fix: SEC8

Reviewed-By: Ginger <ginger@gingershaped.computer>
Reviewed-By: Jade <jade@ellis.link>
Reviewed-By: Jacob Taylor <jacob@explodie.org>

src/admin/debug/commands.rs

@@ -694,11 +694,11 @@ impl crate::Context<'_> {
 			| Ok(value) => match self
 				.services
 				.server_keys
-				.verify_json(&value, &room_version_rules)
+				.verify_event_json(&value, &room_version_rules)
 				.await
 			{
 				| Err(e) => return Err!("Signature verification failed: {e}"),
-				| Ok(()) => write!(self, "Signature correct"),
+				| Ok(_) => write!(self, "Signature correct"),
 			},
 		}
 		.await
@@ -714,7 +714,7 @@ impl crate::Context<'_> {
 		let msg = match self
 			.services
 			.server_keys
-			.verify_event(&event, &room_version_rules)
+			.verify_event_json(&event, &room_version_rules)
 			.await
 		{
 			| Err(e) => return Err(e),
@@ -849,7 +849,7 @@ impl crate::Context<'_> {
 		for result in remote_state_response.pdus.iter().map(|pdu| {
 			self.services
 				.server_keys
-				.validate_and_add_event_id(pdu, &room_version_rules)
+				.verify_event_json_no_fetch_add_event_id(pdu, &room_version_rules)
 		}) {
 			let Ok((event_id, value)) = result.await else {
 				continue;
@@ -887,7 +887,7 @@ impl crate::Context<'_> {
 		for result in remote_state_response.auth_chain.iter().map(|pdu| {
 			self.services
 				.server_keys
-				.validate_and_add_event_id(pdu, &room_version_rules)
+				.verify_event_json_no_fetch_add_event_id(pdu, &room_version_rules)
 		}) {
 			let Ok((event_id, value)) = result.await else {
 				continue;
@@ -943,60 +943,6 @@ impl crate::Context<'_> {
 			.await
 	}
 
-	pub(super) async fn get_signing_keys(
-		&self,
-		server_name: Option<OwnedServerName>,
-		notary: Option<OwnedServerName>,
-		query: bool,
-	) -> Result {
-		let server_name = server_name.unwrap_or_else(|| self.services.server.name.clone());
-
-		if let Some(notary) = notary {
-			let signing_keys = self
-				.services
-				.server_keys
-				.notary_request(&notary, &server_name)
-				.await?;
-
-			let out = format!("```rs\n{signing_keys:#?}\n```");
-			return self.write_str(&out).await;
-		}
-
-		let signing_keys = if query {
-			self.services
-				.server_keys
-				.server_request(&server_name)
-				.await?
-		} else {
-			self.services
-				.server_keys
-				.signing_keys_for(&server_name)
-				.await?
-		};
-
-		let out = format!("```rs\n{signing_keys:#?}\n```");
-		self.write_str(&out).await
-	}
-
-	pub(super) async fn get_verify_keys(&self, server_name: Option<OwnedServerName>) -> Result {
-		let server_name = server_name.unwrap_or_else(|| self.services.server.name.clone());
-
-		let keys = self
-			.services
-			.server_keys
-			.verify_keys_for(&server_name)
-			.await;
-
-		let mut out = String::new();
-		writeln!(out, "| Key ID | Public Key |")?;
-		writeln!(out, "| --- | --- |")?;
-		for (key_id, key) in keys {
-			writeln!(out, "| {key_id} | {key:?} |")?;
-		}
-
-		self.write_str(&out).await
-	}
-
 	pub(super) async fn resolve_true_destination(
 		&self,
 		server_name: OwnedServerName,

src/admin/debug/mod.rs

@@ -103,22 +103,6 @@ pub enum DebugCommand {
 		event_id: OwnedEventId,
 	},
 
-	/// Get and display signing keys from local cache or remote server.
-	GetSigningKeys {
-		server_name: Option<OwnedServerName>,
-
-		#[arg(long)]
-		notary: Option<OwnedServerName>,
-
-		#[arg(short, long)]
-		query: bool,
-	},
-
-	/// Get and display signing keys from local cache or remote server.
-	GetVerifyKeys {
-		server_name: Option<OwnedServerName>,
-	},
-
 	/// Sends a federation request to the remote server's
 	///   `/_matrix/federation/v1/version` endpoint and measures the latency it
 	///   took for the server to respond

src/admin/federation/commands.rs

@@ -2,7 +2,7 @@ use std::fmt::Write;
 
 use conduwuit::{Err, Result, utils::response::LimitReadExt};
 use futures::StreamExt;
-use ruma::{OwnedRoomId, OwnedServerName, OwnedUserId};
+use ruma::{MilliSecondsSinceUnixEpoch, OwnedRoomId, OwnedServerName, OwnedUserId};
 
 use crate::get_room_info;
 
@@ -131,4 +131,30 @@ impl crate::Context<'_> {
 		self.write_str(&format!("Rooms {user_id} shares with us ({num}):\n```\n{body}\n```"))
 			.await
 	}
+
+	pub(super) async fn get_signing_keys(&self, server_name: OwnedServerName) -> Result {
+		let response = self
+			.services
+			.server_keys
+			.origin_request(server_name, MilliSecondsSinceUnixEpoch::now())
+			.await?;
+		self.write_str("| Key ID | Public Key | Expired (unix milliseconds) |\n")
+			.await?;
+		self.write_str("| ------ | ---------- | --------------------------- |\n")
+			.await?;
+		for (key_id, key) in &response.verify_keys {
+			self.write_str(&format!("| {key_id} | {} | |\n", key.key))
+				.await?;
+		}
+		for (key_id, old_key) in &response.old_verify_keys {
+			self.write_str(&format!(
+				"| {key_id} | {} | {:0<13} |\n",
+				old_key.key,
+				old_key.expired_ts.get().to_string()
+			))
+			.await?;
+		}
+
+		Ok(())
+	}
 }

src/admin/federation/mod.rs

@@ -39,4 +39,9 @@ pub enum FederationCommand {
 	RemoteUserInRooms {
 		user_id: OwnedUserId,
 	},
+
+	/// Queries the remote server for their current signing keys.
+	GetSigningKeys {
+		server_name: OwnedServerName,
+	},
 }

src/admin/processor.rs

@@ -32,7 +32,6 @@ use crate::{admin, admin::AdminCommand, context::Context};
 #[must_use]
 pub(super) fn complete(line: &str) -> String { complete_command(AdminCommand::command(), line) }
 
-#[must_use]
 pub(super) fn dispatch(services: Arc<Services>, command: CommandInput) -> ProcessorFuture {
 	Box::pin(handle_command(services, command))
 }

src/admin/query/globals.rs

@@ -1,6 +1,5 @@
 use clap::Subcommand;
 use conduwuit::Result;
-use ruma::OwnedServerName;
 
 use crate::Context;
 
@@ -12,12 +11,6 @@ pub enum GlobalsCommand {
 	CurrentCount,
 
 	LastCheckForAnnouncementsId,
-
-	/// This returns an empty `Ok(BTreeMap<..>)` when there are no keys found
-	///   for the server.
-	SigningKeysFor {
-		origin: OwnedServerName,
-	},
 }
 
 /// All the getters and iterators from src/database/key_value/globals.rs
@@ -47,13 +40,6 @@ pub(super) async fn process(subcommand: GlobalsCommand, context: &Context<'_>) -
 				.await;
 			let query_time = timer.elapsed();
 
-			write!(context, "Query completed in {query_time:?}:\n\n```rs\n{results:#?}\n```")
-		},
-		| GlobalsCommand::SigningKeysFor { origin } => {
-			let timer = tokio::time::Instant::now();
-			let results = services.server_keys.verify_keys_for(&origin).await;
-			let query_time = timer.elapsed();
-
 			write!(context, "Query completed in {query_time:?}:\n\n```rs\n{results:#?}\n```")
 		},
 	}

src/admin/room/moderation.rs

@@ -204,7 +204,7 @@ impl crate::Context<'_> {
 							},
 						};
 
-						room_ids.push(room_id.clone());
+						room_ids.push(room_id);
 					}
 
 					if room_alias_or_id.is_room_alias_id() {