Bump version to v0.7.5

Upcoming breaking changes in room v12 prevent safely using the default
room version and security embargoes prevent fixing them ahead of time.

.github/ISSUE_TEMPLATE/bug.md

@@ -5,3 +5,10 @@ about: If something is definitely wrong in the bridge (rather than just a setup
 labels: bug
 
 ---
+
+<!--
+Remember to include relevant logs, the bridge version and any other details.
+
+If you aren't sure what's needed, ask in the Matrix room rather than opening an
+incomplete issue. Issues with insufficient detail will likely just be ignored.
+-->

.github/workflows/go.yml

@@ -5,13 +5,20 @@ on: [push, pull_request]
 jobs:
   lint:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        go-version: ["1.23", "1.24"]
+    name: Lint ${{ matrix.go-version == '1.24' && '(latest)' || '(old)' }}
+
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.20"
+          go-version: ${{ matrix.go-version }}
+          cache: true
 
       - name: Install libolm
         run: sudo apt-get install libolm-dev libolm3

.github/workflows/stale.yml

@@ -0,0 +1,29 @@
+name: 'Lock old issues'
+
+on:
+  schedule:
+    - cron: '0 21 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+#  pull-requests: write
+#  discussions: write
+
+concurrency:
+  group: lock-threads
+
+jobs:
+  lock-stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@v5
+        id: lock
+        with:
+          issue-inactive-days: 90
+          process-only: issues
+      - name: Log processed threads
+        run: |
+          if [ '${{ steps.lock.outputs.issues }}' ]; then
+            echo "Issues:" && echo '${{ steps.lock.outputs.issues }}' | jq -r '.[] | "https://github.com/\(.owner)/\(.repo)/issues/\(.issue_number)"'
+          fi

.gitignore

@@ -4,3 +4,6 @@
 
 *.db*
 *.log*
+
+/mautrix-discord
+/start

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
+    rev: v4.5.0
     hooks:
       - id: trailing-whitespace
         exclude_types: [markdown]
@@ -13,3 +13,8 @@ repos:
     hooks:
       - id: go-imports-repo
       - id: go-vet-repo-mod
+
+  - repo: https://github.com/beeper/pre-commit-go
+    rev: v0.3.1
+    hooks:
+      - id: zerolog-ban-msgf

CHANGELOG.md

@@ -1,3 +1,113 @@
+# v0.7.5 (2025-07-16)
+
+* Fixed federation key response when using direct media.
+* Changed `prefix_webhook_messages` option to generate [MSC4144] fallbacks,
+  so that any compatible clients will hide the prefix.
+* Changed new room creation to hardcode room v11 to avoid v12 rooms being
+  created before proper support for them can be added.
+
+# v0.7.4 (2025-06-16)
+
+* Added support for forwarded messages
+* Added support for [MSC4193] media spoilers (thanks to [@LeaPhant] in [#189]).
+* Added support for [MSC4190] for MAS-compatible encryption.
+* Updated Docker image to Alpine 3.22
+
+[MSC4193]: https://github.com/matrix-org/matrix-spec-proposals/pull/4193
+[MSC4190]: https://github.com/matrix-org/matrix-spec-proposals/pull/4190
+[@LeaPhant]: https://github.com/mautrix/discord/pull/189
+[#189]: https://github.com/mautrix/discord/pull/189
+
+# v0.7.3 (2025-04-16)
+
+* Added support for sending no-mention replies from Matrix
+  (uses intentional mentions and requires client support).
+* Added file name to QR image message when logging in to fix rendering in dumb
+  clients that validate the file extension.
+* Added `id` field to per-message profiles to match [MSC4144].
+* Fixed guild avatars in per-message profiles (thanks to [@mat-1] in [#172]).
+* Fixed typo in MSC1767 field name in voice messages (thanks to [@ginnyTheCat] in [#177]).
+
+[@mat-1]: https://github.com/mat-1
+[@ginnyTheCat]: https://github.com/ginnyTheCat
+[#172]: https://github.com/mautrix/discord/pull/172
+[#177]: https://github.com/mautrix/discord/pull/177
+[MSC4144]: https://github.com/matrix-org/matrix-spec-proposals/pull/4144
+
+# v0.7.2 (2024-12-16)
+
+* Fixed some headers being set incorrectly.
+
+# v0.7.1 (2024-11-16)
+
+* Bumped minimum Go version to 1.22.
+* Updated Discord version numbers.
+
+# v0.7.0 (2024-07-16)
+
+* Bumped minimum Go version to 1.21.
+* Added support for Matrix v1.11 authenticated media.
+  * This also changes how avatars are sent to Discord when using relay webhooks.
+    To keep avatars working, you must configure `public_address` in the *bridge*
+    section of the config and proxy `/mautrix-discord/avatar/*` from that
+    address to the bridge.
+* Added `create-portal` command to create individual portals bypassing the
+  bridging mode. When used in combination with the `if-portal-exists` bridging
+  mode, this can be used to bridge individual channels from a guild.
+* Changed how direct media access works to make it compatible with Discord's
+  signed URL requirement. The new system must be enabled manually, see
+  [docs](https://docs.mau.fi/bridges/go/discord/direct-media.html) for info.
+
+# v0.6.5 (2024-01-16)
+
+* Fixed adding reply embed to webhook sends if the Matrix room is encrypted.
+
+# v0.6.4 (2023-11-16)
+
+* Changed error messages to be sent in a thread if the errored message was in
+  a thread.
+
+# v0.6.3 (2023-10-16)
+
+* Fixed op7 reconnects during connection causing the bridge to get stuck
+  disconnected.
+* Fixed double puppet of recipient joining DM portals when both ends of a DM
+  are using the same bridge.
+
+# v0.6.2 (2023-09-16)
+
+* Added support for double puppeting with arbitrary `as_token`s.
+  See [docs](https://docs.mau.fi/bridges/general/double-puppeting.html#appservice-method-new) for more info.
+* Adjusted markdown parsing rules to allow inline links in normal messages.
+* Fixed panic if redacting an attachment fails.
+* Fixed panic when handling video embeds with no URLs
+  (thanks to [@odrling] in [#110]).
+
+[@odrling]: https://github.com/odrling
+[#110]: https://github.com/mautrix/discord/pull/110
+
+# v0.6.1 (2023-08-16)
+
+* Bumped minimum Go version to 1.20.
+* Fixed all logged-in users being invited to existing portal rooms even if they
+  don't have permission to view the channel on Discord.
+* Fixed gif links not being treated as embeds if the canonical URL is different
+  than the URL in the message body.
+
+# v0.6.0 (2023-07-16)
+
+* Added initial support for backfilling threads.
+* Exposed `Application` flag to displayname template.
+* Changed `m.emote` bridging to use italics on Discord.
+* Updated Docker image to Alpine 3.18.
+* Added limit to parallel media transfers to avoid high memory usage if lots
+  of messages are received at the same time.
+* Fixed guilds being unbridged if Discord has server issues and temporarily
+  marks a guild as unavailable.
+* Fixed using `guilds bridge` command without `--entire` flag.
+* Fixed panic if lottieconverter isn't installed.
+* Fixed relay webhook secret being leaked in network error messages.
+
 # v0.5.0 (2023-06-16)
 
 * Added support for intentional mentions in Matrix (MSC3952).

Dockerfile

@@ -1,6 +1,6 @@
-FROM dock.mau.dev/tulir/lottieconverter:alpine-3.17 AS lottie
+FROM dock.mau.dev/tulir/lottieconverter:alpine-3.22 AS lottie
 
-FROM golang:1-alpine3.17 AS builder
+FROM golang:1-alpine3.22 AS builder
 
 RUN apk add --no-cache git ca-certificates build-base su-exec olm-dev
 
@@ -8,7 +8,7 @@ COPY . /build
 WORKDIR /build
 RUN go build -o /usr/bin/mautrix-discord
 
-FROM alpine:3.17
+FROM alpine:3.22
 
 ENV UID=1337 \
     GID=1337

Dockerfile.ci

@@ -1,6 +1,6 @@
-FROM dock.mau.dev/tulir/lottieconverter:alpine-3.17 AS lottie
+FROM dock.mau.dev/tulir/lottieconverter:alpine-3.22 AS lottie
 
-FROM alpine:3.17
+FROM alpine:3.22
 
 ENV UID=1337 \
     GID=1337

Dockerfile.dev

@@ -1,18 +0,0 @@
-FROM dock.mau.dev/tulir/lottieconverter:alpine-3.17 AS lottie
-
-FROM golang:1-alpine3.17 AS builder
-
-RUN apk add --no-cache git ca-certificates build-base su-exec olm-dev bash jq yq curl \
-    zlib libpng giflib libstdc++ libgcc
-
-COPY --from=lottie /usr/lib/librlottie.so* /usr/lib/
-COPY --from=lottie /usr/local/bin/lottieconverter /usr/local/bin/lottieconverter
-COPY . /build
-WORKDIR /build
-RUN go build -o /usr/bin/mautrix-discord
-
-# Setup development stack using gow
-RUN go install github.com/mitranim/gow@latest
-RUN echo 'gow run /build $@' > /usr/bin/mautrix-discord \
-    && chmod +x /usr/bin/mautrix-discord
-VOLUME /data

ROADMAP.md

@@ -1,11 +1,12 @@
 # Features & roadmap
 * Matrix → Discord
-  * [x] Message content
+  * [ ] Message content
     * [x] Plain text
     * [x] Formatted messages
     * [x] Media/files
     * [x] Replies
     * [x] Threads
+    * [ ] Custom emojis
   * [x] Message redactions
   * [x] Reactions
     * [x] Unicode emojis
@@ -45,7 +46,7 @@
   * [x] Message deletions
   * [x] Reactions
     * [x] Unicode emojis
-    * [x] Custom emojis (not yet supported on Matrix)
+    * [x] Custom emojis ([MSC4027](https://github.com/matrix-org/matrix-spec-proposals/pull/4027))
   * [x] Avatars
   * [ ] Presence
   * [ ] Typing notifications (currently partial support: DMs work after you type in them)

attachments.go

@@ -3,6 +3,7 @@ package main
 import (
 	"bytes"
 	"context"
+	"errors"
 	"fmt"
 	"image"
 	"io"
@@ -12,23 +13,23 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/bwmarrin/discordgo"
 	"github.com/gabriel-vasile/mimetype"
-
+	"go.mau.fi/util/exsync"
+	"go.mau.fi/util/ffmpeg"
 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/appservice"
 	"maunium.net/go/mautrix/crypto/attachment"
 	"maunium.net/go/mautrix/event"
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util"
-	"maunium.net/go/mautrix/util/ffmpeg"
 
 	"go.mau.fi/mautrix-discord/database"
 )
 
-func downloadDiscordAttachment(url string) ([]byte, error) {
+func downloadDiscordAttachment(cli *http.Client, url string, maxSize int64) ([]byte, error) {
 	req, err := http.NewRequest(http.MethodGet, url, nil)
 	if err != nil {
 		return nil, err
@@ -37,28 +38,48 @@ func downloadDiscordAttachment(url string) ([]byte, error) {
 		req.Header.Set(key, value)
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := cli.Do(req)
 	if err != nil {
 		return nil, err
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode > 300 {
 		data, _ := io.ReadAll(resp.Body)
-		return nil, fmt.Errorf("unexpected status %d: %s", resp.StatusCode, data)
+		return nil, fmt.Errorf("unexpected status %d downloading %s: %s", resp.StatusCode, url, data)
+	}
+	if resp.Header.Get("Content-Length") != "" {
+		length, err := strconv.ParseInt(resp.Header.Get("Content-Length"), 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse content length: %w", err)
+		} else if length > maxSize {
+			return nil, fmt.Errorf("attachment too large (%d > %d)", length, maxSize)
+		}
+		return io.ReadAll(resp.Body)
+	} else {
+		var mbe *http.MaxBytesError
+		data, err := io.ReadAll(http.MaxBytesReader(nil, resp.Body, maxSize))
+		if err != nil && errors.As(err, &mbe) {
+			return nil, fmt.Errorf("attachment too large (over %d)", maxSize)
+		}
+		return data, err
 	}
-	return io.ReadAll(resp.Body)
 }
 
-func uploadDiscordAttachment(url string, data []byte) error {
+func uploadDiscordAttachment(cli *http.Client, url string, data []byte) error {
 	req, err := http.NewRequest(http.MethodPut, url, bytes.NewReader(data))
 	if err != nil {
 		return err
 	}
-	for key, value := range discordgo.DroidFetchHeaders {
+	for key, value := range discordgo.DroidBaseHeaders {
 		req.Header.Set(key, value)
 	}
+	req.Header.Set("Content-Type", "application/octet-stream")
+	req.Header.Set("Referer", "https://discord.com/")
+	req.Header.Set("Sec-Fetch-Dest", "empty")
+	req.Header.Set("Sec-Fetch-Mode", "cors")
+	req.Header.Set("Sec-Fetch-Site", "cross-site")
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := cli.Do(req)
 	if err != nil {
 		return err
 	}
@@ -99,7 +120,7 @@ func downloadMatrixAttachment(intent *appservice.IntentAPI, content *event.Messa
 	return data, nil
 }
 
-func (br *DiscordBridge) uploadMatrixAttachment(intent *appservice.IntentAPI, data []byte, url string, encrypt bool, meta AttachmentMeta) (*database.File, error) {
+func (br *DiscordBridge) uploadMatrixAttachment(intent *appservice.IntentAPI, data []byte, url string, encrypt bool, meta AttachmentMeta, semaWg *sync.WaitGroup) (*database.File, error) {
 	dbFile := br.DB.File.New()
 	dbFile.Timestamp = time.Now()
 	dbFile.URL = url
@@ -135,7 +156,9 @@ func (br *DiscordBridge) uploadMatrixAttachment(intent *appservice.IntentAPI, da
 		dbFile.MXC = resp.ContentURI
 		req.MXC = resp.ContentURI
 		req.UnstableUploadURL = resp.UnstableUploadURL
+		semaWg.Add(1)
 		go func() {
+			defer semaWg.Done()
 			_, err = intent.UploadMedia(req)
 			if err != nil {
 				br.Log.Errorfln("Failed to upload %s: %v", req.MXC, err)
@@ -250,7 +273,7 @@ func (br *DiscordBridge) copyAttachmentToMatrix(intent *appservice.IntentAPI, ur
 	returnDBFile = br.DB.File.Get(url, encrypt)
 	if returnDBFile == nil {
 		transferKey := attachmentKey{url, encrypt}
-		once, _ := br.attachmentTransfers.GetOrSet(transferKey, &util.ReturnableOnce[*database.File]{})
+		once, _ := br.attachmentTransfers.GetOrSet(transferKey, &exsync.ReturnableOnce[*database.File]{})
 		returnDBFile, returnErr = once.Do(func() (onceDBFile *database.File, onceErr error) {
 			if isCacheable {
 				onceDBFile = br.DB.File.Get(url, encrypt)
@@ -259,8 +282,25 @@ func (br *DiscordBridge) copyAttachmentToMatrix(intent *appservice.IntentAPI, ur
 				}
 			}
 
+			const attachmentSizeVal = 1
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			onceErr = br.parallelAttachmentSemaphore.Acquire(ctx, attachmentSizeVal)
+			cancel()
+			if onceErr != nil {
+				br.ZLog.Warn().Err(onceErr).Msg("Failed to acquire semaphore")
+				onceErr = fmt.Errorf("reuploading timed out")
+				return
+			}
+			var semaWg sync.WaitGroup
+			semaWg.Add(1)
+			defer semaWg.Done()
+			go func() {
+				semaWg.Wait()
+				br.parallelAttachmentSemaphore.Release(attachmentSizeVal)
+			}()
+
 			var data []byte
-			data, onceErr = downloadDiscordAttachment(url)
+			data, onceErr = downloadDiscordAttachment(http.DefaultClient, url, br.MediaConfig.UploadSize)
 			if onceErr != nil {
 				return
 			}
@@ -273,7 +313,7 @@ func (br *DiscordBridge) copyAttachmentToMatrix(intent *appservice.IntentAPI, ur
 				}
 			}
 
-			onceDBFile, onceErr = br.uploadMatrixAttachment(intent, data, url, encrypt, meta)
+			onceDBFile, onceErr = br.uploadMatrixAttachment(intent, data, url, encrypt, meta, &semaWg)
 			if onceErr != nil {
 				return
 			}
@@ -288,19 +328,17 @@ func (br *DiscordBridge) copyAttachmentToMatrix(intent *appservice.IntentAPI, ur
 }
 
 func (portal *Portal) getEmojiMXCByDiscordID(emojiID, name string, animated bool) id.ContentURI {
-	var url, mimeType, ext string
+	mxc := portal.bridge.DMA.EmojiMXC(emojiID, name, animated)
+	if !mxc.IsEmpty() {
+		return mxc
+	}
+	var url, mimeType string
 	if animated {
 		url = discordgo.EndpointEmojiAnimated(emojiID)
 		mimeType = "image/gif"
-		ext = "gif"
 	} else {
 		url = discordgo.EndpointEmoji(emojiID)
 		mimeType = "image/png"
-		ext = "png"
-	}
-	mxc := portal.bridge.Config.Bridge.MediaPatterns.Emoji(emojiID, ext)
-	if !mxc.IsEmpty() {
-		return mxc
 	}
 	dbFile, err := portal.bridge.copyAttachmentToMatrix(portal.MainIntent(), url, false, AttachmentMeta{
 		AttachmentID: emojiID,

backfill.go

@@ -10,15 +10,18 @@ import (
 	"github.com/bwmarrin/discordgo"
 	"github.com/rs/zerolog"
 	"maunium.net/go/mautrix"
-	"maunium.net/go/mautrix/bridge/bridgeconfig"
 	"maunium.net/go/mautrix/event"
 	"maunium.net/go/mautrix/id"
 
 	"go.mau.fi/mautrix-discord/database"
 )
 
-func (portal *Portal) forwardBackfillInitial(source *User) {
-	defer portal.forwardBackfillLock.Unlock()
+func (portal *Portal) forwardBackfillInitial(source *User, thread *Thread) {
+	log := portal.log
+	defer func() {
+		log.Debug().Msg("Forward backfill finished, unlocking lock")
+		portal.forwardBackfillLock.Unlock()
+	}()
 	// This should only be called from CreateMatrixRoom which locks forwardBackfillLock before creating the room.
 	if portal.forwardBackfillLock.TryLock() {
 		panic("forwardBackfillInitial() called without locking forwardBackfillLock")
@@ -27,21 +30,28 @@ func (portal *Portal) forwardBackfillInitial(source *User) {
 	limit := portal.bridge.Config.Bridge.Backfill.Limits.Initial.Channel
 	if portal.GuildID == "" {
 		limit = portal.bridge.Config.Bridge.Backfill.Limits.Initial.DM
+		if thread != nil {
+			limit = portal.bridge.Config.Bridge.Backfill.Limits.Initial.Thread
+			thread.initialBackfillAttempted = true
+		}
 	}
 	if limit == 0 {
 		return
 	}
 
-	log := portal.log.With().
+	with := log.With().
 		Str("action", "initial backfill").
 		Str("room_id", portal.MXID.String()).
-		Int("limit", limit).
-		Logger()
+		Int("limit", limit)
+	if thread != nil {
+		with = with.Str("thread_id", thread.ID)
+	}
+	log = with.Logger()
 
-	portal.backfillLimited(log, source, limit, "")
+	portal.backfillLimited(log, source, limit, "", thread)
 }
 
-func (portal *Portal) ForwardBackfillMissed(source *User, meta *discordgo.Channel) {
+func (portal *Portal) ForwardBackfillMissed(source *User, serverLastMessageID string, thread *Thread) {
 	if portal.MXID == "" {
 		return
 	}
@@ -49,50 +59,65 @@ func (portal *Portal) ForwardBackfillMissed(source *User, meta *discordgo.Channe
 	limit := portal.bridge.Config.Bridge.Backfill.Limits.Missed.Channel
 	if portal.GuildID == "" {
 		limit = portal.bridge.Config.Bridge.Backfill.Limits.Missed.DM
+		if thread != nil {
+			limit = portal.bridge.Config.Bridge.Backfill.Limits.Missed.Thread
+		}
 	}
 	if limit == 0 {
 		return
 	}
-	log := portal.log.With().
+	with := portal.log.With().
 		Str("action", "missed event backfill").
 		Str("room_id", portal.MXID.String()).
-		Int("limit", limit).
-		Logger()
+		Int("limit", limit)
+	if thread != nil {
+		with = with.Str("thread_id", thread.ID)
+	}
+	log := with.Logger()
 
 	portal.forwardBackfillLock.Lock()
 	defer portal.forwardBackfillLock.Unlock()
 
-	lastMessage := portal.bridge.DB.Message.GetLast(portal.Key)
-	if lastMessage == nil || meta.LastMessageID == "" {
+	var lastMessage *database.Message
+	if thread != nil {
+		lastMessage = portal.bridge.DB.Message.GetLastInThread(portal.Key, thread.ID)
+	} else {
+		lastMessage = portal.bridge.DB.Message.GetLast(portal.Key)
+	}
+	if lastMessage == nil || serverLastMessageID == "" {
 		log.Debug().Msg("Not backfilling, no last message in database or no last message in metadata")
 		return
-	} else if !shouldBackfill(lastMessage.DiscordID, meta.LastMessageID) {
+	} else if !shouldBackfill(lastMessage.DiscordID, serverLastMessageID) {
 		log.Debug().
 			Str("last_bridged_message", lastMessage.DiscordID).
-			Str("last_server_message", meta.LastMessageID).
+			Str("last_server_message", serverLastMessageID).
 			Msg("Not backfilling, last message in database is newer than last message in metadata")
 		return
 	}
 	log.Debug().
 		Str("last_bridged_message", lastMessage.DiscordID).
-		Str("last_server_message", meta.LastMessageID).
+		Str("last_server_message", serverLastMessageID).
 		Msg("Backfilling missed messages")
 	if limit < 0 {
-		portal.backfillUnlimitedMissed(log, source, lastMessage.DiscordID)
+		portal.backfillUnlimitedMissed(log, source, lastMessage.DiscordID, thread)
 	} else {
-		portal.backfillLimited(log, source, limit, lastMessage.DiscordID)
+		portal.backfillLimited(log, source, limit, lastMessage.DiscordID, thread)
 	}
 }
 
 const messageFetchChunkSize = 50
 
-func (portal *Portal) collectBackfillMessages(log zerolog.Logger, source *User, limit int, until string) ([]*discordgo.Message, bool, error) {
+func (portal *Portal) collectBackfillMessages(log zerolog.Logger, source *User, limit int, until string, thread *Thread) ([]*discordgo.Message, bool, error) {
 	var messages []*discordgo.Message
 	var before string
 	var foundAll bool
+	protoChannelID := portal.Key.ChannelID
+	if thread != nil {
+		protoChannelID = thread.ID
+	}
 	for {
 		log.Debug().Str("before_id", before).Msg("Fetching messages for backfill")
-		newMessages, err := source.Session.ChannelMessages(portal.Key.ChannelID, messageFetchChunkSize, before, "", "")
+		newMessages, err := source.Session.ChannelMessages(protoChannelID, messageFetchChunkSize, before, "", "", portal.RefererOptIfUser(source.Session, protoChannelID)...)
 		if err != nil {
 			return nil, false, err
 		}
@@ -123,9 +148,12 @@ func (portal *Portal) collectBackfillMessages(log zerolog.Logger, source *User,
 	return messages, foundAll, nil
 }
 
-func (portal *Portal) backfillLimited(log zerolog.Logger, source *User, limit int, after string) {
-	messages, foundAll, err := portal.collectBackfillMessages(log, source, limit, after)
+func (portal *Portal) backfillLimited(log zerolog.Logger, source *User, limit int, after string, thread *Thread) {
+	messages, foundAll, err := portal.collectBackfillMessages(log, source, limit, after, thread)
 	if err != nil {
+		if source.handlePossible40002(err) {
+			panic(err)
+		}
 		log.Err(err).Msg("Error collecting messages to forward backfill")
 		return
 	}
@@ -145,13 +173,17 @@ func (portal *Portal) backfillLimited(log zerolog.Logger, source *User, limit in
 			log.Debug().Msg("Sent warning about possibly missed messages")
 		}
 	}
-	portal.sendBackfillBatch(log, source, messages)
+	portal.sendBackfillBatch(log, source, messages, thread)
 }
 
-func (portal *Portal) backfillUnlimitedMissed(log zerolog.Logger, source *User, after string) {
+func (portal *Portal) backfillUnlimitedMissed(log zerolog.Logger, source *User, after string, thread *Thread) {
+	protoChannelID := portal.Key.ChannelID
+	if thread != nil {
+		protoChannelID = thread.ID
+	}
 	for {
 		log.Debug().Str("after_id", after).Msg("Fetching chunk of messages to backfill")
-		messages, err := source.Session.ChannelMessages(portal.Key.ChannelID, messageFetchChunkSize, "", after, "")
+		messages, err := source.Session.ChannelMessages(protoChannelID, messageFetchChunkSize, "", after, "", portal.RefererOptIfUser(source.Session, protoChannelID)...)
 		if err != nil {
 			log.Err(err).Msg("Error fetching chunk of messages to forward backfill")
 			return
@@ -159,7 +191,7 @@ func (portal *Portal) backfillUnlimitedMissed(log zerolog.Logger, source *User,
 		log.Debug().Int("count", len(messages)).Msg("Fetched chunk of messages to backfill")
 		sort.Sort(MessageSlice(messages))
 
-		portal.sendBackfillBatch(log, source, messages)
+		portal.sendBackfillBatch(log, source, messages, thread)
 
 		if len(messages) < messageFetchChunkSize {
 			// Assume that was all the missing messages
@@ -170,28 +202,28 @@ func (portal *Portal) backfillUnlimitedMissed(log zerolog.Logger, source *User,
 	}
 }
 
-func (portal *Portal) sendBackfillBatch(log zerolog.Logger, source *User, messages []*discordgo.Message) {
-	if portal.bridge.Config.Homeserver.Software == bridgeconfig.SoftwareHungry {
+func (portal *Portal) sendBackfillBatch(log zerolog.Logger, source *User, messages []*discordgo.Message, thread *Thread) {
+	if portal.bridge.SpecVersions.Supports(mautrix.BeeperFeatureBatchSending) {
 		log.Debug().Msg("Using hungryserv, sending messages with batch send endpoint")
-		portal.forwardBatchSend(log, source, messages)
+		portal.forwardBatchSend(log, source, messages, thread)
 	} else {
 		log.Debug().Msg("Not using hungryserv, sending messages one by one")
 		for _, msg := range messages {
-			portal.handleDiscordMessageCreate(source, msg, nil)
+			portal.handleDiscordMessageCreate(source, msg, thread)
 		}
 	}
 }
 
-func (portal *Portal) forwardBatchSend(log zerolog.Logger, source *User, messages []*discordgo.Message) {
-	evts, dbMessages := portal.convertMessageBatch(log, source, messages)
+func (portal *Portal) forwardBatchSend(log zerolog.Logger, source *User, messages []*discordgo.Message, thread *Thread) {
+	evts, metas, dbMessages := portal.convertMessageBatch(log, source, messages, thread)
 	if len(evts) == 0 {
 		log.Warn().Msg("Didn't get any events to backfill")
 		return
 	}
 	log.Info().Int("events", len(evts)).Msg("Converted messages to backfill")
-	resp, err := portal.MainIntent().BatchSend(portal.MXID, &mautrix.ReqBatchSend{
-		BeeperNewMessages: true,
-		Events:            evts,
+	resp, err := portal.MainIntent().BeeperBatchSend(portal.MXID, &mautrix.ReqBeeperBatchSend{
+		Forward: true,
+		Events:  evts,
 	})
 	if err != nil {
 		log.Err(err).Msg("Error sending backfill batch")
@@ -199,25 +231,42 @@ func (portal *Portal) forwardBatchSend(log zerolog.Logger, source *User, message
 	}
 	for i, evtID := range resp.EventIDs {
 		dbMessages[i].MXID = evtID
+		if metas[i] != nil && metas[i].Flags == discordgo.MessageFlagsHasThread {
+			// TODO proper context
+			ctx := log.WithContext(context.Background())
+			portal.bridge.threadFound(ctx, source, &dbMessages[i], metas[i].ID, metas[i].Thread)
+		}
 	}
 	portal.bridge.DB.Message.MassInsert(portal.Key, dbMessages)
-	log.Info().Msg("Inserted backfilled batch to database")
 }
 
-func (portal *Portal) convertMessageBatch(log zerolog.Logger, source *User, messages []*discordgo.Message) ([]*event.Event, []database.Message) {
+func (portal *Portal) convertMessageBatch(log zerolog.Logger, source *User, messages []*discordgo.Message, thread *Thread) ([]*event.Event, []*discordgo.Message, []database.Message) {
+	var discordThreadID string
+	var threadRootEvent, lastThreadEvent id.EventID
+	if thread != nil {
+		discordThreadID = thread.ID
+		threadRootEvent = thread.RootMXID
+		lastThreadEvent = threadRootEvent
+		lastInThread := portal.bridge.DB.Message.GetLastInThread(portal.Key, thread.ID)
+		if lastInThread != nil {
+			lastThreadEvent = lastInThread.MXID
+		}
+	}
+
 	evts := make([]*event.Event, 0, len(messages))
 	dbMessages := make([]database.Message, 0, len(messages))
+	metas := make([]*discordgo.Message, 0, len(messages))
 	ctx := context.Background()
 	for _, msg := range messages {
 		for _, mention := range msg.Mentions {
 			puppet := portal.bridge.GetPuppetByID(mention.ID)
-			puppet.UpdateInfo(nil, mention, "")
+			puppet.UpdateInfo(nil, mention, nil)
 		}
 
 		puppet := portal.bridge.GetPuppetByID(msg.Author.ID)
-		puppet.UpdateInfo(source, msg.Author, msg.WebhookID)
+		puppet.UpdateInfo(source, msg.Author, msg)
 		intent := puppet.IntentFor(portal)
-		replyTo := portal.getReplyTarget(source, "", msg.MessageReference, msg.Embeds, true)
+		replyTo := portal.getReplyTarget(source, discordThreadID, msg.MessageReference, msg.Embeds, true)
 		mentions := portal.convertDiscordMentions(msg, false)
 
 		ts, _ := discordgo.SnowflakeTimestamp(msg.ID)
@@ -228,8 +277,14 @@ func (portal *Portal) convertMessageBatch(log zerolog.Logger, source *User, mess
 			Logger()
 		parts := portal.convertDiscordMessage(log.WithContext(ctx), puppet, intent, msg)
 		for i, part := range parts {
+			if (replyTo != nil || threadRootEvent != "") && part.Content.RelatesTo == nil {
+				part.Content.RelatesTo = &event.RelatesTo{}
+			}
+			if threadRootEvent != "" {
+				part.Content.RelatesTo.SetThread(threadRootEvent, lastThreadEvent)
+			}
 			if replyTo != nil {
-				part.Content.RelatesTo = &event.RelatesTo{InReplyTo: replyTo}
+				part.Content.RelatesTo.SetReplyTo(replyTo.EventID)
 				// Only set reply for first event
 				replyTo = nil
 			}
@@ -270,9 +325,15 @@ func (portal *Portal) convertMessageBatch(log zerolog.Logger, source *User, mess
 				AttachmentID: part.AttachmentID,
 				SenderMXID:   intent.UserID,
 			})
+			if i == 0 {
+				metas = append(metas, msg)
+			} else {
+				metas = append(metas, nil)
+			}
+			lastThreadEvent = evt.ID
 		}
 	}
-	return evts, dbMessages
+	return evts, metas, dbMessages
 }
 
 func (portal *Portal) deterministicEventID(messageID, partName string) id.EventID {

commands.go

@@ -62,6 +62,7 @@ func (br *DiscordBridge) RegisterCommands() {
 		cmdBridge,
 		cmdUnbridge,
 		cmdDeletePortal,
+		cmdCreatePortal,
 		cmdSetRelay,
 		cmdUnsetRelay,
 		cmdGuilds,
@@ -159,7 +160,7 @@ func fnLoginToken(ce *WrappedCommandEvent) {
 		ce.Reply("Error connecting to Discord: %v", err)
 		return
 	}
-	ce.Reply("Successfully logged in as %s#%s", ce.User.Session.State.User.Username, ce.User.Session.State.User.Discriminator)
+	ce.Reply("Successfully logged in as @%s", ce.User.Session.State.User.Username)
 }
 
 var cmdLoginQR = &commands.FullHandler{
@@ -228,7 +229,7 @@ func fnLoginQR(ce *WrappedCommandEvent) {
 	ce.User.DiscordID = user.UserID
 	ce.User.Update()
 	ce.User.Unlock()
-	ce.Reply("Successfully logged in as %s#%s", user.Username, user.Discriminator)
+	ce.Reply("Successfully logged in as @%s", user.Username)
 }
 
 func sendQRCode(ce *WrappedCommandEvent, code string) id.EventID {
@@ -238,9 +239,10 @@ func sendQRCode(ce *WrappedCommandEvent, code string) id.EventID {
 	}
 
 	content := event.MessageEventContent{
-		MsgType: event.MsgImage,
-		Body:    code,
-		URL:     url.CUString(),
+		MsgType:  event.MsgImage,
+		Body:     code,
+		FileName: "qr.png",
+		URL:      url.CUString(),
 	}
 
 	resp, err := ce.Bot.SendMessageEvent(ce.RoomID, event.EventMessage, &content)
@@ -308,7 +310,7 @@ func fnPing(ce *WrappedCommandEvent) {
 	} else if ce.User.wasDisconnected {
 		ce.Reply("You're logged in, but the Discord connection seems to be dead 💥")
 	} else {
-		ce.Reply("You're logged in as %s#%s (`%s`)", ce.User.Session.State.User.Username, ce.User.Session.State.User.Discriminator, ce.User.DiscordID)
+		ce.Reply("You're logged in as @%s (`%s`)", ce.User.Session.State.User.Username, ce.User.DiscordID)
 	}
 }
 
@@ -467,7 +469,7 @@ func fnSetRelay(ce *WrappedCommandEvent) {
 			return
 		}
 	case "create":
-		perms, err := ce.User.Session.UserChannelPermissions(ce.User.DiscordID, portal.Key.ChannelID)
+		perms, err := ce.User.Session.UserChannelPermissions(ce.User.DiscordID, portal.Key.ChannelID, portal.RefererOptIfUser(ce.User.Session, "")...)
 		if err != nil {
 			log.Warn().Err(err).Msg("Failed to check user permissions")
 			ce.Reply("Failed to check if you have permission to create webhooks")
@@ -482,7 +484,7 @@ func fnSetRelay(ce *WrappedCommandEvent) {
 			name = strings.Join(ce.Args[1:], " ")
 		}
 		log.Debug().Str("webhook_name", name).Msg("Creating webhook")
-		webhookMeta, err = ce.User.Session.WebhookCreate(portal.Key.ChannelID, name, "")
+		webhookMeta, err = ce.User.Session.WebhookCreate(portal.Key.ChannelID, name, "", portal.RefererOptIfUser(ce.User.Session, "")...)
 		if err != nil {
 			log.Warn().Err(err).Msg("Failed to create webhook")
 			ce.Reply("Failed to create webhook: %v", err)
@@ -757,7 +759,7 @@ func fnBridge(ce *WrappedCommandEvent) {
 	portal.updateRoomName()
 	portal.updateRoomAvatar()
 	portal.updateRoomTopic()
-	portal.updateSpace()
+	portal.updateSpace(ce.User)
 	portal.UpdateBridgeInfo()
 	state, err := portal.MainIntent().State(portal.MXID)
 	if err != nil {
@@ -785,6 +787,45 @@ var cmdUnbridge = &commands.FullHandler{
 	RequiresEventLevel: roomModerator,
 }
 
+var cmdCreatePortal = &commands.FullHandler{
+	Func: wrapCommand(fnCreatePortal),
+	Name: "create-portal",
+	Help: commands.HelpMeta{
+		Section:     HelpSectionPortalManagement,
+		Description: "Create a portal for a specific channel",
+		Args:        "<_channel ID_>",
+	},
+	RequiresLogin: true,
+}
+
+func fnCreatePortal(ce *WrappedCommandEvent) {
+	meta, err := ce.User.Session.Channel(ce.Args[0])
+	if err != nil {
+		ce.Reply("Failed to get channel info: %v", err)
+		return
+	} else if meta == nil {
+		ce.Reply("Channel not found")
+		return
+	} else if !ce.User.channelIsBridgeable(meta) {
+		ce.Reply("That channel can't be bridged")
+		return
+	}
+	portal := ce.User.GetPortalByMeta(meta)
+	if portal.Guild != nil && portal.Guild.BridgingMode == database.GuildBridgeNothing {
+		ce.Reply("That guild is set to not bridge any messages. Bridge the guild with `$cmdprefix guilds bridge %s` first", portal.Guild.ID)
+		return
+	} else if portal.MXID != "" {
+		ce.Reply("That channel is already bridged: [%s](%s)", portal.Name, portal.MXID.URI(portal.bridge.Config.Homeserver.Domain).MatrixToURL())
+		return
+	}
+	err = portal.CreateMatrixRoom(ce.User, meta)
+	if err != nil {
+		ce.Reply("Failed to create portal: %v", err)
+	} else {
+		ce.Reply("Portal created: [%s](%s)", portal.Name, portal.MXID.URI(portal.bridge.Config.Homeserver.Domain).MatrixToURL())
+	}
+}
+
 var cmdDeletePortal = &commands.FullHandler{
 	Func: wrapCommand(fnUnbridge),
 	Name: "delete-portal",

commands_botinteraction.go

@@ -61,7 +61,7 @@ func (portal *Portal) getCommand(user *User, command string) (*discordgo.Applica
 	defer portal.commandsLock.Unlock()
 	cmd, ok := portal.commands[command]
 	if !ok {
-		results, err := user.Session.ApplicationCommandsSearch(portal.Key.ChannelID, command)
+		results, err := user.Session.ApplicationCommandsSearch(portal.Key.ChannelID, command, portal.RefererOpt(""))
 		if err != nil {
 			return nil, err
 		}
@@ -247,7 +247,7 @@ func fnCommands(ce *WrappedCommandEvent) {
 	}
 	subcmd := strings.ToLower(ce.Args[0])
 	if subcmd == "search" {
-		results, err := ce.User.Session.ApplicationCommandsSearch(ce.Portal.Key.ChannelID, ce.Args[1])
+		results, err := ce.User.Session.ApplicationCommandsSearch(ce.Portal.Key.ChannelID, ce.Args[1], ce.Portal.RefererOpt(""))
 		if err != nil {
 			ce.Reply("Error searching for commands: %v", err)
 			return
@@ -297,7 +297,7 @@ func fnExec(ce *WrappedCommandEvent) {
 		ce.User.pendingInteractionsLock.Lock()
 		ce.User.pendingInteractions[nonce] = ce
 		ce.User.pendingInteractionsLock.Unlock()
-		err = ce.User.Session.SendInteractions(ce.Portal.GuildID, ce.Portal.Key.ChannelID, cmd, options, nonce)
+		err = ce.User.Session.SendInteractions(ce.Portal.GuildID, ce.Portal.Key.ChannelID, cmd, options, nonce, ce.Portal.RefererOpt(""))
 		if err != nil {
 			ce.Reply("Error sending interaction: %v", err)
 			ce.User.pendingInteractionsLock.Lock()

config/bridge.go

@@ -25,7 +25,6 @@ import (
 	"github.com/bwmarrin/discordgo"
 
 	"maunium.net/go/mautrix/bridge/bridgeconfig"
-	"maunium.net/go/mautrix/id"
 )
 
 type BridgeConfig struct {
@@ -38,6 +37,9 @@ type BridgeConfig struct {
 
 	PortalMessageBuffer int `yaml:"portal_message_buffer"`
 
+	PublicAddress  string `yaml:"public_address"`
+	AvatarProxyKey string `yaml:"avatar_proxy_key"`
+
 	DeliveryReceipts            bool `yaml:"delivery_receipts"`
 	MessageStatusEvents         bool `yaml:"message_status_events"`
 	MessageErrorNotices         bool `yaml:"message_error_notices"`
@@ -55,8 +57,10 @@ type BridgeConfig struct {
 	EnableWebhookAvatars        bool `yaml:"enable_webhook_avatars"`
 	UseDiscordCDNUpload         bool `yaml:"use_discord_cdn_upload"`
 
-	CacheMedia    string        `yaml:"cache_media"`
-	MediaPatterns MediaPatterns `yaml:"media_patterns"`
+	Proxy string `yaml:"proxy"`
+
+	CacheMedia  string      `yaml:"cache_media"`
+	DirectMedia DirectMedia `yaml:"direct_media"`
 
 	AnimatedSticker struct {
 		Target string `yaml:"target"`
@@ -67,9 +71,7 @@ type BridgeConfig struct {
 		} `yaml:"args"`
 	} `yaml:"animated_sticker"`
 
-	DoublePuppetServerMap      map[string]string `yaml:"double_puppet_server_map"`
-	DoublePuppetAllowDiscovery bool              `yaml:"double_puppet_allow_discovery"`
-	LoginSharedSecretMap       map[string]string `yaml:"login_shared_secret_map"`
+	DoublePuppetConfig bridgeconfig.DoublePuppetConfig `yaml:",inline"`
 
 	CommandPrefix      string                           `yaml:"command_prefix"`
 	ManagementRoomText bridgeconfig.ManagementRoomTexts `yaml:"management_room_text"`
@@ -85,8 +87,9 @@ type BridgeConfig struct {
 	Encryption bridgeconfig.EncryptionConfig `yaml:"encryption"`
 
 	Provisioning struct {
-		Prefix       string `yaml:"prefix"`
-		SharedSecret string `yaml:"shared_secret"`
+		Prefix         string `yaml:"prefix"`
+		SharedSecret   string `yaml:"shared_secret"`
+		DebugEndpoints bool   `yaml:"debug_endpoints"`
 	} `yaml:"provisioning"`
 
 	Permissions bridgeconfig.PermissionConfig `yaml:"permissions"`
@@ -97,116 +100,18 @@ type BridgeConfig struct {
 	guildNameTemplate   *template.Template `yaml:"-"`
 }
 
-type MediaPatterns struct {
-	Enabled        bool   `yaml:"enabled"`
-	TplAttachments string `yaml:"attachments"`
-	TplEmojis      string `yaml:"emojis"`
-	TplStickers    string `yaml:"stickers"`
-	TplAvatars     string `yaml:"avatars"`
-
-	attachments *template.Template `yaml:"-"`
-	emojis      *template.Template `yaml:"-"`
-	stickers    *template.Template `yaml:"-"`
-	avatars     *template.Template `yaml:"-"`
-}
-
-type umMediaPatterns MediaPatterns
-
-func (mp *MediaPatterns) UnmarshalYAML(unmarshal func(interface{}) error) error {
-	err := unmarshal((*umMediaPatterns)(mp))
-	if err != nil {
-		return err
-	}
-	tpl := template.New("media_patterns")
-
-	pairs := []struct {
-		ptr      **template.Template
-		name     string
-		template string
-	}{
-		{&mp.attachments, "attachments", mp.TplAttachments},
-		{&mp.emojis, "emojis", mp.TplEmojis},
-		{&mp.stickers, "stickers", mp.TplStickers},
-		{&mp.avatars, "avatars", mp.TplAvatars},
-	}
-	for _, pair := range pairs {
-		if pair.template == "" {
-			continue
-		}
-		*pair.ptr, err = tpl.New(pair.name).Parse(pair.template)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-type attachmentParams struct {
-	ChannelID    string
-	AttachmentID string
-	FileName     string
-}
-
-type emojiStickerParams struct {
-	ID  string
-	Ext string
-}
-
-type avatarParams struct {
-	UserID   string
-	AvatarID string
-	Ext      string
-}
-
-func (mp *MediaPatterns) execute(tpl *template.Template, params any) id.ContentURI {
-	if tpl == nil || !mp.Enabled {
-		return id.ContentURI{}
-	}
-	var out strings.Builder
-	err := tpl.Execute(&out, params)
-	if err != nil {
-		panic(err)
-	}
-	uri, err := id.ParseContentURI(out.String())
-	if err != nil {
-		panic(err)
-	}
-	return uri
-}
-
-func (mp *MediaPatterns) Attachment(channelID, attachmentID, filename string) id.ContentURI {
-	return mp.execute(mp.attachments, attachmentParams{
-		ChannelID:    channelID,
-		AttachmentID: attachmentID,
-		FileName:     filename,
-	})
-}
-
-func (mp *MediaPatterns) Emoji(emojiID, ext string) id.ContentURI {
-	return mp.execute(mp.emojis, emojiStickerParams{
-		ID:  emojiID,
-		Ext: ext,
-	})
-}
-
-func (mp *MediaPatterns) Sticker(stickerID, ext string) id.ContentURI {
-	return mp.execute(mp.stickers, emojiStickerParams{
-		ID:  stickerID,
-		Ext: ext,
-	})
-}
-
-func (mp *MediaPatterns) Avatar(userID, avatarID, ext string) id.ContentURI {
-	return mp.execute(mp.avatars, avatarParams{
-		UserID:   userID,
-		AvatarID: avatarID,
-		Ext:      ext,
-	})
+type DirectMedia struct {
+	Enabled           bool   `yaml:"enabled"`
+	ServerName        string `yaml:"server_name"`
+	WellKnownResponse string `yaml:"well_known_response"`
+	AllowProxy        bool   `yaml:"allow_proxy"`
+	ServerKey         string `yaml:"server_key"`
 }
 
 type BackfillLimitPart struct {
 	DM      int `yaml:"dm"`
 	Channel int `yaml:"channel"`
+	Thread  int `yaml:"thread"`
 }
 
 func (bc *BridgeConfig) GetResendBridgeInfo() bool {
@@ -271,6 +176,10 @@ func (bc *BridgeConfig) UnmarshalYAML(unmarshal func(interface{}) error) error {
 
 var _ bridgeconfig.BridgeConfig = (*BridgeConfig)(nil)
 
+func (bc BridgeConfig) GetDoublePuppetConfig() bridgeconfig.DoublePuppetConfig {
+	return bc.DoublePuppetConfig
+}
+
 func (bc BridgeConfig) GetEncryptionConfig() bridgeconfig.EncryptionConfig {
 	return bc.Encryption
 }
@@ -291,12 +200,17 @@ func (bc BridgeConfig) FormatUsername(userID string) string {
 
 type DisplaynameParams struct {
 	*discordgo.User
-	Webhook bool
+	Webhook     bool
+	Application bool
 }
 
-func (bc BridgeConfig) FormatDisplayname(user *discordgo.User, webhook bool) string {
+func (bc BridgeConfig) FormatDisplayname(user *discordgo.User, webhook, application bool) string {
 	var buffer strings.Builder
-	_ = bc.displaynameTemplate.Execute(&buffer, &DisplaynameParams{user, webhook})
+	_ = bc.displaynameTemplate.Execute(&buffer, &DisplaynameParams{
+		User:        user,
+		Webhook:     webhook,
+		Application: application,
+	})
 	return buffer.String()
 }
 

config/config.go

@@ -29,7 +29,7 @@ type Config struct {
 
 func (config *Config) CanAutoDoublePuppet(userID id.UserID) bool {
 	_, homeserver, _ := userID.Parse()
-	_, hasSecret := config.Bridge.LoginSharedSecretMap[homeserver]
+	_, hasSecret := config.Bridge.DoublePuppetConfig.SharedSecretMap[homeserver]
 
 	return hasSecret
 }

config/upgrade.go

@@ -17,16 +17,15 @@
 package config
 
 import (
+	up "go.mau.fi/util/configupgrade"
+	"go.mau.fi/util/random"
 	"maunium.net/go/mautrix/bridge/bridgeconfig"
-	"maunium.net/go/mautrix/util"
-	up "maunium.net/go/mautrix/util/configupgrade"
+	"maunium.net/go/mautrix/federation"
 )
 
 func DoUpgrade(helper *up.Helper) {
 	bridgeconfig.Upgrader.DoUpgrade(helper)
 
-	helper.Copy(up.Str|up.Null, "homeserver", "public_address")
-
 	helper.Copy(up.Str, "bridge", "username_template")
 	helper.Copy(up.Str, "bridge", "displayname_template")
 	helper.Copy(up.Str, "bridge", "channel_name_template")
@@ -41,6 +40,12 @@ func DoUpgrade(helper *up.Helper) {
 		helper.Copy(up.Str, "bridge", "private_chat_portal_meta")
 	}
 	helper.Copy(up.Int, "bridge", "startup_private_channel_create_limit")
+	helper.Copy(up.Str|up.Null, "bridge", "public_address")
+	if apkey, ok := helper.Get(up.Str, "bridge", "avatar_proxy_key"); !ok || apkey == "generate" {
+		helper.Set(up.Str, random.String(32), "bridge", "avatar_proxy_key")
+	} else {
+		helper.Copy(up.Str, "bridge", "avatar_proxy_key")
+	}
 	helper.Copy(up.Int, "bridge", "portal_message_buffer")
 	helper.Copy(up.Bool, "bridge", "delivery_receipts")
 	helper.Copy(up.Bool, "bridge", "message_status_events")
@@ -58,12 +63,18 @@ func DoUpgrade(helper *up.Helper) {
 	helper.Copy(up.Bool, "bridge", "prefix_webhook_messages")
 	helper.Copy(up.Bool, "bridge", "enable_webhook_avatars")
 	helper.Copy(up.Bool, "bridge", "use_discord_cdn_upload")
-	helper.Copy(up.Bool, "bridge", "media_patterns", "enabled")
+	helper.Copy(up.Str|up.Null, "bridge", "proxy")
 	helper.Copy(up.Str, "bridge", "cache_media")
-	helper.Copy(up.Str|up.Null, "bridge", "media_patterns", "attachments")
-	helper.Copy(up.Str|up.Null, "bridge", "media_patterns", "emojis")
-	helper.Copy(up.Str|up.Null, "bridge", "media_patterns", "stickers")
-	helper.Copy(up.Str|up.Null, "bridge", "media_patterns", "avatars")
+	helper.Copy(up.Bool, "bridge", "direct_media", "enabled")
+	helper.Copy(up.Str, "bridge", "direct_media", "server_name")
+	helper.Copy(up.Str|up.Null, "bridge", "direct_media", "well_known_response")
+	helper.Copy(up.Bool, "bridge", "direct_media", "allow_proxy")
+	if serverKey, ok := helper.Get(up.Str, "bridge", "direct_media", "server_key"); !ok || serverKey == "generate" {
+		serverKey = federation.GenerateSigningKey().SynapseString()
+		helper.Set(up.Str, serverKey, "bridge", "direct_media", "server_key")
+	} else {
+		helper.Copy(up.Str, "bridge", "direct_media", "server_key")
+	}
 	helper.Copy(up.Str, "bridge", "animated_sticker", "target")
 	helper.Copy(up.Int, "bridge", "animated_sticker", "args", "width")
 	helper.Copy(up.Int, "bridge", "animated_sticker", "args", "height")
@@ -79,13 +90,16 @@ func DoUpgrade(helper *up.Helper) {
 	helper.Copy(up.Bool, "bridge", "backfill", "enabled")
 	helper.Copy(up.Int, "bridge", "backfill", "forward_limits", "initial", "dm")
 	helper.Copy(up.Int, "bridge", "backfill", "forward_limits", "initial", "channel")
+	helper.Copy(up.Int, "bridge", "backfill", "forward_limits", "initial", "thread")
 	helper.Copy(up.Int, "bridge", "backfill", "forward_limits", "missed", "dm")
 	helper.Copy(up.Int, "bridge", "backfill", "forward_limits", "missed", "channel")
+	helper.Copy(up.Int, "bridge", "backfill", "forward_limits", "missed", "thread")
 	helper.Copy(up.Int, "bridge", "backfill", "max_guild_members")
 	helper.Copy(up.Bool, "bridge", "encryption", "allow")
 	helper.Copy(up.Bool, "bridge", "encryption", "default")
 	helper.Copy(up.Bool, "bridge", "encryption", "require")
 	helper.Copy(up.Bool, "bridge", "encryption", "appservice")
+	helper.Copy(up.Bool, "bridge", "encryption", "msc4190")
 	helper.Copy(up.Bool, "bridge", "encryption", "allow_key_sharing")
 	helper.Copy(up.Bool, "bridge", "encryption", "plaintext_mentions")
 	helper.Copy(up.Bool, "bridge", "encryption", "delete_keys", "delete_outbound_on_ack")
@@ -95,6 +109,7 @@ func DoUpgrade(helper *up.Helper) {
 	helper.Copy(up.Bool, "bridge", "encryption", "delete_keys", "delete_prev_on_new_session")
 	helper.Copy(up.Bool, "bridge", "encryption", "delete_keys", "delete_on_device_delete")
 	helper.Copy(up.Bool, "bridge", "encryption", "delete_keys", "periodically_delete_expired")
+	helper.Copy(up.Bool, "bridge", "encryption", "delete_keys", "delete_outdated_inbound")
 	helper.Copy(up.Str, "bridge", "encryption", "verification_levels", "receive")
 	helper.Copy(up.Str, "bridge", "encryption", "verification_levels", "send")
 	helper.Copy(up.Str, "bridge", "encryption", "verification_levels", "share")
@@ -105,11 +120,12 @@ func DoUpgrade(helper *up.Helper) {
 
 	helper.Copy(up.Str, "bridge", "provisioning", "prefix")
 	if secret, ok := helper.Get(up.Str, "bridge", "provisioning", "shared_secret"); !ok || secret == "generate" {
-		sharedSecret := util.RandomString(64)
+		sharedSecret := random.String(64)
 		helper.Set(up.Str, sharedSecret, "bridge", "provisioning", "shared_secret")
 	} else {
 		helper.Copy(up.Str, "bridge", "provisioning", "shared_secret")
 	}
+	helper.Copy(up.Bool, "bridge", "provisioning", "debug_endpoints")
 
 	helper.Copy(up.Map, "bridge", "permissions")
 	//helper.Copy(up.Bool, "bridge", "relay", "enabled")

custompuppet.go

@@ -1,170 +1,72 @@
 package main
 
 import (
-	"crypto/hmac"
-	"crypto/sha512"
-	"encoding/hex"
-	"errors"
-	"fmt"
-
-	"maunium.net/go/mautrix"
-	"maunium.net/go/mautrix/appservice"
 	"maunium.net/go/mautrix/id"
 )
 
-var (
-	ErrNoCustomMXID    = errors.New("no custom mxid set")
-	ErrMismatchingMXID = errors.New("whoami result does not match custom mxid")
-)
-
-func (br *DiscordBridge) newDoublePuppetClient(mxid id.UserID, accessToken string) (*mautrix.Client, error) {
-	_, homeserver, err := mxid.Parse()
-	if err != nil {
-		return nil, err
-	}
-
-	homeserverURL, found := br.Config.Bridge.DoublePuppetServerMap[homeserver]
-	if !found {
-		if homeserver == br.AS.HomeserverDomain {
-			homeserverURL = ""
-		} else if br.Config.Bridge.DoublePuppetAllowDiscovery {
-			resp, err := mautrix.DiscoverClientAPI(homeserver)
-			if err != nil {
-				return nil, fmt.Errorf("failed to find homeserver URL for %s: %v", homeserver, err)
-			}
-
-			homeserverURL = resp.Homeserver.BaseURL
-			br.Log.Debugfln("Discovered URL %s for %s to enable double puppeting for %s", homeserverURL, homeserver, mxid)
-		} else {
-			return nil, fmt.Errorf("double puppeting from %s is not allowed", homeserver)
-		}
-	}
-
-	return br.AS.NewExternalMautrixClient(mxid, accessToken, homeserverURL)
-}
-
-func (puppet *Puppet) clearCustomMXID() {
-	puppet.CustomMXID = ""
-	puppet.AccessToken = ""
-	puppet.customIntent = nil
-	puppet.customUser = nil
-}
-
-func (puppet *Puppet) newCustomIntent() (*appservice.IntentAPI, error) {
-	if puppet.CustomMXID == "" {
-		return nil, ErrNoCustomMXID
-	}
-
-	client, err := puppet.bridge.newDoublePuppetClient(puppet.CustomMXID, puppet.AccessToken)
-	if err != nil {
-		return nil, err
-	}
-
-	ia := puppet.bridge.AS.NewIntentAPI("custom")
-	ia.Client = client
-	ia.Localpart, _, _ = puppet.CustomMXID.Parse()
-	ia.UserID = puppet.CustomMXID
-	ia.IsCustomPuppet = true
-	return ia, nil
-}
-
-func (puppet *Puppet) StartCustomMXID(reloginOnFail bool) error {
-	if puppet.CustomMXID == "" {
-		puppet.clearCustomMXID()
-		return nil
-	}
-
-	intent, err := puppet.newCustomIntent()
-	if err != nil {
-		puppet.clearCustomMXID()
-		return err
-	}
-
-	resp, err := intent.Whoami()
-	if err != nil {
-		if !reloginOnFail || (errors.Is(err, mautrix.MUnknownToken) && !puppet.tryRelogin(err, "initializing double puppeting")) {
-			puppet.clearCustomMXID()
-			return err
-		}
-
-		intent.AccessToken = puppet.AccessToken
-	} else if resp.UserID != puppet.CustomMXID {
-		puppet.clearCustomMXID()
-		return ErrMismatchingMXID
-	}
-
-	puppet.customIntent = intent
-	puppet.customUser = puppet.bridge.GetUserByMXID(puppet.CustomMXID)
-	return nil
-}
-
-func (puppet *Puppet) tryRelogin(cause error, action string) bool {
-	if !puppet.bridge.Config.CanAutoDoublePuppet(puppet.CustomMXID) {
-		return false
-	}
-	log := puppet.log.With().
-		AnErr("cause_error", cause).
-		Str("while_action", action).
-		Logger()
-	log.Debug().Msg("Trying to relogin")
-	accessToken, err := puppet.loginWithSharedSecret(puppet.CustomMXID)
-	if err != nil {
-		log.Error().Err(err).Msg("Failed to relogin")
-		return false
-	}
-	log.Info().Msg("Successfully relogined")
-	puppet.AccessToken = accessToken
-	puppet.Update()
-	return true
-}
-
-func (puppet *Puppet) loginWithSharedSecret(mxid id.UserID) (string, error) {
-	_, homeserver, _ := mxid.Parse()
-	puppet.log.Debug().Str("user_id", mxid.String()).Msg("Logging into double puppet target with shared secret")
-	loginSecret := puppet.bridge.Config.Bridge.LoginSharedSecretMap[homeserver]
-	client, err := puppet.bridge.newDoublePuppetClient(mxid, "")
-	if err != nil {
-		return "", fmt.Errorf("failed to create mautrix client to log in: %v", err)
-	}
-	req := mautrix.ReqLogin{
-		Identifier:               mautrix.UserIdentifier{Type: mautrix.IdentifierTypeUser, User: string(mxid)},
-		DeviceID:                 "Discord Bridge",
-		InitialDeviceDisplayName: "Discord Bridge",
-	}
-	if loginSecret == "appservice" {
-		client.AccessToken = puppet.bridge.AS.Registration.AppToken
-		req.Type = mautrix.AuthTypeAppservice
-	} else {
-		mac := hmac.New(sha512.New, []byte(loginSecret))
-		mac.Write([]byte(mxid))
-		req.Password = hex.EncodeToString(mac.Sum(nil))
-		req.Type = mautrix.AuthTypePassword
-	}
-	resp, err := client.Login(&req)
-	if err != nil {
-		return "", err
-	}
-	return resp.AccessToken, nil
-}
-
 func (puppet *Puppet) SwitchCustomMXID(accessToken string, mxid id.UserID) error {
-	prevCustomMXID := puppet.CustomMXID
 	puppet.CustomMXID = mxid
 	puppet.AccessToken = accessToken
-
+	puppet.Update()
 	err := puppet.StartCustomMXID(false)
 	if err != nil {
 		return err
 	}
-
-	if prevCustomMXID != "" {
-		delete(puppet.bridge.puppetsByCustomMXID, prevCustomMXID)
-	}
-	if puppet.CustomMXID != "" {
-		puppet.bridge.puppetsByCustomMXID[puppet.CustomMXID] = puppet
-	}
-	puppet.bridge.AS.StateStore.MarkRegistered(puppet.CustomMXID)
-	puppet.Update()
 	// TODO leave rooms with default puppet
 	return nil
 }
+
+func (puppet *Puppet) ClearCustomMXID() {
+	save := puppet.CustomMXID != "" || puppet.AccessToken != ""
+	puppet.bridge.puppetsLock.Lock()
+	if puppet.CustomMXID != "" && puppet.bridge.puppetsByCustomMXID[puppet.CustomMXID] == puppet {
+		delete(puppet.bridge.puppetsByCustomMXID, puppet.CustomMXID)
+	}
+	puppet.bridge.puppetsLock.Unlock()
+	puppet.CustomMXID = ""
+	puppet.AccessToken = ""
+	puppet.customIntent = nil
+	puppet.customUser = nil
+	if save {
+		puppet.Update()
+	}
+}
+
+func (puppet *Puppet) StartCustomMXID(reloginOnFail bool) error {
+	newIntent, newAccessToken, err := puppet.bridge.DoublePuppet.Setup(puppet.CustomMXID, puppet.AccessToken, reloginOnFail)
+	if err != nil {
+		puppet.ClearCustomMXID()
+		return err
+	}
+	puppet.bridge.puppetsLock.Lock()
+	puppet.bridge.puppetsByCustomMXID[puppet.CustomMXID] = puppet
+	puppet.bridge.puppetsLock.Unlock()
+	if puppet.AccessToken != newAccessToken {
+		puppet.AccessToken = newAccessToken
+		puppet.Update()
+	}
+	puppet.customIntent = newIntent
+	puppet.customUser = puppet.bridge.GetUserByMXID(puppet.CustomMXID)
+	return nil
+}
+
+func (user *User) tryAutomaticDoublePuppeting() {
+	if !user.bridge.Config.CanAutoDoublePuppet(user.MXID) {
+		return
+	}
+	user.log.Debug().Msg("Checking if double puppeting needs to be enabled")
+	puppet := user.bridge.GetPuppetByID(user.DiscordID)
+	if len(puppet.CustomMXID) > 0 {
+		user.log.Debug().Msg("User already has double-puppeting enabled")
+		// Custom puppet already enabled
+		return
+	}
+	puppet.CustomMXID = user.MXID
+	err := puppet.StartCustomMXID(true)
+	if err != nil {
+		user.log.Warn().Err(err).Msg("Failed to login with shared secret")
+	} else {
+		// TODO leave rooms with default puppet
+		user.log.Debug().Msg("Successfully automatically enabled custom puppet")
+	}
+}

database/database.go

@@ -5,10 +5,9 @@ import (
 
 	_ "github.com/lib/pq"
 	_ "github.com/mattn/go-sqlite3"
+	"go.mau.fi/util/dbutil"
 	"maunium.net/go/maulogger/v2"
 
-	"maunium.net/go/mautrix/util/dbutil"
-
 	"go.mau.fi/mautrix-discord/database/upgrades"
 )
 

database/file.go

@@ -6,11 +6,10 @@ import (
 	"errors"
 	"time"
 
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
-
 	"maunium.net/go/mautrix/crypto/attachment"
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util/dbutil"
 )
 
 type FileQuery struct {

database/guild.go

@@ -6,10 +6,9 @@ import (
 	"fmt"
 	"strings"
 
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
 	"maunium.net/go/mautrix/id"
-
-	"maunium.net/go/mautrix/util/dbutil"
 )
 
 type GuildBridgingMode int

database/message.go

@@ -7,10 +7,9 @@ import (
 	"strings"
 	"time"
 
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
-
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util/dbutil"
 )
 
 type MessageQuery struct {
@@ -108,7 +107,7 @@ func (mq *MessageQuery) MassInsert(key PortalKey, msgs []Message) {
 	params[0] = key.ChannelID
 	params[1] = key.Receiver
 	for i, msg := range msgs {
-		baseIndex := 2 + i*7
+		baseIndex := 2 + i*8
 		params[baseIndex] = msg.DiscordID
 		params[baseIndex+1] = msg.AttachmentID
 		params[baseIndex+2] = msg.SenderID

database/portal.go

@@ -4,11 +4,9 @@ import (
 	"database/sql"
 
 	"github.com/bwmarrin/discordgo"
-
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
-
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util/dbutil"
 )
 
 // language=postgresql

database/puppet.go

@@ -3,15 +3,14 @@ package database
 import (
 	"database/sql"
 
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
-
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util/dbutil"
 )
 
 const (
 	puppetSelect = "SELECT id, name, name_set, avatar, avatar_url, avatar_set," +
-		" contact_info_set, global_name, username, discriminator, is_bot, is_webhook, custom_mxid, access_token, next_batch" +
+		" contact_info_set, global_name, username, discriminator, is_bot, is_webhook, is_application, custom_mxid, access_token, next_batch" +
 		" FROM puppet "
 )
 
@@ -80,6 +79,7 @@ type Puppet struct {
 	Discriminator string
 	IsBot         bool
 	IsWebhook     bool
+	IsApplication bool
 
 	CustomMXID  id.UserID
 	AccessToken string
@@ -91,7 +91,7 @@ func (p *Puppet) Scan(row dbutil.Scannable) *Puppet {
 	var customMXID, accessToken, nextBatch sql.NullString
 
 	err := row.Scan(&p.ID, &p.Name, &p.NameSet, &p.Avatar, &avatarURL, &p.AvatarSet, &p.ContactInfoSet,
-		&p.GlobalName, &p.Username, &p.Discriminator, &p.IsBot, &p.IsWebhook, &customMXID, &accessToken, &nextBatch)
+		&p.GlobalName, &p.Username, &p.Discriminator, &p.IsBot, &p.IsWebhook, &p.IsApplication, &customMXID, &accessToken, &nextBatch)
 
 	if err != nil {
 		if err != sql.ErrNoRows {
@@ -114,13 +114,13 @@ func (p *Puppet) Insert() {
 	query := `
 		INSERT INTO puppet (
 			id, name, name_set, avatar, avatar_url, avatar_set, contact_info_set,
-			global_name, username, discriminator, is_bot, is_webhook,
+			global_name, username, discriminator, is_bot, is_webhook, is_application,
 			custom_mxid, access_token, next_batch
 		)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
 	`
 	_, err := p.db.Exec(query, p.ID, p.Name, p.NameSet, p.Avatar, p.AvatarURL.String(), p.AvatarSet, p.ContactInfoSet,
-		p.GlobalName, p.Username, p.Discriminator, p.IsBot, p.IsWebhook,
+		p.GlobalName, p.Username, p.Discriminator, p.IsBot, p.IsWebhook, p.IsApplication,
 		strPtr(p.CustomMXID), strPtr(p.AccessToken), strPtr(p.NextBatch))
 
 	if err != nil {
@@ -132,14 +132,14 @@ func (p *Puppet) Insert() {
 func (p *Puppet) Update() {
 	query := `
 		UPDATE puppet SET name=$1, name_set=$2, avatar=$3, avatar_url=$4, avatar_set=$5, contact_info_set=$6,
-		                  global_name=$7, username=$8, discriminator=$9, is_bot=$10, is_webhook=$11,
-		                  custom_mxid=$12, access_token=$13, next_batch=$14
-		WHERE id=$15
+		                  global_name=$7, username=$8, discriminator=$9, is_bot=$10, is_webhook=$11, is_application=$12,
+		                  custom_mxid=$13, access_token=$14, next_batch=$15
+		WHERE id=$16
 	`
 	_, err := p.db.Exec(
 		query,
 		p.Name, p.NameSet, p.Avatar, p.AvatarURL.String(), p.AvatarSet, p.ContactInfoSet,
-		p.GlobalName, p.Username, p.Discriminator, p.IsBot, p.IsWebhook,
+		p.GlobalName, p.Username, p.Discriminator, p.IsBot, p.IsWebhook, p.IsApplication,
 		strPtr(p.CustomMXID), strPtr(p.AccessToken), strPtr(p.NextBatch),
 		p.ID,
 	)

database/reaction.go

@@ -4,10 +4,9 @@ import (
 	"database/sql"
 	"errors"
 
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
-
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util/dbutil"
 )
 
 type ReactionQuery struct {

database/role.go

@@ -4,11 +4,9 @@ import (
 	"database/sql"
 	"errors"
 
-	log "maunium.net/go/maulogger/v2"
-
-	"maunium.net/go/mautrix/util/dbutil"
-
 	"github.com/bwmarrin/discordgo"
+	"go.mau.fi/util/dbutil"
+	log "maunium.net/go/maulogger/v2"
 )
 
 type RoleQuery struct {

database/thread.go

@@ -4,10 +4,9 @@ import (
 	"database/sql"
 	"errors"
 
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
-
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util/dbutil"
 )
 
 type ThreadQuery struct {

database/upgrades/00-latest-revision.sql

@@ -1,4 +1,4 @@
--- v0 -> v22 (compatible with v19+): Latest revision
+-- v0 -> v23 (compatible with v19+): Latest revision
 
 CREATE TABLE guild (
     dcid       TEXT PRIMARY KEY,
@@ -71,11 +71,12 @@ CREATE TABLE puppet (
 
     contact_info_set BOOLEAN NOT NULL DEFAULT false,
 
-    global_name   TEXT NOT NULL DEFAULT '',
-    username      TEXT NOT NULL DEFAULT '',
-    discriminator TEXT NOT NULL DEFAULT '',
-    is_bot        BOOLEAN NOT NULL DEFAULT false,
-    is_webhook    BOOLEAN NOT NULL DEFAULT false,
+    global_name    TEXT NOT NULL DEFAULT '',
+    username       TEXT NOT NULL DEFAULT '',
+    discriminator  TEXT NOT NULL DEFAULT '',
+    is_bot         BOOLEAN NOT NULL DEFAULT false,
+    is_webhook     BOOLEAN NOT NULL DEFAULT false,
+    is_application BOOLEAN NOT NULL DEFAULT false,
 
     custom_mxid  TEXT,
     access_token TEXT,

database/upgrades/23-puppet-is-application.sql

@@ -0,0 +1,2 @@
+-- v23 (compatible with v19+): Store is application status for puppets
+ALTER TABLE puppet ADD COLUMN is_application BOOLEAN NOT NULL DEFAULT false;

database/upgrades/upgrades.go

@@ -19,7 +19,7 @@ package upgrades
 import (
 	"embed"
 
-	"maunium.net/go/mautrix/util/dbutil"
+	"go.mau.fi/util/dbutil"
 )
 
 var Table dbutil.UpgradeTable

database/user.go

@@ -3,10 +3,9 @@ package database
 import (
 	"database/sql"
 
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
-
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util/dbutil"
 )
 
 type UserQuery struct {

database/userportal.go

@@ -5,8 +5,9 @@ import (
 	"errors"
 	"time"
 
+	"go.mau.fi/util/dbutil"
 	log "maunium.net/go/maulogger/v2"
-	"maunium.net/go/mautrix/util/dbutil"
+	"maunium.net/go/mautrix/id"
 )
 
 const (
@@ -44,6 +45,24 @@ func (u *User) scanUserPortals(rows dbutil.Rows) []UserPortal {
 	return ups
 }
 
+func (db *Database) GetUsersInPortal(channelID string) []id.UserID {
+	rows, err := db.Query("SELECT user_mxid FROM user_portal WHERE discord_id=$1", channelID)
+	if err != nil {
+		db.Portal.log.Errorln("Failed to get users in portal:", err)
+	}
+	var users []id.UserID
+	for rows.Next() {
+		var mxid id.UserID
+		err = rows.Scan(&mxid)
+		if err != nil {
+			db.Portal.log.Errorln("Failed to scan user in portal:", err)
+		} else {
+			users = append(users, mxid)
+		}
+	}
+	return users
+}
+
 func (u *User) GetPortals() []UserPortal {
 	rows, err := u.db.Query("SELECT discord_id, type, timestamp, in_space FROM user_portal WHERE user_mxid=$1", u.MXID)
 	if err != nil {

directmedia.go

@@ -0,0 +1,662 @@
+// mautrix-discord - A Matrix-Discord puppeting bridge.
+// Copyright (C) 2024 Tulir Asokan
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/binary"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
+	"net"
+	"net/http"
+	"net/textproto"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/bwmarrin/discordgo"
+	"github.com/gorilla/mux"
+	"github.com/rs/zerolog"
+	"maunium.net/go/mautrix"
+	"maunium.net/go/mautrix/federation"
+	"maunium.net/go/mautrix/id"
+
+	"go.mau.fi/mautrix-discord/config"
+	"go.mau.fi/mautrix-discord/database"
+)
+
+type DirectMediaAPI struct {
+	bridge *DiscordBridge
+	ks     *federation.KeyServer
+	cfg    config.DirectMedia
+	log    zerolog.Logger
+	proxy  http.Client
+
+	signatureKey [32]byte
+
+	attachmentCache     map[AttachmentCacheKey]AttachmentCacheValue
+	attachmentCacheLock sync.Mutex
+}
+
+type AttachmentCacheKey struct {
+	ChannelID    uint64
+	AttachmentID uint64
+}
+
+type AttachmentCacheValue struct {
+	URL    string
+	Expiry time.Time
+}
+
+func newDirectMediaAPI(br *DiscordBridge) *DirectMediaAPI {
+	if !br.Config.Bridge.DirectMedia.Enabled {
+		return nil
+	}
+	dma := &DirectMediaAPI{
+		bridge: br,
+		cfg:    br.Config.Bridge.DirectMedia,
+		log:    br.ZLog.With().Str("component", "direct media").Logger(),
+		proxy: http.Client{
+			Transport: &http.Transport{
+				DialContext:         (&net.Dialer{Timeout: 10 * time.Second}).DialContext,
+				TLSHandshakeTimeout: 10 * time.Second,
+				ForceAttemptHTTP2:   false,
+			},
+			Timeout: 60 * time.Second,
+		},
+		attachmentCache: make(map[AttachmentCacheKey]AttachmentCacheValue),
+	}
+	r := br.AS.Router
+
+	parsed, err := federation.ParseSynapseKey(dma.cfg.ServerKey)
+	if err != nil {
+		dma.log.WithLevel(zerolog.FatalLevel).Err(err).Msg("Failed to parse server key")
+		os.Exit(11)
+		return nil
+	}
+	dma.signatureKey = sha256.Sum256(parsed.Priv.Seed())
+	dma.ks = &federation.KeyServer{
+		KeyProvider: &federation.StaticServerKey{
+			ServerName: dma.cfg.ServerName,
+			Key:        parsed,
+		},
+		WellKnownTarget: dma.cfg.WellKnownResponse,
+		Version: federation.ServerVersion{
+			Name:    br.Name,
+			Version: br.Version,
+		},
+	}
+	if dma.ks.WellKnownTarget == "" {
+		dma.ks.WellKnownTarget = fmt.Sprintf("%s:443", dma.cfg.ServerName)
+	}
+	federationRouter := r.PathPrefix("/_matrix/federation").Subrouter()
+	mediaRouter := r.PathPrefix("/_matrix/media").Subrouter()
+	clientMediaRouter := r.PathPrefix("/_matrix/client/v1/media").Subrouter()
+	var reqIDCounter atomic.Uint64
+	middleware := func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Access-Control-Allow-Origin", "*")
+			w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
+			w.Header().Set("Access-Control-Allow-Headers", "X-Requested-With, Content-Type, Authorization")
+			log := dma.log.With().
+				Str("remote_addr", r.RemoteAddr).
+				Str("request_path", r.URL.Path).
+				Uint64("req_id", reqIDCounter.Add(1)).
+				Logger()
+			next.ServeHTTP(w, r.WithContext(log.WithContext(r.Context())))
+		})
+	}
+	mediaRouter.Use(middleware)
+	federationRouter.Use(middleware)
+	clientMediaRouter.Use(middleware)
+	addRoutes := func(version string) {
+		mediaRouter.HandleFunc("/"+version+"/download/{serverName}/{mediaID}", dma.DownloadMedia).Methods(http.MethodGet)
+		mediaRouter.HandleFunc("/"+version+"/download/{serverName}/{mediaID}/{fileName}", dma.DownloadMedia).Methods(http.MethodGet)
+		mediaRouter.HandleFunc("/"+version+"/thumbnail/{serverName}/{mediaID}", dma.DownloadMedia).Methods(http.MethodGet)
+		mediaRouter.HandleFunc("/"+version+"/upload/{serverName}/{mediaID}", dma.UploadNotSupported).Methods(http.MethodPut)
+		mediaRouter.HandleFunc("/"+version+"/upload", dma.UploadNotSupported).Methods(http.MethodPost)
+		mediaRouter.HandleFunc("/"+version+"/create", dma.UploadNotSupported).Methods(http.MethodPost)
+		mediaRouter.HandleFunc("/"+version+"/config", dma.UploadNotSupported).Methods(http.MethodGet)
+		mediaRouter.HandleFunc("/"+version+"/preview_url", dma.PreviewURLNotSupported).Methods(http.MethodGet)
+	}
+	clientMediaRouter.HandleFunc("/download/{serverName}/{mediaID}", dma.DownloadMedia).Methods(http.MethodGet)
+	clientMediaRouter.HandleFunc("/download/{serverName}/{mediaID}/{fileName}", dma.DownloadMedia).Methods(http.MethodGet)
+	clientMediaRouter.HandleFunc("/thumbnail/{serverName}/{mediaID}", dma.DownloadMedia).Methods(http.MethodGet)
+	clientMediaRouter.HandleFunc("/upload/{serverName}/{mediaID}", dma.UploadNotSupported).Methods(http.MethodPut)
+	clientMediaRouter.HandleFunc("/upload", dma.UploadNotSupported).Methods(http.MethodPost)
+	clientMediaRouter.HandleFunc("/create", dma.UploadNotSupported).Methods(http.MethodPost)
+	clientMediaRouter.HandleFunc("/config", dma.UploadNotSupported).Methods(http.MethodGet)
+	clientMediaRouter.HandleFunc("/preview_url", dma.PreviewURLNotSupported).Methods(http.MethodGet)
+	addRoutes("v3")
+	addRoutes("r0")
+	addRoutes("v1")
+	federationRouter.HandleFunc("/v1/media/download/{mediaID}", dma.DownloadMedia).Methods(http.MethodGet)
+	federationRouter.HandleFunc("/v1/version", dma.ks.GetServerVersion).Methods(http.MethodGet)
+	mediaRouter.NotFoundHandler = http.HandlerFunc(dma.UnknownEndpoint)
+	mediaRouter.MethodNotAllowedHandler = http.HandlerFunc(dma.UnsupportedMethod)
+	federationRouter.NotFoundHandler = http.HandlerFunc(dma.UnknownEndpoint)
+	federationRouter.MethodNotAllowedHandler = http.HandlerFunc(dma.UnsupportedMethod)
+	dma.ks.Register(r)
+
+	return dma
+}
+
+func (dma *DirectMediaAPI) makeMXC(data MediaIDData) id.ContentURI {
+	return id.ContentURI{
+		Homeserver: dma.cfg.ServerName,
+		FileID:     data.Wrap().SignedString(dma.signatureKey),
+	}
+}
+
+func parseExpiryTS(addr string) time.Time {
+	parsedURL, err := url.Parse(addr)
+	if err != nil {
+		return time.Time{}
+	}
+	tsBytes, err := hex.DecodeString(parsedURL.Query().Get("ex"))
+	if err != nil || len(tsBytes) != 4 {
+		return time.Time{}
+	}
+	parsedTS := int64(binary.BigEndian.Uint32(tsBytes))
+	if parsedTS > time.Now().Unix() && parsedTS < time.Now().Add(365*24*time.Hour).Unix() {
+		return time.Unix(parsedTS, 0)
+	}
+	return time.Time{}
+}
+
+func (dma *DirectMediaAPI) addAttachmentToCache(channelID uint64, att *discordgo.MessageAttachment) time.Time {
+	attachmentID, err := strconv.ParseUint(att.ID, 10, 64)
+	if err != nil {
+		return time.Time{}
+	}
+	expiry := parseExpiryTS(att.URL)
+	if expiry.IsZero() {
+		expiry = time.Now().Add(24 * time.Hour)
+	}
+	dma.attachmentCache[AttachmentCacheKey{
+		ChannelID:    channelID,
+		AttachmentID: attachmentID,
+	}] = AttachmentCacheValue{
+		URL:    att.URL,
+		Expiry: expiry,
+	}
+	return expiry
+}
+
+func (dma *DirectMediaAPI) AttachmentMXC(channelID, messageID string, att *discordgo.MessageAttachment) (mxc id.ContentURI) {
+	if dma == nil {
+		return
+	}
+	channelIDInt, err := strconv.ParseUint(channelID, 10, 64)
+	if err != nil {
+		dma.log.Warn().Str("channel_id", channelID).Msg("Got non-integer channel ID")
+		return
+	}
+	messageIDInt, err := strconv.ParseUint(messageID, 10, 64)
+	if err != nil {
+		dma.log.Warn().Str("message_id", messageID).Msg("Got non-integer message ID")
+		return
+	}
+	attachmentIDInt, err := strconv.ParseUint(att.ID, 10, 64)
+	if err != nil {
+		dma.log.Warn().Str("attachment_id", att.ID).Msg("Got non-integer attachment ID")
+		return
+	}
+	dma.attachmentCacheLock.Lock()
+	dma.addAttachmentToCache(channelIDInt, att)
+	dma.attachmentCacheLock.Unlock()
+	return dma.makeMXC(&AttachmentMediaData{
+		ChannelID:    channelIDInt,
+		MessageID:    messageIDInt,
+		AttachmentID: attachmentIDInt,
+	})
+}
+
+func (dma *DirectMediaAPI) EmojiMXC(emojiID, name string, animated bool) (mxc id.ContentURI) {
+	if dma == nil {
+		return
+	}
+	emojiIDInt, err := strconv.ParseUint(emojiID, 10, 64)
+	if err != nil {
+		dma.log.Warn().Str("emoji_id", emojiID).Msg("Got non-integer emoji ID")
+		return
+	}
+	return dma.makeMXC(&EmojiMediaData{
+		EmojiMediaDataInner: EmojiMediaDataInner{
+			EmojiID:  emojiIDInt,
+			Animated: animated,
+		},
+		Name: name,
+	})
+}
+
+func (dma *DirectMediaAPI) StickerMXC(stickerID string, format discordgo.StickerFormat) (mxc id.ContentURI) {
+	if dma == nil {
+		return
+	}
+	stickerIDInt, err := strconv.ParseUint(stickerID, 10, 64)
+	if err != nil {
+		dma.log.Warn().Str("sticker_id", stickerID).Msg("Got non-integer sticker ID")
+		return
+	} else if format > 255 || format < 0 {
+		dma.log.Warn().Int("format", int(format)).Msg("Got invalid sticker format")
+		return
+	}
+	return dma.makeMXC(&StickerMediaData{
+		StickerID: stickerIDInt,
+		Format:    byte(format),
+	})
+}
+
+func (dma *DirectMediaAPI) AvatarMXC(guildID, userID, avatarID string) (mxc id.ContentURI) {
+	if dma == nil {
+		return
+	}
+	animated := strings.HasPrefix(avatarID, "a_")
+	avatarIDBytes, err := hex.DecodeString(strings.TrimPrefix(avatarID, "a_"))
+	if err != nil {
+		dma.log.Warn().Str("avatar_id", avatarID).Msg("Got non-hex avatar ID")
+		return
+	} else if len(avatarIDBytes) != 16 {
+		dma.log.Warn().Str("avatar_id", avatarID).Msg("Got invalid avatar ID length")
+		return
+	}
+	avatarIDArray := [16]byte(avatarIDBytes)
+	userIDInt, err := strconv.ParseUint(userID, 10, 64)
+	if err != nil {
+		dma.log.Warn().Str("user_id", userID).Msg("Got non-integer user ID")
+		return
+	}
+	if guildID != "" {
+		guildIDInt, err := strconv.ParseUint(guildID, 10, 64)
+		if err != nil {
+			dma.log.Warn().Str("guild_id", guildID).Msg("Got non-integer guild ID")
+			return
+		}
+		return dma.makeMXC(&GuildMemberAvatarMediaData{
+			GuildID:  guildIDInt,
+			UserID:   userIDInt,
+			AvatarID: avatarIDArray,
+			Animated: animated,
+		})
+	} else {
+		return dma.makeMXC(&UserAvatarMediaData{
+			UserID:   userIDInt,
+			AvatarID: avatarIDArray,
+			Animated: animated,
+		})
+	}
+}
+
+type RespError struct {
+	Code    string
+	Message string
+	Status  int
+}
+
+func (re *RespError) Error() string {
+	return re.Message
+}
+
+var ErrNoUsersWithAccessFound = errors.New("no users found to fetch message")
+var ErrAttachmentNotFound = errors.New("attachment not found")
+
+func (dma *DirectMediaAPI) fetchNewAttachmentURL(ctx context.Context, meta *AttachmentMediaData) (string, time.Time, error) {
+	var client *discordgo.Session
+	channelIDStr := strconv.FormatUint(meta.ChannelID, 10)
+	portal := dma.bridge.GetExistingPortalByID(database.PortalKey{ChannelID: channelIDStr})
+	var users []id.UserID
+	if portal != nil && portal.GuildID != "" {
+		users = dma.bridge.DB.GetUsersInPortal(portal.GuildID)
+	} else {
+		users = dma.bridge.DB.GetUsersInPortal(channelIDStr)
+	}
+	for _, userID := range users {
+		user := dma.bridge.GetCachedUserByMXID(userID)
+		if user == nil || user.Session == nil {
+			continue
+		}
+		perms, err := user.Session.State.UserChannelPermissions(user.DiscordID, channelIDStr)
+		if err == nil && perms&discordgo.PermissionViewChannel == 0 {
+			continue
+		}
+		if client == nil || err == nil {
+			client = user.Session
+			if !client.IsUser {
+				break
+			}
+		}
+	}
+	if client == nil {
+		return "", time.Time{}, ErrNoUsersWithAccessFound
+	}
+	var msgs []*discordgo.Message
+	var err error
+	messageIDStr := strconv.FormatUint(meta.MessageID, 10)
+	if client.IsUser {
+		var refs []discordgo.RequestOption
+		if portal != nil {
+			refs = append(refs, discordgo.WithChannelReferer(portal.GuildID, channelIDStr))
+		}
+		msgs, err = client.ChannelMessages(channelIDStr, 5, "", "", messageIDStr, refs...)
+	} else {
+		var msg *discordgo.Message
+		msg, err = client.ChannelMessage(channelIDStr, messageIDStr)
+		msgs = []*discordgo.Message{msg}
+	}
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("failed to fetch message: %w", err)
+	}
+	attachmentIDStr := strconv.FormatUint(meta.AttachmentID, 10)
+	var url string
+	var expiry time.Time
+	for _, item := range msgs {
+		for _, att := range item.Attachments {
+			thisExpiry := dma.addAttachmentToCache(meta.ChannelID, att)
+			if att.ID == attachmentIDStr {
+				url = att.URL
+				expiry = thisExpiry
+			}
+		}
+	}
+	if url == "" {
+		return "", time.Time{}, ErrAttachmentNotFound
+	}
+	return url, expiry, nil
+}
+
+func (dma *DirectMediaAPI) GetEmojiInfo(contentURI id.ContentURI) *EmojiMediaData {
+	if dma == nil || contentURI.IsEmpty() || contentURI.Homeserver != dma.cfg.ServerName {
+		return nil
+	}
+	mediaID, err := ParseMediaID(contentURI.FileID, dma.signatureKey)
+	if err != nil {
+		return nil
+	}
+	emojiData, ok := mediaID.Data.(*EmojiMediaData)
+	if !ok {
+		return nil
+	}
+	return emojiData
+
+}
+
+func (dma *DirectMediaAPI) getMediaURL(ctx context.Context, encodedMediaID string) (url string, expiry time.Time, err error) {
+	var mediaID *MediaID
+	mediaID, err = ParseMediaID(encodedMediaID, dma.signatureKey)
+	if err != nil {
+		err = &RespError{
+			Code:    mautrix.MNotFound.ErrCode,
+			Message: err.Error(),
+			Status:  http.StatusNotFound,
+		}
+		return
+	}
+	switch mediaData := mediaID.Data.(type) {
+	case *AttachmentMediaData:
+		dma.attachmentCacheLock.Lock()
+		defer dma.attachmentCacheLock.Unlock()
+		cached, ok := dma.attachmentCache[mediaData.CacheKey()]
+		if ok && time.Until(cached.Expiry) > 5*time.Minute {
+			return cached.URL, cached.Expiry, nil
+		}
+		zerolog.Ctx(ctx).Debug().
+			Uint64("channel_id", mediaData.ChannelID).
+			Uint64("message_id", mediaData.MessageID).
+			Uint64("attachment_id", mediaData.AttachmentID).
+			Msg("Refreshing attachment URL")
+		url, expiry, err = dma.fetchNewAttachmentURL(ctx, mediaData)
+		if err != nil {
+			zerolog.Ctx(ctx).Err(err).Msg("Failed to refresh attachment URL")
+			msg := "Failed to refresh attachment URL"
+			if errors.Is(err, ErrNoUsersWithAccessFound) {
+				msg = "No users found with access to the channel"
+			} else if errors.Is(err, ErrAttachmentNotFound) {
+				msg = "Attachment not found in message. Perhaps it was deleted?"
+			}
+			err = &RespError{
+				Code:    mautrix.MNotFound.ErrCode,
+				Message: msg,
+				Status:  http.StatusNotFound,
+			}
+		} else {
+			zerolog.Ctx(ctx).Debug().Time("expiry", expiry).Msg("Successfully refreshed attachment URL")
+		}
+	case *EmojiMediaData:
+		if mediaData.Animated {
+			url = discordgo.EndpointEmojiAnimated(strconv.FormatUint(mediaData.EmojiID, 10))
+		} else {
+			url = discordgo.EndpointEmoji(strconv.FormatUint(mediaData.EmojiID, 10))
+		}
+	case *StickerMediaData:
+		url = discordgo.EndpointStickerImage(
+			strconv.FormatUint(mediaData.StickerID, 10),
+			discordgo.StickerFormat(mediaData.Format),
+		)
+	case *UserAvatarMediaData:
+		if mediaData.Animated {
+			url = discordgo.EndpointUserAvatarAnimated(
+				strconv.FormatUint(mediaData.UserID, 10),
+				fmt.Sprintf("a_%x", mediaData.AvatarID),
+			)
+		} else {
+			url = discordgo.EndpointUserAvatar(
+				strconv.FormatUint(mediaData.UserID, 10),
+				fmt.Sprintf("%x", mediaData.AvatarID),
+			)
+		}
+	case *GuildMemberAvatarMediaData:
+		if mediaData.Animated {
+			url = discordgo.EndpointGuildMemberAvatarAnimated(
+				strconv.FormatUint(mediaData.GuildID, 10),
+				strconv.FormatUint(mediaData.UserID, 10),
+				fmt.Sprintf("a_%x", mediaData.AvatarID),
+			)
+		} else {
+			url = discordgo.EndpointGuildMemberAvatar(
+				strconv.FormatUint(mediaData.GuildID, 10),
+				strconv.FormatUint(mediaData.UserID, 10),
+				fmt.Sprintf("%x", mediaData.AvatarID),
+			)
+		}
+	default:
+		zerolog.Ctx(ctx).Error().Type("media_data_type", mediaData).Msg("Unrecognized media data struct")
+		err = &RespError{
+			Code:    "M_UNKNOWN",
+			Message: "Unrecognized media data struct",
+			Status:  http.StatusInternalServerError,
+		}
+	}
+	return
+}
+
+func (dma *DirectMediaAPI) proxyDownload(ctx context.Context, w http.ResponseWriter, url, fileName string) {
+	log := zerolog.Ctx(ctx)
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		log.Err(err).Str("url", url).Msg("Failed to create proxy request")
+		jsonResponse(w, http.StatusInternalServerError, &mautrix.RespError{
+			ErrCode: "M_UNKNOWN",
+			Err:     "Failed to create proxy request",
+		})
+		return
+	}
+	for key, val := range discordgo.DroidDownloadHeaders {
+		req.Header.Set(key, val)
+	}
+	resp, err := dma.proxy.Do(req)
+	defer func() {
+		if resp != nil && resp.Body != nil {
+			_ = resp.Body.Close()
+		}
+	}()
+	if err != nil {
+		log.Err(err).Str("url", url).Msg("Failed to proxy download")
+		jsonResponse(w, http.StatusServiceUnavailable, &mautrix.RespError{
+			ErrCode: "M_UNKNOWN",
+			Err:     "Failed to proxy download",
+		})
+		return
+	} else if resp.StatusCode != http.StatusOK {
+		log.Warn().Str("url", url).Int("status", resp.StatusCode).Msg("Unexpected status code proxying download")
+		jsonResponse(w, resp.StatusCode, &mautrix.RespError{
+			ErrCode: "M_UNKNOWN",
+			Err:     "Unexpected status code proxying download",
+		})
+		return
+	}
+	w.Header()["Content-Type"] = resp.Header["Content-Type"]
+	w.Header()["Content-Length"] = resp.Header["Content-Length"]
+	w.Header()["Last-Modified"] = resp.Header["Last-Modified"]
+	w.Header()["Cache-Control"] = resp.Header["Cache-Control"]
+	contentDisposition := "attachment"
+	switch resp.Header.Get("Content-Type") {
+	case "text/css", "text/plain", "text/csv", "application/json", "application/ld+json", "image/jpeg", "image/gif",
+		"image/png", "image/apng", "image/webp", "image/avif", "video/mp4", "video/webm", "video/ogg", "video/quicktime",
+		"audio/mp4", "audio/webm", "audio/aac", "audio/mpeg", "audio/ogg", "audio/wave", "audio/wav", "audio/x-wav",
+		"audio/x-pn-wav", "audio/flac", "audio/x-flac", "application/pdf":
+		contentDisposition = "inline"
+	}
+	if fileName != "" {
+		contentDisposition = mime.FormatMediaType(contentDisposition, map[string]string{
+			"filename": fileName,
+		})
+	}
+	w.Header().Set("Content-Disposition", contentDisposition)
+	w.WriteHeader(http.StatusOK)
+	_, err = io.Copy(w, resp.Body)
+	if err != nil {
+		log.Debug().Err(err).Msg("Failed to write proxy response")
+	}
+}
+
+func (dma *DirectMediaAPI) DownloadMedia(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	log := zerolog.Ctx(ctx)
+	isNewFederation := strings.HasPrefix(r.URL.Path, "/_matrix/federation/v1/media/download/")
+	vars := mux.Vars(r)
+	if !isNewFederation && vars["serverName"] != dma.cfg.ServerName {
+		jsonResponse(w, http.StatusNotFound, &mautrix.RespError{
+			ErrCode: mautrix.MNotFound.ErrCode,
+			Err:     fmt.Sprintf("This is a Discord media proxy for %q, other media downloads are not available here", dma.cfg.ServerName),
+		})
+		return
+	}
+	// TODO check destination header in X-Matrix auth when isNewFederation
+
+	url, expiresAt, err := dma.getMediaURL(ctx, vars["mediaID"])
+	if err != nil {
+		var respError *RespError
+		if errors.As(err, &respError) {
+			jsonResponse(w, respError.Status, &mautrix.RespError{
+				ErrCode: respError.Code,
+				Err:     respError.Message,
+			})
+		} else {
+			log.Err(err).Str("media_id", vars["mediaID"]).Msg("Failed to get media URL")
+			jsonResponse(w, http.StatusNotFound, &mautrix.RespError{
+				ErrCode: mautrix.MNotFound.ErrCode,
+				Err:     "Media not found",
+			})
+		}
+		return
+	}
+	if isNewFederation {
+		mp := multipart.NewWriter(w)
+		w.Header().Set("Content-Type", strings.Replace(mp.FormDataContentType(), "form-data", "mixed", 1))
+		var metaPart io.Writer
+		metaPart, err = mp.CreatePart(textproto.MIMEHeader{
+			"Content-Type": {"application/json"},
+		})
+		if err != nil {
+			log.Err(err).Msg("Failed to create multipart metadata field")
+			return
+		}
+		_, err = metaPart.Write([]byte(`{}`))
+		if err != nil {
+			log.Err(err).Msg("Failed to write multipart metadata field")
+			return
+		}
+		_, err = mp.CreatePart(textproto.MIMEHeader{
+			"Location": {url},
+		})
+		if err != nil {
+			log.Err(err).Msg("Failed to create multipart redirect field")
+			return
+		}
+		err = mp.Close()
+		if err != nil {
+			log.Err(err).Msg("Failed to close multipart writer")
+			return
+		}
+		return
+	}
+	// Proxy if the config allows proxying and the request doesn't allow redirects.
+	// In any other case, redirect to the Discord CDN.
+	if dma.cfg.AllowProxy && r.URL.Query().Get("allow_redirect") != "true" {
+		dma.proxyDownload(ctx, w, url, vars["fileName"])
+		return
+	}
+	w.Header().Set("Location", url)
+	expirySeconds := (time.Until(expiresAt) - 5*time.Minute).Seconds()
+	if expiresAt.IsZero() {
+		w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
+	} else if expirySeconds > 0 {
+		cacheControl := fmt.Sprintf("public, max-age=%d, immutable", int(expirySeconds))
+		w.Header().Set("Cache-Control", cacheControl)
+	} else {
+		w.Header().Set("Cache-Control", "no-store")
+	}
+	w.WriteHeader(http.StatusTemporaryRedirect)
+}
+
+func (dma *DirectMediaAPI) UploadNotSupported(w http.ResponseWriter, r *http.Request) {
+	jsonResponse(w, http.StatusNotImplemented, &mautrix.RespError{
+		ErrCode: mautrix.MUnrecognized.ErrCode,
+		Err:     "This bridge only supports proxying Discord media downloads and does not support media uploads.",
+	})
+}
+
+func (dma *DirectMediaAPI) PreviewURLNotSupported(w http.ResponseWriter, r *http.Request) {
+	jsonResponse(w, http.StatusNotImplemented, &mautrix.RespError{
+		ErrCode: mautrix.MUnrecognized.ErrCode,
+		Err:     "This bridge only supports proxying Discord media downloads and does not support URL previews.",
+	})
+}
+
+func (dma *DirectMediaAPI) UnknownEndpoint(w http.ResponseWriter, r *http.Request) {
+	jsonResponse(w, http.StatusNotFound, &mautrix.RespError{
+		ErrCode: mautrix.MUnrecognized.ErrCode,
+		Err:     "Unrecognized endpoint",
+	})
+}
+
+func (dma *DirectMediaAPI) UnsupportedMethod(w http.ResponseWriter, r *http.Request) {
+	jsonResponse(w, http.StatusMethodNotAllowed, &mautrix.RespError{
+		ErrCode: mautrix.MUnrecognized.ErrCode,
+		Err:     "Invalid method for endpoint",
+	})
+}

directmedia_id.go

@@ -0,0 +1,287 @@
+// mautrix-discord - A Matrix-Discord puppeting bridge.
+// Copyright (C) 2024 Tulir Asokan
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package main
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+)
+
+const MediaIDPrefix = "\U0001F408DISCORD"
+const MediaIDVersion = 1
+
+type MediaIDClass uint8
+
+const (
+	MediaIDClassAttachment        MediaIDClass = 1
+	MediaIDClassEmoji             MediaIDClass = 2
+	MediaIDClassSticker           MediaIDClass = 3
+	MediaIDClassUserAvatar        MediaIDClass = 4
+	MediaIDClassGuildMemberAvatar MediaIDClass = 5
+)
+
+type MediaIDData interface {
+	Write(to io.Writer)
+	Read(from io.Reader) error
+	Size() int
+	Wrap() *MediaID
+}
+
+type MediaID struct {
+	Version   uint8
+	TypeClass MediaIDClass
+	Data      MediaIDData
+}
+
+func ParseMediaID(id string, key [32]byte) (*MediaID, error) {
+	data, err := base64.RawURLEncoding.DecodeString(id)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decode base64: %w", err)
+	}
+	hasher := hmac.New(sha256.New, key[:])
+	checksum := data[len(data)-TruncatedHashLength:]
+	data = data[:len(data)-TruncatedHashLength]
+	hasher.Write(data)
+	if !hmac.Equal(checksum, hasher.Sum(nil)[:TruncatedHashLength]) {
+		return nil, ErrMediaIDChecksumMismatch
+	}
+	mid := &MediaID{}
+	err = mid.Read(bytes.NewReader(data))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse media ID: %w", err)
+	}
+	return mid, nil
+}
+
+const TruncatedHashLength = 16
+
+func (mid *MediaID) SignedString(key [32]byte) string {
+	buf := bytes.NewBuffer(make([]byte, 0, mid.Size()))
+	mid.Write(buf)
+	hasher := hmac.New(sha256.New, key[:])
+	hasher.Write(buf.Bytes())
+	buf.Write(hasher.Sum(nil)[:TruncatedHashLength])
+	return base64.RawURLEncoding.EncodeToString(buf.Bytes())
+}
+
+func (mid *MediaID) Write(to io.Writer) {
+	_, _ = to.Write([]byte(MediaIDPrefix))
+	_ = binary.Write(to, binary.BigEndian, mid.Version)
+	_ = binary.Write(to, binary.BigEndian, mid.TypeClass)
+	mid.Data.Write(to)
+}
+
+func (mid *MediaID) Size() int {
+	return len(MediaIDPrefix) + 2 + mid.Data.Size() + TruncatedHashLength
+}
+
+var (
+	ErrInvalidMediaID          = errors.New("invalid media ID")
+	ErrMediaIDChecksumMismatch = errors.New("invalid checksum in media ID")
+	ErrUnsupportedMediaID      = errors.New("unsupported media ID")
+)
+
+func (mid *MediaID) Read(from io.Reader) error {
+	prefix := make([]byte, len(MediaIDPrefix))
+	_, err := io.ReadFull(from, prefix)
+	if err != nil || !bytes.Equal(prefix, []byte(MediaIDPrefix)) {
+		return fmt.Errorf("%w: prefix not found", ErrInvalidMediaID)
+	}
+	versionAndClass := make([]byte, 2)
+	_, err = io.ReadFull(from, versionAndClass)
+	if err != nil {
+		return fmt.Errorf("%w: version and class not found", ErrInvalidMediaID)
+	} else if versionAndClass[0] != MediaIDVersion {
+		return fmt.Errorf("%w: unknown version %d", ErrUnsupportedMediaID, versionAndClass[0])
+	}
+	switch MediaIDClass(versionAndClass[1]) {
+	case MediaIDClassAttachment:
+		mid.Data = &AttachmentMediaData{}
+	case MediaIDClassEmoji:
+		mid.Data = &EmojiMediaData{}
+	case MediaIDClassSticker:
+		mid.Data = &StickerMediaData{}
+	case MediaIDClassUserAvatar:
+		mid.Data = &UserAvatarMediaData{}
+	case MediaIDClassGuildMemberAvatar:
+		mid.Data = &GuildMemberAvatarMediaData{}
+	default:
+		return fmt.Errorf("%w: unrecognized type class %d", ErrUnsupportedMediaID, versionAndClass[1])
+	}
+	err = mid.Data.Read(from)
+	if err != nil {
+		return fmt.Errorf("failed to parse media ID data: %w", err)
+	}
+	return nil
+}
+
+type AttachmentMediaData struct {
+	ChannelID    uint64
+	MessageID    uint64
+	AttachmentID uint64
+}
+
+func (amd *AttachmentMediaData) Write(to io.Writer) {
+	_ = binary.Write(to, binary.BigEndian, amd)
+}
+
+func (amd *AttachmentMediaData) Read(from io.Reader) (err error) {
+	return binary.Read(from, binary.BigEndian, amd)
+}
+
+func (amd *AttachmentMediaData) Size() int {
+	return binary.Size(amd)
+}
+
+func (amd *AttachmentMediaData) Wrap() *MediaID {
+	return &MediaID{
+		Version:   MediaIDVersion,
+		TypeClass: MediaIDClassAttachment,
+		Data:      amd,
+	}
+}
+
+func (amd *AttachmentMediaData) CacheKey() AttachmentCacheKey {
+	return AttachmentCacheKey{
+		ChannelID:    amd.ChannelID,
+		AttachmentID: amd.AttachmentID,
+	}
+}
+
+type StickerMediaData struct {
+	StickerID uint64
+	Format    uint8
+}
+
+func (smd *StickerMediaData) Write(to io.Writer) {
+	_ = binary.Write(to, binary.BigEndian, smd)
+}
+
+func (smd *StickerMediaData) Read(from io.Reader) error {
+	return binary.Read(from, binary.BigEndian, smd)
+}
+
+func (smd *StickerMediaData) Size() int {
+	return binary.Size(smd)
+}
+
+func (smd *StickerMediaData) Wrap() *MediaID {
+	return &MediaID{
+		Version:   MediaIDVersion,
+		TypeClass: MediaIDClassSticker,
+		Data:      smd,
+	}
+}
+
+type EmojiMediaDataInner struct {
+	EmojiID  uint64
+	Animated bool
+}
+
+type EmojiMediaData struct {
+	EmojiMediaDataInner
+	Name string
+}
+
+func (emd *EmojiMediaData) Write(to io.Writer) {
+	_ = binary.Write(to, binary.BigEndian, &emd.EmojiMediaDataInner)
+	_, _ = to.Write([]byte(emd.Name))
+}
+
+func (emd *EmojiMediaData) Read(from io.Reader) (err error) {
+	err = binary.Read(from, binary.BigEndian, &emd.EmojiMediaDataInner)
+	if err != nil {
+		return
+	}
+	name, err := io.ReadAll(from)
+	if err != nil {
+		return
+	}
+	emd.Name = string(name)
+	return
+}
+
+func (emd *EmojiMediaData) Size() int {
+	return binary.Size(&emd.EmojiMediaDataInner) + len(emd.Name)
+}
+
+func (emd *EmojiMediaData) Wrap() *MediaID {
+	return &MediaID{
+		Version:   MediaIDVersion,
+		TypeClass: MediaIDClassEmoji,
+		Data:      emd,
+	}
+}
+
+type UserAvatarMediaData struct {
+	UserID   uint64
+	Animated bool
+	AvatarID [16]byte
+}
+
+func (uamd *UserAvatarMediaData) Write(to io.Writer) {
+	_ = binary.Write(to, binary.BigEndian, uamd)
+}
+
+func (uamd *UserAvatarMediaData) Read(from io.Reader) error {
+	return binary.Read(from, binary.BigEndian, uamd)
+}
+
+func (uamd *UserAvatarMediaData) Size() int {
+	return binary.Size(uamd)
+}
+
+func (uamd *UserAvatarMediaData) Wrap() *MediaID {
+	return &MediaID{
+		Version:   MediaIDVersion,
+		TypeClass: MediaIDClassUserAvatar,
+		Data:      uamd,
+	}
+}
+
+type GuildMemberAvatarMediaData struct {
+	GuildID  uint64
+	UserID   uint64
+	Animated bool
+	AvatarID [16]byte
+}
+
+func (guamd *GuildMemberAvatarMediaData) Write(to io.Writer) {
+	_ = binary.Write(to, binary.BigEndian, guamd)
+}
+
+func (guamd *GuildMemberAvatarMediaData) Read(from io.Reader) error {
+	return binary.Read(from, binary.BigEndian, guamd)
+}
+
+func (guamd *GuildMemberAvatarMediaData) Size() int {
+	return binary.Size(guamd)
+}
+
+func (guamd *GuildMemberAvatarMediaData) Wrap() *MediaID {
+	return &MediaID{
+		Version:   MediaIDVersion,
+		TypeClass: MediaIDClassGuildMemberAvatar,
+		Data:      guamd,
+	}
+}

example-config.yaml

@@ -2,9 +2,6 @@
 homeserver:
     # The address that this appservice can use to connect to the homeserver.
     address: https://matrix.example.com
-    # Publicly accessible base URL for media, used for avatars in relay mode.
-    # If not set, the connection address above will be used.
-    public_address: null
     # The domain of the homeserver (also known as server_name, used for MXIDs, etc).
     domain: example.com
 
@@ -92,8 +89,9 @@ bridge:
     #   .Discriminator - The 4 numbers after the name on Discord
     #   .Bot - Whether the user is a bot
     #   .System - Whether the user is an official system user
-    #   .Webhook - Whether the user is a webhook
-    displayname_template: '{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}'
+    #   .Webhook - Whether the user is a webhook and is not an application
+    #   .Application - Whether the user is an application
+    displayname_template: '{{if .Webhook}}Webhook{{else}}{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}{{end}}'
     # Displayname template for Discord channels (bridged as rooms, or spaces when type=4).
     # Available variables:
     #   .Name - Channel name, or user displayname (pre-formatted with displayname_template) in DMs.
@@ -112,6 +110,13 @@ bridge:
     # If set to `never`, DM rooms will never have names and avatars set.
     private_chat_portal_meta: default
 
+    # Publicly accessible base URL that Discord can use to reach the bridge, used for avatars in relay mode.
+    # If not set, avatars will not be bridged. Only the /mautrix-discord/avatar/{server}/{id}/{hash} endpoint is used on this address.
+    # This should not have a trailing slash, the endpoint above will be appended to the provided address.
+    public_address: null
+    # A random key used to sign the avatar URLs. The bridge will only accept requests with a valid signature.
+    avatar_proxy_key: generate
+
     portal_message_buffer: 128
 
     # Number of private channel portals to create on bridge startup.
@@ -156,31 +161,39 @@ bridge:
     federate_rooms: true
     # Prefix messages from webhooks with the profile info? This can be used along with a custom displayname_template
     # to better handle webhooks that change their name all the time (like ones used by bridges).
-    prefix_webhook_messages: false
+    #
+    # This will use the fallback mode in MSC4144, which means clients that support MSC4144 will not show the prefix
+    # (and will instead show the name and avatar as the message sender).
+    prefix_webhook_messages: true
     # Bridge webhook avatars?
-    enable_webhook_avatars: true
+    enable_webhook_avatars: false
     # Should the bridge upload media to the Discord CDN directly before sending the message when using a user token,
     # like the official client does? The other option is sending the media in the message send request as a form part
     # (which is always used by bots and webhooks).
     use_discord_cdn_upload: true
+    # Proxy for Discord connections
+    proxy:
     # Should mxc uris copied from Discord be cached?
     # This can be `never` to never cache, `unencrypted` to only cache unencrypted mxc uris, or `always` to cache everything.
     # If you have a media repo that generates non-unique mxc uris, you should set this to never.
     cache_media: unencrypted
-    # Patterns for converting Discord media to custom mxc:// URIs instead of reuploading.
-    # Each of the patterns can be set to null to disable custom URIs for that type of media.
+    # Settings for converting Discord media to custom mxc:// URIs instead of reuploading.
     # More details can be found at https://docs.mau.fi/bridges/go/discord/direct-media.html
-    media_patterns:
+    direct_media:
         # Should custom mxc:// URIs be used instead of reuploading media?
         enabled: false
-        # Pattern for normal message attachments.
-        attachments: mxc://discord-media.mau.dev/attachments|{{.ChannelID}}|{{.AttachmentID}}|{{.FileName}}
-        # Pattern for custom emojis.
-        emojis: mxc://discord-media.mau.dev/emojis|{{.ID}}.{{.Ext}}
-        # Pattern for stickers. Note that animated lottie stickers will not be converted if this is enabled.
-        stickers: mxc://discord-media.mau.dev/stickers|{{.ID}}.{{.Ext}}
-        # Pattern for static user avatars.
-        avatars: mxc://discord-media.mau.dev/avatars|{{.UserID}}|{{.AvatarID}}.{{.Ext}}
+        # The server name to use for the custom mxc:// URIs.
+        # This server name will effectively be a real Matrix server, it just won't implement anything other than media.
+        # You must either set up .well-known delegation from this domain to the bridge, or proxy the domain directly to the bridge.
+        server_name: discord-media.example.com
+        # Optionally a custom .well-known response. This defaults to `server_name:443`
+        well_known_response:
+        # The bridge supports MSC3860 media download redirects and will use them if the requester supports it.
+        # Optionally, you can force redirects and not allow proxying at all by setting this to false.
+        allow_proxy: true
+        # Matrix server signing key to make the federation tester pass, same format as synapse's .signing.key file.
+        # This key is also used to sign the mxc:// URIs to ensure only the bridge can generate them.
+        server_key: generate
     # Settings for converting animated stickers.
     animated_sticker:
         # Format to which animated stickers should be converted.
@@ -232,6 +245,7 @@ bridge:
             initial:
                 dm: 0
                 channel: 0
+                thread: 0
             # Missed message backfill (on startup).
             # 0 means backfill is disabled, -1 means fetch all messages since last bridged message.
             # When using unlimited backfill (-1), messages are backfilled as they are fetched.
@@ -239,6 +253,7 @@ bridge:
             missed:
                 dm: 0
                 channel: 0
+                thread: 0
         # Maximum members in a guild to enable backfilling. Set to -1 to disable limit.
         # This can be used as a rough heuristic to disable backfilling in channels that are too active.
         # Currently only applies to missed message backfill.
@@ -254,7 +269,13 @@ bridge:
         # This will cause the bridge bot to be in private chats for the encryption to work properly.
         default: false
         # Whether to use MSC2409/MSC3202 instead of /sync long polling for receiving encryption-related data.
+        # Changing this option requires updating the appservice registration file.
         appservice: false
+        # Whether to use MSC4190 instead of appservice login to create the bridge bot device.
+        # Requires the homeserver to support MSC4190 and the device masquerading parts of MSC3202.
+        # Only relevant when using end-to-bridge encryption, required when using encryption with next-gen auth (MSC3861).
+        # Changing this option requires updating the appservice registration file.
+        msc4190: false
         # Require encryption, drop any unencrypted messages.
         require: false
         # Enable key sharing? If enabled, key requests for rooms where users are in will be fulfilled.
@@ -279,6 +300,10 @@ bridge:
             delete_on_device_delete: false
             # Periodically delete megolm sessions when 2x max_age has passed since receiving the session.
             periodically_delete_expired: false
+            # Delete inbound megolm sessions that don't have the received_at field used for
+            # automatic ratcheting and expired session deletion. This is meant as a migration
+            # to delete old keys prior to the bridge update.
+            delete_outdated_inbound: false
         # What level of device verification should be required from users?
         #
         # Valid levels:
@@ -325,6 +350,8 @@ bridge:
         # Shared secret for authentication. If set to "generate", a random secret will be generated,
         # or if set to "disable", the provisioning API will be disabled.
         shared_secret: generate
+        # Enable debug API at /debug with provisioning authentication.
+        debug_endpoints: false
 
     # Permissions for using the bridge.
     # Permitted values:

formatter.go

@@ -26,13 +26,12 @@ import (
 	"github.com/yuin/goldmark/extension"
 	"github.com/yuin/goldmark/parser"
 	"github.com/yuin/goldmark/util"
+	"go.mau.fi/util/variationselector"
 	"golang.org/x/exp/slices"
-
 	"maunium.net/go/mautrix/event"
 	"maunium.net/go/mautrix/format"
 	"maunium.net/go/mautrix/format/mdext"
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util/variationselector"
 )
 
 // escapeFixer is a hacky partial fix for the difference in escaping markdown, used with escapeReplacement
@@ -75,7 +74,7 @@ var discordRendererWithInlineLinks = goldmark.New(
 	fixIndentedParagraphs, format.HTMLOptions, discordExtensions,
 )
 
-func (portal *Portal) renderDiscordMarkdownOnlyHTML(text string, allowInlineLinks bool) string {
+func (portal *Portal) renderDiscordMarkdownOnlyHTMLNoUnwrap(text string, allowInlineLinks bool) string {
 	text = escapeFixer.ReplaceAllStringFunc(text, escapeReplacement)
 
 	var buf strings.Builder
@@ -89,7 +88,11 @@ func (portal *Portal) renderDiscordMarkdownOnlyHTML(text string, allowInlineLink
 	if err != nil {
 		panic(fmt.Errorf("markdown parser errored: %w", err))
 	}
-	return format.UnwrapSingleParagraph(buf.String())
+	return buf.String()
+}
+
+func (portal *Portal) renderDiscordMarkdownOnlyHTML(text string, allowInlineLinks bool) string {
+	return format.UnwrapSingleParagraph(portal.renderDiscordMarkdownOnlyHTMLNoUnwrap(text, allowInlineLinks))
 }
 
 const formatterContextPortalKey = "fi.mau.discord.portal"
@@ -156,11 +159,14 @@ func (br *DiscordBridge) pillConverter(displayname, mxid, eventID string, ctx fo
 	return displayname
 }
 
+const discordLinkPattern = `https?://[^<\p{Zs}\x{feff}]*[^"'),.:;\]\p{Zs}\x{feff}]`
+
 // Discord links start with http:// or https://, contain at least two characters afterwards,
 // don't contain < or whitespace anywhere, and don't end with "'),.:;]
 //
 // Zero-width whitespace is mostly in the Format category and is allowed, except \uFEFF isn't for some reason
-var discordLinkRegex = regexp.MustCompile(`https?://[^<\p{Zs}\x{feff}]*[^"'),.:;\]\p{Zs}\x{feff}]`)
+var discordLinkRegex = regexp.MustCompile(discordLinkPattern)
+var discordLinkRegexFull = regexp.MustCompile("^" + discordLinkPattern + "$")
 
 var discordMarkdownEscaper = strings.NewReplacer(
 	`\`, `\\`,
@@ -214,6 +220,14 @@ var matrixHTMLParser = &format.HTMLParser{
 		}
 		return fmt.Sprintf("||%s||", text)
 	},
+	LinkConverter: func(text, href string, ctx format.Context) string {
+		if text == href {
+			return text
+		} else if !discordLinkRegexFull.MatchString(href) {
+			return fmt.Sprintf("%s (%s)", escapeDiscordMarkdown(text), escapeDiscordMarkdown(href))
+		}
+		return fmt.Sprintf("[%s](%s)", escapeDiscordMarkdown(text), href)
+	},
 }
 
 func (portal *Portal) parseMatrixHTML(content *event.MessageEventContent) (string, *discordgo.MessageAllowedMentions) {

formatter_tag.go

@@ -30,6 +30,7 @@ import (
 	"github.com/yuin/goldmark/renderer"
 	"github.com/yuin/goldmark/text"
 	"github.com/yuin/goldmark/util"
+	"maunium.net/go/mautrix/id"
 
 	"go.mau.fi/mautrix-discord/database"
 )
@@ -262,11 +263,19 @@ func (r *discordTagHTMLRenderer) renderDiscordMention(w util.BufWriter, source [
 	}
 	switch node := n.(type) {
 	case *astDiscordUserMention:
-		if user := node.portal.bridge.GetUserByID(strconv.FormatInt(node.id, 10)); user != nil {
-			_, _ = fmt.Fprintf(w, `<a href="%s">%s</a>`, user.MXID.URI().MatrixToURL(), user.MXID)
-		} else if puppet := node.portal.bridge.GetPuppetByID(strconv.FormatInt(node.id, 10)); puppet != nil {
-			_, _ = fmt.Fprintf(w, `<a href="%s">%s</a>`, puppet.MXID.URI().MatrixToURL(), puppet.Name)
+		var mxid id.UserID
+		var name string
+		if puppet := node.portal.bridge.GetPuppetByID(strconv.FormatInt(node.id, 10)); puppet != nil {
+			mxid = puppet.MXID
+			name = puppet.Name
 		}
+		if user := node.portal.bridge.GetUserByID(strconv.FormatInt(node.id, 10)); user != nil {
+			mxid = user.MXID
+			if name == "" {
+				name = user.MXID.Localpart()
+			}
+		}
+		_, _ = fmt.Fprintf(w, `<a href="%s">%s</a>`, mxid.URI().MatrixToURL(), name)
 		return
 	case *astDiscordRoleMention:
 		role := node.portal.bridge.DB.Role.GetByID(node.portal.GuildID, strconv.FormatInt(node.id, 10))

go.mod

@@ -1,41 +1,45 @@
 module go.mau.fi/mautrix-discord
 
-go 1.19
+go 1.23.0
+
+toolchain go1.24.5
 
 require (
 	github.com/bwmarrin/discordgo v0.27.0
-	github.com/gabriel-vasile/mimetype v1.4.2
+	github.com/gabriel-vasile/mimetype v1.4.9
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/gorilla/mux v1.8.0
 	github.com/gorilla/websocket v1.5.0
 	github.com/lib/pq v1.10.9
-	github.com/mattn/go-sqlite3 v1.14.17
-	github.com/rs/zerolog v1.29.1
+	github.com/mattn/go-sqlite3 v1.14.28
+	github.com/rs/zerolog v1.34.0
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
-	github.com/stretchr/testify v1.8.4
-	github.com/yuin/goldmark v1.5.4
-	golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1
+	github.com/stretchr/testify v1.10.0
+	github.com/yuin/goldmark v1.7.12
+	go.mau.fi/util v0.2.2-0.20231228160422-22fdd4bbddeb
+	golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc
+	golang.org/x/sync v0.16.0
 	maunium.net/go/maulogger/v2 v2.4.1
-	maunium.net/go/mautrix v0.15.3
+	maunium.net/go/mautrix v0.16.3-0.20250629161415-a29d782e6638
 )
 
 require (
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/mattn/go-colorable v0.1.12 // indirect
-	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/tidwall/gjson v1.14.4 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
-	github.com/tidwall/pretty v1.2.0 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tidwall/sjson v1.2.5 // indirect
 	go.mau.fi/zeroconfig v0.1.2 // indirect
-	golang.org/x/crypto v0.10.0 // indirect
-	golang.org/x/net v0.11.0 // indirect
-	golang.org/x/sys v0.9.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
+	golang.org/x/sys v0.34.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	maunium.net/go/mauflag v1.0.0 // indirect
 )
 
-replace github.com/bwmarrin/discordgo => github.com/beeper/discordgo v0.0.0-20230512133900-5b12693331c0
+replace github.com/bwmarrin/discordgo => github.com/beeper/discordgo v0.0.0-20250607214857-f23a8518ece2

go.sum

@@ -1,12 +1,13 @@
 github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
-github.com/beeper/discordgo v0.0.0-20230512133900-5b12693331c0 h1:ECBEbC4ruaXzcVJJ4UurkGpT/Xlm9ZnwsHiHn9gjPZw=
-github.com/beeper/discordgo v0.0.0-20230512133900-5b12693331c0/go.mod h1:59+AOzzjmL6onAh62nuLXmn7dJCaC/owDLWbGtjTcFA=
+github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
+github.com/beeper/discordgo v0.0.0-20250607214857-f23a8518ece2 h1:8lgTjYGSIlS90f0jiFfEC4UwxCq9FiUo4dKwjknbupQ=
+github.com/beeper/discordgo v0.0.0-20250607214857-f23a8518ece2/go.mod h1:59+AOzzjmL6onAh62nuLXmn7dJCaC/owDLWbGtjTcFA=
 github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
-github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
+github.com/gabriel-vasile/mimetype v1.4.9 h1:5k+WDwEsD9eTLL8Tz3L0VnmVh9QxGjRmjBvAG7U/oYY=
+github.com/gabriel-vasile/mimetype v1.4.9/go.mod h1:WnSQhFKJuBlRyLiKohA/2DtIlPFAbguNaG7QCHcyGok=
 github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
@@ -16,45 +17,52 @@ github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWm
 github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
 github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/mattn/go-colorable v0.1.12 h1:jF+Du6AlPIjs2BiUiQlKOX0rt3SujHxPnksPKZbaA40=
-github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-isatty v0.0.14 h1:yVuAays6BHfxijgZPzw+3Zlu5yQgKGP2/hcQbHb7S9Y=
-github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-sqlite3 v1.14.17 h1:mCRHCLDUBXgpKAqIKsaAaAsrAlbkeomtRFKXh2L6YIM=
-github.com/mattn/go-sqlite3 v1.14.17/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.28 h1:ThEiQrnbtumT+QMknw63Befp/ce/nUPgBPMlRFEum7A=
+github.com/mattn/go-sqlite3 v1.14.28/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/rs/zerolog v1.29.1 h1:cO+d60CHkknCbvzEWxP0S9K6KqyTjrCNUy1LdQLCGPc=
-github.com/rs/zerolog v1.29.1/go.mod h1:Le6ESbR7hc+DP6Lt1THiV8CQSdkkNrd3R0XbEgp3ZBU=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e h1:MRM5ITcdelLK2j1vwZ3Je0FKVCfqOLp5zO6trqMLYs0=
 github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e/go.mod h1:XV66xRDqSt+GTGFMVlhk3ULuV0y9ZmzeVGR4mloJI3M=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
-github.com/tidwall/gjson v1.14.4 h1:uo0p8EbA09J7RQaflQ1aBRffTR7xedD2bcIVSYxLnkM=
-github.com/tidwall/gjson v1.14.4/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.18.0 h1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=
+github.com/tidwall/gjson v1.18.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
 github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
-github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
-github.com/yuin/goldmark v1.5.4 h1:2uY/xC0roWy8IBEGLgB1ywIoEJFGmRrX21YQcvGZzjU=
-github.com/yuin/goldmark v1.5.4/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.7.12 h1:YwGP/rrea2/CnCtUHgjuolG/PnMxdQtPMO5PvaE2/nY=
+github.com/yuin/goldmark v1.7.12/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+go.mau.fi/util v0.2.2-0.20231228160422-22fdd4bbddeb h1:Is+6vDKgINRy9KHodvi7NElxoDaWA8sc2S3cF3+QWjs=
+go.mau.fi/util v0.2.2-0.20231228160422-22fdd4bbddeb/go.mod h1:tiBX6nxVSOjU89jVQ7wBh3P8KjM26Lv1k7/I5QdSvBw=
 go.mau.fi/zeroconfig v0.1.2 h1:DKOydWnhPMn65GbXZOafgkPm11BvFashZWLct0dGFto=
 go.mau.fi/zeroconfig v0.1.2/go.mod h1:NcSJkf180JT+1IId76PcMuLTNa1CzsFFZ0nBygIQM70=
-golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM=
-golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I=
-golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1 h1:k/i9J1pBpvlfR+9QsetwPyERsqu1GIbi967PQMq3Ivc=
-golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
-golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU=
-golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ=
-golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s=
-golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
+golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc h1:TS73t7x3KarrNd5qAipmspBDS1rkMcgVG/fS1aRb4Rc=
+golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc/go.mod h1:A+z0yzpGtvnG90cToK5n2tu8UJVP2XUATh+r+sfOOOc=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA=
+golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
@@ -65,5 +73,5 @@ maunium.net/go/mauflag v1.0.0 h1:YiaRc0tEI3toYtJMRIfjP+jklH45uDHtT80nUamyD4M=
 maunium.net/go/mauflag v1.0.0/go.mod h1:nLivPOpTpHnpzEh8jEdSL9UqO9+/KBJFmNRlwKfkPeA=
 maunium.net/go/maulogger/v2 v2.4.1 h1:N7zSdd0mZkB2m2JtFUsiGTQQAdP0YeFWT7YMc80yAL8=
 maunium.net/go/maulogger/v2 v2.4.1/go.mod h1:omPuYwYBILeVQobz8uO3XC8DIRuEb5rXYlQSuqrbCho=
-maunium.net/go/mautrix v0.15.3 h1:C9BHSUM0gYbuZmAtopuLjIcH5XHLb/ZjTEz7nN+0jN0=
-maunium.net/go/mautrix v0.15.3/go.mod h1:zLrQqdxJlLkurRCozTc9CL6FySkgZlO/kpCYxBILSLE=
+maunium.net/go/mautrix v0.16.3-0.20250629161415-a29d782e6638 h1:tZEmq1FBuueW6cmxoa2BkXYbfMknW8XPPMiZfD5PKto=
+maunium.net/go/mautrix v0.16.3-0.20250629161415-a29d782e6638/go.mod h1:gCgLw/4c1a8QsiOWTdUdXlt5cYdE0rJ9wLeZQKPD58Q=

guildportal.go

@@ -205,6 +205,7 @@ func (guild *Guild) CreateMatrixRoom(user *User, meta *discordgo.Guild) error {
 		Preset:          "private_chat",
 		InitialState:    initialState,
 		CreationContent: creationContent,
+		RoomVersion:     "11",
 	})
 	if err != nil {
 		guild.log.Warnln("Failed to create room:", err)
@@ -298,7 +299,7 @@ func (guild *Guild) cleanup() {
 		return
 	}
 	intent := guild.bridge.Bot
-	if guild.bridge.SpecVersions.UnstableFeatures["com.beeper.room_yeeting"] {
+	if guild.bridge.SpecVersions.Supports(mautrix.BeeperFeatureRoomYeeting) {
 		err := intent.BeeperDeleteRoom(guild.MXID)
 		if err != nil && !errors.Is(err, mautrix.MNotFound) {
 			guild.log.Errorfln("Failed to delete %s using hungryserv yeet endpoint: %v", guild.MXID, err)

main.go

@@ -18,13 +18,15 @@ package main
 
 import (
 	_ "embed"
+	"net/http"
 	"sync"
 
+	"go.mau.fi/util/configupgrade"
+	"go.mau.fi/util/exsync"
+	"golang.org/x/sync/semaphore"
 	"maunium.net/go/mautrix/bridge"
 	"maunium.net/go/mautrix/bridge/commands"
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util"
-	"maunium.net/go/mautrix/util/configupgrade"
 
 	"go.mau.fi/mautrix-discord/config"
 	"go.mau.fi/mautrix-discord/database"
@@ -47,6 +49,7 @@ type DiscordBridge struct {
 	Config *config.Config
 	DB     *database.Database
 
+	DMA          *DirectMediaAPI
 	provisioning *ProvisioningAPI
 
 	usersByMXID map[id.UserID]*User
@@ -73,7 +76,8 @@ type DiscordBridge struct {
 	puppetsByCustomMXID map[id.UserID]*Puppet
 	puppetsLock         sync.Mutex
 
-	attachmentTransfers *util.SyncMap[attachmentKey, *util.ReturnableOnce[*database.File]]
+	attachmentTransfers         *exsync.Map[attachmentKey, *exsync.ReturnableOnce[*database.File]]
+	parallelAttachmentSemaphore *semaphore.Weighted
 }
 
 func (br *DiscordBridge) GetExampleConfig() string {
@@ -102,6 +106,10 @@ func (br *DiscordBridge) Start() {
 	if br.Config.Bridge.Provisioning.SharedSecret != "disable" {
 		br.provisioning = newProvisioningAPI(br)
 	}
+	if br.Config.Bridge.PublicAddress != "" {
+		br.AS.Router.HandleFunc("/mautrix-discord/avatar/{server}/{mediaID}/{checksum}", br.serveMediaProxy).Methods(http.MethodGet)
+	}
+	br.DMA = newDirectMediaAPI(br)
 	br.WaitWebsocketConnected()
 	go br.startUsers()
 }
@@ -170,13 +178,14 @@ func main() {
 		puppets:             make(map[string]*Puppet),
 		puppetsByCustomMXID: make(map[id.UserID]*Puppet),
 
-		attachmentTransfers: util.NewSyncMap[attachmentKey, *util.ReturnableOnce[*database.File]](),
+		attachmentTransfers:         exsync.NewMap[attachmentKey, *exsync.ReturnableOnce[*database.File]](),
+		parallelAttachmentSemaphore: semaphore.NewWeighted(3),
 	}
 	br.Bridge = bridge.Bridge{
 		Name:              "mautrix-discord",
 		URL:               "https://github.com/mautrix/discord",
 		Description:       "A Matrix-Discord puppeting bridge.",
-		Version:           "0.5.0",
+		Version:           "0.7.5",
 		ProtocolName:      "Discord",
 		BeeperServiceName: "discordgo",
 		BeeperNetworkName: "discord",

portal.go

@@ -3,12 +3,17 @@ package main
 import (
 	"bytes"
 	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"reflect"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -17,7 +22,10 @@ import (
 
 	"github.com/bwmarrin/discordgo"
 	"github.com/gabriel-vasile/mimetype"
+	"github.com/gorilla/mux"
 	"github.com/rs/zerolog"
+	"go.mau.fi/util/exsync"
+	"go.mau.fi/util/variationselector"
 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/appservice"
 	"maunium.net/go/mautrix/bridge"
@@ -26,8 +34,6 @@ import (
 	"maunium.net/go/mautrix/crypto/attachment"
 	"maunium.net/go/mautrix/event"
 	"maunium.net/go/mautrix/id"
-	"maunium.net/go/mautrix/util"
-	"maunium.net/go/mautrix/util/variationselector"
 
 	"go.mau.fi/mautrix-discord/config"
 	"go.mau.fi/mautrix-discord/database"
@@ -62,7 +68,7 @@ type Portal struct {
 	discordMessages chan portalDiscordMessage
 	matrixMessages  chan portalMatrixMessage
 
-	recentMessages *util.RingBuffer[string, *discordgo.Message]
+	recentMessages *exsync.RingBuffer[string, *discordgo.Message]
 
 	commands     map[string]*discordgo.ApplicationCommand
 	commandsLock sync.RWMutex
@@ -260,7 +266,7 @@ func (br *DiscordBridge) NewPortal(dbPortal *database.Portal) *Portal {
 		discordMessages: make(chan portalDiscordMessage, br.Config.Bridge.PortalMessageBuffer),
 		matrixMessages:  make(chan portalMatrixMessage, br.Config.Bridge.PortalMessageBuffer),
 
-		recentMessages: util.NewRingBuffer[string, *discordgo.Message](recentMessageBufferSize),
+		recentMessages: exsync.NewRingBuffer[string, *discordgo.Message](recentMessageBufferSize),
 
 		commands: make(map[string]*discordgo.ApplicationCommand),
 	}
@@ -295,7 +301,8 @@ func (portal *Portal) MainIntent() *appservice.IntentAPI {
 
 type CustomBridgeInfoContent struct {
 	event.BridgeEventContent
-	RoomType string `json:"com.beeper.room_type,omitempty"`
+	RoomType   string `json:"com.beeper.room_type,omitempty"`
+	RoomTypeV2 string `json:"com.beeper.room_type.v2,omitempty"`
 }
 
 func init() {
@@ -338,7 +345,14 @@ func (portal *Portal) getBridgeInfo() (string, CustomBridgeInfoContent) {
 	if portal.Type == discordgo.ChannelTypeDM || portal.Type == discordgo.ChannelTypeGroupDM {
 		roomType = "dm"
 	}
-	return bridgeInfoStateKey, CustomBridgeInfoContent{bridgeInfo, roomType}
+	var roomTypeV2 string
+	if portal.Type == discordgo.ChannelTypeDM {
+		roomTypeV2 = "dm"
+	} else if portal.Type == discordgo.ChannelTypeGroupDM {
+		roomTypeV2 = "group_dm"
+	}
+
+	return bridgeInfoStateKey, CustomBridgeInfoContent{bridgeInfo, roomType, roomTypeV2}
 }
 
 func (portal *Portal) UpdateBridgeInfo() {
@@ -459,7 +473,7 @@ func (portal *Portal) CreateMatrixRoom(user *User, channel *discordgo.Channel) e
 			Content: event.Content{Parsed: &event.JoinRulesEventContent{
 				JoinRule: event.JoinRuleRestricted,
 				Allow: []event.JoinRuleAllow{{
-					RoomID: spaceID,
+					RoomID: portal.Guild.MXID,
 					Type:   event.JoinRuleAllowRoomMembership,
 				}},
 			}},
@@ -475,6 +489,7 @@ func (portal *Portal) CreateMatrixRoom(user *User, channel *discordgo.Channel) e
 		IsDirect:        portal.IsPrivateChat(),
 		InitialState:    initialState,
 		CreationContent: creationContent,
+		RoomVersion:     "11",
 	}
 	if !portal.shouldSetDMRoomMetadata() && !portal.FriendNick {
 		req.Name = ""
@@ -519,7 +534,7 @@ func (portal *Portal) CreateMatrixRoom(user *User, channel *discordgo.Channel) e
 	if portal.GuildID == "" {
 		user.addPrivateChannelToSpace(portal)
 	} else {
-		portal.updateSpace()
+		portal.updateSpace(user)
 	}
 	portal.ensureUserInvited(user, true)
 	user.syncChatDoublePuppetDetails(portal, true)
@@ -541,7 +556,7 @@ func (portal *Portal) CreateMatrixRoom(user *User, channel *discordgo.Channel) e
 		portal.Update()
 	}
 
-	go portal.forwardBackfillInitial(user)
+	go portal.forwardBackfillInitial(user, nil)
 	backfillStarted = true
 
 	return nil
@@ -549,13 +564,15 @@ func (portal *Portal) CreateMatrixRoom(user *User, channel *discordgo.Channel) e
 
 func (portal *Portal) handleDiscordMessages(msg portalDiscordMessage) {
 	if portal.MXID == "" {
-		_, ok := msg.msg.(*discordgo.MessageCreate)
+		msgCreate, ok := msg.msg.(*discordgo.MessageCreate)
 		if !ok {
 			portal.log.Warn().Msg("Can't create Matrix room from non new message event")
 			return
 		}
 
-		portal.log.Debug().Msg("Creating Matrix room from incoming message")
+		portal.log.Debug().
+			Str("message_id", msgCreate.ID).
+			Msg("Creating Matrix room from incoming message")
 		if err := portal.CreateMatrixRoom(msg.user, nil); err != nil {
 			portal.log.Err(err).Msg("Failed to create portal room")
 			return
@@ -586,7 +603,7 @@ func (portal *Portal) ensureUserInvited(user *User, ignoreCache bool) bool {
 	return user.ensureInvited(portal.MainIntent(), portal.MXID, portal.IsPrivateChat(), ignoreCache)
 }
 
-func (portal *Portal) markMessageHandled(discordID string, authorID string, timestamp time.Time, threadID string, senderMXID id.UserID, parts []database.MessagePart) {
+func (portal *Portal) markMessageHandled(discordID string, authorID string, timestamp time.Time, threadID string, senderMXID id.UserID, parts []database.MessagePart) *database.Message {
 	msg := portal.bridge.DB.Message.New()
 	msg.Channel = portal.Key
 	msg.DiscordID = discordID
@@ -595,6 +612,9 @@ func (portal *Portal) markMessageHandled(discordID string, authorID string, time
 	msg.ThreadID = threadID
 	msg.SenderMXID = senderMXID
 	msg.MassInsertParts(parts)
+	msg.MXID = parts[0].MXID
+	msg.AttachmentID = parts[0].AttachmentID
+	return msg
 }
 
 func (portal *Portal) handleDiscordMessageCreate(user *User, msg *discordgo.Message, thread *Thread) {
@@ -619,10 +639,10 @@ func (portal *Portal) handleDiscordMessageCreate(user *User, msg *discordgo.Mess
 		log.Debug().Msg("Dropping duplicate message")
 		return
 	}
-	log.Debug().Msg("Starting handling of Discord message")
 
+	handlingStartTime := time.Now()
 	puppet := portal.bridge.GetPuppetByID(msg.Author.ID)
-	puppet.UpdateInfo(user, msg.Author, msg.WebhookID)
+	puppet.UpdateInfo(user, msg.Author, msg)
 	intent := puppet.IntentFor(portal)
 
 	var discordThreadID string
@@ -642,6 +662,7 @@ func (portal *Portal) handleDiscordMessageCreate(user *User, msg *discordgo.Mess
 	ts, _ := discordgo.SnowflakeTimestamp(msg.ID)
 	parts := portal.convertDiscordMessage(ctx, puppet, intent, msg)
 	dbParts := make([]database.MessagePart, 0, len(parts))
+	eventIDs := zerolog.Dict()
 	for i, part := range parts {
 		if (replyTo != nil || threadRootEvent != "") && part.Content.RelatesTo == nil {
 			part.Content.RelatesTo = &event.RelatesTo{}
@@ -672,13 +693,20 @@ func (portal *Portal) handleDiscordMessageCreate(user *User, msg *discordgo.Mess
 		}
 		lastThreadEvent = resp.EventID
 		dbParts = append(dbParts, database.MessagePart{AttachmentID: part.AttachmentID, MXID: resp.EventID})
+		eventIDs.Str(part.AttachmentID, resp.EventID.String())
 	}
+
+	log = log.With().Dur("handling_time", time.Since(handlingStartTime)).Logger()
 	if len(parts) == 0 {
 		log.Warn().Msg("Unhandled message")
 	} else if len(dbParts) == 0 {
 		log.Warn().Msg("All parts of message failed to send to Matrix")
 	} else {
-		portal.markMessageHandled(msg.ID, msg.Author.ID, ts, discordThreadID, intent.UserID, dbParts)
+		log.Debug().Dict("event_ids", eventIDs).Msg("Finished handling Discord message")
+		firstDBMessage := portal.markMessageHandled(msg.ID, msg.Author.ID, ts, discordThreadID, intent.UserID, dbParts)
+		if msg.Flags == discordgo.MessageFlagsHasThread {
+			portal.bridge.threadFound(ctx, user, firstDBMessage, msg.ID, msg.Thread)
+		}
 	}
 }
 
@@ -702,12 +730,8 @@ func (portal *Portal) getReplyTarget(source *User, threadID string, ref *discord
 	if ref == nil {
 		return nil
 	}
-	isHungry := portal.bridge.Config.Homeserver.Software == bridgeconfig.SoftwareHungry
-	if !isHungry {
-		allowNonExistent = false
-	}
 	// TODO add config option for cross-room replies
-	crossRoomReplies := isHungry
+	crossRoomReplies := portal.bridge.Config.Homeserver.Software == bridgeconfig.SoftwareHungry
 
 	targetPortal := portal
 	if ref.ChannelID != portal.Key.ChannelID && ref.ChannelID != threadID && crossRoomReplies {
@@ -807,11 +831,7 @@ func (portal *Portal) handleDiscordMessageUpdate(user *User, msg *discordgo.Mess
 	}
 
 	if msg.Flags == discordgo.MessageFlagsHasThread {
-		thread := portal.bridge.GetThreadByID(msg.ID, existing[0])
-		log.Debug().Msg("Marked message as thread root")
-		if thread.CreationNoticeMXID == "" {
-			portal.sendThreadCreationNotice(ctx, thread)
-		}
+		portal.bridge.threadFound(ctx, user, existing[0], msg.ID, msg.Thread)
 	}
 
 	if msg.Author == nil {
@@ -849,6 +869,7 @@ func (portal *Portal) handleDiscordMessageUpdate(user *User, msg *discordgo.Mess
 	puppet := portal.bridge.GetPuppetByID(msg.Author.ID)
 	intent := puppet.IntentFor(portal)
 
+	redactions := zerolog.Dict()
 	attachmentMap := map[string]*database.Message{}
 	for _, existingPart := range existing {
 		if existingPart.AttachmentID != "" {
@@ -876,11 +897,13 @@ func (portal *Portal) handleDiscordMessageUpdate(user *User, msg *discordgo.Mess
 		}
 	}
 	for _, deletedAttachment := range attachmentMap {
-		_, err := intent.RedactEvent(portal.MXID, deletedAttachment.MXID)
+		resp, err := intent.RedactEvent(portal.MXID, deletedAttachment.MXID)
 		if err != nil {
-			log.Warn().Err(err).
+			log.Err(err).
 				Str("event_id", deletedAttachment.MXID.String()).
 				Msg("Failed to redact attachment")
+		} else {
+			redactions.Str(deletedAttachment.AttachmentID, resp.EventID.String())
 		}
 		deletedAttachment.Delete()
 	}
@@ -928,6 +951,10 @@ func (portal *Portal) handleDiscordMessageUpdate(user *User, msg *discordgo.Mess
 	if msg.EditedTimestamp != nil {
 		existing[0].UpdateEditTimestamp(*msg.EditedTimestamp)
 	}
+	log.Debug().
+		Str("event_id", resp.EventID.String()).
+		Dict("redacted_attachments", redactions).
+		Msg("Finished handling Discord edit")
 }
 
 func (portal *Portal) handleDiscordMessageDelete(user *User, msg *discordgo.Message) {
@@ -992,7 +1019,7 @@ func (portal *Portal) handleDiscordTyping(evt *discordgo.TypingStart) {
 
 func (portal *Portal) syncParticipant(source *User, participant *discordgo.User, remove bool) {
 	puppet := portal.bridge.GetPuppetByID(participant.ID)
-	puppet.UpdateInfo(source, participant, "")
+	puppet.UpdateInfo(source, participant, nil)
 	log := portal.log.With().
 		Str("participant_id", participant.ID).
 		Str("ghost_mxid", puppet.MXID.String()).
@@ -1019,11 +1046,14 @@ func (portal *Portal) syncParticipant(source *User, participant *discordgo.User,
 func (portal *Portal) syncParticipants(source *User, participants []*discordgo.User) {
 	for _, participant := range participants {
 		puppet := portal.bridge.GetPuppetByID(participant.ID)
-		puppet.UpdateInfo(source, participant, "")
+		puppet.UpdateInfo(source, participant, nil)
 
-		user := portal.bridge.GetUserByID(participant.ID)
-		if user != nil {
-			portal.ensureUserInvited(user, false)
+		var user *User
+		if participant.ID != portal.OtherUserID {
+			user = portal.bridge.GetUserByID(participant.ID)
+			if user != nil {
+				portal.ensureUserInvited(user, false)
+			}
 		}
 
 		if user == nil || !puppet.IntentFor(portal).IsCustomPuppet {
@@ -1099,7 +1129,7 @@ func (portal *Portal) getEvent(mxid id.EventID) (*event.Event, error) {
 	if evt.Type == event.EventEncrypted {
 		decryptedEvt, err := portal.bridge.Crypto.Decrypt(evt)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to decrypt event: %w", err)
 		} else {
 			evt = decryptedEvt
 		}
@@ -1147,7 +1177,7 @@ func (portal *Portal) startThreadFromMatrix(sender *User, threadRoot id.EventID)
 			AutoArchiveDuration: 24 * 60,
 			Type:                discordgo.ChannelTypeGuildPublicThread,
 			Location:            "Message",
-		})
+		}, portal.RefererOptIfUser(sender.Session, "")...)
 		if err != nil {
 			return "", fmt.Errorf("error starting thread: %v", err)
 		}
@@ -1160,7 +1190,7 @@ func (portal *Portal) startThreadFromMatrix(sender *User, threadRoot id.EventID)
 	}
 }
 
-func (portal *Portal) sendErrorMessage(msgType, message string, confirmed bool) id.EventID {
+func (portal *Portal) sendErrorMessage(evt *event.Event, msgType, message string, confirmed bool) id.EventID {
 	if !portal.bridge.Config.Bridge.MessageErrorNotices {
 		return ""
 	}
@@ -1168,10 +1198,18 @@ func (portal *Portal) sendErrorMessage(msgType, message string, confirmed bool)
 	if confirmed {
 		certainty = "was not"
 	}
-	resp, err := portal.sendMatrixMessage(portal.MainIntent(), event.EventMessage, &event.MessageEventContent{
+	if portal.RelayWebhookSecret != "" {
+		message = strings.ReplaceAll(message, portal.RelayWebhookSecret, "<redacted>")
+	}
+	content := &event.MessageEventContent{
 		MsgType: event.MsgNotice,
 		Body:    fmt.Sprintf("\u26a0 Your %s %s bridged: %v", msgType, certainty, message),
-	}, nil, 0)
+	}
+	relatable, ok := evt.Content.Parsed.(event.Relatable)
+	if ok && relatable.OptionalGetRelatesTo().GetThreadParent() != "" {
+		content.GetRelatesTo().SetThread(relatable.OptionalGetRelatesTo().GetThreadParent(), evt.ID)
+	}
+	resp, err := portal.sendMatrixMessage(portal.MainIntent(), event.EventMessage, content, nil, 0)
 	if err != nil {
 		portal.log.Warn().Err(err).Msg("Failed to send bridging error message")
 		return ""
@@ -1336,7 +1374,7 @@ func (portal *Portal) sendMessageMetrics(evt *event.Event, err error, part strin
 			if humanMessage == "" {
 				humanMessage = err.Error()
 			}
-			portal.sendErrorMessage(msgType, humanMessage, isCertain)
+			portal.sendErrorMessage(evt, msgType, humanMessage, isCertain)
 		}
 		portal.sendStatusEvent(evt.ID, err)
 	} else {
@@ -1347,6 +1385,64 @@ func (portal *Portal) sendMessageMetrics(evt *event.Event, err error, part strin
 	}
 }
 
+func (br *DiscordBridge) serveMediaProxy(w http.ResponseWriter, r *http.Request) {
+	vars := mux.Vars(r)
+	mxc := id.ContentURI{
+		Homeserver: vars["server"],
+		FileID:     vars["mediaID"],
+	}
+	checksum, err := base64.RawURLEncoding.DecodeString(vars["checksum"])
+	if err != nil || len(checksum) != 32 {
+		w.WriteHeader(http.StatusNotFound)
+		return
+	}
+	_, expectedChecksum := br.hashMediaProxyURL(mxc)
+	if !hmac.Equal(checksum, expectedChecksum) {
+		w.WriteHeader(http.StatusNotFound)
+		return
+	}
+	reader, err := br.Bot.Download(mxc)
+	if err != nil {
+		br.ZLog.Warn().Err(err).Msg("Failed to download media to proxy")
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	buf := make([]byte, 32*1024)
+	n, err := io.ReadFull(reader, buf)
+	if err != nil && (!errors.Is(err, io.EOF) && !errors.Is(err, io.ErrUnexpectedEOF)) {
+		br.ZLog.Warn().Err(err).Msg("Failed to read first part of media to proxy")
+		w.WriteHeader(http.StatusBadGateway)
+		return
+	}
+	w.Header().Add("Content-Type", http.DetectContentType(buf[:n]))
+	if n < len(buf) {
+		w.Header().Add("Content-Length", strconv.Itoa(n))
+	}
+	w.WriteHeader(http.StatusOK)
+	_, err = w.Write(buf[:n])
+	if err != nil {
+		return
+	}
+	if n >= len(buf) {
+		_, _ = io.CopyBuffer(w, reader, buf)
+	}
+}
+
+func (br *DiscordBridge) hashMediaProxyURL(mxc id.ContentURI) (string, []byte) {
+	path := fmt.Sprintf("/mautrix-discord/avatar/%s/%s/", mxc.Homeserver, mxc.FileID)
+	checksum := hmac.New(sha256.New, []byte(br.Config.Bridge.AvatarProxyKey))
+	checksum.Write([]byte(path))
+	return path, checksum.Sum(nil)
+}
+
+func (br *DiscordBridge) makeMediaProxyURL(mxc id.ContentURI) string {
+	if br.Config.Bridge.PublicAddress == "" {
+		return ""
+	}
+	path, checksum := br.hashMediaProxyURL(mxc)
+	return br.Config.Bridge.PublicAddress + path + base64.RawURLEncoding.EncodeToString(checksum)
+}
+
 func (portal *Portal) getRelayUserMeta(sender *User) (name, avatarURL string) {
 	member := portal.bridge.StateStore.GetMember(portal.MXID, sender.MXID)
 	name = member.Displayname
@@ -1354,11 +1450,8 @@ func (portal *Portal) getRelayUserMeta(sender *User) (name, avatarURL string) {
 		name = sender.MXID.String()
 	}
 	mxc := member.AvatarURL.ParseOrIgnore()
-	if !mxc.IsEmpty() {
-		avatarURL = mautrix.BuildURL(
-			portal.bridge.PublicHSAddress,
-			"_matrix", "media", "v3", "download", mxc.Homeserver, mxc.FileID,
-		).String()
+	if !mxc.IsEmpty() && portal.bridge.Config.Bridge.PublicAddress != "" {
+		avatarURL = portal.bridge.makeMediaProxyURL(mxc)
 	}
 	return
 }
@@ -1387,13 +1480,9 @@ func cutBody(body string) string {
 }
 
 func (portal *Portal) convertReplyMessageToEmbed(eventID id.EventID, url string) (*discordgo.MessageEmbed, error) {
-	evt, err := portal.MainIntent().GetEvent(portal.MXID, eventID)
+	evt, err := portal.getEvent(eventID)
 	if err != nil {
-		return nil, fmt.Errorf("failed to fetch event: %w", err)
-	}
-	err = evt.Content.ParseRaw(evt.Type)
-	if err != nil {
-		return nil, fmt.Errorf("failed to parse event content: %w", err)
+		return nil, fmt.Errorf("failed to get reply target event: %w", err)
 	}
 	content, ok := evt.Content.Parsed.(*event.MessageEventContent)
 	if !ok {
@@ -1418,6 +1507,20 @@ func (portal *Portal) convertReplyMessageToEmbed(eventID id.EventID, url string)
 	return embed, nil
 }
 
+func (portal *Portal) RefererOpt(threadID string) discordgo.RequestOption {
+	if threadID != "" && threadID != portal.Key.ChannelID {
+		return discordgo.WithThreadReferer(portal.GuildID, portal.Key.ChannelID, threadID)
+	}
+	return discordgo.WithChannelReferer(portal.GuildID, portal.Key.ChannelID)
+}
+
+func (portal *Portal) RefererOptIfUser(sess *discordgo.Session, threadID string) []discordgo.RequestOption {
+	if sess == nil || !sess.IsUser {
+		return nil
+	}
+	return []discordgo.RequestOption{portal.RefererOpt(threadID)}
+}
+
 func (portal *Portal) handleMatrixMessage(sender *User, evt *event.Event) {
 	if portal.IsPrivateChat() && sender.DiscordID != portal.Key.Receiver {
 		go portal.sendMessageMetrics(evt, errUserNotReceiver, "Ignoring")
@@ -1463,9 +1566,10 @@ func (portal *Portal) handleMatrixMessage(sender *User, evt *event.Event) {
 		}
 		return
 	} else if threadRoot := content.GetRelatesTo().GetThreadParent(); threadRoot != "" {
-		existingThread := portal.bridge.DB.Thread.GetByMatrixRootMsg(threadRoot)
+		existingThread := portal.bridge.GetThreadByRootMXID(threadRoot)
 		if existingThread != nil {
 			threadID = existingThread.ID
+			existingThread.initialBackfillAttempted = true
 		} else {
 			if isWebhookSend {
 				// TODO start thread with bot?
@@ -1496,9 +1600,12 @@ func (portal *Portal) handleMatrixMessage(sender *User, evt *event.Event) {
 		}
 	}
 
-	if replyToMXID := content.RelatesTo.GetNonFallbackReplyTo(); replyToMXID != "" {
+	replyToMXID := content.RelatesTo.GetNonFallbackReplyTo()
+	var replyToUser id.UserID
+	if replyToMXID != "" {
 		replyTo := portal.bridge.DB.Message.GetByMXID(portal.Key, replyToMXID)
 		if replyTo != nil && replyTo.ThreadID == threadID {
+			replyToUser = replyTo.SenderMXID
 			if isWebhookSend {
 				messageURL := fmt.Sprintf("https://discord.com/channels/%s/%s/%s", portal.GuildID, channelID, replyTo.DiscordID)
 				embed, err := portal.convertReplyMessageToEmbed(replyTo.MXID, messageURL)
@@ -1518,6 +1625,9 @@ func (portal *Portal) handleMatrixMessage(sender *User, evt *event.Event) {
 	switch content.MsgType {
 	case event.MsgText, event.MsgEmote, event.MsgNotice:
 		sendReq.Content, sendReq.AllowedMentions = portal.parseMatrixHTML(content)
+		if content.MsgType == event.MsgEmote {
+			sendReq.Content = fmt.Sprintf("_%s_", sendReq.Content)
+		}
 	case event.MsgAudio, event.MsgFile, event.MsgImage, event.MsgVideo:
 		data, err := downloadMatrixAttachment(portal.MainIntent(), content)
 		if err != nil {
@@ -1530,6 +1640,10 @@ func (portal *Portal) handleMatrixMessage(sender *User, evt *event.Event) {
 			sendReq.Content, sendReq.AllowedMentions = portal.parseMatrixHTML(content)
 		}
 
+		if evt.Content.Raw["page.codeberg.everypizza.msc4193.spoiler"] == true {
+			filename = "SPOILER_" + filename
+		}
+
 		if portal.bridge.Config.Bridge.UseDiscordCDNUpload && !isWebhookSend && sess.IsUser {
 			att := &discordgo.MessageAttachment{
 				ID:          "0",
@@ -1543,14 +1657,14 @@ func (portal *Portal) handleMatrixMessage(sender *User, evt *event.Event) {
 					Name: att.Filename,
 					ID:   sender.NextDiscordUploadID(),
 				}},
-			})
+			}, portal.RefererOpt(threadID))
 			if err != nil {
 				go portal.sendMessageMetrics(evt, err, "Error preparing to reupload media in")
 				return
 			}
 			prepared := prep.Attachments[0]
 			att.UploadedFilename = prepared.UploadFilename
-			err = uploadDiscordAttachment(prepared.UploadURL, data)
+			err = uploadDiscordAttachment(sender.Session.Client, prepared.UploadURL, data)
 			if err != nil {
 				go portal.sendMessageMetrics(evt, err, "Error reuploading media in")
 				return
@@ -1566,10 +1680,22 @@ func (portal *Portal) handleMatrixMessage(sender *User, evt *event.Event) {
 		go portal.sendMessageMetrics(evt, fmt.Errorf("%w %q", errUnknownMsgType, content.MsgType), "Ignoring")
 		return
 	}
+	silentReply := content.Mentions != nil && replyToMXID != "" &&
+		(len(content.Mentions.UserIDs) == 0 || (replyToUser != "" && !slices.Contains(content.Mentions.UserIDs, replyToUser)))
+	if silentReply && sendReq.AllowedMentions != nil {
+		sendReq.AllowedMentions.RepliedUser = false
+	}
 	if !isWebhookSend {
 		// AllowedMentions must not be set for real users, and it's also not that useful for personal bots.
 		// It's only important for relaying, where the webhook may have higher permissions than the user on Matrix.
-		sendReq.AllowedMentions = nil
+		if silentReply {
+			sendReq.AllowedMentions = &discordgo.MessageAllowedMentions{
+				Parse:       []discordgo.AllowedMentionType{discordgo.AllowedMentionTypeUsers, discordgo.AllowedMentionTypeRoles, discordgo.AllowedMentionTypeEveryone},
+				RepliedUser: false,
+			}
+		} else {
+			sendReq.AllowedMentions = nil
+		}
 	} else if strings.Contains(sendReq.Content, "@everyone") || strings.Contains(sendReq.Content, "@here") {
 		powerLevels, err := portal.MainIntent().PowerLevels(portal.MXID)
 		if err != nil {
@@ -1584,20 +1710,20 @@ func (portal *Portal) handleMatrixMessage(sender *User, evt *event.Event) {
 	var msg *discordgo.Message
 	var err error
 	if !isWebhookSend {
-		msg, err = sess.ChannelMessageSendComplex(channelID, &sendReq)
+		msg, err = sess.ChannelMessageSendComplex(channelID, &sendReq, portal.RefererOptIfUser(sess, threadID)...)
 	} else {
 		username, avatarURL := portal.getRelayUserMeta(sender)
 		msg, err = relayClient.WebhookThreadExecute(portal.RelayWebhookID, portal.RelayWebhookSecret, true, threadID, &discordgo.WebhookParams{
 			Content:         sendReq.Content,
 			Username:        username,
 			AvatarURL:       avatarURL,
-			TTS:             sendReq.TTS,
 			Files:           sendReq.Files,
 			Components:      sendReq.Components,
 			Embeds:          sendReq.Embeds,
 			AllowedMentions: sendReq.AllowedMentions,
 		})
 	}
+	sender.handlePossible40002(err)
 	go portal.sendMessageMetrics(evt, err, "Error sending")
 	if msg != nil {
 		dbMsg := portal.bridge.DB.Message.New()
@@ -1700,7 +1826,7 @@ func (portal *Portal) cleanup(puppetsOnly bool) {
 		return
 	}
 	intent := portal.MainIntent()
-	if portal.bridge.SpecVersions.UnstableFeatures["com.beeper.room_yeeting"] {
+	if portal.bridge.SpecVersions.Supports(mautrix.BeeperFeatureRoomYeeting) {
 		err := intent.BeeperDeleteRoom(portal.MXID)
 		if err != nil && !errors.Is(err, mautrix.MNotFound) {
 			portal.log.Err(err).Msg("Failed to delete room using hungryserv yeet endpoint")
@@ -1809,13 +1935,15 @@ func (portal *Portal) handleMatrixReaction(sender *User, evt *event.Event) {
 	emojiID := reaction.RelatesTo.Key
 	if strings.HasPrefix(emojiID, "mxc://") {
 		uri, _ := id.ParseContentURI(emojiID)
-		emojiFile := portal.bridge.DB.File.GetEmojiByMXC(uri)
-		if emojiFile == nil || emojiFile.ID == "" || emojiFile.EmojiName == "" {
+		emojiInfo := portal.bridge.DMA.GetEmojiInfo(uri)
+		if emojiInfo != nil {
+			emojiID = fmt.Sprintf("%s:%d", emojiInfo.Name, emojiInfo.EmojiID)
+		} else if emojiFile := portal.bridge.DB.File.GetEmojiByMXC(uri); emojiFile != nil && emojiFile.ID != "" && emojiFile.EmojiName != "" {
+			emojiID = fmt.Sprintf("%s:%s", emojiFile.EmojiName, emojiFile.ID)
+		} else {
 			go portal.sendMessageMetrics(evt, fmt.Errorf("%w %s", errUnknownEmoji, emojiID), "Ignoring")
 			return
 		}
-
-		emojiID = fmt.Sprintf("%s:%s", emojiFile.EmojiName, emojiFile.ID)
 	} else {
 		emojiID = variationselector.FullyQualify(emojiID)
 	}
@@ -1830,7 +1958,7 @@ func (portal *Portal) handleMatrixReaction(sender *User, evt *event.Event) {
 		return
 	}
 
-	err := sender.Session.MessageReactionAdd(msg.DiscordProtoChannelID(), msg.DiscordID, emojiID)
+	err := sender.Session.MessageReactionAddUser(portal.GuildID, msg.DiscordProtoChannelID(), msg.DiscordID, emojiID)
 	go portal.sendMessageMetrics(evt, err, "Error sending")
 	if err == nil {
 		dbReaction := portal.bridge.DB.Reaction.New()
@@ -1848,7 +1976,7 @@ func (portal *Portal) handleMatrixReaction(sender *User, evt *event.Event) {
 func (portal *Portal) handleDiscordReaction(user *User, reaction *discordgo.MessageReaction, add bool, thread *Thread, member *discordgo.Member) {
 	puppet := portal.bridge.GetPuppetByID(reaction.UserID)
 	if member != nil {
-		puppet.UpdateInfo(user, member.User, "")
+		puppet.UpdateInfo(user, member.User, nil)
 	}
 	intent := puppet.IntentFor(portal)
 
@@ -1966,7 +2094,7 @@ func (portal *Portal) handleMatrixRedaction(sender *User, evt *event.Event) {
 		var err error
 		// TODO add support for deleting individual attachments from messages
 		if sess != nil {
-			err = sess.ChannelMessageDelete(message.DiscordProtoChannelID(), message.DiscordID)
+			err = sess.ChannelMessageDelete(message.DiscordProtoChannelID(), message.DiscordID, portal.RefererOptIfUser(sess, message.ThreadID)...)
 		} else {
 			// TODO pre-validate that the message was sent by the webhook?
 			err = relayClient.WebhookMessageDelete(portal.RelayWebhookID, portal.RelayWebhookSecret, message.DiscordID)
@@ -1981,7 +2109,7 @@ func (portal *Portal) handleMatrixRedaction(sender *User, evt *event.Event) {
 	if sess != nil {
 		reaction := portal.bridge.DB.Reaction.GetByMXID(evt.Redacts)
 		if reaction != nil && reaction.Channel == portal.Key {
-			err := sess.MessageReactionRemove(reaction.DiscordProtoChannelID(), reaction.MessageID, reaction.EmojiName, reaction.Sender)
+			err := sess.MessageReactionRemoveUser(portal.GuildID, reaction.DiscordProtoChannelID(), reaction.MessageID, reaction.EmojiName, reaction.Sender)
 			go portal.sendMessageMetrics(evt, err, "Error sending")
 			if err == nil {
 				reaction.Delete()
@@ -2050,7 +2178,7 @@ func (portal *Portal) HandleMatrixReadReceipt(brUser bridge.User, eventID id.Eve
 			Msg("Dropping read receipt: thread ID mismatch")
 		return
 	}
-	resp, err := sender.Session.ChannelMessageAckNoToken(msg.DiscordProtoChannelID(), msg.DiscordID)
+	resp, err := sender.Session.ChannelMessageAckNoToken(msg.DiscordProtoChannelID(), msg.DiscordID, portal.RefererOpt(msg.DiscordProtoChannelID()))
 	if err != nil {
 		log.Err(err).Msg("Failed to send read receipt to Discord")
 	} else if resp.Token != nil {
@@ -2084,7 +2212,7 @@ func (portal *Portal) HandleMatrixTyping(newTyping []id.UserID) {
 		user := portal.bridge.GetUserByMXID(userID)
 		if user != nil && user.Session != nil {
 			user.ViewingChannel(portal)
-			err := user.Session.ChannelTyping(portal.Key.ChannelID)
+			err := user.Session.ChannelTyping(portal.Key.ChannelID, portal.RefererOptIfUser(user.Session, "")...)
 			if err != nil {
 				portal.log.Warn().Err(err).
 					Str("user_id", user.MXID.String()).
@@ -2296,11 +2424,19 @@ func (portal *Portal) ExpectedSpaceID() id.RoomID {
 	return ""
 }
 
-func (portal *Portal) updateSpace() bool {
+func (portal *Portal) updateSpace(source *User) bool {
 	if portal.MXID == "" {
 		return false
 	}
 	if portal.Parent != nil {
+		if portal.Parent.MXID != "" {
+			portal.log.Warn().Str("parent_id", portal.ParentID).Msg("Parent portal has no Matrix room, creating...")
+			err := portal.Parent.CreateMatrixRoom(source, nil)
+			if err != nil {
+				portal.log.Err(err).Str("parent_id", portal.ParentID).Msg("Failed to create Matrix room for parent")
+				return false
+			}
+		}
 		return portal.addToSpace(portal.Parent.MXID)
 	} else if portal.Guild != nil {
 		return portal.addToSpace(portal.Guild.MXID)
@@ -2391,7 +2527,7 @@ func (portal *Portal) UpdateInfo(source *User, meta *discordgo.Channel) *discord
 	changed = portal.UpdateParent(meta.ParentID) || changed
 	// Private channels are added to the space in User.handlePrivateChannel
 	if portal.GuildID != "" && portal.MXID != "" && portal.ExpectedSpaceID() != portal.InSpace {
-		changed = portal.updateSpace() || changed
+		changed = portal.updateSpace(source) || changed
 	}
 	if changed {
 		portal.UpdateBridgeInfo()

portal_convert.go

@@ -18,6 +18,8 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	"html"
 	"strconv"
@@ -27,12 +29,13 @@ import (
 	"github.com/bwmarrin/discordgo"
 	"github.com/rs/zerolog"
 	"golang.org/x/exp/slices"
-	"maunium.net/go/mautrix/id"
-
 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/appservice"
 	"maunium.net/go/mautrix/event"
 	"maunium.net/go/mautrix/format"
+	"maunium.net/go/mautrix/id"
+
+	"go.mau.fi/mautrix-discord/database"
 )
 
 type ConvertedMessage struct {
@@ -82,6 +85,9 @@ func (portal *Portal) convertDiscordFile(ctx context.Context, typeName string, i
 }
 
 func (portal *Portal) cleanupConvertedStickerInfo(content *event.MessageEventContent) {
+	if content.Info == nil {
+		return
+	}
 	if content.Info.Width == 0 && content.Info.Height == 0 {
 		content.Info.Width = DiscordStickerSize
 		content.Info.Height = DiscordStickerSize
@@ -99,21 +105,17 @@ func (portal *Portal) cleanupConvertedStickerInfo(content *event.MessageEventCon
 	}
 }
 
-func (portal *Portal) convertDiscordSticker(ctx context.Context, intent *appservice.IntentAPI, sticker *discordgo.Sticker) *ConvertedMessage {
-	var mime, ext string
+func (portal *Portal) convertDiscordSticker(ctx context.Context, intent *appservice.IntentAPI, sticker *discordgo.StickerItem) *ConvertedMessage {
+	var mime string
 	switch sticker.FormatType {
 	case discordgo.StickerFormatTypePNG:
 		mime = "image/png"
-		ext = "png"
 	case discordgo.StickerFormatTypeAPNG:
 		mime = "image/apng"
-		ext = "png"
 	case discordgo.StickerFormatTypeLottie:
 		mime = "application/json"
-		ext = "json"
 	case discordgo.StickerFormatTypeGIF:
 		mime = "image/gif"
-		ext = "gif"
 	default:
 		zerolog.Ctx(ctx).Warn().
 			Int("sticker_format", int(sticker.FormatType)).
@@ -127,8 +129,9 @@ func (portal *Portal) convertDiscordSticker(ctx context.Context, intent *appserv
 		},
 	}
 
-	mxc := portal.bridge.Config.Bridge.MediaPatterns.Sticker(sticker.ID, ext)
-	if mxc.IsEmpty() {
+	mxc := portal.bridge.DMA.StickerMXC(sticker.ID, sticker.FormatType)
+	// TODO add config option to use direct media even for lottie stickers
+	if mxc.IsEmpty() && mime != "application/json" {
 		content = portal.convertDiscordFile(ctx, "sticker", intent, sticker.ID, sticker.URL(), content)
 	} else {
 		content.URL = mxc.CUString()
@@ -141,7 +144,7 @@ func (portal *Portal) convertDiscordSticker(ctx context.Context, intent *appserv
 	}
 }
 
-func (portal *Portal) convertDiscordAttachment(ctx context.Context, intent *appservice.IntentAPI, att *discordgo.MessageAttachment) *ConvertedMessage {
+func (portal *Portal) convertDiscordAttachment(ctx context.Context, intent *appservice.IntentAPI, messageID string, att *discordgo.MessageAttachment) *ConvertedMessage {
 	content := &event.MessageEventContent{
 		Body: att.Filename,
 		Info: &event.FileInfo{
@@ -153,24 +156,27 @@ func (portal *Portal) convertDiscordAttachment(ctx context.Context, intent *apps
 			Size: att.Size,
 		},
 	}
+
+	var extra = make(map[string]any)
+
+	if strings.HasPrefix(att.Filename, "SPOILER_") {
+		extra["page.codeberg.everypizza.msc4193.spoiler"] = true
+	}
+
 	if att.Description != "" {
 		content.Body = att.Description
 		content.FileName = att.Filename
 	}
 
-	var extra map[string]any
-
 	switch strings.ToLower(strings.Split(att.ContentType, "/")[0]) {
 	case "audio":
 		content.MsgType = event.MsgAudio
 		if att.Waveform != nil {
 			// TODO convert waveform
-			extra = map[string]any{
-				"org.matrix.1767.audio": map[string]any{
-					"duration": int(att.DurationSeconds * 1000),
-				},
-				"org.matrix.msc3245.voice": map[string]any{},
+			extra["org.matrix.msc1767.audio"] = map[string]any{
+				"duration": int(att.DurationSeconds * 1000),
 			}
+			extra["org.matrix.msc3245.voice"] = map[string]any{}
 		}
 	case "image":
 		content.MsgType = event.MsgImage
@@ -179,7 +185,7 @@ func (portal *Portal) convertDiscordAttachment(ctx context.Context, intent *apps
 	default:
 		content.MsgType = event.MsgFile
 	}
-	mxc := portal.bridge.Config.Bridge.MediaPatterns.Attachment(portal.Key.ChannelID, att.ID, att.Filename)
+	mxc := portal.bridge.DMA.AttachmentMXC(portal.Key.ChannelID, messageID, att)
 	if mxc.IsEmpty() {
 		content = portal.convertDiscordFile(ctx, "attachment", intent, att.ID, att.URL, content)
 	} else {
@@ -198,8 +204,18 @@ func (portal *Portal) convertDiscordVideoEmbed(ctx context.Context, intent *apps
 	var proxyURL string
 	if embed.Video != nil {
 		proxyURL = embed.Video.ProxyURL
-	} else {
+	} else if embed.Thumbnail != nil {
 		proxyURL = embed.Thumbnail.ProxyURL
+	} else {
+		zerolog.Ctx(ctx).Warn().Str("embed_url", embed.URL).Msg("No video or thumbnail proxy URL found in embed")
+		return &ConvertedMessage{
+			AttachmentID: attachmentID,
+			Type:         event.EventMessage,
+			Content: &event.MessageEventContent{
+				Body:    "Failed to bridge media: no video or thumbnail proxy URL found in embed",
+				MsgType: event.MsgNotice,
+			},
+		}
 	}
 	dbFile, err := portal.bridge.copyAttachmentToMatrix(intent, proxyURL, portal.Encrypted, NoMeta)
 	if err != nil {
@@ -243,6 +259,7 @@ func (portal *Portal) convertDiscordVideoEmbed(ctx context.Context, intent *apps
 	if content.MsgType == event.MsgVideo && embed.Type == discordgo.EmbedTypeGifv {
 		extra["info"] = map[string]any{
 			"fi.mau.discord.gifv":  true,
+			"fi.mau.gif":           true,
 			"fi.mau.loop":          true,
 			"fi.mau.autoplay":      true,
 			"fi.mau.hide_controls": true,
@@ -274,7 +291,7 @@ func (portal *Portal) convertDiscordMessage(ctx context.Context, puppet *Puppet,
 		}
 		handledIDs[att.ID] = struct{}{}
 		log := log.With().Str("attachment_id", att.ID).Logger()
-		if part := portal.convertDiscordAttachment(log.WithContext(ctx), intent, att); part != nil {
+		if part := portal.convertDiscordAttachment(log.WithContext(ctx), intent, msg.ID, att); part != nil {
 			parts = append(parts, part)
 		}
 	}
@@ -308,6 +325,12 @@ func (portal *Portal) convertDiscordMessage(ctx context.Context, puppet *Puppet,
 			parts = append(parts, part)
 		}
 	}
+	if len(parts) == 0 && msg.Thread != nil {
+		parts = append(parts, &ConvertedMessage{Type: event.EventMessage, Content: &event.MessageEventContent{
+			MsgType: event.MsgText,
+			Body:    fmt.Sprintf("Created a thread: %s", msg.Thread.Name),
+		}})
+	}
 	for _, part := range parts {
 		puppet.addWebhookMeta(part, msg)
 		puppet.addMemberMeta(part, msg)
@@ -323,30 +346,25 @@ func (puppet *Puppet) addMemberMeta(part *ConvertedMessage, msg *discordgo.Messa
 		part.Extra = make(map[string]any)
 	}
 	var avatarURL id.ContentURI
+	var discordAvatarURL string
 	if msg.Member.Avatar != "" {
 		var err error
-		avatarURL, err = puppet.bridge.reuploadUserAvatar(puppet.DefaultIntent(), msg.GuildID, msg.Author.ID, msg.Author.Avatar)
+		avatarURL, discordAvatarURL, err = puppet.bridge.reuploadUserAvatar(puppet.DefaultIntent(), msg.GuildID, msg.Author.ID, msg.Member.Avatar)
 		if err != nil {
 			puppet.log.Warn().Err(err).
-				Str("avatar_id", msg.Author.Avatar).
+				Str("avatar_id", msg.Member.Avatar).
 				Msg("Failed to reupload guild user avatar")
 		}
 	}
-	var discordAvararURL string
-	if msg.Member.Avatar != "" {
-		msg.Member.User = msg.Author
-		discordAvararURL = msg.Member.AvatarURL("")
-	}
 	part.Extra["fi.mau.discord.guild_member_metadata"] = map[string]any{
 		"nick":       msg.Member.Nick,
 		"avatar_id":  msg.Member.Avatar,
-		"avatar_url": discordAvararURL,
+		"avatar_url": discordAvatarURL,
 		"avatar_mxc": avatarURL.String(),
 	}
 	if msg.Member.Nick != "" || !avatarURL.IsEmpty() {
 		perMessageProfile := map[string]any{
-			"is_multiple_users": false,
-
+			"id":          fmt.Sprintf("%s_%s", msg.GuildID, msg.Author.ID),
 			"displayname": msg.Member.Nick,
 			"avatar_url":  avatarURL.String(),
 		}
@@ -370,7 +388,7 @@ func (puppet *Puppet) addWebhookMeta(part *ConvertedMessage, msg *discordgo.Mess
 	var avatarURL id.ContentURI
 	if msg.Author.Avatar != "" {
 		var err error
-		avatarURL, err = puppet.bridge.reuploadUserAvatar(puppet.DefaultIntent(), "", msg.Author.ID, msg.Author.Avatar)
+		avatarURL, _, err = puppet.bridge.reuploadUserAvatar(puppet.DefaultIntent(), "", msg.Author.ID, msg.Author.Avatar)
 		if err != nil {
 			puppet.log.Warn().Err(err).
 				Str("avatar_id", msg.Author.Avatar).
@@ -384,11 +402,21 @@ func (puppet *Puppet) addWebhookMeta(part *ConvertedMessage, msg *discordgo.Mess
 		"avatar_url": msg.Author.AvatarURL(""),
 		"avatar_mxc": avatarURL.String(),
 	}
+	profileID := sha256.Sum256(fmt.Appendf(nil, "%s:%s", msg.Author.Username, msg.Author.Avatar))
+	hasFallback := false
+	if msg.ApplicationID == "" &&
+		puppet.bridge.Config.Bridge.PrefixWebhookMessages &&
+		(part.Content.MsgType == event.MsgText || part.Content.MsgType == event.MsgNotice || (part.Content.FileName != "" && part.Content.FileName != part.Content.Body)) {
+		part.Content.EnsureHasHTML()
+		part.Content.Body = fmt.Sprintf("%s: %s", msg.Author.Username, part.Content.Body)
+		part.Content.FormattedBody = fmt.Sprintf("<strong data-mx-profile-fallback>%s: </strong>%s", html.EscapeString(msg.Author.Username), part.Content.FormattedBody)
+		hasFallback = true
+	}
 	part.Extra["com.beeper.per_message_profile"] = map[string]any{
-		"is_multiple_users": true,
-
-		"avatar_url":  avatarURL.String(),
-		"displayname": msg.Author.Username,
+		"id":           hex.EncodeToString(profileID[:]),
+		"avatar_url":   avatarURL.String(),
+		"displayname":  msg.Author.Username,
+		"has_fallback": hasFallback,
 	}
 }
 
@@ -616,9 +644,14 @@ func getEmbedType(msg *discordgo.Message, embed *discordgo.MessageEmbed) BridgeE
 }
 
 func isPlainGifMessage(msg *discordgo.Message) bool {
-	return len(msg.Embeds) == 1 && msg.Embeds[0].URL == msg.Content &&
-		((msg.Embeds[0].Type == discordgo.EmbedTypeGifv && msg.Embeds[0].Video != nil) ||
-			(msg.Embeds[0].Type == discordgo.EmbedTypeImage && msg.Embeds[0].Image == nil && msg.Embeds[0].Thumbnail != nil))
+	if len(msg.Embeds) != 1 {
+		return false
+	}
+	embed := msg.Embeds[0]
+	isGifVideo := embed.Type == discordgo.EmbedTypeGifv && embed.Video != nil
+	isGifImage := embed.Type == discordgo.EmbedTypeImage && embed.Image == nil && embed.Thumbnail != nil && embed.Title == ""
+	contentIsOnlyURL := msg.Content == embed.URL || discordLinkRegexFull.MatchString(msg.Content)
+	return contentIsOnlyURL && (isGifVideo || isGifImage)
 }
 
 func (portal *Portal) convertDiscordMentions(msg *discordgo.Message, syncGhosts bool) *event.Mentions {
@@ -626,7 +659,7 @@ func (portal *Portal) convertDiscordMentions(msg *discordgo.Message, syncGhosts
 	for _, mention := range msg.Mentions {
 		puppet := portal.bridge.GetPuppetByID(mention.ID)
 		if syncGhosts {
-			puppet.UpdateInfo(nil, mention, "")
+			puppet.UpdateInfo(nil, mention, nil)
 		}
 		user := portal.bridge.GetUserByID(mention.ID)
 		if user != nil {
@@ -643,6 +676,12 @@ func (portal *Portal) convertDiscordMentions(msg *discordgo.Message, syncGhosts
 	return &matrixMentions
 }
 
+const forwardTemplateHTML = `<blockquote>
+<p>↷ Forwarded</p>
+%s
+<p>%s</p>
+</blockquote>`
+
 func (portal *Portal) convertDiscordTextMessage(ctx context.Context, intent *appservice.IntentAPI, msg *discordgo.Message) *ConvertedMessage {
 	log := zerolog.Ctx(ctx)
 	if msg.Type == discordgo.MessageTypeCall {
@@ -659,11 +698,41 @@ func (portal *Portal) convertDiscordTextMessage(ctx context.Context, intent *app
 	var htmlParts []string
 	if msg.Interaction != nil {
 		puppet := portal.bridge.GetPuppetByID(msg.Interaction.User.ID)
-		puppet.UpdateInfo(nil, msg.Interaction.User, "")
+		puppet.UpdateInfo(nil, msg.Interaction.User, nil)
 		htmlParts = append(htmlParts, fmt.Sprintf(msgInteractionTemplateHTML, puppet.MXID, puppet.Name, msg.Interaction.Name))
 	}
 	if msg.Content != "" && !isPlainGifMessage(msg) {
-		htmlParts = append(htmlParts, portal.renderDiscordMarkdownOnlyHTML(msg.Content, false))
+		htmlParts = append(htmlParts, portal.renderDiscordMarkdownOnlyHTML(msg.Content, true))
+	} else if msg.MessageReference != nil &&
+		msg.MessageReference.Type == discordgo.MessageReferenceTypeForward &&
+		len(msg.MessageSnapshots) > 0 &&
+		msg.MessageSnapshots[0].Message != nil {
+		forwardedHTML := portal.renderDiscordMarkdownOnlyHTMLNoUnwrap(msg.MessageSnapshots[0].Message.Content, true)
+		msgTSText := msg.MessageSnapshots[0].Message.Timestamp.Format("2006-01-02 15:04 MST")
+		origLink := fmt.Sprintf("unknown channel • %s", msgTSText)
+		forwardedFromPortal := portal.bridge.GetExistingPortalByID(database.NewPortalKey(msg.MessageReference.ChannelID, ""))
+		if forwardedFromPortal != nil {
+			origMessage := portal.bridge.DB.Message.GetFirstByDiscordID(forwardedFromPortal.Key, msg.MessageReference.MessageID)
+			if origMessage != nil {
+				origLink = fmt.Sprintf(
+					`<a href="%s">#%s • %s</a>`,
+					forwardedFromPortal.MXID.EventURI(origMessage.MXID, portal.bridge.AS.HomeserverDomain),
+					forwardedFromPortal.PlainName,
+					msgTSText,
+				)
+			} else if forwardedFromPortal.MXID != "" {
+				origLink = fmt.Sprintf(
+					`<a href="%s">#%s</a> • %s`,
+					forwardedFromPortal.MXID.URI(portal.bridge.AS.HomeserverDomain),
+					forwardedFromPortal.PlainName,
+					msgTSText,
+				)
+			} else if forwardedFromPortal.PlainName != "" {
+				origLink = fmt.Sprintf("%s • %s", forwardedFromPortal.PlainName, msgTSText)
+			}
+		}
+
+		htmlParts = append(htmlParts, fmt.Sprintf(forwardTemplateHTML, forwardedHTML, origLink))
 	}
 	previews := make([]*BeeperLinkPreview, 0)
 	for i, embed := range msg.Embeds {
@@ -706,11 +775,5 @@ func (portal *Portal) convertDiscordTextMessage(ctx context.Context, intent *app
 		"com.beeper.linkpreviews": previews,
 	}
 
-	if msg.WebhookID != "" && portal.bridge.Config.Bridge.PrefixWebhookMessages {
-		content.EnsureHasHTML()
-		content.Body = fmt.Sprintf("%s: %s", msg.Author.Username, content.Body)
-		content.FormattedBody = fmt.Sprintf("<strong>%s</strong>: %s", html.EscapeString(msg.Author.Username), content.FormattedBody)
-	}
-
 	return &ConvertedMessage{Type: event.EventMessage, Content: &content, Extra: extraContent}
 }

provisioning.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	_ "net/http/pprof"
 	"strings"
 	"time"
 
@@ -71,6 +72,13 @@ func newProvisioningAPI(br *DiscordBridge) *ProvisioningAPI {
 	r.HandleFunc("/v1/guilds/{guildID}", p.guildsBridge).Methods(http.MethodPost)
 	r.HandleFunc("/v1/guilds/{guildID}", p.guildsUnbridge).Methods(http.MethodDelete)
 
+	if p.bridge.Config.Bridge.Provisioning.DebugEndpoints {
+		p.log.Debugln("Enabling debug API at /debug")
+		r := p.bridge.AS.Router.PathPrefix("/debug").Subrouter()
+		r.Use(p.authMiddleware)
+		r.PathPrefix("/pprof").Handler(http.DefaultServeMux)
+	}
+
 	return p
 }
 

puppet.go

@@ -9,9 +9,9 @@ import (
 	"github.com/bwmarrin/discordgo"
 	"github.com/rs/zerolog"
 
+	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/appservice"
 	"maunium.net/go/mautrix/bridge"
-	"maunium.net/go/mautrix/bridge/bridgeconfig"
 	"maunium.net/go/mautrix/id"
 
 	"go.mau.fi/mautrix-discord/database"
@@ -195,7 +195,7 @@ func (puppet *Puppet) updatePortalMeta(meta func(portal *Portal)) {
 }
 
 func (puppet *Puppet) UpdateName(info *discordgo.User) bool {
-	newName := puppet.bridge.Config.Bridge.FormatDisplayname(info, puppet.IsWebhook)
+	newName := puppet.bridge.Config.Bridge.FormatDisplayname(info, puppet.IsWebhook, puppet.IsApplication)
 	if puppet.Name == newName && puppet.NameSet {
 		return false
 	}
@@ -216,34 +216,32 @@ func (puppet *Puppet) UpdateName(info *discordgo.User) bool {
 	return true
 }
 
-func (br *DiscordBridge) reuploadUserAvatar(intent *appservice.IntentAPI, guildID, userID, avatarID string) (id.ContentURI, error) {
-	var downloadURL, ext string
+func (br *DiscordBridge) reuploadUserAvatar(intent *appservice.IntentAPI, guildID, userID, avatarID string) (id.ContentURI, string, error) {
+	var downloadURL string
 	if guildID == "" {
-		downloadURL = discordgo.EndpointUserAvatar(userID, avatarID)
-		ext = "png"
 		if strings.HasPrefix(avatarID, "a_") {
 			downloadURL = discordgo.EndpointUserAvatarAnimated(userID, avatarID)
-			ext = "gif"
+		} else {
+			downloadURL = discordgo.EndpointUserAvatar(userID, avatarID)
 		}
 	} else {
-		downloadURL = discordgo.EndpointGuildMemberAvatar(guildID, userID, avatarID)
-		ext = "png"
 		if strings.HasPrefix(avatarID, "a_") {
 			downloadURL = discordgo.EndpointGuildMemberAvatarAnimated(guildID, userID, avatarID)
-			ext = "gif"
+		} else {
+			downloadURL = discordgo.EndpointGuildMemberAvatar(guildID, userID, avatarID)
 		}
 	}
-	url := br.Config.Bridge.MediaPatterns.Avatar(userID, avatarID, ext)
+	url := br.DMA.AvatarMXC(guildID, userID, avatarID)
 	if !url.IsEmpty() {
-		return url, nil
+		return url, downloadURL, nil
 	}
 	copied, err := br.copyAttachmentToMatrix(intent, downloadURL, false, AttachmentMeta{
 		AttachmentID: fmt.Sprintf("avatar/%s/%s/%s", guildID, userID, avatarID),
 	})
 	if err != nil {
-		return url, err
+		return id.ContentURI{}, downloadURL, err
 	}
-	return copied.MXC, nil
+	return copied.MXC, downloadURL, nil
 }
 
 func (puppet *Puppet) UpdateAvatar(info *discordgo.User) bool {
@@ -260,7 +258,7 @@ func (puppet *Puppet) UpdateAvatar(info *discordgo.User) bool {
 	puppet.AvatarURL = id.ContentURI{}
 
 	if puppet.Avatar != "" && (puppet.AvatarURL.IsEmpty() || avatarChanged) {
-		url, err := puppet.bridge.reuploadUserAvatar(puppet.DefaultIntent(), "", info.ID, puppet.Avatar)
+		url, _, err := puppet.bridge.reuploadUserAvatar(puppet.DefaultIntent(), "", info.ID, puppet.Avatar)
 		if err != nil {
 			puppet.log.Warn().Err(err).Str("avatar_id", puppet.Avatar).Msg("Failed to reupload user avatar")
 			return true
@@ -283,7 +281,7 @@ func (puppet *Puppet) UpdateAvatar(info *discordgo.User) bool {
 	return true
 }
 
-func (puppet *Puppet) UpdateInfo(source *User, info *discordgo.User, webhookID string) {
+func (puppet *Puppet) UpdateInfo(source *User, info *discordgo.User, message *discordgo.Message) {
 	puppet.syncLock.Lock()
 	defer puppet.syncLock.Unlock()
 
@@ -306,9 +304,24 @@ func (puppet *Puppet) UpdateInfo(source *User, info *discordgo.User, webhookID s
 	}
 
 	changed := false
-	if webhookID != "" && webhookID == info.ID && !puppet.IsWebhook {
-		puppet.IsWebhook = true
-		changed = true
+	if message != nil {
+		if message.WebhookID != "" && message.ApplicationID == "" && !puppet.IsWebhook {
+			puppet.log.Debug().
+				Str("message_id", message.ID).
+				Str("webhook_id", message.WebhookID).
+				Msg("Found webhook ID in message, marking ghost as a webhook")
+			puppet.IsWebhook = true
+			changed = true
+		}
+		if message.ApplicationID != "" && !puppet.IsApplication {
+			puppet.log.Debug().
+				Str("message_id", message.ID).
+				Str("application_id", message.ApplicationID).
+				Msg("Found application ID in message, marking ghost as an application")
+			puppet.IsApplication = true
+			puppet.IsWebhook = false
+			changed = true
+		}
 	}
 	changed = puppet.UpdateContactInfo(info) || changed
 	changed = puppet.UpdateName(info) || changed
@@ -345,12 +358,16 @@ func (puppet *Puppet) UpdateContactInfo(info *discordgo.User) bool {
 }
 
 func (puppet *Puppet) ResendContactInfo() {
-	if puppet.bridge.Config.Homeserver.Software != bridgeconfig.SoftwareHungry || puppet.ContactInfoSet {
+	if !puppet.bridge.SpecVersions.Supports(mautrix.BeeperFeatureArbitraryProfileMeta) || puppet.ContactInfoSet {
 		return
 	}
+	discordUsername := puppet.Username
+	if puppet.Discriminator != "0" {
+		discordUsername += "#" + puppet.Discriminator
+	}
 	contactInfo := map[string]any{
 		"com.beeper.bridge.identifiers": []string{
-			fmt.Sprintf("discord:%s#%s", puppet.Username, puppet.Discriminator),
+			fmt.Sprintf("discord:%s", discordUsername),
 		},
 		"com.beeper.bridge.remote_id":      puppet.ID,
 		"com.beeper.bridge.service":        puppet.bridge.BeeperServiceName,

thread.go

@@ -1,10 +1,13 @@
 package main
 
 import (
+	"context"
 	"sync"
 	"time"
 
 	"github.com/bwmarrin/discordgo"
+	"github.com/rs/zerolog"
+	"golang.org/x/exp/slices"
 	"maunium.net/go/mautrix/id"
 
 	"go.mau.fi/mautrix-discord/database"
@@ -14,7 +17,8 @@ type Thread struct {
 	*database.Thread
 	Parent *Portal
 
-	creationNoticeLock sync.Mutex
+	creationNoticeLock       sync.Mutex
+	initialBackfillAttempted bool
 }
 
 func (br *DiscordBridge) GetThreadByID(id string, root *database.Message) *Thread {
@@ -74,15 +78,70 @@ func (br *DiscordBridge) loadThread(dbThread *database.Thread, id string, root *
 	return thread
 }
 
+func (br *DiscordBridge) threadFound(ctx context.Context, source *User, rootMessage *database.Message, id string, metadata *discordgo.Channel) {
+	thread := br.GetThreadByID(id, rootMessage)
+	log := zerolog.Ctx(ctx)
+	log.Debug().Msg("Marked message as thread root")
+	if thread.CreationNoticeMXID == "" {
+		thread.Parent.sendThreadCreationNotice(ctx, thread)
+	}
+	// TODO member_ids_preview is probably not guaranteed to contain the source user
+	if source != nil && metadata != nil && slices.Contains(metadata.MemberIDsPreview, source.DiscordID) && !source.IsInPortal(thread.ID) {
+		source.MarkInPortal(database.UserPortal{
+			DiscordID: thread.ID,
+			Type:      database.UserPortalTypeThread,
+			Timestamp: time.Now(),
+		})
+		if metadata.MessageCount > 0 {
+			go thread.maybeInitialBackfill(source)
+		} else {
+			thread.initialBackfillAttempted = true
+		}
+	}
+}
+
+func (thread *Thread) maybeInitialBackfill(source *User) {
+	if thread.initialBackfillAttempted || thread.Parent.bridge.Config.Bridge.Backfill.Limits.Initial.Thread == 0 {
+		return
+	}
+	thread.Parent.forwardBackfillLock.Lock()
+	if thread.Parent.bridge.DB.Message.GetLastInThread(thread.Parent.Key, thread.ID) != nil {
+		thread.Parent.forwardBackfillLock.Unlock()
+		return
+	}
+	thread.Parent.forwardBackfillInitial(source, thread)
+}
+
+func (thread *Thread) RefererOpt() discordgo.RequestOption {
+	return discordgo.WithThreadReferer(thread.Parent.GuildID, thread.ParentID, thread.ID)
+}
+
 func (thread *Thread) Join(user *User) {
 	if user.IsInPortal(thread.ID) {
 		return
 	}
 	log := user.log.With().Str("thread_id", thread.ID).Str("channel_id", thread.ParentID).Logger()
 	log.Debug().Msg("Joining thread")
+
+	var doBackfill, backfillStarted bool
+	if !thread.initialBackfillAttempted && thread.Parent.bridge.Config.Bridge.Backfill.Limits.Initial.Thread > 0 {
+		thread.Parent.forwardBackfillLock.Lock()
+		lastMessage := thread.Parent.bridge.DB.Message.GetLastInThread(thread.Parent.Key, thread.ID)
+		if lastMessage != nil {
+			thread.Parent.forwardBackfillLock.Unlock()
+		} else {
+			doBackfill = true
+			defer func() {
+				if !backfillStarted {
+					thread.Parent.forwardBackfillLock.Unlock()
+				}
+			}()
+		}
+	}
+
 	var err error
 	if user.Session.IsUser {
-		err = user.Session.ThreadJoinWithLocation(thread.ID, discordgo.ThreadJoinLocationContextMenu)
+		err = user.Session.ThreadJoin(thread.ID, discordgo.WithLocationParam(discordgo.ThreadJoinLocationContextMenu), thread.RefererOpt())
 	} else {
 		err = user.Session.ThreadJoin(thread.ID)
 	}
@@ -94,5 +153,9 @@ func (thread *Thread) Join(user *User) {
 			Type:      database.UserPortalTypeThread,
 			Timestamp: time.Now(),
 		})
+		if doBackfill {
+			go thread.Parent.forwardBackfillInitial(user, thread)
+			backfillStarted = true
+		}
 	}
 }

user.go

@@ -1,11 +1,15 @@
 package main
 
 import (
+	"context"
+	"crypto/tls"
 	"errors"
 	"fmt"
 	"math/rand"
 	"net/http"
+	"net/url"
 	"os"
+	"runtime/debug"
 	"sort"
 	"strconv"
 	"strings"
@@ -16,8 +20,7 @@ import (
 	"github.com/bwmarrin/discordgo"
 	"github.com/gorilla/websocket"
 	"github.com/rs/zerolog"
-	"maunium.net/go/mautrix/util/dbutil"
-
+	"go.mau.fi/util/dbutil"
 	"maunium.net/go/mautrix"
 	"maunium.net/go/mautrix/appservice"
 	"maunium.net/go/mautrix/bridge"
@@ -73,6 +76,9 @@ func (user *User) GetRemoteID() string {
 
 func (user *User) GetRemoteName() string {
 	if user.Session != nil && user.Session.State != nil && user.Session.State.User != nil {
+		if user.Session.State.User.Discriminator == "0" {
+			return fmt.Sprintf("@%s", user.Session.State.User.Username)
+		}
 		return fmt.Sprintf("%s#%s", user.Session.State.User.Username, user.Session.State.User.Discriminator)
 	}
 	return user.DiscordID
@@ -97,7 +103,7 @@ func discordToZeroLevel(level int) zerolog.Level {
 
 func init() {
 	discordgo.Logger = func(msgL, caller int, format string, a ...interface{}) {
-		discordLog.WithLevel(discordToZeroLevel(msgL)).Caller(caller+1).Msgf(strings.TrimSpace(format), a...)
+		discordLog.WithLevel(discordToZeroLevel(msgL)).Caller(caller+1).Msgf(strings.TrimSpace(format), a...) // zerolog-allow-msgf
 	}
 }
 
@@ -192,6 +198,12 @@ func (br *DiscordBridge) GetCachedUserByID(id string) *User {
 	return br.usersByID[id]
 }
 
+func (br *DiscordBridge) GetCachedUserByMXID(userID id.UserID) *User {
+	br.usersLock.Lock()
+	defer br.usersLock.Unlock()
+	return br.usersByMXID[userID]
+}
+
 func (br *DiscordBridge) NewUser(dbUser *database.User) *User {
 	user := &User{
 		User:   dbUser,
@@ -332,6 +344,7 @@ func (user *User) getSpaceRoom(ptr *id.RoomID, name, topic string, parent id.Roo
 				user.MXID:              50,
 			},
 		},
+		RoomVersion: "11",
 	})
 
 	if err != nil {
@@ -365,37 +378,6 @@ func (user *User) GetDMSpaceRoom() id.RoomID {
 	return user.getSpaceRoom(&user.DMSpaceRoom, "Direct Messages", "Your Discord direct messages", user.GetSpaceRoom())
 }
 
-func (user *User) tryAutomaticDoublePuppeting() {
-	user.Lock()
-	defer user.Unlock()
-
-	if !user.bridge.Config.CanAutoDoublePuppet(user.MXID) {
-		return
-	}
-
-	user.log.Debug().Msg("Checking if double puppeting needs to be enabled")
-
-	puppet := user.bridge.GetPuppetByID(user.DiscordID)
-	if puppet.CustomMXID != "" {
-		user.log.Debug().Msg("User already has double-puppeting enabled")
-		return
-	}
-
-	accessToken, err := puppet.loginWithSharedSecret(user.MXID)
-	if err != nil {
-		user.log.Warn().Err(err).Msg("Failed to login with shared secret")
-		return
-	}
-
-	err = puppet.SwitchCustomMXID(accessToken, user.MXID)
-	if err != nil {
-		puppet.log.Warn().Err(err).Msg("Failed to switch to auto-logined custom puppet")
-		return
-	}
-
-	user.log.Info().Msg("Successfully automatically enabled custom puppet")
-}
-
 func (user *User) ViewingChannel(portal *Portal) bool {
 	if portal.GuildID != "" || !user.Session.IsUser {
 		return false
@@ -568,6 +550,19 @@ func (user *User) Connect() error {
 	if err != nil {
 		return err
 	}
+	if user.bridge.Config.Bridge.Proxy != "" {
+		u, _ := url.Parse(user.bridge.Config.Bridge.Proxy)
+		tlsConf := &tls.Config{
+			InsecureSkipVerify: os.Getenv("DISCORD_SKIP_TLS_VERIFICATION") == "true",
+		}
+		session.Client.Transport = &http.Transport{
+			Proxy:             http.ProxyURL(u),
+			TLSClientConfig:   tlsConf,
+			ForceAttemptHTTP2: true,
+		}
+		session.Dialer.Proxy = http.ProxyURL(u)
+		session.Dialer.TLSClientConfig = tlsConf
+	}
 	// TODO move to config
 	if os.Getenv("DISCORD_DEBUG") == "1" {
 		session.LogLevel = discordgo.LogDebug
@@ -576,16 +571,31 @@ func (user *User) Connect() error {
 	}
 	userDiscordLog := user.log.With().Str("component", "discordgo").Logger()
 	session.Logger = func(msgL, caller int, format string, a ...interface{}) {
-		userDiscordLog.WithLevel(discordToZeroLevel(msgL)).Caller(caller+1).Msgf(strings.TrimSpace(format), a...)
+		userDiscordLog.WithLevel(discordToZeroLevel(msgL)).Caller(caller+1).Msgf(strings.TrimSpace(format), a...) // zerolog-allow-msgf
 	}
 	if !session.IsUser {
 		session.Identify.Intents = BotIntents
 	}
 	session.EventHandler = user.eventHandlerSync
 
+	if session.IsUser {
+		err = session.LoadMainPage(context.TODO())
+		if err != nil {
+			user.log.Warn().Err(err).Msg("Failed to load main page")
+		}
+	}
+
 	user.Session = session
 
-	return user.Session.Open()
+	for {
+		err = user.Session.Open()
+		if errors.Is(err, discordgo.ErrImmediateDisconnect) {
+			user.log.Warn().Err(err).Msg("Retrying initial connection in 5 seconds")
+			time.Sleep(5 * time.Second)
+			continue
+		}
+		return err
+	}
 }
 
 func (user *User) eventHandlerSync(rawEvt any) {
@@ -593,6 +603,15 @@ func (user *User) eventHandlerSync(rawEvt any) {
 }
 
 func (user *User) eventHandler(rawEvt any) {
+	defer func() {
+		err := recover()
+		if err != nil {
+			user.log.Error().
+				Bytes(zerolog.ErrorStackFieldName, debug.Stack()).
+				Any(zerolog.ErrorFieldName, err).
+				Msg("Panic in Discord event handler")
+		}
+	}()
 	switch evt := rawEvt.(type) {
 	case *discordgo.Ready:
 		user.readyHandler(evt)
@@ -650,6 +669,8 @@ func (user *User) eventHandler(rawEvt any) {
 		user.typingStartHandler(evt)
 	case *discordgo.InteractionSuccess:
 		user.interactionSuccessHandler(evt)
+	case *discordgo.ThreadListSync:
+		user.threadListSyncHandler(evt)
 	case *discordgo.Event:
 		// Ignore
 	default:
@@ -864,7 +885,7 @@ func (user *User) handlePrivateChannel(portal *Portal, meta *discordgo.Channel,
 		}
 	} else {
 		portal.UpdateInfo(user, meta)
-		portal.ForwardBackfillMissed(user, meta)
+		portal.ForwardBackfillMissed(user, meta.LastMessageID, nil)
 	}
 	user.MarkInPortal(database.UserPortal{
 		DiscordID: portal.Key.ChannelID,
@@ -954,8 +975,11 @@ func (user *User) handleGuild(meta *discordgo.Guild, timestamp time.Time, isInSp
 	guild.UpdateInfo(user, meta)
 	if len(meta.Channels) > 0 {
 		for _, ch := range meta.Channels {
+			if !user.channelIsBridgeable(ch) {
+				continue
+			}
 			portal := user.GetPortalByMeta(ch)
-			if guild.BridgingMode >= database.GuildBridgeEverything && portal.MXID == "" && user.channelIsBridgeable(ch) {
+			if guild.BridgingMode >= database.GuildBridgeEverything && portal.MXID == "" {
 				err := portal.CreateMatrixRoom(user, ch)
 				if err != nil {
 					user.log.Error().Err(err).
@@ -966,7 +990,7 @@ func (user *User) handleGuild(meta *discordgo.Guild, timestamp time.Time, isInSp
 			} else {
 				portal.UpdateInfo(user, ch)
 				if user.bridge.Config.Bridge.Backfill.MaxGuildMembers < 0 || meta.MemberCount < user.bridge.Config.Bridge.Backfill.MaxGuildMembers {
-					portal.ForwardBackfillMissed(user, ch)
+					portal.ForwardBackfillMissed(user, ch.LastMessageID, nil)
 				}
 			}
 		}
@@ -1008,6 +1032,15 @@ func (user *User) invalidAuthHandler(_ *discordgo.InvalidAuth) {
 	go user.Logout(false)
 }
 
+func (user *User) handlePossible40002(err error) bool {
+	var restErr *discordgo.RESTError
+	if !errors.As(err, &restErr) || restErr.Message == nil || restErr.Message.Code != discordgo.ErrCodeActionRequiredVerifiedAccount {
+		return false
+	}
+	user.BridgeState.Send(status.BridgeState{StateEvent: status.StateBadCredentials, Error: "dc-http-40002", Message: restErr.Message.Message})
+	return true
+}
+
 func (user *User) guildCreateHandler(g *discordgo.GuildCreate) {
 	user.log.Info().
 		Str("guild_id", g.ID).
@@ -1018,6 +1051,10 @@ func (user *User) guildCreateHandler(g *discordgo.GuildCreate) {
 }
 
 func (user *User) guildDeleteHandler(g *discordgo.GuildDelete) {
+	if g.Unavailable {
+		user.log.Info().Str("guild_id", g.ID).Msg("Ignoring guild delete event with unavailable flag")
+		return
+	}
 	user.log.Info().Str("guild_id", g.ID).Msg("Got guild delete event")
 	user.MarkNotInPortal(g.ID)
 	guild := user.bridge.GetGuildByID(g.ID, false)
@@ -1038,6 +1075,30 @@ func (user *User) guildUpdateHandler(g *discordgo.GuildUpdate) {
 	user.handleGuild(g.Guild, time.Now(), user.IsInSpace(g.ID))
 }
 
+func (user *User) threadListSyncHandler(t *discordgo.ThreadListSync) {
+	for _, meta := range t.Threads {
+		log := user.log.With().
+			Str("action", "thread list sync").
+			Str("guild_id", t.GuildID).
+			Str("parent_id", meta.ParentID).
+			Str("thread_id", meta.ID).
+			Logger()
+		ctx := log.WithContext(context.Background())
+		thread := user.bridge.GetThreadByID(meta.ID, nil)
+		if thread == nil {
+			msg := user.bridge.DB.Message.GetByDiscordID(database.NewPortalKey(meta.ParentID, ""), meta.ID)
+			if len(msg) == 0 {
+				log.Debug().Msg("Found unknown thread in thread list sync and don't have message")
+			} else {
+				log.Debug().Msg("Found unknown thread in thread list sync for existing message, creating thread")
+				user.bridge.threadFound(ctx, user, msg[0], meta.ID, meta)
+			}
+		} else {
+			thread.Parent.ForwardBackfillMissed(user, meta.LastMessageID, thread)
+		}
+	}
+}
+
 func (user *User) channelCreateHandler(c *discordgo.ChannelCreate) {
 	if user.getGuildBridgingMode(c.GuildID) < database.GuildBridgeEverything {
 		user.log.Debug().
@@ -1093,7 +1154,7 @@ func (user *User) channelUpdateHandler(c *discordgo.ChannelUpdate) {
 	portal := user.GetPortalByMeta(c.Channel)
 	if c.GuildID == "" {
 		user.handlePrivateChannel(portal, c.Channel, time.Now(), true, user.IsInSpace(portal.Key.String()))
-	} else {
+	} else if user.channelIsBridgeable(c.Channel) {
 		portal.UpdateInfo(user, c.Channel)
 	}
 }
@@ -1169,11 +1230,21 @@ func (user *User) pushPortalMessage(msg interface{}, typeName, channelID, guildI
 		return
 	}
 
-	portal.discordMessages <- portalDiscordMessage{
+	wrappedMsg := portalDiscordMessage{
 		msg:    msg,
 		user:   user,
 		thread: thread,
 	}
+	select {
+	case portal.discordMessages <- wrappedMsg:
+	default:
+		user.log.Warn().
+			Str("discord_event", typeName).
+			Str("guild_id", guildID).
+			Str("channel_id", channelID).
+			Msg("Portal message buffer is full")
+		portal.discordMessages <- wrappedMsg
+	}
 }
 
 type CustomReadReceipt struct {
@@ -1409,6 +1480,8 @@ func (user *User) bridgeGuild(guildID string, everything bool) error {
 	}
 	if everything {
 		guild.BridgingMode = database.GuildBridgeEverything
+	} else {
+		guild.BridgingMode = database.GuildBridgeCreateOnMessage
 	}
 	guild.Update()