feat(services/autumn): download and preview files

crates/core/config/Revolt.toml

@@ -88,6 +88,8 @@ max_concurrent_connections = 50
 # Encryption key for stored files
 # Generate your own key using `openssl rand -base64 32`
 encryption_key = "qcuMA+ssxhMyKaNAKBGFfryfFtUH8NDlamQyDwGW6fU="
+# Quality used for lossy WebP previews (set to 100 for lossless)
+webp_quality = 80.0
 
 [files.limit]
 # Minimum image resolution
@@ -118,13 +120,13 @@ emojis = [128, 128]
 # - default_bucket matches the name of the bucket you've created
 
 # S3 protocol endpoint
-endpoint = ""
+endpoint = "http://minio:9000"
 # S3 region name
-region = ""
+region = "minio"
 # S3 protocol key ID
-access_key_id = ""
+access_key_id = "minioautumn"
 # S3 protocol access key
-secret_access_key = ""
+secret_access_key = "minioautumn"
 # Bucket to upload to by default
 default_bucket = "revolt-uploads"
 

crates/core/config/src/lib.rs

@@ -126,6 +126,31 @@ pub struct Api {
     pub workers: ApiWorkers,
 }
 
+#[derive(Deserialize, Debug, Clone)]
+pub struct FilesLimit {
+    pub min_resolution: [usize; 2],
+    pub max_mega_pixels: usize,
+    pub max_pixel_side: usize,
+}
+
+#[derive(Deserialize, Debug, Clone)]
+pub struct FilesS3 {
+    pub endpoint: String,
+    pub region: String,
+    pub access_key_id: String,
+    pub secret_access_key: String,
+    pub default_bucket: String,
+}
+
+#[derive(Deserialize, Debug, Clone)]
+pub struct Files {
+    pub encryption_key: String,
+    pub webp_quality: f32,
+    pub limit: FilesLimit,
+    pub preview: HashMap<String, [usize; 2]>,
+    pub s3: FilesS3,
+}
+
 #[derive(Deserialize, Debug, Clone)]
 pub struct GlobalLimits {
     pub group_size: usize,
@@ -186,6 +211,7 @@ pub struct Settings {
     pub database: Database,
     pub hosts: Hosts,
     pub api: Api,
+    pub files: Files,
     pub features: Features,
     pub sentry: Sentry,
 }

crates/core/database/src/drivers/reference.rs

@@ -3,7 +3,7 @@ use std::{collections::HashMap, sync::Arc};
 use futures::lock::Mutex;
 
 use crate::{
-    Bot, Channel, ChannelCompositeKey, ChannelUnread, Emoji, File, Invite, Member,
+    Bot, Channel, ChannelCompositeKey, ChannelUnread, Emoji, File, FileHash, Invite, Member,
     MemberCompositeKey, Message, RatelimitEvent, Report, Server, ServerBan, Snapshot, User,
     UserSettings, Webhook,
 };
@@ -18,6 +18,7 @@ database_derived!(
         pub channel_unreads: Arc<Mutex<HashMap<ChannelCompositeKey, ChannelUnread>>>,
         pub channel_webhooks: Arc<Mutex<HashMap<String, Webhook>>>,
         pub emojis: Arc<Mutex<HashMap<String, Emoji>>>,
+        pub file_hashes: Arc<Mutex<HashMap<String, FileHash>>>,
         pub files: Arc<Mutex<HashMap<String, File>>>,
         pub messages: Arc<Mutex<HashMap<String, Message>>>,
         pub ratelimit_events: Arc<Mutex<HashMap<String, RatelimitEvent>>>,

crates/core/database/src/models/file_hashes/mod.rs

@@ -0,0 +1,5 @@
+mod model;
+mod ops;
+
+pub use model::*;
+pub use ops::*;

crates/core/database/src/models/file_hashes/model.rs

@@ -0,0 +1,49 @@
+use iso8601_timestamp::Timestamp;
+
+auto_derived_partial!(
+    /// File hash
+    pub struct FileHash {
+        /// Sha256 hash of the file
+        #[serde(rename = "_id")]
+        pub id: String,
+        /// Sha256 hash of file after it has been processed
+        pub processed_hash: String,
+
+        /// When this file was created in system
+        pub created_at: Timestamp,
+
+        /// The bucket this file is stored in
+        pub bucket_id: String,
+        /// The path at which this file exists in
+        pub path: String,
+        /// Cryptographic nonce used to encrypt this file
+        pub iv: String,
+
+        /// Parsed metadata of this file
+        pub metadata: Metadata,
+        /// Raw content type of this file
+        pub content_type: String,
+        /// Size of this file (in bytes)
+        pub size: isize,
+    },
+    "PartialFile"
+);
+
+auto_derived!(
+    /// Metadata associated with a file
+    #[serde(tag = "type")]
+    #[derive(Default)]
+    pub enum Metadata {
+        /// File is just a generic uncategorised file
+        #[default]
+        File,
+        /// File contains textual data and should be displayed as such
+        Text,
+        /// File is an image with specific dimensions
+        Image { width: isize, height: isize },
+        /// File is a video with specific dimensions
+        Video { width: isize, height: isize },
+        /// File is audio
+        Audio,
+    }
+);

crates/core/database/src/models/file_hashes/ops.rs

@@ -0,0 +1,12 @@
+use revolt_result::Result;
+
+use crate::FileHash;
+
+mod mongodb;
+mod reference;
+
+#[async_trait]
+pub trait AbstractAttachmentHashes: Sync + Send {
+    /// Fetch an attachment hash entry by sha256 hash.
+    async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash>;
+}

crates/core/database/src/models/file_hashes/ops/mongodb.rs

@@ -0,0 +1,24 @@
+use revolt_result::Result;
+
+use crate::FileHash;
+use crate::MongoDb;
+
+use super::AbstractAttachmentHashes;
+
+static COL: &str = "attachment_hashes";
+
+#[async_trait]
+impl AbstractAttachmentHashes for MongoDb {
+    /// Fetch an attachment hash entry by sha256 hash.
+    async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash> {
+        query!(
+            self,
+            find_one,
+            COL,
+            doc! {
+                "_id": hash
+            }
+        )?
+        .ok_or_else(|| create_error!(NotFound))
+    }
+}

crates/core/database/src/models/file_hashes/ops/reference.rs

@@ -0,0 +1,23 @@
+use revolt_result::Result;
+
+use crate::FileHash;
+use crate::ReferenceDb;
+
+use super::AbstractAttachmentHashes;
+
+#[async_trait]
+impl AbstractAttachmentHashes for ReferenceDb {
+    /// Fetch an attachment hash entry by sha256 hash.
+    async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash> {
+        let hashes = self.file_hashes.lock().await;
+        if let Some(file) = hashes.get(hash) {
+            if file.id == hash {
+                Ok(file.clone())
+            } else {
+                Err(create_error!(NotFound))
+            }
+        } else {
+            Err(create_error!(NotFound))
+        }
+    }
+}

crates/core/database/src/models/files/model.rs

@@ -1,5 +1,6 @@
-use crate::Database;
+use crate::{Database, FileHash, Metadata};
 
+use iso8601_timestamp::Timestamp;
 use revolt_result::Result;
 
 auto_derived_partial!(
@@ -12,13 +13,16 @@ auto_derived_partial!(
         pub tag: String,
         /// Original filename
         pub filename: String,
-        /// Parsed metadata of this file
-        pub metadata: Metadata,
-        /// Raw content type of this file
-        pub content_type: String,
-        /// Size of this file (in bytes)
-        pub size: isize,
+        /// Hash of this file
+        pub hash: Option<String>, // these are Option<>s to not break file uploads on legacy Autumn
 
+        /// When this file was uploaded
+        pub uploaded_at: Option<Timestamp>, // these are Option<>s to not break file uploads on legacy Autumn
+        /// ID of user who uploaded this file
+        pub uploaded_id: Option<String>, // these are Option<>s to not break file uploads on legacy Autumn
+
+        // TODO: used_for: field
+        //
         /// Whether this file was deleted
         #[serde(skip_serializing_if = "Option::is_none")]
         pub deleted: Option<bool>,
@@ -26,6 +30,14 @@ auto_derived_partial!(
         #[serde(skip_serializing_if = "Option::is_none")]
         pub reported: Option<bool>,
 
+        // !!! DEPRECATED:
+        /// Parsed metadata of this file
+        pub metadata: Metadata,
+        /// Raw content type of this file
+        pub content_type: String,
+        /// Size of this file (in bytes)
+        pub size: isize,
+
         // TODO: migrate this mess to having:
         // - author_id
         // - parent: Parent { Message(id), User(id), etc }
@@ -43,26 +55,12 @@ auto_derived_partial!(
     "PartialFile"
 );
 
-auto_derived!(
-    /// Metadata associated with a file
-    #[serde(tag = "type")]
-    #[derive(Default)]
-    pub enum Metadata {
-        /// File is just a generic uncategorised file
-        #[default]
-        File,
-        /// File contains textual data and should be displayed as such
-        Text,
-        /// File is an image with specific dimensions
-        Image { width: isize, height: isize },
-        /// File is a video with specific dimensions
-        Video { width: isize, height: isize },
-        /// File is audio
-        Audio,
-    }
-);
-
 impl File {
+    /// Get the hash entry for this file
+    pub async fn as_hash(&self, db: &Database) -> Result<FileHash> {
+        db.fetch_attachment_hash(self.hash.as_ref().unwrap()).await
+    }
+
     /// Use a file for a message attachment
     pub async fn use_attachment(db: &Database, id: &str, parent: &str) -> Result<File> {
         db.find_and_use_attachment(id, "attachments", "message", parent)

crates/core/database/src/models/files/ops.rs

@@ -10,6 +10,9 @@ pub trait AbstractAttachments: Sync + Send {
     /// Insert attachment into database.
     async fn insert_attachment(&self, attachment: &File) -> Result<()>;
 
+    /// Fetch an attachment by its id.
+    async fn fetch_attachment(&self, tag: &str, file_id: &str) -> Result<File>;
+
     /// Find an attachment by its details and mark it as used by a given parent.
     async fn find_and_use_attachment(
         &self,

crates/core/database/src/models/files/ops/mongodb.rs

@@ -15,6 +15,20 @@ impl AbstractAttachments for MongoDb {
         query!(self, insert_one, COL, &attachment).map(|_| ())
     }
 
+    /// Fetch an attachment by its id.
+    async fn fetch_attachment(&self, tag: &str, file_id: &str) -> Result<File> {
+        query!(
+            self,
+            find_one,
+            COL,
+            doc! {
+                "_id": file_id,
+                "tag": tag
+            }
+        )?
+        .ok_or_else(|| create_error!(NotFound))
+    }
+
     /// Find an attachment by its details and mark it as used by a given parent.
     async fn find_and_use_attachment(
         &self,

crates/core/database/src/models/files/ops/reference.rs

@@ -18,6 +18,20 @@ impl AbstractAttachments for ReferenceDb {
         }
     }
 
+    /// Fetch an attachment by its id.
+    async fn fetch_attachment(&self, tag: &str, file_id: &str) -> Result<File> {
+        let files = self.files.lock().await;
+        if let Some(file) = files.get(file_id) {
+            if file.tag == tag {
+                Ok(file.clone())
+            } else {
+                Err(create_error!(NotFound))
+            }
+        } else {
+            Err(create_error!(NotFound))
+        }
+    }
+
     /// Find an attachment by its details and mark it as used by a given parent.
     async fn find_and_use_attachment(
         &self,

crates/core/database/src/models/mod.rs

@@ -5,6 +5,7 @@ mod channel_unreads;
 mod channel_webhooks;
 mod channels;
 mod emojis;
+mod file_hashes;
 mod files;
 mod messages;
 mod ratelimit_events;
@@ -23,6 +24,7 @@ pub use channel_unreads::*;
 pub use channel_webhooks::*;
 pub use channels::*;
 pub use emojis::*;
+pub use file_hashes::*;
 pub use files::*;
 pub use messages::*;
 pub use ratelimit_events::*;
@@ -46,6 +48,7 @@ pub trait AbstractDatabase:
     + channel_unreads::AbstractChannelUnreads
     + channel_webhooks::AbstractWebhooks
     + emojis::AbstractEmojis
+    + file_hashes::AbstractAttachmentHashes
     + files::AbstractAttachments
     + messages::AbstractMessages
     + ratelimit_events::AbstractRatelimitEvents

crates/core/database/src/util/bridge/v0.rs

@@ -419,6 +419,9 @@ impl From<File> for crate::File {
             user_id: value.user_id,
             server_id: value.server_id,
             object_id: value.object_id,
+            hash: None,
+            uploaded_at: None,
+            uploaded_id: None,
         }
     }
 }

crates/core/files/Cargo.toml

@@ -7,7 +7,12 @@ authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: S3 and encryption subroutines"
 
 [dependencies]
+base64 = "0.22.1"
 aes-gcm = "0.10.3"
+typenum = "1.17.0"
 
 aws-config = "1.5.5"
 aws-sdk-s3 = { version = "1.46.0", features = ["behavior-version-latest"] }
+
+revolt-config = { version = "0.7.16", path = "../config" }
+revolt-result = { version = "0.7.16", path = "../result" }

crates/core/files/src/lib.rs

@@ -1,3 +1,78 @@
-// pub fn
+use std::io::Write;
 
-pub fn decrypt(data: &mut [u8]) {}
+use aes_gcm::{aead::AeadMutInPlace, Aes256Gcm, Key, KeyInit, Nonce};
+use revolt_config::{config, FilesS3};
+use revolt_result::{create_error, Result};
+
+use aws_sdk_s3::{
+    config::{Credentials, Region},
+    Client, Config,
+};
+
+use base64::prelude::*;
+
+/// Create an S3 client
+pub fn create_client(s3_config: FilesS3) -> Client {
+    let provider_name = "my-creds";
+    let creds = Credentials::new(
+        s3_config.access_key_id,
+        s3_config.secret_access_key,
+        None,
+        None,
+        provider_name,
+    );
+
+    let config = Config::builder()
+        .region(Region::new(s3_config.region))
+        .endpoint_url(s3_config.endpoint)
+        .credentials_provider(creds)
+        .build();
+
+    Client::from_conf(config)
+}
+
+/// Create an AES-256-GCM cipher
+pub fn create_cipher(key: &str) -> Aes256Gcm {
+    let key = &BASE64_STANDARD.decode(key).unwrap()[..];
+    let key: &Key<Aes256Gcm> = key.into();
+    Aes256Gcm::new(key)
+}
+
+/// Fetch a file from S3 (and decrypt it)
+pub async fn fetch_from_s3(bucket_id: &str, path: &str, nonce: &str) -> Result<Vec<u8>> {
+    let config = config().await;
+    let client = create_client(config.files.s3);
+
+    // Send a request for the file
+    let mut obj = client
+        .get_object()
+        .bucket(bucket_id)
+        .key(path)
+        .send()
+        .await
+        .inspect_err(|err| {
+            revolt_config::capture_error(err);
+        })
+        .map_err(|_| create_error!(InternalError))?;
+
+    // Read the file from remote
+    let mut buf = vec![];
+    while let Some(bytes) = obj.body.next().await {
+        let data = bytes.map_err(|_| create_error!(InternalError))?;
+        buf.write_all(&data)
+            .map_err(|_| create_error!(InternalError))?;
+        // is there a more efficient way to do this?
+        // we just want the Vec<u8>
+    }
+
+    // Recover nonce as bytes
+    let nonce = &BASE64_STANDARD.decode(nonce).unwrap()[..];
+    let nonce: &Nonce<typenum::consts::U12> = nonce.into();
+
+    // Decrypt the file
+    create_cipher(&config.files.encryption_key)
+        .decrypt_in_place(nonce, b"", &mut buf)
+        .map_err(|_| create_error!(InternalError))?;
+
+    Ok(buf)
+}