Compare commits
10
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Paul Makles
|
4fd66b2719 | ||
|
Paul Makles
|
916f47e2f5 | ||
|
Paul Makles
|
a3c5b1bf87 | ||
|
Paul Makles
|
ace6c30ba5 | ||
|
Paul Makles
|
f4104612b2 | ||
|
Paul Makles
|
6209bc7152 | ||
|
Paul Makles
|
1a6a8a809b | ||
|
Paul Makles
|
5485781e7c | ||
|
Paul Makles
|
8b21825ffe | ||
|
Paul Makles
|
530ff4f9c7 |
-107
@@ -1,107 +0,0 @@
|
||||
# MongoDB URI
|
||||
MONGODB=mongodb://localhost
|
||||
AUTUMN_MONGO_URI=mongodb://database
|
||||
REDIS_URI=redis://localhost/
|
||||
|
||||
# URL to where the Revolt app is publicly accessible
|
||||
REVOLT_APP_URL=http://local.revolt.chat:5000
|
||||
|
||||
# URL to where the API is publicly accessible
|
||||
REVOLT_PUBLIC_URL=http://local.revolt.chat:8000
|
||||
VITE_API_URL=http://local.revolt.chat:8000
|
||||
|
||||
# URL to where the WebSocket server is publicly accessible
|
||||
REVOLT_EXTERNAL_WS_URL=ws://local.revolt.chat:9000
|
||||
|
||||
# URL to where Autumn is publicly available
|
||||
AUTUMN_PUBLIC_URL=http://local.revolt.chat:3000
|
||||
|
||||
# URL to where January is publicly available
|
||||
JANUARY_PUBLIC_URL=http://local.revolt.chat:7000
|
||||
|
||||
# URL to where Vortex is publicly available
|
||||
# VOSO_PUBLIC_URL=https://voso.revolt.chat
|
||||
|
||||
|
||||
##
|
||||
## hCaptcha Settings
|
||||
##
|
||||
|
||||
# If you are sure that you don't want to use hCaptcha, set to 1.
|
||||
REVOLT_UNSAFE_NO_CAPTCHA=1
|
||||
|
||||
# hCaptcha API key
|
||||
# REVOLT_HCAPTCHA_KEY=0x0000000000000000000000000000000000000000
|
||||
|
||||
# hCaptcha site key
|
||||
# REVOLT_HCAPTCHA_SITEKEY=10000000-ffff-ffff-ffff-000000000001
|
||||
|
||||
|
||||
##
|
||||
## Email Settings
|
||||
##
|
||||
|
||||
# If you are sure that you don't want to use email verification, set to 1.
|
||||
REVOLT_UNSAFE_NO_EMAIL=1
|
||||
|
||||
# SMTP host
|
||||
# REVOLT_SMTP_HOST=smtp.example.com
|
||||
|
||||
# SMTP username
|
||||
# REVOLT_SMTP_USERNAME=noreply@example.com
|
||||
|
||||
# SMTP password
|
||||
# REVOLT_SMTP_PASSWORD=CHANGEME
|
||||
|
||||
# SMTP From header
|
||||
# REVOLT_SMTP_FROM=Revolt <noreply@example.com>
|
||||
|
||||
|
||||
##
|
||||
## Application Settings
|
||||
##
|
||||
|
||||
# Whether to enable staging only features
|
||||
REVOLT_IS_STAGING=1
|
||||
|
||||
# Whether to only allow users to sign up if they have an invite code
|
||||
REVOLT_INVITE_ONLY=0
|
||||
|
||||
# Maximum number of people that can be in a group chat
|
||||
REVOLT_MAX_GROUP_SIZE=150
|
||||
|
||||
# VAPID keys for push notifications
|
||||
# Generate using this guide: https://gitlab.insrt.uk/revolt/delta/-/wikis/vapid
|
||||
# --> Please replace these keys before going into production! <--
|
||||
REVOLT_VAPID_PRIVATE_KEY=LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUJSUWpyTWxLRnBiVWhsUHpUbERvcEliYk1yeVNrNXpKYzVYVzIxSjJDS3hvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWnkrQkg2TGJQZ2hEa3pEempXOG0rUXVPM3pCajRXT1phdkR6ZU00c0pqbmFwd1psTFE0WAp1ZDh2TzVodU94QWhMQlU3WWRldVovWHlBdFpWZmNyQi9BPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
|
||||
REVOLT_VAPID_PUBLIC_KEY=BGcvgR-i2z4IQ5Mw841vJvkLjt8wY-FjmWrw83jOLCY52qcGZS0OF7nfLzuYbjsQISwVO2HXrmf18gLWVX3Kwfw=
|
||||
|
||||
|
||||
##
|
||||
## Vortex configuration
|
||||
##
|
||||
|
||||
# VOSO_MANAGE_TOKEN=CHANGEME
|
||||
|
||||
|
||||
##
|
||||
## Autumn configuration
|
||||
##
|
||||
|
||||
# S3 Region
|
||||
AUTUMN_S3_REGION=minio
|
||||
|
||||
# S3 Endpoint
|
||||
AUTUMN_S3_ENDPOINT=http://minio:9000
|
||||
|
||||
# MinIO Root User
|
||||
MINIO_ROOT_USER=minioautumn
|
||||
|
||||
# MinIO Root Password
|
||||
MINIO_ROOT_PASSWORD=minioautumn
|
||||
|
||||
# AWS Access Key ID
|
||||
AWS_ACCESS_KEY_ID=minioautumn
|
||||
|
||||
# AWS Secret Key
|
||||
AWS_SECRET_ACCESS_KEY=minioautumn
|
||||
Generated
+46
-4
@@ -2515,8 +2515,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
|
||||
dependencies = [
|
||||
"cfg-if",
|
||||
"js-sys",
|
||||
"libc",
|
||||
"wasi",
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -5308,10 +5310,12 @@ dependencies = [
|
||||
"kamadak-exif",
|
||||
"lazy_static",
|
||||
"moka",
|
||||
"nanoid",
|
||||
"revolt-config",
|
||||
"revolt-database",
|
||||
"revolt-files",
|
||||
"revolt-result",
|
||||
"revolt_clamav-client",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"sha2",
|
||||
@@ -5319,8 +5323,10 @@ dependencies = [
|
||||
"strum_macros",
|
||||
"tempfile",
|
||||
"tokio 1.35.1",
|
||||
"tower-http",
|
||||
"tracing",
|
||||
"tracing-subscriber",
|
||||
"ulid 1.1.3",
|
||||
"utoipa",
|
||||
"utoipa-scalar",
|
||||
"webp",
|
||||
@@ -5368,6 +5374,7 @@ dependencies = [
|
||||
"log",
|
||||
"once_cell",
|
||||
"pretty_env_logger",
|
||||
"revolt-result",
|
||||
"sentry",
|
||||
"serde",
|
||||
]
|
||||
@@ -5381,6 +5388,7 @@ dependencies = [
|
||||
"async-std",
|
||||
"async-trait",
|
||||
"authifier",
|
||||
"axum",
|
||||
"base64 0.21.3",
|
||||
"bson",
|
||||
"deadqueue",
|
||||
@@ -5412,7 +5420,7 @@ dependencies = [
|
||||
"schemars",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"ulid 1.0.0",
|
||||
"ulid 1.1.3",
|
||||
"unicode-segmentation",
|
||||
"url-escape",
|
||||
"validator 0.16.0",
|
||||
@@ -5596,6 +5604,12 @@ dependencies = [
|
||||
"tokio 1.35.1",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "revolt_clamav-client"
|
||||
version = "0.1.5"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "3d719e9fe861e2e05cbf01fd82d310fdeb2160c74fee21689a5c223eeb65cea8"
|
||||
|
||||
[[package]]
|
||||
name = "revolt_okapi"
|
||||
version = "0.9.1"
|
||||
@@ -7109,6 +7123,22 @@ dependencies = [
|
||||
"tracing",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tower-http"
|
||||
version = "0.5.2"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
|
||||
dependencies = [
|
||||
"bitflags 2.6.0",
|
||||
"bytes 1.5.0",
|
||||
"http 1.1.0",
|
||||
"http-body 1.0.0",
|
||||
"http-body-util",
|
||||
"pin-project-lite 0.2.13",
|
||||
"tower-layer",
|
||||
"tower-service",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "tower-layer"
|
||||
version = "0.3.2"
|
||||
@@ -7324,11 +7354,13 @@ dependencies = [
|
||||
|
||||
[[package]]
|
||||
name = "ulid"
|
||||
version = "1.0.0"
|
||||
version = "1.1.3"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "13a3aaa69b04e5b66cc27309710a569ea23593612387d67daaf102e73aa974fd"
|
||||
checksum = "04f903f293d11f31c0c29e4148f6dc0d033a7f80cebc0282bea147611667d289"
|
||||
dependencies = [
|
||||
"getrandom",
|
||||
"rand 0.8.5",
|
||||
"web-time",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -7509,7 +7541,7 @@ dependencies = [
|
||||
"quote 1.0.37",
|
||||
"regex",
|
||||
"syn 2.0.76",
|
||||
"ulid 1.0.0",
|
||||
"ulid 1.1.3",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -7791,6 +7823,16 @@ dependencies = [
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "web-time"
|
||||
version = "1.1.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
|
||||
dependencies = [
|
||||
"js-sys",
|
||||
"wasm-bindgen",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "webp"
|
||||
version = "0.3.0"
|
||||
|
||||
@@ -1,19 +1,34 @@
|
||||
# Revolt Backend
|
||||
<div align="center">
|
||||
<h1>
|
||||
Revolt Backend
|
||||
|
||||
[](https://github.com/revoltchat/backend/stargazers)
|
||||
[](https://github.com/revoltchat/backend/network/members)
|
||||
[](https://github.com/revoltchat/backend/pulls)
|
||||
[](https://github.com/revoltchat/backend/issues)
|
||||
[](https://github.com/revoltchat/backend/graphs/contributors)
|
||||
[](https://github.com/revoltchat/backend/blob/main/LICENSE)
|
||||
</h1>
|
||||
The services and libraries that power the Revolt service.<br/>
|
||||
<br/>
|
||||
|
||||
This is a monorepo for the Revolt backend.
|
||||
| Crate | Path | Description | |
|
||||
| ------------------ | -------------------------------------------------- | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `core/config` | [crates/core/config](crates/core/config) | Core: Configuration |     |
|
||||
| `core/database` | [crates/core/database](crates/core/database) | Core: Database Implementation |     |
|
||||
| `core/files` | [crates/core/files](crates/core/files) | Core: S3 and encryption subroutines |     |
|
||||
| `core/models` | [crates/core/models](crates/core/models) | Core: API Models |     |
|
||||
| `core/permissions` | [crates/core/permissions](crates/core/permissions) | Core: Permission Logic |     |
|
||||
| `core/presence` | [crates/core/presence](crates/core/presence) | Core: User Presence |     |
|
||||
| `core/result` | [crates/core/result](crates/core/result) | Core: Result and Error types |     |
|
||||
| `delta` | [crates/delta](crates/delta) | REST API server |  |
|
||||
| `bonfire` | [crates/bonfire](crates/bonfire) | WebSocket events server |  |
|
||||
| `services/january` | [crates/services/january](crates/services/january) | Proxy server |  |
|
||||
| `services/autumn` | [crates/services/autumn](crates/services/autumn) | File server |  |
|
||||
| `bindings/node` | [crates/bindings/node](crates/bindings/node) | Node.js bindings for the Revolt software |  |
|
||||
|
||||
| Crate | Path | Description |
|
||||
| ------------------ | -------------------------------------------------- | ----------------------------- |
|
||||
| `core/config` | [crates/core/config](crates/core/config) | Core: Configuration |
|
||||
| `core/database` | [crates/core/database](crates/core/database) | Core: Database Implementation |
|
||||
| `core/models` | [crates/core/models](crates/core/models) | Core: API Models |
|
||||
| `core/permissions` | [crates/core/permissions](crates/core/permissions) | Core: Permission Logic |
|
||||
| `core/presence` | [crates/core/presence](crates/core/presence) | Core: User Presence |
|
||||
| `core/result` | [crates/core/result](crates/core/result) | Core: Result and Error types |
|
||||
| `delta` | [crates/delta](crates/delta) | REST API server |
|
||||
| `bonfire` | [crates/bonfire](crates/bonfire) | WebSocket events server |
|
||||
|
||||
Note: `january`, `autumn`, and `vortex` are yet to be moved into this monorepo.
|
||||
</div>
|
||||
<br/>
|
||||
|
||||
## Minimum Supported Rust Version
|
||||
|
||||
@@ -60,13 +75,19 @@ cargo build
|
||||
|
||||
A default configuration `Revolt.toml` is present in this project that is suited for development.
|
||||
|
||||
If you'd like to change anything, create a `Revolt.overrides.toml` file to overwrite it.
|
||||
If you'd like to change anything, create a `Revolt.overrides.toml` file and specify relevant variables.
|
||||
|
||||
You may need to configure the legacy environment options:
|
||||
|
||||
```bash
|
||||
cp .env.example .env
|
||||
```
|
||||
> [!TIP]
|
||||
> Use Sentry to catch unexpected service errors:
|
||||
>
|
||||
> ```toml
|
||||
> # Revolt.overrides.toml
|
||||
> [sentry]
|
||||
> api = "https://abc@your.sentry/1"
|
||||
> events = "https://abc@your.sentry/1"
|
||||
> files = "https://abc@your.sentry/1"
|
||||
> proxy = "https://abc@your.sentry/1"
|
||||
> ```
|
||||
|
||||
Then continue:
|
||||
|
||||
@@ -98,10 +119,13 @@ git clone --recursive https://github.com/revoltchat/revite
|
||||
cd revite
|
||||
yarn
|
||||
yarn build:deps
|
||||
echo "VITE_API_URL=http://local.revolt.chat:14702" > .env.local
|
||||
yarn dev --port 14701
|
||||
```
|
||||
|
||||
Then go to https://local.revolt.chat:14701
|
||||
Then go to http://local.revolt.chat:14701 to create an account/login.
|
||||
|
||||
When signing up, go to http://localhost:14080 to find confirmation/password reset emails.
|
||||
|
||||
## Deployment Guide
|
||||
|
||||
|
||||
+3
-153
@@ -4,10 +4,10 @@
|
||||
[database]
|
||||
# MongoDB connection URL
|
||||
# Defaults to the container name specified in self-hosted
|
||||
mongodb = "mongodb://localhost:14017"
|
||||
mongodb = "mongodb://127.0.0.1:14017"
|
||||
# Redis connection URL
|
||||
# Defaults to the container name specified in self-hosted
|
||||
redis = "redis://localhost:14079/"
|
||||
redis = "redis://127.0.0.1:14079/"
|
||||
|
||||
[hosts]
|
||||
# Web locations of various services
|
||||
@@ -25,11 +25,6 @@ voso_legacy_ws = ""
|
||||
|
||||
[api]
|
||||
|
||||
[api.registration]
|
||||
# Whether an invite should be required for registration
|
||||
# See https://github.com/revoltchat/self-hosted#making-your-instance-invite-only
|
||||
invite_only = false
|
||||
|
||||
[api.smtp]
|
||||
# Email server configuration for verification
|
||||
# Defaults to no email verification (host field is empty)
|
||||
@@ -41,97 +36,9 @@ reply_to = "support@revolt.chat"
|
||||
port = 14025
|
||||
use_tls = false
|
||||
|
||||
[api.vapid]
|
||||
# Generate your own keys:
|
||||
# 1. Run `openssl ecparam -name prime256v1 -genkey -noout -out vapid_private.pem`
|
||||
# 2. Find `private_key` using `base64 vapid_private.pem`
|
||||
# 3. Find `public_key` using `openssl ec -in vapid_private.pem -outform DER|tail -c 65|base64|tr '/+' '_-'|tr -d '\n'`
|
||||
private_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUJSUWpyTWxLRnBiVWhsUHpUbERvcEliYk1yeVNrNXpKYzVYVzIxSjJDS3hvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWnkrQkg2TGJQZ2hEa3pEempXOG0rUXVPM3pCajRXT1phdkR6ZU00c0pqbmFwd1psTFE0WAp1ZDh2TzVodU94QWhMQlU3WWRldVovWHlBdFpWZmNyQi9BPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo"
|
||||
public_key = "BGcvgR-i2z4IQ5Mw841vJvkLjt8wY-FjmWrw83jOLCY52qcGZS0OF7nfLzuYbjsQISwVO2HXrmf18gLWVX3Kwfw="
|
||||
|
||||
[api.fcm]
|
||||
# Google Firebase Cloud Messaging Service Account Key
|
||||
# Obtained from the cloud messaging console
|
||||
key_type = ""
|
||||
project_id = ""
|
||||
private_key_id = ""
|
||||
private_key = ""
|
||||
client_email = ""
|
||||
client_id = ""
|
||||
auth_uri = ""
|
||||
token_uri = ""
|
||||
auth_provider_x509_cert_url = ""
|
||||
client_x509_cert_url = ""
|
||||
|
||||
[api.apn]
|
||||
# Apple Push Notifications keys for sending notifications
|
||||
sandbox = false
|
||||
pkcs8 = ""
|
||||
key_id = ""
|
||||
team_id = ""
|
||||
|
||||
[api.security]
|
||||
# Authifier Shield API key
|
||||
authifier_shield_key = ""
|
||||
# Legacy voice server management token
|
||||
voso_legacy_token = ""
|
||||
# Whether services are behind the Cloudflare network
|
||||
trust_cloudflare = false
|
||||
|
||||
[api.security.captcha]
|
||||
# hCaptcha configuration
|
||||
hcaptcha_key = ""
|
||||
hcaptcha_sitekey = ""
|
||||
|
||||
[api.workers]
|
||||
# Maximum concurrent connections (to proxy server)
|
||||
max_concurrent_connections = 50
|
||||
|
||||
[files]
|
||||
# Encryption key for stored files
|
||||
# Generate your own key using `openssl rand -base64 32`
|
||||
encryption_key = "qcuMA+ssxhMyKaNAKBGFfryfFtUH8NDlamQyDwGW6fU="
|
||||
# Quality used for lossy WebP previews (set to 100 for lossless)
|
||||
webp_quality = 80.0
|
||||
# Mime types that cannot be uploaded or served
|
||||
#
|
||||
# Example for Windows executables and Android installation files:
|
||||
# ["application/vnd.microsoft.portable-executable", "application/vnd.android.package-archive"]
|
||||
blocked_mime_types = []
|
||||
# ClamAV service
|
||||
# hostname:port
|
||||
clamd_host = ""
|
||||
|
||||
[files.limit]
|
||||
# Minimum image resolution
|
||||
min_resolution = [1, 1]
|
||||
# Maximum MP of images
|
||||
max_mega_pixels = 40
|
||||
# Maximum pixel side of an image
|
||||
max_pixel_side = 10_000
|
||||
|
||||
[files.preview]
|
||||
# Maximum image resolution
|
||||
attachments = [1280, 1280]
|
||||
avatars = [128, 128]
|
||||
backgrounds = [1280, 720]
|
||||
icons = [128, 128]
|
||||
banners = [480, 480]
|
||||
emojis = [128, 128]
|
||||
|
||||
[files.s3]
|
||||
# Configuration for S3
|
||||
# Defaults included for MinIO + self-hosted setup
|
||||
#
|
||||
# Backblaze B2:
|
||||
# - endpoint is listed on the "Buckets" page
|
||||
# - region is `eu-central-003` string from endpoint URL
|
||||
# - access_key_id is keyID generated on the "Application Keys" page
|
||||
# - secret_access_key is token generated on the "Application Keys" page
|
||||
# - default_bucket matches the name of the bucket you've created
|
||||
|
||||
# S3 protocol endpoint
|
||||
endpoint = "http://localhost:14009"
|
||||
endpoint = "http://127.0.0.1:14009"
|
||||
# S3 region name
|
||||
region = "minio"
|
||||
# S3 protocol key ID
|
||||
@@ -140,60 +47,3 @@ access_key_id = "minioautumn"
|
||||
secret_access_key = "minioautumn"
|
||||
# Bucket to upload to by default
|
||||
default_bucket = "revolt-uploads"
|
||||
|
||||
[features]
|
||||
# Feature gate options
|
||||
webhooks_enabled = false
|
||||
|
||||
[features.limits]
|
||||
|
||||
[features.limits.global]
|
||||
group_size = 100
|
||||
message_embeds = 5
|
||||
message_replies = 5
|
||||
message_reactions = 20
|
||||
server_emoji = 100
|
||||
server_roles = 200
|
||||
server_channels = 200
|
||||
|
||||
# How many days since creation a user is considered new
|
||||
new_user_days = 3
|
||||
|
||||
# Maximum permissible body size in bytes for uploads
|
||||
# (should be greater than any one file upload limit)
|
||||
body_limit_size = 20_000_000
|
||||
|
||||
[features.limits.new_user]
|
||||
outgoing_friend_requests = 5
|
||||
|
||||
bots = 2
|
||||
message_length = 2000
|
||||
message_attachments = 5
|
||||
servers = 100
|
||||
|
||||
attachment_size = 20_000_000
|
||||
avatar_size = 4_000_000
|
||||
background_size = 6_000_000
|
||||
icon_size = 2_500_000
|
||||
banner_size = 6_000_000
|
||||
emoji_size = 500_000
|
||||
|
||||
[features.limits.default]
|
||||
outgoing_friend_requests = 10
|
||||
|
||||
bots = 5
|
||||
message_length = 2000
|
||||
message_attachments = 5
|
||||
servers = 100
|
||||
|
||||
attachment_size = 20_000_000
|
||||
avatar_size = 4_000_000
|
||||
background_size = 6_000_000
|
||||
icon_size = 2_500_000
|
||||
banner_size = 6_000_000
|
||||
emoji_size = 500_000
|
||||
|
||||
[sentry]
|
||||
# Configuration for Sentry error reporting
|
||||
api = ""
|
||||
events = ""
|
||||
|
||||
+2
-1
@@ -24,6 +24,7 @@ services:
|
||||
- ./.data/minio:/data
|
||||
ports:
|
||||
- "14009:9000"
|
||||
- "14010:9001"
|
||||
restart: always
|
||||
|
||||
# Create buckets for minio.
|
||||
@@ -46,7 +47,7 @@ services:
|
||||
maildev:
|
||||
image: soulteary/maildev
|
||||
ports:
|
||||
- "14025:8080"
|
||||
- "14025:25"
|
||||
- "14080:8080"
|
||||
environment:
|
||||
MAILDEV_SMTP_PORT: 25
|
||||
|
||||
@@ -9,6 +9,7 @@ description = "Revolt Backend: Configuration"
|
||||
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
|
||||
|
||||
[features]
|
||||
report-macros = ["revolt-result"]
|
||||
test = ["async-std"]
|
||||
default = ["test"]
|
||||
|
||||
@@ -32,3 +33,6 @@ pretty_env_logger = "0.4.0"
|
||||
|
||||
# Sentry
|
||||
sentry = "0.31.5"
|
||||
|
||||
# Core
|
||||
revolt-result = { version = "0.7.16", path = "../result", optional = true }
|
||||
|
||||
@@ -98,8 +98,18 @@ blocked_mime_types = []
|
||||
# ClamAV service
|
||||
# hostname:port
|
||||
clamd_host = ""
|
||||
# Mime types that should be virus scanned
|
||||
#
|
||||
# Leave empty to scan all file types
|
||||
scan_mime_types = [
|
||||
"application/vnd.microsoft.portable-executable",
|
||||
"application/vnd.android.package-archive",
|
||||
"application/zip",
|
||||
]
|
||||
|
||||
[files.limit]
|
||||
# Minimum file size (in bytes)
|
||||
min_file_size = 1
|
||||
# Minimum image resolution
|
||||
min_resolution = [1, 1]
|
||||
# Maximum MP of images
|
||||
@@ -153,44 +163,70 @@ server_emoji = 100
|
||||
server_roles = 200
|
||||
server_channels = 200
|
||||
|
||||
# How many days since creation a user is considered new
|
||||
new_user_days = 3
|
||||
# How many hours since creation a user is considered new
|
||||
new_user_hours = 72
|
||||
|
||||
# Maximum permissible body size in bytes for uploads
|
||||
# (should be greater than any one file upload limit)
|
||||
body_limit_size = 20_000_000
|
||||
|
||||
[features.limits.new_user]
|
||||
# Limits imposed on new users
|
||||
|
||||
# Number of outgoing friend requests permitted at any time
|
||||
outgoing_friend_requests = 5
|
||||
|
||||
# Maximum number of owned bots
|
||||
bots = 2
|
||||
message_length = 2000
|
||||
message_attachments = 5
|
||||
servers = 100
|
||||
|
||||
attachment_size = 20_000_000
|
||||
avatar_size = 4_000_000
|
||||
background_size = 6_000_000
|
||||
icon_size = 2_500_000
|
||||
banner_size = 6_000_000
|
||||
emoji_size = 500_000
|
||||
# Message content length
|
||||
message_length = 2000
|
||||
|
||||
# Number of attachments that can be included
|
||||
message_attachments = 5
|
||||
|
||||
# Maximum number of servers the user can create/join
|
||||
servers = 50
|
||||
|
||||
[features.limits.new_user.file_upload_size_limit]
|
||||
# Maximum file size limits (in bytes)
|
||||
attachments = 20_000_000
|
||||
avatars = 4_000_000
|
||||
backgrounds = 6_000_000
|
||||
icons = 2_500_000
|
||||
banners = 6_000_000
|
||||
emojis = 500_000
|
||||
|
||||
[features.limits.default]
|
||||
# Limits imposed on users by default
|
||||
|
||||
# Number of outgoing friend requests permitted at any time
|
||||
outgoing_friend_requests = 10
|
||||
|
||||
# Maximum number of owned bots
|
||||
bots = 5
|
||||
|
||||
# Message content length
|
||||
message_length = 2000
|
||||
|
||||
# Number of attachments that can be included
|
||||
message_attachments = 5
|
||||
|
||||
# Maximum number of servers the user can create/join
|
||||
servers = 100
|
||||
|
||||
attachment_size = 20_000_000
|
||||
avatar_size = 4_000_000
|
||||
background_size = 6_000_000
|
||||
icon_size = 2_500_000
|
||||
banner_size = 6_000_000
|
||||
emoji_size = 500_000
|
||||
[features.limits.default.file_upload_size_limit]
|
||||
# Maximum file size limits (in bytes)
|
||||
attachments = 20_000_000
|
||||
avatars = 4_000_000
|
||||
backgrounds = 6_000_000
|
||||
icons = 2_500_000
|
||||
banners = 6_000_000
|
||||
emojis = 500_000
|
||||
|
||||
[sentry]
|
||||
# Configuration for Sentry error reporting
|
||||
api = ""
|
||||
events = ""
|
||||
files = ""
|
||||
proxy = ""
|
||||
|
||||
@@ -8,9 +8,41 @@ use serde::Deserialize;
|
||||
|
||||
pub use sentry::capture_error;
|
||||
|
||||
#[cfg(not(debug_assertions))]
|
||||
use std::env;
|
||||
#[cfg(feature = "report-macros")]
|
||||
#[macro_export]
|
||||
macro_rules! report_error {
|
||||
( $expr: expr, $error: ident $( $tt:tt )? ) => {
|
||||
$expr
|
||||
.inspect_err(|err| {
|
||||
$crate::capture_error(err);
|
||||
})
|
||||
.map_err(|_| ::revolt_result::create_error!($error))
|
||||
};
|
||||
}
|
||||
|
||||
#[cfg(feature = "report-macros")]
|
||||
#[macro_export]
|
||||
macro_rules! report_internal_error {
|
||||
( $expr: expr ) => {
|
||||
$expr
|
||||
.inspect_err(|err| {
|
||||
$crate::capture_error(err);
|
||||
})
|
||||
.map_err(|_| ::revolt_result::create_error!(InternalError))
|
||||
};
|
||||
}
|
||||
|
||||
/// Paths to search for configuration
|
||||
static CONFIG_SEARCH_PATHS: [&str; 3] = [
|
||||
// current working directory
|
||||
"Revolt.toml",
|
||||
// current working directory - overrides file
|
||||
"Revolt.overrides.toml",
|
||||
// root directory, for Docker containers
|
||||
"/Revolt.toml",
|
||||
];
|
||||
|
||||
/// Configuration builder
|
||||
static CONFIG_BUILDER: Lazy<RwLock<Config>> = Lazy::new(|| {
|
||||
RwLock::new({
|
||||
let mut builder = Config::builder().add_source(File::from_str(
|
||||
@@ -23,18 +55,18 @@ static CONFIG_BUILDER: Lazy<RwLock<Config>> = Lazy::new(|| {
|
||||
include_str!("../Revolt.test.toml"),
|
||||
FileFormat::Toml,
|
||||
));
|
||||
} else if std::path::Path::new("Revolt.toml").exists() {
|
||||
builder = builder.add_source(File::new("Revolt.toml", FileFormat::Toml));
|
||||
} else if std::path::Path::new("/Revolt.toml").exists() {
|
||||
builder = builder.add_source(File::new("/Revolt.toml", FileFormat::Toml));
|
||||
}
|
||||
|
||||
for path in CONFIG_SEARCH_PATHS {
|
||||
if std::path::Path::new(path).exists() {
|
||||
builder = builder.add_source(File::new(path, FileFormat::Toml));
|
||||
}
|
||||
}
|
||||
|
||||
builder.build().unwrap()
|
||||
})
|
||||
});
|
||||
|
||||
// https://gifbox.me/view/gT5mqxYKCZv-twilight-meow
|
||||
|
||||
#[derive(Deserialize, Debug, Clone)]
|
||||
pub struct Database {
|
||||
pub mongodb: String,
|
||||
@@ -128,6 +160,7 @@ pub struct Api {
|
||||
|
||||
#[derive(Deserialize, Debug, Clone)]
|
||||
pub struct FilesLimit {
|
||||
pub min_file_size: usize,
|
||||
pub min_resolution: [usize; 2],
|
||||
pub max_mega_pixels: usize,
|
||||
pub max_pixel_side: usize,
|
||||
@@ -148,6 +181,7 @@ pub struct Files {
|
||||
pub webp_quality: f32,
|
||||
pub blocked_mime_types: Vec<String>,
|
||||
pub clamd_host: String,
|
||||
pub scan_mime_types: Vec<String>,
|
||||
|
||||
pub limit: FilesLimit,
|
||||
pub preview: HashMap<String, [usize; 2]>,
|
||||
@@ -164,7 +198,7 @@ pub struct GlobalLimits {
|
||||
pub server_roles: usize,
|
||||
pub server_channels: usize,
|
||||
|
||||
pub new_user_days: usize,
|
||||
pub new_user_hours: usize,
|
||||
|
||||
pub body_limit_size: usize,
|
||||
}
|
||||
@@ -178,12 +212,7 @@ pub struct FeaturesLimits {
|
||||
pub message_attachments: usize,
|
||||
pub servers: usize,
|
||||
|
||||
pub attachment_size: usize,
|
||||
pub avatar_size: usize,
|
||||
pub background_size: usize,
|
||||
pub icon_size: usize,
|
||||
pub banner_size: usize,
|
||||
pub emoji_size: usize,
|
||||
pub file_upload_size_limit: HashMap<String, usize>,
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Debug, Clone)]
|
||||
@@ -207,6 +236,8 @@ pub struct Features {
|
||||
pub struct Sentry {
|
||||
pub api: String,
|
||||
pub events: String,
|
||||
pub files: String,
|
||||
pub proxy: String,
|
||||
}
|
||||
|
||||
#[derive(Deserialize, Debug, Clone)]
|
||||
@@ -259,6 +290,12 @@ pub async fn setup_logging(release: &'static str, dsn: String) -> Option<sentry:
|
||||
std::env::set_var("ROCKET_ADDRESS", "0.0.0.0");
|
||||
}
|
||||
|
||||
if std::env::var("REDIS_URL").is_err() {
|
||||
// Configure redis-kiss library
|
||||
let config = config().await;
|
||||
std::env::set_var("REDIS_URI", config.database.redis);
|
||||
}
|
||||
|
||||
pretty_env_logger::init();
|
||||
log::info!("Starting {release}");
|
||||
|
||||
|
||||
@@ -16,6 +16,7 @@ mongodb = ["dep:mongodb", "bson"]
|
||||
tasks = ["isahc", "linkify", "url-escape"]
|
||||
async-std-runtime = ["async-std"]
|
||||
rocket-impl = ["rocket", "schemars", "revolt_okapi", "revolt_rocket_okapi"]
|
||||
axum-impl = ["axum"]
|
||||
redis-is-patched = ["revolt-presence/redis-is-patched"]
|
||||
|
||||
# Default Features
|
||||
@@ -76,6 +77,9 @@ async-recursion = "1.0.4"
|
||||
# Async
|
||||
async-std = { version = "1.8.0", features = ["attributes"], optional = true }
|
||||
|
||||
# Axum Impl
|
||||
axum = { version = "0.7.5", optional = true }
|
||||
|
||||
# Rocket Impl
|
||||
schemars = { version = "0.8.8", optional = true }
|
||||
rocket = { version = "0.5.0-rc.2", default-features = false, features = [
|
||||
|
||||
@@ -16,6 +16,8 @@ extern crate revolt_optional_struct;
|
||||
#[macro_use]
|
||||
extern crate revolt_result;
|
||||
|
||||
pub use iso8601_timestamp;
|
||||
|
||||
#[cfg(feature = "mongodb")]
|
||||
pub use mongodb;
|
||||
|
||||
@@ -91,4 +93,4 @@ pub fn if_false(t: &bool) -> bool {
|
||||
/// Utility function to check if an option doesnt contain true
|
||||
pub fn if_option_false(t: &Option<bool>) -> bool {
|
||||
t != &Some(true)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -56,6 +56,10 @@ pub async fn create_database(db: &MongoDb) {
|
||||
.await
|
||||
.expect("Failed to create attachments collection.");
|
||||
|
||||
db.create_collection("attachment_hashes", None)
|
||||
.await
|
||||
.expect("Failed to create attachment_hashes collection.");
|
||||
|
||||
db.create_collection("user_settings", None)
|
||||
.await
|
||||
.expect("Failed to create user_settings collection.");
|
||||
@@ -209,6 +213,40 @@ pub async fn create_database(db: &MongoDb) {
|
||||
.await
|
||||
.expect("Failed to create server_members index.");
|
||||
|
||||
db.run_command(
|
||||
doc! {
|
||||
"createIndexes": "attachments",
|
||||
"indexes": [
|
||||
{
|
||||
"key": {
|
||||
"hash": 1_i32
|
||||
},
|
||||
"name": "hash"
|
||||
}
|
||||
]
|
||||
},
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.expect("Failed to create attachments index.");
|
||||
|
||||
db.run_command(
|
||||
doc! {
|
||||
"createIndexes": "attachment_hashes",
|
||||
"indexes": [
|
||||
{
|
||||
"key": {
|
||||
"processed_hash": 1_i32
|
||||
},
|
||||
"name": "processed_hash"
|
||||
}
|
||||
]
|
||||
},
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.expect("Failed to create attachment_hashes index.");
|
||||
|
||||
db.collection("migrations")
|
||||
.insert_one(
|
||||
doc! {
|
||||
|
||||
@@ -20,7 +20,7 @@ struct MigrationInfo {
|
||||
revision: i32,
|
||||
}
|
||||
|
||||
pub const LATEST_REVISION: i32 = 28;
|
||||
pub const LATEST_REVISION: i32 = 29;
|
||||
|
||||
pub async fn migrate_database(db: &MongoDb) {
|
||||
let migrations = db.col::<Document>("migrations");
|
||||
@@ -1094,6 +1094,51 @@ pub async fn run_migrations(db: &MongoDb, revision: i32) -> i32 {
|
||||
.expect("Failed to create message index.");
|
||||
}
|
||||
|
||||
if revision <= 28 {
|
||||
info!("Running migration [revision 28 / 10-09-2024]: Add support for new Autumn.");
|
||||
|
||||
db.db()
|
||||
.create_collection("attachment_hashes", None)
|
||||
.await
|
||||
.ok();
|
||||
|
||||
db.db()
|
||||
.run_command(
|
||||
doc! {
|
||||
"createIndexes": "attachments",
|
||||
"indexes": [
|
||||
{
|
||||
"key": {
|
||||
"hash": 1_i32
|
||||
},
|
||||
"name": "hash"
|
||||
}
|
||||
]
|
||||
},
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.expect("Failed to create attachments index.");
|
||||
|
||||
db.db()
|
||||
.run_command(
|
||||
doc! {
|
||||
"createIndexes": "attachment_hashes",
|
||||
"indexes": [
|
||||
{
|
||||
"key": {
|
||||
"processed_hash": 1_i32
|
||||
},
|
||||
"name": "processed_hash"
|
||||
}
|
||||
]
|
||||
},
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.expect("Failed to create attachment_hashes index.");
|
||||
}
|
||||
|
||||
// Need to migrate fields on attachments, change `user_id`, `object_id`, etc to `parent`.
|
||||
|
||||
// Reminder to update LATEST_REVISION when adding new migrations.
|
||||
|
||||
@@ -70,7 +70,7 @@ impl Webhook {
|
||||
if self.token.as_deref() == Some(token) {
|
||||
Ok(())
|
||||
} else {
|
||||
Err(create_error!(InvalidCredentials))
|
||||
Err(create_error!(NotAuthenticated))
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
use iso8601_timestamp::Timestamp;
|
||||
|
||||
use crate::File;
|
||||
|
||||
auto_derived_partial!(
|
||||
/// File hash
|
||||
pub struct FileHash {
|
||||
@@ -51,3 +53,40 @@ auto_derived!(
|
||||
Audio,
|
||||
}
|
||||
);
|
||||
|
||||
impl FileHash {
|
||||
/// Create a file from a file hash
|
||||
pub fn into_file(
|
||||
&self,
|
||||
id: String,
|
||||
tag: String,
|
||||
filename: String,
|
||||
uploader_id: String,
|
||||
) -> File {
|
||||
File {
|
||||
id,
|
||||
tag,
|
||||
filename,
|
||||
hash: Some(self.id.clone()),
|
||||
|
||||
uploaded_at: Some(Timestamp::now_utc()),
|
||||
uploader_id: Some(uploader_id),
|
||||
|
||||
used_for: None,
|
||||
|
||||
deleted: None,
|
||||
reported: None,
|
||||
|
||||
// TODO: remove this data
|
||||
metadata: self.metadata.clone(),
|
||||
content_type: self.content_type.clone(),
|
||||
size: self.size,
|
||||
|
||||
// TODO: superseded by "used_for"
|
||||
message_id: None,
|
||||
object_id: None,
|
||||
server_id: None,
|
||||
user_id: None,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,6 +7,12 @@ mod reference;
|
||||
|
||||
#[async_trait]
|
||||
pub trait AbstractAttachmentHashes: Sync + Send {
|
||||
/// Insert a new attachment hash into the database.
|
||||
async fn insert_attachment_hash(&self, hash: &FileHash) -> Result<()>;
|
||||
|
||||
/// Fetch an attachment hash entry by sha256 hash.
|
||||
async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash>;
|
||||
|
||||
/// Update an attachment hash nonce value.
|
||||
async fn set_attachment_hash_nonce(&self, hash: &str, nonce: &str) -> Result<()>;
|
||||
}
|
||||
|
||||
@@ -9,6 +9,11 @@ static COL: &str = "attachment_hashes";
|
||||
|
||||
#[async_trait]
|
||||
impl AbstractAttachmentHashes for MongoDb {
|
||||
/// Insert a new attachment hash into the database.
|
||||
async fn insert_attachment_hash(&self, hash: &FileHash) -> Result<()> {
|
||||
query!(self, insert_one, COL, &hash).map(|_| ())
|
||||
}
|
||||
|
||||
/// Fetch an attachment hash entry by sha256 hash.
|
||||
async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash> {
|
||||
query!(
|
||||
@@ -16,9 +21,31 @@ impl AbstractAttachmentHashes for MongoDb {
|
||||
find_one,
|
||||
COL,
|
||||
doc! {
|
||||
"_id": hash
|
||||
"$or": [
|
||||
{"_id": hash},
|
||||
{"processed_hash": hash}
|
||||
]
|
||||
}
|
||||
)?
|
||||
.ok_or_else(|| create_error!(NotFound))
|
||||
}
|
||||
|
||||
/// Update an attachment hash nonce value.
|
||||
async fn set_attachment_hash_nonce(&self, hash: &str, nonce: &str) -> Result<()> {
|
||||
self.col::<FileHash>(COL)
|
||||
.update_one(
|
||||
doc! {
|
||||
"_id": hash
|
||||
},
|
||||
doc! {
|
||||
"$set": {
|
||||
"iv": nonce
|
||||
}
|
||||
},
|
||||
None,
|
||||
)
|
||||
.await
|
||||
.map(|_| ())
|
||||
.map_err(|_| create_database_error!("update_one", COL))
|
||||
}
|
||||
}
|
||||
|
||||
@@ -7,15 +7,33 @@ use super::AbstractAttachmentHashes;
|
||||
|
||||
#[async_trait]
|
||||
impl AbstractAttachmentHashes for ReferenceDb {
|
||||
/// Insert a new attachment hash into the database.
|
||||
async fn insert_attachment_hash(&self, hash: &FileHash) -> Result<()> {
|
||||
let mut hashes = self.file_hashes.lock().await;
|
||||
if hashes.contains_key(&hash.id) {
|
||||
Err(create_database_error!("insert", "attachment"))
|
||||
} else {
|
||||
hashes.insert(hash.id.to_string(), hash.clone());
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
/// Fetch an attachment hash entry by sha256 hash.
|
||||
async fn fetch_attachment_hash(&self, hash: &str) -> Result<FileHash> {
|
||||
async fn fetch_attachment_hash(&self, hash_value: &str) -> Result<FileHash> {
|
||||
let hashes = self.file_hashes.lock().await;
|
||||
if let Some(file) = hashes.get(hash) {
|
||||
if file.id == hash {
|
||||
Ok(file.clone())
|
||||
} else {
|
||||
Err(create_error!(NotFound))
|
||||
}
|
||||
hashes
|
||||
.values()
|
||||
.cloned()
|
||||
.find(|hash| hash.id == hash_value || hash.processed_hash == hash_value)
|
||||
.ok_or(create_error!(NotFound))
|
||||
}
|
||||
|
||||
/// Update an attachment hash nonce value.
|
||||
async fn set_attachment_hash_nonce(&self, hash: &str, nonce: &str) -> Result<()> {
|
||||
let mut hashes = self.file_hashes.lock().await;
|
||||
if let Some(file) = hashes.get_mut(hash) {
|
||||
file.iv = nonce.to_owned();
|
||||
Ok(())
|
||||
} else {
|
||||
Err(create_error!(NotFound))
|
||||
}
|
||||
|
||||
@@ -19,7 +19,7 @@ auto_derived_partial!(
|
||||
/// When this file was uploaded
|
||||
pub uploaded_at: Option<Timestamp>, // these are Option<>s to not break file uploads on legacy Autumn
|
||||
/// ID of user who uploaded this file
|
||||
pub uploaded_id: Option<String>, // these are Option<>s to not break file uploads on legacy Autumn
|
||||
pub uploader_id: Option<String>, // these are Option<>s to not break file uploads on legacy Autumn
|
||||
|
||||
/// What the file was used for
|
||||
pub used_for: Option<FileUsedFor>,
|
||||
@@ -59,15 +59,14 @@ auto_derived_partial!(
|
||||
auto_derived!(
|
||||
/// Type of object file was used for
|
||||
pub enum FileUsedForType {
|
||||
// TODO: changing this requires a db migration
|
||||
message,
|
||||
serverBanner,
|
||||
emoji,
|
||||
userAvatar,
|
||||
userProfileBackground,
|
||||
legacyGroupIcon,
|
||||
channelIcon,
|
||||
serverIcon,
|
||||
Message,
|
||||
ServerBanner,
|
||||
Emoji,
|
||||
UserAvatar,
|
||||
UserProfileBackground,
|
||||
LegacyGroupIcon,
|
||||
ChannelIcon,
|
||||
ServerIcon,
|
||||
}
|
||||
|
||||
/// Information about what the file was used for
|
||||
|
||||
@@ -0,0 +1,24 @@
|
||||
use axum::{extract::FromRequestParts, http::request::Parts};
|
||||
|
||||
use revolt_result::{create_error, Error, Result};
|
||||
|
||||
use crate::{Database, User};
|
||||
|
||||
#[async_trait::async_trait]
|
||||
impl FromRequestParts<Database> for User {
|
||||
type Rejection = Error;
|
||||
|
||||
async fn from_request_parts(parts: &mut Parts, db: &Database) -> Result<User> {
|
||||
if let Some(Ok(bot_token)) = parts.headers.get("x-bot-token").map(|v| v.to_str()) {
|
||||
let bot = db.fetch_bot_by_token(bot_token).await?;
|
||||
db.fetch_user(&bot.id).await
|
||||
} else if let Some(Ok(session_token)) =
|
||||
parts.headers.get("x-session-token").map(|v| v.to_str())
|
||||
{
|
||||
let session = db.fetch_session_by_token(session_token).await?;
|
||||
db.fetch_user(&session.user_id).await
|
||||
} else {
|
||||
Err(create_error!(NotAuthenticated))
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,3 +1,5 @@
|
||||
#[cfg(feature = "axum-impl")]
|
||||
mod axum;
|
||||
mod model;
|
||||
mod ops;
|
||||
#[cfg(feature = "rocket-impl")]
|
||||
@@ -5,6 +7,8 @@ mod rocket;
|
||||
#[cfg(feature = "rocket-impl")]
|
||||
mod schema;
|
||||
|
||||
#[cfg(feature = "axum-impl")]
|
||||
pub use self::axum::*;
|
||||
#[cfg(feature = "rocket-impl")]
|
||||
pub use self::rocket::*;
|
||||
#[cfg(feature = "rocket-impl")]
|
||||
|
||||
@@ -218,7 +218,7 @@ impl User {
|
||||
.datetime()
|
||||
.elapsed()
|
||||
.expect("time went backwards")
|
||||
<= Duration::from_secs(86400u64 * config.features.limits.global.new_user_days as u64)
|
||||
<= Duration::from_secs(3600u64 * config.features.limits.global.new_user_hours as u64)
|
||||
{
|
||||
config.features.limits.new_user
|
||||
} else {
|
||||
|
||||
@@ -421,7 +421,7 @@ impl From<File> for crate::File {
|
||||
object_id: value.object_id,
|
||||
hash: None,
|
||||
uploaded_at: None,
|
||||
uploaded_id: None,
|
||||
uploader_id: None,
|
||||
used_for: None,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -14,5 +14,7 @@ typenum = "1.17.0"
|
||||
aws-config = "1.5.5"
|
||||
aws-sdk-s3 = { version = "1.46.0", features = ["behavior-version-latest"] }
|
||||
|
||||
revolt-config = { version = "0.7.16", path = "../config" }
|
||||
revolt-config = { version = "0.7.16", path = "../config", features = [
|
||||
"report-macros",
|
||||
] }
|
||||
revolt-result = { version = "0.7.16", path = "../result" }
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
use std::io::Write;
|
||||
|
||||
use aes_gcm::{aead::AeadMutInPlace, Aes256Gcm, Key, KeyInit, Nonce};
|
||||
use revolt_config::{config, FilesS3};
|
||||
use aes_gcm::{
|
||||
aead::{AeadCore, AeadMutInPlace, OsRng},
|
||||
Aes256Gcm, Key, KeyInit, Nonce,
|
||||
};
|
||||
use revolt_config::{config, report_internal_error, FilesS3};
|
||||
use revolt_result::{create_error, Result};
|
||||
|
||||
use aws_sdk_s3::{
|
||||
@@ -11,7 +14,8 @@ use aws_sdk_s3::{
|
||||
|
||||
use base64::prelude::*;
|
||||
|
||||
pub static AUTHENTICATION_TAG_SIZE_BYTES: usize = 16;
|
||||
/// Size of the authentication tag in the buffer
|
||||
pub const AUTHENTICATION_TAG_SIZE_BYTES: usize = 16;
|
||||
|
||||
/// Create an S3 client
|
||||
pub fn create_client(s3_config: FilesS3) -> Client {
|
||||
@@ -35,7 +39,7 @@ pub fn create_client(s3_config: FilesS3) -> Client {
|
||||
|
||||
/// Create an AES-256-GCM cipher
|
||||
pub fn create_cipher(key: &str) -> Aes256Gcm {
|
||||
let key = &BASE64_STANDARD.decode(key).unwrap()[..];
|
||||
let key = &BASE64_STANDARD.decode(key).expect("valid base64 string")[..];
|
||||
let key: &Key<Aes256Gcm> = key.into();
|
||||
Aes256Gcm::new(key)
|
||||
}
|
||||
@@ -46,23 +50,14 @@ pub async fn fetch_from_s3(bucket_id: &str, path: &str, nonce: &str) -> Result<V
|
||||
let client = create_client(config.files.s3);
|
||||
|
||||
// Send a request for the file
|
||||
let mut obj = client
|
||||
.get_object()
|
||||
.bucket(bucket_id)
|
||||
.key(path)
|
||||
.send()
|
||||
.await
|
||||
.inspect_err(|err| {
|
||||
revolt_config::capture_error(err);
|
||||
})
|
||||
.map_err(|_| create_error!(InternalError))?;
|
||||
let mut obj =
|
||||
report_internal_error!(client.get_object().bucket(bucket_id).key(path).send().await)?;
|
||||
|
||||
// Read the file from remote
|
||||
let mut buf = vec![];
|
||||
while let Some(bytes) = obj.body.next().await {
|
||||
let data = bytes.map_err(|_| create_error!(InternalError))?;
|
||||
buf.write_all(&data)
|
||||
.map_err(|_| create_error!(InternalError))?;
|
||||
let data = report_internal_error!(bytes)?;
|
||||
report_internal_error!(buf.write_all(&data))?;
|
||||
// is there a more efficient way to do this?
|
||||
// we just want the Vec<u8>
|
||||
}
|
||||
@@ -78,3 +73,33 @@ pub async fn fetch_from_s3(bucket_id: &str, path: &str, nonce: &str) -> Result<V
|
||||
|
||||
Ok(buf)
|
||||
}
|
||||
|
||||
/// Encrypt and upload a file to S3 (returning its nonce/IV)
|
||||
pub async fn upload_to_s3(bucket_id: &str, path: &str, buf: &[u8]) -> Result<String> {
|
||||
let config = config().await;
|
||||
let client = create_client(config.files.s3);
|
||||
|
||||
// Generate a nonce
|
||||
let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
|
||||
|
||||
// Extend the buffer for in-place encryption
|
||||
let mut buf = [buf, &[0; AUTHENTICATION_TAG_SIZE_BYTES]].concat();
|
||||
|
||||
// Encrypt the file in place
|
||||
create_cipher(&config.files.encryption_key)
|
||||
.encrypt_in_place(&nonce, b"", &mut buf)
|
||||
.map_err(|_| create_error!(InternalError))?;
|
||||
|
||||
// Upload the file to remote
|
||||
report_internal_error!(
|
||||
client
|
||||
.put_object()
|
||||
.bucket(bucket_id)
|
||||
.key(path)
|
||||
.body(buf.into())
|
||||
.send()
|
||||
.await
|
||||
)?;
|
||||
|
||||
Ok(BASE64_STANDARD.encode(nonce))
|
||||
}
|
||||
|
||||
@@ -67,6 +67,7 @@ impl IntoResponse for Error {
|
||||
ErrorType::InvalidCredentials => StatusCode::UNAUTHORIZED,
|
||||
ErrorType::InvalidProperty => StatusCode::BAD_REQUEST,
|
||||
ErrorType::InvalidSession => StatusCode::UNAUTHORIZED,
|
||||
ErrorType::NotAuthenticated => StatusCode::UNAUTHORIZED,
|
||||
ErrorType::DuplicateNonce => StatusCode::CONFLICT,
|
||||
ErrorType::VosoUnavailable => StatusCode::BAD_REQUEST,
|
||||
ErrorType::NotFound => StatusCode::NOT_FOUND,
|
||||
@@ -74,6 +75,9 @@ impl IntoResponse for Error {
|
||||
ErrorType::FailedValidation { .. } => StatusCode::BAD_REQUEST,
|
||||
|
||||
ErrorType::ProxyError => StatusCode::BAD_REQUEST,
|
||||
ErrorType::FileTooSmall => StatusCode::UNPROCESSABLE_ENTITY,
|
||||
ErrorType::FileTooLarge { .. } => StatusCode::UNPROCESSABLE_ENTITY,
|
||||
ErrorType::FileTypeNotAllowed => StatusCode::BAD_REQUEST,
|
||||
};
|
||||
|
||||
(status, Json(&self)).into_response()
|
||||
|
||||
@@ -147,6 +147,7 @@ pub enum ErrorType {
|
||||
InvalidCredentials,
|
||||
InvalidProperty,
|
||||
InvalidSession,
|
||||
NotAuthenticated,
|
||||
DuplicateNonce,
|
||||
NotFound,
|
||||
NoEffect,
|
||||
@@ -156,6 +157,11 @@ pub enum ErrorType {
|
||||
|
||||
// ? Micro-service errors
|
||||
ProxyError,
|
||||
FileTooSmall,
|
||||
FileTooLarge {
|
||||
max: usize,
|
||||
},
|
||||
FileTypeNotAllowed,
|
||||
|
||||
// ? Legacy errors
|
||||
VosoUnavailable,
|
||||
|
||||
@@ -73,6 +73,7 @@ impl<'r> Responder<'r, 'static> for Error {
|
||||
ErrorType::InvalidCredentials => Status::Unauthorized,
|
||||
ErrorType::InvalidProperty => Status::BadRequest,
|
||||
ErrorType::InvalidSession => Status::Unauthorized,
|
||||
ErrorType::NotAuthenticated => Status::Unauthorized,
|
||||
ErrorType::DuplicateNonce => Status::Conflict,
|
||||
ErrorType::VosoUnavailable => Status::BadRequest,
|
||||
ErrorType::NotFound => Status::NotFound,
|
||||
@@ -80,6 +81,9 @@ impl<'r> Responder<'r, 'static> for Error {
|
||||
ErrorType::FailedValidation { .. } => Status::BadRequest,
|
||||
|
||||
ErrorType::ProxyError => Status::BadRequest,
|
||||
ErrorType::FileTooSmall => Status::UnprocessableEntity,
|
||||
ErrorType::FileTooLarge { .. } => Status::UnprocessableEntity,
|
||||
ErrorType::FileTypeNotAllowed => Status::BadRequest,
|
||||
};
|
||||
|
||||
// Serialize the error data structure into JSON.
|
||||
|
||||
@@ -4,14 +4,21 @@ version = "0.7.14"
|
||||
edition = "2021"
|
||||
|
||||
[dependencies]
|
||||
# ID generation
|
||||
ulid = "1.1.3"
|
||||
nanoid = "0.4.0"
|
||||
|
||||
# Media processing
|
||||
webp = "0.3.0"
|
||||
sha2 = "0.10.8"
|
||||
jxl-oxide = "0.8.1"
|
||||
kamadak-exif = "0.5.4"
|
||||
# revolt_little_exif = "0.4.0"
|
||||
image = { version = "0.25.2" } # avif encode requires dav1d system library: features = ["avif-native"]
|
||||
|
||||
# File processing
|
||||
revolt_clamav-client = { version = "0.1.5" }
|
||||
simdutf8 = { version = "0.1.4", features = ["aarch64_neon"] }
|
||||
image = { version = "0.25.2" } # requires dav1d system library: features = ["avif-native"]
|
||||
|
||||
# Content type processing
|
||||
infer = "0.16.0"
|
||||
@@ -37,7 +44,9 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
||||
# Core crates
|
||||
revolt-files = { version = "0.7.16", path = "../../core/files" }
|
||||
revolt-config = { version = "0.7.16", path = "../../core/config" }
|
||||
revolt-database = { version = "0.7.16", path = "../../core/database" }
|
||||
revolt-database = { version = "0.7.16", path = "../../core/database", features = [
|
||||
"axum-impl",
|
||||
] }
|
||||
revolt-result = { version = "0.7.16", path = "../../core/result", features = [
|
||||
"utoipa",
|
||||
"axum",
|
||||
@@ -48,6 +57,7 @@ tempfile = "3.12.0"
|
||||
axum-macros = "0.4.1"
|
||||
axum_typed_multipart = "0.12.1"
|
||||
axum = { version = "0.7.5", features = ["multipart"] }
|
||||
tower-http = { version = "0.5.2", features = ["cors"] }
|
||||
|
||||
# OpenAPI & documentation generation
|
||||
utoipa-scalar = { version = "0.1.0", features = ["axum"] }
|
||||
|
||||
@@ -1 +1,12 @@
|
||||
# TODO: https://github.com/wader/static-ffmpeg
|
||||
# Build Stage
|
||||
FROM ghcr.io/revoltchat/base:latest AS builder
|
||||
|
||||
# Bundle Stage
|
||||
FROM gcr.io/distroless/cc-debian12:nonroot
|
||||
COPY --from=builder /home/rust/src/target/release/revolt-autumn ./
|
||||
COPY --from=mwader/static-ffmpeg:7.0.2 /ffmpeg /usr/local/bin/
|
||||
COPY --from=mwader/static-ffmpeg:7.0.2 /ffprobe /usr/local/bin/
|
||||
|
||||
EXPOSE 14704
|
||||
USER nonroot
|
||||
CMD ["./revolt-autumn"]
|
||||
|
||||
@@ -5,7 +5,7 @@ use std::{
|
||||
|
||||
use axum::{
|
||||
extract::{DefaultBodyLimit, Path, State},
|
||||
http::header,
|
||||
http::{header, Method},
|
||||
response::{IntoResponse, Redirect, Response},
|
||||
routing::{get, post},
|
||||
Json, Router,
|
||||
@@ -13,14 +13,15 @@ use axum::{
|
||||
use axum_typed_multipart::{FieldData, TryFromMultipart, TypedMultipart};
|
||||
use image::ImageReader;
|
||||
use lazy_static::lazy_static;
|
||||
use revolt_config::config;
|
||||
use revolt_database::{Database, FileHash, Metadata};
|
||||
use revolt_files::{fetch_from_s3, AUTHENTICATION_TAG_SIZE_BYTES};
|
||||
use revolt_config::{config, report_internal_error};
|
||||
use revolt_database::{iso8601_timestamp::Timestamp, Database, FileHash, Metadata, User};
|
||||
use revolt_files::{fetch_from_s3, upload_to_s3, AUTHENTICATION_TAG_SIZE_BYTES};
|
||||
use revolt_result::{create_error, Result};
|
||||
use serde::{Deserialize, Serialize};
|
||||
use sha2::Digest;
|
||||
use tempfile::NamedTempFile;
|
||||
use tokio::time::Instant;
|
||||
use tower_http::cors::{AllowHeaders, Any, CorsLayer};
|
||||
use utoipa::ToSchema;
|
||||
|
||||
use crate::{exif::strip_metadata, metadata::generate_metadata, mime_type::determine_mime_type};
|
||||
@@ -29,16 +30,24 @@ use crate::{exif::strip_metadata, metadata::generate_metadata, mime_type::determ
|
||||
pub async fn router() -> Router<Database> {
|
||||
let config = config().await;
|
||||
|
||||
let cors = CorsLayer::new()
|
||||
.allow_methods([Method::POST])
|
||||
.allow_headers(AllowHeaders::mirror_request())
|
||||
.allow_origin(Any);
|
||||
|
||||
Router::new()
|
||||
.route("/", get(root))
|
||||
.route(
|
||||
"/:tag",
|
||||
post(upload_file).layer(DefaultBodyLimit::max(
|
||||
config.features.limits.global.body_limit_size,
|
||||
)),
|
||||
post(upload_file)
|
||||
.options(options)
|
||||
.layer(DefaultBodyLimit::max(
|
||||
config.features.limits.global.body_limit_size,
|
||||
)),
|
||||
)
|
||||
.route("/:tag/:file_id", get(fetch_preview))
|
||||
.route("/:tag/:file_id/:file_name", get(fetch_file))
|
||||
.layer(cors)
|
||||
}
|
||||
|
||||
lazy_static! {
|
||||
@@ -86,8 +95,11 @@ async fn root() -> Json<RootResponse> {
|
||||
})
|
||||
}
|
||||
|
||||
/// Empty handler for OPTIONS routes
|
||||
async fn options() {}
|
||||
|
||||
/// Available tags to upload to
|
||||
#[derive(Deserialize, Debug, ToSchema, strum_macros::IntoStaticStr)]
|
||||
#[derive(Clone, Deserialize, Debug, ToSchema, strum_macros::IntoStaticStr)]
|
||||
#[allow(non_camel_case_types)]
|
||||
pub enum Tag {
|
||||
attachments,
|
||||
@@ -111,7 +123,7 @@ pub struct UploadPayload {
|
||||
#[derive(Serialize, Debug, ToSchema)]
|
||||
pub struct UploadResponse {
|
||||
/// ID to attach uploaded file to object
|
||||
id: &'static str,
|
||||
id: String,
|
||||
}
|
||||
|
||||
/// Upload a file
|
||||
@@ -136,29 +148,48 @@ pub struct UploadResponse {
|
||||
("tag" = Tag, Path, description = "Tag to upload to (e.g. attachments, icons, ...)")
|
||||
),
|
||||
request_body(content_type = "multipart/form-data", content = UploadPayload),
|
||||
security(
|
||||
("session_token" = []),
|
||||
("bot_token" = [])
|
||||
)
|
||||
)]
|
||||
async fn upload_file(
|
||||
State(db): State<Database>,
|
||||
user: User,
|
||||
Path(tag): Path<Tag>,
|
||||
TypedMultipart(UploadPayload { mut file }): TypedMultipart<UploadPayload>,
|
||||
) -> axum::response::Result<Json<UploadResponse>> {
|
||||
) -> Result<Json<UploadResponse>> {
|
||||
// Fetch configuration
|
||||
let config = config().await;
|
||||
|
||||
// Keep track of processing time
|
||||
let now = Instant::now();
|
||||
|
||||
// TODO: authenticate the user
|
||||
|
||||
// Extract the filename, or give it a generic name
|
||||
let file_name = file.metadata.file_name.unwrap_or("unnamed-file".to_owned());
|
||||
let filename = file.metadata.file_name.unwrap_or("unnamed-file".to_owned());
|
||||
|
||||
// Load file to memory
|
||||
let mut buf = Vec::<u8>::new();
|
||||
file.contents
|
||||
.read_to_end(&mut buf)
|
||||
.map_err(|_| create_error!(InternalError))?;
|
||||
report_internal_error!(file.contents.read_to_end(&mut buf))?;
|
||||
|
||||
// Take note of original file size
|
||||
let original_file_size = buf.len();
|
||||
|
||||
// TODO: check against tag
|
||||
// Ensure the file is not empty
|
||||
if original_file_size < config.files.limit.min_file_size {
|
||||
return Err(create_error!(FileTooSmall));
|
||||
}
|
||||
|
||||
// Get user's file upload limits
|
||||
let limits = user.limits().await;
|
||||
let size_limit = *limits
|
||||
.file_upload_size_limit
|
||||
.get(tag.clone().into())
|
||||
.expect("size limit");
|
||||
|
||||
if original_file_size > size_limit {
|
||||
return Err(create_error!(FileTooLarge { max: size_limit }));
|
||||
}
|
||||
|
||||
// Generate sha256 hash
|
||||
let original_hash = {
|
||||
@@ -167,13 +198,37 @@ async fn upload_file(
|
||||
hasher.finalize()
|
||||
};
|
||||
|
||||
// TODO: find existing `hash` (or match `processed`) and use that if possible
|
||||
// then: create attachment and return UploadResponse { id }
|
||||
// Generate an ID for this file
|
||||
let id = if matches!(tag, Tag::emojis) {
|
||||
ulid::Ulid::new().to_string()
|
||||
} else {
|
||||
nanoid::nanoid!(42)
|
||||
};
|
||||
|
||||
// Find an existing hash and use that if possible
|
||||
if let Ok(file_hash) = db
|
||||
.fetch_attachment_hash(&format!("{original_hash:02x}"))
|
||||
.await
|
||||
{
|
||||
let tag: &'static str = tag.into();
|
||||
db.insert_attachment(&file_hash.into_file(id.clone(), tag.to_owned(), filename, user.id))
|
||||
.await?;
|
||||
|
||||
return Ok(Json(UploadResponse { id }));
|
||||
}
|
||||
|
||||
// Determine the mime type for the file
|
||||
let mime_type = determine_mime_type(&mut file.contents, &buf, &file_name);
|
||||
let mime_type = determine_mime_type(&mut file.contents, &buf, &filename);
|
||||
|
||||
// TODO: block mime types here
|
||||
// Check blocklist for mime type
|
||||
if config
|
||||
.files
|
||||
.blocked_mime_types
|
||||
.iter()
|
||||
.any(|m| m == mime_type)
|
||||
{
|
||||
return Err(create_error!(FileTypeNotAllowed));
|
||||
}
|
||||
|
||||
// Determine metadata for the file
|
||||
let metadata = generate_metadata(&file.contents, mime_type);
|
||||
@@ -181,7 +236,14 @@ async fn upload_file(
|
||||
// Strip metadata
|
||||
let (buf, metadata) = strip_metadata(file.contents, buf, metadata, mime_type).await?;
|
||||
|
||||
// TODO: Virus scan Metadata::File
|
||||
// Virus scan files if ClamAV is configured
|
||||
if matches!(metadata, Metadata::File)
|
||||
&& (config.files.scan_mime_types.is_empty()
|
||||
|| config.files.scan_mime_types.iter().any(|v| v == mime_type))
|
||||
&& crate::clamav::is_malware(&buf).await?
|
||||
{
|
||||
return Err(create_error!(InternalError));
|
||||
}
|
||||
|
||||
// Print file information for debug purposes
|
||||
let new_file_size = buf.len() + AUTHENTICATION_TAG_SIZE_BYTES;
|
||||
@@ -193,15 +255,41 @@ async fn upload_file(
|
||||
let process_ratio = new_file_size as f32 / original_file_size as f32;
|
||||
let time_to_process = Instant::now() - now;
|
||||
|
||||
tracing::info!("Received file {file_name}\nOriginal hash: {original_hash:02X}\nOriginal size: {original_file_size} bytes\nMime type: {mime_type}\nMetadata: {metadata:?}\nProcessed file size: {new_file_size} bytes ({:.2}%).\nProcessed hash: {processed_hash:02X}\nProcessing took {time_to_process:?}", process_ratio * 100.0);
|
||||
tracing::info!("Received file {filename}\nOriginal hash: {original_hash:02x}\nOriginal size: {original_file_size} bytes\nMime type: {mime_type}\nMetadata: {metadata:?}\nProcessed file size: {new_file_size} bytes ({:.2}%).\nProcessed hash: {processed_hash:02x}\nProcessing took {time_to_process:?}", process_ratio * 100.0);
|
||||
|
||||
// TODO: encrypt the file and generate FileHash
|
||||
// note: file_size is processed file's size (incl. authTag in encrypted buffer)
|
||||
// TODO: insert FileHash
|
||||
// TODO: upload to S3
|
||||
// TODO: create attachment
|
||||
// Create hash entry in database
|
||||
let file_hash = FileHash {
|
||||
id: format!("{original_hash:02x}"),
|
||||
processed_hash: format!("{processed_hash:02x}"),
|
||||
|
||||
Ok(Json(UploadResponse { id: "aaa" }))
|
||||
created_at: Timestamp::now_utc(),
|
||||
|
||||
bucket_id: config.files.s3.default_bucket,
|
||||
path: format!("{original_hash:02x}"),
|
||||
iv: String::new(), // indicates file is not uploaded yet
|
||||
|
||||
metadata,
|
||||
content_type: mime_type.to_owned(),
|
||||
size: new_file_size as isize,
|
||||
};
|
||||
|
||||
db.insert_attachment_hash(&file_hash).await?;
|
||||
|
||||
// Upload the file to S3 and commit nonce to database
|
||||
let upload_start = Instant::now();
|
||||
let nonce = upload_to_s3(&file_hash.bucket_id, &file_hash.id, &buf).await?;
|
||||
db.set_attachment_hash_nonce(&file_hash.id, &nonce).await?;
|
||||
|
||||
// Debug information
|
||||
let time_to_upload = Instant::now() - upload_start;
|
||||
tracing::info!("Took {time_to_upload:?} to upload {new_file_size} bytes to S3.");
|
||||
|
||||
// Finally, create the file and return its ID
|
||||
let tag: &'static str = tag.into();
|
||||
db.insert_attachment(&file_hash.into_file(id.clone(), tag.to_owned(), filename, user.id))
|
||||
.await?;
|
||||
|
||||
Ok(Json(UploadResponse { id }))
|
||||
}
|
||||
|
||||
/// Header value used for cache control
|
||||
@@ -270,16 +358,16 @@ async fn fetch_preview(
|
||||
|
||||
// Read the image and resize it
|
||||
// TODO: use jxl_oxide to process image/jxl files
|
||||
let image = ImageReader::new(Cursor::new(data))
|
||||
.with_guessed_format()
|
||||
.map_err(|_| create_error!(InternalError))?
|
||||
.decode()
|
||||
.map_err(|_| create_error!(InternalError))?
|
||||
//.resize(width as u32, height as u32, image::imageops::FilterType::Gaussian)
|
||||
// resize is about 2.5x slower,
|
||||
// thumbnail doesn't have terrible quality
|
||||
// so we use thumbnail
|
||||
.thumbnail(*w as u32, *h as u32);
|
||||
let image = report_internal_error!(report_internal_error!(ImageReader::new(Cursor::new(
|
||||
data
|
||||
))
|
||||
.with_guessed_format())?
|
||||
.decode())?
|
||||
//.resize(width as u32, height as u32, image::imageops::FilterType::Gaussian)
|
||||
// resize is about 2.5x slower,
|
||||
// thumbnail doesn't have terrible quality
|
||||
// so we use thumbnail
|
||||
.thumbnail(*w as u32, *h as u32);
|
||||
|
||||
// Encode it into WEBP
|
||||
let encoder = webp::Encoder::from_image(&image).expect("Could not create encoder.");
|
||||
|
||||
@@ -0,0 +1,49 @@
|
||||
use std::time::Duration;
|
||||
|
||||
use revolt_config::{config, report_internal_error};
|
||||
use revolt_result::Result;
|
||||
|
||||
/// Initialise ClamAV
|
||||
pub async fn init() {
|
||||
let config = config().await;
|
||||
|
||||
if !config.files.clamd_host.is_empty() {
|
||||
tracing::info!("Waiting for clamd to be ready...");
|
||||
|
||||
loop {
|
||||
let clamd_available =
|
||||
match revolt_clamav_client::ping_tcp(config.files.clamd_host.clone()) {
|
||||
Ok(ping_response) => ping_response == b"PONG\0",
|
||||
Err(_) => false,
|
||||
};
|
||||
|
||||
if clamd_available {
|
||||
tracing::info!("clamd is ready, virus protection enabled!");
|
||||
break;
|
||||
} else {
|
||||
tracing::error!(
|
||||
"Could not ping clamd host at {}, retrying in 10 seconds...",
|
||||
config.files.clamd_host
|
||||
);
|
||||
|
||||
std::thread::sleep(Duration::from_secs(10));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Scan for malware
|
||||
pub async fn is_malware(buf: &[u8]) -> Result<bool> {
|
||||
let config = config().await;
|
||||
if config.files.clamd_host.is_empty() {
|
||||
Ok(false)
|
||||
} else {
|
||||
let scan_response = report_internal_error!(revolt_clamav_client::scan_buffer_tcp(
|
||||
buf,
|
||||
config.files.clamd_host,
|
||||
None
|
||||
))?;
|
||||
|
||||
report_internal_error!(revolt_clamav_client::clean(&scan_response)).map(|v| !v)
|
||||
}
|
||||
}
|
||||
@@ -2,6 +2,7 @@ use std::io::{Cursor, Read};
|
||||
|
||||
use exif::Reader;
|
||||
use image::{ImageFormat, ImageReader};
|
||||
use revolt_config::report_internal_error;
|
||||
use revolt_database::Metadata;
|
||||
use revolt_result::{create_error, Result};
|
||||
use tempfile::NamedTempFile;
|
||||
@@ -39,11 +40,11 @@ pub async fn strip_metadata(
|
||||
let mut cursor = Cursor::new(buf);
|
||||
|
||||
// Decode the image
|
||||
let image = ImageReader::new(&mut cursor)
|
||||
.with_guessed_format()
|
||||
.map_err(|_| create_error!(InternalError))?
|
||||
.decode()
|
||||
.map_err(|_| create_error!(InternalError));
|
||||
let image = report_internal_error!(report_internal_error!(ImageReader::new(
|
||||
&mut cursor
|
||||
)
|
||||
.with_guessed_format())?
|
||||
.decode());
|
||||
|
||||
// Reset read position
|
||||
cursor.set_position(0);
|
||||
@@ -64,7 +65,7 @@ pub async fn strip_metadata(
|
||||
|
||||
// Apply the EXIF rotation
|
||||
// See https://jdhao.github.io/2019/07/31/image_rotation_exif_info/
|
||||
match &rotation {
|
||||
report_internal_error!(match &rotation {
|
||||
2 => image?.fliph(),
|
||||
3 => image?.rotate180(),
|
||||
4 => image?.rotate180().fliph(),
|
||||
@@ -83,8 +84,7 @@ pub async fn strip_metadata(
|
||||
"image/tiff" => ImageFormat::Tiff,
|
||||
_ => todo!(),
|
||||
},
|
||||
)
|
||||
.map_err(|_| create_error!(InternalError))?;
|
||||
))?;
|
||||
|
||||
// Calculate dimensions after rotation.
|
||||
let (width, height) = match &rotation {
|
||||
@@ -112,47 +112,44 @@ pub async fn strip_metadata(
|
||||
};
|
||||
|
||||
// Temporary output file
|
||||
let mut out_file =
|
||||
NamedTempFile::new().map_err(|_| create_error!(InternalError))?;
|
||||
let mut out_file = report_internal_error!(NamedTempFile::new())?;
|
||||
|
||||
// Process the file with ffmpeg
|
||||
Command::new("ffmpeg")
|
||||
.args([
|
||||
// Overwrite the temporary file
|
||||
"-y",
|
||||
// Read original uploaded file
|
||||
"-i",
|
||||
file.path().to_str().ok_or(create_error!(InternalError))?,
|
||||
// Strip any metadata
|
||||
"-map_metadata",
|
||||
"-1",
|
||||
// Copy video / audio data to new file
|
||||
"-c:v",
|
||||
"copy",
|
||||
"-c:a",
|
||||
"copy",
|
||||
// Select correct file format
|
||||
"-f",
|
||||
ext,
|
||||
// Save to new temporary file
|
||||
out_file
|
||||
.path()
|
||||
.to_str()
|
||||
.ok_or(create_error!(InternalError))?,
|
||||
])
|
||||
.output()
|
||||
.await
|
||||
.inspect_err(|err| tracing::error!("{err:?}"))
|
||||
.map_err(|_| create_error!(InternalError))?;
|
||||
report_internal_error!(
|
||||
Command::new("ffmpeg")
|
||||
.args([
|
||||
// Overwrite the temporary file
|
||||
"-y",
|
||||
// Read original uploaded file
|
||||
"-i",
|
||||
file.path().to_str().ok_or(create_error!(InternalError))?,
|
||||
// Strip any metadata
|
||||
"-map_metadata",
|
||||
"-1",
|
||||
// Copy video / audio data to new file
|
||||
"-c:v",
|
||||
"copy",
|
||||
"-c:a",
|
||||
"copy",
|
||||
// Select correct file format
|
||||
"-f",
|
||||
ext,
|
||||
// Save to new temporary file
|
||||
out_file
|
||||
.path()
|
||||
.to_str()
|
||||
.ok_or(create_error!(InternalError))?,
|
||||
])
|
||||
.output()
|
||||
.await
|
||||
)?;
|
||||
|
||||
// Probe the file again
|
||||
let metadata = crate::metadata::generate_metadata(&out_file, mime);
|
||||
|
||||
// Read the file from disk
|
||||
let mut buf = Vec::<u8>::new();
|
||||
out_file
|
||||
.read_to_end(&mut buf)
|
||||
.map_err(|_| create_error!(InternalError))?;
|
||||
report_internal_error!(out_file.read_to_end(&mut buf))?;
|
||||
|
||||
Ok((buf, metadata))
|
||||
}
|
||||
|
||||
@@ -11,6 +11,7 @@ use utoipa::{
|
||||
use utoipa_scalar::{Scalar, Servable as ScalarServable};
|
||||
|
||||
mod api;
|
||||
pub mod clamav;
|
||||
pub mod exif;
|
||||
pub mod metadata;
|
||||
pub mod mime_type;
|
||||
@@ -18,7 +19,10 @@ pub mod mime_type;
|
||||
#[tokio::main]
|
||||
async fn main() -> Result<(), std::io::Error> {
|
||||
// Configure logging and environment
|
||||
revolt_config::configure!(api);
|
||||
revolt_config::configure!(files);
|
||||
|
||||
// Wait for ClamAV
|
||||
clamav::init().await;
|
||||
|
||||
// Configure API schema
|
||||
#[derive(OpenApi)]
|
||||
@@ -52,9 +56,13 @@ async fn main() -> Result<(), std::io::Error> {
|
||||
fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
|
||||
if let Some(components) = openapi.components.as_mut() {
|
||||
components.add_security_scheme(
|
||||
"api_key",
|
||||
SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("todo_apikey"))),
|
||||
)
|
||||
"bot_token",
|
||||
SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("X-Bot-Token"))),
|
||||
);
|
||||
components.add_security_scheme(
|
||||
"session_token",
|
||||
SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("X-Session-Token"))),
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
use std::{io::Cursor, os::unix::fs::MetadataExt};
|
||||
use std::io::Cursor;
|
||||
|
||||
use revolt_database::Metadata;
|
||||
use revolt_result::{create_error, Result};
|
||||
use tempfile::NamedTempFile;
|
||||
|
||||
/// Intersection of what infer can detect and what image-rs supports
|
||||
|
||||
@@ -1,7 +1,14 @@
|
||||
use tempfile::NamedTempFile;
|
||||
|
||||
/// Determine the mime type of the given temporary file and filename
|
||||
pub fn determine_mime_type(f: &mut NamedTempFile, buf: &Vec<u8>, file_name: &str) -> &'static str {
|
||||
pub fn determine_mime_type(f: &mut NamedTempFile, buf: &[u8], file_name: &str) -> &'static str {
|
||||
// Force certain extensions into particular mime types
|
||||
if file_name.to_lowercase().ends_with(".apk") {
|
||||
return "application/vnd.android.package-archive";
|
||||
} else if file_name.to_lowercase().ends_with(".exe") {
|
||||
return "application/vnd.microsoft.portable-executable";
|
||||
}
|
||||
|
||||
// Use magic signatures to determine mime type
|
||||
let kind = infer::get_from_path(f.path()).expect("file read successfully");
|
||||
let mime_type = if let Some(kind) = kind {
|
||||
@@ -10,14 +17,6 @@ pub fn determine_mime_type(f: &mut NamedTempFile, buf: &Vec<u8>, file_name: &str
|
||||
"application/octet-stream"
|
||||
};
|
||||
|
||||
// Map any known conflicts where appropriate
|
||||
let mime_type = if mime_type == "application/zip" && file_name.to_lowercase().ends_with(".apk")
|
||||
{
|
||||
"application/vnd.android.package-archive"
|
||||
} else {
|
||||
mime_type
|
||||
};
|
||||
|
||||
// See if the file is actually just plain Unicode/ASCII text
|
||||
if mime_type == "application/octet-stream" && simdutf8::basic::from_utf8(buf).is_ok() {
|
||||
return "plain/text";
|
||||
|
||||
@@ -15,7 +15,7 @@ pub mod requests;
|
||||
#[tokio::main]
|
||||
async fn main() -> Result<(), std::io::Error> {
|
||||
// Configure logging and environment
|
||||
revolt_config::configure!(api);
|
||||
revolt_config::configure!(proxy);
|
||||
|
||||
// Configure API schema
|
||||
#[derive(OpenApi)]
|
||||
|
||||
@@ -23,6 +23,7 @@ echo "Building images, will tag for ghcr.io with $TAG!"
|
||||
docker build -t ghcr.io/revoltchat/base:latest -f Dockerfile.useCurrentArch .
|
||||
docker build -t ghcr.io/revoltchat/server:$TAG - < crates/delta/Dockerfile
|
||||
docker build -t ghcr.io/revoltchat/bonfire:$TAG - < crates/bonfire/Dockerfile
|
||||
docker build -t ghcr.io/revoltchat/autumn:$TAG - < crates/services/autumn/Dockerfile
|
||||
|
||||
if [ "$DEBUG" = "true" ]; then
|
||||
git restore Cargo.toml
|
||||
@@ -30,3 +31,4 @@ fi
|
||||
|
||||
docker push ghcr.io/revoltchat/server:$TAG
|
||||
docker push ghcr.io/revoltchat/bonfire:$TAG
|
||||
docker push ghcr.io/revoltchat/autumn:$TAG
|
||||
|
||||
Reference in New Issue
Block a user