Merge branch 'main' into feat/oauth2

Signed-off-by: Aeledfyr <aeledfyr@gmail.com>

.github/workflows/docker.yaml

@@ -49,13 +49,6 @@ jobs:
         uses: docker/setup-buildx-action@v2
 
       # Authenticate with Docker Hub and GHCR
-      - name: Login to DockerHub
-        uses: docker/login-action@v2
-        with:
-          registry: docker.io
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
       - name: Login to Github Container Registry
         uses: docker/login-action@v2
         with:
@@ -72,14 +65,13 @@ jobs:
           platforms: linux/amd64,linux/arm64
           tags: ghcr.io/${{ github.repository_owner }}/base:latest
 
-      # revoltchat/server
+      # stoatchat/api
       - name: Docker meta
         id: meta-delta
         uses: docker/metadata-action@v4
         with:
           images: |
-            docker.io/revoltchat/server
-            ghcr.io/revoltchat/server
+            ghcr.io/stoatchat/api
       - name: Publish
         uses: docker/build-push-action@v4
         with:
@@ -92,14 +84,13 @@ jobs:
             BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/base:latest
           labels: ${{ steps.meta-delta.outputs.labels }}
 
-      # revoltchat/bonfire
+      # stoatchat/events
       - name: Docker meta
         id: meta-bonfire
         uses: docker/metadata-action@v4
         with:
           images: |
-            docker.io/revoltchat/bonfire
-            ghcr.io/revoltchat/bonfire
+            ghcr.io/stoatchat/events
       - name: Publish
         uses: docker/build-push-action@v4
         with:
@@ -112,14 +103,13 @@ jobs:
             BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/base:latest
           labels: ${{ steps.meta-bonfire.outputs.labels }}
 
-      # revoltchat/autumn
+      # stoatchat/file-server
       - name: Docker meta
         id: meta-autumn
         uses: docker/metadata-action@v4
         with:
           images: |
-            docker.io/revoltchat/autumn
-            ghcr.io/revoltchat/autumn
+            ghcr.io/stoatchat/file-server
       - name: Publish
         uses: docker/build-push-action@v4
         with:
@@ -132,14 +122,13 @@ jobs:
             BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/base:latest
           labels: ${{ steps.meta-autumn.outputs.labels }}
 
-      # revoltchat/january
+      # stoatchat/proxy
       - name: Docker meta
         id: meta-january
         uses: docker/metadata-action@v4
         with:
           images: |
-            docker.io/revoltchat/january
-            ghcr.io/revoltchat/january
+            ghcr.io/stoatchat/proxy
       - name: Publish
         uses: docker/build-push-action@v4
         with:
@@ -152,14 +141,32 @@ jobs:
             BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/base:latest
           labels: ${{ steps.meta-january.outputs.labels }}
 
-      # revoltchat/crond
+      # stoatchat/gifbox
+      - name: Docker meta
+        id: meta-gifbox
+        uses: docker/metadata-action@v4
+        with:
+          images: |
+            ghcr.io/stoatchat/gifbox
+      - name: Publish
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          file: crates/services/gifbox/Dockerfile
+          tags: ${{ steps.meta-gifbox.outputs.tags }}
+          build-args: |
+            BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/base:latest
+          labels: ${{ steps.meta-gifbox.outputs.labels }}
+
+      # stoatchat/crond
       - name: Docker meta
         id: meta-crond
         uses: docker/metadata-action@v4
         with:
           images: |
-            docker.io/revoltchat/crond
-            ghcr.io/revoltchat/crond
+            ghcr.io/stoatchat/crond
       - name: Publish
         uses: docker/build-push-action@v4
         with:
@@ -172,14 +179,13 @@ jobs:
             BASE_IMAGE=ghcr.io/${{ github.repository_owner }}/base:latest
           labels: ${{ steps.meta-crond.outputs.labels }}
 
-      # revoltchat/pushd
+      # stoatchat/pushd
       - name: Docker meta
         id: meta-pushd
         uses: docker/metadata-action@v4
         with:
           images: |
-            docker.io/revoltchat/pushd
-            ghcr.io/revoltchat/pushd
+            ghcr.io/stoatchat/pushd
       - name: Publish
         uses: docker/build-push-action@v4
         with:

.github/workflows/rust.yaml

@@ -73,7 +73,7 @@ jobs:
         if: github.event_name != 'pull_request' && github.ref_name == 'main'
         uses: actions/checkout@v3
         with:
-          repository: revoltchat/api
+          repository: stoatchat/api
           path: api
           token: ${{ secrets.PAT }}
 

.github/workflows/triage_issue.yml

@@ -14,7 +14,7 @@ jobs:
         run: |
           gh api graphql -f query='
             query {
-              organization(login: "revoltchat"){
+              organization(login: "stoatchat"){
                 projectV2(number: 3) {
                   id
                   fields(first:20) {

.github/workflows/triage_pr.yml

@@ -14,7 +14,7 @@ jobs:
         run: |
           gh api graphql -f query='
             query {
-              organization(login: "revoltchat"){
+              organization(login: "stoatchat"){
                 projectV2(number: 5) {
                   id
                   fields(first:20) {

Dockerfile

@@ -27,8 +27,11 @@ COPY crates/core/parser/Cargo.toml ./crates/core/parser/
 COPY crates/core/permissions/Cargo.toml ./crates/core/permissions/
 COPY crates/core/presence/Cargo.toml ./crates/core/presence/
 COPY crates/core/result/Cargo.toml ./crates/core/result/
+COPY crates/core/coalesced/Cargo.toml ./crates/core/coalesced/
+COPY crates/core/ratelimits/Cargo.toml ./crates/core/ratelimits/
 COPY crates/services/autumn/Cargo.toml ./crates/services/autumn/
 COPY crates/services/january/Cargo.toml ./crates/services/january/
+COPY crates/services/gifbox/Cargo.toml ./crates/services/gifbox/
 COPY crates/daemons/crond/Cargo.toml ./crates/daemons/crond/
 COPY crates/daemons/pushd/Cargo.toml ./crates/daemons/pushd/
 RUN sh /tmp/build-image-layer.sh deps

Dockerfile.useCurrentArch

@@ -23,8 +23,11 @@ COPY crates/core/parser/Cargo.toml ./crates/core/parser/
 COPY crates/core/permissions/Cargo.toml ./crates/core/permissions/
 COPY crates/core/presence/Cargo.toml ./crates/core/presence/
 COPY crates/core/result/Cargo.toml ./crates/core/result/
+COPY crates/core/coalesced/Cargo.toml ./crates/core/coalesced/
+COPY crates/core/ratelimits/Cargo.toml ./crates/core/ratelimits/
 COPY crates/services/autumn/Cargo.toml ./crates/services/autumn/
 COPY crates/services/january/Cargo.toml ./crates/services/january/
+COPY crates/services/gifbox/Cargo.toml ./crates/services/gifbox/
 COPY crates/daemons/crond/Cargo.toml ./crates/daemons/crond/
 COPY crates/daemons/pushd/Cargo.toml ./crates/daemons/pushd/
 RUN sh /tmp/build-image-layer.sh deps

README.md

@@ -21,9 +21,11 @@ The services and libraries that power the Revolt service.<br/>
 | `core/permissions` | [crates/core/permissions](crates/core/permissions) | Core: Permission Logic              | ![Crates.io Version](https://img.shields.io/crates/v/revolt-permissions) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-permissions) ![Crates.io Version](https://img.shields.io/crates/size/revolt-permissions) ![Crates.io License](https://img.shields.io/crates/l/revolt-permissions) |
 | `core/presence`    | [crates/core/presence](crates/core/presence)       | Core: User Presence                 | ![Crates.io Version](https://img.shields.io/crates/v/revolt-presence) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-presence) ![Crates.io Version](https://img.shields.io/crates/size/revolt-presence) ![Crates.io License](https://img.shields.io/crates/l/revolt-presence)             |
 | `core/result`      | [crates/core/result](crates/core/result)           | Core: Result and Error types        | ![Crates.io Version](https://img.shields.io/crates/v/revolt-result) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-result) ![Crates.io Version](https://img.shields.io/crates/size/revolt-result) ![Crates.io License](https://img.shields.io/crates/l/revolt-result)                     |
+| `core/coalesced`   | [crates/core/coalesced](crates/core/coalesced)     | Core: Coalescion service            | ![Crates.io Version](https://img.shields.io/crates/v/revolt-coalesced) ![Crates.io Version](https://img.shields.io/crates/msrv/revolt-coalesced) ![Crates.io Version](https://img.shields.io/crates/size/revolt-coalesced) ![Crates.io License](https://img.shields.io/crates/l/revolt-coalesced)         |
 | `delta`            | [crates/delta](crates/delta)                       | REST API server                     | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
 | `bonfire`          | [crates/bonfire](crates/bonfire)                   | WebSocket events server             | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
 | `services/january` | [crates/services/january](crates/services/january) | Proxy server                        | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
+| `services/gifbox`  | [crates/services/gifbox](crates/services/gifbox)   | Tenor proxy server                  | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
 | `services/autumn`  | [crates/services/autumn](crates/services/autumn)   | File server                         | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
 | `daemons/crond`    | [crates/daemons/crond](crates/daemons/crond)       | Timed data clean up daemon server   | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
 | `daemons/pushd`    | [crates/daemons/pushd](crates/daemons/pushd)       | Push notification daemon server     | ![License](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)                                                                                                                                                                                                                                |
@@ -66,6 +68,7 @@ As a heads-up, the development environment uses the following ports:
 | `crates/bonfire`          |     14703      |
 | `crates/services/autumn`  |     14704      |
 | `crates/services/january` |     14705      |
+| `crates/services/gifbox`  |     14706      |
 
 Now you can clone and build the project:
 
@@ -141,6 +144,8 @@ cargo run --bin revolt-bonfire
 cargo run --bin revolt-autumn
 # run the proxy server
 cargo run --bin revolt-january
+# run the tenor proxy
+cargo run --bin revolt-gifbox
 # run the push daemon (not usually needed in regular development)
 cargo run --bin revolt-pushd
 

Revolt.toml

@@ -40,6 +40,9 @@ port = 14025
 use_tls = false
 use_starttls = false
 
+[api.security]
+token_secret = "trolt"
+
 [files.s3]
 # S3 protocol endpoint
 endpoint = "http://127.0.0.1:14009"

crates/bonfire/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-bonfire"
-version = "0.8.8"
+version = "0.8.9"
 license = "AGPL-3.0-or-later"
 edition = "2021"
 
@@ -19,6 +19,7 @@ async-channel = "2.3.1"
 
 # parsing
 querystring = "1.1.0"
+regex = "1.11.1"
 
 # serde
 bincode = "1.3.3"
@@ -41,7 +42,7 @@ revolt-result = { path = "../core/result" }
 revolt-models = { path = "../core/models" }
 revolt-config = { path = "../core/config" }
 revolt-database = { path = "../core/database" }
-revolt-permissions = { version = "0.8.8", path = "../core/permissions" }
+revolt-permissions = { version = "0.8.9", path = "../core/permissions" }
 revolt-presence = { path = "../core/presence", features = ["redis-is-patched"] }
 
 # redis

crates/bonfire/Dockerfile

@@ -1,5 +1,5 @@
 # Build Stage
-FROM ghcr.io/revoltchat/base:latest AS builder
+FROM ghcr.io/stoatchat/base:latest AS builder
 FROM debian:12 AS debian
 
 # Bundle Stage

crates/bonfire/src/config.rs

@@ -1,9 +1,15 @@
 use async_tungstenite::tungstenite::{handshake, Message};
 use futures::channel::oneshot::Sender;
+use once_cell::sync::Lazy;
+use regex::Regex;
 use revolt_database::events::client::ReadyPayloadFields;
 use revolt_result::{create_error, Result};
 use serde::{Deserialize, Serialize};
 
+/// matches either a single word ie "users" or a key and value ie "settings[notifications]"
+static READY_PAYLOAD_FIELD_REGEX: Lazy<Regex> =
+    Lazy::new(|| Regex::new(r#"^(\w+)(?:\[(\S+)\])?$"#).unwrap());
+
 /// Enumeration of supported protocol formats
 #[derive(Debug)]
 pub enum ProtocolFormat {
@@ -17,6 +23,7 @@ pub struct ProtocolConfiguration {
     protocol_version: i32,
     format: ProtocolFormat,
     session_token: Option<String>,
+    ready_payload_fields: ReadyPayloadFields,
 }
 
 impl ProtocolConfiguration {
@@ -25,11 +32,13 @@ impl ProtocolConfiguration {
         protocol_version: i32,
         format: ProtocolFormat,
         session_token: Option<String>,
+        ready_payload_fields: ReadyPayloadFields,
     ) -> Self {
         Self {
             protocol_version,
             format,
             session_token,
+            ready_payload_fields,
         }
     }
 
@@ -86,14 +95,8 @@ impl ProtocolConfiguration {
     }
 
     /// Get ready payload fields
-    pub fn get_ready_payload_fields(&self) -> Vec<ReadyPayloadFields> {
-        vec![
-            ReadyPayloadFields::Users,
-            ReadyPayloadFields::Servers,
-            ReadyPayloadFields::Channels,
-            ReadyPayloadFields::Members,
-            ReadyPayloadFields::Emoji,
-        ]
+    pub fn get_ready_payload_fields(&self) -> &ReadyPayloadFields {
+        &self.ready_payload_fields
     }
 }
 
@@ -124,6 +127,22 @@ impl handshake::server::Callback for WebsocketHandshakeCallback {
         let mut protocol_version = 1;
         let mut format = ProtocolFormat::Json;
         let mut session_token = None;
+        let mut ready_payload_fields = if params.iter().any(|(k, _)| *k == "ready") {
+            // If they pass the ready field, set all fields to false
+
+            ReadyPayloadFields {
+                users: false,
+                servers: false,
+                channels: false,
+                members: false,
+                emojis: false,
+                user_settings: Vec::new(),
+                channel_unreads: false,
+                policy_changes: false,
+            }
+        } else {
+            ReadyPayloadFields::default()
+        };
 
         // Parse and map parameters from key-value to known variables.
         for (key, value) in params {
@@ -139,6 +158,30 @@ impl handshake::server::Callback for WebsocketHandshakeCallback {
                     _ => {}
                 },
                 "token" => session_token = Some(value.into()),
+                "ready" => {
+                    // Re-enable all the fields the client specifies
+                    if let Some(captures) = READY_PAYLOAD_FIELD_REGEX.captures(value) {
+                        if let Some(field) = captures.get(0) {
+                            match field.as_str() {
+                                "users" => ready_payload_fields.users = true,
+                                "servers" => ready_payload_fields.servers = true,
+                                "channels" => ready_payload_fields.channels = true,
+                                "members" => ready_payload_fields.members = true,
+                                "emojis" => ready_payload_fields.emojis = true,
+                                "channel_unreads" => ready_payload_fields.channel_unreads = true,
+                                "user_settings" => {
+                                    if let Some(subkey) = captures.get(1) {
+                                        ready_payload_fields
+                                            .user_settings
+                                            .push(subkey.as_str().to_string());
+                                    }
+                                }
+                                "policy_changes" => ready_payload_fields.policy_changes = true,
+                                _ => {}
+                            }
+                        }
+                    }
+                }
                 _ => {}
             }
         }
@@ -151,6 +194,7 @@ impl handshake::server::Callback for WebsocketHandshakeCallback {
                 protocol_version,
                 format,
                 session_token,
+                ready_payload_fields,
             })
             .is_ok()
         {

crates/bonfire/src/events/impl.rs

@@ -95,21 +95,23 @@ impl State {
     pub async fn generate_ready_payload(
         &mut self,
         db: &Database,
-        fields: Vec<ReadyPayloadFields>,
+        fields: &ReadyPayloadFields,
     ) -> Result<EventV1> {
         let user = self.clone_user();
         self.cache.is_bot = user.bot.is_some();
 
         // Fetch pending policy changes.
-        let policy_changes = if user.bot.is_some() {
-            vec![]
+        let policy_changes = if user.bot.is_some() || !fields.policy_changes {
+            None
         } else {
-            db.fetch_policy_changes()
-                .await?
-                .into_iter()
-                .filter(|policy| policy.created_time > user.last_acknowledged_policy_change)
-                .map(Into::into)
-                .collect()
+            Some(
+                db.fetch_policy_changes()
+                    .await?
+                    .into_iter()
+                    .filter(|policy| policy.created_time > user.last_acknowledged_policy_change)
+                    .map(Into::into)
+                    .collect(),
+            )
         };
 
         // Find all relationships to the user.
@@ -168,7 +170,7 @@ impl State {
             .await?;
 
         // Fetch customisations.
-        let emojis = if fields.contains(&ReadyPayloadFields::Emoji) {
+        let emojis = if fields.emojis {
             Some(
                 db.fetch_emoji_by_parent_ids(
                     &servers
@@ -176,25 +178,34 @@ impl State {
                         .map(|x| x.id.to_string())
                         .collect::<Vec<String>>(),
                 )
-                .await?,
+                .await?
+                .into_iter()
+                .map(|emoji| emoji.into())
+                .collect(),
             )
         } else {
             None
         };
 
         // Fetch user settings
-        let user_settings = if let Some(ReadyPayloadFields::UserSettings(keys)) = fields
-            .iter()
-            .find(|e| matches!(e, ReadyPayloadFields::UserSettings(_)))
-        {
-            Some(db.fetch_user_settings(&user.id, keys).await?)
+        let user_settings = if !fields.user_settings.is_empty() {
+            Some(
+                db.fetch_user_settings(&user.id, &fields.user_settings)
+                    .await?,
+            )
         } else {
             None
         };
 
         // Fetch channel unreads
-        let channel_unreads = if fields.contains(&ReadyPayloadFields::ChannelUnreads) {
-            Some(db.fetch_unreads(&user.id).await?)
+        let channel_unreads = if fields.channel_unreads {
+            Some(
+                db.fetch_unreads(&user.id)
+                    .await?
+                    .into_iter()
+                    .map(|unread| unread.into())
+                    .collect(),
+            )
         } else {
             None
         };
@@ -241,30 +252,25 @@ impl State {
         }
 
         Ok(EventV1::Ready {
-            users: if fields.contains(&ReadyPayloadFields::Users) {
-                Some(users)
-            } else {
-                None
-            },
-            servers: if fields.contains(&ReadyPayloadFields::Servers) {
+            users: if fields.users { Some(users) } else { None },
+            servers: if fields.servers {
                 Some(servers.into_iter().map(Into::into).collect())
             } else {
                 None
             },
-            channels: if fields.contains(&ReadyPayloadFields::Channels) {
+            channels: if fields.channels {
                 Some(channels.into_iter().map(Into::into).collect())
             } else {
                 None
             },
-            members: if fields.contains(&ReadyPayloadFields::Members) {
+            members: if fields.members {
                 Some(members.into_iter().map(Into::into).collect())
             } else {
                 None
             },
-            emojis: emojis.map(|vec| vec.into_iter().map(Into::into).collect()),
-
+            emojis,
             user_settings,
-            channel_unreads: channel_unreads.map(|vec| vec.into_iter().map(Into::into).collect()),
+            channel_unreads,
 
             policy_changes,
         })

crates/bonfire/src/websocket.rs

@@ -17,9 +17,11 @@ use redis_kiss::{PayloadType, REDIS_PAYLOAD_TYPE, REDIS_URI};
 use revolt_config::report_internal_error;
 use revolt_database::{
     events::{client::EventV1, server::ClientMessage},
+    util::oauth2,
     iso8601_timestamp::Timestamp,
     Database, User, UserHint,
 };
+use revolt_models::v0;
 use revolt_presence::{create_session, delete_session};
 
 use async_std::{
@@ -88,23 +90,51 @@ pub async fn client(db: &'static Database, stream: TcpStream, addr: SocketAddr)
         return;
     };
 
+    // Presume the token is a proper token first
     let (user, session_id) = match User::from_token(db, token, UserHint::Any).await {
-        Ok(user) => user,
-        Err(err) => {
-            write
-                .send(config.encode(&EventV1::Error { data: err }))
+        Ok((user, session_id)) => {
+            db.update_session_last_seen(&session_id, Timestamp::now_utc())
                 .await
                 .ok();
-            return;
+
+            (user, session_id)
+        },
+        Err(err) => {
+            let revolt_config = revolt_config::config().await;
+
+            // If it fails to find the user from the token see if its an OAuth2 token
+            let res = match oauth2::decode_token(&revolt_config.api.security.token_secret, token) {
+                // Check if the OAuth2 token is allowed to establish an events websocket
+                Ok(claims) => if !claims.scopes.contains(&v0::OAuth2Scope::Events) {
+                    // TODO: maybe a last_seen system for OAuth2 as well
+                    db.fetch_user(&claims.sub).await.map(|user| (user, claims.jti))
+                } else {
+                    Err(create_error!(MissingScope { scope: v0::OAuth2Scope::Events.to_string() }))
+                },
+                // If its expired return an error
+                Err(e) => if e.into_kind() == oauth2::JWTErrorKind::ExpiredSignature {
+                    Err(create_error!(ExpiredToken))
+                } else {
+                    // Finally re-return the error from User::from_token if everything else fails to avoid a confusing error
+                    Err(err)
+                }
+            };
+
+            match res {
+                Ok(user) => user,
+                Err(err) => {
+                    write
+                        .send(config.encode(&EventV1::Error { data: err }))
+                        .await
+                        .ok();
+                    return;
+                }
+            }
         }
     };
 
     info!("User {addr:?} authenticated as @{}", user.username);
 
-    db.update_session_last_seen(&session_id, Timestamp::now_utc())
-        .await
-        .ok();
-
     // Create local state.
     let mut state = State::from(user, session_id);
     let user_id = state.cache.user_id.clone();

crates/core/coalesced/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "revolt-coalesced"
+version = "0.8.9"
+edition = "2021"
+license = "MIT"
+authors = ["Paul Makles <me@insrt.uk>", "Zomatree <me@zomatree.live>"]
+description = "Revolt Backend: Coalescion service"
+
+[features]
+tokio = ["dep:tokio"]
+queue = ["dep:indexmap"]
+cache = ["dep:lru"]
+
+default = ["tokio"]
+
+[dependencies]
+tokio = { version = "1.47.0", features = ["sync"], optional = true }
+indexmap = { version = "*", optional = true }
+lru = { version = "*", optional = true }
+
+[dev-dependencies]
+tokio = { version = "1.47.0", features = ["rt", "rt-multi-thread", "macros", "time"] }

crates/core/coalesced/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2024 Pawel Makles
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

crates/core/coalesced/src/config.rs

@@ -0,0 +1,24 @@
+#[derive(Clone, PartialEq, Eq, Debug)]
+/// Config values for [`CoalescionService`].
+pub struct CoalescionServiceConfig {
+    /// How many tasks are running at once
+    pub max_concurrent: Option<usize>,
+    /// Whether to queue tasks once `max_concurrent` is reached
+    #[cfg(feature = "queue")]
+    pub queue_requests: bool,
+    /// Max amount of tasks in the buffer queue
+    #[cfg(feature = "queue")]
+    pub max_queue: Option<usize>,
+}
+
+impl Default for CoalescionServiceConfig {
+    fn default() -> Self {
+        Self {
+            max_concurrent: Some(100),
+            #[cfg(feature = "queue")]
+            queue_requests: true,
+            #[cfg(feature = "queue")]
+            max_queue: Some(100)
+        }
+    }
+}

crates/core/coalesced/src/error.rs

@@ -0,0 +1,27 @@
+use std::fmt;
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Hash)]
+/// Coalescion service error.
+pub enum Error {
+    /// Failed to receive the actions return from the channel for unknown reason
+    RecvError,
+    /// Reached the `max_concurrent` amount of actions running at once and could not queue the action
+    MaxConcurrent,
+    /// Reached the `max_queue` amount of actions in the queue
+    MaxQueue,
+    /// Failed to downcast the type to the current type being returned, this will be most likely an ID collision
+    DowncastError,
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Error::RecvError => write!(f, "Unable to receive data from the channel"),
+            Error::MaxConcurrent => write!(f, "Max number of tasks running at once"),
+            Error::MaxQueue => write!(f, "Max number of tasks in queue"),
+            Error::DowncastError => write!(f, "Failed to downcast type, possible key collision with different types")
+        }
+    }
+}
+
+impl std::error::Error for Error {}

crates/core/coalesced/src/lib.rs

@@ -0,0 +1,39 @@
+//! # Coalesced
+//!
+//! Coalescion service to group, caching and queue duplicate actions.
+//! useful for deduplicating web requests, database lookups and other similar resource
+//! intensive or rate-limited actions.
+//!
+//! ## Features
+//! - `tokio`: Uses tokio for the async backend, this is currently the only backend.
+//! - `queue`: Whether to support queueing requests to only allow X amount of actions running at once.
+//! - `cache`: Whether to cache the actions results for future actions with the same id, uses an LRU cache internally.
+//!
+//! [`CoalescionService`] uses both [`Arc`] and [`RwLock`] internally and can be cheaply cloned to
+//! use in your codebase.
+//!
+//! It is common practice to wrap the service and in your own which delegates the executions to ensure all ids are tracked in one location across your codebase.
+//!
+//! All values are stored using [`Any`] and must be [`'static`] + [`Send`] + [`Sync`], if there is an id mismatch
+//! and a type is wrong the library will return an error, values returned from the service are also
+//! wrapped in an [`Arc`] as they are shared to each duplicate action.
+//!
+//! ## Example:
+//! ```rs
+//! use revolt_coalesced::CoalescionService;
+//!
+//! let service = CoalescionService::new();
+//!
+//! let user_id = "my_user_id";
+//! let user = service.execute(user_id, || async move {
+//!     database.fetch_user(user_id).await.unwrap()
+//! }).await;
+//! ```
+
+mod config;
+mod error;
+mod service;
+
+pub use config::CoalescionServiceConfig;
+pub use error::Error;
+pub use service::CoalescionService;

crates/core/coalesced/src/service.rs

@@ -0,0 +1,208 @@
+use std::{any::Any, collections::HashMap, fmt::Debug, future::Future, hash::Hash, sync::Arc};
+
+use tokio::sync::{
+    watch::{channel as watch_channel, Receiver},
+    RwLock,
+};
+
+#[cfg(feature = "cache")]
+use lru::LruCache;
+
+#[cfg(feature = "queue")]
+use indexmap::IndexMap;
+
+use crate::{CoalescionServiceConfig, Error};
+
+#[derive(Debug, Clone)]
+#[allow(clippy::type_complexity)]
+/// # Coalescion service
+///
+/// See module description for example usage.
+pub struct CoalescionService<Id: Hash + Clone + Eq> {
+    config: Arc<CoalescionServiceConfig>,
+    watchers: Arc<RwLock<HashMap<Id, Receiver<Option<Result<Arc<dyn Any + Send + Sync>, Error>>>>>>,
+    #[cfg(feature = "queue")]
+    queue: Arc<RwLock<IndexMap<Id, Receiver<Option<Result<Arc<dyn Any + Send + Sync>, Error>>>>>>,
+    #[cfg(feature = "cache")]
+    cache: Option<Arc<tokio::sync::Mutex<LruCache<Id, Arc<dyn Any + Send + Sync>>>>>,
+}
+
+impl<Id: Hash + Clone + Eq> CoalescionService<Id> {
+    pub fn new() -> Self {
+        Default::default()
+    }
+
+    pub fn from_config(config: CoalescionServiceConfig) -> Self {
+        Self {
+            config: Arc::new(config),
+            watchers: Arc::new(RwLock::new(HashMap::new())),
+            #[cfg(feature = "queue")]
+            queue: Arc::new(RwLock::new(IndexMap::new())),
+            #[cfg(feature = "cache")]
+            cache: None,
+        }
+    }
+
+    #[cfg(feature = "cache")]
+    pub fn from_cache(
+        config: CoalescionServiceConfig,
+        cache: LruCache<Id, Arc<dyn Any + Send + Sync>>,
+    ) -> Self {
+        Self {
+            cache: Some(Arc::new(Mutex::new(cache))),
+            ..Self::from_config(config)
+        }
+    }
+
+    async fn wait_for<Value: Any + Send + Sync>(
+        &self,
+        mut receiver: Receiver<Option<Result<Arc<dyn Any + Send + Sync>, Error>>>,
+    ) -> Result<Arc<Value>, Error> {
+        receiver
+            .wait_for(|v| v.is_some())
+            .await
+            .map_err(|_| Error::RecvError)
+            .and_then(|r| r.clone().unwrap())
+            .and_then(|arc| Arc::downcast(arc).map_err(|_| Error::DowncastError))
+    }
+
+    async fn insert_and_execute<
+        Value: Send + Sync + 'static,
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = Value>,
+    >(
+        &self,
+        id: Id,
+        func: F,
+    ) -> Result<Arc<Value>, Error> {
+        let (send, recv) = watch_channel(None);
+
+        self.watchers.write().await.insert(id.clone(), recv);
+
+        let value = Ok(Arc::new(func().await));
+
+        send.send_modify(|opt| {
+            opt.replace(value.clone().map(|v| v as Arc<dyn Any + Send + Sync>));
+        });
+
+        #[cfg(feature = "cache")]
+        if let Some(cache) = self.cache.as_ref() {
+            if let Ok(value) = &value {
+                cache.lock().await.push(id.clone(), value.clone());
+            }
+        };
+
+        self.watchers.write().await.remove(&id);
+
+        value
+    }
+
+    /// Coalesces an function, the actual function may not run if one with the same id is already running,
+    /// queued to be ran, or cached, the id should be globally unique for this specific action.
+    pub async fn execute<
+        Value: Send + Sync + 'static,
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = Value>,
+    >(
+        &self,
+        id: Id,
+        func: F,
+    ) -> Result<Arc<Value>, Error> {
+        #[cfg(feature = "cache")]
+        if let Some(cache) = self.cache.as_ref() {
+            if let Some(value) = cache.lock().await.get(&id) {
+                return Arc::downcast::<Value>(value.clone()).map_err(|_| Error::DowncastError);
+            }
+        };
+
+        let (receiver, length) = {
+            let watchers = self.watchers.read().await;
+            let length = watchers.len();
+
+            (watchers.get(&id).cloned(), length)
+        };
+
+        if let Some(receiver) = receiver {
+            self.wait_for(receiver).await
+        } else {
+            match self.config.max_concurrent {
+                Some(max_concurrent) if length >= max_concurrent => {
+                    #[cfg(feature = "queue")]
+                    if self.config.queue_requests {
+                        let (receiver, length) = {
+                            let queue = self.queue.read().await;
+
+                            (queue.get(&id).cloned(), queue.len())
+                        };
+
+                        if let Some(receiver) = receiver {
+                            return self.wait_for(receiver).await;
+                        } else {
+                            if self
+                                .config
+                                .max_queue
+                                .is_some_and(|max_queue| max_queue >= length)
+                            {
+                                return Err(Error::MaxQueue);
+                            };
+
+                            let (send, recv) = watch_channel(None);
+
+                            self.queue.write().await.insert(id.clone(), recv);
+
+                            loop {
+                                let length = self.watchers.read().await.len();
+
+                                if length < max_concurrent {
+                                    let first_key = {
+                                        let queue = self.queue.read().await;
+                                        queue.first().map(|v| v.0).cloned()
+                                    };
+
+                                    if first_key == Some(id.clone()) {
+                                        self.queue.write().await.shift_remove(&id);
+
+                                        let response = self.insert_and_execute(id, func).await;
+
+                                        send.send_modify(|opt| {
+                                            opt.replace(
+                                                response
+                                                    .clone()
+                                                    .map(|v| v as Arc<dyn Any + Send + Sync>),
+                                            );
+                                        });
+
+                                        return response;
+                                    }
+                                }
+                            }
+                        }
+                    } else {
+                        Err(Error::MaxConcurrent)
+                    }
+
+                    #[cfg(not(feature = "queue"))]
+                    Err(Error::MaxConcurrent)
+                }
+                _ => self.insert_and_execute(id, func).await,
+            }
+        }
+    }
+
+    /// Fetches the amount of currently running tasks
+    pub async fn current_task_count(&self) -> usize {
+        self.watchers.read().await.len()
+    }
+
+    #[cfg(feature = "queue")]
+    /// Fetches the current length of the queue
+    pub async fn current_queue_len(&self) -> usize {
+        self.queue.read().await.len()
+    }
+}
+
+impl<Id: Hash + Clone + Eq> Default for CoalescionService<Id> {
+    fn default() -> Self {
+        Self::from_config(CoalescionServiceConfig::default())
+    }
+}

crates/core/config/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-config"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -37,4 +37,4 @@ sentry = { version = "0.31.5", optional = true }
 sentry-anyhow = { version = "0.38.1", optional = true }
 
 # Core
-revolt-result = { version = "0.8.8", path = "../result", optional = true }
+revolt-result = { version = "0.8.9", path = "../result", optional = true }

crates/core/config/Revolt.toml

@@ -56,6 +56,10 @@ voso_legacy_token = ""
 trust_cloudflare = false
 # easypwned endpoint
 easypwned = ""
+# Secret used to encode and decode tokens
+token_secret = ""
+# Tenor API Key
+tenor_key = ""
 
 [api.security.captcha]
 # hCaptcha configuration
@@ -277,3 +281,4 @@ files = ""
 proxy = ""
 pushd = ""
 crond = ""
+gifbox = ""

crates/core/config/src/lib.rs

@@ -190,6 +190,8 @@ pub struct ApiSecurity {
     pub captcha: ApiSecurityCaptcha,
     pub trust_cloudflare: bool,
     pub easypwned: String,
+    pub token_secret: String,
+    pub tenor_key: String,
 }
 
 #[derive(Deserialize, Debug, Clone)]
@@ -365,6 +367,7 @@ pub struct Sentry {
     pub proxy: String,
     pub pushd: String,
     pub crond: String,
+    pub gifbox: String,
 }
 
 #[derive(Deserialize, Debug, Clone)]

crates/core/database/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-database"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -24,19 +24,19 @@ default = ["mongodb", "async-std-runtime", "tasks"]
 
 [dependencies]
 # Core
-revolt-config = { version = "0.8.8", path = "../config", features = [
+revolt-config = { version = "0.8.9", path = "../config", features = [
     "report-macros",
 ] }
-revolt-result = { version = "0.8.8", path = "../result" }
-revolt-models = { version = "0.8.8", path = "../models", features = [
+revolt-result = { version = "0.8.9", path = "../result" }
+revolt-models = { version = "0.8.9", path = "../models", features = [
     "validator",
 ] }
-revolt-presence = { version = "0.8.8", path = "../presence" }
-revolt-permissions = { version = "0.8.8", path = "../permissions", features = [
+revolt-presence = { version = "0.8.9", path = "../presence" }
+revolt-permissions = { version = "0.8.9", path = "../permissions", features = [
     "serde",
     "bson",
 ] }
-revolt-parser = { version = "0.8.8", path = "../parser" }
+revolt-parser = { version = "0.8.9", path = "../parser" }
 
 # Utility
 log = "0.4"
@@ -53,6 +53,8 @@ linkify = { optional = true, version = "0.8.1" }
 url-escape = { optional = true, version = "0.1.1" }
 validator = { version = "0.16", features = ["derive"] }
 isahc = { optional = true, version = "1.7", features = ["json"] }
+jsonwebtoken = "9.3.1"
+chrono = "0.4"
 
 # Serialisation
 serde_json = "1"

crates/core/database/src/drivers/reference.rs

@@ -5,13 +5,14 @@ use futures::lock::Mutex;
 use crate::{
     Bot, Channel, ChannelCompositeKey, ChannelUnread, Emoji, File, FileHash, Invite, Member,
     MemberCompositeKey, Message, PolicyChange, RatelimitEvent, Report, Server, ServerBan, Snapshot,
-    User, UserSettings, Webhook,
+    User, UserSettings, Webhook, AuthorizedBotId, AuthorizedBot,
 };
 
 database_derived!(
     /// Reference implementation
     #[derive(Default)]
     pub struct ReferenceDb {
+        pub authorized_bots: Arc<Mutex<HashMap<AuthorizedBotId, AuthorizedBot>>>,
         pub bots: Arc<Mutex<HashMap<String, Bot>>>,
         pub channels: Arc<Mutex<HashMap<String, Channel>>>,
         pub channel_invites: Arc<Mutex<HashMap<String, Invite>>>,

crates/core/database/src/events/client.rs

@@ -20,16 +20,31 @@ pub enum Ping {
 }
 
 /// Fields provided in Ready payload
-#[derive(PartialEq)]
-pub enum ReadyPayloadFields {
-    Users,
-    Servers,
-    Channels,
-    Members,
-    Emoji,
+#[derive(PartialEq, Debug, Clone, Deserialize)]
+pub struct ReadyPayloadFields {
+    pub users: bool,
+    pub servers: bool,
+    pub channels: bool,
+    pub members: bool,
+    pub emojis: bool,
+    pub user_settings: Vec<String>,
+    pub channel_unreads: bool,
+    pub policy_changes: bool,
+}
 
-    UserSettings(Vec<String>),
-    ChannelUnreads,
+impl Default for ReadyPayloadFields {
+    fn default() -> Self {
+        Self {
+            users: true,
+            servers: true,
+            channels: true,
+            members: true,
+            emojis: true,
+            user_settings: Vec::new(),
+            channel_unreads: false,
+            policy_changes: true,
+        }
+    }
 }
 
 /// Protocol Events
@@ -63,7 +78,8 @@ pub enum EventV1 {
         #[serde(skip_serializing_if = "Option::is_none")]
         channel_unreads: Option<Vec<ChannelUnread>>,
 
-        policy_changes: Vec<PolicyChange>,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        policy_changes: Option<Vec<PolicyChange>>,
     },
 
     /// Ping response

crates/core/database/src/models/authorized_bots/mod.rs

@@ -0,0 +1,5 @@
+mod model;
+mod ops;
+
+pub use model::*;
+pub use ops::*;

crates/core/database/src/models/authorized_bots/model.rs

@@ -0,0 +1,30 @@
+use iso8601_timestamp::Timestamp;
+
+use crate::OAuth2Scope;
+
+auto_derived! (
+    /// Unique id of the user and bot
+    #[derive(Hash)]
+    pub struct AuthorizedBotId {
+        /// User id
+        pub user: String,
+
+        /// Bot Id
+        pub bot: String,
+    }
+
+    pub struct AuthorizedBot {
+        /// Unique Id
+        #[serde(rename = "_id")]
+        pub id: AuthorizedBotId,
+
+        /// When the authorized oauth2 bot connection was created at
+        pub created_at: Timestamp,
+
+        /// If and when the authorized oauth2 bot connection was revoked at
+        pub deauthorized_at: Option<Timestamp>,
+
+        /// Scopes the bot has access to
+        pub scope: Vec<OAuth2Scope>,
+    }
+);

crates/core/database/src/models/authorized_bots/ops.rs

@@ -0,0 +1,27 @@
+use revolt_result::Result;
+
+use crate::{AuthorizedBot, AuthorizedBotId};
+
+mod mongodb;
+mod reference;
+
+#[async_trait]
+pub trait AbstractAuthorizedBots: Sync + Send {
+    /// Insert emoji into database.
+    async fn insert_authorized_bot(&self, authorized_bot: &AuthorizedBot) -> Result<()>;
+
+    /// Fetch an authorized bot by its id
+    async fn fetch_authorized_bot(&self, id: &AuthorizedBotId) -> Result<AuthorizedBot>;
+
+    /// Fetch a users authorized bot by its id
+    async fn fetch_users_authorized_bots(&self, user_id: &str) -> Result<Vec<AuthorizedBot>>;
+
+    /// Deletes an authorized bot
+    async fn delete_authorized_bot(&self, id: &AuthorizedBotId) -> Result<()>;
+
+    /// Deauthorizes an authorized bot
+    async fn deauthorize_authorized_bot(&self, id: &AuthorizedBotId) -> Result<AuthorizedBot>;
+
+    // Fetches all authorized bots which have been deauthorized
+    async fn fetch_deauthorized_authorized_bots(&self) -> Result<Vec<AuthorizedBot>>;
+}

crates/core/database/src/models/authorized_bots/ops/mongodb.rs

@@ -0,0 +1,71 @@
+use bson::to_bson;
+use revolt_result::Result;
+use iso8601_timestamp::Timestamp;
+
+use crate::{MongoDb, AuthorizedBot, AuthorizedBotId};
+
+use super::AbstractAuthorizedBots;
+
+static COL: &str = "authorized_bots";
+
+#[async_trait]
+impl AbstractAuthorizedBots for MongoDb {
+    /// Insert an authorized bot into database.
+    async fn insert_authorized_bot(&self, authorized_bot: &AuthorizedBot) -> Result<()> {
+        query!(self, insert_one, COL, &authorized_bot).map(|_| ())
+    }
+
+    /// Fetch an authorized bot by its id
+    async fn fetch_authorized_bot(&self, id: &AuthorizedBotId) -> Result<AuthorizedBot> {
+        query!(
+            self,
+            find_one,
+            COL,
+            doc! {
+                "_id.user": &id.user,
+                "_id.bot": &id.bot
+            }
+        )?.ok_or_else(|| create_error!(NotFound))
+    }
+
+    /// Fetch a users authorized bot by its id
+    async fn fetch_users_authorized_bots(&self, user_id: &str) -> Result<Vec<AuthorizedBot>> {
+        query!(self, find, COL, doc! { "_id.user": &user_id })
+    }
+
+    /// Deletes an authorized bot
+    async fn delete_authorized_bot(&self, id: &AuthorizedBotId) -> Result<()> {
+        query!(self, delete_one, COL, doc! { "_id.user": &id.user, "_id.bot": &id.bot }).map(|_| ())
+    }
+
+    /// Deauthorizes an authorized bot
+    async fn deauthorize_authorized_bot(&self, id: &AuthorizedBotId) -> Result<AuthorizedBot> {
+        self.col::<AuthorizedBot>(COL)
+            .find_one_and_update(
+                doc! {
+                    "_id.user": &id.user,
+                    "_id.bot": &id.bot
+                },
+                doc! {
+                    "$set": {
+                        "deauthorized_at": to_bson(&Timestamp::now_utc()).unwrap()
+                    }
+                }
+            )
+            .await
+            .map_err(|_| create_database_error!("find_one_and_update", COL))
+            .and_then(|opt| opt.ok_or_else(|| create_database_error!("find_one_and_update", COL)))
+    }
+
+    // Fetches all authorized bots which have been deauthorized
+    async fn fetch_deauthorized_authorized_bots(&self) -> Result<Vec<AuthorizedBot>> {
+        query!(
+            self,
+            find,
+            COL,
+            doc! {
+                "deauthorized_at": { "$exists": true }
+            }
+        )
+    }
+}

crates/core/database/src/models/authorized_bots/ops/reference.rs

@@ -0,0 +1,76 @@
+use revolt_result::Result;
+use iso8601_timestamp::Timestamp;
+
+use crate::{ReferenceDb, AuthorizedBot, AuthorizedBotId};
+
+use super::AbstractAuthorizedBots;
+
+#[async_trait]
+impl AbstractAuthorizedBots for ReferenceDb {
+    /// Insert an authorized bot into database.
+    async fn insert_authorized_bot(&self, authorized_bot: &AuthorizedBot) -> Result<()> {
+        let mut authorized_bots = self.authorized_bots.lock().await;
+
+        if authorized_bots.contains_key(&authorized_bot.id) {
+            Err(create_database_error!("insert", "authorized_bots"))
+        } else {
+            authorized_bots.insert(authorized_bot.id.clone(), authorized_bot.clone());
+            Ok(())
+        }
+    }
+
+    /// Fetch an authorized bot by its id
+    async fn fetch_authorized_bot(&self, id: &AuthorizedBotId) -> Result<AuthorizedBot> {
+        let authorized_bots = self.authorized_bots.lock().await;
+
+        authorized_bots.get(id).cloned().ok_or_else(|| create_error!(NotFound))
+    }
+
+    /// Fetch a users authorized bot by its id
+    async fn fetch_users_authorized_bots(&self, user_id: &str) -> Result<Vec<AuthorizedBot>> {
+        let authorized_bots = self.authorized_bots.lock().await;
+
+        Ok(authorized_bots
+            .values()
+            .filter(|authorized_bot| authorized_bot.id.user == user_id)
+            .cloned()
+            .collect()
+        )
+    }
+
+    /// Deletes an authorized bot
+    async fn delete_authorized_bot(&self, id: &AuthorizedBotId) -> Result<()> {
+        let mut authorized_bots = self.authorized_bots.lock().await;
+
+        if authorized_bots.remove(id).is_some() {
+            Ok(())
+        } else {
+            Err(create_error!(NotFound))
+        }
+    }
+
+    /// Deauthorizes an authorized bot
+    async fn deauthorize_authorized_bot(&self, id: &AuthorizedBotId) -> Result<AuthorizedBot> {
+        let mut authorized_bots = self.authorized_bots.lock().await;
+
+        if let Some(authorized_bot) = authorized_bots.get_mut(id) {
+            authorized_bot.deauthorized_at = Some(Timestamp::now_utc());
+
+            Ok(authorized_bot.clone())
+        } else {
+            Err(create_error!(NotFound))
+        }
+    }
+
+    // Fetches all authorized bots which have been deauthorized
+    async fn fetch_deauthorized_authorized_bots(&self) -> Result<Vec<AuthorizedBot>> {
+        let authorized_bots = self.authorized_bots.lock().await;
+
+        Ok(authorized_bots
+            .values()
+            .filter(|authorized_bot| authorized_bot.deauthorized_at.is_some())
+            .cloned()
+            .collect()
+        )
+    }
+}

crates/core/database/src/models/bots/model.rs

@@ -1,5 +1,6 @@
 use revolt_result::Result;
 use ulid::Ulid;
+use std::collections::HashMap;
 
 use crate::{events::client::EventV1, BotInformation, Database, PartialUser, User};
 
@@ -35,6 +36,10 @@ auto_derived_partial!(
         #[serde(skip_serializing_if = "String::is_empty", default)]
         pub privacy_policy_url: String,
 
+        /// Oauth2 bot settings
+        #[serde(skip_serializing_if = "Option::is_none", default)]
+        pub oauth2: Option<BotOauth2>,
+
         /// Enum of bot flags
         #[serde(skip_serializing_if = "Option::is_none")]
         pub flags: Option<i32>,
@@ -42,11 +47,52 @@ auto_derived_partial!(
     "PartialBot"
 );
 
+auto_derived!(
+    #[derive(Copy, Hash)]
+    pub enum OAuth2Scope {
+        #[serde(rename = "read:identify")]
+        ReadIdentify,
+        #[serde(rename = "read:servers")]
+        ReadServers,
+        #[serde(rename = "write:files")]
+        WriteFiles,
+        #[serde(rename = "events")]
+        Events,
+        #[serde(rename = "full")]
+        Full,
+    }
+
+    pub struct OAuth2ScopeReasoning {
+        pub allow: String,
+        pub deny: String
+    }
+);
+
+auto_derived_partial!(
+    pub struct BotOauth2 {
+        /// Whether the oauth2 client is public and should not receive a secret key
+        #[serde(default)]
+        pub public: bool,
+        /// Secret key used for authorisation, not provided if the client is public
+        #[serde(default)]
+        pub secret: Option<String>,
+        /// Allowed redirects for the authorisation
+        #[serde(default)]
+        pub redirects: Vec<String>,
+        /// Mapping of allowed scopes and the reasonings
+        #[serde(default)]
+        pub allowed_scopes: HashMap<OAuth2Scope, OAuth2ScopeReasoning>,
+    },
+    "PartialBotOauth2"
+);
+
 auto_derived!(
     /// Optional fields on bot object
     pub enum FieldsBot {
         Token,
         InteractionsURL,
+        Oauth2,
+        Oauth2Secret,
     }
 );
 
@@ -63,11 +109,24 @@ impl Default for Bot {
             interactions_url: Default::default(),
             terms_of_service_url: Default::default(),
             privacy_policy_url: Default::default(),
+            oauth2: Default::default(),
             flags: Default::default(),
         }
     }
 }
 
+#[allow(clippy::derivable_impls)]
+impl Default for BotOauth2 {
+    fn default() -> Self {
+        Self {
+            public: false,
+            secret: Some(nanoid::nanoid!(64)),
+            redirects: Vec::new(),
+            allowed_scopes: HashMap::new(),
+        }
+    }
+}
+
 #[allow(clippy::disallowed_methods)]
 impl Bot {
     /// Create a new bot
@@ -124,6 +183,14 @@ impl Bot {
             FieldsBot::Token => self.token = nanoid::nanoid!(64),
             FieldsBot::InteractionsURL => {
                 self.interactions_url = String::new();
+            },
+            FieldsBot::Oauth2 => self.oauth2 = None,
+            FieldsBot::Oauth2Secret => {
+                if let Some(oauth2) = &mut self.oauth2 {
+                    if !oauth2.public {
+                        oauth2.secret = Some(nanoid::nanoid!(64))
+                    }
+                }
             }
         }
     }

crates/core/database/src/models/bots/ops/mongodb.rs

@@ -87,6 +87,8 @@ impl IntoDocumentPath for FieldsBot {
         match self {
             FieldsBot::InteractionsURL => Some("interactions_url"),
             FieldsBot::Token => None,
+            FieldsBot::Oauth2 => Some("oauth2"),
+            FieldsBot::Oauth2Secret => None,
         }
     }
 }

crates/core/database/src/models/messages/model.rs

@@ -440,7 +440,8 @@ impl Message {
         }
 
         // Verify replies are valid.
-        let mut replies = HashSet::new();
+        let mut replies = Vec::new();
+
         if let Some(entries) = data.replies {
             if entries.len() > config.features.limits.global.message_replies {
                 return Err(create_error!(TooManyReplies {
@@ -448,6 +449,8 @@ impl Message {
                 }));
             }
 
+            replies.reserve(entries.len());
+
             for ReplyIntent {
                 id,
                 mention,
@@ -461,7 +464,12 @@ impl Message {
                             user_mentions.insert(message.author.to_owned());
                         }
 
-                        replies.insert(message.id);
+                        // This is O(n^2), but this is faster than a HashSet
+                        // when n < 20; as long as the message_replies limit
+                        // is reasonable, this will be fast.
+                        if !replies.contains(&message.id) {
+                            replies.push(message.id);
+                        }
                     }
                     // If the referenced message doesn't exist and fail_if_not_exists
                     // is set to false, send the message without the reply.
@@ -534,9 +542,7 @@ impl Message {
         }
 
         if !replies.is_empty() {
-            message
-                .replies
-                .replace(replies.into_iter().collect::<Vec<String>>());
+            message.replies.replace(replies);
         }
 
         // Calculate final message flags

crates/core/database/src/models/mod.rs

@@ -1,4 +1,5 @@
 mod admin_migrations;
+mod authorized_bots;
 mod bots;
 mod channel_invites;
 mod channel_unreads;
@@ -19,6 +20,7 @@ mod user_settings;
 mod users;
 
 pub use admin_migrations::*;
+pub use authorized_bots::*;
 pub use bots::*;
 pub use channel_invites::*;
 pub use channel_unreads::*;
@@ -46,6 +48,7 @@ use crate::MongoDb;
 pub trait AbstractDatabase:
     Sync
     + Send
+    + authorized_bots::AbstractAuthorizedBots
     + admin_migrations::AbstractMigrations
     + bots::AbstractBots
     + channels::AbstractChannels

crates/core/database/src/models/users/axum.rs

@@ -1,14 +1,22 @@
-use axum::{extract::FromRequestParts, http::request::Parts};
+use axum::{extract::{FromRef, FromRequestParts}, http::request::Parts};
 
+use revolt_config::config;
+use revolt_models::v0;
 use revolt_result::{create_error, Error, Result};
 
-use crate::{Database, User};
+use crate::{util::oauth2, Database, OAuth2Scope, User};
 
 #[async_trait::async_trait]
-impl FromRequestParts<Database> for User {
+impl<S> FromRequestParts<S> for User
+where
+    Database: FromRef<S>,
+    S: Send + Sync
+{
     type Rejection = Error;
 
-    async fn from_request_parts(parts: &mut Parts, db: &Database) -> Result<User> {
+    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<User> {
+        let db = Database::from_ref(state);
+
         if let Some(Ok(bot_token)) = parts.headers.get("x-bot-token").map(|v| v.to_str()) {
             let bot = db.fetch_bot_by_token(bot_token).await?;
             db.fetch_user(&bot.id).await
@@ -17,6 +25,24 @@ impl FromRequestParts<Database> for User {
         {
             let session = db.fetch_session_by_token(session_token).await?;
             db.fetch_user(&session.user_id).await
+        } else if let Some(Ok(header_oauth_token)) = parts.headers.get("x-oauth2-token").map(|v| v.to_str()) {
+            let config = config().await;
+
+            let claims = oauth2::decode_token(
+                &config.api.security.token_secret,
+                header_oauth_token,
+            ).map_err(|_| create_error!(NotAuthenticated))?;
+
+            let required_scope: v0::OAuth2Scope = parts.extensions.get::<OAuth2Scope>()
+                .copied()
+                .ok_or_else(|| create_error!(NotAuthenticated))?
+                .into();
+
+            if claims.scopes.contains(&v0::OAuth2Scope::Full) || claims.scopes.contains(&required_scope) {
+                db.fetch_user(&claims.sub).await
+            } else {
+                Err(create_error!(MissingScope { scope: required_scope.to_string() }))
+            }
         } else {
             Err(create_error!(NotAuthenticated))
         }

crates/core/database/src/models/users/rocket.rs

@@ -1,7 +1,10 @@
 use authifier::models::Session;
+use revolt_config::config;
+use revolt_models::v0;
 use rocket::http::Status;
 use rocket::request::{self, FromRequest, Outcome, Request};
 
+use crate::util::oauth2;
 use crate::{Database, User};
 
 #[rocket::async_trait]
@@ -19,12 +22,38 @@ impl<'r> FromRequest<'r> for User {
                     .next()
                     .map(|x| x.to_string());
 
+                let header_oauth_token = request
+                    .headers()
+                    .get("x-oauth2-token")
+                    .next()
+                    .map(|x| x.to_string());
+
                 if let Some(bot_token) = header_bot_token {
                     if let Ok(bot) = db.fetch_bot_by_token(&bot_token).await {
                         if let Ok(user) = db.fetch_user(&bot.id).await {
                             return Some(user);
                         }
                     }
+                } else if let Some(header_oauth_token) = header_oauth_token {
+                    let config = config().await;
+
+                    let claims = oauth2::decode_token(
+                        &config.api.security.token_secret,
+                        &header_oauth_token,
+                    )
+                    .ok()?;
+
+                    // access the scope required for the route stored in the request local cache set via `OAuth2Scoped`
+                    let required_scope: v0::OAuth2Scope = request.local_cache(|| None::<crate::OAuth2Scope>)
+                        .as_ref()
+                        .copied()?
+                        .into();
+
+                    if claims.scopes.contains(&v0::OAuth2Scope::Full) || claims.scopes.contains(&required_scope) {
+                        if let Ok(user) = db.fetch_user(&claims.sub).await {
+                            return Some(user);
+                        }
+                    }
                 } else if let Outcome::Success(session) = request.guard::<Session>().await {
                     if let Ok(user) = db.fetch_user(&session.user_id).await {
                         return Some(user);

crates/core/database/src/util/bridge/v0.rs

@@ -33,6 +33,7 @@ impl From<crate::Bot> for Bot {
             interactions_url: value.interactions_url,
             terms_of_service_url: value.terms_of_service_url,
             privacy_policy_url: value.privacy_policy_url,
+            oauth2: value.oauth2.map(|oauth2| oauth2.into()),
             flags: value.flags.unwrap_or_default() as u32,
         }
     }
@@ -43,6 +44,8 @@ impl From<FieldsBot> for crate::FieldsBot {
         match value {
             FieldsBot::InteractionsURL => crate::FieldsBot::InteractionsURL,
             FieldsBot::Token => crate::FieldsBot::Token,
+            FieldsBot::Oauth2 => crate::FieldsBot::Oauth2,
+            FieldsBot::Oauth2Secret => crate::FieldsBot::Oauth2Secret,
         }
     }
 }
@@ -52,6 +55,78 @@ impl From<crate::FieldsBot> for FieldsBot {
         match value {
             crate::FieldsBot::InteractionsURL => FieldsBot::InteractionsURL,
             crate::FieldsBot::Token => FieldsBot::Token,
+            crate::FieldsBot::Oauth2 => FieldsBot::Oauth2,
+            crate::FieldsBot::Oauth2Secret => FieldsBot::Oauth2Secret,
+        }
+    }
+}
+
+impl From<BotOauth2> for crate::BotOauth2 {
+    fn from(value: BotOauth2) -> Self {
+        crate::BotOauth2 {
+            public: value.public,
+            secret: value.secret,
+            redirects: value.redirects,
+            allowed_scopes: value.allowed_scopes
+                .into_iter()
+                .map(|(scope, value)| (scope.into(), value.into()))
+                .collect(),
+        }
+    }
+}
+
+impl From<crate::BotOauth2> for BotOauth2 {
+    fn from(value: crate::BotOauth2) -> Self {
+        BotOauth2 {
+            public: value.public,
+            secret: value.secret,
+            redirects: value.redirects,
+            allowed_scopes: value.allowed_scopes
+                .into_iter()
+                .map(|(scope, value)| (scope.into(), value.into()))
+                .collect(),
+        }
+    }
+}
+
+impl From<crate::OAuth2Scope> for OAuth2Scope {
+    fn from(value: crate::OAuth2Scope) -> Self {
+        match value {
+            crate::OAuth2Scope::ReadIdentify => OAuth2Scope::ReadIdentify,
+            crate::OAuth2Scope::ReadServers => OAuth2Scope::ReadServers,
+            crate::OAuth2Scope::WriteFiles => OAuth2Scope::WriteFiles,
+            crate::OAuth2Scope::Events => OAuth2Scope::Events,
+            crate::OAuth2Scope::Full => OAuth2Scope::Full,
+        }
+    }
+}
+
+impl From<OAuth2Scope> for crate::OAuth2Scope {
+    fn from(value: OAuth2Scope) -> Self {
+        match value {
+            OAuth2Scope::ReadIdentify => crate::OAuth2Scope::ReadIdentify,
+            OAuth2Scope::ReadServers => crate::OAuth2Scope::ReadServers,
+            OAuth2Scope::WriteFiles => crate::OAuth2Scope::WriteFiles,
+            OAuth2Scope::Events => crate::OAuth2Scope::Events,
+            OAuth2Scope::Full => crate::OAuth2Scope::Full,
+        }
+    }
+}
+
+impl From<crate::OAuth2ScopeReasoning> for OAuth2ScopeReasoning {
+    fn from(value: crate::OAuth2ScopeReasoning) -> Self {
+        OAuth2ScopeReasoning {
+            allow: value.allow,
+            deny: value.deny,
+        }
+    }
+}
+
+impl From<OAuth2ScopeReasoning> for crate::OAuth2ScopeReasoning {
+    fn from(value: OAuth2ScopeReasoning) -> Self {
+        crate::OAuth2ScopeReasoning {
+            allow: value.allow,
+            deny: value.deny,
         }
     }
 }
@@ -1387,3 +1462,43 @@ impl From<FieldsMessage> for crate::FieldsMessage {
         }
     }
 }
+
+impl From<AuthorizedBotId> for crate::AuthorizedBotId {
+    fn from(value: AuthorizedBotId) -> Self {
+        crate::AuthorizedBotId {
+            user: value.user,
+            bot: value.bot
+        }
+    }
+}
+
+impl From<crate::AuthorizedBotId> for AuthorizedBotId {
+    fn from(value: crate::AuthorizedBotId) -> Self {
+        AuthorizedBotId {
+            user: value.user,
+            bot: value.bot
+        }
+    }
+}
+
+impl From<AuthorizedBot> for crate::AuthorizedBot {
+    fn from(value: AuthorizedBot) -> Self {
+        crate::AuthorizedBot {
+            id: value.id.into(),
+            created_at: value.created_at,
+            deauthorized_at: value.deauthorized_at,
+            scope: value.scope.into_iter().map(|scope| scope.into()).collect(),
+        }
+    }
+}
+
+impl From<crate::AuthorizedBot> for AuthorizedBot {
+    fn from(value: crate::AuthorizedBot) -> Self {
+        AuthorizedBot {
+            id: value.id.into(),
+            created_at: value.created_at,
+            deauthorized_at: value.deauthorized_at,
+            scope: value.scope.into_iter().map(|scope| scope.into()).collect(),
+        }
+    }
+}

crates/core/database/src/util/mod.rs

@@ -4,3 +4,4 @@ pub mod idempotency;
 pub mod permissions;
 pub mod reference;
 pub mod test_fixtures;
+pub mod oauth2;

crates/core/database/src/util/oauth2/axum.rs

@@ -0,0 +1,17 @@
+use std::marker::PhantomData;
+
+use axum::{extract::FromRequestParts, http::request::Parts};
+use revolt_result::{Error, Result};
+
+use super::{OAuth2Scoped, scopes::OAuth2Scope};
+
+#[rocket::async_trait]
+impl<S: Send + Sync, Scope: OAuth2Scope> FromRequestParts<S> for OAuth2Scoped<Scope> {
+    type Rejection = Error;
+
+    async fn from_request_parts(parts: &mut Parts, _state: &S) -> Result<Self> {
+        parts.extensions.insert(Scope::SCOPE);
+
+        Ok(OAuth2Scoped { _scope: PhantomData })
+    }
+}

crates/core/database/src/util/oauth2/mod.rs

@@ -0,0 +1,120 @@
+use chrono::{TimeDelta, Utc};
+use jsonwebtoken::{decode, encode, errors::Error, DecodingKey, EncodingKey, Header, Validation};
+use redis_kiss::AsyncCommands;
+use revolt_models::v0;
+use revolt_result::Result;
+use serde::{Deserialize, Serialize};
+
+pub mod scopes;
+pub use scopes::OAuth2Scoped;
+
+#[cfg(feature = "rocket")]
+pub mod rocket;
+
+#[cfg(feature = "axum")]
+pub mod axum;
+
+pub use jsonwebtoken::errors::{Error as JWTError, ErrorKind as JWTErrorKind};
+use ulid::Ulid;
+
+#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
+pub enum TokenType {
+    Auth,
+    Access,
+    Refresh,
+}
+
+impl TokenType {
+    pub fn lifetime(self) -> TimeDelta {
+        match self {
+            TokenType::Access => TimeDelta::weeks(1),
+            TokenType::Auth => TimeDelta::minutes(5),
+            TokenType::Refresh => TimeDelta::weeks(4),
+        }
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct Claims {
+    pub jti: String,
+    pub sub: String,
+    pub exp: i64,
+
+    pub r#type: TokenType,
+    pub client_id: String,
+    pub scopes: Vec<v0::OAuth2Scope>,
+    pub redirect_uri: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub code_challange_method: Option<v0::OAuth2CodeChallangeMethod>,
+}
+
+#[allow(clippy::too_many_arguments)]
+pub fn encode_token(
+    token_secret: &str,
+    token_type: TokenType,
+    user_id: String,
+    client_id: String,
+    redirect_uri: String,
+    scopes: Vec<v0::OAuth2Scope>,
+    code_challange_method: Option<v0::OAuth2CodeChallangeMethod>,
+) -> Result<String, Error> {
+    let now = Utc::now();
+
+    let exp = now.checked_add_signed(token_type.lifetime()).unwrap();
+
+    println!("{now:?} {exp:}");
+
+    let claims = Claims {
+        jti: Ulid::new().to_string(),
+        sub: user_id,
+        exp: exp.timestamp(),
+
+        r#type: token_type,
+        client_id,
+        scopes,
+        redirect_uri,
+        code_challange_method,
+    };
+
+    let encoding_key = EncodingKey::from_secret(token_secret.as_bytes());
+
+    encode(&Header::default(), &claims, &encoding_key)
+}
+
+pub fn decode_token(token_secret: &str, code: &str) -> Result<Claims, Error> {
+    let decoding_key = DecodingKey::from_secret(token_secret.as_bytes());
+
+    let data = decode(
+        code,
+        &decoding_key,
+        &Validation::new(jsonwebtoken::Algorithm::HS256),
+    )?;
+
+    Ok(data.claims)
+}
+
+pub async fn add_code_challange(token: &str, code_challenge: &str) -> Result<()> {
+    let mut conn = redis_kiss::get_connection()
+        .await
+        .map_err(|_| create_error!(InternalError))?;
+
+    conn.pset_ex::<_, _, ()>(
+        format!("oauth2:{token}:code_challenge"),
+        code_challenge,
+        TokenType::Access.lifetime().num_milliseconds() as usize,
+    )
+    .await
+    .map_err(|_| create_error!(InternalError))?;
+
+    Ok(())
+}
+
+pub async fn get_code_challange(token: &str) -> Result<Option<String>> {
+    let mut conn = redis_kiss::get_connection()
+        .await
+        .map_err(|_| create_error!(InternalError))?;
+
+    conn.get(format!("oauth2:{token}:code_challenge"))
+        .await
+        .map_err(|_| create_error!(InternalError))
+}

crates/core/database/src/util/oauth2/rocket.rs

@@ -0,0 +1,53 @@
+use std::{convert::Infallible, marker::PhantomData};
+
+use revolt_okapi::openapi3::{OAuthFlows, SecurityScheme, SecuritySchemeData};
+use revolt_rocket_okapi::request::{OpenApiFromRequest, RequestHeaderInput};
+use rocket::{request::{self, FromRequest}, Request};
+
+use super::{OAuth2Scoped, scopes::OAuth2Scope};
+
+
+#[rocket::async_trait]
+impl<'r, Scope: OAuth2Scope> FromRequest<'r> for OAuth2Scoped<Scope> {
+    type Error = Infallible;
+
+    async fn from_request(request: &'r Request<'_>) -> request::Outcome<Self, Self::Error> {
+        request.local_cache(|| Some(Scope::SCOPE));
+
+        request::Outcome::Success(OAuth2Scoped { _scope: PhantomData })
+    }
+}
+
+impl<'r, Scope: OAuth2Scope> OpenApiFromRequest<'r> for OAuth2Scoped<Scope> {
+    fn from_request_input(
+        _gen: &mut revolt_rocket_okapi::r#gen::OpenApiGenerator,
+        _name: String,
+        _required: bool,
+    ) -> revolt_rocket_okapi::Result<revolt_rocket_okapi::request::RequestHeaderInput> {
+        Ok(RequestHeaderInput::Security(
+            "OAuth2".to_owned(),
+            SecurityScheme {
+                description: None,
+                extensions: Default::default(),
+                data: SecuritySchemeData::OAuth2 {
+                    flows: OAuthFlows::AuthorizationCode {
+                        authorization_url: "todo".to_string(),
+                        token_url: "todo".to_string(),
+                        refresh_url: Some("todo".to_string()),
+                        scopes: revolt_okapi::map! {
+                            "read:identify".to_string() => "".to_string(),
+                            "read:servers".to_string() => "".to_string(),
+                            "write:files".to_string() => "".to_string(),
+                            "events".to_string() => "".to_string(),
+                            "full".to_string() => "".to_string(),
+                        },
+                        extensions: Default::default()
+                    }
+                }
+            },
+            revolt_okapi::map! {
+                "OAuth2".to_owned() => vec![Scope::MODEL.to_string()]
+            },
+        ))
+    }
+}

crates/core/database/src/util/oauth2/scopes.rs

@@ -0,0 +1,29 @@
+use std::marker::PhantomData;
+
+pub struct OAuth2Scoped<Scope> {
+    pub(crate) _scope: PhantomData<Scope>
+}
+
+pub trait OAuth2Scope {
+    const SCOPE: crate::OAuth2Scope;
+    const MODEL: revolt_models::v0::OAuth2Scope;
+}
+
+macro_rules! define_oauth2_scope {
+    ($struct_name:ident) => {
+        pub struct $struct_name;
+
+        impl OAuth2Scope for $struct_name {
+            const SCOPE: crate::OAuth2Scope = crate::OAuth2Scope::$struct_name;
+            const MODEL: revolt_models::v0::OAuth2Scope = revolt_models::v0::OAuth2Scope::$struct_name;
+        }
+    };
+}
+
+// This must match the OAuth2Scope enum
+// TODO: automatically sync this
+define_oauth2_scope!(ReadIdentify);
+define_oauth2_scope!(ReadServers);
+define_oauth2_scope!(WriteFiles);
+define_oauth2_scope!(Events);
+define_oauth2_scope!(Full);

crates/core/files/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-files"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -20,10 +20,10 @@ typenum = "1.17.0"
 aws-config = "1.5.5"
 aws-sdk-s3 = { version = "1.46.0", features = ["behavior-version-latest"] }
 
-revolt-config = { version = "0.8.8", path = "../config", features = [
+revolt-config = { version = "0.8.9", path = "../config", features = [
     "report-macros",
 ] }
-revolt-result = { version = "0.8.8", path = "../result" }
+revolt-result = { version = "0.8.9", path = "../result" }
 
 # image processing
 jxl-oxide = "0.8.1"

crates/core/models/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-models"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -20,8 +20,8 @@ default = ["serde", "partials", "rocket"]
 
 [dependencies]
 # Core
-revolt-config = { version = "0.8.8", path = "../config" }
-revolt-permissions = { version = "0.8.8", path = "../permissions" }
+revolt-config = { version = "0.8.9", path = "../config" }
+revolt-permissions = { version = "0.8.9", path = "../permissions" }
 
 # Utility
 regex = "1.11"

crates/core/models/src/v0/authorized_bots.rs

@@ -0,0 +1,34 @@
+use iso8601_timestamp::Timestamp;
+
+use crate::v0::{PublicBot, OAuth2Scope};
+
+auto_derived!(
+    /// Unique id of the user and bot
+    pub struct AuthorizedBotId {
+        /// User id
+        pub user: String,
+
+        /// Bot Id
+        pub bot: String,
+    }
+
+    pub struct AuthorizedBot {
+        /// Unique Id
+        #[serde(rename = "_id")]
+        pub id: AuthorizedBotId,
+
+        /// When the authorized oauth2 bot connection was created at
+        pub created_at: Timestamp,
+
+        /// If and when the authorized oauth2 bot connection was revoked at
+        pub deauthorized_at: Option<Timestamp>,
+
+        /// Scopes the bot has access to
+        pub scope: Vec<OAuth2Scope>,
+    }
+
+    pub struct AuthorizedBotsResponse {
+        pub public_bot: PublicBot,
+        pub authorized_bot: AuthorizedBot,
+    }
+);

crates/core/models/src/v0/bots.rs

@@ -1,4 +1,8 @@
-use super::User;
+use super::{User, OAuth2Scope, OAuth2ScopeReasoning};
+use std::collections::HashMap;
+
+#[cfg(feature = "validator")]
+use validator::Validate;
 
 auto_derived!(
     /// Bot
@@ -48,6 +52,13 @@ auto_derived!(
         )]
         pub privacy_policy_url: String,
 
+        /// Oauth2 bot settings
+        #[cfg_attr(
+            feature = "serde",
+            serde(skip_serializing_if = "Option::is_none", default)
+        )]
+        pub oauth2: Option<BotOauth2>,
+
         /// Enum of bot flags
         #[cfg_attr(
             feature = "serde",
@@ -60,6 +71,8 @@ auto_derived!(
     pub enum FieldsBot {
         Token,
         InteractionsURL,
+        Oauth2,
+        Oauth2Secret,
     }
 
     /// Flags that may be attributed to a bot
@@ -101,7 +114,7 @@ auto_derived!(
 
     /// Bot Details
     #[derive(Default)]
-    #[cfg_attr(feature = "validator", derive(validator::Validate))]
+    #[cfg_attr(feature = "validator", derive(Validate))]
     pub struct DataCreateBot {
         /// Bot username
         #[cfg_attr(
@@ -113,7 +126,7 @@ auto_derived!(
 
     /// New Bot Details
     #[derive(Default)]
-    #[cfg_attr(feature = "validator", derive(validator::Validate))]
+    #[cfg_attr(feature = "validator", derive(Validate))]
     pub struct DataEditBot {
         /// Bot username
         #[cfg_attr(
@@ -131,11 +144,24 @@ auto_derived!(
         /// Interactions URL
         #[cfg_attr(feature = "validator", validate(length(min = 1, max = 2048)))]
         pub interactions_url: Option<String>,
+
+        #[cfg_attr(feature = "validator", validate)]
+        pub oauth2: Option<DataEditBotOauth2>,
+
         /// Fields to remove from bot object
         #[cfg_attr(feature = "serde", serde(default))]
         pub remove: Vec<FieldsBot>,
     }
 
+    #[derive(Default)]
+    #[cfg_attr(feature = "validator", derive(Validate))]
+    pub struct DataEditBotOauth2 {
+        pub public: Option<bool>,
+        #[cfg_attr(feature = "validator", validate(length(min = 1, max = 10)))]
+        pub redirects: Option<Vec<String>>,
+        pub allowed_scopes: Option<HashMap<OAuth2Scope, OAuth2ScopeReasoning>>
+    }
+
     /// Where we are inviting a bot to
     #[serde(untagged)]
     pub enum InviteBotDestination {
@@ -170,3 +196,22 @@ auto_derived!(
         pub user: User,
     }
 );
+
+auto_derived_partial!(
+    /// Bot Oauth2 information
+    pub struct BotOauth2 {
+        /// Whether the oauth client is public and should not receive a secret key
+        #[serde(default)]
+        pub public: bool,
+        /// Secret key used for authorisation, not provided if the client is public
+        #[serde(default)]
+        pub secret: Option<String>,
+        /// Allowed redirects for the authorisation
+        #[serde(default)]
+        pub redirects: Vec<String>,
+        /// Mapping of allowed scopes and the reasonings
+        #[serde(default)]
+        pub allowed_scopes: HashMap<OAuth2Scope, OAuth2ScopeReasoning>,
+    },
+    "PartialBotOauth2"
+);

crates/core/models/src/v0/mod.rs

@@ -1,3 +1,4 @@
+mod authorized_bots;
 mod bots;
 mod channel_invites;
 mod channel_unreads;
@@ -7,6 +8,7 @@ mod embeds;
 mod emojis;
 mod files;
 mod messages;
+mod oauth2;
 mod policy_changes;
 mod safety_reports;
 mod server_bans;
@@ -15,6 +17,7 @@ mod servers;
 mod user_settings;
 mod users;
 
+pub use authorized_bots::*;
 pub use bots::*;
 pub use channel_invites::*;
 pub use channel_unreads::*;
@@ -24,6 +27,7 @@ pub use embeds::*;
 pub use emojis::*;
 pub use files::*;
 pub use messages::*;
+pub use oauth2::*;
 pub use policy_changes::*;
 pub use safety_reports::*;
 pub use server_bans::*;

crates/core/models/src/v0/oauth2.rs

@@ -0,0 +1,140 @@
+use crate::v0::{PublicBot, User};
+use std::{collections::HashMap, fmt::Display};
+
+auto_derived!(
+    pub struct OAuth2AuthorizeAuthResponse {
+        /// Redirect URI which will contain the access token
+        pub redirect_uri: String,
+    }
+
+    pub struct OAuth2ScopeReasoning {
+        pub allow: String,
+        pub deny: String
+    }
+
+    pub struct OAuth2AuthorizeInfoResponse {
+        pub bot: PublicBot,
+        pub user: User,
+        pub allowed_scopes: HashMap<OAuth2Scope, OAuth2ScopeReasoning>
+    }
+
+    #[derive(Copy)]
+    #[cfg_attr(feature = "serde", serde(rename = "lowercase"))]
+    #[cfg_attr(feature = "rocket", derive(rocket::FromFormField))]
+    pub enum OAuth2ResponseType {
+        #[cfg_attr(feature = "rocket", field(value = "code"))]
+        Code,
+        #[cfg_attr(feature = "rocket", field(value = "token"))]
+        Token,
+    }
+
+    #[derive(Copy)]
+    #[cfg_attr(feature = "rocket", derive(rocket::FromFormField))]
+    pub enum OAuth2GrantType {
+        #[cfg_attr(feature = "rocket", field(value = "authorization_code"))]
+        #[cfg_attr(feature = "serde", serde(rename = "authorization_code"))]
+        AuthorizationCode,
+        #[cfg_attr(feature = "rocket", field(value = "implicit"))]
+        #[cfg_attr(feature = "serde", serde(rename = "implicit"))]
+        Implicit,
+        #[cfg_attr(feature = "rocket", field(value = "refresh_token"))]
+        #[cfg_attr(feature = "serde", serde(rename = "refresh_token"))]
+        RefreshToken
+    }
+
+    #[derive(Copy)]
+    #[cfg_attr(feature = "rocket", derive(rocket::FromFormField))]
+    pub enum OAuth2CodeChallangeMethod {
+        #[cfg_attr(feature = "rocket", field(value = "plain"))]
+        #[cfg_attr(feature = "serde", serde(rename = "plain"))]
+        Plain,
+        S256
+    }
+
+    #[cfg_attr(feature = "rocket", derive(rocket::FromForm))]
+    pub struct OAuth2AuthorizationForm {
+        pub client_id: String,
+        pub scope: String,
+        pub redirect_uri: String,
+        pub response_type: OAuth2ResponseType,
+        pub state: Option<String>,
+        pub code_challenge: Option<String>,
+        pub code_challenge_method: Option<OAuth2CodeChallangeMethod>,
+    }
+
+    #[cfg_attr(feature = "rocket", derive(rocket::FromForm))]
+    pub struct OAuth2TokenExchangeForm {
+        pub grant_type: OAuth2GrantType,
+
+        pub client_id: String,
+        pub client_secret: Option<String>,
+
+        /// Authorization code
+        pub code: Option<String>,
+        // Refresh token to generate new access token
+        pub refresh_token: Option<String>,
+
+        pub code_verifier: Option<String>,
+    }
+
+    pub struct OAuth2TokenExchangeResponse {
+        pub access_token: String,
+        pub refresh_token: Option<String>,
+        pub token_type: String,
+        pub scope: String,
+    }
+
+    #[derive(Copy, Hash)]
+    #[cfg_attr(feature = "serde", serde(rename = "snake_case"))]
+    pub enum OAuth2Scope {
+        #[cfg_attr(feature = "serde", serde(rename = "read:identify"))]
+        ReadIdentify,
+        #[cfg_attr(feature = "serde", serde(rename = "read:servers"))]
+        ReadServers,
+        #[cfg_attr(feature = "serde", serde(rename = "write:files"))]
+        WriteFiles,
+        #[cfg_attr(feature = "serde", serde(rename = "events"))]
+        Events,
+        #[cfg_attr(feature = "serde", serde(rename = "full"))]
+        Full,
+    }
+);
+
+impl Display for OAuth2Scope {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(match self {
+            OAuth2Scope::ReadIdentify => "read:identify",
+            OAuth2Scope::ReadServers => "read:servers",
+            OAuth2Scope::WriteFiles => "write:files",
+            OAuth2Scope::Events => "events",
+            OAuth2Scope::Full => "full",
+        })
+    }
+}
+
+impl OAuth2Scope {
+    #[allow(clippy::should_implement_trait)]
+    pub fn from_str(str: &str) -> Option<OAuth2Scope> {
+        match str {
+            "read:identify" => Some(OAuth2Scope::ReadIdentify),
+            "read:servers" => Some(OAuth2Scope::ReadServers),
+            "events" => Some(OAuth2Scope::Events),
+            "full" => Some(OAuth2Scope::Full),
+            _ => None,
+        }
+    }
+
+    pub fn scopes_from_str(string: &str) -> Option<Vec<OAuth2Scope>> {
+        let mut scopes = Vec::new();
+
+        for scope in string.split(' ') {
+            if let Some(scope) = OAuth2Scope::from_str(scope) {
+                scopes.push(scope);
+            } else {
+                return None;
+            }
+        }
+
+        Some(scopes)
+    }
+}

crates/core/parser/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-parser"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "MIT"
 authors = ["Zomatree <me@zomatree.live>", "Paul Makles <me@insrt.uk>"]

crates/core/permissions/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-permissions"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -21,7 +21,7 @@ async-std = { version = "1.8.0", features = ["attributes"] }
 
 [dependencies]
 # Core
-revolt-result = { version = "0.8.8", path = "../result" }
+revolt-result = { version = "0.8.9", path = "../result" }
 
 # Utility
 auto_ops = "0.3.0"

crates/core/presence/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-presence"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
@@ -16,7 +16,7 @@ redis-is-patched = []
 async-std = { version = "1.8.0", features = ["attributes"] }
 
 # Config for loading Redis URI
-revolt-config = { version = "0.8.8", path = "../config" }
+revolt-config = { version = "0.8.9", path = "../config" }
 
 [dependencies]
 # Utility

crates/core/ratelimits/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "revolt-ratelimits"
+version = "0.8.9"
+edition = "2024"
+
+[features]
+rocket = ["dep:rocket", "dep:revolt_rocket_okapi", "revolt-database/rocket-impl"]
+axum = ["dep:axum", "revolt-database/axum-impl"]
+
+default = ["rocket", "axum"]
+
+[dependencies]
+revolt-database = { version = "0.8.9", path = "../database"}
+revolt-result = { version = "0.8.9", path = "../result" }
+revolt-config = { version = "0.8.9", path = "../config" }
+
+rocket = { version = "0.5.1", optional = true }
+revolt_rocket_okapi = { version = "0.10.0", optional = true }
+
+axum = { version = "0.7.5", optional = true, features = ["macros"] }
+
+serde = { version = "1", features = ["derive"] }
+authifier = { version = "1.0.15" }
+dashmap = "5.2.0"
+async-trait = "0.1.81"
+log = "0.4"

crates/core/ratelimits/src/axum.rs

@@ -0,0 +1,194 @@
+use std::net::SocketAddr;
+
+use async_trait::async_trait;
+use axum::{
+    Json, RequestPartsExt, Router,
+    body::Body,
+    extract::{ConnectInfo, FromRef, FromRequestParts, State},
+    http::{HeaderValue, Request, StatusCode, request::Parts},
+    middleware::Next,
+    response::{IntoResponse, Response},
+    routing::get,
+};
+use revolt_database::{Database, User};
+use revolt_config::config;
+
+use crate::ratelimiter::{RatelimitInformation, Ratelimiter, RequestKind};
+
+#[derive(Clone, Copy)]
+pub struct AxumRequestKind;
+
+impl RequestKind for AxumRequestKind {
+    type R<'a> = Parts;
+}
+
+pub type RatelimitStorage = crate::ratelimiter::RatelimitStorage<AxumRequestKind>;
+
+fn to_ip(parts: &Parts) -> String {
+    parts
+        .extensions
+        .get::<ConnectInfo<SocketAddr>>()
+        .map(|info| info.ip().to_string())
+        .unwrap_or_default()
+}
+
+async fn to_real_ip(parts: &Parts) -> String {
+    if config().await.api.security.trust_cloudflare {
+        parts
+            .headers
+            .get("CF-Connecting-IP")
+            .map(|x| x.to_str().unwrap().to_string())
+            .unwrap_or_else(|| to_ip(parts))
+    } else {
+        to_ip(parts)
+    }
+}
+
+#[async_trait]
+impl<S: Send + Sync> FromRequestParts<S> for Ratelimiter
+where
+    Database: FromRef<S>,
+    RatelimitStorage: FromRef<S>,
+{
+    type Rejection = Json<Ratelimiter>;
+
+    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
+        if parts
+            .extensions
+            .get::<Result<Ratelimiter, Json<Ratelimiter>>>()
+            .is_none()
+        {
+            let storage = RatelimitStorage::from_ref(state);
+
+            let identifier = if let Ok(user) = parts.extract_with_state::<User, _>(state).await {
+                user.id
+            } else {
+                to_real_ip(parts).await
+            };
+
+            let (bucket, resource) = storage.resolver.resolve_bucket(parts);
+            let limit = storage.resolver.resolve_bucket_limit(bucket);
+
+            let ratelimiter =
+                Ratelimiter::from(&storage.map, &identifier, limit, (bucket, resource));
+
+            parts.extensions.insert(ratelimiter.map_err(Json));
+        };
+
+        *parts
+            .extensions
+            .get::<Result<Ratelimiter, Json<Ratelimiter>>>()
+            .unwrap()
+    }
+}
+
+#[async_trait]
+impl<S: Send + Sync> FromRequestParts<S> for RatelimitInformation
+where
+    Database: FromRef<S>,
+    RatelimitStorage: FromRef<S>,
+{
+    type Rejection = Json<RatelimitInformation>;
+
+    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {
+        if parts
+            .extensions
+            .get::<Result<Ratelimiter, Json<Ratelimiter>>>()
+            .is_none()
+        {
+            let ratelimiter = parts.extract_with_state::<Ratelimiter, S>(state).await;
+
+            parts.extensions.insert(ratelimiter);
+        };
+
+        let ratelimiter = *parts
+            .extensions
+            .get::<Result<Ratelimiter, Json<Ratelimiter>>>()
+            .unwrap();
+
+        match ratelimiter {
+            Ok(ratelimter) => Ok(RatelimitInformation::Success(ratelimter)),
+            Err(ratelimiter) => Err(Json(RatelimitInformation::Failure {
+                retry_after: ratelimiter.reset,
+            })),
+        }
+    }
+}
+
+pub async fn ratelimit_middleware(
+    State(database): State<Database>,
+    State(ratelimit_storage): State<RatelimitStorage>,
+    request: Request<Body>,
+    next: Next,
+) -> Response {
+    #[derive(axum::extract::FromRef)]
+    struct TempState {
+        database: Database,
+        ratelimit_storage: RatelimitStorage,
+    }
+
+    let state = TempState {
+        database,
+        ratelimit_storage,
+    };
+
+    let (mut parts, body) = request.into_parts();
+
+    let res = Ratelimiter::from_request_parts(&mut parts, &state).await;
+
+    let (Ok(ratelimiter) | Err(Json(ratelimiter))) = &res;
+
+    let mut response = if res.is_ok() {
+        let request = Request::from_parts(parts, body);
+
+        next.run(request).await
+    } else {
+        let ratelimit_info = RatelimitInformation::from_request_parts(&mut parts, &state).await;
+
+        ratelimit_info.map(Json).into_response()
+    };
+
+    let Ratelimiter {
+        key,
+        limit,
+        remaining,
+        reset,
+    } = ratelimiter;
+
+    let headers = response.headers_mut();
+
+    headers.insert(
+        "X-RateLimit-Limit",
+        HeaderValue::from_str(&limit.to_string()).unwrap(),
+    );
+    headers.insert(
+        "X-RateLimit-Bucket",
+        HeaderValue::from_str(&key.to_string()).unwrap(),
+    );
+    headers.insert(
+        "X-RateLimit-Remaining",
+        HeaderValue::from_str(&remaining.to_string()).unwrap(),
+    );
+    headers.insert(
+        "X-RateLimit-Reset-After",
+        HeaderValue::from_str(&reset.to_string()).unwrap(),
+    );
+
+    if res.is_err() {
+        *response.status_mut() = StatusCode::TOO_MANY_REQUESTS;
+    };
+
+    response
+}
+
+async fn ratelimit_info(info: RatelimitInformation) -> Json<RatelimitInformation> {
+    Json(info)
+}
+
+pub fn routes<S: Clone + Send + Sync + 'static>() -> Router<S>
+where
+    Database: FromRef<S>,
+    RatelimitStorage: FromRef<S>,
+{
+    Router::new().route("/ratelimit", get(ratelimit_info))
+}

crates/core/ratelimits/src/lib.rs

@@ -0,0 +1,7 @@
+pub mod ratelimiter;
+
+#[cfg(feature = "rocket")]
+pub mod rocket;
+
+#[cfg(feature = "axum")]
+pub mod axum;

crates/core/ratelimits/src/ratelimiter.rs

@@ -0,0 +1,145 @@
+use std::collections::hash_map::DefaultHasher;
+use std::hash::Hasher;
+use std::ops::Add;
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use serde::Serialize;
+
+use dashmap::DashMap;
+
+pub trait RequestKind {
+    type R<'a>;
+}
+
+pub trait RatelimitResolver<R>: Send + Sync {
+    fn resolve_bucket<'a>(&self, request: &'a R) -> (&'a str, Option<&'a str>);
+    fn resolve_bucket_limit(&self, bucket: &str) -> u32;
+}
+
+#[derive(Clone)]
+pub struct RatelimitStorage<K: RequestKind> {
+    pub resolver: Arc<dyn for<'a> RatelimitResolver<K::R<'a>>>,
+    pub map: Arc<DashMap<u64, Entry>>,
+}
+
+impl<K: RequestKind> RatelimitStorage<K> {
+    pub fn new<R: for<'a> RatelimitResolver<K::R<'a>> + 'static>(resolver: R) -> Self {
+        Self {
+            resolver: Arc::new(resolver),
+            map: Arc::new(DashMap::new()),
+        }
+    }
+}
+
+/// Ratelimit Bucket
+#[derive(Clone, Copy, Debug)]
+pub struct Entry {
+    used: u32,
+    reset: u128,
+}
+
+/// Get the current time from Unix Epoch as a Duration
+fn now() -> Duration {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .expect("Time went backwards...")
+}
+
+impl Entry {
+    /// Find bucket by its key
+    pub fn from(map: &DashMap<u64, Entry>, key: u64) -> Entry {
+        map.get(&key).map(|x| *x).unwrap_or_else(|| Entry {
+            used: 0,
+            reset: now().add(Duration::from_secs(10)).as_millis(),
+        })
+    }
+
+    /// Deduct one unit from the bucket and save
+    pub fn deduct(&mut self) {
+        let current_time = now().as_millis();
+        if current_time > self.reset {
+            self.used = 1;
+            self.reset = now().add(Duration::from_secs(10)).as_millis();
+        } else {
+            self.used += 1;
+        }
+    }
+
+    /// Save information
+    pub fn save(self, map: &DashMap<u64, Entry>, key: u64) {
+        map.insert(key, self);
+    }
+
+    /// Get remaining units in the bucket
+    pub fn get_remaining(&self, limit: u32) -> u32 {
+        if now().as_millis() > self.reset {
+            limit
+        } else {
+            limit - self.used
+        }
+    }
+
+    /// Get how long bucket has until reset
+    pub fn left_until_reset(&self) -> u128 {
+        let current_time = now().as_millis();
+        self.reset.saturating_sub(current_time)
+    }
+}
+
+/// Ratelimit Guard
+#[derive(Serialize, Clone, Copy, Debug)]
+#[allow(dead_code)]
+pub struct Ratelimiter {
+    pub key: u64,
+    pub limit: u32,
+    pub remaining: u32,
+    pub reset: u128,
+}
+
+impl Ratelimiter {
+    /// Generate guard from identifier and target bucket
+    pub fn from(
+        map: &DashMap<u64, Entry>,
+        identifier: &str,
+        limit: u32,
+        (bucket, resource): (&str, Option<&str>),
+    ) -> Result<Ratelimiter, Ratelimiter> {
+        let mut key = DefaultHasher::new();
+        key.write(identifier.as_bytes());
+        key.write(bucket.as_bytes());
+
+        if let Some(id) = resource {
+            key.write(id.as_bytes());
+        }
+
+        let key = key.finish();
+        let mut entry = Entry::from(map, key);
+
+        let remaining = entry.get_remaining(limit);
+        let reset = entry.left_until_reset();
+        let mut ratelimiter = Ratelimiter {
+            key,
+            limit,
+            remaining,
+            reset,
+        };
+        if remaining == 0 {
+            return Err(ratelimiter);
+        }
+
+        entry.deduct();
+        entry.save(map, key);
+        ratelimiter.remaining -= 1;
+        ratelimiter.reset = entry.left_until_reset();
+
+        Ok(ratelimiter)
+    }
+}
+
+#[derive(Serialize)]
+#[serde(untagged)]
+pub enum RatelimitInformation {
+    Success(Ratelimiter),
+    Failure { retry_after: u128 },
+}

crates/core/ratelimits/src/rocket.rs

@@ -0,0 +1,163 @@
+use async_trait::async_trait;
+use log::info;
+use rocket::fairing::{Fairing, Info, Kind};
+use rocket::http::uri::Origin;
+use rocket::http::{Method, Status};
+use rocket::request::{FromRequest, Outcome};
+use rocket::serde::json::Json;
+use rocket::{Data, Request, Response, State};
+use revolt_config::config;
+
+use revolt_rocket_okapi::r#gen::OpenApiGenerator;
+use revolt_rocket_okapi::request::{OpenApiFromRequest, RequestHeaderInput};
+
+use authifier::models::Session;
+
+use crate::ratelimiter::RequestKind;
+use crate::ratelimiter::{RatelimitInformation, Ratelimiter};
+
+#[derive(Clone, Copy)]
+pub struct RocketRequestKind;
+
+impl RequestKind for RocketRequestKind {
+    type R<'a> = Request<'a>;
+}
+
+pub type RatelimitStorage = crate::ratelimiter::RatelimitStorage<RocketRequestKind>;
+
+/// Find the remote IP of the client
+fn to_ip(request: &'_ rocket::Request<'_>) -> String {
+    request
+        .remote()
+        .map(|x| x.ip().to_string())
+        .unwrap_or_default()
+}
+
+/// Find the actual IP of the client
+async fn to_real_ip(request: &'_ rocket::Request<'_>) -> String {
+    if config().await.api.security.trust_cloudflare {
+        request
+            .headers()
+            .get_one("CF-Connecting-IP")
+            .map(|x| x.to_string())
+            .unwrap_or_else(|| to_ip(request))
+    } else {
+        to_ip(request)
+    }
+}
+
+#[async_trait]
+impl<'r> FromRequest<'r> for Ratelimiter {
+    type Error = Ratelimiter;
+
+    async fn from_request<'a>(request: &'r rocket::Request<'a>) -> Outcome<Self, Self::Error> {
+        let ratelimiter = request
+            .local_cache_async(async {
+                use rocket::outcome::Outcome;
+
+                let storage = request.guard::<&State<RatelimitStorage>>().await.unwrap();
+
+                let identifier = if let Outcome::Success(session) = request.guard::<Session>().await
+                {
+                    session.id
+                } else {
+                    to_real_ip(request).await
+                };
+
+                let (bucket, resource) = storage.resolver.resolve_bucket(request);
+                let limit = storage.resolver.resolve_bucket_limit(bucket);
+
+                Ratelimiter::from(&storage.map, &identifier, limit, (bucket, resource))
+            })
+            .await;
+
+        match ratelimiter {
+            Ok(ratelimiter) => Outcome::Success(*ratelimiter),
+            Err(ratelimiter) => Outcome::Error((Status::TooManyRequests, *ratelimiter)),
+        }
+    }
+}
+
+impl OpenApiFromRequest<'_> for Ratelimiter {
+    fn from_request_input(
+        _gen: &mut OpenApiGenerator,
+        _name: String,
+        _required: bool,
+    ) -> revolt_rocket_okapi::Result<RequestHeaderInput> {
+        Ok(RequestHeaderInput::None)
+    }
+}
+
+/// Attach ratelimiter to the Rocket application
+pub struct RatelimitFairing;
+
+#[async_trait]
+impl Fairing for RatelimitFairing {
+    fn info(&self) -> Info {
+        Info {
+            name: "Ratelimiter",
+            kind: Kind::Request | Kind::Response,
+        }
+    }
+
+    async fn on_request(&self, request: &mut Request<'_>, _: &mut Data<'_>) {
+        use rocket::outcome::Outcome;
+        if let Outcome::Error(_) = request.guard::<Ratelimiter>().await {
+            info!(
+                "User rate-limited on route {}! (IP = {:?})",
+                request.uri(),
+                to_real_ip(request).await
+            );
+
+            request.set_method(Method::Get);
+            request.set_uri(Origin::parse("/ratelimit").unwrap())
+        }
+    }
+
+    async fn on_response<'r>(&self, request: &'r Request<'_>, response: &mut Response<'r>) {
+        let guard = request.guard::<Ratelimiter>().await;
+        let (Outcome::Success(ratelimiter) | Outcome::Error((_, ratelimiter))) = guard else {
+            unreachable!()
+        };
+        let Ratelimiter {
+            key,
+            limit,
+            remaining,
+            reset,
+        } = ratelimiter;
+
+        response.set_raw_header("X-RateLimit-Limit", limit.to_string());
+        response.set_raw_header("X-RateLimit-Bucket", key.to_string());
+        response.set_raw_header("X-RateLimit-Remaining", remaining.to_string());
+        response.set_raw_header("X-RateLimit-Reset-After", reset.to_string());
+
+        if guard.is_error() {
+            response.set_status(Status::TooManyRequests);
+        }
+    }
+}
+
+#[async_trait]
+impl<'r> FromRequest<'r> for RatelimitInformation {
+    type Error = u128;
+
+    async fn from_request(request: &'r rocket::Request<'_>) -> Outcome<Self, Self::Error> {
+        let info = match request.guard::<Ratelimiter>().await {
+            Outcome::Success(ratelimiter) => RatelimitInformation::Success(ratelimiter),
+            Outcome::Error((_, ratelimiter)) => RatelimitInformation::Failure {
+                retry_after: ratelimiter.reset,
+            },
+            _ => unreachable!(),
+        };
+        Outcome::Success(info)
+    }
+}
+
+#[rocket::get("/ratelimit")]
+fn ratelimit_info(info: RatelimitInformation) -> Json<RatelimitInformation> {
+    Json(info)
+}
+
+pub fn routes() -> Vec<rocket::Route> {
+    rocket::routes![ratelimit_info]
+}

crates/core/result/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-result"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]

crates/core/result/src/axum.rs

@@ -78,6 +78,9 @@ impl IntoResponse for Error {
             ErrorType::InvalidFlagValue => StatusCode::BAD_REQUEST,
             ErrorType::FeatureDisabled { .. } => StatusCode::BAD_REQUEST,
 
+            ErrorType::MissingScope { .. } => StatusCode::UNAUTHORIZED,
+            ErrorType::ExpiredToken => StatusCode::UNAUTHORIZED,
+
             ErrorType::ProxyError => StatusCode::BAD_REQUEST,
             ErrorType::FileTooSmall => StatusCode::UNPROCESSABLE_ENTITY,
             ErrorType::FileTooLarge { .. } => StatusCode::UNPROCESSABLE_ENTITY,

crates/core/result/src/lib.rs

@@ -51,7 +51,7 @@ impl std::error::Error for Error {}
 #[cfg_attr(feature = "serde", serde(tag = "type"))]
 #[cfg_attr(feature = "schemas", derive(JsonSchema))]
 #[cfg_attr(feature = "utoipa", derive(ToSchema))]
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Eq, PartialEq)]
 pub enum ErrorType {
     /// This error was not labeled :(
     LabelMe,
@@ -168,6 +168,12 @@ pub enum ErrorType {
     ImageProcessingFailed,
     NoEmbedData,
 
+    // ? OAuth2 Errors
+    ExpiredToken,
+    MissingScope {
+        scope: String
+    },
+
     // ? Legacy errors
     VosoUnavailable,
 

crates/core/result/src/rocket.rs

@@ -84,6 +84,9 @@ impl<'r> Responder<'r, 'static> for Error {
             ErrorType::FailedValidation { .. } => Status::BadRequest,
             ErrorType::FeatureDisabled { .. } => Status::BadRequest,
 
+            ErrorType::MissingScope { .. } => Status::Unauthorized,
+            ErrorType::ExpiredToken => Status::Unauthorized,
+
             ErrorType::ProxyError => Status::BadRequest,
             ErrorType::FileTooSmall => Status::UnprocessableEntity,
             ErrorType::FileTooLarge { .. } => Status::UnprocessableEntity,

crates/daemons/crond/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-crond"
-version = "0.8.8"
+version = "0.8.9"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
 edition = "2021"
@@ -16,7 +16,7 @@ log = "0.4"
 tokio = { version = "1" }
 
 # Core
-revolt-database = { version = "0.8.8", path = "../../core/database" }
-revolt-result = { version = "0.8.8", path = "../../core/result" }
-revolt-config = { version = "0.8.8", path = "../../core/config" }
-revolt-files = { version = "0.8.8", path = "../../core/files" }
+revolt-database = { version = "0.8.9", path = "../../core/database" }
+revolt-result = { version = "0.8.9", path = "../../core/result" }
+revolt-config = { version = "0.8.9", path = "../../core/config" }
+revolt-files = { version = "0.8.9", path = "../../core/files" }

crates/daemons/crond/Dockerfile

@@ -1,5 +1,5 @@
 # Build Stage
-FROM ghcr.io/revoltchat/base:latest AS builder
+FROM ghcr.io/stoatchat/base:latest AS builder
 FROM debian:12 AS debian
 
 # Bundle Stage

crates/daemons/crond/src/main.rs

@@ -4,6 +4,8 @@ use revolt_result::Result;
 use tasks::{file_deletion, prune_dangling_files, prune_members};
 use tokio::try_join;
 
+use crate::tasks::prune_authorized_bots;
+
 pub mod tasks;
 
 #[tokio::main]
@@ -14,6 +16,7 @@ async fn main() -> Result<()> {
     try_join!(
         file_deletion::task(db.clone()),
         prune_dangling_files::task(db.clone()),
+        prune_authorized_bots::task(db.clone()),
         prune_members::task(db.clone())
     )
     .map(|_| ())

crates/daemons/crond/src/tasks/mod.rs

@@ -1,3 +1,4 @@
 pub mod file_deletion;
 pub mod prune_dangling_files;
+pub mod prune_authorized_bots;
 pub mod prune_members;

crates/daemons/crond/src/tasks/prune_authorized_bots.rs

@@ -0,0 +1,22 @@
+use revolt_database::{iso8601_timestamp::{Duration, Timestamp}, util::oauth2::TokenType, Database};
+use revolt_result::Result;
+use tokio::time::sleep;
+
+pub async fn task(db: Database) -> Result<()> {
+    let lifetime = Duration::new(TokenType::Access.lifetime().num_seconds(), 0);
+
+    loop {
+        let deauthorized_bots = db.fetch_deauthorized_authorized_bots().await?;
+
+        for bot in deauthorized_bots {
+            if let Some(deauthorized_at) = &bot.deauthorized_at {
+                if deauthorized_at.saturating_add(lifetime) < Timestamp::now_utc() {
+                    db.delete_authorized_bot(&bot.id).await?;
+                };
+            };
+        };
+
+        // 1 hour
+        sleep(std::time::Duration::from_secs(60 * 60)).await;
+    }
+}

crates/daemons/pushd/Cargo.toml

@@ -1,20 +1,20 @@
 [package]
 name = "revolt-pushd"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 
 [dependencies]
-revolt-result = { version = "0.8.8", path = "../../core/result" }
-revolt-config = { version = "0.8.8", path = "../../core/config", features = [
+revolt-result = { version = "0.8.9", path = "../../core/result" }
+revolt-config = { version = "0.8.9", path = "../../core/config", features = [
     "report-macros",
     "anyhow"
 ] }
-revolt-database = { version = "0.8.8", path = "../../core/database" }
-revolt-models = { version = "0.8.8", path = "../../core/models", features = [
+revolt-database = { version = "0.8.9", path = "../../core/database" }
+revolt-models = { version = "0.8.9", path = "../../core/models", features = [
     "validator",
 ] }
-revolt-presence = { version = "0.8.8", path = "../../core/presence", features = [
+revolt-presence = { version = "0.8.9", path = "../../core/presence", features = [
     "redis-is-patched",
 ] }
 

crates/daemons/pushd/Dockerfile

@@ -1,5 +1,5 @@
 # Build Stage
-FROM ghcr.io/revoltchat/base:latest AS builder
+FROM ghcr.io/stoatchat/base:latest AS builder
 FROM debian:12 AS debian
 
 # Bundle Stage

crates/delta/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-delta"
-version = "0.8.8"
+version = "0.8.9"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <paulmakles@gmail.com>"]
 edition = "2018"
@@ -81,6 +81,10 @@ revolt-models = { path = "../core/models", features = [
 revolt-presence = { path = "../core/presence" }
 revolt-result = { path = "../core/result", features = ["rocket", "okapi"] }
 revolt-permissions = { path = "../core/permissions", features = ["schemas"] }
+revolt-ratelimits = { path = "../core/ratelimits", features = ["rocket"] }
+
+# oauth2
+pkce = "0.2.0"
 
 [build-dependencies]
 vergen = "7.5.0"

crates/delta/Dockerfile

@@ -1,5 +1,5 @@
 # Build Stage
-FROM ghcr.io/revoltchat/base:latest AS builder
+FROM ghcr.io/stoatchat/base:latest AS builder
 FROM debian:12 AS debian
 
 # Bundle Stage

crates/delta/src/main.rs

@@ -11,6 +11,7 @@ pub mod util;
 use revolt_config::config;
 use revolt_database::events::client::EventV1;
 use revolt_database::AMQP;
+use revolt_ratelimits::rocket as ratelimiter;
 use rocket::{Build, Rocket};
 use rocket_cors::{AllowedOrigins, CorsOptions};
 use rocket_prometheus::PrometheusMetrics;
@@ -122,18 +123,22 @@ pub async fn web() -> Rocket<Build> {
     let rocket = rocket::build();
     let prometheus = PrometheusMetrics::new();
 
+    // Ratelimits
+    let ratelimits = ratelimiter::RatelimitStorage::new(util::ratelimits::DeltaRatelimits);
+
     routes::mount(config, rocket)
         .attach(prometheus.clone())
         .mount("/metrics", prometheus)
         .mount("/", rocket_cors::catch_all_options_routes())
-        .mount("/", util::ratelimiter::routes())
+        .mount("/", ratelimiter::routes())
         .mount("/swagger/", swagger)
         .mount("/0.8/swagger/", swagger_0_8)
         .manage(authifier)
         .manage(db)
         .manage(amqp)
         .manage(cors.clone())
-        .attach(util::ratelimiter::RatelimitFairing)
+        .manage(ratelimits)
+        .attach(ratelimiter::RatelimitFairing)
         .attach(cors)
         .configure(rocket::Config {
             limits: rocket::data::Limits::default().limit("string", 5.megabytes()),

crates/delta/src/routes/bots/edit.rs

@@ -37,6 +37,7 @@ pub async fn edit_bot(
     if data.public.is_none()
         && data.analytics.is_none()
         && data.interactions_url.is_none()
+        && data.oauth2.is_none()
         && data.remove.is_empty()
     {
         return Ok(Json(v0::BotWithUserResponse {
@@ -49,17 +50,43 @@ pub async fn edit_bot(
         public,
         analytics,
         interactions_url,
+        oauth2,
         remove,
         ..
     } = data;
 
-    let partial = PartialBot {
+    let mut partial = PartialBot {
         public,
         analytics,
         interactions_url,
         ..Default::default()
     };
 
+    if let Some(edit_oauth2) = oauth2 {
+        let mut oauth2 = bot.oauth2.clone().unwrap_or_default();
+
+        if let Some(public) = edit_oauth2.public {
+            if oauth2.public && !public {
+                oauth2.secret = Some(nanoid::nanoid!(64))
+            } else if !oauth2.public && public {
+                oauth2.secret = None;
+            };
+
+            oauth2.public = public;
+        }
+
+        oauth2.redirects = edit_oauth2.redirects.unwrap_or(oauth2.redirects);
+        oauth2.allowed_scopes = edit_oauth2.allowed_scopes
+            .map(|scopes|scopes
+                .into_iter()
+                .map(|(scope, value)| (scope.into(), value.into()))
+                .collect()
+            )
+            .unwrap_or(oauth2.allowed_scopes);
+
+        partial.oauth2 = Some(oauth2)
+    }
+
     bot.update(
         db,
         partial,

crates/delta/src/routes/mod.rs

@@ -8,6 +8,7 @@ mod bots;
 mod channels;
 mod customisation;
 mod invites;
+mod oauth2;
 mod onboard;
 mod policy;
 mod push;
@@ -31,6 +32,7 @@ pub fn mount(config: Settings, mut rocket: Rocket<Build>) -> Rocket<Build> {
             "/channels" => channels::routes(),
             "/servers" => servers::routes(),
             "/invites" => invites::routes(),
+            "/oauth2" => oauth2::routes(),
             "/custom" => customisation::routes(),
             "/safety" => safety::routes(),
             "/auth/account" => rocket_authifier::routes::account::routes(),
@@ -52,6 +54,7 @@ pub fn mount(config: Settings, mut rocket: Rocket<Build>) -> Rocket<Build> {
             "/channels" => channels::routes(),
             "/servers" => servers::routes(),
             "/invites" => invites::routes(),
+            "/oauth2" => oauth2::routes(),
             "/custom" => customisation::routes(),
             "/safety" => safety::routes(),
             "/auth/account" => rocket_authifier::routes::account::routes(),
@@ -74,6 +77,7 @@ pub fn mount(config: Settings, mut rocket: Rocket<Build>) -> Rocket<Build> {
             "/channels" => channels::routes(),
             "/servers" => servers::routes(),
             "/invites" => invites::routes(),
+            "/oauth2" => oauth2::routes(),
             "/custom" => customisation::routes(),
             "/safety" => safety::routes(),
             "/auth/account" => rocket_authifier::routes::account::routes(),
@@ -94,6 +98,7 @@ pub fn mount(config: Settings, mut rocket: Rocket<Build>) -> Rocket<Build> {
             "/channels" => channels::routes(),
             "/servers" => servers::routes(),
             "/invites" => invites::routes(),
+            "/oauth2" => oauth2::routes(),
             "/custom" => customisation::routes(),
             "/safety" => safety::routes(),
             "/auth/account" => rocket_authifier::routes::account::routes(),
@@ -198,7 +203,13 @@ fn custom_openapi_spec() -> OpenApi {
               "Sync",
               "Web Push"
             ]
-          }
+          },
+          {
+            "name": "OAuth2",
+            "tags": [
+                "OAuth2",
+            ]
+          },
         ]),
     );
 
@@ -370,6 +381,11 @@ fn custom_openapi_spec() -> OpenApi {
                 description: Some("Send messages from 3rd party services".to_owned()),
                 ..Default::default()
             },
+            Tag {
+                name: "OAuth2".to_owned(),
+                description: Some("Integrate Revolt into 3rd party applications".to_owned()),
+                ..Default::default()
+            },
         ],
         ..Default::default()
     }

crates/delta/src/routes/oauth2/authorize_auth.rs

@@ -0,0 +1,111 @@
+use iso8601_timestamp::Timestamp;
+use revolt_config::config;
+use revolt_database::{
+    util::{oauth2, reference::Reference}, AuthorizedBot, AuthorizedBotId, Database, User
+};
+use revolt_models::v0;
+use revolt_result::{create_error, Result};
+use rocket::{serde::json::Json, State};
+
+/// # OAuth2 Authorization Auth
+///
+/// Generates an OAuth2 code to be passed to the redirect URI.
+#[openapi(tag = "OAuth2")]
+#[post("/authorize?<info..>")]
+pub async fn auth(
+    db: &State<Database>,
+    user: User,
+    info: v0::OAuth2AuthorizationForm,
+) -> Result<Json<v0::OAuth2AuthorizeAuthResponse>> {
+    if user.bot.is_some() {
+        return Err(create_error!(IsBot));
+    };
+
+    let bot = Reference::from_unchecked(&info.client_id)
+        .as_bot(db)
+        .await?;
+
+    let Some(oauth2) = &bot.oauth2 else {
+        return Err(create_error!(InvalidOperation));
+    };
+
+    let Some(scopes) = v0::OAuth2Scope::scopes_from_str(&info.scope) else {
+        return Err(create_error!(InvalidOperation));
+    };
+
+    if scopes.iter().any(|&scope| !oauth2.allowed_scopes.contains_key(&scope.into()))
+        || !oauth2.redirects.contains(&info.redirect_uri)
+        || v0::OAuth2Scope::scopes_from_str(&info.scope).is_none()
+    {
+        return Err(create_error!(InvalidOperation));
+    };
+
+    let config = config().await;
+
+    let token = match info.response_type {
+        // implicit
+        v0::OAuth2ResponseType::Code => {
+            if info.state.is_some() || info.code_challenge.is_some() || info.code_challenge_method.is_some() {
+                return Err(create_error!(InvalidOperation));
+            };
+
+            let token = oauth2::encode_token(
+                &config.api.security.token_secret,
+                oauth2::TokenType::Auth,
+                user.id.clone(),
+                info.client_id.clone(),
+                info.redirect_uri.clone(),
+                scopes.clone(),
+                info.code_challenge_method,
+            )
+            .map_err(|_| create_error!(InternalError))?;
+
+            db.insert_authorized_bot(&AuthorizedBot {
+                id: AuthorizedBotId { bot: info.client_id.clone(), user: user.id.clone() },
+                created_at: Timestamp::now_utc(),
+                deauthorized_at: None,
+                scope: scopes.iter().map(|&scope| scope.into()).collect()
+            }).await?;
+
+            token
+        },
+        // authorization code
+        v0::OAuth2ResponseType::Token => {
+            if let Some(((state, code_challange), code_challange_method)) = info.state.as_ref().zip(info.code_challenge.as_ref()).zip(info.code_challenge_method) {
+                let is_valid = match code_challange_method {
+                    v0::OAuth2CodeChallangeMethod::Plain => state == code_challange,
+                    v0::OAuth2CodeChallangeMethod::S256 => &pkce::code_challenge(state.as_bytes()) == code_challange,
+                };
+
+                if !is_valid || state.len() <= 43 || state.len() >= 128 {
+                    return Err(create_error!(InvalidOperation))
+                }
+
+            } else if !oauth2.public {
+                return Err(create_error!(InvalidOperation))
+            };
+
+            let token = oauth2::encode_token(
+                &config.api.security.token_secret,
+                oauth2::TokenType::Auth,
+                user.id.clone(),
+                info.client_id.clone(),
+                info.redirect_uri.clone(),
+                scopes.clone(),
+                info.code_challenge_method,
+            )
+            .map_err(|_| create_error!(InternalError))?;
+
+            if let Some(code_challenge) = info.code_challenge.as_ref() {
+                oauth2::add_code_challange(&token, code_challenge).await?;
+            };
+
+            token
+
+        },
+    };
+
+    let redirect_uri = format!("{}/?code={token}", &info.redirect_uri);
+
+    Ok(Json(v0::OAuth2AuthorizeAuthResponse { redirect_uri }))
+}

crates/delta/src/routes/oauth2/authorize_info.rs

@@ -0,0 +1,40 @@
+use revolt_database::{util::reference::Reference, Database, User};
+use revolt_models::v0;
+use revolt_result::{create_error, Result};
+use rocket::{serde::json::Json, State};
+
+/// # Authorize OAuth Information
+///
+/// Fetches the information needed for displaying on the OAuth grant page
+#[openapi(tag = "OAuth2")]
+#[get("/authorize?<info..>")]
+pub async fn info(
+    db: &State<Database>,
+    user: User,
+    info: v0::OAuth2AuthorizationForm,
+) -> Result<Json<v0::OAuth2AuthorizeInfoResponse>> {
+    if user.bot.is_some() {
+        return Err(create_error!(IsBot));
+    };
+
+    let bot = Reference::from_unchecked(&info.client_id).as_bot(db).await?;
+    let bot_user = Reference::from_unchecked(&bot.id).as_user(db).await?;
+    let public_bot = bot.clone().into_public_bot(bot_user);
+
+    let Some(oauth2) = &bot.oauth2 else {
+        return Err(create_error!(InvalidOperation));
+    };
+
+    if !oauth2.redirects.contains(&info.redirect_uri) || v0::OAuth2Scope::scopes_from_str(&info.scope).is_none() {
+        return Err(create_error!(InvalidOperation));
+    };
+
+    Ok(Json(v0::OAuth2AuthorizeInfoResponse {
+        bot: public_bot,
+        user: user.into(db, None).await,
+        allowed_scopes: oauth2.allowed_scopes.clone()
+            .into_iter()
+            .map(|(scope, value)| (scope.into(), value.into()))
+            .collect()
+    }))
+}

crates/delta/src/routes/oauth2/authorized_bots.rs

@@ -0,0 +1,27 @@
+use revolt_models::v0;
+use rocket::{serde::json::Json, State};
+use revolt_database::{Database, User};
+use revolt_result::Result;
+
+#[openapi(tag = "OAuth2")]
+#[get("/authorized_bots")]
+pub async fn authorized_bots(
+    db: &State<Database>,
+    user: User
+) -> Result<Json<Vec<v0::AuthorizedBotsResponse>>> {
+    let authorized_bots = db.fetch_users_authorized_bots(&user.id).await?;
+
+    let mut response = Vec::new();
+
+    for authorized_bot in authorized_bots {
+        let bot = db.fetch_bot(&authorized_bot.id.bot).await?;
+        let bot_user = db.fetch_user(&authorized_bot.id.bot).await?;
+
+        response.push(v0::AuthorizedBotsResponse {
+            authorized_bot: authorized_bot.into(),
+            public_bot: bot.into_public_bot(bot_user)
+        });
+    };
+
+    Ok(Json(response))
+}

crates/delta/src/routes/oauth2/mod.rs

@@ -0,0 +1,24 @@
+use revolt_rocket_okapi::revolt_okapi::openapi3::OpenApi;
+use rocket::Route;
+
+mod authorize_auth;
+mod authorize_info;
+mod authorized_bots;
+mod revoke;
+mod token;
+
+// TODO
+// Scopes:
+// - identity
+// - servers
+// - full
+
+pub fn routes() -> (Vec<Route>, OpenApi) {
+    openapi_get_routes_spec![
+        authorize_auth::auth,
+        authorize_info::info,
+        authorized_bots::authorized_bots,
+        revoke::revoke,
+        token::token,
+    ]
+}

crates/delta/src/routes/oauth2/revoke.rs

@@ -0,0 +1,50 @@
+use revolt_config::config;
+use revolt_models::v0;
+use rocket::{serde::json::Json, State};
+use revolt_database::{util::oauth2::{self, TokenType}, AuthorizedBotId, Database, User};
+use revolt_result::{create_error, Result};
+
+/// Revoke an OAuth2 token
+///
+/// This can either take user authorization and a client_id,
+/// or an OAuth2 token.
+#[openapi(tag = "OAuth2")]
+#[post("/revoke?<token>&<client_id>")]
+pub async fn revoke(
+    db: &State<Database>,
+    user: Option<User>,
+    token: Option<&str>,
+    client_id: Option<&str>
+) -> Result<Json<v0::AuthorizedBot>> {
+    let config = config().await;
+
+    let (user_id, bot_id) = match (user, client_id, token) {
+        (Some(user), Some(client_id), None) => {
+            (user.id.clone(), client_id.to_string())
+        },
+        (_, None, Some(token)) => {
+            let Ok(claims) = oauth2::decode_token(&config.api.security.token_secret, token) else {
+                return Err(create_error!(NotAuthenticated))
+            };
+
+            if claims.r#type == TokenType::Auth {
+                return Err(create_error!(InvalidOperation))
+            }
+
+            (claims.sub, claims.client_id)
+        },
+        _ => return Err(create_error!(InvalidOperation))
+    };
+
+    let id = AuthorizedBotId { user: user_id, bot: bot_id };
+
+    let authorized_bot = db.fetch_authorized_bot(&id).await?;
+
+    if authorized_bot.deauthorized_at.is_some() {
+        return Err(create_error!(InvalidOperation))
+    }
+
+    db.deauthorize_authorized_bot(&id)
+        .await
+        .map(|bot| Json(bot.into()))
+}

crates/delta/src/routes/oauth2/token.rs

@@ -0,0 +1,165 @@
+use chrono::Utc;
+use iso8601_timestamp::Timestamp;
+use revolt_config::config;
+use revolt_database::{
+    util::{
+        oauth2,
+        reference::Reference,
+    }, AuthorizedBot, AuthorizedBotId, Database
+};
+use revolt_models::v0;
+use revolt_result::{create_error, ErrorType, Result};
+use rocket::{form::Form, serde::json::Json, State};
+
+/// # OAuth Token Exchange
+///
+///
+#[openapi(tag = "OAuth2")]
+#[post("/token", data = "<info>")]
+pub async fn token(
+    db: &State<Database>,
+    info: Form<v0::OAuth2TokenExchangeForm>,
+) -> Result<Json<v0::OAuth2TokenExchangeResponse>> {
+    let bot = Reference::from_unchecked(&info.client_id)
+        .as_bot(db)
+        .await?;
+
+    let config = config().await;
+
+    let (token, token_type) = match (&info.code, &info.refresh_token) {
+        (Some(code), None) => {
+            (code, oauth2::TokenType::Auth)
+        },
+        (None, Some(refresh_token)) => {
+            (refresh_token, oauth2::TokenType::Refresh)
+        },
+        (Some(_), Some(_)) | (None, None) => {
+            return Err(create_error!(InvalidOperation))
+        }
+    };
+
+    let claims = oauth2::decode_token(&config.api.security.token_secret, token)
+        .map_err(|_| create_error!(NotAuthenticated))?;
+
+    if claims.r#type != token_type || claims.client_id != info.client_id || claims.exp < Utc::now().timestamp() {
+        return Err(create_error!(NotAuthenticated))
+    };
+
+    if let Ok(authorized_bot) = db.fetch_authorized_bot(&AuthorizedBotId { user: claims.sub.clone(), bot: claims.client_id.clone() }).await {
+        if authorized_bot.deauthorized_at.is_some() {
+            return Err(create_error!(NotAuthenticated));
+        }
+    };
+
+    // TODO: track used tokens and dont allow them to be used twice
+    //  - refresh token
+    //  - auth tokens (only last 5 mins but still should be considered)
+
+    match info.grant_type {
+        v0::OAuth2GrantType::AuthorizationCode => {
+            if claims.r#type != oauth2::TokenType::Auth {
+                return Err(create_error!(InvalidOperation))
+            }
+
+            if let Some((client_secret, bot_secret)) = info.client_secret.as_ref().zip(bot.oauth2.as_ref().and_then(|oauth2| oauth2.secret.as_ref())) {
+                if client_secret != bot_secret {
+                    return Err(create_error!(NotAuthenticated))
+                }
+            } else if let Some((code_verifier, method)) = info.code_verifier.as_ref().zip(claims.code_challange_method) {
+                let Some(server_code_challenge) = oauth2::get_code_challange(token).await? else {
+                    return Err(create_error!(NotAuthenticated))
+                };
+
+                let is_valid = match method {
+                    v0::OAuth2CodeChallangeMethod::Plain => &server_code_challenge == code_verifier,
+                    v0::OAuth2CodeChallangeMethod::S256 => pkce::code_challenge(code_verifier.as_bytes()) == server_code_challenge,
+                };
+
+                if !is_valid {
+                    return Err(create_error!(NotAuthenticated))
+                }
+            } else {
+                return Err(create_error!(NotAuthenticated))
+            }
+
+            let token = oauth2::encode_token(
+                &config.api.security.token_secret,
+                oauth2::TokenType::Access,
+                claims.sub.clone(),
+                claims.client_id.clone(),
+                claims.redirect_uri.clone(),
+                claims.scopes.clone(),
+                None,
+            )
+            .map_err(|_| create_error!(InternalError))?;
+
+            let refresh_token = oauth2::encode_token(
+                &config.api.security.token_secret,
+                oauth2::TokenType::Refresh,
+                claims.sub.clone(),
+                claims.client_id.clone(),
+                claims.redirect_uri.clone(),
+                claims.scopes.clone(),
+                None,
+            )
+            .map_err(|_| create_error!(InternalError))?;
+
+            let authorized_bot_id = AuthorizedBotId { bot: claims.client_id.clone(), user: claims.sub.clone() };
+            let auth_bot = db.fetch_authorized_bot(&authorized_bot_id).await;
+
+            if auth_bot.is_err_and(|err| err.error_type == ErrorType::NotFound) {
+                db.insert_authorized_bot(&AuthorizedBot {
+                    id: authorized_bot_id,
+                    created_at: Timestamp::now_utc(),
+                    deauthorized_at: None,
+                    scope: claims.scopes.iter().map(|&scope| scope.into()).collect()
+                }).await?;
+            }
+
+            Ok(Json(v0::OAuth2TokenExchangeResponse {
+                access_token: token,
+                refresh_token: Some(refresh_token),
+                token_type: "OAuth2".to_string(),
+                scope: claims.scopes.iter().map(|scope| scope.to_string()).collect::<Vec<_>>().join(" "),
+            }))
+        },
+        v0::OAuth2GrantType::RefreshToken => {
+            if claims.r#type != oauth2::TokenType::Refresh {
+                return Err(create_error!(InvalidOperation))
+            };
+
+            let token = oauth2::encode_token(
+                &config.api.security.token_secret,
+                oauth2::TokenType::Access,
+                claims.sub.clone(),
+                claims.client_id.clone(),
+                claims.redirect_uri.clone(),
+                claims.scopes.clone(),
+                None,
+            )
+            .map_err(|_| create_error!(InternalError))?;
+
+            let refresh_token = oauth2::encode_token(
+                &config.api.security.token_secret,
+                oauth2::TokenType::Refresh,
+                claims.sub.clone(),
+                claims.client_id.clone(),
+                claims.redirect_uri.clone(),
+                claims.scopes.clone(),
+                None,
+            )
+            .map_err(|_| create_error!(InternalError))?;
+
+            Ok(Json(v0::OAuth2TokenExchangeResponse {
+                access_token: token,
+                refresh_token: Some(refresh_token),
+                token_type: "OAuth2".to_string(),
+                scope: claims.scopes.iter().map(|scope| scope.to_string()).collect::<Vec<_>>().join(" "),
+            }))
+        }
+        v0::OAuth2GrantType::Implicit => {
+            // token is already an access token so this endpoint does not need to be called - in theory this should be unreachable
+            Err(create_error!(InvalidOperation))
+        }
+    }
+}

crates/delta/src/routes/servers/mod.rs

@@ -29,7 +29,7 @@ pub fn routes() -> (Vec<Route>, OpenApi) {
     openapi_get_routes_spec![
         server_create::create_server,
         server_delete::delete,
-        server_fetch::fetch,
+        server_fetch::fetch_server,
         server_edit::edit,
         server_ack::ack,
         channel_create::create_server_channel,

crates/delta/src/routes/servers/server_fetch.rs

@@ -1,5 +1,5 @@
 use revolt_database::{
-    util::{permissions::DatabasePermissionQuery, reference::Reference},
+    util::{oauth2::{scopes, OAuth2Scoped}, permissions::DatabasePermissionQuery, reference::Reference},
     Database, User,
 };
 use revolt_models::v0;
@@ -12,8 +12,9 @@ use rocket::{serde::json::Json, State};
 /// Fetch a server by its id.
 #[openapi(tag = "Server Information")]
 #[get("/<target>?<options..>")]
-pub async fn fetch(
+pub async fn fetch_server(
     db: &State<Database>,
+    _oauth2_scope: OAuth2Scoped<scopes::ReadServers>,
     user: User,
     target: Reference<'_>,
     options: v0::OptionsFetchServer,

crates/delta/src/routes/users/fetch_self.rs

@@ -1,4 +1,4 @@
-use revolt_database::User;
+use revolt_database::{User, util::oauth2::{OAuth2Scoped, scopes}};
 use revolt_models::v0;
 use revolt_result::Result;
 use rocket::serde::json::Json;
@@ -8,6 +8,9 @@ use rocket::serde::json::Json;
 /// Retrieve your user information.
 #[openapi(tag = "User Information")]
 #[get("/@me")]
-pub async fn fetch(user: User) -> Result<Json<v0::User>> {
+pub async fn fetch_self(
+    _oauth2_scope: OAuth2Scoped<scopes::ReadIdentify>,
+    user: User
+) -> Result<Json<v0::User>> {
     Ok(Json(user.into_self(false).await))
 }

crates/delta/src/routes/users/fetch_self_servers.rs

@@ -0,0 +1,54 @@
+use revolt_database::{util::{oauth2::{scopes, OAuth2Scoped}, permissions::DatabasePermissionQuery}, Database, User};
+use revolt_models::v0;
+use revolt_permissions::{calculate_channel_permissions, ChannelPermission};
+use revolt_result::Result;
+use rocket::{serde::json::Json, State};
+
+/// # Fetch current user's servers
+///
+/// Retrieve all servers the current user is in.
+#[openapi(tag = "User Information")]
+#[get("/@me/servers?<options..>")]
+pub async fn fetch_self_servers(
+    db: &State<Database>,
+    _oauth2_scope: OAuth2Scoped<scopes::ReadServers>,
+    user: User,
+    options: v0::OptionsFetchServer,
+) -> Result<Json<Vec<v0::FetchServerResponse>>> {
+    let members = db.fetch_all_memberships(&user.id).await?;
+
+    let server_ids = members
+        .iter()
+        .map(|x| x.id.server.clone())
+        .collect::<Vec<_>>();
+
+    let mut servers: Vec<v0::FetchServerResponse> = Vec::new();
+
+    for server in db.fetch_servers(&server_ids).await? {
+        if let Some(true) = options.include_channels {
+            let query = DatabasePermissionQuery::new(db, &user).server(&server);
+
+            let all_channels = db.fetch_channels(&server.channels).await?;
+            let mut visible_channels: Vec<v0::Channel> = vec![];
+
+            for channel in all_channels {
+                let mut channel_query = query.clone().channel(&channel);
+                if calculate_channel_permissions(&mut channel_query)
+                    .await
+                    .has_channel_permission(ChannelPermission::ViewChannel)
+                {
+                    visible_channels.push(channel.into());
+                }
+            }
+
+            servers.push(v0::FetchServerResponse::ServerWithChannels {
+                server: server.into(),
+                channels: visible_channels,
+            });
+        } else {
+            servers.push(v0::FetchServerResponse::JustServer(server.into()))
+        }
+    }
+
+    Ok(Json(servers))
+}

crates/delta/src/routes/users/mod.rs

@@ -7,6 +7,7 @@ mod change_username;
 mod edit_user;
 mod fetch_dms;
 mod fetch_profile;
+mod fetch_self_servers;
 mod fetch_self;
 mod fetch_user;
 mod fetch_user_flags;
@@ -20,7 +21,8 @@ mod unblock_user;
 pub fn routes() -> (Vec<Route>, OpenApi) {
     openapi_get_routes_spec![
         // User Information
-        fetch_self::fetch,
+        fetch_self::fetch_self,
+        fetch_self_servers::fetch_self_servers,
         fetch_user::fetch,
         fetch_user_flags::fetch_user_flags,
         edit_user::edit,

crates/delta/src/util/mod.rs

@@ -1,2 +1,2 @@
-pub mod ratelimiter;
+pub mod ratelimits;
 pub mod test;

crates/delta/src/util/ratelimiter.rs

@@ -1,347 +0,0 @@
-use std::collections::hash_map::DefaultHasher;
-use std::hash::Hasher;
-use std::ops::Add;
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
-
-use authifier::models::Session;
-use rocket::fairing::{Fairing, Info, Kind};
-use rocket::http::uri::Origin;
-use rocket::http::{Method, Status};
-use rocket::request::{FromRequest, Outcome};
-use rocket::serde::json::Json;
-use rocket::{Data, Request, Response};
-
-use revolt_rocket_okapi::gen::OpenApiGenerator;
-use revolt_rocket_okapi::request::{OpenApiFromRequest, RequestHeaderInput};
-
-use serde::Serialize;
-
-use dashmap::DashMap;
-use once_cell::sync::Lazy;
-
-/// Ratelimit Bucket
-#[derive(Clone, Copy, Debug)]
-struct Entry {
-    used: u8,
-    reset: u128,
-}
-
-static MAP: Lazy<DashMap<u64, Entry>> = Lazy::new(DashMap::new);
-
-/// Get the current time from Unix Epoch as a Duration
-fn now() -> Duration {
-    SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .expect("Time went backwards...")
-}
-
-impl Entry {
-    /// Find bucket by its key
-    pub fn from(key: u64) -> Entry {
-        MAP.get(&key).map(|x| *x).unwrap_or_else(|| Entry {
-            used: 0,
-            reset: now().add(Duration::from_secs(10)).as_millis(),
-        })
-    }
-
-    /// Deduct one unit from the bucket and save
-    pub fn deduct(&mut self) {
-        let current_time = now().as_millis();
-        if current_time > self.reset {
-            self.used = 1;
-            self.reset = now().add(Duration::from_secs(10)).as_millis();
-        } else {
-            self.used += 1;
-        }
-    }
-
-    /// Save information
-    pub fn save(self, key: u64) {
-        MAP.insert(key, self);
-    }
-
-    /// Get remaining units in the bucket
-    pub fn get_remaining(&self, limit: u8) -> u8 {
-        if now().as_millis() > self.reset {
-            limit
-        } else {
-            limit - self.used
-        }
-    }
-
-    /// Get how long bucket has until reset
-    pub fn left_until_reset(&self) -> u128 {
-        let current_time = now().as_millis();
-        if current_time > self.reset {
-            0
-        } else {
-            self.reset - current_time
-        }
-    }
-}
-
-/// Ratelimit Guard
-#[derive(Serialize, Clone, Copy, Debug)]
-#[allow(dead_code)]
-pub struct Ratelimiter {
-    key: u64,
-    limit: u8,
-    remaining: u8,
-    reset: u128,
-}
-
-/// Find bucket from given request
-///
-/// Optionally, include a resource id to hash against.
-fn resolve_bucket<'r>(request: &'r rocket::Request<'_>) -> (&'r str, Option<&'r str>) {
-    let (segment, resource, extra) = if matches!(request.routed_segment(0), Some("0.8")) {
-        (
-            request.routed_segment(1),
-            request.routed_segment(2),
-            request.routed_segment(3),
-        )
-    } else {
-        (
-            request.routed_segment(0),
-            request.routed_segment(1),
-            request.routed_segment(2),
-        )
-    };
-
-    if let Some(segment) = segment {
-        #[allow(clippy::redundant_locals)]
-        let resource = resource;
-
-        let method = request.method();
-        match (segment, resource, method) {
-            ("users", target, Method::Patch) => ("user_edit", target),
-            ("users", _, _) => {
-                if let Some("default_avatar") = extra {
-                    return ("default_avatar", None);
-                }
-
-                ("users", None)
-            }
-            ("bots", _, _) => ("bots", None),
-            ("channels", Some(id), _) => {
-                if request.method() == Method::Post {
-                    if let Some("messages") = extra {
-                        return ("messaging", Some(id));
-                    }
-                }
-
-                ("channels", Some(id))
-            }
-            ("servers", Some(id), _) => ("servers", Some(id)),
-            ("auth", _, _) => {
-                if request.method() == Method::Delete {
-                    ("auth_delete", None)
-                } else {
-                    ("auth", None)
-                }
-            }
-            ("swagger", _, _) => ("swagger", None),
-            ("safety", Some("report"), _) => ("safety_report", Some("report")),
-            ("safety", _, _) => ("safety", None),
-            _ => ("any", None),
-        }
-    } else {
-        ("any", None)
-    }
-}
-
-/// Resolve per-bucket limits
-fn resolve_bucket_limit(bucket: &str) -> u8 {
-    match bucket {
-        "user_edit" => 2,
-        "users" => 20,
-        "bots" => 10,
-        "messaging" => 10,
-        "channels" => 15,
-        "servers" => 5,
-        "auth" => 15,
-        "auth_delete" => 255,
-        "default_avatar" => 255,
-        "swagger" => 100,
-        "safety" => 15,
-        "safety_report" => 3,
-        _ => 20,
-    }
-}
-
-/// Find the remote IP of the client
-fn to_ip(request: &'_ rocket::Request<'_>) -> String {
-    request
-        .remote()
-        .map(|x| x.ip().to_string())
-        .unwrap_or_default()
-}
-
-/// Find the actual IP of the client
-fn to_real_ip(request: &'_ rocket::Request<'_>) -> String {
-    if let Ok(true) = std::env::var("TRUST_CLOUDFLARE").map(|x| x == "1") {
-        request
-            .headers()
-            .get_one("CF-Connecting-IP")
-            .map(|x| x.to_string())
-            .unwrap_or_else(|| to_ip(request))
-    } else {
-        to_ip(request)
-    }
-}
-
-impl Ratelimiter {
-    /// Generate guard from identifier and target bucket
-    pub fn from(
-        identifier: &str,
-        (bucket, resource): (&str, Option<&str>),
-    ) -> Result<Ratelimiter, Ratelimiter> {
-        let mut key = DefaultHasher::new();
-        key.write(identifier.as_bytes());
-        key.write(bucket.as_bytes());
-
-        if let Some(id) = resource {
-            key.write(id.as_bytes());
-        }
-
-        let key = key.finish();
-        let limit = resolve_bucket_limit(bucket);
-        let mut entry = Entry::from(key);
-
-        let remaining = entry.get_remaining(limit);
-        let reset = entry.left_until_reset();
-        let mut ratelimiter = Ratelimiter {
-            key,
-            limit,
-            remaining,
-            reset,
-        };
-        if remaining == 0 {
-            return Err(ratelimiter);
-        }
-
-        entry.deduct();
-        entry.save(key);
-        ratelimiter.remaining -= 1;
-        ratelimiter.reset = entry.left_until_reset();
-
-        Ok(ratelimiter)
-    }
-}
-
-#[async_trait]
-impl<'r> FromRequest<'r> for Ratelimiter {
-    type Error = Ratelimiter;
-
-    async fn from_request(request: &'r rocket::Request<'_>) -> Outcome<Self, Self::Error> {
-        let ratelimiter = request
-            .local_cache_async(async {
-                use rocket::outcome::Outcome;
-                let identifier = if let Outcome::Success(session) = request.guard::<Session>().await
-                {
-                    session.id
-                } else {
-                    to_real_ip(request)
-                };
-
-                Ratelimiter::from(&identifier, resolve_bucket(request))
-            })
-            .await;
-
-        match ratelimiter {
-            Ok(ratelimiter) => Outcome::Success(*ratelimiter),
-            Err(ratelimiter) => Outcome::Error((Status::TooManyRequests, *ratelimiter)),
-        }
-    }
-}
-
-impl OpenApiFromRequest<'_> for Ratelimiter {
-    fn from_request_input(
-        _gen: &mut OpenApiGenerator,
-        _name: String,
-        _required: bool,
-    ) -> revolt_rocket_okapi::Result<RequestHeaderInput> {
-        Ok(RequestHeaderInput::None)
-    }
-}
-
-/// Attach ratelimiter to the Rocket application
-pub struct RatelimitFairing;
-
-#[rocket::async_trait]
-impl Fairing for RatelimitFairing {
-    fn info(&self) -> Info {
-        Info {
-            name: "Ratelimiter",
-            kind: Kind::Request | Kind::Response,
-        }
-    }
-
-    async fn on_request(&self, request: &mut Request<'_>, _: &mut Data<'_>) {
-        use rocket::outcome::Outcome;
-        if let Outcome::Error(_) = request.guard::<Ratelimiter>().await {
-            info!(
-                "User rate-limited on route {}! (IP = {:?})",
-                request.uri(),
-                to_real_ip(request)
-            );
-
-            request.set_method(Method::Get);
-            request.set_uri(Origin::parse("/ratelimit").unwrap())
-        }
-    }
-
-    async fn on_response<'r>(&self, request: &'r Request<'_>, response: &mut Response<'r>) {
-        let guard = request.guard::<Ratelimiter>().await;
-        let (Outcome::Success(ratelimiter) | Outcome::Error((_, ratelimiter))) = guard else {
-            unreachable!()
-        };
-        let Ratelimiter {
-            key,
-            limit,
-            remaining,
-            reset,
-        } = ratelimiter;
-
-        response.set_raw_header("X-RateLimit-Limit", limit.to_string());
-        response.set_raw_header("X-RateLimit-Bucket", key.to_string());
-        response.set_raw_header("X-RateLimit-Remaining", remaining.to_string());
-        response.set_raw_header("X-RateLimit-Reset-After", reset.to_string());
-
-        if guard.is_error() {
-            response.set_status(Status::TooManyRequests);
-        }
-    }
-}
-
-#[derive(Serialize)]
-#[serde(untagged)]
-pub enum RatelimitInformation {
-    Success(Ratelimiter),
-    Failure { retry_after: u128 },
-}
-
-#[async_trait]
-impl<'r> FromRequest<'r> for RatelimitInformation {
-    type Error = u128;
-
-    async fn from_request(request: &'r rocket::Request<'_>) -> Outcome<Self, Self::Error> {
-        let info = match request.guard::<Ratelimiter>().await {
-            Outcome::Success(ratelimiter) => RatelimitInformation::Success(ratelimiter),
-            Outcome::Error((_, ratelimiter)) => RatelimitInformation::Failure {
-                retry_after: ratelimiter.reset,
-            },
-            _ => unreachable!(),
-        };
-        Outcome::Success(info)
-    }
-}
-
-#[rocket::get("/ratelimit")]
-fn ratelimit_info(info: RatelimitInformation) -> Json<RatelimitInformation> {
-    Json(info)
-}
-
-pub fn routes() -> Vec<rocket::Route> {
-    rocket::routes![ratelimit_info]
-}

crates/delta/src/util/ratelimits.rs

@@ -0,0 +1,81 @@
+use revolt_ratelimits::ratelimiter::RatelimitResolver;
+use rocket::{http::Method, Request};
+
+pub struct DeltaRatelimits;
+
+impl<'a> RatelimitResolver<Request<'a>> for DeltaRatelimits {
+    fn resolve_bucket<'r>(&self, request: &'r Request<'_>) -> (&'r str, Option<&'r str>) {
+        let (segment, resource, extra) = if request.routed_segment(0) == Some("0.8") {
+            (
+                request.routed_segment(1),
+                request.routed_segment(2),
+                request.routed_segment(3),
+            )
+        } else {
+            (
+                request.routed_segment(0),
+                request.routed_segment(1),
+                request.routed_segment(2),
+            )
+        };
+
+        if let Some(segment) = segment {
+            #[allow(clippy::redundant_locals)]
+            let resource = resource;
+
+            let method = request.method();
+            match (segment, resource, method) {
+                ("users", target, Method::Patch) => ("user_edit", target),
+                ("users", _, _) => {
+                    if let Some("default_avatar") = extra {
+                        return ("default_avatar", None);
+                    }
+
+                    ("users", None)
+                }
+                ("bots", _, _) => ("bots", None),
+                ("channels", Some(id), _) => {
+                    if request.method() == Method::Post {
+                        if let Some("messages") = extra {
+                            return ("messaging", Some(id));
+                        }
+                    }
+
+                    ("channels", Some(id))
+                }
+                ("servers", Some(id), _) => ("servers", Some(id)),
+                ("auth", _, _) => {
+                    if request.method() == Method::Delete {
+                        ("auth_delete", None)
+                    } else {
+                        ("auth", None)
+                    }
+                }
+                ("swagger", _, _) => ("swagger", None),
+                ("safety", Some("report"), _) => ("safety_report", Some("report")),
+                ("safety", _, _) => ("safety", None),
+                _ => ("any", None),
+            }
+        } else {
+            ("any", None)
+        }
+    }
+
+    fn resolve_bucket_limit(&self, bucket: &str) -> u32 {
+        match bucket {
+            "user_edit" => 2,
+            "users" => 20,
+            "bots" => 10,
+            "messaging" => 10,
+            "channels" => 15,
+            "servers" => 5,
+            "auth" => 15,
+            "auth_delete" => 255,
+            "default_avatar" => 255,
+            "swagger" => 100,
+            "safety" => 15,
+            "safety_report" => 3,
+            _ => 20,
+        }
+    }
+}

crates/services/autumn/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-autumn"
-version = "0.8.8"
+version = "0.8.9"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 
@@ -43,15 +43,16 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 # Core crates
-revolt-files = { version = "0.8.8", path = "../../core/files" }
-revolt-config = { version = "0.8.8", path = "../../core/config" }
-revolt-database = { version = "0.8.8", path = "../../core/database", features = [
+revolt-files = { version = "0.8.9", path = "../../core/files" }
+revolt-config = { version = "0.8.9", path = "../../core/config" }
+revolt-database = { version = "0.8.9", path = "../../core/database", features = [
     "axum-impl",
 ] }
-revolt-result = { version = "0.8.8", path = "../../core/result", features = [
+revolt-result = { version = "0.8.9", path = "../../core/result", features = [
     "utoipa",
     "axum",
 ] }
+revolt-ratelimits = { version = "0.8.9", path = "../../core/ratelimits", features = ["axum"] }
 
 # Axum / web server
 tempfile = "3.12.0"

crates/services/autumn/Dockerfile

@@ -1,5 +1,5 @@
 # Build Stage
-FROM ghcr.io/revoltchat/base:latest AS builder
+FROM ghcr.io/stoatchat/base:latest AS builder
 FROM debian:12 AS debian
 
 # Bundle Stage

crates/services/autumn/src/api.rs

@@ -25,10 +25,10 @@ use tokio::time::Instant;
 use tower_http::cors::{AllowHeaders, Any, CorsLayer};
 use utoipa::ToSchema;
 
-use crate::{exif::strip_metadata, metadata::generate_metadata, mime_type::determine_mime_type};
+use crate::{exif::strip_metadata, metadata::generate_metadata, mime_type::determine_mime_type, AppState};
 
 /// Build the API router
-pub async fn router() -> Router<Database> {
+pub async fn router() -> Router<AppState> {
     let config = config().await;
 
     let cors = CorsLayer::new()

crates/services/autumn/src/main.rs

@@ -1,8 +1,10 @@
 use std::net::{Ipv4Addr, SocketAddr};
 
-use axum::Router;
+use axum::{middleware::from_fn_with_state, Router};
 
-use revolt_database::DatabaseInfo;
+use axum_macros::FromRef;
+use revolt_database::{Database, DatabaseInfo};
+use revolt_ratelimits::axum as ratelimiter;
 use tokio::net::TcpListener;
 use utoipa::{
     openapi::security::{ApiKey, ApiKeyValue, SecurityScheme},
@@ -15,6 +17,13 @@ pub mod clamav;
 pub mod exif;
 pub mod metadata;
 pub mod mime_type;
+mod ratelimits;
+
+#[derive(FromRef, Clone)]
+struct AppState {
+    database: Database,
+    ratelimit_storage: ratelimiter::RatelimitStorage,
+}
 
 #[tokio::main]
 async fn main() -> Result<(), std::io::Error> {
@@ -69,12 +78,23 @@ async fn main() -> Result<(), std::io::Error> {
 
     // Connect to the database
     let db = DatabaseInfo::Auto.connect().await.unwrap();
+    let ratelimits = ratelimiter::RatelimitStorage::new(ratelimits::AutumnRatelimits);
+
+    let state = AppState {
+        database: db,
+        ratelimit_storage: ratelimits,
+    };
 
     // Configure Axum and router
     let app = Router::new()
         .merge(Scalar::with_url("/scalar", ApiDoc::openapi()))
         .nest("/", api::router().await)
-        .with_state(db);
+        .nest("/", ratelimiter::routes())
+        .layer(from_fn_with_state(
+            state.clone(),
+            ratelimiter::ratelimit_middleware,
+        ))
+        .with_state(state);
 
     // Configure TCP listener and bind
     let address = SocketAddr::from((Ipv4Addr::UNSPECIFIED, 14704));

crates/services/autumn/src/ratelimits.rs

@@ -0,0 +1,28 @@
+use axum::http::{request::Parts, Method};
+use revolt_ratelimits::ratelimiter::RatelimitResolver;
+
+pub struct AutumnRatelimits;
+
+impl RatelimitResolver<Parts> for AutumnRatelimits {
+    fn resolve_bucket<'a>(&self, parts: &'a Parts) -> (&'a str, Option<&'a str>) {
+        let path = parts
+            .uri
+            .path()
+            .trim_matches('/')
+            .split_terminator("/")
+            .collect::<Vec<&str>>();
+
+        match (&parts.method, path.as_slice()) {
+            (&Method::POST, &[tag]) => ("upload", Some(tag)),
+            _ => ("any", None),
+        }
+    }
+
+    fn resolve_bucket_limit(&self, bucket: &str) -> u32 {
+        match bucket {
+            "upload" => 10,
+            "any" => u32::MAX,
+            _ => unreachable!("Bucket defined but no limit set"),
+        }
+    }
+}

crates/services/gifbox/Cargo.toml

@@ -0,0 +1,47 @@
+[package]
+name = "revolt-gifbox"
+version = "0.8.9"
+edition = "2021"
+license = "AGPL-3.0-or-later"
+
+[dependencies]
+# Serialisation
+serde = { version = "1.0", features = ["derive", "rc"] }
+serde_json = "1.0.68"
+
+# Async runtime
+tokio = { version = "1.0", features = ["full"] }
+
+# Web requests
+reqwest = { version = "0.12", features = ["json"] }
+
+# Core crates
+revolt-config = { version = "0.8.9", path = "../../core/config" }
+revolt-models = { version = "0.8.9", path = "../../core/models" }
+revolt-result = { version = "0.8.9", path = "../../core/result", features = [
+    "utoipa",
+    "axum",
+] }
+revolt-coalesced = { version = "0.8.9", path = "../../core/coalesced", features = [
+    "queue",
+] }
+revolt-database = { version = "0.8.9", path = "../../core/database", features = [
+    "axum-impl",
+] }
+revolt-ratelimits = { version = "0.8.9", path = "../../core/ratelimits", features = [
+    "axum",
+] }
+
+# Axum / web server
+axum = { version = "0.7.5" }
+axum-extra = { version = "0.9", features = ["typed-header"] }
+
+# OpenAPI & documentation generation
+utoipa-scalar = { version = "0.1.0", features = ["axum"] }
+utoipa = { version = "4.2.3", features = ["axum_extras", "ulid"] }
+
+# Logging
+tracing = "0.1"
+
+# Utils
+lru_time_cache = "0.11.11"

crates/services/gifbox/Dockerfile

@@ -0,0 +1,10 @@
+# Build Stage
+FROM ghcr.io/stoatchat/base:latest AS builder
+
+# Bundle Stage
+FROM gcr.io/distroless/cc-debian12:nonroot
+COPY --from=builder /home/rust/src/target/release/revolt-gifbox ./
+
+EXPOSE 14706
+USER nonroot
+CMD ["./revolt-gifbox"]

crates/services/gifbox/src/main.rs

@@ -0,0 +1,112 @@
+use std::net::{Ipv4Addr, SocketAddr};
+
+use axum::{extract::FromRef, middleware::from_fn_with_state, Router};
+
+use revolt_config::config;
+use revolt_database::{Database, DatabaseInfo};
+use revolt_ratelimits::axum as ratelimiter;
+use tokio::net::TcpListener;
+use utoipa::{
+    openapi::security::{ApiKey, ApiKeyValue, SecurityScheme},
+    Modify, OpenApi,
+};
+use utoipa_scalar::{Scalar, Servable as ScalarServable};
+
+use crate::tenor::Tenor;
+
+mod ratelimits;
+mod routes;
+mod tenor;
+mod types;
+
+#[derive(Clone, FromRef)]
+struct AppState {
+    pub database: Database,
+    pub tenor: Tenor,
+    pub ratelimit_storage: ratelimiter::RatelimitStorage,
+}
+
+struct SecurityAddon;
+
+impl Modify for SecurityAddon {
+    fn modify(&self, openapi: &mut utoipa::openapi::OpenApi) {
+        let components = openapi.components.get_or_insert_default();
+
+        components.add_security_scheme(
+            "User Token",
+            SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new(
+                "X-Session-Token".to_string(),
+            ))),
+        );
+
+        components.add_security_scheme(
+            "Bot Token",
+            SecurityScheme::ApiKey(ApiKey::Header(ApiKeyValue::new("X-Bot-Token".to_string()))),
+        );
+    }
+}
+
+#[tokio::main]
+async fn main() -> Result<(), std::io::Error> {
+    // Configure logging and environment
+    revolt_config::configure!(gifbox);
+
+    // Configure API schema
+    #[derive(OpenApi)]
+    #[openapi(
+        modifiers(&SecurityAddon),
+        paths(
+            routes::categories::categories,
+            routes::root::root,
+            routes::search::search,
+            routes::trending::trending,
+        ),
+        tags(
+            (name = "Misc", description = "Misc routes for microservice."),
+            (name = "GIFs", description = "All routes for requesting GIFs from tenor.")
+        ),
+        components(
+            schemas(
+                revolt_result::Error,
+                revolt_result::ErrorType,
+                types::MediaResult,
+                types::MediaObject,
+            )
+        ),
+    )]
+    struct ApiDoc;
+
+    let config = config().await;
+
+    let database = DatabaseInfo::Auto
+        .connect()
+        .await
+        .expect("Unable to connect to database");
+
+    let tenor = tenor::Tenor::new(&config.api.security.tenor_key);
+
+    let ratelimit_storage = ratelimiter::RatelimitStorage::new(ratelimits::GifboxRatelimits);
+
+    let state = AppState {
+        database,
+        tenor,
+        ratelimit_storage,
+    };
+
+    // Configure Axum and router
+    let app = Router::new()
+        .merge(Scalar::with_url("/scalar", ApiDoc::openapi()))
+        .nest("/", routes::router())
+        .layer(from_fn_with_state(
+            state.clone(),
+            ratelimiter::ratelimit_middleware,
+        ))
+        .with_state(state);
+
+    // Configure TCP listener and bind
+    tracing::info!("Listening on 0.0.0.0:14706");
+    tracing::info!("Play around with the API: http://localhost:14706/scalar");
+    let address = SocketAddr::from((Ipv4Addr::UNSPECIFIED, 14706));
+    let listener = TcpListener::bind(&address).await?;
+    axum::serve(listener, app.into_make_service()).await
+}

crates/services/gifbox/src/ratelimits.rs

@@ -0,0 +1,32 @@
+use axum::http::request::Parts;
+use revolt_ratelimits::ratelimiter::RatelimitResolver;
+
+pub struct GifboxRatelimits;
+
+impl RatelimitResolver<Parts> for GifboxRatelimits {
+    fn resolve_bucket<'a>(&self, parts: &'a Parts) -> (&'a str, Option<&'a str>) {
+        let path = parts
+            .uri
+            .path()
+            .trim_matches('/')
+            .split_terminator("/")
+            .next();
+
+        match path {
+            Some("categories") => ("categories", None),
+            Some("trending") => ("trending", None),
+            Some("search") => ("search", None),
+            _ => ("any", None),
+        }
+    }
+
+    fn resolve_bucket_limit(&self, bucket: &str) -> u32 {
+        match bucket {
+            "categories" => 2,
+            "trending" => 5,
+            "search" => 10,
+            "any" => u32::MAX,
+            _ => unreachable!("Bucket defined but no limit set"),
+        }
+    }
+}

crates/services/gifbox/src/routes/categories.rs

@@ -0,0 +1,48 @@
+use axum::{
+    extract::{Query, State},
+    Json,
+};
+use revolt_database::User;
+use revolt_result::{create_error, Result};
+use serde::Deserialize;
+use utoipa::IntoParams;
+
+use crate::{tenor, types};
+
+#[derive(Deserialize, IntoParams)]
+pub struct CategoriesQueryParams {
+    /// Users locale
+    #[param(example = "en_US")]
+    pub locale: String,
+}
+
+/// Trending GIF categories
+#[utoipa::path(
+    get,
+    path = "/categories",
+    tag = "GIFs",
+    security(("User Token" = []), ("Bot Token" = [])),
+    params(CategoriesQueryParams),
+    responses(
+        (status = 200, description = "Categories results", body = inline(Vec<types::CategoryResponse>))
+    )
+)]
+pub async fn categories(
+    _user: User,
+    Query(params): Query<CategoriesQueryParams>,
+    State(tenor): State<tenor::Tenor>,
+) -> Result<Json<Vec<types::CategoryResponse>>> {
+    tenor
+        .categories(&params.locale)
+        .await
+        .map_err(|_| create_error!(InternalError))
+        .map(|results| {
+            (*results)
+                .clone()
+                .tags
+                .into_iter()
+                .map(|cat| cat.into())
+                .collect()
+        })
+        .map(Json)
+}

crates/services/gifbox/src/routes/mod.rs

@@ -0,0 +1,15 @@
+use crate::AppState;
+use axum::routing::{get, Router};
+
+pub mod categories;
+pub mod root;
+pub mod search;
+pub mod trending;
+
+pub fn router() -> Router<AppState> {
+    Router::new()
+        .route("/", get(root::root))
+        .route("/categories", get(categories::categories))
+        .route("/search", get(search::search))
+        .route("/trending", get(trending::trending))
+}

crates/services/gifbox/src/routes/root.rs

@@ -0,0 +1,22 @@
+use axum::Json;
+
+use crate::types;
+
+/// Capture crate version from Cargo
+static CRATE_VERSION: &str = env!("CARGO_PKG_VERSION");
+
+/// Root response from service
+#[utoipa::path(
+    get,
+    path = "/",
+    tag = "Misc",
+    responses(
+        (status = 200, description = "Root response", body = inline(types::RootResponse))
+    )
+)]
+pub async fn root() -> Json<types::RootResponse<'static>> {
+    Json(types::RootResponse {
+        message: "Gifbox lives on!",
+        version: CRATE_VERSION,
+    })
+}

crates/services/gifbox/src/routes/search.rs

@@ -0,0 +1,56 @@
+use axum::{
+    extract::{Query, State},
+    Json,
+};
+use revolt_database::User;
+use revolt_result::{create_error, Result};
+use serde::Deserialize;
+use utoipa::IntoParams;
+
+use crate::{tenor, types};
+
+#[derive(Deserialize, IntoParams)]
+pub struct SearchQueryParams {
+    /// Search query
+    #[param(example = "Wave")]
+    pub query: String,
+    /// Users locale
+    #[param(example = "en_US")]
+    pub locale: String,
+    /// Amount of results to respond with
+    pub limit: Option<u32>,
+    /// Flag for if searching in a gif category
+    pub is_category: Option<bool>,
+    /// Value of `next` for getting the next page of results with the current search query
+    pub position: Option<String>,
+}
+
+/// Searches for GIFs with a query
+#[utoipa::path(
+    get,
+    path = "/search",
+    tag = "GIFs",
+    security(("User Token" = []), ("Bot Token" = [])),
+    params(SearchQueryParams),
+    responses(
+        (status = 200, description = "Search results", body = inline(types::PaginatedMediaResponse))
+    )
+)]
+pub async fn search(
+    _user: User,
+    Query(params): Query<SearchQueryParams>,
+    State(tenor): State<tenor::Tenor>,
+) -> Result<Json<types::PaginatedMediaResponse>> {
+    tenor
+        .search(
+            &params.query,
+            &params.locale,
+            params.limit.unwrap_or(50),
+            params.is_category.unwrap_or_default(),
+            params.position.as_deref().unwrap_or_default(),
+        )
+        .await
+        .map_err(|_| create_error!(InternalError))
+        .map(|results| results.as_ref().clone().into())
+        .map(Json)
+}