            }
+
+            pub_key_map.insert(origin.to_string(), result);
        }

        Ok(())
@ -1559,7 +1521,7 @@ impl Service {
        &self,
        event: &create_join_event::v2::Response,
        room_version: &RoomVersionId,
-        pub_key_map: &RwLock<BTreeMap<String, SigningKeys>>,
+        pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
    ) -> Result<()> {
        let mut servers: BTreeMap<
            OwnedServerName,
@ -1622,7 +1584,10 @@ impl Service {

                    let result = services()
                        .globals
-                        .add_signing_key_from_trusted_server(&k.server_name, k.clone())?;
+                        .add_signing_key(&k.server_name, k.clone())?
+                        .into_iter()
+                        .map(|(k, v)| (k.to_string(), v.key))
+                        .collect::<BTreeMap<_, _>>();

                    pkm.insert(k.server_name.to_string(), result);
                }
@ -1653,9 +1618,12 @@ impl Service {
            if let (Ok(get_keys_response), origin) = result {
                info!("Result is from {origin}");
                if let Ok(key) = get_keys_response.server_key.deserialize() {
-                    let result = services()
+                    let result: BTreeMap<_, _> = services()
                        .globals
-                        .add_signing_key_from_origin(&origin, key)?;
+                        .add_signing_key(&origin, key)?
+                        .into_iter()
+                        .map(|(k, v)| (k.to_string(), v.key))
+                        .collect();
                    pub_key_map.write().await.insert(origin.to_string(), result);
                }
            }
@ -1687,6 +1655,11 @@ impl Service {
                }
            };

+        if acl_event_content.allow.is_empty() {
+            // Ignore broken acl events
+            return Ok(());
+        }
+
        if acl_event_content.is_allowed(server_name) {
            Ok(())
        } else {
@ -1695,7 +1668,7 @@ impl Service {
                server_name, room_id
            );
            Err(Error::BadRequest(
-                ErrorKind::forbidden(),
+                ErrorKind::Forbidden,
                "Server was denied by room ACL",
            ))
        }
@ -1708,23 +1681,9 @@ impl Service {
        &self,
        origin: &ServerName,
        signature_ids: Vec<String>,
-        // Whether to ask for keys from trusted servers. Should be false when getting
-        // keys for validating requests, as per MSC4029
-        query_via_trusted_servers: bool,
-    ) -> Result<SigningKeys> {
-        let contains_all_ids = |keys: &SigningKeys| {
-            signature_ids.iter().all(|id| {
-                keys.verify_keys
-                    .keys()
-                    .map(ToString::to_string)
-                    .any(|key_id| id == &key_id)
-                    || keys
-                        .old_verify_keys
-                        .keys()
-                        .map(ToString::to_string)
-                        .any(|key_id| id == &key_id)
-            })
-        };
+    ) -> Result<BTreeMap<String, Base64>> {
+        let contains_all_ids =
+            |keys: &BTreeMap<String, Base64>| signature_ids.iter().all(|id| keys.contains_key(id));

        let permit = services()
            .globals
@ -1785,172 +1744,94 @@ impl Service {

        trace!("Loading signing keys for {}", origin);

-        let result = services().globals.signing_keys_for(origin)?;
+        let mut result: BTreeMap<_, _> = services()
+            .globals
+            .signing_keys_for(origin)?
+            .into_iter()
+            .map(|(k, v)| (k.to_string(), v.key))
+            .collect();

-        let mut expires_soon_or_has_expired = false;
-
-        if let Some(result) = result.clone() {
-            let ts_threshold = MilliSecondsSinceUnixEpoch::from_system_time(
-                SystemTime::now() + Duration::from_secs(30 * 60),
-            )
-            .expect("Should be valid until year 500,000,000");
-
-            debug!(
-                "The treshhold is {:?}, found time is {:?} for server {}",
-                ts_threshold, result.valid_until_ts, origin
-            );
-
-            if contains_all_ids(&result) {
-                // We want to ensure that the keys remain valid by the time the other functions that handle signatures reach them
-                if result.valid_until_ts > ts_threshold {
-                    debug!(
-                        "Keys for {} are deemed as valid, as they expire at {:?}",
-                        &origin, &result.valid_until_ts
-                    );
-                    return Ok(result);
-                }
-
-                expires_soon_or_has_expired = true;
-            }
+        if contains_all_ids(&result) {
+            return Ok(result);
        }

-        let mut keys = result.unwrap_or_else(|| SigningKeys {
-            verify_keys: BTreeMap::new(),
-            old_verify_keys: BTreeMap::new(),
-            valid_until_ts: MilliSecondsSinceUnixEpoch::now(),
-        });
-
-        // We want to set this to the max, and then lower it whenever we see older keys
-        keys.valid_until_ts = MilliSecondsSinceUnixEpoch::from_system_time(
-            SystemTime::now() + Duration::from_secs(7 * 86400),
-        )
-        .expect("Should be valid until year 500,000,000");
-
        debug!("Fetching signing keys for {} over federation", origin);

-        if let Some(mut server_key) = services()
+        if let Some(server_key) = services()
            .sending
            .send_federation_request(origin, get_server_keys::v2::Request::new())
            .await
            .ok()
            .and_then(|resp| resp.server_key.deserialize().ok())
        {
-            // Keys should only be valid for a maximum of seven days
-            server_key.valid_until_ts = server_key.valid_until_ts.min(
-                MilliSecondsSinceUnixEpoch::from_system_time(
-                    SystemTime::now() + Duration::from_secs(7 * 86400),
-                )
-                .expect("Should be valid until year 500,000,000"),
-            );
-
            services()
                .globals
-                .add_signing_key_from_origin(origin, server_key.clone())?;
+                .add_signing_key(origin, server_key.clone())?;

-            if keys.valid_until_ts > server_key.valid_until_ts {
-                keys.valid_until_ts = server_key.valid_until_ts;
-            }
-
-            keys.verify_keys.extend(
+            result.extend(
                server_key
                    .verify_keys
                    .into_iter()
-                    .map(|(id, key)| (id.to_string(), key)),
+                    .map(|(k, v)| (k.to_string(), v.key)),
            );
-            keys.old_verify_keys.extend(
+            result.extend(
                server_key
                    .old_verify_keys
                    .into_iter()
-                    .map(|(id, key)| (id.to_string(), key)),
+                    .map(|(k, v)| (k.to_string(), v.key)),
            );

-            if contains_all_ids(&keys) {
-                return Ok(keys);
+            if contains_all_ids(&result) {
+                return Ok(result);
            }
        }

-        if query_via_trusted_servers {
-            for server in services().globals.trusted_servers() {
-                debug!("Asking {} for {}'s signing key", server, origin);
-                if let Some(server_keys) = services()
-                    .sending
-                    .send_federation_request(
-                        server,
-                        get_remote_server_keys::v2::Request::new(
-                            origin.to_owned(),
-                            MilliSecondsSinceUnixEpoch::from_system_time(
-                                SystemTime::now()
-                                    .checked_add(Duration::from_secs(3600))
-                                    .expect("SystemTime to large"),
-                            )
-                            .expect("time is valid"),
-                        ),
-                    )
-                    .await
-                    .ok()
-                    .map(|resp| {
-                        resp.server_keys
+        for server in services().globals.trusted_servers() {
+            debug!("Asking {} for {}'s signing key", server, origin);
+            if let Some(server_keys) = services()
+                .sending
+                .send_federation_request(
+                    server,
+                    get_remote_server_keys::v2::Request::new(
+                        origin.to_owned(),
+                        MilliSecondsSinceUnixEpoch::from_system_time(
+                            SystemTime::now()
+                                .checked_add(Duration::from_secs(3600))
+                                .expect("SystemTime to large"),
+                        )
+                        .expect("time is valid"),
+                    ),
+                )
+                .await
+                .ok()
+                .map(|resp| {
+                    resp.server_keys
+                        .into_iter()
+                        .filter_map(|e| e.deserialize().ok())
+                        .collect::<Vec<_>>()
+                })
+            {
+                trace!("Got signing keys: {:?}", server_keys);
+                for k in server_keys {
+                    services().globals.add_signing_key(origin, k.clone())?;
+                    result.extend(
+                        k.verify_keys
                            .into_iter()
-                            .filter_map(|e| e.deserialize().ok())
-                            .collect::<Vec<_>>()
-                    })
-                {
-                    trace!("Got signing keys: {:?}", server_keys);
-                    for mut k in server_keys {
-                        if k.valid_until_ts
-                        // Half an hour should give plenty of time for the server to respond with keys that are still
-                        // valid, given we requested keys which are valid at least an hour from now
-                            < MilliSecondsSinceUnixEpoch::from_system_time(
-                                SystemTime::now() + Duration::from_secs(30 * 60),
-                            )
-                            .expect("Should be valid until year 500,000,000")
-                        {
-                            // Keys should only be valid for a maximum of seven days
-                            k.valid_until_ts = k.valid_until_ts.min(
-                                MilliSecondsSinceUnixEpoch::from_system_time(
-                                    SystemTime::now() + Duration::from_secs(7 * 86400),
-                                )
-                                .expect("Should be valid until year 500,000,000"),
-                            );
+                            .map(|(k, v)| (k.to_string(), v.key)),
+                    );
+                    result.extend(
+                        k.old_verify_keys
+                            .into_iter()
+                            .map(|(k, v)| (k.to_string(), v.key)),
+                    );
+                }

-                            if keys.valid_until_ts > k.valid_until_ts {
-                                keys.valid_until_ts = k.valid_until_ts;
-                            }
-
-                            services()
-                                .globals
-                                .add_signing_key_from_trusted_server(origin, k.clone())?;
-                            keys.verify_keys.extend(
-                                k.verify_keys
-                                    .into_iter()
-                                    .map(|(id, key)| (id.to_string(), key)),
-                            );
-                            keys.old_verify_keys.extend(
-                                k.old_verify_keys
-                                    .into_iter()
-                                    .map(|(id, key)| (id.to_string(), key)),
-                            );
-                        } else {
-                            warn!(
-                                "Server {} gave us keys older than we requested, valid until: {:?}",
-                                origin, k.valid_until_ts
-                            );
-                        }
-
-                        if contains_all_ids(&keys) {
-                            return Ok(keys);
-                        }
-                    }
+                if contains_all_ids(&result) {
+                    return Ok(result);
                }
            }
        }

-        // We should return these keys if fresher keys were not found
-        if expires_soon_or_has_expired {
-            info!("Returning stale keys for {}", origin);
-            return Ok(keys);
-        }
-
        drop(permit);

        back_off(signature_ids).await;
--- a/src/service/rooms/pdu_metadata/mod.rs
+++ b/src/service/rooms/pdu_metadata/mod.rs
@ -3,9 +3,9 @@ use std::sync::Arc;

 pub use data::Data;
 use ruma::{
-    api::{client::relations::get_relating_events, Direction},
+    api::client::relations::get_relating_events,
    events::{relation::RelationType, TimelineEventType},
-    EventId, RoomId, UInt, UserId,
+    EventId, RoomId, UserId,
 };
 use serde::Deserialize;

@ -48,57 +48,37 @@ impl Service {
        target: &EventId,
        filter_event_type: Option<TimelineEventType>,
        filter_rel_type: Option<RelationType>,
-        from: Option<String>,
-        to: Option<String>,
-        limit: Option<UInt>,
-        recurse: bool,
-        dir: &Direction,
+        from: PduCount,
+        to: Option<PduCount>,
+        limit: usize,
    ) -> Result<get_relating_events::v1::Response> {
-        let from = match from {
-            Some(from) => PduCount::try_from_string(&from)?,
-            None => match dir {
-                Direction::Forward => PduCount::min(),
-                Direction::Backward => PduCount::max(),
-            },
-        };
-
-        let to = to.as_ref().and_then(|t| PduCount::try_from_string(t).ok());
-
-        // Use limit or else 10, with maximum 100
-        let limit = limit
-            .and_then(|u| u32::try_from(u).ok())
-            .map_or(10_usize, |u| u as usize)
-            .min(100);
-
        let next_token;

-        // Spec (v1.10) recommends depth of at least 3
-        let depth: u8 = if recurse { 3 } else { 1 };
-
-        match dir {
-            Direction::Forward => {
-                let relations_until = &services().rooms.pdu_metadata.relations_until(
-                    sender_user,
-                    room_id,
-                    target,
-                    from,
-                    depth,
-                )?;
-                let events_after: Vec<_> = relations_until // TODO: should be relations_after
-                    .iter()
-                    .filter(|(_, pdu)| {
-                        filter_event_type.as_ref().map_or(true, |t| &pdu.kind == t)
-                            && if let Ok(content) =
-                                serde_json::from_str::<ExtractRelatesToEventId>(pdu.content.get())
-                            {
-                                filter_rel_type
-                                    .as_ref()
-                                    .map_or(true, |r| &content.relates_to.rel_type == r)
-                            } else {
-                                false
-                            }
+        //TODO: Fix ruma: match body.dir {
+        match ruma::api::Direction::Backward {
+            ruma::api::Direction::Forward => {
+                let events_after: Vec<_> = services()
+                    .rooms
+                    .pdu_metadata
+                    .relations_until(sender_user, room_id, target, from)? // TODO: should be relations_after
+                    .filter(|r| {
+                        r.as_ref().map_or(true, |(_, pdu)| {
+                            filter_event_type.as_ref().map_or(true, |t| &pdu.kind == t)
+                                && if let Ok(content) =
+                                    serde_json::from_str::<ExtractRelatesToEventId>(
+                                        pdu.content.get(),
+                                    )
+                                {
+                                    filter_rel_type
+                                        .as_ref()
+                                        .map_or(true, |r| &content.relates_to.rel_type == r)
+                                } else {
+                                    false
+                                }
+                        })
                    })
                    .take(limit)
+                    .filter_map(|r| r.ok()) // Filter out buggy events
                    .filter(|(_, pdu)| {
                        services()
                            .rooms
@ -106,7 +86,7 @@ impl Service {
                            .user_can_see_event(sender_user, room_id, &pdu.event_id)
                            .unwrap_or(false)
                    })
-                    .take_while(|(k, _)| Some(k) != to.as_ref()) // Stop at `to`
+                    .take_while(|&(k, _)| Some(k) != to) // Stop at `to`
                    .collect();

                next_token = events_after.last().map(|(count, _)| count).copied();
@ -121,32 +101,31 @@ impl Service {
                    chunk: events_after,
                    next_batch: next_token.map(|t| t.stringify()),
                    prev_batch: Some(from.stringify()),
-                    recursion_depth: if recurse { Some(depth.into()) } else { None },
                })
            }
-            Direction::Backward => {
-                let relations_until = &services().rooms.pdu_metadata.relations_until(
-                    sender_user,
-                    room_id,
-                    target,
-                    from,
-                    depth,
-                )?;
-                let events_before: Vec<_> = relations_until
-                    .iter()
-                    .filter(|(_, pdu)| {
-                        filter_event_type.as_ref().map_or(true, |t| &pdu.kind == t)
-                            && if let Ok(content) =
-                                serde_json::from_str::<ExtractRelatesToEventId>(pdu.content.get())
-                            {
-                                filter_rel_type
-                                    .as_ref()
-                                    .map_or(true, |r| &content.relates_to.rel_type == r)
-                            } else {
-                                false
-                            }
+            ruma::api::Direction::Backward => {
+                let events_before: Vec<_> = services()
+                    .rooms
+                    .pdu_metadata
+                    .relations_until(sender_user, room_id, target, from)?
+                    .filter(|r| {
+                        r.as_ref().map_or(true, |(_, pdu)| {
+                            filter_event_type.as_ref().map_or(true, |t| &pdu.kind == t)
+                                && if let Ok(content) =
+                                    serde_json::from_str::<ExtractRelatesToEventId>(
+                                        pdu.content.get(),
+                                    )
+                                {
+                                    filter_rel_type
+                                        .as_ref()
+                                        .map_or(true, |r| &content.relates_to.rel_type == r)
+                                } else {
+                                    false
+                                }
+                        })
                    })
                    .take(limit)
+                    .filter_map(|r| r.ok()) // Filter out buggy events
                    .filter(|(_, pdu)| {
                        services()
                            .rooms
@ -154,7 +133,7 @@ impl Service {
                            .user_can_see_event(sender_user, room_id, &pdu.event_id)
                            .unwrap_or(false)
                    })
-                    .take_while(|&(k, _)| Some(k) != to.as_ref()) // Stop at `to`
+                    .take_while(|&(k, _)| Some(k) != to) // Stop at `to`
                    .collect();

                next_token = events_before.last().map(|(count, _)| count).copied();
@ -168,7 +147,6 @@ impl Service {
                    chunk: events_before,
                    next_batch: next_token.map(|t| t.stringify()),
                    prev_batch: Some(from.stringify()),
-                    recursion_depth: if recurse { Some(depth.into()) } else { None },
                })
            }
        }
@ -180,44 +158,14 @@ impl Service {
        room_id: &'a RoomId,
        target: &'a EventId,
        until: PduCount,
-        max_depth: u8,
-    ) -> Result<Vec<(PduCount, PduEvent)>> {
+    ) -> Result<impl Iterator<Item = Result<(PduCount, PduEvent)>> + 'a> {
        let room_id = services().rooms.short.get_or_create_shortroomid(room_id)?;
        let target = match services().rooms.timeline.get_pdu_count(target)? {
            Some(PduCount::Normal(c)) => c,
            // TODO: Support backfilled relations
            _ => 0, // This will result in an empty iterator
        };
-
-        self.db
-            .relations_until(user_id, room_id, target, until)
-            .map(|mut relations| {
-                let mut pdus: Vec<_> = (*relations).into_iter().filter_map(Result::ok).collect();
-                let mut stack: Vec<_> =
-                    pdus.clone().iter().map(|pdu| (pdu.to_owned(), 1)).collect();
-
-                while let Some(stack_pdu) = stack.pop() {
-                    let target = match stack_pdu.0 .0 {
-                        PduCount::Normal(c) => c,
-                        // TODO: Support backfilled relations
-                        PduCount::Backfilled(_) => 0, // This will result in an empty iterator
-                    };
-
-                    if let Ok(relations) = self.db.relations_until(user_id, room_id, target, until)
-                    {
-                        for relation in relations.flatten() {
-                            if stack_pdu.1 < max_depth {
-                                stack.push((relation.clone(), stack_pdu.1 + 1));
-                            }
-
-                            pdus.push(relation);
-                        }
-                    }
-                }
-
-                pdus.sort_by(|a, b| a.0.cmp(&b.0));
-                pdus
-            })
+        self.db.relations_until(user_id, room_id, target, until)
    }

    #[tracing::instrument(skip(self, room_id, event_ids))]
--- a/src/service/rooms/search/data.rs
+++ b/src/service/rooms/search/data.rs
@ -4,8 +4,6 @@ use ruma::RoomId;
 pub trait Data: Send + Sync {
    fn index_pdu(&self, shortroomid: u64, pdu_id: &[u8], message_body: &str) -> Result<()>;

-    fn deindex_pdu(&self, shortroomid: u64, pdu_id: &[u8], message_body: &str) -> Result<()>;
-
    #[allow(clippy::type_complexity)]
    fn search_pdus<'a>(
        &'a self,
--- a/src/service/rooms/search/mod.rs
+++ b/src/service/rooms/search/mod.rs
@ -15,16 +15,6 @@ impl Service {
        self.db.index_pdu(shortroomid, pdu_id, message_body)
    }

-    #[tracing::instrument(skip(self))]
-    pub fn deindex_pdu<'a>(
-        &self,
-        shortroomid: u64,
-        pdu_id: &[u8],
-        message_body: &str,
-    ) -> Result<()> {
-        self.db.deindex_pdu(shortroomid, pdu_id, message_body)
-    }
-
    #[tracing::instrument(skip(self))]
    pub fn search_pdus<'a>(
        &'a self,
--- a/src/service/rooms/spaces/mod.rs
+++ b/src/service/rooms/spaces/mod.rs
@ -408,7 +408,7 @@ impl Service {
                    debug!("User is not allowed to see room {room_id}");
                    // This error will be caught later
                    return Err(Error::BadRequest(
-                        ErrorKind::forbidden(),
+                        ErrorKind::Forbidden,
                        "User is not allowed to see the room",
                    ));
                }
--- a/src/service/rooms/state_accessor/mod.rs
+++ b/src/service/rooms/state_accessor/mod.rs
@ -321,7 +321,6 @@ impl Service {
            unsigned: None,
            state_key: Some(target_user.into()),
            redacts: None,
-            timestamp: None,
        };

        Ok(services()
--- a/src/service/rooms/timeline/mod.rs
+++ b/src/service/rooms/timeline/mod.rs
@ -21,9 +21,10 @@ use ruma::{
        GlobalAccountDataEventType, StateEventType, TimelineEventType,
    },
    push::{Action, Ruleset, Tweak},
+    serde::Base64,
    state_res::{self, Event, RoomVersion},
-    uint, user_id, CanonicalJsonObject, CanonicalJsonValue, EventId, MilliSecondsSinceUnixEpoch,
-    OwnedEventId, OwnedRoomId, OwnedServerName, RoomId, RoomVersionId, ServerName, UserId,
+    uint, user_id, CanonicalJsonObject, CanonicalJsonValue, EventId, OwnedEventId, OwnedRoomId,
+    OwnedServerName, RoomId, RoomVersionId, ServerName, UserId,
 };
 use serde::Deserialize;
 use serde_json::value::{to_raw_value, RawValue as RawJsonValue};
@ -32,10 +33,7 @@ use tracing::{error, info, warn};

 use crate::{
    api::server_server,
-    service::{
-        globals::SigningKeys,
-        pdu::{EventHash, PduBuilder},
-    },
+    service::pdu::{EventHash, PduBuilder},
    services, utils, Error, PduEvent, Result,
 };

@ -401,7 +399,7 @@ impl Service {
                                &pdu.room_id,
                                false,
                            )? {
-                                self.redact_pdu(redact_id, pdu, shortroomid)?;
+                                self.redact_pdu(redact_id, pdu)?;
                            }
                        }
                    }
@ -418,7 +416,7 @@ impl Service {
                                &pdu.room_id,
                                false,
                            )? {
-                                self.redact_pdu(redact_id, pdu, shortroomid)?;
+                                self.redact_pdu(redact_id, pdu)?;
                            }
                        }
                    }
@ -485,27 +483,20 @@ impl Service {
                        .search
                        .index_pdu(shortroomid, &pdu_id, &body)?;

-                    let server_user = services().globals.server_user();
+                    let server_user = format!("@conduit:{}", services().globals.server_name());

                    let to_conduit = body.starts_with(&format!("{server_user}: "))
                        || body.starts_with(&format!("{server_user} "))
                        || body == format!("{server_user}:")
-                        || body == server_user.as_str();
+                        || body == server_user;

                    // This will evaluate to false if the emergency password is set up so that
                    // the administrator can execute commands as conduit
-                    let from_conduit = pdu.sender == *server_user
+                    let from_conduit = pdu.sender == server_user
                        && services().globals.emergency_password().is_none();

                    if let Some(admin_room) = services().admin.get_admin_room()? {
-                        if to_conduit
-                            && !from_conduit
-                            && admin_room == pdu.room_id
-                            && services()
-                                .rooms
-                                .state_cache
-                                .is_joined(server_user, &admin_room)?
-                        {
+                        if to_conduit && !from_conduit && admin_room == pdu.room_id {
                            services().admin.process_message(body);
                        }
                    }
@ -665,7 +656,6 @@ impl Service {
            unsigned,
            state_key,
            redacts,
-            timestamp,
        } = pdu_builder;

        let prev_events: Vec<_> = services()
@ -735,9 +725,9 @@ impl Service {
            event_id: ruma::event_id!("$thiswillbefilledinlater").into(),
            room_id: room_id.to_owned(),
            sender: sender.to_owned(),
-            origin_server_ts: timestamp
-                .map(|ts| ts.get())
-                .unwrap_or_else(|| MilliSecondsSinceUnixEpoch::now().get()),
+            origin_server_ts: utils::millis_since_unix_epoch()
+                .try_into()
+                .expect("time is valid"),
            kind: event_type,
            content,
            state_key,
@ -772,7 +762,7 @@ impl Service {

        if !auth_check {
            return Err(Error::BadRequest(
-                ErrorKind::forbidden(),
+                ErrorKind::Forbidden,
                "Event is not authorized.",
            ));
        }
@ -815,7 +805,7 @@ impl Service {
        pdu.event_id = EventId::parse_arc(format!(
            "${}",
            ruma::signatures::reference_hash(&pdu_json, &room_version_id)
-                .expect("Event format validated when event was hashed")
+                .expect("ruma can calculate reference hashes")
        ))
        .expect("ruma's reference hashes are valid event ids");

@ -852,7 +842,7 @@ impl Service {
                    TimelineEventType::RoomEncryption => {
                        warn!("Encryption is not allowed in the admins room");
                        return Err(Error::BadRequest(
-                            ErrorKind::forbidden(),
+                            ErrorKind::Forbidden,
                            "Encryption is not allowed in the admins room.",
                        ));
                    }
@ -867,7 +857,7 @@ impl Service {
                            .filter(|v| v.starts_with('@'))
                            .unwrap_or(sender.as_str());
                        let server_name = services().globals.server_name();
-                        let server_user = services().globals.server_user().as_str();
+                        let server_user = format!("@conduit:{}", server_name);
                        let content = serde_json::from_str::<ExtractMembership>(pdu.content.get())
                            .map_err(|_| Error::bad_database("Invalid content in pdu."))?;

@ -875,7 +865,7 @@ impl Service {
                            if target == server_user {
                                warn!("Conduit user cannot leave from admins room");
                                return Err(Error::BadRequest(
-                                    ErrorKind::forbidden(),
+                                    ErrorKind::Forbidden,
                                    "Conduit user cannot leave from admins room.",
                                ));
                            }
@ -891,7 +881,7 @@ impl Service {
                            if count < 2 {
                                warn!("Last admin cannot leave from admins room");
                                return Err(Error::BadRequest(
-                                    ErrorKind::forbidden(),
+                                    ErrorKind::Forbidden,
                                    "Last admin cannot leave from admins room.",
                                ));
                            }
@ -901,7 +891,7 @@ impl Service {
                            if target == server_user {
                                warn!("Conduit user cannot be banned in admins room");
                                return Err(Error::BadRequest(
-                                    ErrorKind::forbidden(),
+                                    ErrorKind::Forbidden,
                                    "Conduit user cannot be banned in admins room.",
                                ));
                            }
@ -917,7 +907,7 @@ impl Service {
                            if count < 2 {
                                warn!("Last admin cannot be banned in admins room");
                                return Err(Error::BadRequest(
-                                    ErrorKind::forbidden(),
+                                    ErrorKind::Forbidden,
                                    "Last admin cannot be banned in admins room.",
                                ));
                            }
@ -949,7 +939,7 @@ impl Service {
                            false,
                        )? {
                            return Err(Error::BadRequest(
-                                ErrorKind::forbidden(),
+                                ErrorKind::Forbidden,
                                "User cannot redact this event.",
                            ));
                        }
@ -970,7 +960,7 @@ impl Service {
                            false,
                        )? {
                            return Err(Error::BadRequest(
-                                ErrorKind::forbidden(),
+                                ErrorKind::Forbidden,
                                "User cannot redact this event.",
                            ));
                        }
@ -1110,33 +1100,14 @@ impl Service {

    /// Replace a PDU with the redacted form.
    #[tracing::instrument(skip(self, reason))]
-    pub fn redact_pdu(
-        &self,
-        event_id: &EventId,
-        reason: &PduEvent,
-        shortroomid: u64,
-    ) -> Result<()> {
+    pub fn redact_pdu(&self, event_id: &EventId, reason: &PduEvent) -> Result<()> {
        // TODO: Don't reserialize, keep original json
        if let Some(pdu_id) = self.get_pdu_id(event_id)? {
            let mut pdu = self
                .get_pdu_from_id(&pdu_id)?
                .ok_or_else(|| Error::bad_database("PDU ID points to invalid PDU."))?;
-
-            #[derive(Deserialize)]
-            struct ExtractBody {
-                body: String,
-            }
-
-            if let Ok(content) = serde_json::from_str::<ExtractBody>(pdu.content.get()) {
-                services()
-                    .rooms
-                    .search
-                    .deindex_pdu(shortroomid, &pdu_id, &content.body)?;
-            }
-
            let room_version_id = services().rooms.state.get_room_version(&pdu.room_id)?;
            pdu.redact(room_version_id, reason)?;
-
            self.replace_pdu(
                &pdu_id,
                &utils::to_canonical_object(&pdu).expect("PDU is an object"),
@ -1217,7 +1188,7 @@ impl Service {
        &self,
        origin: &ServerName,
        pdu: Box<RawJsonValue>,
-        pub_key_map: &RwLock<BTreeMap<String, SigningKeys>>,
+        pub_key_map: &RwLock<BTreeMap<String, BTreeMap<String, Base64>>>,
    ) -> Result<()> {
        let (event_id, value, room_id) = server_server::parse_incoming_pdu(&pdu)?;

--- a/src/service/uiaa/mod.rs
+++ b/src/service/uiaa/mod.rs
@ -86,7 +86,7 @@ impl Service {

                    if !hash_matches {
                        uiaainfo.auth_error = Some(ruma::api::client::error::StandardErrorBody {
-                            kind: ErrorKind::forbidden(),
+                            kind: ErrorKind::Forbidden,
                            message: "Invalid username or password.".to_owned(),
                        });
                        return Ok((false, uiaainfo));
@ -101,7 +101,7 @@ impl Service {
                    uiaainfo.completed.push(AuthType::RegistrationToken);
                } else {
                    uiaainfo.auth_error = Some(ruma::api::client::error::StandardErrorBody {
-                        kind: ErrorKind::forbidden(),
+                        kind: ErrorKind::Forbidden,
                        message: "Invalid registration token.".to_owned(),
                    });
                    return Ok((false, uiaainfo));
--- a/src/service/users/data.rs
+++ b/src/service/users/data.rs
@ -211,10 +211,4 @@ pub trait Data: Send + Sync {
    fn create_filter(&self, user_id: &UserId, filter: &FilterDefinition) -> Result<String>;

    fn get_filter(&self, user_id: &UserId, filter_id: &str) -> Result<Option<FilterDefinition>>;
-
-    // Creates an OpenID token, which can be used to prove that a user has access to an account (primarily for integrations)
-    fn create_openid_token(&self, user_id: &UserId) -> Result<(String, u64)>;
-
-    /// Find out which user an OpenID access token belongs to.
-    fn find_from_openid_token(&self, token: &str) -> Result<Option<OwnedUserId>>;
 }
--- a/src/service/users/mod.rs
+++ b/src/service/users/mod.rs
@ -9,6 +9,7 @@ pub use data::Data;
 use ruma::{
    api::client::{
        device::Device,
+        error::ErrorKind,
        filter::FilterDefinition,
        sync::sync_events::{
            self,
@ -19,7 +20,7 @@ use ruma::{
    events::AnyToDeviceEvent,
    serde::Raw,
    DeviceId, DeviceKeyAlgorithm, DeviceKeyId, OwnedDeviceId, OwnedDeviceKeyId, OwnedMxcUri,
-    OwnedRoomId, OwnedUserId, UInt, UserId,
+    OwnedRoomId, OwnedUserId, RoomAliasId, UInt, UserId,
 };

 use crate::{services, Error, Result};
@ -261,14 +262,19 @@ impl Service {

    /// Check if a user is an admin
    pub fn is_admin(&self, user_id: &UserId) -> Result<bool> {
-        if let Some(admin_room_id) = services().admin.get_admin_room()? {
-            services()
-                .rooms
-                .state_cache
-                .is_joined(user_id, &admin_room_id)
-        } else {
-            Ok(false)
-        }
+        let admin_room_alias_id =
+            RoomAliasId::parse(format!("#admins:{}", services().globals.server_name()))
+                .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Invalid alias."))?;
+        let admin_room_id = services()
+            .rooms
+            .alias
+            .resolve_local_alias(&admin_room_alias_id)?
+            .unwrap();
+
+        services()
+            .rooms
+            .state_cache
+            .is_joined(user_id, &admin_room_id)
    }

    /// Create a new user account on this homeserver.
@ -592,16 +598,6 @@ impl Service {
    ) -> Result<Option<FilterDefinition>> {
        self.db.get_filter(user_id, filter_id)
    }
-
-    // Creates an OpenID token, which can be used to prove that a user has access to an account (primarily for integrations)
-    pub fn create_openid_token(&self, user_id: &UserId) -> Result<(String, u64)> {
-        self.db.create_openid_token(user_id)
-    }
-
-    /// Find out which user an OpenID access token belongs to.
-    pub fn find_from_openid_token(&self, token: &str) -> Result<Option<OwnedUserId>> {
-        self.db.find_from_openid_token(token)
-    }
 }

 /// Ensure that a user only sees signatures from themselves and the target user
--- a/src/utils/error.rs
+++ b/src/utils/error.rs
@ -128,7 +128,7 @@ impl Error {
                kind.clone(),
                match kind {
                    WrongRoomKeysVersion { .. }
-                    | Forbidden { .. }
+                    | Forbidden
                    | GuestAccessForbidden
                    | ThreepidAuthFailed
                    | ThreepidDenied => StatusCode::FORBIDDEN,
--- a/taplo.toml
+++ b/taplo.toml
@ -1,24 +0,0 @@
-exclude = [".**/*.toml"]
-include = ["**/*.toml"]
-[formatting]
-reorder_arrays = true
-reorder_keys = true
-
-# Prevent breaking command and argument order
-[[rule]]
-include = ["engage.toml"]
-# https://github.com/tamasfe/taplo/issues/608
-#keys = ["interpreter"]
-
-[rule.formatting]
-reorder_arrays = false
-
-# Prevent breaking license file order
-[[rule]]
-include = ["Cargo.toml"]
-# https://github.com/tamasfe/taplo/issues/608
-# keys = ["package.metadata.deb.license-file", "package.metadata.deb.assets"]
-keys = ["package.metadata.deb", "package.metadata.deb.assets"]
-
-[rule.formatting]
-reorder_arrays = false
--- a/tests/test-config.toml
+++ b/tests/test-config.toml
@ -7,9 +7,9 @@ server_name = "localhost"
 database_path = "/tmp"

 # All the other settings are left at their defaults:
-address = "127.0.0.1"
-allow_registration = true
-max_request_size = 20_000_000
 port = 6167
-proxy = "none"
+max_request_size = 20_000_000
+allow_registration = true
 trusted_servers = ["matrix.org"]
+address = "127.0.0.1"
+proxy = "none"
Author	SHA1	Message	Date
Matthias Ahouansou	9a88386ddf	feat: allow specifying config path via command flag	2024-05-05 18:47:55 +01:00
Matthias Ahouansou	60a2f2d011	feat: generate config	2024-05-05 18:47:51 +01:00