chore: bump quark

fixes #153

Cargo.lock

@@ -792,6 +792,16 @@ dependencies = [
  "tokio 1.18.0",
 ]
 
+[[package]]
+name = "debugid"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6ee87af31d84ef885378aebca32be3d682b0e0dc119d5b4860a2c5bb5046730"
+dependencies = [
+ "serde",
+ "uuid",
+]
+
 [[package]]
 name = "derivative"
 version = "2.2.0"
@@ -2750,7 +2760,7 @@ dependencies = [
 [[package]]
 name = "rauth"
 version = "1.0.0"
-source = "git+https://github.com/insertish/rauth?rev=611b11baa9e199bcefd0ca5bd3302f9d6904a2c6#611b11baa9e199bcefd0ca5bd3302f9d6904a2c6"
+source = "git+https://github.com/insertish/rauth?rev=001a9698c56cea79e69e4ae71d7bc2cb48aec1a6#001a9698c56cea79e69e4ae71d7bc2cb48aec1a6"
 dependencies = [
  "async-std",
  "base32",
@@ -2999,7 +3009,7 @@ dependencies = [
 [[package]]
 name = "revolt-quark"
 version = "0.1.0"
-source = "git+https://github.com/revoltchat/quark?rev=4356bcd09dc9382b1a8c0e339895682a8b096dfb#4356bcd09dc9382b1a8c0e339895682a8b096dfb"
+source = "git+https://github.com/revoltchat/quark?rev=076755e513aa6b1e955cf917f60aad9e62a73883#076755e513aa6b1e955cf917f60aad9e62a73883"
 dependencies = [
  "async-recursion",
  "async-std",
@@ -3029,6 +3039,7 @@ dependencies = [
  "rocket",
  "rocket_okapi",
  "schemars",
+ "sentry",
  "serde",
  "serde_json",
  "ulid 0.5.0",
@@ -3222,7 +3233,16 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "138e3e0acb6c9fb258b19b67cb8abd63c00679d2851805ea151465464fe9030a"
 dependencies = [
- "semver",
+ "semver 0.9.0",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver 1.0.9",
 ]
 
 [[package]]
@@ -3231,8 +3251,8 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d31b7153270ebf48bf91c65ae5b0c00e749c4cfad505f66530ac74950249582f"
 dependencies = [
- "rustc_version",
- "semver",
+ "rustc_version 0.2.3",
+ "semver 0.9.0",
 ]
 
 [[package]]
@@ -3395,12 +3415,98 @@ dependencies = [
  "semver-parser",
 ]
 
+[[package]]
+name = "semver"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cb243bdfdb5936c8dc3c45762a19d12ab4550cdc753bc247637d4ec35a040fd"
+
 [[package]]
 name = "semver-parser"
 version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
 
+[[package]]
+name = "sentry"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2d23af89cf3e40dffb53f974e9a21653353b3e21cf51633aa58006f2a0caf8a"
+dependencies = [
+ "httpdate 1.0.2",
+ "reqwest",
+ "sentry-backtrace",
+ "sentry-contexts",
+ "sentry-core",
+ "sentry-panic",
+ "tokio 1.18.0",
+]
+
+[[package]]
+name = "sentry-backtrace"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8158a446429420acdf6a4f75192ee8929da16a0c41c89a1c34b2e0f1eaebcc02"
+dependencies = [
+ "backtrace",
+ "lazy_static",
+ "regex",
+ "sentry-core",
+]
+
+[[package]]
+name = "sentry-contexts"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a3bda8a1e3213f1944da2d42f3081ea9f3717105bb2a6b0a8fe4f5e603010a3"
+dependencies = [
+ "hostname",
+ "libc",
+ "rustc_version 0.4.0",
+ "sentry-core",
+ "uname",
+]
+
+[[package]]
+name = "sentry-core"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56333f11be3a78131c67637f7611339df8af7ad9af831226585a457df75f9e3b"
+dependencies = [
+ "lazy_static",
+ "rand 0.8.5",
+ "sentry-types",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "sentry-panic"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b957b1965c450acd220a27806fe1f2dec998d393973ebae797936b12df1c7416"
+dependencies = [
+ "sentry-backtrace",
+ "sentry-core",
+]
+
+[[package]]
+name = "sentry-types"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "825fd3382e2397007499a910e0184e55f7837cb0df4af30ae62bd2123e2ebcd6"
+dependencies = [
+ "debugid",
+ "getrandom 0.2.6",
+ "hex",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "time 0.3.9",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "serde"
 version = "1.0.136"
@@ -3670,7 +3776,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d022496b16281348b52d0e30ae99e01a73d737b2f45d38fed4edf79f9325a1d5"
 dependencies = [
  "discard",
- "rustc_version",
+ "rustc_version 0.2.3",
  "stdweb-derive",
  "stdweb-internal-macros",
  "stdweb-internal-runtime",
@@ -3873,6 +3979,7 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2702e08a7a860f005826c6815dcac101b19b5eb330c27fe4a5928fec1d20ddd"
 dependencies = [
+ "itoa 1.0.1",
  "libc",
  "num_threads",
  "time-macros 0.2.4",
@@ -4333,6 +4440,15 @@ dependencies = [
  "rand 0.8.5",
 ]
 
+[[package]]
+name = "uname"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b72f89f0ca32e4db1c04e2a72f5345d59796d4866a1ee0609084569f73683dc8"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "uncased"
 version = "0.9.6"
@@ -4411,6 +4527,7 @@ dependencies = [
  "idna",
  "matches",
  "percent-encoding",
+ "serde",
 ]
 
 [[package]]

Cargo.toml

@@ -46,7 +46,7 @@ async-std = { version = "1.8.0", features = ["tokio1", "tokio02", "attributes"]
 
 # internal util
 lettre = "0.10.0-alpha.4"
-rauth = { git = "https://github.com/insertish/rauth", rev = "611b11baa9e199bcefd0ca5bd3302f9d6904a2c6" }
+rauth = { git = "https://github.com/insertish/rauth", rev = "001a9698c56cea79e69e4ae71d7bc2cb48aec1a6" }
 
 # redis
 redis = { version = "0.21.2", features = ["async-std-comp"] }
@@ -64,5 +64,5 @@ schemars = "0.8.8"
 rocket_okapi = { git = "https://github.com/insertish/okapi", rev = "dcf0df115596ee07a587a7a543cddf3d7944645b", features = [ "swagger" ] }
 
 # quark
-revolt-quark = { git = "https://github.com/revoltchat/quark", rev = "4356bcd09dc9382b1a8c0e339895682a8b096dfb" }
+revolt-quark = { git = "https://github.com/revoltchat/quark", rev = "076755e513aa6b1e955cf917f60aad9e62a73883" }
 # revolt-quark = { path = "../quark" }

set_version.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
-export version=0.5.3
+export version=0.5.3-5-patch.2
 echo "pub const VERSION: &str = \"${version}\";" > src/version.rs

src/main.rs

@@ -27,8 +27,7 @@ use std::str::FromStr;
 
 #[async_std::main]
 async fn main() {
-    dotenv::dotenv().ok();
-    env_logger::init_from_env(env_logger::Env::default().filter_or("RUST_LOG", "info"));
+    let _guard = revolt_quark::setup_logging();
 
     info!(
         "Starting Revolt server [version {}].",

src/routes/bots/create.rs

@@ -45,7 +45,7 @@ pub async fn create_bot(db: &Db, user: User, info: Json<DataCreateBot>) -> Resul
     let id = Ulid::new().to_string();
     let bot_user = User {
         id: id.clone(),
-        username: info.name,
+        username: info.name.trim().to_string(),
         bot: Some(BotInformation {
             owner: user.id.clone(),
         }),

src/routes/channels/channel_ack.rs

@@ -1,4 +1,4 @@
-use revolt_quark::{models::User, perms, Db, EmptyResponse, Permission, Ref, Result};
+use revolt_quark::{models::User, perms, Db, EmptyResponse, Error, Permission, Ref, Result};
 
 /// # Acknowledge Message
 ///
@@ -6,6 +6,10 @@ use revolt_quark::{models::User, perms, Db, EmptyResponse, Permission, Ref, Resu
 #[openapi(tag = "Messaging")]
 #[put("/<target>/ack/<message>")]
 pub async fn req(db: &Db, user: User, target: Ref, message: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let channel = target.as_channel(db).await?;
     perms(&user)
         .channel(&channel)

src/routes/channels/group_add_member.rs

@@ -9,6 +9,10 @@ use revolt_quark::{
 #[openapi(tag = "Groups")]
 #[put("/<target>/recipients/<member>")]
 pub async fn req(db: &Db, user: User, target: Ref, member: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let mut channel = target.as_channel(db).await?;
     perms(&user)
         .channel(&channel)

src/routes/channels/group_create.rs

@@ -37,6 +37,10 @@ pub struct DataCreateGroup {
 #[openapi(tag = "Groups")]
 #[post("/create", data = "<info>")]
 pub async fn req(db: &Db, user: User, info: Json<DataCreateGroup>) -> Result<Json<Channel>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let info = info.into_inner();
     info.validate()
         .map_err(|error| Error::FailedValidation { error })?;

src/routes/channels/group_remove_member.rs

@@ -9,6 +9,10 @@ use revolt_quark::{
 #[openapi(tag = "Groups")]
 #[delete("/<target>/recipients/<member>")]
 pub async fn req(db: &Db, user: User, target: Ref, member: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let channel = target.as_channel(db).await?;
 
     match &channel {

src/routes/channels/invite_create.rs

@@ -1,6 +1,6 @@
 use revolt_quark::{
     models::{Invite, User},
-    perms, Db, Permission, Ref, Result,
+    perms, Db, Error, Permission, Ref, Result,
 };
 
 use rocket::serde::json::Json;
@@ -13,6 +13,10 @@ use rocket::serde::json::Json;
 #[openapi(tag = "Channel Invites")]
 #[post("/<target>/invites")]
 pub async fn req(db: &Db, user: User, target: Ref) -> Result<Json<Invite>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let channel = target.as_channel(db).await?;
     perms(&user)
         .channel(&channel)

src/routes/channels/members_fetch.rs

@@ -11,6 +11,10 @@ use rocket::serde::json::Json;
 #[openapi(tag = "Groups")]
 #[get("/<target>/members")]
 pub async fn req(db: &Db, user: User, target: Ref) -> Result<Json<Vec<User>>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let channel = target.as_channel(db).await?;
     perms(&user)
         .channel(&channel)

src/routes/channels/message_bulk_delete.rs

@@ -0,0 +1,59 @@
+use chrono::Utc;
+use revolt_quark::{
+    models::{Message, User},
+    perms, Db, EmptyResponse, Error, Permission, Ref, Result,
+};
+use rocket::serde::json::Json;
+use serde::Deserialize;
+use validator::Validate;
+
+/// # Search Parameters
+#[derive(Validate, Deserialize, JsonSchema)]
+pub struct OptionsBulkDelete {
+    /// Message IDs
+    #[validate(length(min = 1, max = 100))]
+    ids: Vec<String>,
+}
+
+/// # Bulk Delete Messages
+///
+/// Delete multiple messages you've sent or one you have permission to delete.
+///
+/// This will always require `ManageMessages` permission regardless of whether you own the message or not.
+///
+/// Messages must have been sent within the past 1 week.
+#[openapi(tag = "Messaging")]
+#[delete("/<target>/messages/bulk", data = "<options>", rank = 1)]
+pub async fn req(
+    db: &Db,
+    user: User,
+    target: Ref,
+    options: Json<OptionsBulkDelete>,
+) -> Result<EmptyResponse> {
+    let options = options.into_inner();
+    options
+        .validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
+    for id in &options.ids {
+        if ulid::Ulid::from_string(id)
+            .map_err(|_| Error::InvalidOperation)?
+            .datetime()
+            .signed_duration_since(Utc::now())
+            .num_days()
+            .abs()
+            > 7
+        {
+            return Err(Error::InvalidOperation);
+        }
+    }
+
+    perms(&user)
+        .channel(&target.as_channel(db).await?)
+        .throw_permission(db, Permission::ManageMessages)
+        .await?;
+
+    Message::bulk_delete(db, &target.id, options.ids)
+        .await
+        .map(|_| EmptyResponse)
+}

src/routes/channels/message_delete.rs

@@ -4,7 +4,7 @@ use revolt_quark::{models::User, perms, Db, EmptyResponse, Error, Permission, Re
 ///
 /// Delete a message you've sent or one you have permission to delete.
 #[openapi(tag = "Messaging")]
-#[delete("/<target>/messages/<msg>")]
+#[delete("/<target>/messages/<msg>", rank = 2)]
 pub async fn req(db: &Db, user: User, target: Ref, msg: Ref) -> Result<EmptyResponse> {
     let message = msg.as_message(db).await?;
     if message.channel != target.id {

src/routes/channels/message_search.rs

@@ -11,7 +11,7 @@ use serde::{Deserialize, Serialize};
 use validator::Validate;
 
 /// # Search Parameters
-#[derive(Validate, Serialize, Deserialize, JsonSchema, FromForm)]
+#[derive(Validate, Serialize, Deserialize, JsonSchema)]
 pub struct OptionsMessageSearch {
     /// Full-text search query
     ///
@@ -48,6 +48,10 @@ pub async fn req(
     target: Ref,
     options: Json<OptionsMessageSearch>,
 ) -> Result<Json<BulkMessageResponse>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let options = options.into_inner();
     options
         .validate()

src/routes/channels/message_send.rs

@@ -80,6 +80,7 @@ pub async fn message_send(
         id: message_id.clone(),
         channel: channel.id().to_string(),
         author: user.id.clone(),
+        masquerade: data.masquerade,
         ..Default::default()
     };
 
@@ -94,7 +95,7 @@ pub async fn message_send(
     }
 
     // 2. Verify permissions for masquerade.
-    if data.masquerade.is_some() {
+    if message.masquerade.is_some() {
         permissions
             .throw_permission(db, Permission::Masquerade)
             .await?;

src/routes/channels/mod.rs

@@ -10,6 +10,7 @@ mod group_create;
 mod group_remove_member;
 mod invite_create;
 mod members_fetch;
+mod message_bulk_delete;
 mod message_delete;
 mod message_edit;
 mod message_fetch;
@@ -35,6 +36,7 @@ pub fn routes() -> (Vec<Route>, OpenApi) {
         message_query_stale::req,
         message_fetch::req,
         message_edit::req,
+        message_bulk_delete::req,
         message_delete::req,
         group_create::req,
         group_add_member::req,

src/routes/servers/invites_fetch.rs

@@ -1,6 +1,6 @@
 use revolt_quark::{
     models::{Invite, User},
-    perms, Db, Permission, Ref, Result,
+    perms, Db, Error, Permission, Ref, Result,
 };
 
 use rocket::serde::json::Json;
@@ -11,6 +11,10 @@ use rocket::serde::json::Json;
 #[openapi(tag = "Server Members")]
 #[get("/<target>/invites")]
 pub async fn req(db: &Db, user: User, target: Ref) -> Result<Json<Vec<Invite>>> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let server = target.as_server(db).await?;
     perms(&user)
         .server(&server)

src/routes/servers/server_ack.rs

@@ -1,4 +1,4 @@
-use revolt_quark::{models::User, perms, Db, EmptyResponse, Ref, Result};
+use revolt_quark::{models::User, perms, Db, EmptyResponse, Error, Ref, Result};
 
 /// # Mark Server As Read
 ///
@@ -6,6 +6,10 @@ use revolt_quark::{models::User, perms, Db, EmptyResponse, Ref, Result};
 #[openapi(tag = "Server Information")]
 #[put("/<target>/ack")]
 pub async fn req(db: &Db, user: User, target: Ref) -> Result<EmptyResponse> {
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let server = target.as_server(db).await?;
     perms(&user).server(&server).calc(db).await?;
 

src/routes/servers/server_edit.rs

@@ -139,7 +139,7 @@ pub async fn req(
 
     // 3. Apply new banner
     if let Some(banner) = banner {
-        partial.banner = Some(File::use_server_icon(db, &banner, &server.id).await?);
+        partial.banner = Some(File::use_banner(db, &banner, &server.id).await?);
         server.banner = partial.banner.clone();
     }
 

src/routes/users/add_friend.rs

@@ -1,5 +1,5 @@
 use revolt_quark::models::User;
-use revolt_quark::{Database, Result};
+use revolt_quark::{Database, Error, Result};
 
 use rocket::serde::json::Json;
 use rocket::State;
@@ -11,6 +11,11 @@ use rocket::State;
 #[put("/<username>/friend")]
 pub async fn req(db: &State<Database>, user: User, username: String) -> Result<Json<User>> {
     let mut target = db.fetch_user_by_username(&username).await?;
+
+    if user.bot.is_some() || target.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     user.add_friend(db, &mut target).await?;
     Ok(Json(target.with_auto_perspective(db, &user).await))
 }

src/routes/users/change_username.rs

@@ -28,6 +28,9 @@ pub async fn req(
     data: Json<DataChangeUsername>,
 ) -> Result<Json<User>> {
     let data = data.into_inner();
+    data.validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
     account
         .verify_password(&data.password)
         .map_err(|_| Error::InvalidCredentials)?;

src/routes/users/find_mutual.rs

@@ -24,6 +24,10 @@ pub async fn req(db: &State<Database>, user: User, target: Ref) -> Result<Json<M
         return Err(Error::InvalidOperation);
     }
 
+    if user.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     let target = target.as_user(db).await?;
 
     if perms(&user)

src/routes/users/remove_friend.rs

@@ -1,5 +1,5 @@
 use revolt_quark::models::User;
-use revolt_quark::{Database, Result};
+use revolt_quark::{Database, Error, Result};
 
 use rocket::serde::json::Json;
 use rocket::State;
@@ -11,6 +11,11 @@ use rocket::State;
 #[delete("/<target>/friend")]
 pub async fn req(db: &State<Database>, user: User, target: String) -> Result<Json<User>> {
     let mut target = db.fetch_user(&target).await?;
+
+    if user.bot.is_some() || target.bot.is_some() {
+        return Err(Error::IsBot);
+    }
+
     user.remove_friend(db, &mut target).await?;
     Ok(Json(target.with_auto_perspective(db, &user).await))
 }

src/util/ratelimiter.rs

@@ -136,7 +136,7 @@ fn resolve_bucket_limit(bucket: &str) -> u8 {
         "messaging" => 10,
         "channels" => 15,
         "servers" => 5,
-        "auth" => 3,
+        "auth" => 15,
         "auth_delete" => 255,
         "swagger" => 100,
         _ => 20,

src/util/regex.rs

@@ -1,4 +1,9 @@
 use once_cell::sync::Lazy;
 use regex::Regex;
 
-pub static RE_USERNAME: Lazy<Regex> = Lazy::new(|| Regex::new(r"^[a-zA-Z0-9_.]+$").unwrap());
+/// Regex for valid usernames
+///
+/// Block zero width space
+/// Block lookalike characters
+pub static RE_USERNAME: Lazy<Regex> =
+    Lazy::new(|| Regex::new(r"^[^\u200BА-Яа-яΑ-Ωα-ω]+$").unwrap());

src/version.rs

@@ -1 +1 @@
-pub const VERSION: &str = "0.5.3";
+pub const VERSION: &str = "0.5.3-5-patch.2";