chore: bump all versions

feat(services/january): website embed generation
feat(services/january): image/video embeds
2024-10-01 21:18:55 +01:00 · 2024-10-01 21:11:08 +01:00 · 2024-10-01 19:13:48 +01:00 · 2024-10-01 19:02:39 +01:00 · 2024-09-29 17:18:41 +01:00 · 2024-09-29 17:08:42 +01:00
72 changed files with 2165 additions and 756 deletions
@@ -1,107 +0,0 @@
-# MongoDB URI
-MONGODB=mongodb://localhost
-AUTUMN_MONGO_URI=mongodb://database
-REDIS_URI=redis://localhost/
-
-# URL to where the Revolt app is publicly accessible
-REVOLT_APP_URL=http://local.revolt.chat:5000
-
-# URL to where the API is publicly accessible
-REVOLT_PUBLIC_URL=http://local.revolt.chat:8000
-VITE_API_URL=http://local.revolt.chat:8000
-
-# URL to where the WebSocket server is publicly accessible
-REVOLT_EXTERNAL_WS_URL=ws://local.revolt.chat:9000
-
-# URL to where Autumn is publicly available
-AUTUMN_PUBLIC_URL=http://local.revolt.chat:3000
-
-# URL to where January is publicly available
-JANUARY_PUBLIC_URL=http://local.revolt.chat:7000
-
-# URL to where Vortex is publicly available
-# VOSO_PUBLIC_URL=https://voso.revolt.chat
-
-
-##
-## hCaptcha Settings
-##
-
-# If you are sure that you don't want to use hCaptcha, set to 1.
-REVOLT_UNSAFE_NO_CAPTCHA=1
-
-# hCaptcha API key
-# REVOLT_HCAPTCHA_KEY=0x0000000000000000000000000000000000000000
-
-# hCaptcha site key
-# REVOLT_HCAPTCHA_SITEKEY=10000000-ffff-ffff-ffff-000000000001
-
-
-##
-## Email Settings
-##
-
-# If you are sure that you don't want to use email verification, set to 1.
-REVOLT_UNSAFE_NO_EMAIL=1
-
-# SMTP host
-# REVOLT_SMTP_HOST=smtp.example.com
-
-# SMTP username
-# REVOLT_SMTP_USERNAME=noreply@example.com
-
-# SMTP password
-# REVOLT_SMTP_PASSWORD=CHANGEME
-
-# SMTP From header
-# REVOLT_SMTP_FROM=Revolt <noreply@example.com>
-
-
-##
-## Application Settings
-##
-
-# Whether to enable staging only features
-REVOLT_IS_STAGING=1
-
-# Whether to only allow users to sign up if they have an invite code
-REVOLT_INVITE_ONLY=0
-
-# Maximum number of people that can be in a group chat
-REVOLT_MAX_GROUP_SIZE=150
-
-# VAPID keys for push notifications
-# Generate using this guide: https://gitlab.insrt.uk/revolt/delta/-/wikis/vapid
-# --> Please replace these keys before going into production! <--
-REVOLT_VAPID_PRIVATE_KEY=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUJSUWpyTWxLRnBiVWhsUHpUbERvcEliYk1yeVNrNXpKYzVYVzIxSjJDS3hvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWnkrQkg2TGJQZ2hEa3pEempXOG0rUXVPM3pCajRXT1phdkR6ZU00c0pqbmFwd1psTFE0WAp1ZDh2TzVodU94QWhMQlU3WWRldVovWHlBdFpWZmNyQi9BPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
-REVOLT_VAPID_PUBLIC_KEY=BGcvgR-i2z4IQ5Mw841vJvkLjt8wY-FjmWrw83jOLCY52qcGZS0OF7nfLzuYbjsQISwVO2HXrmf18gLWVX3Kwfw=
-
-
-##
-## Vortex configuration
-##
-
-# VOSO_MANAGE_TOKEN=CHANGEME
-
-
-##
-## Autumn configuration
-##
-
-# S3 Region
-AUTUMN_S3_REGION=minio
-
-# S3 Endpoint
-AUTUMN_S3_ENDPOINT=http://minio:9000
-
-# MinIO Root User
-MINIO_ROOT_USER=minioautumn
-
-# MinIO Root Password
-MINIO_ROOT_PASSWORD=minioautumn
-
-# AWS Access Key ID
-AWS_ACCESS_KEY_ID=minioautumn
-
-# AWS Secret Key
-AWS_SECRET_ACCESS_KEY=minioautumn
@@ -61,7 +61,7 @@ jobs:
    if: github.event_name != 'pull_request'
    strategy:
      matrix:
-        project: [delta, bonfire]
+        project: [delta, bonfire, autumn, january]
    name: Build ${{ matrix.project }} image
    steps:
      # Configure build environment
@@ -98,6 +98,14 @@ jobs:
              "bonfire": {
                "path": "crates/bonfire",
                "tag": "${{ github.repository_owner }}/bonfire"
+              },
+              "autumn": {
+                "path": "crates/services/autumn",
+                "tag": "${{ github.repository_owner }}/autumn"
+              },
+              "january": {
+                "path": "crates/services/january",
+                "tag": "${{ github.repository_owner }}/january"
              }
            }
          export_to: output
@@ -41,11 +41,7 @@ jobs:

      - name: Run services in background
        run: |
-          docker compose -f docker-compose.db.yml up -d
-
-      - name: Copy .env.example
-        run: |
-          cp .env.example .env
+          docker compose -f compose.yml up -d

      - name: Run cargo test
        env:
@@ -111,6 +111,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
 dependencies = [
 "cfg-if",
+ "getrandom",
 "once_cell",
 "version_check",
 "zerocopy",
@@ -324,9 +325,9 @@ dependencies = [

 [[package]]
 name = "async-recursion"
-version = "1.0.4"
+version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e97ce7de6cf12de5d7226c73f5ba9811622f4db3a5b91b55c53e987e5f91cba"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
 dependencies = [
 "proc-macro2",
 "quote 1.0.37",
@@ -602,9 +603,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-s3"
-version = "1.48.0"
+version = "1.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00a545b16c05af9302b0b4b38a7584f6f323749e407169aa3e9b210e7c0a808d"
+checksum = "4abf69a87be33b6f125a93d5046b5f7395c26d1f449bf8d3927f5577463b6de0"
 dependencies = [
 "ahash 0.8.11",
 "aws-credential-types",
@@ -637,9 +638,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-sso"
-version = "1.41.0"
+version = "1.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af0a3f676cba2c079c9563acc9233998c8951cdbe38629a0bef3c8c1b02f3658"
+checksum = "11822090cf501c316c6f75711d77b96fba30658e3867a7762e5e2f5d32d31e81"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -659,9 +660,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-ssooidc"
-version = "1.42.0"
+version = "1.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c91b6a04495547162cf52b075e3c15a17ab6608bf9c5785d3e5a5509b3f09f5c"
+checksum = "bc3e48ec239bb734db029ceef83599f4c9b3ce5d25c961b5bcd3f031c15bed54"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -681,9 +682,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-sts"
-version = "1.41.0"
+version = "1.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99c56bcd6a56cab7933980a54148b476a5a69a7694e3874d9aa2a566f150447d"
+checksum = "a20a91795850826a6f456f4a48eff1dfa59a0e69bdbf5b8c50518fd372106574"
 dependencies = [
 "aws-credential-types",
 "aws-runtime",
@@ -1139,9 +1140,9 @@ checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"

 [[package]]
 name = "bitstream-io"
-version = "2.5.3"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b81e1519b0d82120d2fd469d5bfb2919a9361c48b02d82d04befc1cdd2002452"
+checksum = "7c12d1856e42f0d817a835fe55853957c85c8c8a470114029143d3f12671446e"

 [[package]]
 name = "blake2b_simd"
@@ -1646,6 +1647,29 @@ dependencies = [
 "typenum",
 ]

+[[package]]
+name = "cssparser"
+version = "0.31.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b3df4f93e5fbbe73ec01ec8d3f68bba73107993a5b1e7519273c32db9b0d5be"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf 0.11.2",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13b588ba4ac1a99f7f2964d24b3d896ddc6bf847ee3855dbd4366f058cfcd331"
+dependencies = [
+ "quote 1.0.37",
+ "syn 2.0.76",
+]
+
 [[package]]
 name = "ct-codecs"
 version = "1.1.1"
@@ -1904,6 +1928,17 @@ dependencies = [
 "syn 1.0.107",
 ]

+[[package]]
+name = "derive_more"
+version = "0.99.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f33878137e4dafd7fa914ad4e259e18a4e8e532b9617a2d0150262bf53abfce"
+dependencies = [
+ "proc-macro2",
+ "quote 1.0.37",
+ "syn 2.0.76",
+]
+
 [[package]]
 name = "devise"
 version = "0.3.1"
@@ -1970,6 +2005,21 @@ version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"

+[[package]]
+name = "dtoa"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcbb2bf8e87535c23f7a8a321e364ce21462d0ff10cb6407820e8e96dfff6653"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.5"
@@ -2016,6 +2066,12 @@ dependencies = [
 "getrandom",
 ]

+[[package]]
+name = "ego-tree"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12a0bb14ac04a9fcf170d0bbbef949b44cc492f4452bd20c095636956f653642"
+
 [[package]]
 name = "either"
 version = "1.6.1"
@@ -2055,9 +2111,9 @@ dependencies = [

 [[package]]
 name = "encoding_rs"
-version = "0.8.31"
+version = "0.8.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9852635589dc9f9ea1b6fe9f05b50ef208c85c834a562f0c6abb1c475736ec2b"
+checksum = "b45de904aa0b010bce2ab45264d0631681847fa7b6f2eaa7dab7619943bc4f59"
 dependencies = [
 "cfg-if",
 ]
@@ -2355,6 +2411,16 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"

+[[package]]
+name = "futf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
+dependencies = [
+ "mac",
+ "new_debug_unreachable",
+]
+
 [[package]]
 name = "futures"
 version = "0.3.21"
@@ -2476,6 +2542,15 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
 [[package]]
 name = "generator"
 version = "0.7.0"
@@ -2508,6 +2583,15 @@ dependencies = [
 "version_check",
 ]

+[[package]]
+name = "getopts"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14dbbfd5c71d70241ecf9e6f13737f7b5ce823821063188d7e46c41d371eebd5"
+dependencies = [
+ "unicode-width",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.14"
@@ -2515,8 +2599,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
 dependencies = [
 "cfg-if",
+ "js-sys",
 "libc",
 "wasi",
+ "wasm-bindgen",
 ]

 [[package]]
@@ -2809,6 +2895,20 @@ dependencies = [
 "winapi",
 ]

+[[package]]
+name = "html5ever"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c13771afe0e6e846f1e67d038d4cb29998a6779f93c809212e4e9c32efd244d4"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+ "proc-macro2",
+ "quote 1.0.37",
+ "syn 2.0.76",
+]
+
 [[package]]
 name = "http"
 version = "0.2.12"
@@ -3542,9 +3642,9 @@ dependencies = [

 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.159"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "561d97a539a36e26a9a5fad1ea11a3039a67714694aaa379433e580854bc3dc5"

 [[package]]
 name = "libfuzzer-sys"
@@ -3733,12 +3833,32 @@ version = "0.11.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9106e1d747ffd48e6be5bb2d97fa706ed25b144fbee4d5c02eae110cd8d6badd"

+[[package]]
+name = "mac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
+
 [[package]]
 name = "maplit"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"

+[[package]]
+name = "markup5ever"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16ce3abbeba692c8b8441d036ef91aea6df8da2c6b6e21c7e14d3c18e526be45"
+dependencies = [
+ "log",
+ "phf 0.11.2",
+ "phf_codegen 0.11.2",
+ "string_cache",
+ "string_cache_codegen",
+ "tendril",
+]
+
 [[package]]
 name = "match_cfg"
 version = "0.1.0"
@@ -3773,6 +3893,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ea1f30cedd69f0a2954655f7188c6a834246d2bcf1e315e2ac40c4b24dc9519"
 dependencies = [
 "cfg-if",
+ "rayon",
 ]

 [[package]]
@@ -3786,9 +3907,9 @@ dependencies = [

 [[package]]
 name = "memchr"
-version = "2.5.0"
+version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"

 [[package]]
 name = "metrics"
@@ -4545,6 +4666,96 @@ dependencies = [
 "sha-1 0.8.2",
 ]

+[[package]]
+name = "phf"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
+dependencies = [
+ "phf_shared 0.10.0",
+]
+
+[[package]]
+name = "phf"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ade2d8b8f33c7333b51bcf0428d37e217e9f32192ae4772156f65063b8ce03dc"
+dependencies = [
+ "phf_macros",
+ "phf_shared 0.11.2",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb1c3a8bc4dd4e5cfce29b44ffc14bedd2ee294559a294e2a4d4c9e9a6a13cd"
+dependencies = [
+ "phf_generator 0.10.0",
+ "phf_shared 0.10.0",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8d39688d359e6b34654d328e262234662d16cc0f60ec8dcbe5e718709342a5a"
+dependencies = [
+ "phf_generator 0.11.2",
+ "phf_shared 0.11.2",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
+dependencies = [
+ "phf_shared 0.10.0",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e4cc64c2ad9ebe670cb8fd69dd50ae301650392e81c05f9bfcb2d5bdbc24b0"
+dependencies = [
+ "phf_shared 0.11.2",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3444646e286606587e49f3bcf1679b8cef1dc2c5ecc29ddacaffc305180d464b"
+dependencies = [
+ "phf_generator 0.11.2",
+ "phf_shared 0.11.2",
+ "proc-macro2",
+ "quote 1.0.37",
+ "syn 2.0.76",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90fcb95eef784c2ac79119d1dd819e162b5da872ce6f3c3abe1e8ca1c082f72b"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project"
 version = "1.0.10"
@@ -4667,6 +4878,12 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eb9f9e6e233e5c4a35559a617bf40a4ec447db2e84c20b55a6f83167b7e57872"

+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
 [[package]]
 name = "pretty_env_logger"
 version = "0.4.0"
@@ -5003,15 +5220,17 @@ dependencies = [

 [[package]]
 name = "ravif"
-version = "0.11.10"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8f0bfd976333248de2078d350bfdf182ff96e168a24d23d2436cef320dd4bdd"
+checksum = "85be49d628515bb99a01c44200009f0a4167c252f036445b975b35daf952258c"
 dependencies = [
 "avif-serialize",
+ "bitstream-io",
 "imgref",
 "loop9",
 "quick-error 2.0.1",
 "rav1e",
+ "rayon",
 "rgb",
 ]

@@ -5154,14 +5373,14 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.9.4"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12de2eff854e5fa4b1295edd650e227e9d8fb0c9e90b12e7f36d6a6811791a29"
+checksum = "38200e5ee88914975b69f657f0801b6f6dccafd44fd9326302a4aaeecfacb1d8"
 dependencies = [
 "aho-corasick",
 "memchr",
- "regex-automata 0.3.7",
- "regex-syntax 0.7.5",
+ "regex-automata 0.4.8",
+ "regex-syntax 0.8.5",
 ]

 [[package]]
@@ -5175,13 +5394,13 @@ dependencies = [

 [[package]]
 name = "regex-automata"
-version = "0.3.7"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49530408a136e16e5b486e883fbb6ba058e8e4e8ae6621a77b048b314336e629"
+checksum = "368758f23274712b504848e9d5a6f010445cc8b87a7cdb4d7cbee666c1288da3"
 dependencies = [
 "aho-corasick",
 "memchr",
- "regex-syntax 0.7.5",
+ "regex-syntax 0.8.5",
 ]

 [[package]]
@@ -5198,9 +5417,9 @@ checksum = "49b3de9ec5dc0a3417da371aab17d729997c15010e7fd24ff707773a33bddb64"

 [[package]]
 name = "regex-syntax"
-version = "0.7.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"

 [[package]]
 name = "reqwest"
@@ -5292,7 +5511,7 @@ dependencies = [

 [[package]]
 name = "revolt-autumn"
-version = "0.7.14"
+version = "0.7.17"
 dependencies = [
 "axum",
 "axum-macros",
@@ -5305,10 +5524,12 @@ dependencies = [
 "kamadak-exif",
 "lazy_static",
 "moka",
+ "nanoid",
 "revolt-config",
 "revolt-database",
 "revolt-files",
 "revolt-result",
+ "revolt_clamav-client",
 "serde",
 "serde_json",
 "sha2",
@@ -5316,8 +5537,10 @@ dependencies = [
 "strum_macros",
 "tempfile",
 "tokio 1.35.1",
+ "tower-http",
 "tracing",
 "tracing-subscriber",
+ "ulid 1.1.3",
 "utoipa",
 "utoipa-scalar",
 "webp",
@@ -5325,7 +5548,7 @@ dependencies = [

 [[package]]
 name = "revolt-bonfire"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "async-channel 2.3.1",
 "async-std",
@@ -5355,7 +5578,7 @@ dependencies = [

 [[package]]
 name = "revolt-config"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "async-std",
 "cached",
@@ -5365,19 +5588,21 @@ dependencies = [
 "log",
 "once_cell",
 "pretty_env_logger",
+ "revolt-result",
 "sentry",
 "serde",
 ]

 [[package]]
 name = "revolt-database"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "async-lock 2.8.0",
 "async-recursion",
 "async-std",
 "async-trait",
 "authifier",
+ "axum",
 "base64 0.21.3",
 "bson",
 "deadqueue",
@@ -5409,7 +5634,7 @@ dependencies = [
 "schemars",
 "serde",
 "serde_json",
- "ulid 1.0.0",
+ "ulid 1.1.3",
 "unicode-segmentation",
 "url-escape",
 "validator 0.16.0",
@@ -5418,7 +5643,7 @@ dependencies = [

 [[package]]
 name = "revolt-delta"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "async-channel 1.6.1",
 "async-std",
@@ -5465,32 +5690,45 @@ dependencies = [

 [[package]]
 name = "revolt-files"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "aes-gcm 0.10.3",
 "aws-config",
 "aws-sdk-s3",
 "base64 0.22.1",
+ "ffprobe",
+ "image",
+ "imagesize",
+ "jxl-oxide",
 "revolt-config",
 "revolt-result",
+ "tempfile",
+ "tracing",
 "typenum",
+ "webp",
 ]

 [[package]]
 name = "revolt-january"
-version = "0.7.14"
+version = "0.7.17"
 dependencies = [
+ "async-recursion",
 "axum",
 "axum-extra",
+ "encoding_rs",
 "lazy_static",
 "mime",
 "moka",
+ "regex",
 "reqwest 0.12.4",
 "revolt-config",
+ "revolt-files",
 "revolt-models",
 "revolt-result",
+ "scraper",
 "serde",
 "serde_json",
+ "tempfile",
 "tokio 1.35.1",
 "tracing",
 "tracing-subscriber",
@@ -5500,7 +5738,7 @@ dependencies = [

 [[package]]
 name = "revolt-models"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "indexmap 1.9.3",
 "iso8601-timestamp 0.2.11",
@@ -5518,7 +5756,7 @@ dependencies = [

 [[package]]
 name = "revolt-nodejs-bindings"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "async-std",
 "neon",
@@ -5531,7 +5769,7 @@ dependencies = [

 [[package]]
 name = "revolt-permissions"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "async-std",
 "async-trait",
@@ -5546,7 +5784,7 @@ dependencies = [

 [[package]]
 name = "revolt-presence"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "async-std",
 "log",
@@ -5557,7 +5795,7 @@ dependencies = [

 [[package]]
 name = "revolt-result"
-version = "0.7.16"
+version = "0.7.17"
 dependencies = [
 "axum",
 "revolt_okapi",
@@ -5593,6 +5831,12 @@ dependencies = [
 "tokio 1.35.1",
 ]

+[[package]]
+name = "revolt_clamav-client"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d719e9fe861e2e05cbf01fd82d310fdeb2160c74fee21689a5c223eeb65cea8"
+
 [[package]]
 name = "revolt_okapi"
 version = "0.9.1"
@@ -5941,9 +6185,9 @@ dependencies = [

 [[package]]
 name = "rustix"
-version = "0.38.34"
+version = "0.38.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
+checksum = "8acb788b847c24f28525660c4d7758620a7210875711f79e7f663cc152726811"
 dependencies = [
 "bitflags 2.6.0",
 "errno",
@@ -6116,6 +6360,22 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"

+[[package]]
+name = "scraper"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b90460b31bfe1fc07be8262e42c665ad97118d4585869de9345a84d501a9eaf0"
+dependencies = [
+ "ahash 0.8.11",
+ "cssparser",
+ "ego-tree",
+ "getopts",
+ "html5ever",
+ "once_cell",
+ "selectors",
+ "tendril",
+]
+
 [[package]]
 name = "sct"
 version = "0.7.0"
@@ -6180,6 +6440,25 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "selectors"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eb30575f3638fc8f6815f448d50cb1a2e255b0897985c8c59f4d37b72a07b06"
+dependencies = [
+ "bitflags 2.6.0",
+ "cssparser",
+ "derive_more",
+ "fxhash",
+ "log",
+ "new_debug_unreachable",
+ "phf 0.10.1",
+ "phf_codegen 0.10.0",
+ "precomputed-hash",
+ "servo_arc",
+ "smallvec",
+]
+
 [[package]]
 name = "semver"
 version = "0.9.0"
@@ -6420,6 +6699,15 @@ dependencies = [
 "syn 1.0.107",
 ]

+[[package]]
+name = "servo_arc"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d036d71a959e00c77a63538b90a6c2390969f9772b096ea837205c6bd0491a44"
+dependencies = [
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "sha-1"
 version = "0.8.2"
@@ -6536,6 +6824,12 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f27f6278552951f1f2b8cf9da965d10969b2efdea95a6ec47987ab46edfe263a"

+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
 [[package]]
 name = "slab"
 version = "0.4.6"
@@ -6613,6 +6907,12 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
 [[package]]
 name = "state"
 version = "0.5.3"
@@ -6622,6 +6922,32 @@ dependencies = [
 "loom",
 ]

+[[package]]
+name = "string_cache"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91138e76242f575eb1d3b38b4f1362f10d3a43f47d182a5b359af488a02293b"
+dependencies = [
+ "new_debug_unreachable",
+ "once_cell",
+ "parking_lot",
+ "phf_shared 0.10.0",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb30289b722be4ff74a408c3cc27edeaad656e06cb1fe8fa9231fa59c728988"
+dependencies = [
+ "phf_generator 0.10.0",
+ "phf_shared 0.10.0",
+ "proc-macro2",
+ "quote 1.0.37",
+]
+
 [[package]]
 name = "stringprep"
 version = "0.1.2"
@@ -6808,9 +7134,9 @@ checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"

 [[package]]
 name = "tempfile"
-version = "3.12.0"
+version = "3.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04cbcdd0c794ebb0d4cf35e88edd2f7d2c4c3e9a5a6dab322839b321c6a87a64"
+checksum = "f0f2c9fc62d0beef6951ccffd757e241266a2c833136efbe35af6cd2567dca5b"
 dependencies = [
 "cfg-if",
 "fastrand 2.1.1",
@@ -6819,6 +7145,17 @@ dependencies = [
 "windows-sys 0.59.0",
 ]

+[[package]]
+name = "tendril"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
+dependencies = [
+ "futf",
+ "mac",
+ "utf-8",
+]
+
 [[package]]
 name = "termcolor"
 version = "1.1.3"
@@ -7106,6 +7443,22 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "tower-http"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
+dependencies = [
+ "bitflags 2.6.0",
+ "bytes 1.5.0",
+ "http 1.1.0",
+ "http-body 1.0.0",
+ "http-body-util",
+ "pin-project-lite 0.2.13",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.2"
@@ -7321,11 +7674,13 @@ dependencies = [

 [[package]]
 name = "ulid"
-version = "1.0.0"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "13a3aaa69b04e5b66cc27309710a569ea23593612387d67daaf102e73aa974fd"
+checksum = "04f903f293d11f31c0c29e4148f6dc0d033a7f80cebc0282bea147611667d289"
 dependencies = [
+ "getrandom",
 "rand 0.8.5",
+ "web-time",
 ]

 [[package]]
@@ -7393,6 +7748,12 @@ version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"

+[[package]]
+name = "unicode-width"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+
 [[package]]
 name = "unicode-xid"
 version = "0.0.4"
@@ -7506,7 +7867,7 @@ dependencies = [
 "quote 1.0.37",
 "regex",
 "syn 2.0.76",
- "ulid 1.0.0",
+ "ulid 1.1.3",
 ]

 [[package]]
@@ -7788,6 +8149,16 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "webp"
 version = "0.3.0"
@@ -1,19 +1,34 @@
-# Revolt Backend
+<div align="center">
+<h1>
+  Revolt Backend
+  
+  [![Stars](https://img.shields.io/github/stars/revoltchat/backend?style=flat-square&logoColor=white)](https://github.com/revoltchat/backend/stargazers)
+  [![Forks](https://img.shields.io/github/forks/revoltchat/backend?style=flat-square&logoColor=white)](https://github.com/revoltchat/backend/network/members)
+  [![Pull Requests](https://img.shields.io/github/issues-pr/revoltchat/backend?style=flat-square&logoColor=white)](https://github.com/revoltchat/backend/pulls)
+  [![Issues](https://img.shields.io/github/issues/revoltchat/backend?style=flat-square&logoColor=white)](https://github.com/revoltchat/backend/issues)
+  [![Contributors](https://img.shields.io/github/contributors/revoltchat/backend?style=flat-square&logoColor=white)](https://github.com/revoltchat/backend/graphs/contributors)
+  [![License](https://img.shields.io/github/license/revoltchat/backend?style=flat-square&logoColor=white)](https://github.com/revoltchat/backend/blob/main/LICENSE)
+</h1>
+The services and libraries that power the Revolt service.<br/>
+<br/>

-This is a monorepo for the Revolt backend.
+| Crate              | Path                                               | Description                              |                                                                                                                                                                                                                                                                                                           |
+| ------------------ | -------------------------------------------------- | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `core/config`      | [crates/core/config](crates/core/config)           | Core: Configuration                      | ![Crates.io Version](https://img.shields.io/crates/v/revolt-config) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-config) ![Crates.io Version](https://img.shields.io/crates/size/revolt-config) ![Crates.io License](https://img.shields.io/crates/l/revolt-config)                     |
+| `core/database`    | [crates/core/database](crates/core/database)       | Core: Database Implementation            | ![Crates.io Version](https://img.shields.io/crates/v/revolt-database) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-database) ![Crates.io Version](https://img.shields.io/crates/size/revolt-database) ![Crates.io License](https://img.shields.io/crates/l/revolt-database)             |
+| `core/files`       | [crates/core/files](crates/core/files)             | Core: S3 and encryption subroutines      | ![Crates.io Version](https://img.shields.io/crates/v/revolt-files) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-files) ![Crates.io Version](https://img.shields.io/crates/size/revolt-files) ![Crates.io License](https://img.shields.io/crates/l/revolt-files)                         |
+| `core/models`      | [crates/core/models](crates/core/models)           | Core: API Models                         | ![Crates.io Version](https://img.shields.io/crates/v/revolt-models) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-models) ![Crates.io Version](https://img.shields.io/crates/size/revolt-models) ![Crates.io License](https://img.shields.io/crates/l/revolt-models)                     |
+| `core/permissions` | [crates/core/permissions](crates/core/permissions) | Core: Permission Logic                   | ![Crates.io Version](https://img.shields.io/crates/v/revolt-permissions) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-permissions) ![Crates.io Version](https://img.shields.io/crates/size/revolt-permissions) ![Crates.io License](https://img.shields.io/crates/l/revolt-permissions) |
+| `core/presence`    | [crates/core/presence](crates/core/presence)       | Core: User Presence                      | ![Crates.io Version](https://img.shields.io/crates/v/revolt-presence) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-presence) ![Crates.io Version](https://img.shields.io/crates/size/revolt-presence) ![Crates.io License](https://img.shields.io/crates/l/revolt-presence)             |
+| `core/result`      | [crates/core/result](crates/core/result)           | Core: Result and Error types             | ![Crates.io Version](https://img.shields.io/crates/v/revolt-result) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-result) ![Crates.io Version](https://img.shields.io/crates/size/revolt-result) ![Crates.io License](https://img.shields.io/crates/l/revolt-result)                     |
+| `delta`            | [crates/delta](crates/delta)                       | REST API server                          | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
+| `bonfire`          | [crates/bonfire](crates/bonfire)                   | WebSocket events server                  | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
+| `services/january` | [crates/services/january](crates/services/january) | Proxy server                             | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
+| `services/autumn`  | [crates/services/autumn](crates/services/autumn)   | File server                              | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
+| `bindings/node`    | [crates/bindings/node](crates/bindings/node)       | Node.js bindings for the Revolt software | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |

-| Crate              | Path                                               | Description                   |
-| ------------------ | -------------------------------------------------- | ----------------------------- |
-| `core/config`      | [crates/core/config](crates/core/config)           | Core: Configuration           |
-| `core/database`    | [crates/core/database](crates/core/database)       | Core: Database Implementation |
-| `core/models`      | [crates/core/models](crates/core/models)           | Core: API Models              |
-| `core/permissions` | [crates/core/permissions](crates/core/permissions) | Core: Permission Logic        |
-| `core/presence`    | [crates/core/presence](crates/core/presence)       | Core: User Presence           |
-| `core/result`      | [crates/core/result](crates/core/result)           | Core: Result and Error types  |
-| `delta`            | [crates/delta](crates/delta)                       | REST API server               |
-| `bonfire`          | [crates/bonfire](crates/bonfire)                   | WebSocket events server       |
-
-Note: `january`, `autumn`, and `vortex` are yet to be moved into this monorepo.
+</div>
+<br/>

 ## Minimum Supported Rust Version

@@ -60,13 +75,19 @@ cargo build

 A default configuration `Revolt.toml` is present in this project that is suited for development.

-If you'd like to change anything, create a `Revolt.overrides.toml` file to overwrite it.
+If you'd like to change anything, create a `Revolt.overrides.toml` file and specify relevant variables.

-You may need to configure the legacy environment options:
-
-```bash
-cp .env.example .env
-```
+> [!TIP]
+> Use Sentry to catch unexpected service errors:
+>
+> ```toml
+> # Revolt.overrides.toml
+> [sentry]
+> api = "https://abc@your.sentry/1"
+> events = "https://abc@your.sentry/1"
+> files = "https://abc@your.sentry/1"
+> proxy = "https://abc@your.sentry/1"
+> ```

 Then continue:

@@ -98,10 +119,13 @@ git clone --recursive https://github.com/revoltchat/revite
 cd revite
 yarn
 yarn build:deps
+echo "VITE_API_URL=http://local.revolt.chat:14702" > .env.local
 yarn dev --port 14701
 ```

-Then go to https://local.revolt.chat:14701
+Then go to http://local.revolt.chat:14701 to create an account/login.
+
+When signing up, go to http://localhost:14080 to find confirmation/password reset emails.

 ## Deployment Guide

@@ -4,10 +4,10 @@
 [database]
 # MongoDB connection URL
 # Defaults to the container name specified in self-hosted
-mongodb = "mongodb://localhost:14017"
+mongodb = "mongodb://127.0.0.1:14017"
 # Redis connection URL
 # Defaults to the container name specified in self-hosted
-redis = "redis://localhost:14079/"
+redis = "redis://127.0.0.1:14079/"

 [hosts]
 # Web locations of various services
@@ -25,11 +25,6 @@ voso_legacy_ws = ""

 [api]

-[api.registration]
-# Whether an invite should be required for registration
-# See https://github.com/revoltchat/self-hosted#making-your-instance-invite-only
-invite_only = false
-
 [api.smtp]
 # Email server configuration for verification
 # Defaults to no email verification (host field is empty)
@@ -41,97 +36,9 @@ reply_to = "support@revolt.chat"
 port = 14025
 use_tls = false

-[api.vapid]
-# Generate your own keys:
-# 1. Run `openssl ecparam -name prime256v1 -genkey -noout -out vapid_private.pem`
-# 2. Find `private_key` using `base64 vapid_private.pem`
-# 3. Find `public_key` using `openssl ec -in vapid_private.pem -outform DER|tail -c 65|base64|tr '/+' '_-'|tr -d '\n'`
-private_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUJSUWpyTWxLRnBiVWhsUHpUbERvcEliYk1yeVNrNXpKYzVYVzIxSjJDS3hvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWnkrQkg2TGJQZ2hEa3pEempXOG0rUXVPM3pCajRXT1phdkR6ZU00c0pqbmFwd1psTFE0WAp1ZDh2TzVodU94QWhMQlU3WWRldVovWHlBdFpWZmNyQi9BPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo"
-public_key = "BGcvgR-i2z4IQ5Mw841vJvkLjt8wY-FjmWrw83jOLCY52qcGZS0OF7nfLzuYbjsQISwVO2HXrmf18gLWVX3Kwfw="
-
-[api.fcm]
-# Google Firebase Cloud Messaging Service Account Key
-# Obtained from the cloud messaging console
-key_type = ""
-project_id = ""
-private_key_id = ""
-private_key = ""
-client_email = ""
-client_id = ""
-auth_uri = ""
-token_uri = ""
-auth_provider_x509_cert_url = ""
-client_x509_cert_url = ""
-
-[api.apn]
-# Apple Push Notifications keys for sending notifications
-sandbox = false
-pkcs8 = ""
-key_id = ""
-team_id = ""
-
-[api.security]
-# Authifier Shield API key
-authifier_shield_key = ""
-# Legacy voice server management token
-voso_legacy_token = ""
-# Whether services are behind the Cloudflare network
-trust_cloudflare = false
-
-[api.security.captcha]
-# hCaptcha configuration
-hcaptcha_key = ""
-hcaptcha_sitekey = ""
-
-[api.workers]
-# Maximum concurrent connections (to proxy server)
-max_concurrent_connections = 50
-
-[files]
-# Encryption key for stored files
-# Generate your own key using `openssl rand -base64 32`
-encryption_key = "qcuMA+ssxhMyKaNAKBGFfryfFtUH8NDlamQyDwGW6fU="
-# Quality used for lossy WebP previews (set to 100 for lossless)
-webp_quality = 80.0
-# Mime types that cannot be uploaded or served
-#
-# Example for Windows executables and Android installation files:
-# ["application/vnd.microsoft.portable-executable", "application/vnd.android.package-archive"]
-blocked_mime_types = []
-# ClamAV service
-# hostname:port
-clamd_host = ""
-
-[files.limit]
-# Minimum image resolution
-min_resolution = [1, 1]
-# Maximum MP of images
-max_mega_pixels = 40
-# Maximum pixel side of an image
-max_pixel_side = 10_000
-
-[files.preview]
-# Maximum image resolution
-attachments = [1280, 1280]
-avatars = [128, 128]
-backgrounds = [1280, 720]
-icons = [128, 128]
-banners = [480, 480]
-emojis = [128, 128]
-
 [files.s3]
-# Configuration for S3
-# Defaults included for MinIO + self-hosted setup
-#
-# Backblaze B2:
-# - endpoint is listed on the "Buckets" page
-# - region is `eu-central-003` string from endpoint URL
-# - access_key_id is keyID generated on the "Application Keys" page
-# - secret_access_key is token generated on the "Application Keys" page
-# - default_bucket matches the name of the bucket you've created
-
 # S3 protocol endpoint
-endpoint = "http://localhost:14009"
+endpoint = "http://127.0.0.1:14009"
 # S3 region name
 region = "minio"
 # S3 protocol key ID
@@ -140,60 +47,3 @@ access_key_id = "minioautumn"
 secret_access_key = "minioautumn"
 # Bucket to upload to by default
 default_bucket = "revolt-uploads"
-
-[features]
-# Feature gate options
-webhooks_enabled = false
-
-[features.limits]
-
-[features.limits.global]
-group_size = 100
-message_embeds = 5
-message_replies = 5
-message_reactions = 20
-server_emoji = 100
-server_roles = 200
-server_channels = 200
-
-# How many days since creation a user is considered new
-new_user_days = 3
-
-# Maximum permissible body size in bytes for uploads
-# (should be greater than any one file upload limit)
-body_limit_size = 20_000_000
-
-[features.limits.new_user]
-outgoing_friend_requests = 5
-
-bots = 2
-message_length = 2000
-message_attachments = 5
-servers = 100
-
-attachment_size = 20_000_000
-avatar_size = 4_000_000
-background_size = 6_000_000
-icon_size = 2_500_000
-banner_size = 6_000_000
-emoji_size = 500_000
-
-[features.limits.default]
-outgoing_friend_requests = 10
-
-bots = 5
-message_length = 2000
-message_attachments = 5
-servers = 100
-
-attachment_size = 20_000_000
-avatar_size = 4_000_000
-background_size = 6_000_000
-icon_size = 2_500_000
-banner_size = 6_000_000
-emoji_size = 500_000
-
-[sentry]
-# Configuration for Sentry error reporting
-api = ""
-events = ""
@@ -24,6 +24,7 @@ services:
      - ./.data/minio:/data
    ports:
      - "14009:9000"
+      - "14010:9001"
    restart: always

  # Create buckets for minio.
@@ -46,7 +47,7 @@ services:
  maildev:
    image: soulteary/maildev
    ports:
-      - "14025:8080"
+      - "14025:25"
      - "14080:8080"
    environment:
      MAILDEV_SMTP_PORT: 25
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-nodejs-bindings"
-version = "0.7.16"
+version = "0.7.17"
 description = "Node.js bindings for the Revolt software"
 authors = ["Paul Makles <me@insrt.uk>"]
 license = "MIT"
@@ -20,6 +20,6 @@ serde = { version = "1", features = ["derive"] }

 async-std = "1.12.0"

-revolt-config = { version = "0.7.16", path = "../../core/config" }
-revolt-result = { version = "0.7.16", path = "../../core/result" }
-revolt-database = { version = "0.7.16", path = "../../core/database" }
+revolt-config = { version = "0.7.17", path = "../../core/config" }
+revolt-result = { version = "0.7.17", path = "../../core/result" }
+revolt-database = { version = "0.7.17", path = "../../core/database" }
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-bonfire"
-version = "0.7.16"
+version = "0.7.17"
 license = "AGPL-3.0-or-later"
 edition = "2021"

@@ -41,7 +41,7 @@ revolt-result = { path = "../core/result" }
 revolt-models = { path = "../core/models" }
 revolt-config = { path = "../core/config" }
 revolt-database = { path = "../core/database" }
-revolt-permissions = { version = "0.7.16", path = "../core/permissions" }
+revolt-permissions = { version = "0.7.17", path = "../core/permissions" }
 revolt-presence = { path = "../core/presence", features = ["redis-is-patched"] }

 # redis
@@ -5,7 +5,6 @@ FROM ghcr.io/revoltchat/base:latest AS builder
 FROM gcr.io/distroless/cc-debian12:nonroot
 COPY --from=builder /home/rust/src/target/release/revolt-bonfire ./

-EXPOSE 9000
+EXPOSE 14703
 USER nonroot
-ENV HOST=0.0.0.0:9000
 CMD ["./revolt-bonfire"]
@@ -14,6 +14,7 @@ use futures::{
    FutureExt, SinkExt, StreamExt, TryStreamExt,
 };
 use redis_kiss::{PayloadType, REDIS_PAYLOAD_TYPE, REDIS_URI};
+use revolt_config::report_internal_error;
 use revolt_database::{
    events::{client::EventV1, server::ClientMessage},
    Database, User, UserHint,
@@ -99,27 +100,21 @@ pub async fn client(db: &'static Database, stream: TcpStream, addr: SocketAddr)
    let user_id = state.cache.user_id.clone();

    // Notify socket we have authenticated.
-    if let Err(err) = write.send(config.encode(&EventV1::Authenticated)).await {
-        error!("Failed to write: {err:?}");
-        sentry::capture_error(&err);
+    if report_internal_error!(write.send(config.encode(&EventV1::Authenticated)).await).is_err() {
        return;
    }

    // Download required data to local cache and send Ready payload.
-    let ready_payload = match state
-        .generate_ready_payload(db, config.get_ready_payload_fields())
-        .await
-    {
+    let ready_payload = match report_internal_error!(
+        state
+            .generate_ready_payload(db, config.get_ready_payload_fields())
+            .await
+    ) {
        Ok(ready_payload) => ready_payload,
-        Err(err) => {
-            sentry::capture_error(&err);
-            return;
-        }
+        Err(_) => return,
    };

-    if let Err(err) = write.send(config.encode(&ready_payload)).await {
-        error!("Failed to write: {err:?}");
-        sentry::capture_error(&err);
+    if report_internal_error!(write.send(config.encode(&ready_payload)).await).is_err() {
        return;
    }

@@ -214,21 +209,16 @@ async fn listener(
    write: &Mutex<WsWriter>,
 ) {
    let redis_config = RedisConfig::from_url(&REDIS_URI).unwrap();
-    let subscriber = match fred::types::Builder::from_config(redis_config).build_subscriber_client()
-    {
+    let subscriber = match report_internal_error!(
+        fred::types::Builder::from_config(redis_config).build_subscriber_client()
+    ) {
        Ok(subscriber) => subscriber,
-        Err(err) => {
-            error!("Failed to build a subscriber: {err:?}");
-            sentry::capture_error(&err);
-            return;
-        }
+        Err(_) => return,
    };

-    if let Err(err) = subscriber.init().await {
-        error!("Failed to init subscriber: {err:?}");
-        sentry::capture_error(&err);
+    if report_internal_error!(subscriber.init().await).is_err() {
        return;
-    };
+    }

    // Handle Redis connection dropping
    let (clean_up_s, clean_up_r) = async_channel::bounded(1);
@@ -249,17 +239,13 @@ async fn listener(
        // Check for state changes for subscriptions.
        match state.apply_state().await {
            SubscriptionStateChange::Reset => {
-                if let Err(err) = subscriber.unsubscribe_all().await {
-                    error!("Unsubscribe all failed: {err:?}");
-                    sentry::capture_error(&err);
+                if report_internal_error!(subscriber.unsubscribe_all().await).is_err() {
                    break 'out;
                }

                let subscribed = state.subscribed.read().await;
                for id in subscribed.iter() {
-                    if let Err(err) = subscriber.subscribe(id).await {
-                        error!("Subscribe failed: {err:?}");
-                        sentry::capture_error(&err);
+                    if report_internal_error!(subscriber.subscribe(id).await).is_err() {
                        break 'out;
                    }
                }
@@ -272,9 +258,7 @@ async fn listener(
                    #[cfg(debug_assertions)]
                    info!("{addr:?} unsubscribing from {id}");

-                    if let Err(err) = subscriber.unsubscribe(id).await {
-                        error!("Unsubscribe failed: {err:?}");
-                        sentry::capture_error(&err);
+                    if report_internal_error!(subscriber.unsubscribe(id).await).is_err() {
                        break 'out;
                    }
                }
@@ -283,9 +267,7 @@ async fn listener(
                    #[cfg(debug_assertions)]
                    info!("{addr:?} subscribing to {id}");

-                    if let Err(err) = subscriber.subscribe(id).await {
-                        error!("Subscribe failed: {err:?}");
-                        sentry::capture_error(&err);
+                    if report_internal_error!(subscriber.subscribe(id).await).is_err() {
                        break 'out;
                    }
                }
@@ -310,13 +292,9 @@ async fn listener(
            _ = t2 => {},
            message = t1 => {
                // Handle incoming events.
-                let message = match message {
+                let message = match report_internal_error!(message) {
                    Ok(message) => message,
-                    Err(e) => {
-                        error!("Error while consuming pub/sub messages: {e:?}");
-                        sentry::capture_error(&e);
-                        break 'out;
-                    }
+                    Err(_) => break 'out
                };

                let event = match *REDIS_PAYLOAD_TYPE {
@@ -393,10 +371,7 @@ async fn listener(
        }
    }

-    if let Err(err) = subscriber.quit().await {
-        error!("{}", err);
-        sentry::capture_error(&err);
-    }
+    report_internal_error!(subscriber.quit().await).ok();
 }

 #[allow(clippy::too_many_arguments)]
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-config"
-version = "0.7.16"
+version = "0.7.17"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -9,6 +9,7 @@ description = "Revolt Backend: Configuration"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

 [features]
+report-macros = ["revolt-result"]
 test = ["async-std"]
 default = ["test"]

@@ -32,3 +33,6 @@ pretty_env_logger = "0.4.0"

 # Sentry
 sentry = "0.31.5"
+
+# Core
+revolt-result = { version = "0.7.17", path = "../result", optional = true }
@@ -98,8 +98,18 @@ blocked_mime_types = []
 # ClamAV service
 # hostname:port
 clamd_host = ""
+# Mime types that should be virus scanned
+#
+# Leave empty to scan all file types
+scan_mime_types = [
+    "application/vnd.microsoft.portable-executable",
+    "application/vnd.android.package-archive",
+    "application/zip",
+]

 [files.limit]
+# Minimum file size (in bytes)
+min_file_size = 1
 # Minimum image resolution
 min_resolution = [1, 1]
 # Maximum MP of images
@@ -153,44 +163,70 @@ server_emoji = 100
 server_roles = 200
 server_channels = 200

-# How many days since creation a user is considered new
-new_user_days = 3
+# How many hours since creation a user is considered new
+new_user_hours = 72

 # Maximum permissible body size in bytes for uploads
 # (should be greater than any one file upload limit)
 body_limit_size = 20_000_000

 [features.limits.new_user]
+# Limits imposed on new users
+
+# Number of outgoing friend requests permitted at any time
 outgoing_friend_requests = 5

+# Maximum number of owned bots
 bots = 2
-message_length = 2000
-message_attachments = 5
-servers = 100

-attachment_size = 20_000_000
-avatar_size = 4_000_000
-background_size = 6_000_000
-icon_size = 2_500_000
-banner_size = 6_000_000
-emoji_size = 500_000
+# Message content length
+message_length = 2000
+
+# Number of attachments that can be included
+message_attachments = 5
+
+# Maximum number of servers the user can create/join
+servers = 50
+
+[features.limits.new_user.file_upload_size_limit]
+# Maximum file size limits (in bytes)
+attachments = 20_000_000
+avatars = 4_000_000
+backgrounds = 6_000_000
+icons = 2_500_000
+banners = 6_000_000
+emojis = 500_000

 [features.limits.default]
+# Limits imposed on users by default
+
+# Number of outgoing friend requests permitted at any time
 outgoing_friend_requests = 10

+# Maximum number of owned bots
 bots = 5
+
+# Message content length
 message_length = 2000
+
+# Number of attachments that can be included
 message_attachments = 5
+
+# Maximum number of servers the user can create/join
 servers = 100

-attachment_size = 20_000_000
-avatar_size = 4_000_000
-background_size = 6_000_000
-icon_size = 2_500_000
-banner_size = 6_000_000
-emoji_size = 500_000
+[features.limits.default.file_upload_size_limit]
+# Maximum file size limits (in bytes)
+attachments = 20_000_000
+avatars = 4_000_000
+backgrounds = 6_000_000
+icons = 2_500_000
+banners = 6_000_000
+emojis = 500_000

 [sentry]
 # Configuration for Sentry error reporting
 api = ""
 events = ""
+files = ""
+proxy = ""
@@ -6,11 +6,49 @@ use futures_locks::RwLock;
 use once_cell::sync::Lazy;
 use serde::Deserialize;

-pub use sentry::capture_error;
+pub use sentry::{capture_error, capture_message, Level};

-#[cfg(not(debug_assertions))]
-use std::env;
+#[cfg(feature = "report-macros")]
+#[macro_export]
+macro_rules! report_error {
+    ( $expr: expr, $error: ident $( $tt:tt )? ) => {
+        $expr
+            .inspect_err(|err| {
+                $crate::capture_message(
+                    &format!("{err:?} ({}:{}:{})", file!(), line!(), column!()),
+                    $crate::Level::Error,
+                );
+            })
+            .map_err(|_| ::revolt_result::create_error!($error))
+    };
+}

+#[cfg(feature = "report-macros")]
+#[macro_export]
+macro_rules! report_internal_error {
+    ( $expr: expr ) => {
+        $expr
+            .inspect_err(|err| {
+                $crate::capture_message(
+                    &format!("{err:?} ({}:{}:{})", file!(), line!(), column!()),
+                    $crate::Level::Error,
+                );
+            })
+            .map_err(|_| ::revolt_result::create_error!(InternalError))
+    };
+}
+
+/// Paths to search for configuration
+static CONFIG_SEARCH_PATHS: [&str; 3] = [
+    // current working directory
+    "Revolt.toml",
+    // current working directory - overrides file
+    "Revolt.overrides.toml",
+    // root directory, for Docker containers
+    "/Revolt.toml",
+];
+
+/// Configuration builder
 static CONFIG_BUILDER: Lazy<RwLock<Config>> = Lazy::new(|| {
    RwLock::new({
        let mut builder = Config::builder().add_source(File::from_str(
@@ -23,18 +61,18 @@ static CONFIG_BUILDER: Lazy<RwLock<Config>> = Lazy::new(|| {
                include_str!("../Revolt.test.toml"),
                FileFormat::Toml,
            ));
-        } else if std::path::Path::new("Revolt.toml").exists() {
-            builder = builder.add_source(File::new("Revolt.toml", FileFormat::Toml));
-        } else if std::path::Path::new("/Revolt.toml").exists() {
-            builder = builder.add_source(File::new("/Revolt.toml", FileFormat::Toml));
+        }
+
+        for path in CONFIG_SEARCH_PATHS {
+            if std::path::Path::new(path).exists() {
+                builder = builder.add_source(File::new(path, FileFormat::Toml));
+            }
        }

        builder.build().unwrap()
    })
 });

-// https://gifbox.me/view/gT5mqxYKCZv-twilight-meow
-
 #[derive(Deserialize, Debug, Clone)]
 pub struct Database {
    pub mongodb: String,
@@ -128,6 +166,7 @@ pub struct Api {

 #[derive(Deserialize, Debug, Clone)]
 pub struct FilesLimit {
+    pub min_file_size: usize,
    pub min_resolution: [usize; 2],
    pub max_mega_pixels: usize,
    pub max_pixel_side: usize,
@@ -148,6 +187,7 @@ pub struct Files {
    pub webp_quality: f32,
    pub blocked_mime_types: Vec<String>,
    pub clamd_host: String,
+    pub scan_mime_types: Vec<String>,

    pub limit: FilesLimit,
    pub preview: HashMap<String, [usize; 2]>,
@@ -164,7 +204,7 @@ pub struct GlobalLimits {
    pub server_roles: usize,
    pub server_channels: usize,

-    pub new_user_days: usize,
+    pub new_user_hours: usize,

    pub body_limit_size: usize,
 }
@@ -178,12 +218,7 @@ pub struct FeaturesLimits {
    pub message_attachments: usize,
    pub servers: usize,

-    pub attachment_size: usize,
-    pub avatar_size: usize,
-    pub background_size: usize,
-    pub icon_size: usize,
-    pub banner_size: usize,
-    pub emoji_size: usize,
+    pub file_upload_size_limit: HashMap<String, usize>,
 }

 #[derive(Deserialize, Debug, Clone)]
@@ -207,6 +242,8 @@ pub struct Features {
 pub struct Sentry {
    pub api: String,
    pub events: String,
+    pub files: String,
+    pub proxy: String,
 }

 #[derive(Deserialize, Debug, Clone)]
@@ -222,22 +259,10 @@ pub struct Settings {
 impl Settings {
    pub fn preflight_checks(&self) {
        if self.api.smtp.host.is_empty() {
-            #[cfg(not(debug_assertions))]
-            if !env::var("REVOLT_UNSAFE_NO_EMAIL").map_or(false, |v| v == *"1") {
-                panic!("Running in production without email is not recommended, set REVOLT_UNSAFE_NO_EMAIL=1 to override.");
-            }
-
-            #[cfg(debug_assertions)]
            log::warn!("No SMTP settings specified! Remember to configure email.");
        }

        if self.api.security.captcha.hcaptcha_key.is_empty() {
-            #[cfg(not(debug_assertions))]
-            if !env::var("REVOLT_UNSAFE_NO_CAPTCHA").map_or(false, |v| v == *"1") {
-                panic!("Running in production without CAPTCHA is not recommended, set REVOLT_UNSAFE_NO_CAPTCHA=1 to override.");
-            }
-
-            #[cfg(debug_assertions)]
            log::warn!("No Captcha key specified! Remember to add hCaptcha key.");
        }
    }
@@ -271,6 +296,12 @@ pub async fn setup_logging(release: &'static str, dsn: String) -> Option<sentry:
        std::env::set_var("ROCKET_ADDRESS", "0.0.0.0");
    }

+    if std::env::var("REDIS_URL").is_err() {
+        // Configure redis-kiss library
+        let config = config().await;
+        std::env::set_var("REDIS_URI", config.database.redis);
+    }
+
    pretty_env_logger::init();
    log::info!("Starting {release}");

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-database"
-version = "0.7.16"
+version = "0.7.17"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -16,6 +16,7 @@ mongodb = ["dep:mongodb", "bson"]
 tasks = ["isahc", "linkify", "url-escape"]
 async-std-runtime = ["async-std"]
 rocket-impl = ["rocket", "schemars", "revolt_okapi", "revolt_rocket_okapi"]
+axum-impl = ["axum"]
 redis-is-patched = ["revolt-presence/redis-is-patched"]

 # Default Features
@@ -23,13 +24,15 @@ default = ["mongodb", "async-std-runtime", "tasks"]

 [dependencies]
 # Core
-revolt-config = { version = "0.7.16", path = "../config" }
-revolt-result = { version = "0.7.16", path = "../result" }
-revolt-models = { version = "0.7.16", path = "../models", features = [
+revolt-config = { version = "0.7.17", path = "../config", features = [
+    "report-macros",
+] }
+revolt-result = { version = "0.7.17", path = "../result" }
+revolt-models = { version = "0.7.17", path = "../models", features = [
    "validator",
 ] }
-revolt-presence = { version = "0.7.16", path = "../presence" }
-revolt-permissions = { version = "0.7.16", path = "../permissions", features = [
+revolt-presence = { version = "0.7.17", path = "../presence" }
+revolt-permissions = { version = "0.7.17", path = "../permissions", features = [
    "serde",
    "bson",
 ] }
@@ -76,6 +79,9 @@ async-recursion = "1.0.4"
 # Async
 async-std = { version = "1.8.0", features = ["attributes"], optional = true }

+# Axum Impl
+axum = { version = "0.7.5", optional = true }
+
 # Rocket Impl
 schemars = { version = "0.8.8", optional = true }
 rocket = { version = "0.5.0-rc.2", default-features = false, features = [
@@ -16,6 +16,8 @@ extern crate revolt_optional_struct;
 #[macro_use]
 extern crate revolt_result;

+pub use iso8601_timestamp;
+
 #[cfg(feature = "mongodb")]
 pub use mongodb;

@@ -91,4 +93,4 @@ pub fn if_false(t: &bool) -> bool {
 /// Utility function to check if an option doesnt contain true
 pub fn if_option_false(t: &Option<bool>) -> bool {
    t != &Some(true)
-}
+}
@@ -56,6 +56,10 @@ pub async fn create_database(db: &MongoDb) {
        .await
        .expect("Failed to create attachments collection.");

+    db.create_collection("attachment_hashes", None)
+        .await
+        .expect("Failed to create attachment_hashes collection.");
+
    db.create_collection("user_settings", None)
        .await
        .expect("Failed to create user_settings collection.");
@@ -209,6 +213,46 @@ pub async fn create_database(db: &MongoDb) {
    .await
    .expect("Failed to create server_members index.");

+    db.run_command(
+        doc! {
+            "createIndexes": "attachments",
+            "indexes": [
+                {
+                    "key": {
+                        "hash": 1_i32
+                    },
+                    "name": "hash"
+                },
+                {
+                    "key": {
+                        "used_for.id": 1_i32
+                    },
+                    "name": "used_for_id"
+                }
+            ]
+        },
+        None,
+    )
+    .await
+    .expect("Failed to create attachments index.");
+
+    db.run_command(
+        doc! {
+            "createIndexes": "attachment_hashes",
+            "indexes": [
+                {
+                    "key": {
+                        "processed_hash": 1_i32
+                    },
+                    "name": "processed_hash"
+                }
+            ]
+        },
+        None,
+    )
+    .await
+    .expect("Failed to create attachment_hashes index.");
+
    db.collection("migrations")
        .insert_one(
            doc! {
@@ -5,7 +5,7 @@ use crate::{
        bson::{doc, from_bson, from_document, to_document, Bson, DateTime, Document},
        options::FindOptions,
    },
-    Invite, MongoDb, DISCRIMINATOR_SEARCH_SPACE,
+    AbstractChannels, AbstractServers, Channel, Invite, MongoDb, DISCRIMINATOR_SEARCH_SPACE,
 };
 use bson::oid::ObjectId;
 use futures::StreamExt;
@@ -20,7 +20,7 @@ struct MigrationInfo {
    revision: i32,
 }

-pub const LATEST_REVISION: i32 = 28;
+pub const LATEST_REVISION: i32 = 30;

 pub async fn migrate_database(db: &MongoDb) {
    let migrations = db.col::<Document>("migrations");
@@ -1094,6 +1094,121 @@ pub async fn run_migrations(db: &MongoDb, revision: i32) -> i32 {
            .expect("Failed to create message index.");
    }

+    if revision <= 28 {
+        info!("Running migration [revision 28 / 10-09-2024]: Add support for new Autumn.");
+
+        db.db()
+            .create_collection("attachment_hashes", None)
+            .await
+            .ok();
+
+        db.db()
+            .run_command(
+                doc! {
+                    "createIndexes": "attachments",
+                    "indexes": [
+                        {
+                            "key": {
+                                "hash": 1_i32
+                            },
+                            "name": "hash"
+                        }
+                    ]
+                },
+                None,
+            )
+            .await
+            .expect("Failed to create attachments index.");
+
+        db.db()
+            .run_command(
+                doc! {
+                    "createIndexes": "attachment_hashes",
+                    "indexes": [
+                        {
+                            "key": {
+                                "processed_hash": 1_i32
+                            },
+                            "name": "processed_hash"
+                        }
+                    ]
+                },
+                None,
+            )
+            .await
+            .expect("Failed to create attachment_hashes index.");
+    }
+
+    if revision <= 29 {
+        info!("Running migration [revision 29 / 29-09-2024]: Add creator_id to webhooks.");
+
+        #[derive(serde::Serialize, serde::Deserialize)]
+        struct WebhookShell {
+            _id: String,
+            channel_id: String,
+        }
+
+        let invites = db
+            .db()
+            .collection::<WebhookShell>("channel_webhooks")
+            .find(doc! {}, None)
+            .await
+            .expect("webhooks")
+            .filter_map(|s| async { s.ok() })
+            .collect::<Vec<WebhookShell>>()
+            .await;
+
+        for invite in invites {
+            let channel = db.fetch_channel(&invite.channel_id).await.expect("channel");
+            let creator_id = match channel {
+                Channel::Group { owner, .. } => owner,
+                Channel::TextChannel { server, .. } | Channel::VoiceChannel { server, .. } => {
+                    let server = db.fetch_server(&server).await.expect("server");
+                    server.owner
+                }
+                _ => unreachable!("not server or group channel!"),
+            };
+
+            db.db()
+                .collection::<Document>("channel_webhooks")
+                .update_one(
+                    doc! {
+                        "_id": invite._id,
+                    },
+                    doc! {
+                        "$set" : {
+                            "creator_id": creator_id
+                        }
+                    },
+                    None,
+                )
+                .await
+                .expect("update webhook");
+        }
+    }
+
+    if revision <= 30 {
+        info!("Running migration [revision 30 / 29-09-2024]: Add index for used_for.id to attachments.");
+
+        db.db()
+            .run_command(
+                doc! {
+                    "createIndexes": "attachments",
+                    "indexes": [
+                        {
+                            "key": {
+                                "used_for.id": 1_i32
+                            },
+                            "name": "used_for_id"
+                        }
+                    ]
+                },
+                None,
+            )
+            .await
+            .expect("Failed to create attachments index.");
+    }
+
    // Need to migrate fields on attachments, change `user_id`, `object_id`, etc to `parent`.

    // Reminder to update LATEST_REVISION when adding new migrations.
@@ -17,6 +17,9 @@ auto_derived_partial!(
        #[serde(skip_serializing_if = "Option::is_none")]
        pub avatar: Option<File>,

+        /// User that created this webhook
+        pub creator_id: String,
+
        /// The channel this webhook belongs to
        pub channel_id: String,

@@ -43,6 +46,7 @@ impl Default for Webhook {
            id: Default::default(),
            name: Default::default(),
            avatar: None,
+            creator_id: Default::default(),
            channel_id: Default::default(),
            permissions: Default::default(),
            token: Default::default(),
@@ -70,7 +74,7 @@ impl Webhook {
        if self.token.as_deref() == Some(token) {
            Ok(())
        } else {
-            Err(create_error!(InvalidCredentials))
+            Err(create_error!(NotAuthenticated))
        }
    }

@@ -261,7 +261,7 @@ impl AbstractChannels for MongoDb {

        // Delete associated attachments
        self.delete_many_attachments(doc! {
-            "object_id": &id
+            "used_for.id": &id
        })
        .await?;

@@ -1,5 +1,7 @@
 use iso8601_timestamp::Timestamp;

+use crate::File;
+
 auto_derived_partial!(
    /// File hash
    pub struct FileHash {
@@ -51,3 +53,40 @@ auto_derived!(
        Audio,
    }
 );
+
+impl FileHash {
+    /// Create a file from a file hash
+    pub fn into_file(
+        &self,
+        id: String,
+        tag: String,
+        filename: String,
+        uploader_id: String,
+    ) -> File {
+        File {
+            id,
+            tag,
+            filename,
+            hash: Some(self.id.clone()),
+
+            uploaded_at: Some(Timestamp::now_utc()),
+            uploader_id: Some(uploader_id),
+
+            used_for: None,
+
+            deleted: None,
+            reported: None,
+
+            // TODO: remove this data
+            metadata: self.metadata.clone(),
+            content_type: self.content_type.clone(),
+            size: self.size,
+
+            // TODO: superseded by "used_for"
+            message_id: None,
+            object_id: None,
+            server_id: None,
+            user_id: None,
+        }
+    }
+}
@@ -7,6 +7,12 @@ mod reference;

 #[async_trait]
 pub trait AbstractAttachmentHashes: Sync + Send {
+    /// Insert a new attachment hash into the database.
+    async fn insert_attachment_hash(&self, hash: &FileHash) -> Result<()>;
+
    /// Fetch an attachment hash entry by sha256 hash.
    async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash>;
+
+    /// Update an attachment hash nonce value.
+    async fn set_attachment_hash_nonce(&self, hash: &str, nonce: &str) -> Result<()>;
 }
@@ -9,6 +9,11 @@ static COL: &str = "attachment_hashes";

 #[async_trait]
 impl AbstractAttachmentHashes for MongoDb {
+    /// Insert a new attachment hash into the database.
+    async fn insert_attachment_hash(&self, hash: &FileHash) -> Result<()> {
+        query!(self, insert_one, COL, &hash).map(|_| ())
+    }
+
    /// Fetch an attachment hash entry by sha256 hash.
    async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash> {
        query!(
@@ -16,9 +21,31 @@ impl AbstractAttachmentHashes for MongoDb {
            find_one,
            COL,
            doc! {
-                "_id": hash
+                "$or": [
+                    {"_id": hash},
+                    {"processed_hash": hash}
+                ]
            }
        )?
        .ok_or_else(|| create_error!(NotFound))
    }
+
+    /// Update an attachment hash nonce value.
+    async fn set_attachment_hash_nonce(&self, hash: &str, nonce: &str) -> Result<()> {
+        self.col::<FileHash>(COL)
+            .update_one(
+                doc! {
+                    "_id": hash
+                },
+                doc! {
+                    "$set": {
+                        "iv": nonce
+                    }
+                },
+                None,
+            )
+            .await
+            .map(|_| ())
+            .map_err(|_| create_database_error!("update_one", COL))
+    }
 }
@@ -7,15 +7,33 @@ use super::AbstractAttachmentHashes;

 #[async_trait]
 impl AbstractAttachmentHashes for ReferenceDb {
+    /// Insert a new attachment hash into the database.
+    async fn insert_attachment_hash(&self, hash: &FileHash) -> Result<()> {
+        let mut hashes = self.file_hashes.lock().await;
+        if hashes.contains_key(&hash.id) {
+            Err(create_database_error!("insert", "attachment"))
+        } else {
+            hashes.insert(hash.id.to_string(), hash.clone());
+            Ok(())
+        }
+    }
+
    /// Fetch an attachment hash entry by sha256 hash.
-    async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash> {
+    async fn fetch_attachment_hash(&self, hash_value: &str) -> Result<FileHash> {
        let hashes = self.file_hashes.lock().await;
-        if let Some(file) = hashes.get(hash) {
-            if file.id == hash {
-                Ok(file.clone())
-            } else {
-                Err(create_error!(NotFound))
-            }
+        hashes
+            .values()
+            .cloned()
+            .find(|hash| hash.id == hash_value || hash.processed_hash == hash_value)
+            .ok_or(create_error!(NotFound))
+    }
+
+    /// Update an attachment hash nonce value.
+    async fn set_attachment_hash_nonce(&self, hash: &str, nonce: &str) -> Result<()> {
+        let mut hashes = self.file_hashes.lock().await;
+        if let Some(file) = hashes.get_mut(hash) {
+            file.iv = nonce.to_owned();
+            Ok(())
        } else {
            Err(create_error!(NotFound))
        }
@@ -19,9 +19,11 @@ auto_derived_partial!(
        /// When this file was uploaded
        pub uploaded_at: Option<Timestamp>, // these are Option<>s to not break file uploads on legacy Autumn
        /// ID of user who uploaded this file
-        pub uploaded_id: Option<String>, // these are Option<>s to not break file uploads on legacy Autumn
+        #[serde(skip_serializing_if = "Option::is_none")]
+        pub uploader_id: Option<String>, // these are Option<>s to not break file uploads on legacy Autumn

        /// What the file was used for
+        #[serde(skip_serializing_if = "Option::is_none")]
        pub used_for: Option<FileUsedFor>,

        /// Whether this file was deleted
@@ -59,15 +61,15 @@ auto_derived_partial!(
 auto_derived!(
    /// Type of object file was used for
    pub enum FileUsedForType {
-        // TODO: changing this requires a db migration
-        message,
-        serverBanner,
-        emoji,
-        userAvatar,
-        userProfileBackground,
-        legacyGroupIcon,
-        channelIcon,
-        serverIcon,
+        Message,
+        ServerBanner,
+        Emoji,
+        UserAvatar,
+        WebhookAvatar,
+        UserProfileBackground,
+        LegacyGroupIcon,
+        ChannelIcon,
+        ServerIcon,
    }

    /// Information about what the file was used for
@@ -87,44 +89,154 @@ impl File {
    }

    /// Use a file for a message attachment
-    pub async fn use_attachment(db: &Database, id: &str, parent: &str) -> Result<File> {
-        db.find_and_use_attachment(id, "attachments", "message", parent)
-            .await
+    pub async fn use_attachment(
+        db: &Database,
+        id: &str,
+        parent: &str,
+        uploader_id: &str,
+    ) -> Result<File> {
+        db.find_and_use_attachment(
+            id,
+            "attachments",
+            FileUsedFor {
+                id: parent.to_owned(),
+                object_type: FileUsedForType::Message,
+            },
+            uploader_id.to_owned(),
+        )
+        .await
    }

    /// Use a file for a user profile background
-    pub async fn use_background(db: &Database, id: &str, parent: &str) -> Result<File> {
-        db.find_and_use_attachment(id, "backgrounds", "user", parent)
-            .await
+    pub async fn use_background(
+        db: &Database,
+        id: &str,
+        parent: &str,
+        uploader_id: &str,
+    ) -> Result<File> {
+        db.find_and_use_attachment(
+            id,
+            "backgrounds",
+            FileUsedFor {
+                id: parent.to_owned(),
+                object_type: FileUsedForType::UserProfileBackground,
+            },
+            uploader_id.to_owned(),
+        )
+        .await
    }

    /// Use a file for a user avatar
-    pub async fn use_avatar(db: &Database, id: &str, parent: &str) -> Result<File> {
-        db.find_and_use_attachment(id, "avatars", "user", parent)
-            .await
+    pub async fn use_user_avatar(
+        db: &Database,
+        id: &str,
+        parent: &str,
+        uploader_id: &str,
+    ) -> Result<File> {
+        db.find_and_use_attachment(
+            id,
+            "avatars",
+            FileUsedFor {
+                id: parent.to_owned(),
+                object_type: FileUsedForType::UserAvatar,
+            },
+            uploader_id.to_owned(),
+        )
+        .await
    }

-    /// Use a file for an icon
-    pub async fn use_icon(db: &Database, id: &str, parent: &str) -> Result<File> {
-        db.find_and_use_attachment(id, "icons", "object", parent)
-            .await
+    /// Use a file for a webhook avatar
+    pub async fn use_webhook_avatar(
+        db: &Database,
+        id: &str,
+        parent: &str,
+        uploader_id: &str,
+    ) -> Result<File> {
+        db.find_and_use_attachment(
+            id,
+            "avatars",
+            FileUsedFor {
+                id: parent.to_owned(),
+                object_type: FileUsedForType::WebhookAvatar,
+            },
+            uploader_id.to_owned(),
+        )
+        .await
    }

    /// Use a file for a server icon
-    pub async fn use_server_icon(db: &Database, id: &str, parent: &str) -> Result<File> {
-        db.find_and_use_attachment(id, "icons", "object", parent)
-            .await
+    pub async fn use_server_icon(
+        db: &Database,
+        id: &str,
+        parent: &str,
+        uploader_id: &str,
+    ) -> Result<File> {
+        db.find_and_use_attachment(
+            id,
+            "icons",
+            FileUsedFor {
+                id: parent.to_owned(),
+                object_type: FileUsedForType::ServerIcon,
+            },
+            uploader_id.to_owned(),
+        )
+        .await
+    }
+
+    /// Use a file for a channel icon
+    pub async fn use_channel_icon(
+        db: &Database,
+        id: &str,
+        parent: &str,
+        uploader_id: &str,
+    ) -> Result<File> {
+        db.find_and_use_attachment(
+            id,
+            "icons",
+            FileUsedFor {
+                id: parent.to_owned(),
+                object_type: FileUsedForType::ChannelIcon,
+            },
+            uploader_id.to_owned(),
+        )
+        .await
    }

    /// Use a file for a server banner
-    pub async fn use_banner(db: &Database, id: &str, parent: &str) -> Result<File> {
-        db.find_and_use_attachment(id, "banners", "server", parent)
-            .await
+    pub async fn use_server_banner(
+        db: &Database,
+        id: &str,
+        parent: &str,
+        uploader_id: &str,
+    ) -> Result<File> {
+        db.find_and_use_attachment(
+            id,
+            "banners",
+            FileUsedFor {
+                id: parent.to_owned(),
+                object_type: FileUsedForType::ServerBanner,
+            },
+            uploader_id.to_owned(),
+        )
+        .await
    }

    /// Use a file for an emoji
-    pub async fn use_emoji(db: &Database, id: &str, parent: &str) -> Result<File> {
-        db.find_and_use_attachment(id, "emojis", "object", parent)
-            .await
+    pub async fn use_emoji(
+        db: &Database,
+        id: &str,
+        parent: &str,
+        uploader_id: &str,
+    ) -> Result<File> {
+        db.find_and_use_attachment(
+            id,
+            "emojis",
+            FileUsedFor {
+                id: parent.to_owned(),
+                object_type: FileUsedForType::Emoji,
+            },
+            uploader_id.to_owned(),
+        )
+        .await
    }
 }
@@ -2,6 +2,8 @@ use revolt_result::Result;

 use crate::File;

+use super::FileUsedFor;
+
 mod mongodb;
 mod reference;

@@ -18,8 +20,8 @@ pub trait AbstractAttachments: Sync + Send {
        &self,
        id: &str,
        tag: &str,
-        parent_type: &str,
-        parent_id: &str,
+        used_for: FileUsedFor,
+        uploader_id: String,
    ) -> Result<File>;

    /// Mark an attachment as having been reported.
@@ -1,7 +1,10 @@
+use bson::to_document;
 use bson::Document;
+use revolt_config::report_internal_error;
 use revolt_result::Result;

 use crate::File;
+use crate::FileUsedFor;
 use crate::MongoDb;

 use super::AbstractAttachments;
@@ -34,10 +37,9 @@ impl AbstractAttachments for MongoDb {
        &self,
        id: &str,
        tag: &str,
-        parent_type: &str,
-        parent_id: &str,
+        used_for: FileUsedFor,
+        uploader_id: String,
    ) -> Result<File> {
-        let key = format!("{parent_type}_id");
        let file = query!(
            self,
            find_one,
@@ -45,7 +47,7 @@ impl AbstractAttachments for MongoDb {
            doc! {
                "_id": id,
                "tag": tag,
-                &key: {
+                "used_for": {
                    "$exists": false
                }
            }
@@ -59,7 +61,8 @@ impl AbstractAttachments for MongoDb {
                },
                doc! {
                    "$set": {
-                        key: parent_id
+                        "used_for": report_internal_error!(to_document(&used_for))?,
+                        "uploader_id": uploader_id
                    }
                },
                None,
@@ -1,6 +1,7 @@
 use revolt_result::Result;

 use crate::File;
+use crate::FileUsedFor;
 use crate::ReferenceDb;

 use super::AbstractAttachments;
@@ -37,19 +38,14 @@ impl AbstractAttachments for ReferenceDb {
        &self,
        id: &str,
        tag: &str,
-        parent_type: &str,
-        parent_id: &str,
+        used_for: FileUsedFor,
+        uploader_id: String,
    ) -> Result<File> {
        let mut files = self.files.lock().await;
        if let Some(file) = files.get_mut(id) {
            if file.tag == tag {
-                match parent_type {
-                    "message" => file.message_id = Some(parent_id.to_owned()),
-                    "user" => file.user_id = Some(parent_id.to_owned()),
-                    "object" => file.object_id = Some(parent_id.to_owned()),
-                    "server" => file.server_id = Some(parent_id.to_owned()),
-                    _ => unreachable!(),
-                }
+                file.uploader_id = Some(uploader_id);
+                file.used_for = Some(used_for);

                Ok(file.clone())
            } else {
@@ -370,10 +370,8 @@ impl Message {
        }

        for attachment_id in data.attachments.as_deref().unwrap_or_default() {
-            attachments.push(
-                db.find_and_use_attachment(attachment_id, "attachments", "message", &message_id)
-                    .await?,
-            );
+            attachments
+                .push(File::use_attachment(db, attachment_id, &message_id, author.id()).await?);
        }

        if !attachments.is_empty() {
@@ -499,10 +497,7 @@ impl Message {
        })?;

        let media = if let Some(id) = embed.media {
-            Some(
-                db.find_and_use_attachment(&id, "attachments", "message", &self.id)
-                    .await?,
-            )
+            Some(File::use_attachment(db, &id, &self.id, &self.author).await?)
        } else {
            None
        };
@@ -661,7 +656,7 @@ impl Message {
    ) -> Result<()> {
        let media: Option<v0::File> = if let Some(id) = embed.media {
            Some(
-                db.find_and_use_attachment(&id, "attachments", "message", &self.id)
+                File::use_attachment(db, &id, &self.id, &self.author)
                    .await?
                    .into(),
            )
@@ -260,7 +260,7 @@ impl MongoDb {

        // Update many attachments with parent id.
        self.delete_many_attachments(doc! {
-            "object_id": &server_id
+            "used_for.id": &server_id
        })
        .await?;

@@ -0,0 +1,24 @@
+use axum::{extract::FromRequestParts, http::request::Parts};
+
+use revolt_result::{create_error, Error, Result};
+
+use crate::{Database, User};
+
+#[async_trait::async_trait]
+impl FromRequestParts<Database> for User {
+    type Rejection = Error;
+
+    async fn from_request_parts(parts: &mut Parts, db: &Database) -> Result<User> {
+        if let Some(Ok(bot_token)) = parts.headers.get("x-bot-token").map(|v| v.to_str()) {
+            let bot = db.fetch_bot_by_token(bot_token).await?;
+            db.fetch_user(&bot.id).await
+        } else if let Some(Ok(session_token)) =
+            parts.headers.get("x-session-token").map(|v| v.to_str())
+        {
+            let session = db.fetch_session_by_token(session_token).await?;
+            db.fetch_user(&session.user_id).await
+        } else {
+            Err(create_error!(NotAuthenticated))
+        }
+    }
+}
@@ -1,3 +1,5 @@
+#[cfg(feature = "axum-impl")]
+mod axum;
 mod model;
 mod ops;
 #[cfg(feature = "rocket-impl")]
@@ -5,6 +7,8 @@ mod rocket;
 #[cfg(feature = "rocket-impl")]
 mod schema;

+#[cfg(feature = "axum-impl")]
+pub use self::axum::*;
 #[cfg(feature = "rocket-impl")]
 pub use self::rocket::*;
 #[cfg(feature = "rocket-impl")]
@@ -218,7 +218,7 @@ impl User {
            .datetime()
            .elapsed()
            .expect("time went backwards")
-            <= Duration::from_secs(86400u64 * config.features.limits.global.new_user_days as u64)
+            <= Duration::from_secs(3600u64 * config.features.limits.global.new_user_hours as u64)
        {
            config.features.limits.new_user
        } else {
@@ -20,6 +20,7 @@ use crate::Database;

 /// Payload information, before assembly
 #[derive(Debug)]
+#[allow(non_snake_case)]
 pub struct ApnPayload {
    message: Message,
    url: String,
@@ -29,6 +30,7 @@ pub struct ApnPayload {
 }

 #[derive(Serialize, Debug)]
+#[allow(non_snake_case)]
 struct Payload<'a> {
    aps: APS<'a>,
    #[serde(skip_serializing)]
@@ -11,7 +11,7 @@ use base64::{
 use deadqueue::limited::Queue;
 use fcm_v1::auth::{Authenticator, ServiceAccountKey};
 use once_cell::sync::Lazy;
-use revolt_config::config;
+use revolt_config::{config, report_internal_error};
 use revolt_models::v0::PushNotification;
 use revolt_presence::filter_online;
 use serde_json::json;
@@ -116,12 +116,11 @@ pub async fn worker(db: Database, authifier_db: AuthifierDatabase) {
                                    if fcm_error.contains("404 (Not Found)") {
                                        println!("Unregistering {:?}", session.id);

-                                        if let Err(err) = db
-                                            .remove_push_subscription_by_session_id(&session.id)
-                                            .await
-                                        {
-                                            revolt_config::capture_error(&err);
-                                        }
+                                        report_internal_error!(
+                                            db.remove_push_subscription_by_session_id(&session.id)
+                                                .await
+                                        )
+                                        .ok();
                                    }
                                }
                            } else {
@@ -108,6 +108,7 @@ impl From<crate::Webhook> for Webhook {
            id: value.id,
            name: value.name,
            avatar: value.avatar.map(|file| file.into()),
+            creator_id: value.creator_id,
            channel_id: value.channel_id,
            token: value.token,
            permissions: value.permissions,
@@ -121,6 +122,7 @@ impl From<crate::PartialWebhook> for PartialWebhook {
            id: value.id,
            name: value.name,
            avatar: value.avatar.map(|file| file.into()),
+            creator_id: value.creator_id,
            channel_id: value.channel_id,
            token: value.token,
            permissions: value.permissions,
@@ -421,7 +423,7 @@ impl From<File> for crate::File {
            object_id: value.object_id,
            hash: None,
            uploaded_at: None,
-            uploaded_id: None,
+            uploader_id: None,
            used_for: None,
        }
    }
@@ -1,12 +1,18 @@
 [package]
 name = "revolt-files"
-version = "0.7.16"
+version = "0.7.17"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: S3 and encryption subroutines"

 [dependencies]
+tracing = "0.1"
+
+ffprobe = "0.4.0"
+imagesize = "0.13.0"
+tempfile = "3.12.0"
+
 base64 = "0.22.1"
 aes-gcm = "0.10.3"
 typenum = "1.17.0"
@@ -14,5 +20,14 @@ typenum = "1.17.0"
 aws-config = "1.5.5"
 aws-sdk-s3 = { version = "1.46.0", features = ["behavior-version-latest"] }

-revolt-config = { version = "0.7.16", path = "../config" }
-revolt-result = { version = "0.7.16", path = "../result" }
+revolt-config = { version = "0.7.17", path = "../config", features = [
+    "report-macros",
+] }
+revolt-result = { version = "0.7.17", path = "../result" }
+
+# image processing
+jxl-oxide = "0.8.1"
+image = { version = "0.25.2" }
+
+# encoding
+webp = "0.3.0"
@@ -1,7 +1,11 @@
-use std::io::Write;
+use std::io::{BufRead, Read, Seek, Write};

-use aes_gcm::{aead::AeadMutInPlace, Aes256Gcm, Key, KeyInit, Nonce};
-use revolt_config::{config, FilesS3};
+use aes_gcm::{
+    aead::{AeadCore, AeadMutInPlace, OsRng},
+    Aes256Gcm, Key, KeyInit, Nonce,
+};
+use image::DynamicImage;
+use revolt_config::{config, report_internal_error, FilesS3};
 use revolt_result::{create_error, Result};

 use aws_sdk_s3::{
@@ -10,8 +14,10 @@ use aws_sdk_s3::{
 };

 use base64::prelude::*;
+use tempfile::NamedTempFile;

-pub static AUTHENTICATION_TAG_SIZE_BYTES: usize = 16;
+/// Size of the authentication tag in the buffer
+pub const AUTHENTICATION_TAG_SIZE_BYTES: usize = 16;

 /// Create an S3 client
 pub fn create_client(s3_config: FilesS3) -> Client {
@@ -35,7 +41,7 @@ pub fn create_client(s3_config: FilesS3) -> Client {

 /// Create an AES-256-GCM cipher
 pub fn create_cipher(key: &str) -> Aes256Gcm {
-    let key = &BASE64_STANDARD.decode(key).unwrap()[..];
+    let key = &BASE64_STANDARD.decode(key).expect("valid base64 string")[..];
    let key: &Key<Aes256Gcm> = key.into();
    Aes256Gcm::new(key)
 }
@@ -46,27 +52,23 @@ pub async fn fetch_from_s3(bucket_id: &str, path: &str, nonce: &str) -> Result<V
    let client = create_client(config.files.s3);

    // Send a request for the file
-    let mut obj = client
-        .get_object()
-        .bucket(bucket_id)
-        .key(path)
-        .send()
-        .await
-        .inspect_err(|err| {
-            revolt_config::capture_error(err);
-        })
-        .map_err(|_| create_error!(InternalError))?;
+    let mut obj =
+        report_internal_error!(client.get_object().bucket(bucket_id).key(path).send().await)?;

    // Read the file from remote
    let mut buf = vec![];
    while let Some(bytes) = obj.body.next().await {
-        let data = bytes.map_err(|_| create_error!(InternalError))?;
-        buf.write_all(&data)
-            .map_err(|_| create_error!(InternalError))?;
+        let data = report_internal_error!(bytes)?;
+        report_internal_error!(buf.write_all(&data))?;
        // is there a more efficient way to do this?
        // we just want the Vec<u8>
    }

+    // File is not encrypted
+    if nonce.is_empty() {
+        return Ok(buf);
+    }
+
    // Recover nonce as bytes
    let nonce = &BASE64_STANDARD.decode(nonce).unwrap()[..];
    let nonce: &Nonce<typenum::consts::U12> = nonce.into();
@@ -78,3 +80,131 @@ pub async fn fetch_from_s3(bucket_id: &str, path: &str, nonce: &str) -> Result<V

    Ok(buf)
 }
+
+/// Encrypt and upload a file to S3 (returning its nonce/IV)
+pub async fn upload_to_s3(bucket_id: &str, path: &str, buf: &[u8]) -> Result<String> {
+    let config = config().await;
+    let client = create_client(config.files.s3);
+
+    // Generate a nonce
+    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
+
+    // Extend the buffer for in-place encryption
+    let mut buf = [buf, &[0; AUTHENTICATION_TAG_SIZE_BYTES]].concat();
+
+    // Encrypt the file in place
+    create_cipher(&config.files.encryption_key)
+        .encrypt_in_place(&nonce, b"", &mut buf)
+        .map_err(|_| create_error!(InternalError))?;
+
+    // Upload the file to remote
+    report_internal_error!(
+        client
+            .put_object()
+            .bucket(bucket_id)
+            .key(path)
+            .body(buf.into())
+            .send()
+            .await
+    )?;
+
+    Ok(BASE64_STANDARD.encode(nonce))
+}
+
+/// Determine size of image at temp file
+pub fn image_size(f: &NamedTempFile) -> Option<(usize, usize)> {
+    if let Ok(size) = imagesize::size(f.path())
+        .inspect_err(|err| tracing::error!("Failed to generate image size! {err:?}"))
+    {
+        Some((size.width, size.height))
+    } else {
+        None
+    }
+}
+
+/// Determine size of image with buffer
+pub fn image_size_vec(v: &[u8]) -> Option<(usize, usize)> {
+    if let Ok(size) = imagesize::blob_size(v)
+        .inspect_err(|err| tracing::error!("Failed to generate image size! {err:?}"))
+    {
+        Some((size.width, size.height))
+    } else {
+        None
+    }
+}
+
+/// Determine size of video at temp file
+pub fn video_size(f: &NamedTempFile) -> Option<(i64, i64)> {
+    if let Ok(data) = ffprobe::ffprobe(f.path())
+        .inspect_err(|err| tracing::error!("Failed to ffprobe file! {err:?}"))
+    {
+        // Use first valid stream
+        for stream in data.streams {
+            if let (Some(w), Some(h)) = (stream.width, stream.height) {
+                return Some((w, h));
+            }
+        }
+
+        None
+    } else {
+        None
+    }
+}
+
+/// Decode image from reader
+pub fn decode_image<R: Read + BufRead + Seek>(
+    reader: &mut R,
+    is_jxl: bool,
+) -> Result<DynamicImage> {
+    if is_jxl {
+        Err(create_error!(LabelMe))
+    } else {
+        // Check if we can read using image-rs crate
+        report_internal_error!(report_internal_error!(
+            image::ImageReader::new(reader).with_guessed_format()
+        )?
+        .decode())
+    }
+}
+
+/// Check whether given reader has a valid image
+pub fn is_valid_image<R: Read + BufRead + Seek>(reader: &mut R, is_jxl: bool) -> bool {
+    if is_jxl {
+        // Check if we can read using jxl-oxide crate
+        jxl_oxide::JxlImage::builder()
+            .read(reader)
+            .inspect_err(|err| tracing::error!("Failed to read JXL! {err:?}"))
+            .is_ok()
+    } else {
+        !matches!(
+            // Check if we can read using image-rs crate
+            image::ImageReader::new(reader)
+                .with_guessed_format()
+                .inspect_err(|err| tracing::error!("Failed to read image! {err:?}"))
+                .map(|f| f.decode()),
+            Err(_) | Ok(Err(_))
+        )
+    }
+}
+
+/// Create thumbnail from given image
+pub async fn create_thumbnail(image: DynamicImage, tag: &str) -> Vec<u8> {
+    // Load configuration
+    let config = config().await;
+    let [w, h] = config.files.preview.get(tag).unwrap();
+
+    // Create thumbnail
+    //.resize(width as u32, height as u32, image::imageops::FilterType::Gaussian)
+    // resize is about 2.5x slower,
+    // thumbnail doesn't have terrible quality
+    // so we use thumbnail
+    let image = image.thumbnail(image.width().min(*w as u32), image.height().min(*h as u32));
+
+    // Encode it into WEBP
+    let encoder = webp::Encoder::from_image(&image).expect("Could not create encoder.");
+    if config.files.webp_quality != 100.0 {
+        encoder.encode(config.files.webp_quality).to_vec()
+    } else {
+        encoder.encode_lossless().to_vec()
+    }
+}
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-models"
-version = "0.7.16"
+version = "0.7.17"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -20,8 +20,8 @@ default = ["serde", "partials", "rocket"]

 [dependencies]
 # Core
-revolt-config = { version = "0.7.16", path = "../config" }
-revolt-permissions = { version = "0.7.16", path = "../permissions" }
+revolt-config = { version = "0.7.17", path = "../config" }
+revolt-permissions = { version = "0.7.17", path = "../permissions" }

 # Utility
 regex = "1"
@@ -16,6 +16,9 @@ auto_derived_partial!(
        #[cfg_attr(feature = "serde", serde(skip_serializing_if = "Option::is_none"))]
        pub avatar: Option<File>,

+        /// User that created this webhook
+        pub creator_id: String,
+
        /// The channel this webhook belongs to
        pub channel_id: String,

@@ -14,9 +14,9 @@ auto_derived!(
        /// URL to the original image
        pub url: String,
        /// Width of the image
-        pub width: isize,
+        pub width: usize,
        /// Height of the image
-        pub height: isize,
+        pub height: usize,
        /// Positioning and size
        pub size: ImageSize,
    }
@@ -26,9 +26,9 @@ auto_derived!(
        /// URL to the original video
        pub url: String,
        /// Width of the video
-        pub width: isize,
+        pub width: usize,
        /// Height of the video
-        pub height: isize,
+        pub height: usize,
    }

    /// Type of remote Twitch content
@@ -86,7 +86,7 @@ auto_derived!(
        },
        AppleMusic {
            album_id: String,
-            
+
            #[serde(skip_serializing_if = "Option::is_none")]
            track_id: Option<String>,
        },
@@ -119,8 +119,6 @@ auto_derived!(
        #[serde(skip_serializing_if = "Option::is_none")]
        pub video: Option<Video>,

-        // #[serde(skip_serializing_if = "Option::is_none")]
-        // opengraph_type: Option<String>,
        /// Site name
        #[serde(skip_serializing_if = "Option::is_none")]
        pub site_name: Option<String>,
@@ -156,11 +154,44 @@ auto_derived!(

    /// Embed
    #[serde(tag = "type")]
+    #[derive(Default)]
    pub enum Embed {
        Website(WebsiteMetadata),
        Image(Image),
        Video(Video),
        Text(Text),
+        #[default]
        None,
    }
 );
+
+impl WebsiteMetadata {
+    /// Truncate strings in metadata
+    pub fn truncate(&mut self) {
+        if let Some(s) = self.title.as_mut() {
+            s.truncate(100);
+        }
+
+        if let Some(s) = self.description.as_mut() {
+            s.truncate(1000);
+        }
+
+        if let Some(s) = self.site_name.as_mut() {
+            s.truncate(32);
+        }
+
+        if let Some(s) = self.colour.as_mut() {
+            s.truncate(32);
+        }
+    }
+
+    /// Check if this is considered "empty"
+    pub fn is_empty(&self) -> bool {
+        (self.title.is_none() || self.title.as_ref().is_some_and(|f| f.is_empty()))
+            && (self.description.is_none()
+                || self.description.as_ref().is_some_and(|f| f.is_empty()))
+            && self.special.is_none()
+            && self.video.is_none()
+            && self.image.is_none()
+    }
+}
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-permissions"
-version = "0.7.16"
+version = "0.7.17"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -21,7 +21,7 @@ async-std = { version = "1.8.0", features = ["attributes"] }

 [dependencies]
 # Core
-revolt-result = { version = "0.7.16", path = "../result" }
+revolt-result = { version = "0.7.17", path = "../result" }

 # Utility
 auto_ops = "0.3.0"
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-presence"
-version = "0.7.16"
+version = "0.7.17"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-result"
-version = "0.7.16"
+version = "0.7.17"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -67,6 +67,7 @@ impl IntoResponse for Error {
            ErrorType::InvalidCredentials => StatusCode::UNAUTHORIZED,
            ErrorType::InvalidProperty => StatusCode::BAD_REQUEST,
            ErrorType::InvalidSession => StatusCode::UNAUTHORIZED,
+            ErrorType::NotAuthenticated => StatusCode::UNAUTHORIZED,
            ErrorType::DuplicateNonce => StatusCode::CONFLICT,
            ErrorType::VosoUnavailable => StatusCode::BAD_REQUEST,
            ErrorType::NotFound => StatusCode::NOT_FOUND,
@@ -74,6 +75,9 @@ impl IntoResponse for Error {
            ErrorType::FailedValidation { .. } => StatusCode::BAD_REQUEST,

            ErrorType::ProxyError => StatusCode::BAD_REQUEST,
+            ErrorType::FileTooSmall => StatusCode::UNPROCESSABLE_ENTITY,
+            ErrorType::FileTooLarge { .. } => StatusCode::UNPROCESSABLE_ENTITY,
+            ErrorType::FileTypeNotAllowed => StatusCode::BAD_REQUEST,
        };

        (status, Json(&self)).into_response()
@@ -147,6 +147,7 @@ pub enum ErrorType {
    InvalidCredentials,
    InvalidProperty,
    InvalidSession,
+    NotAuthenticated,
    DuplicateNonce,
    NotFound,
    NoEffect,
@@ -156,6 +157,11 @@ pub enum ErrorType {

    // ? Micro-service errors
    ProxyError,
+    FileTooSmall,
+    FileTooLarge {
+        max: usize,
+    },
+    FileTypeNotAllowed,

    // ? Legacy errors
    VosoUnavailable,
@@ -73,6 +73,7 @@ impl<'r> Responder<'r, 'static> for Error {
            ErrorType::InvalidCredentials => Status::Unauthorized,
            ErrorType::InvalidProperty => Status::BadRequest,
            ErrorType::InvalidSession => Status::Unauthorized,
+            ErrorType::NotAuthenticated => Status::Unauthorized,
            ErrorType::DuplicateNonce => Status::Conflict,
            ErrorType::VosoUnavailable => Status::BadRequest,
            ErrorType::NotFound => Status::NotFound,
@@ -80,6 +81,9 @@ impl<'r> Responder<'r, 'static> for Error {
            ErrorType::FailedValidation { .. } => Status::BadRequest,

            ErrorType::ProxyError => Status::BadRequest,
+            ErrorType::FileTooSmall => Status::UnprocessableEntity,
+            ErrorType::FileTooLarge { .. } => Status::UnprocessableEntity,
+            ErrorType::FileTypeNotAllowed => Status::BadRequest,
        };

        // Serialize the error data structure into JSON.
@@ -1,6 +1,6 @@
 [package]
 name = "revolt-delta"
-version = "0.7.16"
+version = "0.7.17"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <paulmakles@gmail.com>"]
 edition = "2018"
@@ -7,6 +7,5 @@ COPY --from=builder /home/rust/src/target/release/revolt-delta ./

 EXPOSE 8000
 ENV ROCKET_ADDRESS 0.0.0.0
-ENV ROCKET_PORT 8000
 USER nonroot
 CMD ["./revolt-delta"]
@@ -124,7 +124,7 @@ pub async fn edit(
            }

            if let Some(icon_id) = data.icon {
-                partial.icon = Some(File::use_icon(db, &icon_id, id).await?);
+                partial.icon = Some(File::use_channel_icon(db, &icon_id, id, &user.id).await?);
                *icon = partial.icon.clone();
            }

@@ -1,6 +1,6 @@
 use revolt_database::{
    util::{permissions::DatabasePermissionQuery, reference::Reference},
-    Channel, Database, User, Webhook,
+    Channel, Database, File, User, Webhook,
 };
 use revolt_models::v0;
 use revolt_permissions::{
@@ -43,10 +43,7 @@ pub async fn create_webhook(
    let webhook_id = Ulid::new().to_string();

    let avatar = match &data.avatar {
-        Some(id) => Some(
-            db.find_and_use_attachment(id, "avatars", "user", &webhook_id)
-                .await?,
-        ),
+        Some(id) => Some(File::use_webhook_avatar(db, id, &webhook_id, &user.id).await?),
        None => None,
    };

@@ -54,6 +51,7 @@ pub async fn create_webhook(
        id: webhook_id,
        name: data.name,
        avatar,
+        creator_id: user.id,
        channel_id: channel.id().to_string(),
        permissions: *DEFAULT_WEBHOOK_PERMISSIONS,
        token: Some(nanoid::nanoid!(64)),
@@ -55,7 +55,7 @@ pub async fn create_emoji(
    };

    // Find the relevant attachment
-    let attachment = File::use_emoji(db, &id, &id).await?;
+    let attachment = File::use_emoji(db, &id, &id, &user.id).await?;

    // Create the emoji object
    let emoji = Emoji {
@@ -142,7 +142,7 @@ pub async fn edit(

    // 2. Apply new avatar
    if let Some(avatar) = avatar {
-        partial.avatar = Some(File::use_avatar(db, &avatar, &user.id).await?);
+        partial.avatar = Some(File::use_user_avatar(db, &avatar, &user.id, &user.id).await?);
    }

    member
@@ -138,13 +138,13 @@ pub async fn edit(

    // 3. Apply new icon
    if let Some(icon) = icon {
-        partial.icon = Some(File::use_server_icon(db, &icon, &server.id).await?);
+        partial.icon = Some(File::use_server_icon(db, &icon, &server.id, &user.id).await?);
        server.icon = partial.icon.clone();
    }

    // 4. Apply new banner
    if let Some(banner) = banner {
-        partial.banner = Some(File::use_banner(db, &banner, &server.id).await?);
+        partial.banner = Some(File::use_server_banner(db, &banner, &server.id, &user.id).await?);
        server.banner = partial.banner.clone();
    }

@@ -89,7 +89,7 @@ pub async fn edit(

    // 2. Apply new avatar
    if let Some(avatar) = data.avatar {
-        partial.avatar = Some(File::use_avatar(db, &avatar, &user.id).await?);
+        partial.avatar = Some(File::use_user_avatar(db, &avatar, &user.id, &user.id).await?);
    }

    // 3. Apply new status
@@ -114,7 +114,8 @@ pub async fn edit(
        }

        if let Some(background) = profile.background {
-            new_profile.background = Some(File::use_background(db, &background, &user.id).await?);
+            new_profile.background =
+                Some(File::use_background(db, &background, &user.id, &user.id).await?);
        }

        partial.profile = Some(new_profile);
@@ -1,6 +1,6 @@
 use revolt_database::{
    util::{permissions::DatabasePermissionQuery, reference::Reference},
-    Database, PartialWebhook, User,
+    Database, File, PartialWebhook, User,
 };
 use revolt_models::v0::{DataEditWebhook, Webhook};
 use revolt_permissions::{calculate_channel_permissions, ChannelPermission};
@@ -52,10 +52,7 @@ pub async fn webhook_edit(
    };

    if let Some(avatar) = avatar {
-        let file = db
-            .find_and_use_attachment(&avatar, "avatars", "user", &webhook.id)
-            .await?;
-
+        let file = File::use_webhook_avatar(db, &avatar, &webhook.id, &webhook.creator_id).await?;
        partial.avatar = Some(file)
    }

@@ -1,5 +1,5 @@
 use revolt_database::util::reference::Reference;
-use revolt_database::{Database, PartialWebhook};
+use revolt_database::{Database, File, PartialWebhook};
 use revolt_models::v0::{DataEditWebhook, Webhook};
 use revolt_models::validator::Validate;
 use revolt_result::{create_error, Result};
@@ -34,7 +34,7 @@ pub async fn webhook_edit_token(
        name,
        avatar,
        permissions,
-        remove
+        remove,
    } = data;

    let mut partial = PartialWebhook {
@@ -44,10 +44,7 @@ pub async fn webhook_edit_token(
    };

    if let Some(avatar) = avatar {
-        let file = db
-            .find_and_use_attachment(&avatar, "avatars", "user", &webhook.id)
-            .await?;
-
+        let file = File::use_webhook_avatar(db, &avatar, &webhook.id, &webhook.creator_id).await?;
        partial.avatar = Some(file)
    }

@@ -1,17 +1,24 @@
 [package]
 name = "revolt-autumn"
-version = "0.7.14"
+version = "0.7.17"
 edition = "2021"

 [dependencies]
+# ID generation
+ulid = "1.1.3"
+nanoid = "0.4.0"
+
 # Media processing
 webp = "0.3.0"
 sha2 = "0.10.8"
 jxl-oxide = "0.8.1"
 kamadak-exif = "0.5.4"
 # revolt_little_exif = "0.4.0"
+image = { version = "0.25.2" } # avif encode requires dav1d system library: features = ["avif-native"]
+
+# File processing
+revolt_clamav-client = { version = "0.1.5" }
 simdutf8 = { version = "0.1.4", features = ["aarch64_neon"] }
-image = { version = "0.25.2" }                                # requires dav1d system library: features = ["avif-native"]

 # Content type processing
 infer = "0.16.0"
@@ -35,10 +42,12 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }

 # Core crates
-revolt-files = { version = "0.7.16", path = "../../core/files" }
-revolt-config = { version = "0.7.16", path = "../../core/config" }
-revolt-database = { version = "0.7.16", path = "../../core/database" }
-revolt-result = { version = "0.7.16", path = "../../core/result", features = [
+revolt-files = { version = "0.7.17", path = "../../core/files" }
+revolt-config = { version = "0.7.17", path = "../../core/config" }
+revolt-database = { version = "0.7.17", path = "../../core/database", features = [
+    "axum-impl",
+] }
+revolt-result = { version = "0.7.17", path = "../../core/result", features = [
    "utoipa",
    "axum",
 ] }
@@ -48,6 +57,7 @@ tempfile = "3.12.0"
 axum-macros = "0.4.1"
 axum_typed_multipart = "0.12.1"
 axum = { version = "0.7.5", features = ["multipart"] }
+tower-http = { version = "0.5.2", features = ["cors"] }

 # OpenAPI & documentation generation
 utoipa-scalar = { version = "0.1.0", features = ["axum"] }
@@ -1 +1,12 @@
-# TODO: https://github.com/wader/static-ffmpeg
+# Build Stage
+FROM ghcr.io/revoltchat/base:latest AS builder
+
+# Bundle Stage
+FROM gcr.io/distroless/cc-debian12:nonroot
+COPY --from=builder /home/rust/src/target/release/revolt-autumn ./
+COPY --from=mwader/static-ffmpeg:7.0.2 /ffmpeg /usr/local/bin/
+COPY --from=mwader/static-ffmpeg:7.0.2 /ffprobe /usr/local/bin/
+
+EXPOSE 14704
+USER nonroot
+CMD ["./revolt-autumn"]
@@ -5,7 +5,7 @@ use std::{

 use axum::{
    extract::{DefaultBodyLimit, Path, State},
-    http::header,
+    http::{header, Method},
    response::{IntoResponse, Redirect, Response},
    routing::{get, post},
    Json, Router,
@@ -13,14 +13,17 @@ use axum::{
 use axum_typed_multipart::{FieldData, TryFromMultipart, TypedMultipart};
 use image::ImageReader;
 use lazy_static::lazy_static;
-use revolt_config::config;
-use revolt_database::{Database, FileHash, Metadata};
-use revolt_files::{fetch_from_s3, AUTHENTICATION_TAG_SIZE_BYTES};
+use revolt_config::{config, report_internal_error};
+use revolt_database::{iso8601_timestamp::Timestamp, Database, FileHash, Metadata, User};
+use revolt_files::{
+    create_thumbnail, decode_image, fetch_from_s3, upload_to_s3, AUTHENTICATION_TAG_SIZE_BYTES,
+};
 use revolt_result::{create_error, Result};
 use serde::{Deserialize, Serialize};
 use sha2::Digest;
 use tempfile::NamedTempFile;
 use tokio::time::Instant;
+use tower_http::cors::{AllowHeaders, Any, CorsLayer};
 use utoipa::ToSchema;

 use crate::{exif::strip_metadata, metadata::generate_metadata, mime_type::determine_mime_type};
@@ -29,16 +32,24 @@ use crate::{exif::strip_metadata, metadata::generate_metadata, mime_type::determ
 pub async fn router() -> Router<Database> {
    let config = config().await;

+    let cors = CorsLayer::new()
+        .allow_methods([Method::POST])
+        .allow_headers(AllowHeaders::mirror_request())
+        .allow_origin(Any);
+
    Router::new()
        .route("/", get(root))
        .route(
            "/:tag",
-            post(upload_file).layer(DefaultBodyLimit::max(
-                config.features.limits.global.body_limit_size,
-            )),
+            post(upload_file)
+                .options(options)
+                .layer(DefaultBodyLimit::max(
+                    config.features.limits.global.body_limit_size,
+                )),
        )
        .route("/:tag/:file_id", get(fetch_preview))
        .route("/:tag/:file_id/:file_name", get(fetch_file))
+        .layer(cors)
 }

 lazy_static! {
@@ -86,8 +97,11 @@ async fn root() -> Json<RootResponse> {
    })
 }

+/// Empty handler for OPTIONS routes
+async fn options() {}
+
 /// Available tags to upload to
-#[derive(Deserialize, Debug, ToSchema, strum_macros::IntoStaticStr)]
+#[derive(Clone, Deserialize, Debug, ToSchema, strum_macros::IntoStaticStr)]
 #[allow(non_camel_case_types)]
 pub enum Tag {
    attachments,
@@ -111,7 +125,7 @@ pub struct UploadPayload {
 #[derive(Serialize, Debug, ToSchema)]
 pub struct UploadResponse {
    /// ID to attach uploaded file to object
-    id: &'static str,
+    id: String,
 }

 /// Upload a file
@@ -136,29 +150,48 @@ pub struct UploadResponse {
        ("tag" = Tag, Path, description = "Tag to upload to (e.g. attachments, icons, ...)")
    ),
    request_body(content_type = "multipart/form-data", content = UploadPayload),
+    security(
+        ("session_token" = []),
+        ("bot_token" = [])
+    )
 )]
 async fn upload_file(
+    State(db): State<Database>,
+    user: User,
    Path(tag): Path<Tag>,
    TypedMultipart(UploadPayload { mut file }): TypedMultipart<UploadPayload>,
-) -> axum::response::Result<Json<UploadResponse>> {
+) -> Result<Json<UploadResponse>> {
+    // Fetch configuration
+    let config = config().await;
+
    // Keep track of processing time
    let now = Instant::now();

-    // TODO: authenticate the user
-
    // Extract the filename, or give it a generic name
-    let file_name = file.metadata.file_name.unwrap_or("unnamed-file".to_owned());
+    let filename = file.metadata.file_name.unwrap_or("unnamed-file".to_owned());

    // Load file to memory
    let mut buf = Vec::<u8>::new();
-    file.contents
-        .read_to_end(&mut buf)
-        .map_err(|_| create_error!(InternalError))?;
+    report_internal_error!(file.contents.read_to_end(&mut buf))?;

    // Take note of original file size
    let original_file_size = buf.len();

-    // TODO: check against tag
+    // Ensure the file is not empty
+    if original_file_size < config.files.limit.min_file_size {
+        return Err(create_error!(FileTooSmall));
+    }
+
+    // Get user's file upload limits
+    let limits = user.limits().await;
+    let size_limit = *limits
+        .file_upload_size_limit
+        .get(tag.clone().into())
+        .expect("size limit");
+
+    if original_file_size > size_limit {
+        return Err(create_error!(FileTooLarge { max: size_limit }));
+    }

    // Generate sha256 hash
    let original_hash = {
@@ -167,13 +200,37 @@ async fn upload_file(
        hasher.finalize()
    };

-    // TODO: find existing `hash` (or match `processed`) and use that if possible
-    // then: create attachment and return UploadResponse { id }
+    // Generate an ID for this file
+    let id = if matches!(tag, Tag::emojis) {
+        ulid::Ulid::new().to_string()
+    } else {
+        nanoid::nanoid!(42)
+    };
+
+    // Find an existing hash and use that if possible
+    if let Ok(file_hash) = db
+        .fetch_attachment_hash(&format!("{original_hash:02x}"))
+        .await
+    {
+        let tag: &'static str = tag.into();
+        db.insert_attachment(&file_hash.into_file(id.clone(), tag.to_owned(), filename, user.id))
+            .await?;
+
+        return Ok(Json(UploadResponse { id }));
+    }

    // Determine the mime type for the file
-    let mime_type = determine_mime_type(&mut file.contents, &buf, &file_name);
+    let mime_type = determine_mime_type(&mut file.contents, &buf, &filename);

-    // TODO: block mime types here
+    // Check blocklist for mime type
+    if config
+        .files
+        .blocked_mime_types
+        .iter()
+        .any(|m| m == mime_type)
+    {
+        return Err(create_error!(FileTypeNotAllowed));
+    }

    // Determine metadata for the file
    let metadata = generate_metadata(&file.contents, mime_type);
@@ -181,7 +238,14 @@ async fn upload_file(
    // Strip metadata
    let (buf, metadata) = strip_metadata(file.contents, buf, metadata, mime_type).await?;

-    // TODO: Virus scan Metadata::File
+    // Virus scan files if ClamAV is configured
+    if matches!(metadata, Metadata::File)
+        && (config.files.scan_mime_types.is_empty()
+            || config.files.scan_mime_types.iter().any(|v| v == mime_type))
+        && crate::clamav::is_malware(&buf).await?
+    {
+        return Err(create_error!(InternalError));
+    }

    // Print file information for debug purposes
    let new_file_size = buf.len() + AUTHENTICATION_TAG_SIZE_BYTES;
@@ -193,15 +257,41 @@ async fn upload_file(
    let process_ratio = new_file_size as f32 / original_file_size as f32;
    let time_to_process = Instant::now() - now;

-    tracing::info!("Received file {file_name}\nOriginal hash: {original_hash:02X}\nOriginal size: {original_file_size} bytes\nMime type: {mime_type}\nMetadata: {metadata:?}\nProcessed file size: {new_file_size} bytes ({:.2}%).\nProcessed hash: {processed_hash:02X}\nProcessing took {time_to_process:?}", process_ratio * 100.0);
+    tracing::info!("Received file {filename}\nOriginal hash: {original_hash:02x}\nOriginal size: {original_file_size} bytes\nMime type: {mime_type}\nMetadata: {metadata:?}\nProcessed file size: {new_file_size} bytes ({:.2}%).\nProcessed hash: {processed_hash:02x}\nProcessing took {time_to_process:?}", process_ratio * 100.0);

-    // TODO: encrypt the file and generate FileHash
-    // note: file_size is processed file's size (incl. authTag in encrypted buffer)
-    // TODO: insert FileHash
-    // TODO: upload to S3
-    // TODO: create attachment
+    // Create hash entry in database
+    let file_hash = FileHash {
+        id: format!("{original_hash:02x}"),
+        processed_hash: format!("{processed_hash:02x}"),

-    Ok(Json(UploadResponse { id: "aaa" }))
+        created_at: Timestamp::now_utc(),
+
+        bucket_id: config.files.s3.default_bucket,
+        path: format!("{original_hash:02x}"),
+        iv: String::new(), // indicates file is not uploaded yet
+
+        metadata,
+        content_type: mime_type.to_owned(),
+        size: new_file_size as isize,
+    };
+
+    db.insert_attachment_hash(&file_hash).await?;
+
+    // Upload the file to S3 and commit nonce to database
+    let upload_start = Instant::now();
+    let nonce = upload_to_s3(&file_hash.bucket_id, &file_hash.id, &buf).await?;
+    db.set_attachment_hash_nonce(&file_hash.id, &nonce).await?;
+
+    // Debug information
+    let time_to_upload = Instant::now() - upload_start;
+    tracing::info!("Took {time_to_upload:?} to upload {new_file_size} bytes to S3.");
+
+    // Finally, create the file and return its ID
+    let tag: &'static str = tag.into();
+    db.insert_attachment(&file_hash.into_file(id.clone(), tag.to_owned(), filename, user.id))
+        .await?;
+
+    Ok(Json(UploadResponse { id }))
 }

 /// Header value used for cache control
@@ -264,30 +354,8 @@ async fn fetch_preview(
    // Original image data
    let data = retrieve_file_by_hash(&hash).await?;

-    // Dimensions we need to resize to
-    let config = config().await;
-    let [w, h] = config.files.preview.get(tag).unwrap();
-
-    // Read the image and resize it
-    // TODO: use jxl_oxide to process image/jxl files
-    let image = ImageReader::new(Cursor::new(data))
-        .with_guessed_format()
-        .map_err(|_| create_error!(InternalError))?
-        .decode()
-        .map_err(|_| create_error!(InternalError))?
-        //.resize(width as u32, height as u32, image::imageops::FilterType::Gaussian)
-        // resize is about 2.5x slower,
-        // thumbnail doesn't have terrible quality
-        // so we use thumbnail
-        .thumbnail(*w as u32, *h as u32);
-
-    // Encode it into WEBP
-    let encoder = webp::Encoder::from_image(&image).expect("Could not create encoder.");
-    let data = if config.files.webp_quality != 100.0 {
-        encoder.encode(config.files.webp_quality).to_vec()
-    } else {
-        encoder.encode_lossless().to_vec()
-    };
+    // Read image and create thumbnail
+    let data = create_thumbnail(decode_image(&mut Cursor::new(data), false)?, tag).await;

    Ok((
        [
@@ -0,0 +1,49 @@
+use std::time::Duration;
+
+use revolt_config::{config, report_internal_error};
+use revolt_result::Result;
+
+/// Initialise ClamAV
+pub async fn init() {
+    let config = config().await;
+
+    if !config.files.clamd_host.is_empty() {
+        tracing::info!("Waiting for clamd to be ready...");
+
+        loop {
+            let clamd_available =
+                match revolt_clamav_client::ping_tcp(config.files.clamd_host.clone()) {
+                    Ok(ping_response) => ping_response == b"PONG\0",
+                    Err(_) => false,
+                };
+
+            if clamd_available {
+                tracing::info!("clamd is ready, virus protection enabled!");
+                break;
+            } else {
+                tracing::error!(
+                    "Could not ping clamd host at {}, retrying in 10 seconds...",
+                    config.files.clamd_host
+                );
+
+                std::thread::sleep(Duration::from_secs(10));
+            }
+        }
+    }
+}
+
+/// Scan for malware
+pub async fn is_malware(buf: &[u8]) -> Result<bool> {
+    let config = config().await;
+    if config.files.clamd_host.is_empty() {
+        Ok(false)
+    } else {
+        let scan_response = report_internal_error!(revolt_clamav_client::scan_buffer_tcp(
+            buf,
+            config.files.clamd_host,
+            None
+        ))?;
+
+        report_internal_error!(revolt_clamav_client::clean(&scan_response)).map(|v| !v)
+    }
+}
@@ -2,6 +2,7 @@ use std::io::{Cursor, Read};

 use exif::Reader;
 use image::{ImageFormat, ImageReader};
+use revolt_config::report_internal_error;
 use revolt_database::Metadata;
 use revolt_result::{create_error, Result};
 use tempfile::NamedTempFile;
@@ -39,11 +40,11 @@ pub async fn strip_metadata(
                let mut cursor = Cursor::new(buf);

                // Decode the image
-                let image = ImageReader::new(&mut cursor)
-                    .with_guessed_format()
-                    .map_err(|_| create_error!(InternalError))?
-                    .decode()
-                    .map_err(|_| create_error!(InternalError));
+                let image = report_internal_error!(report_internal_error!(ImageReader::new(
+                    &mut cursor
+                )
+                .with_guessed_format())?
+                .decode());

                // Reset read position
                cursor.set_position(0);
@@ -64,7 +65,7 @@ pub async fn strip_metadata(

                // Apply the EXIF rotation
                // See https://jdhao.github.io/2019/07/31/image_rotation_exif_info/
-                match &rotation {
+                report_internal_error!(match &rotation {
                    2 => image?.fliph(),
                    3 => image?.rotate180(),
                    4 => image?.rotate180().fliph(),
@@ -83,8 +84,7 @@ pub async fn strip_metadata(
                        "image/tiff" => ImageFormat::Tiff,
                        _ => todo!(),
                    },
-                )
-                .map_err(|_| create_error!(InternalError))?;
+                ))?;

                // Calculate dimensions after rotation.
                let (width, height) = match &rotation {
@@ -112,47 +112,44 @@ pub async fn strip_metadata(
                };

                // Temporary output file
-                let mut out_file =
-                    NamedTempFile::new().map_err(|_| create_error!(InternalError))?;
+                let mut out_file = report_internal_error!(NamedTempFile::new())?;

                // Process the file with ffmpeg
-                Command::new("ffmpeg")
-                    .args([
-                        // Overwrite the temporary file
-                        "-y",
-                        // Read original uploaded file
-                        "-i",
-                        file.path().to_str().ok_or(create_error!(InternalError))?,
-                        // Strip any metadata
-                        "-map_metadata",
-                        "-1",
-                        // Copy video / audio data to new file
-                        "-c:v",
-                        "copy",
-                        "-c:a",
-                        "copy",
-                        // Select correct file format
-                        "-f",
-                        ext,
-                        // Save to new temporary file
-                        out_file
-                            .path()
-                            .to_str()
-                            .ok_or(create_error!(InternalError))?,
-                    ])
-                    .output()
-                    .await
-                    .inspect_err(|err| tracing::error!("{err:?}"))
-                    .map_err(|_| create_error!(InternalError))?;
+                report_internal_error!(
+                    Command::new("ffmpeg")
+                        .args([
+                            // Overwrite the temporary file
+                            "-y",
+                            // Read original uploaded file
+                            "-i",
+                            file.path().to_str().ok_or(create_error!(InternalError))?,
+                            // Strip any metadata
+                            "-map_metadata",
+                            "-1",
+                            // Copy video / audio data to new file
+                            "-c:v",
+                            "copy",
+                            "-c:a",
+                            "copy",
+                            // Select correct file format
+                            "-f",
+                            ext,
+                            // Save to new temporary file
+                            out_file
+                                .path()
+                                .to_str()
+                                .ok_or(create_error!(InternalError))?,
+                        ])
+                        .output()
+                        .await
+                )?;

                // Probe the file again
                let metadata = crate::metadata::generate_metadata(&out_file, mime);

                // Read the file from disk
                let mut buf = Vec::<u8>::new();
-                out_file
-                    .read_to_end(&mut buf)
-                    .map_err(|_| create_error!(InternalError))?;
+                report_internal_error!(out_file.read_to_end(&mut buf))?;

                Ok((buf, metadata))
            }
@@ -11,6 +11,7 @@ use utoipa::{
 use utoipa_scalar::{Scalar, Servable as ScalarServable};

 mod api;
+pub mod clamav;
 pub mod exif;
 pub mod metadata;
 pub mod mime_type;
@@ -18,7 +19,10 @@ pub mod mime_type;
 #[tokio::main]
 async fn main() -> Result<(), std::io::Error> {
    // Configure logging and environment
-    revolt_config::configure!(api);
+    revolt_config::configure!(files);
+
+    // Wait for ClamAV
+    clamav::init().await;

    // Configure API schema
    #[derive(OpenApi)]
@@ -52,9 +56,13 @@ async fn main() -> Result<(), std::io::Error> {
        fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
            if let Some(components) = openapi.components.as_mut() {
                components.add_security_scheme(
-                    "api_key",
-                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("todo_apikey"))),
-                )
+                    "bot_token",
+                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("X-Bot-Token"))),
+                );
+                components.add_security_scheme(
+                    "session_token",
+                    SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("X-Session-Token"))),
+                );
            }
        }
    }
@@ -1,7 +1,7 @@
-use std::{io::Cursor, os::unix::fs::MetadataExt};
+use std::io::Cursor;

 use revolt_database::Metadata;
-use revolt_result::{create_error, Result};
+use revolt_files::{image_size, video_size};
 use tempfile::NamedTempFile;

 /// Intersection of what infer can detect and what image-rs supports
@@ -22,32 +22,19 @@ static SUPPORTED_IMAGE_MIME: [&str; 9] = [
 /// Generate metadata from file, using mime type as a hint
 pub fn generate_metadata(f: &NamedTempFile, mime_type: &str) -> Metadata {
    if SUPPORTED_IMAGE_MIME.contains(&mime_type) {
-        if let Ok(size) = imagesize::size(f.path())
-            .inspect_err(|err| tracing::error!("Failed to generate image size! {err:?}"))
-        {
-            if let (Ok(width), Ok(height)) = (size.width.try_into(), size.height.try_into()) {
-                return Metadata::Image { width, height };
-            }
-        }
-
-        Metadata::File
+        image_size(f)
+            .map(|(width, height)| Metadata::Image {
+                width: width as isize,
+                height: height as isize,
+            })
+            .unwrap_or_default()
    } else if mime_type.starts_with("video/") {
-        if let Ok(data) = ffprobe::ffprobe(f.path())
-            .inspect_err(|err| tracing::error!("Failed to ffprobe file! {err:?}"))
-        {
-            // Use first valid stream
-            for stream in data.streams {
-                if let (Some(w), Some(h)) = (stream.width, stream.height) {
-                    if let (Ok(width), Ok(height)) = (w.try_into(), h.try_into()) {
-                        return Metadata::Video { width, height };
-                    }
-                }
-            }
-
-            Metadata::File
-        } else {
-            Metadata::File
-        }
+        video_size(f)
+            .map(|(width, height)| Metadata::Video {
+                width: width as isize,
+                height: height as isize,
+            })
+            .unwrap_or_default()
    } else if mime_type.starts_with("audio/") {
        Metadata::Audio
    } else if mime_type == "plain/text" {
@@ -1,7 +1,14 @@
 use tempfile::NamedTempFile;

 /// Determine the mime type of the given temporary file and filename
-pub fn determine_mime_type(f: &mut NamedTempFile, buf: &Vec<u8>, file_name: &str) -> &'static str {
+pub fn determine_mime_type(f: &mut NamedTempFile, buf: &[u8], file_name: &str) -> &'static str {
+    // Force certain extensions into particular mime types
+    if file_name.to_lowercase().ends_with(".apk") {
+        return "application/vnd.android.package-archive";
+    } else if file_name.to_lowercase().ends_with(".exe") {
+        return "application/vnd.microsoft.portable-executable";
+    }
+
    // Use magic signatures to determine mime type
    let kind = infer::get_from_path(f.path()).expect("file read successfully");
    let mime_type = if let Some(kind) = kind {
@@ -10,14 +17,6 @@ pub fn determine_mime_type(f: &mut NamedTempFile, buf: &Vec<u8>, file_name: &str
        "application/octet-stream"
    };

-    // Map any known conflicts where appropriate
-    let mime_type = if mime_type == "application/zip" && file_name.to_lowercase().ends_with(".apk")
-    {
-        "application/vnd.android.package-archive"
-    } else {
-        mime_type
-    };
-
    // See if the file is actually just plain Unicode/ASCII text
    if mime_type == "application/octet-stream" && simdutf8::basic::from_utf8(buf).is_ok() {
        return "plain/text";
@@ -1,19 +1,26 @@
 [package]
 name = "revolt-january"
-version = "0.7.14"
+version = "0.7.17"
 edition = "2021"

 [dependencies]
 # Utility
 mime = "0.3.17"
+regex = "1.11.0"
+tempfile = "3.13.0"
 lazy_static = "1.5.0"
 moka = { version = "0.12.8", features = ["future"] }

+# Web scraping
+scraper = "0.20.0"
+encoding_rs = "0.8.34"
+
 # Serialisation
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.68"

 # Async runtime
+async-recursion = "1.1.1"
 tokio = { version = "1.0", features = ["full"] }

 # Web requests
@@ -24,12 +31,13 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }

 # Core crates
-revolt-config = { version = "0.7.16", path = "../../core/config" }
-revolt-models = { version = "0.7.16", path = "../../core/models" }
-revolt-result = { version = "0.7.16", path = "../../core/result", features = [
+revolt-config = { version = "0.7.17", path = "../../core/config" }
+revolt-models = { version = "0.7.17", path = "../../core/models" }
+revolt-result = { version = "0.7.17", path = "../../core/result", features = [
    "utoipa",
    "axum",
 ] }
+revolt-files = { version = "0.7.17", path = "../../core/files" }

 # Axum / web server
 axum = { version = "0.7.5" }
@@ -0,0 +1,12 @@
+# Build Stage
+FROM ghcr.io/revoltchat/base:latest AS builder
+
+# Bundle Stage
+FROM gcr.io/distroless/cc-debian12:nonroot
+COPY --from=builder /home/rust/src/target/release/revolt-january ./
+COPY --from=mwader/static-ffmpeg:7.0.2 /ffmpeg /usr/local/bin/
+COPY --from=mwader/static-ffmpeg:7.0.2 /ffprobe /usr/local/bin/
+
+EXPOSE 14705
+USER nonroot
+CMD ["./revolt-january"]
@@ -1,16 +1,13 @@
-use axum::{body::Bytes, extract::Query, routing::get, Json, Router};
-use revolt_models::v0::Embed;
+use axum::{extract::Query, response::IntoResponse, routing::get, Json, Router};
+use reqwest::header;
 use revolt_result::Result;
 use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;

-use axum_extra::{
-    headers::{authorization::Bearer, Authorization},
-    TypedHeader,
-};
-
 use crate::requests::Request;

+pub static CACHE_CONTROL: &str = "public, max-age=600, immutable";
+
 pub async fn router() -> Router {
    Router::new()
        .route("/", get(root))
@@ -59,8 +56,17 @@ struct UrlQuery {
        ("url" = String, Query, description = "URL to fetch")
    ),
 )]
-async fn proxy(Query(UrlQuery { url }): Query<UrlQuery>) -> Result<Bytes> {
-    Request::proxy_file(&url).await
+async fn proxy(Query(UrlQuery { url }): Query<UrlQuery>) -> Result<impl IntoResponse> {
+    Request::proxy_file(&url).await.map(|(content_type, data)| {
+        (
+            [
+                (header::CONTENT_TYPE, content_type),
+                (header::CONTENT_DISPOSITION, "inline".to_owned()),
+                (header::CACHE_CONTROL, CACHE_CONTROL.to_owned()),
+            ],
+            data,
+        )
+    })
 }

 /// Generate embed for a given URL
@@ -79,7 +85,7 @@ async fn proxy(Query(UrlQuery { url }): Query<UrlQuery>) -> Result<Bytes> {
 )]
 async fn embed(
    Query(UrlQuery { url }): Query<UrlQuery>,
-    TypedHeader(Authorization(_bearer)): TypedHeader<Authorization<Bearer>>,
-) -> Result<Json<Embed>> {
-    Request::generate_embed(&url).await.map(Json)
+    // TypedHeader(Authorization(_bearer)): TypedHeader<Authorization<Bearer>>,
+) -> Result<impl IntoResponse> {
+    Request::generate_embed(url).await.map(Json)
 }
@@ -11,11 +11,12 @@ use utoipa_scalar::{Scalar, Servable as ScalarServable};

 mod api;
 pub mod requests;
+pub mod website_embed;

 #[tokio::main]
 async fn main() -> Result<(), std::io::Error> {
    // Configure logging and environment
-    revolt_config::configure!(api);
+    revolt_config::configure!(proxy);

    // Configure API schema
    #[derive(OpenApi)]
@@ -1,15 +1,23 @@
-use std::time::Duration;
-
-use axum::body::Bytes;
+use encoding_rs::{Encoding, UTF_8_INIT};
 use lazy_static::lazy_static;
 use mime::Mime;
-use reqwest::{header::CONTENT_TYPE, redirect, Client, Response};
-use revolt_models::v0::Embed;
+use regex::Regex;
+use reqwest::{
+    header::{self, CONTENT_TYPE},
+    redirect, Client, Response,
+};
+use revolt_config::report_internal_error;
+use revolt_files::{create_thumbnail, decode_image, image_size_vec, is_valid_image, video_size};
+use revolt_models::v0::{Embed, Image, ImageSize, Video};
 use revolt_result::{create_error, Result};
+use std::{
+    io::{Cursor, Write},
+    time::Duration,
+};

 lazy_static! {
+    /// Request client
    static ref CLIENT: Client = reqwest::Client::builder()
-        .user_agent("Mozilla/5.0 (compatible; January/2.0; +https://github.com/revoltchat/backend)")
        .timeout(Duration::from_secs(10)) // TODO config
        .connect_timeout(Duration::from_secs(5)) // TODO config
        .redirect(redirect::Policy::custom(|attempt| {
@@ -24,14 +32,17 @@ lazy_static! {
        .build()
        .expect("reqwest Client");

+    /// Spoof User Agent as Discord
+    static ref RE_USER_AGENT_SPOOFING_AS_DISCORD: Regex = Regex::new("^(?:(?:https?:)?//)?(?:(?:vx|fx)?twitter|(?:fixv|fixup)?x).com").expect("valid regex");
+
    /// Cache for proxy results
-    static ref PROXY_CACHE: moka::future::Cache<String, Result<Bytes>> = moka::future::Cache::builder()
+    static ref PROXY_CACHE: moka::future::Cache<String, Result<(String, Vec<u8>)>> = moka::future::Cache::builder()
        .max_capacity(10_000) // TODO config
        .time_to_live(Duration::from_secs(60)) // TODO config
        .build();

    /// Cache for embed results
-    static ref EMBED_CACHE: moka::future::Cache<String, Result<Embed>> = moka::future::Cache::builder()
+    static ref EMBED_CACHE: moka::future::Cache<String, Embed> = moka::future::Cache::builder()
        .max_capacity(1_000) // TODO config
        .time_to_live(Duration::from_secs(60)) // TODO config
        .build();
@@ -45,20 +56,175 @@ pub struct Request {

 impl Request {
    /// Proxy a given URL
-    pub async fn proxy_file(url: &str) -> Result<Bytes> {
+    pub async fn proxy_file(url: &str) -> Result<(String, Vec<u8>)> {
        if let Some(hit) = PROXY_CACHE.get(url).await {
            hit
        } else {
-            todo!()
+            let Request { response, mime } = Request::new(url).await?;
+
+            if matches!(mime.type_(), mime::IMAGE | mime::VIDEO) {
+                let bytes = response.bytes().await.map_err(|_| create_error!(LabelMe));
+
+                let result = match bytes {
+                    Ok(bytes) => {
+                        if matches!(mime.type_(), mime::IMAGE) {
+                            let reader = &mut Cursor::new(&bytes);
+
+                            if matches!(mime.subtype(), mime::GIF) {
+                                if is_valid_image(reader, false) {
+                                    Ok(("image/gif".to_owned(), bytes.to_vec()))
+                                } else {
+                                    Err(create_error!(LabelMe))
+                                }
+                            } else {
+                                Ok((
+                                    "image/webp".to_owned(),
+                                    create_thumbnail(decode_image(reader, false)?, "attachments")
+                                        .await,
+                                ))
+                            }
+                        } else {
+                            let mut file = report_internal_error!(tempfile::NamedTempFile::new())?;
+                            report_internal_error!(file.write_all(&bytes))?;
+
+                            if video_size(&file).is_some() {
+                                Ok((mime.to_string(), bytes.to_vec()))
+                            } else {
+                                Err(create_error!(LabelMe))
+                            }
+                        }
+                    }
+                    Err(err) => Err(err),
+                };
+
+                PROXY_CACHE.insert(url.to_owned(), result.clone()).await;
+                result
+            } else {
+                Err(create_error!(LabelMe))
+            }
+        }
+    }
+
+    /// Fetch metadata for an image
+    pub async fn fetch_image_metadata(
+        url: &str,
+        request: Option<Request>,
+    ) -> Result<Option<Image>> {
+        if let Some(hit) = EMBED_CACHE.get(url).await {
+            match hit {
+                Embed::Image(img) => Ok(Some(img)),
+                _ => Ok(None),
+            }
+        } else {
+            let response = if let Some(Request { response, .. }) = request {
+                response
+            } else {
+                let Request { response, mime } = Request::new(url).await?;
+                if matches!(mime.type_(), mime::IMAGE) {
+                    response
+                } else {
+                    return Err(create_error!(LabelMe));
+                }
+            };
+
+            if let Some((width, height)) =
+                image_size_vec(&report_internal_error!(response.bytes().await)?)
+            {
+                Ok(Some(Image {
+                    url: url.to_owned(),
+                    width,
+                    height,
+                    size: ImageSize::Large,
+                }))
+            } else {
+                Ok(None)
+            }
+        }
+    }
+
+    /// Fetch metadata for an video
+    pub async fn fetch_video_metadata(
+        url: &str,
+        request: Option<Request>,
+    ) -> Result<Option<Video>> {
+        if let Some(hit) = EMBED_CACHE.get(url).await {
+            match hit {
+                Embed::Video(vid) => Ok(Some(vid)),
+                _ => Ok(None),
+            }
+        } else {
+            let response = if let Some(Request { response, .. }) = request {
+                response
+            } else {
+                let Request { response, mime } = Request::new(&url).await?;
+                if matches!(mime.type_(), mime::VIDEO) {
+                    response
+                } else {
+                    return Err(create_error!(LabelMe));
+                }
+            };
+
+            let mut file = report_internal_error!(tempfile::NamedTempFile::new())?;
+            report_internal_error!(
+                file.write_all(&report_internal_error!(response.bytes().await)?)
+            )?;
+
+            if let Some((width, height)) = video_size(&file) {
+                Ok(Some(Video {
+                    url: url.to_owned(),
+                    width: width as usize,
+                    height: height as usize,
+                }))
+            } else {
+                Ok(None)
+            }
        }
    }

    /// Generate embed for a given URL
-    pub async fn generate_embed(url: &str) -> Result<Embed> {
-        if let Some(hit) = EMBED_CACHE.get(url).await {
-            hit
+    pub async fn generate_embed(url: String) -> Result<Embed> {
+        if let Some(hit) = EMBED_CACHE.get(&url).await {
+            Ok(hit)
        } else {
-            todo!()
+            let request = Request::new(&url).await?;
+            let embed = match (request.mime.type_(), request.mime.subtype()) {
+                (_, mime::HTML) => {
+                    let content_type = request
+                        .response
+                        .headers()
+                        .get(header::CONTENT_TYPE)
+                        .and_then(|value| value.to_str().ok())
+                        .and_then(|value| value.parse::<Mime>().ok());
+
+                    let encoding_name = content_type
+                        .as_ref()
+                        .and_then(|mime| mime.get_param("charset").map(|charset| charset.as_str()))
+                        .unwrap_or("utf-8");
+
+                    let encoding =
+                        Encoding::for_label(encoding_name.as_bytes()).unwrap_or(&UTF_8_INIT);
+
+                    let bytes = report_internal_error!(request.response.bytes().await)?;
+                    let (text, _, _) = encoding.decode(&bytes);
+
+                    crate::website_embed::create_website_embed(&url, &text)
+                        .await
+                        .map(Embed::Website)
+                        .unwrap_or_default()
+                }
+                (mime::IMAGE, _) => Request::fetch_image_metadata(&url, Some(request))
+                    .await
+                    .map(|res| res.map(Embed::Image).unwrap_or_default())
+                    .unwrap_or_default(),
+                (mime::VIDEO, _) => Request::fetch_video_metadata(&url, Some(request))
+                    .await
+                    .map(|res| res.map(Embed::Video).unwrap_or_default())
+                    .unwrap_or_default(),
+                _ => Embed::None,
+            };
+
+            EMBED_CACHE.insert(url.to_owned(), embed.clone()).await;
+            Ok(embed)
        }
    }

@@ -66,6 +232,14 @@ impl Request {
    pub async fn new(url: &str) -> Result<Request> {
        let response = CLIENT
            .get(url)
+            .header(
+                "User-Agent",
+                if RE_USER_AGENT_SPOOFING_AS_DISCORD.is_match(url) {
+                    "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)"
+                } else {
+                    "Mozilla/5.0 (compatible; January/2.0; +https://github.com/revoltchat/backend)"
+                },
+            )
            .send()
            .await
            .map_err(|_| create_error!(ProxyError))?;
@@ -0,0 +1,304 @@
+use std::collections::HashMap;
+
+use lazy_static::lazy_static;
+use regex::Regex;
+use revolt_models::v0::{
+    BandcampType, Image, ImageSize, LightspeedType, Special, TwitchType, Video, WebsiteMetadata,
+};
+use scraper::{Html, Selector};
+
+/// Create website metadata from URL and document
+pub async fn create_website_embed(original_url: &str, document: &str) -> Option<WebsiteMetadata> {
+    let document = Html::parse_document(document);
+
+    // create selectors
+    let meta_selector = Selector::parse("meta").ok()?;
+    let link_selector = Selector::parse("link").ok()?;
+
+    // extract meta tags
+    let mut meta = HashMap::new();
+    for el in document.select(&meta_selector) {
+        let node = el.value();
+
+        if let (Some(property), Some(content)) = (
+            node.attr("property").or_else(|| node.attr("name")),
+            node.attr("content"),
+        ) {
+            meta.insert(property.to_string(), content.to_string());
+        }
+    }
+
+    // extract rel links
+    let mut link = HashMap::new();
+    for el in document.select(&link_selector) {
+        let node = el.value();
+
+        if let (Some(property), Some(content)) = (node.attr("rel"), node.attr("href")) {
+            link.insert(property.to_string(), content.to_string());
+        }
+    }
+
+    // build metadata
+    let mut metadata = WebsiteMetadata {
+        title: meta
+            .remove("og:title")
+            .or_else(|| meta.remove("twitter:title"))
+            .or_else(|| meta.remove("title"))
+            .map(|s| s.trim().to_owned()),
+        description: meta
+            .remove("og:description")
+            .or_else(|| meta.remove("twitter:description"))
+            .or_else(|| meta.remove("description"))
+            .map(|s| s.trim().to_owned()),
+        image: meta
+            .remove("og:image")
+            .or_else(|| meta.remove("og:image:secure_url"))
+            .or_else(|| meta.remove("twitter:image"))
+            .or_else(|| meta.remove("twitter:image:src"))
+            .map(|s| s.trim().to_owned())
+            .map(|mut url| {
+                // If relative URL, prepend root URL. Also if root URL ends with a slash, remove it.
+                if let Some(ch) = url.chars().next() {
+                    if ch == '/' {
+                        url = format!("{}{}", &original_url.trim_end_matches('/'), url);
+                    }
+                }
+
+                let mut size = ImageSize::Preview;
+                if let Some(card) = meta.remove("twitter:card") {
+                    if &card == "summary_large_image" {
+                        size = ImageSize::Large;
+                    }
+                }
+
+                Image {
+                    url: url.to_owned(),
+                    width: meta
+                        .remove("og:image:width")
+                        .unwrap_or_default()
+                        .parse()
+                        .unwrap_or(0),
+                    height: meta
+                        .remove("og:image:height")
+                        .unwrap_or_default()
+                        .parse()
+                        .unwrap_or(0),
+                    size,
+                }
+            }),
+        video: meta
+            .remove("og:video")
+            .or_else(|| meta.remove("og:video:url"))
+            .or_else(|| meta.remove("og:video:secure_url"))
+            .map(|s| s.trim().to_owned())
+            .map(|mut url| {
+                // If relative URL, prepend root URL. Also if root URL ends with a slash, remove it.
+                if let Some(ch) = url.chars().next() {
+                    if ch == '/' {
+                        url = format!("{}{}", &original_url.trim_end_matches('/'), url);
+                    }
+                }
+
+                Video {
+                    url: url.to_owned(),
+                    width: meta
+                        .remove("og:video:width")
+                        .unwrap_or_default()
+                        .parse()
+                        .unwrap_or(0),
+                    height: meta
+                        .remove("og:video:height")
+                        .unwrap_or_default()
+                        .parse()
+                        .unwrap_or(0),
+                }
+            }),
+        icon_url: link
+            .remove("apple-touch-icon")
+            .or_else(|| link.remove("icon"))
+            .map(|s| s.trim().to_owned())
+            .map(|mut v| {
+                // If relative URL, prepend root URL.
+                if let Some(ch) = v.chars().next() {
+                    if ch == '/' {
+                        v = format!("{}{}", &original_url.trim_end_matches('/'), v);
+                    }
+                }
+
+                v
+            }),
+        colour: meta.remove("theme-color").map(|s| s.trim().to_owned()),
+        site_name: meta.remove("og:site_name").map(|s| s.trim().to_owned()),
+        url: meta
+            .remove("og:url")
+            .or_else(|| Some(original_url.to_owned())),
+        original_url: Some(original_url.to_owned()),
+        special: None,
+    };
+
+    // populate extra metadata for popular websites
+    populate_special(original_url.to_owned(), &mut metadata);
+
+    // TODO: these do not work because compiler is tripping:
+
+    // fetch video size if missing
+    // if let Some(Video { width, height, url }) = &metadata.video {
+    //     if width == &0 || height == &0 {
+    //         metadata.video = match crate::requests::Request::fetch_video_metadata(url, None).await {
+    //             Ok(Some(video)) => Some(video),
+    //             _ => None,
+    //         }
+    //     }
+    // }
+
+    // fetch image size if missing
+    // if let Some(Image {
+    //     width, height, url, ..
+    // }) = &metadata.image
+    // {
+    //     if width == &0 || height == &0 {
+    //         metadata.image = match crate::requests::Request::fetch_image_metadata(url, None).await {
+    //             Ok(Some(image)) => Some(image),
+    //             _ => None,
+    //         }
+    //     }
+    // }
+
+    // truncate data
+    metadata.truncate();
+
+    // if it's empty, don't return anything
+    if metadata.is_empty() {
+        None
+    } else {
+        Some(metadata)
+    }
+}
+
+pub fn populate_special(original_url: String, metadata: &mut WebsiteMetadata) {
+    lazy_static! {
+        static ref RE_YOUTUBE: Regex = Regex::new("^(?:(?:https?:)?//)?(?:(?:www|m)\\.)?(?:(?:youtube\\.com|youtu.be))(?:/(?:[\\w\\-]+\\?v=|embed/|v/)?)([\\w\\-]+)(?:\\S+)?$").unwrap();
+
+        static ref RE_LIGHTSPEED: Regex = Regex::new("^(?:https?://)?(?:[\\w]+\\.)?lightspeed\\.tv/([a-z0-9_]{4,25})").unwrap();
+
+        static ref RE_TWITCH: Regex = Regex::new("^(?:https?://)?(?:www\\.|go\\.)?twitch\\.tv/([a-z0-9_]+)($|\\?)").unwrap();
+        static ref RE_TWITCH_VOD: Regex = Regex::new("^(?:https?://)?(?:www\\.|go\\.)?twitch\\.tv/videos/([0-9]+)($|\\?)").unwrap();
+        static ref RE_TWITCH_CLIP: Regex = Regex::new("^(?:https?://)?(?:www\\.|go\\.)?twitch\\.tv/(?:[a-z0-9_]+)/clip/([A-z0-9_-]+)($|\\?)").unwrap();
+
+        static ref RE_SPOTIFY: Regex = Regex::new("^(?:https?://)?open.spotify.com/(track|user|artist|album|playlist)/([A-z0-9]+)").unwrap();
+        static ref RE_SOUNDCLOUD: Regex = Regex::new("^(?:https?://)?soundcloud.com/([a-zA-Z0-9-]+)/([A-z0-9-]+)").unwrap();
+        static ref RE_BANDCAMP: Regex = Regex::new("^(?:https?://)?(?:[A-z0-9_-]+).bandcamp.com/(track|album)/([A-z0-9_-]+)").unwrap();
+        static ref RE_APPLE_MUSIC: Regex = Regex::new("^(?:https?://)?music\\.apple\\.com/(?:[a-z]{2}/)?album/(?:[a-zA-Z0-9-]+)/(\\d+)(?:\\?i=(\\d+))?").unwrap();
+
+        static ref RE_STREAMABLE: Regex = Regex::new("^(?:https?://)?(?:www\\.)?streamable\\.com/([\\w\\d-]+)").unwrap();
+
+        static ref RE_GIF: Regex = Regex::new("^(?:https?://)?(www\\.)?(gifbox\\.me/view|yiffbox\\.me/view|tenor\\.com/view|giphy\\.com/gifs|gfycat\\.com|redgifs\\.com/watch)/[\\w\\d-]+").unwrap();
+    }
+
+    let url = metadata
+        .url
+        .as_ref()
+        .or(metadata.original_url.as_ref())
+        .unwrap_or(&original_url)
+        .as_str();
+
+    metadata.special = if let Some(captures) = RE_STREAMABLE.captures_iter(url).next() {
+        Some(Special::Streamable {
+            id: captures[1].to_string(),
+        })
+    } else if let Some(captures) = RE_YOUTUBE.captures_iter(url).next() {
+        lazy_static! {
+            static ref RE_TIMESTAMP: Regex = Regex::new("(?:\\?|&)(?:t|start)=([\\w]+)").unwrap();
+        }
+
+        if let Some(video) = &metadata.video {
+            if let Some(timestamp_captures) = RE_TIMESTAMP.captures_iter(&video.url).next() {
+                Some(Special::YouTube {
+                    id: captures[1].to_string(),
+                    timestamp: Some(timestamp_captures[1].to_string()),
+                })
+            } else {
+                Some(Special::YouTube {
+                    id: captures[1].to_string(),
+                    timestamp: None,
+                })
+            }
+        } else {
+            None
+        }
+    } else if let Some(captures) = RE_LIGHTSPEED.captures_iter(url).next() {
+        Some(Special::Lightspeed {
+            id: captures[1].to_string(),
+            content_type: LightspeedType::Channel,
+        })
+    } else if let Some(captures) = RE_TWITCH.captures_iter(url).next() {
+        Some(Special::Twitch {
+            id: captures[1].to_string(),
+            content_type: TwitchType::Channel,
+        })
+    } else if let Some(captures) = RE_TWITCH_VOD.captures_iter(url).next() {
+        Some(Special::Twitch {
+            id: captures[1].to_string(),
+            content_type: TwitchType::Video,
+        })
+    } else if let Some(captures) = RE_TWITCH_CLIP.captures_iter(url).next() {
+        Some(Special::Twitch {
+            id: captures[1].to_string(),
+            content_type: TwitchType::Clip,
+        })
+    } else if let Some(captures) = RE_SPOTIFY.captures_iter(url).next() {
+        Some(Special::Spotify {
+            content_type: captures[1].to_string(),
+            id: captures[2].to_string(),
+        })
+    } else if RE_SOUNDCLOUD.is_match(url) {
+        Some(Special::Soundcloud)
+    } else if RE_BANDCAMP.is_match(url) {
+        lazy_static! {
+            static ref RE_TRACK: Regex = Regex::new("track=(\\d+)").unwrap();
+            static ref RE_ALBUM: Regex = Regex::new("album=(\\d+)").unwrap();
+        }
+
+        if let Some(video) = &metadata.video {
+            if let Some(captures) = RE_TRACK.captures_iter(&video.url).next() {
+                Some(Special::Bandcamp {
+                    content_type: BandcampType::Track,
+                    id: captures[1].to_string(),
+                })
+            } else {
+                RE_ALBUM
+                    .captures_iter(&video.url)
+                    .next()
+                    .map(|captures| Special::Bandcamp {
+                        content_type: BandcampType::Album,
+                        id: captures[1].to_string(),
+                    })
+            }
+        } else {
+            None
+        }
+    } else if RE_GIF.is_match(url) {
+        Some(Special::GIF)
+    } else {
+        RE_APPLE_MUSIC
+            .captures_iter(url)
+            .next()
+            .map(|captures| Special::AppleMusic {
+                album_id: captures[1].to_string(),
+                track_id: captures.get(2).map(|m| m.as_str().to_string()),
+            })
+    };
+
+    // add colours for popular websites
+    if let Some(special) = &metadata.special {
+        match special {
+            Special::YouTube { .. } => metadata.colour = Some("#FF424F".to_string()),
+            Special::Twitch { .. } => metadata.colour = Some("#7B68EE".to_string()),
+            Special::Lightspeed { .. } => metadata.colour = Some("#7445D9".to_string()),
+            Special::Spotify { .. } => metadata.colour = Some("#1ABC9C".to_string()),
+            Special::Soundcloud { .. } => metadata.colour = Some("#FF7F50".to_string()),
+            Special::AppleMusic { .. } => metadata.colour = Some("#FA233B".to_string()),
+            _ => {}
+        }
+    }
+}
@@ -23,6 +23,7 @@ echo "Building images, will tag for ghcr.io with $TAG!"
 docker build -t ghcr.io/revoltchat/base:latest -f Dockerfile.useCurrentArch .
 docker build -t ghcr.io/revoltchat/server:$TAG - < crates/delta/Dockerfile
 docker build -t ghcr.io/revoltchat/bonfire:$TAG - < crates/bonfire/Dockerfile
+docker build -t ghcr.io/revoltchat/autumn:$TAG - < crates/services/autumn/Dockerfile

 if [ "$DEBUG" = "true" ]; then
  git restore Cargo.toml
@@ -30,3 +31,4 @@ fi

 docker push ghcr.io/revoltchat/server:$TAG
 docker push ghcr.io/revoltchat/bonfire:$TAG
+docker push ghcr.io/revoltchat/autumn:$TAG
Author	SHA1	Message	Date
Paul Makles	c596dd5458	chore: bump all versions	2024-10-01 21:18:55 +01:00
Paul Makles	ed78b253ff	feat(services/january): website embed generation	2024-10-01 21:11:08 +01:00
Paul Makles	66c84e0ad9	feat(services/january): image/video embeds	2024-10-01 19:13:48 +01:00
Paul Makles	21335b3297	feat(services/january): proxy images/videos	2024-10-01 19:02:39 +01:00
Paul Makles	8fc791f81a	ci: remove .env file entry	2024-09-29 17:18:41 +01:00
Paul Makles	1689ee5ddc	ci: use compose.yml file instead of deleted file	2024-09-29 17:08:42 +01:00
Paul Makles	7a061bb3c6	ci: add january to build list	2024-09-29 17:05:20 +01:00
Paul Makles	6c3b8eaa92	chore(core/files): do not decrypt file if nonce unavailable	2024-09-29 17:03:02 +01:00
Paul Makles	5e1b2e165f	ci: add autumn to build list	2024-09-29 15:10:23 +01:00
Paul Makles	e270b5df6a	chore: correct ports in Dockerfile	2024-09-29 15:10:12 +01:00
Paul Makles	cbf9e81256	fix: delete attachments by `used_for.id` and add corresponding index	2024-09-29 15:05:56 +01:00
Paul Makles	3080ec1f5a	refactor: capture errors with line numbers refactor: update file api	2024-09-29 14:37:08 +01:00
Paul Makles	4fd66b2719	refactor(core/result): add NotAuthenticated error which is distinct from InvalidCredentials	2024-09-29 12:02:10 +01:00
Paul Makles	916f47e2f5	feat(services/autumn): cors support	2024-09-29 12:01:32 +01:00
Paul Makles	a3c5b1bf87	chore: releasing beta build of autumn	2024-09-11 14:42:00 +01:00
Paul Makles	ace6c30ba5	feat(services/autumn): file uploads feat(services/autumn): deduplicate uploads feat(services/autumn): ClamAV support	2024-09-11 14:29:52 +01:00
Paul Makles	f4104612b2	chore: strip all the duplicate stuff from dev Revolt.toml	2024-09-10 16:54:07 +01:00
Paul Makles	6209bc7152	feat(services/autumn): authenticate the user on upload feat(services/autumn): file size limits on upload chore: add database migrations for new autumn things	2024-09-10 16:53:58 +01:00
Paul Makles	1a6a8a809b	feat(core/database): axum implementation for User	2024-09-10 16:53:02 +01:00
Paul Makles	5485781e7c	docs: update README with more badges	2024-09-10 15:15:53 +01:00
Paul Makles	8b21825ffe	docs: update README	2024-09-09 14:24:22 +01:00
Paul Makles	530ff4f9c7	docs: this will be the developer experience ever (deprecate .env file ✨) fix: port is wrong for maildev	2024-09-09 14:19:31 +01:00
Paul Makles	2eb596fe99	chore: pin crate versions to "MaxSRV"	2024-09-09 13:05:43 +01:00