From 017256162b8294ceb60644f3cf96953510a59527 Mon Sep 17 00:00:00 2001
From: Jannis Braun <151788261+TheZwiss@users.noreply.github.com>
Date: Thu, 2 Apr 2026 10:45:50 +0200
Subject: [PATCH] feat(server): add homeInstance to authenticate, add
 requireLocalUser guard

---
 packages/server/src/utils/auth.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/packages/server/src/utils/auth.ts b/packages/server/src/utils/auth.ts
index 0a17cdd8..eeb498bc 100644
--- a/packages/server/src/utils/auth.ts
+++ b/packages/server/src/utils/auth.ts
@@ -53,6 +53,7 @@ export async function authenticate(
       id: schema.users.id,
       isDeleted: schema.users.isDeleted,
       passwordChangedAt: schema.users.passwordChangedAt,
+      homeInstance: schema.users.homeInstance,
     }).from(schema.users).where(eq(schema.users.id, payload.userId)).get();
 
     if (!user || user.isDeleted === 1) {
@@ -69,6 +70,7 @@ export async function authenticate(
 
     (request as FastifyRequest & { userId: string; username: string }).userId = payload.userId;
     (request as FastifyRequest & { userId: string; username: string }).username = payload.username;
+    (request as FastifyRequest & { userId: string; username: string }).homeInstance = user.homeInstance ?? null;
   } catch {
     return reply.code(401).send({ error: 'Invalid or expired token', statusCode: 401 });
   }
@@ -85,9 +87,22 @@ export async function requireAdmin(
   }
 }
 
+export async function requireLocalUser(
+  request: FastifyRequest,
+  reply: FastifyReply,
+): Promise<void> {
+  if (request.homeInstance) {
+    return reply.code(403).send({
+      error: 'Federated users must use their home instance for DM operations',
+      statusCode: 403,
+    });
+  }
+}
+
 declare module 'fastify' {
   interface FastifyRequest {
     userId: string;
     username: string;
+    homeInstance: string | null;
   }
 }