chore(main): release 0.10.0 (#502)

Co-authored-by: stoat-release[bot] <245062572+stoat-release[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/docs-test.yml

@@ -14,16 +14,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v4
-        with:
-          package_json_file: ./docs/package.json
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-          cache: pnpm
-          cache-dependency-path: ./docs/pnpm-lock.yaml
 
-      - name: Install dependencies
-        run: pnpm install
-      - name: Test build website
-        run: pnpm run build
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@cd24790a7f5f6439ac32cc94f5523cb2de8bfa8c # use-mise-action-v1.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+        
+      - run: mise docs:build

.github/workflows/docs.yml

@@ -16,19 +16,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: pnpm/action-setup@v4
-        with:
-          package_json_file: ./docs/package.json
-      - uses: actions/setup-node@v4
-        with:
-          node-version: lts/*
-          cache: pnpm
-          cache-dependency-path: ./docs/pnpm-lock.yaml
 
-      - name: Install dependencies
-        run: pnpm install
-      - name: Build website
-        run: pnpm run build
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@cd24790a7f5f6439ac32cc94f5523cb2de8bfa8c # use-mise-action-v1.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+        
+      - run: mise docs:build
 
       - name: Upload Build Artifact
         uses: actions/upload-pages-artifact@v3

.github/workflows/git-town.yml

@@ -0,0 +1,19 @@
+name: Git Town
+
+on:
+  pull_request:
+
+jobs:
+  git-town:
+    name: Display the branch stack
+    runs-on: ubuntu-slim
+
+    if: ${{ !startsWith(github.head_ref, 'release-please--') }}
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: stoatchat/action-git-town@4bc5c942e4603bffa0806b51d5fe5f0bc5deb0ac

.github/workflows/publish-crates.yml

@@ -15,7 +15,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Publish crates
-        uses: katyo/publish-crates@02cc2f1ad653fb25c7d1ff9eb590a8a50d06186b # v2
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@cd24790a7f5f6439ac32cc94f5523cb2de8bfa8c # use-mise-action-v1.1.0
         with:
-          registry-token: ${{ secrets.CRATES_IO_PUBLISH_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish
+        run: mise publish --workspace

.github/workflows/rust.yaml

@@ -26,43 +26,33 @@ jobs:
       #   run: |
       #     sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc
 
-      - name: Install latest stable
-        uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+      - name: Setup Mise
+        uses: immich-app/devtools/actions/use-mise@cd24790a7f5f6439ac32cc94f5523cb2de8bfa8c # use-mise-action-v1.1.0
         with:
-          toolchain: stable
-          components: rustfmt, clippy
-      
-      - name: Install cargo-nextest
-        uses: taiki-e/install-action@a58ae9526b2c3acee9ad8e1926b950b7863305d4 # 2.65.16
-        with:
-          tool: cargo-nextest@0.9.119
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Run cargo build
-        run: cargo build
-
-      - name: Run services in background
-        run: |
-          docker compose -f compose.yml up -d
-
-      - name: Run cargo test
+      - run: mise build
+      - run: mise docker:start
+    
+      - name: Reference Test
         env:
           TEST_DB: REFERENCE
         run: |
-          cargo nextest run
+          mise test
 
-      - name: Run cargo test (with MongoDB)
+      - name: MongoDB Test
         env:
           TEST_DB: MONGODB
           MONGODB: mongodb://localhost
         run: |
-          cargo nextest run
+          mise test
 
       - name: Start API in background
         if: github.event_name != 'pull_request' && github.ref_name == 'main'
         env:
           TEST_DB: REFERENCE
         run: |
-          cargo build --bin revolt-delta && (cargo run --bin revolt-delta &)
+          mise build --bin revolt-delta && (mise service:api &)
 
       - name: Wait for API to go up
         if: github.event_name != 'pull_request' && github.ref_name == 'main'

.mise/config.toml

@@ -0,0 +1,19 @@
+[tools]
+node = "25.4.0"
+pnpm = "10.28.1"
+
+gh = "2.25.0"
+
+rust = "1.92.0"
+"cargo:cargo-nextest" = "0.9.122"
+
+"github:git-town/git-town" = "22.4.0"
+
+[settings]
+experimental = true
+idiomatic_version_file_enable_tools = ["rust"]
+
+[tasks.start]
+description = "Run all services"
+depends = ["docker:start", "build"]
+run = [{ task = "service:*" }]

.mise/tasks/build

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Build project"
+set -e
+
+cargo build "$@"

.mise/tasks/check

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Check project with clippy"
+set -e
+
+cargo clippy

.mise/tasks/docker/start

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Start Docker containers"
+set -e
+
+docker compose up -d

.mise/tasks/docker/stop

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Stop Docker containers"
+set -e
+
+docker compose down

.mise/tasks/docs/_default

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+#MISE description="Start the Stoat Developers website"
+#MISE depends=["docs:install"]
+#MISE dir="{{config_root}}/docs"
+set -e
+
+pnpm build

.mise/tasks/docs/build

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+#MISE description="Build the Stoat Developers website"
+#MISE depends=["docs:install"]
+#MISE dir="{{config_root}}/docs"
+set -e
+
+pnpm build

.mise/tasks/docs/install

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+#MISE description="Install dependencies for docs site"
+#MISE dir="{{config_root}}/docs"
+set -e
+
+pnpm i --frozen-lockfile

.mise/tasks/publish

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Publish project"
+set -e
+
+cargo publish "$@"

.mise/tasks/service/api

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run API server"
+set -e
+
+cargo run --bin revolt-delta

.mise/tasks/service/crond

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run cron daemon"
+set -e
+
+cargo run --bin revolt-crond

.mise/tasks/service/events

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run events server"
+set -e
+
+cargo run --bin revolt-bonfire

.mise/tasks/service/files

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run file server"
+set -e
+
+cargo run --bin revolt-autumn

.mise/tasks/service/gifbox

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run GIF proxy server"
+set -e
+
+cargo run --bin revolt-gifbox

.mise/tasks/service/proxy

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run proxy server"
+set -e
+
+cargo run --bin revolt-january

.mise/tasks/service/pushd

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+#MISE description="Run push daemon"
+set -e
+
+cargo run --bin revolt-pushd

.mise/tasks/test

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#MISE description="Test project"
+set -e
+
+: "${TEST_DB:=REFERENCE}"
+export TEST_DB
+
+cargo nextest run

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "0.9.4"
+    ".": "0.10.0"
 }

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.10.0](https://github.com/stoatchat/stoatchat/compare/v0.9.4...v0.10.0) (2026-01-25)
+
+
+### Features
+
+* allow kicking members from voice channels ([#495](https://github.com/stoatchat/stoatchat/issues/495)) ([0dc5442](https://github.com/stoatchat/stoatchat/commit/0dc544249825a49c793309edee5ec1838458a6da))
+* repository architecture for files crate w. added tests ([#498](https://github.com/stoatchat/stoatchat/issues/498)) ([01ded20](https://github.com/stoatchat/stoatchat/commit/01ded209c62208fc906d6aab9b08c04e860e10ef))
+
+
+### Bug Fixes
+
+* expose ratelimit headers via cors ([#496](https://github.com/stoatchat/stoatchat/issues/496)) ([a1a2125](https://github.com/stoatchat/stoatchat/commit/a1a21252d0ad58937e41f16e5fb86f96bebd2a51))
+
 ## [0.9.4](https://github.com/stoatchat/stoatchat/compare/v0.9.3...v0.9.4) (2026-01-10)
 
 

Cargo.toml

@@ -14,9 +14,37 @@ redis23 = { package = "redis", version = "0.23.3", git = "https://github.com/rev
 #authifier = { package = "authifier", version = "1.0.10", path = "../authifier/crates/authifier" }
 #rocket_authifier = { package = "rocket_authifier", version = "1.0.10", path = "../authifier/crates/rocket_authifier" }
 
-# I'm 99% sure this is overloading the GitHub worker
-# hence builds have been failing since, let's just
-# disable it for now. In the future, we could use this
-# if we were rolling our own CI (that is now).
 [profile.release]
 lto = true
+
+[workspace.dependencies]
+# Async
+async-trait = "0.1.89"
+tokio = { version = "1.49.0", features = ["macros", "rt"] }
+
+# Error Handling
+anyhow = "1.0.100"
+thiserror = "2.0.18"
+
+# Other Utilities
+uuid = { version = "1.19.0", features = ["v4"] }
+
+# Axum (HTTP server)
+axum-macros = "0.4.1"
+axum_typed_multipart = "0.12.1"
+axum = { version = "0.7.5", features = ["multipart"] }
+tower-http = { version = "0.5.2", features = ["cors", "trace"] }
+
+# Image Processing
+jxl-oxide = { version = "0.12.5", features = ["image"] }
+image = "0.25.9"
+
+# OpenTelemetry
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.22", features = [
+    "env-filter",
+] } # consider https://crates.io/crates/better-tracing
+opentelemetry = { version = "0.31.0", features = ["logs"] }
+opentelemetry_sdk = { version = "0.31.0", features = ["logs"] }
+opentelemetry-otlp = { version = "0.31.0", features = ["logs"] }
+opentelemetry-appender-tracing = { version = "0.31.1" }

README.md

@@ -43,13 +43,13 @@ Before contributing, make yourself familiar with [our contribution guidelines](h
 
 Before getting started, you'll want to install:
 
-- Rust toolchain (rustup recommended)
+- mise
 - Docker
 - Git
 - mold (optional, faster compilation)
 
 > A **default.nix** is available for Nix users!
-> Just run `nix-shell` and continue.
+> Run `nix-shell` to activate mise.
 
 As a heads-up, the development environment uses the following ports:
 
@@ -72,7 +72,7 @@ Now you can clone and build the project:
 ```bash
 git clone https://github.com/revoltchat/backend revolt-backend
 cd revolt-backend
-cargo build
+mise build
 ```
 
 A default configuration `Revolt.toml` is present in this project that is suited for development.

compose.yml

@@ -12,6 +12,10 @@ services:
       - "27017:27017"
     volumes:
       - ./.data/db:/data/db
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
 
   # MinIO
   minio:

crates/bonfire/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-bonfire"
-version = "0.9.4"
+version = "0.10.0"
 license = "AGPL-3.0-or-later"
 edition = "2021"
 publish = false

crates/core/coalesced/Cargo.toml

@@ -1,10 +1,11 @@
 [package]
 name = "revolt-coalesced"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>", "Zomatree <me@zomatree.live>"]
 description = "Revolt Backend: Coalescion service"
+repository = "https://github.com/stoatchat/stoatchat"
 
 [features]
 tokio = ["dep:tokio"]
@@ -19,4 +20,9 @@ indexmap = { version = "2.13.0", optional = true }
 lru = { version = "0.16.3", optional = true }
 
 [dev-dependencies]
-tokio = { version = "1.47.0", features = ["rt", "rt-multi-thread", "macros", "time"] }
+tokio = { version = "1.47.0", features = [
+    "rt",
+    "rt-multi-thread",
+    "macros",
+    "time",
+] }

crates/core/config/Cargo.toml

@@ -1,10 +1,11 @@
 [package]
 name = "revolt-config"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: Configuration"
+repository = "https://github.com/stoatchat/stoatchat"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -37,4 +38,4 @@ sentry = { version = "0.31.5", optional = true }
 sentry-anyhow = { version = "0.38.1", optional = true }
 
 # Core
-revolt-result = { version = "0.9.4", path = "../result", optional = true }
+revolt-result = { version = "0.10.0", path = "../result", optional = true }

crates/core/config/src/lib.rs

@@ -1,4 +1,4 @@
-use std::collections::HashMap;
+use std::{collections::HashMap, path::Path};
 
 use cached::proc_macro::cached;
 use config::{Config, File, FileFormat};
@@ -94,10 +94,19 @@ static CONFIG_BUILDER: Lazy<RwLock<Config>> = Lazy::new(|| {
             }
         }
 
-        for path in CONFIG_SEARCH_PATHS {
-            if std::path::Path::new(path).exists() {
-                builder = builder.add_source(File::new(path, FileFormat::Toml));
+        let cwd = std::env::current_dir().unwrap();
+        let mut cwd: Option<&Path> = Some(&cwd);
+
+        while let Some(path) = cwd {
+            for config_path in CONFIG_SEARCH_PATHS {
+                let config_path = path.join(config_path);
+                if config_path.exists() {
+                    builder = builder
+                        .add_source(File::new(config_path.to_str().unwrap(), FileFormat::Toml));
+                }
             }
+
+            cwd = path.parent();
         }
 
         builder.build().unwrap()

crates/core/database/Cargo.toml

@@ -1,10 +1,11 @@
 [package]
 name = "revolt-database"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: Database Implementation"
+repository = "https://github.com/stoatchat/stoatchat"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -15,8 +16,14 @@ mongodb = ["dep:mongodb", "bson", "authifier/database-mongodb"]
 # ... Other
 tasks = ["isahc", "linkify", "url-escape"]
 async-std-runtime = ["async-std", "authifier/async-std-runtime"]
-rocket-impl = ["rocket", "schemars", "revolt_okapi", "revolt_rocket_okapi", "authifier/rocket_impl"]
-axum-impl = ["axum"]
+rocket-impl = [
+    "rocket",
+    "schemars",
+    "revolt_okapi",
+    "revolt_rocket_okapi",
+    "authifier/rocket_impl",
+]
+axum-impl = ["axum", "revolt-result/axum"]
 redis-is-patched = ["revolt-presence/redis-is-patched"]
 voice = ["livekit-api", "livekit-protocol", "livekit-runtime"]
 
@@ -25,19 +32,19 @@ default = ["mongodb", "async-std-runtime", "tasks"]
 
 [dependencies]
 # Core
-revolt-config = { version = "0.9.4", path = "../config", features = [
+revolt-config = { version = "0.10.0", path = "../config", features = [
     "report-macros",
 ] }
-revolt-result = { version = "0.9.4", path = "../result" }
-revolt-models = { version = "0.9.4", path = "../models", features = [
+revolt-result = { version = "0.10.0", path = "../result" }
+revolt-models = { version = "0.10.0", path = "../models", features = [
     "validator",
 ] }
-revolt-presence = { version = "0.9.4", path = "../presence" }
-revolt-permissions = { version = "0.9.4", path = "../permissions", features = [
+revolt-presence = { version = "0.10.0", path = "../presence" }
+revolt-permissions = { version = "0.10.0", path = "../permissions", features = [
     "serde",
     "bson",
 ] }
-revolt-parser = { version = "0.9.4", path = "../parser" }
+revolt-parser = { version = "0.10.0", path = "../parser" }
 
 # Utility
 log = "0.4"
@@ -99,6 +106,6 @@ authifier = { version = "1.0.15" }
 amqprs = { version = "1.7.0" }
 
 # Voice
-livekit-api = { version = "0.4.4", optional = true}
+livekit-api = { version = "0.4.4", optional = true }
 livekit-protocol = { version = "0.4.0", optional = true }
 livekit-runtime = { version = "0.3.1", features = ["tokio"], optional = true }

crates/core/database/src/models/server_members/model.rs

@@ -72,6 +72,7 @@ auto_derived!(
         CanReceive,
         CanPublish,
         JoinedAt,
+        VoiceChannel,
     }
 
     /// Member removal intention
@@ -224,13 +225,14 @@ impl Member {
 
     pub fn remove_field(&mut self, field: &FieldsMember) {
         match field {
-            FieldsMember::JoinedAt => (),
+            FieldsMember::JoinedAt => {},
             FieldsMember::Avatar => self.avatar = None,
             FieldsMember::Nickname => self.nickname = None,
             FieldsMember::Roles => self.roles.clear(),
             FieldsMember::Timeout => self.timeout = None,
             FieldsMember::CanReceive => self.can_receive = true,
             FieldsMember::CanPublish => self.can_publish = true,
+            FieldsMember::VoiceChannel => {},
         }
     }
 

crates/core/database/src/models/server_members/ops/mongodb.rs

@@ -330,14 +330,15 @@ impl AbstractServerMembers for MongoDb {
 
 impl IntoDocumentPath for FieldsMember {
     fn as_path(&self) -> Option<&'static str> {
-        Some(match self {
-            FieldsMember::JoinedAt => "joined_at",
-            FieldsMember::Avatar => "avatar",
-            FieldsMember::Nickname => "nickname",
-            FieldsMember::Roles => "roles",
-            FieldsMember::Timeout => "timeout",
-            FieldsMember::CanPublish => "can_publish",
-            FieldsMember::CanReceive => "can_receive",
-        })
+        match self {
+            FieldsMember::JoinedAt => Some("joined_at"),
+            FieldsMember::Avatar => Some("avatar"),
+            FieldsMember::Nickname => Some("nickname"),
+            FieldsMember::Roles => Some("roles"),
+            FieldsMember::Timeout => Some("timeout"),
+            FieldsMember::CanPublish => Some("can_publish"),
+            FieldsMember::CanReceive => Some("can_receive"),
+            FieldsMember::VoiceChannel => None,
+        }
     }
 }

crates/core/database/src/util/bridge/v0.rs

@@ -691,6 +691,7 @@ impl From<crate::FieldsMember> for FieldsMember {
             crate::FieldsMember::CanReceive => FieldsMember::CanReceive,
             crate::FieldsMember::CanPublish => FieldsMember::CanPublish,
             crate::FieldsMember::JoinedAt => FieldsMember::JoinedAt,
+            crate::FieldsMember::VoiceChannel => FieldsMember::VoiceChannel,
         }
     }
 }
@@ -705,6 +706,7 @@ impl From<FieldsMember> for crate::FieldsMember {
             FieldsMember::CanReceive => crate::FieldsMember::CanReceive,
             FieldsMember::CanPublish => crate::FieldsMember::CanPublish,
             FieldsMember::JoinedAt => crate::FieldsMember::JoinedAt,
+            FieldsMember::VoiceChannel => crate::FieldsMember::VoiceChannel,
         }
     }
 }

crates/core/files/Cargo.toml

@@ -1,13 +1,20 @@
 [package]
 name = "revolt-files"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: S3 and encryption subroutines"
+repository = "https://github.com/stoatchat/stoatchat"
 
 [dependencies]
-tracing = "0.1"
+anyhow = { workspace = true }
+thiserror = { workspace = true }
+
+tracing = { workspace = true }
+
+tokio = { workspace = true }
+async-trait = { workspace = true }
 
 ffprobe = "0.4.0"
 imagesize = "0.13.0"
@@ -20,14 +27,14 @@ typenum = "1.17.0"
 aws-config = "1.5.5"
 aws-sdk-s3 = { version = "1.46.0", features = ["behavior-version-latest"] }
 
-revolt-config = { version = "0.9.4", path = "../config", features = [
+revolt-config = { version = "0.10.0", path = "../config", features = [
     "report-macros",
 ] }
-revolt-result = { version = "0.9.4", path = "../result" }
+revolt-result = { version = "0.10.0", path = "../result" }
 
 # image processing
-jxl-oxide = "0.8.1"
-image = { version = "0.25.2" }
+jxl-oxide = { workspace = true }
+image = { workspace = true }
 
 # svg rendering
 usvg = "0.44.0"
@@ -36,3 +43,6 @@ tiny-skia = "0.11.4"
 
 # encoding
 webp = "0.3.0"
+
+[dev-dependencies]
+uuid = { workspace = true }

crates/core/files/src/implementation/encryption_impl.rs

@@ -0,0 +1,75 @@
+use aes_gcm::{
+    aead::{Aead, AeadCore, AeadMutInPlace, OsRng},
+    Aes256Gcm, Key, KeyInit, Nonce,
+};
+use base64::{prelude::BASE64_STANDARD, Engine};
+
+use crate::EncryptionRepository;
+
+pub struct EncryptionKey {
+    key: String,
+}
+
+impl EncryptionKey {
+    pub async fn from_config() -> EncryptionKey {
+        EncryptionKey::new(revolt_config::config().await.files.encryption_key)
+    }
+
+    pub fn new(key: String) -> EncryptionKey {
+        EncryptionKey { key }
+    }
+
+    fn create_cipher(&self) -> Aes256Gcm {
+        let key = &BASE64_STANDARD
+            .decode(self.key.clone())
+            .expect("valid base64 string")[..];
+        let key: &Key<Aes256Gcm> = key.into();
+        Aes256Gcm::new(key)
+    }
+}
+
+impl EncryptionRepository for EncryptionKey {
+    fn decrypt_buffer(&self, mut buf: Vec<u8>, iv: &str) -> anyhow::Result<Vec<u8>> {
+        let iv = &BASE64_STANDARD.decode(iv).unwrap()[..];
+        let iv: &Nonce<typenum::consts::U12> = iv.into();
+
+        self.create_cipher()
+            .decrypt_in_place(iv, b"", &mut buf)
+            .map_err(|error| {
+                tracing::error!("{}", error);
+                anyhow::anyhow!("EncryptionRepository: decryption failed")
+            })?;
+
+        Ok(buf)
+    }
+
+    fn encrypt_buffer(&self, buf: &[u8]) -> anyhow::Result<(Vec<u8>, String)> {
+        let iv = Aes256Gcm::generate_nonce(&mut OsRng);
+
+        let buf = self.create_cipher().encrypt(&iv, buf).map_err(|error| {
+            tracing::error!("{}", error);
+            anyhow::anyhow!("EncryptionRepository: encryption failed")
+        })?;
+
+        Ok((buf, BASE64_STANDARD.encode(iv)))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_encrypt_and_decrypt() {
+        let encryption =
+            EncryptionKey::new("XkbJ8gBzrouQ+15Ri23xCC81+aZE26Z6+gXzglFxOD4=".to_string());
+
+        let buf: Vec<u8> = vec![67];
+        let (ciphertext, iv) = encryption.encrypt_buffer(&buf[..]).unwrap();
+        assert_eq!(ciphertext.len(), 17);
+
+        let plaintext = encryption.decrypt_buffer(ciphertext, &iv).unwrap();
+        assert_eq!(plaintext.len(), 1);
+        assert_eq!(plaintext[0], 67);
+    }
+}

crates/core/files/src/implementation/media_impl.rs

@@ -0,0 +1,294 @@
+use anyhow::Result;
+use image::{DynamicImage, ImageBuffer, ImageReader};
+use jxl_oxide::integration::JxlDecoder;
+use revolt_config::report_internal_error;
+use std::io::{BufRead, Read, Seek};
+use tempfile::NamedTempFile;
+use tiny_skia::Pixmap;
+
+use crate::{MediaError, MediaRepository};
+
+pub struct MediaImpl {
+    config: revolt_config::Files,
+}
+
+impl MediaImpl {
+    pub async fn from_config() -> MediaImpl {
+        MediaImpl {
+            config: revolt_config::config().await.files,
+        }
+    }
+
+    pub fn new(config: revolt_config::Files) -> MediaImpl {
+        MediaImpl { config }
+    }
+}
+
+impl MediaRepository for MediaImpl {
+    fn image_size(&self, f: &NamedTempFile) -> Option<(usize, usize)> {
+        if let Ok(size) = imagesize::size(f.path())
+            .inspect_err(|err| tracing::error!("Failed to generate image size! {err:?}"))
+        {
+            Some((size.width, size.height))
+        } else {
+            None
+        }
+    }
+
+    fn image_size_vec(&self, v: &[u8], mime: &str) -> Option<(usize, usize)> {
+        match mime {
+            "image/svg+xml" => {
+                let tree =
+                    report_internal_error!(usvg::Tree::from_data(v, &Default::default())).ok()?;
+
+                let size = tree.size();
+                Some((size.width() as usize, size.height() as usize))
+            }
+            _ => {
+                if let Ok(size) = imagesize::blob_size(v)
+                    .inspect_err(|err| tracing::error!("Failed to generate image size! {err:?}"))
+                {
+                    Some((size.width, size.height))
+                } else {
+                    None
+                }
+            }
+        }
+    }
+
+    fn decode_image<R: Read + BufRead + Seek>(
+        &self,
+        reader: &mut R,
+        mime: &str,
+    ) -> Result<DynamicImage, MediaError> {
+        match mime {
+            "image/jxl" => {
+                let decoder =
+                    JxlDecoder::new(reader).map_err(|e| MediaError::from(anyhow::anyhow!(e)))?;
+
+                DynamicImage::from_decoder(decoder)
+                    .map_err(|e| MediaError::from(anyhow::anyhow!(e)))
+            }
+            "image/svg+xml" => {
+                let mut buf = Vec::new();
+                reader
+                    .read_to_end(&mut buf)
+                    .map_err(|e| MediaError::from(anyhow::anyhow!(e)))?;
+
+                let tree: usvg::Tree = usvg::Tree::from_data(&buf, &Default::default())
+                    .map_err(|e| MediaError::from(anyhow::anyhow!(e)))?;
+
+                let size = tree.size();
+                let mut pixmap = Pixmap::new(size.width() as u32, size.height() as u32)
+                    .ok_or_else(|| MediaError::ImageProcessingFailed {
+                        cause: "failed to create Pixmap, likely zero sized".to_string(),
+                    })?;
+
+                let mut pixmap_mut = pixmap.as_mut();
+                resvg::render(&tree, Default::default(), &mut pixmap_mut);
+
+                Ok(DynamicImage::ImageRgba8(
+                    ImageBuffer::from_vec(
+                        size.width() as u32,
+                        size.height() as u32,
+                        pixmap.data().to_vec(),
+                    )
+                    .ok_or_else(|| MediaError::ImageProcessingFailed {
+                        cause: "buffer is not big enough".to_string(),
+                    })?,
+                ))
+            }
+            _ => {
+                let image: ImageReader<&mut R> = image::ImageReader::new(reader)
+                    .with_guessed_format()
+                    .map_err(|e| MediaError::from(anyhow::anyhow!(e)))?;
+
+                let image: Result<DynamicImage, MediaError> = image
+                    .decode()
+                    .map_err(|e| MediaError::from(anyhow::anyhow!(e)));
+
+                image
+            }
+        }
+    }
+
+    fn is_valid_image<R: Read + BufRead + Seek>(&self, reader: &mut R, mime: &str) -> bool {
+        match mime {
+            "image/jxl" => jxl_oxide::JxlImage::builder()
+                .read(reader)
+                .inspect_err(|err| tracing::error!("Failed to read JXL! {err:?}"))
+                .is_ok(),
+            _ => !matches!(
+                image::ImageReader::new(reader)
+                    .with_guessed_format()
+                    .inspect_err(|err| tracing::error!("Failed to read image! {err:?}"))
+                    .map(|f| f.decode()),
+                Err(_) | Ok(Err(_))
+            ),
+        }
+    }
+
+    fn create_thumbnail(&self, image: DynamicImage, tag: &str) -> Vec<u8> {
+        let [w, h] = self.config.preview.get(tag).unwrap();
+
+        let image = image.thumbnail(image.width().min(*w as u32), image.height().min(*h as u32));
+
+        let encoder = webp::Encoder::from_image(&image).expect("Could not create encoder.");
+        if self.config.webp_quality != 100.0 {
+            encoder.encode(self.config.webp_quality).to_vec()
+        } else {
+            encoder.encode_lossless().to_vec()
+        }
+    }
+
+    fn video_size(&self, f: &NamedTempFile) -> Option<(i64, i64)> {
+        if let Ok(data) = ffprobe::ffprobe(f.path())
+            .inspect_err(|err| tracing::error!("Failed to ffprobe file! {err:?}"))
+        {
+            for stream in data.streams {
+                if let (Some(w), Some(h)) = (stream.width, stream.height) {
+                    return Some((w, h));
+                }
+            }
+
+            None
+        } else {
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Cursor;
+
+    use crate::{MediaImpl, MediaRepository};
+
+    #[tokio::test]
+    async fn asset_test_jpeg() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/test.jpeg");
+        assert_eq!(media.image_size_vec(buf, "image/jpeg"), Some((655, 582)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/jpeg").unwrap();
+        media.create_thumbnail(image, "attachments");
+    }
+
+    #[tokio::test]
+    async fn asset_test_jpeg_extra_bytes() {
+        let media = MediaImpl::from_config().await;
+        let buf = [
+            &include_bytes!("../../tests/assets/test.jpeg")[..],
+            &[0u8; 16],
+        ]
+        .concat();
+        assert_eq!(media.image_size_vec(&buf, "image/jpeg"), Some((655, 582)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/jpeg").unwrap();
+        media.create_thumbnail(image, "emojis");
+    }
+
+    #[tokio::test]
+    async fn asset_test_png() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/test.png");
+        assert_eq!(media.image_size_vec(buf, "image/png"), Some((900, 900)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/png").unwrap();
+        media.create_thumbnail(image, "emojis");
+    }
+
+    #[tokio::test]
+    async fn asset_test_png_extra_bytes() {
+        let media = MediaImpl::from_config().await;
+        let buf = [
+            &include_bytes!("../../tests/assets/test.png")[..],
+            &[0u8; 16],
+        ]
+        .concat();
+        assert_eq!(media.image_size_vec(&buf, "image/png"), Some((900, 900)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/png").unwrap();
+        media.create_thumbnail(image, "emojis");
+    }
+
+    #[tokio::test]
+    async fn asset_test_corrupted_png() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/corrupted.png");
+        assert_eq!(media.image_size_vec(buf, "image/png"), Some((900, 900)));
+
+        let mut reader = Cursor::new(buf);
+        media.decode_image(&mut reader, "image/png").unwrap_err();
+    }
+
+    #[tokio::test]
+    async fn asset_test_animated_png() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/anim-icos.apng");
+        assert_eq!(media.image_size_vec(buf, "image/png"), Some((128, 128)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/png").unwrap();
+        media.create_thumbnail(image, "attachments");
+    }
+
+    #[tokio::test]
+    async fn asset_test_jxl() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/dice.jxl");
+        assert_eq!(media.image_size_vec(buf, "image/jxl"), Some((800, 600)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/jxl").unwrap();
+        media.create_thumbnail(image, "attachments");
+    }
+
+    #[tokio::test]
+    async fn asset_test_animated_jxl() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/anim-icos.jxl");
+        assert_eq!(media.image_size_vec(buf, "image/jxl"), Some((128, 128)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/jxl").unwrap();
+        media.create_thumbnail(image, "attachments");
+    }
+
+    #[tokio::test]
+    async fn asset_test_webp() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/dice.webp");
+        assert_eq!(media.image_size_vec(buf, "image/webp"), Some((800, 600)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/webp").unwrap();
+        media.create_thumbnail(image, "attachments");
+    }
+
+    #[tokio::test]
+    async fn asset_test_animated_webp() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/anim-icos.webp");
+        assert_eq!(media.image_size_vec(buf, "image/webp"), Some((128, 128)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/webp").unwrap();
+        media.create_thumbnail(image, "attachments");
+    }
+
+    #[tokio::test]
+    async fn asset_test_animated_gif() {
+        let media = MediaImpl::from_config().await;
+        let buf = include_bytes!("../../tests/assets/anim-icos.gif");
+        assert_eq!(media.image_size_vec(buf, "image/gif"), Some((128, 128)));
+
+        let mut reader = Cursor::new(buf);
+        let image = media.decode_image(&mut reader, "image/gif").unwrap();
+        media.create_thumbnail(image, "attachments");
+    }
+}

crates/core/files/src/implementation/mod.rs

@@ -0,0 +1,7 @@
+mod encryption_impl;
+mod media_impl;
+mod s3_impl;
+
+pub use encryption_impl::EncryptionKey;
+pub use media_impl::MediaImpl;
+pub use s3_impl::S3Storage;

crates/core/files/src/implementation/s3_impl.rs

@@ -0,0 +1,118 @@
+use std::io::Write;
+
+use anyhow::Context;
+use aws_sdk_s3::{
+    config::{Credentials, Region},
+    Client, Config,
+};
+use revolt_config::FilesS3;
+
+use crate::{EncryptionRepository, FileStorageRepository};
+
+pub struct S3Storage<ER: EncryptionRepository> {
+    client: Client,
+    encryption: ER,
+}
+
+impl<ER: EncryptionRepository> S3Storage<ER> {
+    pub async fn from_config(encryption: ER) -> S3Storage<ER> {
+        S3Storage::new(encryption, revolt_config::config().await.files.s3)
+    }
+
+    pub fn new(encryption: ER, s3_config: FilesS3) -> S3Storage<ER> {
+        let provider_name = "my-creds";
+        let creds = Credentials::new(
+            s3_config.access_key_id,
+            s3_config.secret_access_key,
+            None,
+            None,
+            provider_name,
+        );
+
+        let config = Config::builder()
+            .region(Region::new(s3_config.region))
+            .endpoint_url(s3_config.endpoint)
+            .force_path_style(s3_config.path_style_buckets)
+            .credentials_provider(creds)
+            .build();
+
+        S3Storage {
+            client: Client::from_conf(config),
+            encryption,
+        }
+    }
+}
+
+#[async_trait::async_trait]
+impl<ER: EncryptionRepository> FileStorageRepository for S3Storage<ER> {
+    async fn create_bucket(&self, bucket_id: &str) -> anyhow::Result<()> {
+        self.client
+            .create_bucket()
+            .bucket(bucket_id)
+            .send()
+            .await
+            .with_context(|| format!("failed to create bucket {bucket_id}"))?;
+
+        Ok(())
+    }
+
+    async fn fetch_and_decrypt_file(
+        &self,
+        bucket_id: &str,
+        path: &str,
+        iv: &str,
+    ) -> anyhow::Result<Vec<u8>> {
+        let mut object = self
+            .client
+            .get_object()
+            .bucket(bucket_id)
+            .key(path)
+            .send()
+            .await
+            .with_context(|| format!("failed to get object at {path} in {bucket_id}"))?;
+
+        let mut buf = vec![];
+        while let Some(bytes) = object.body.next().await {
+            let data = bytes?;
+            buf.write_all(&data)?;
+        }
+
+        if iv.is_empty() {
+            Ok(buf)
+        } else {
+            self.encryption.decrypt_buffer(buf, iv)
+        }
+    }
+
+    async fn encrypt_and_upload_file(
+        &self,
+        bucket_id: &str,
+        path: &str,
+        buf: &[u8],
+    ) -> anyhow::Result<String> {
+        let (buf, iv) = self.encryption.encrypt_buffer(buf)?;
+
+        self.client
+            .put_object()
+            .bucket(bucket_id)
+            .key(path)
+            .body(buf.into())
+            .send()
+            .await
+            .with_context(|| format!("failed to put object at {path} in {bucket_id}"))?;
+
+        Ok(iv)
+    }
+
+    async fn delete_file(&self, bucket_id: &str, path: &str) -> anyhow::Result<()> {
+        self.client
+            .delete_object()
+            .bucket(bucket_id)
+            .key(path)
+            .send()
+            .await
+            .with_context(|| format!("failed to delete object at {path} in {bucket_id}"))?;
+
+        Ok(())
+    }
+}

crates/core/files/src/lib.rs

@@ -1,293 +1,182 @@
-use std::io::{BufRead, Read, Seek, Write};
+mod implementation;
+mod repositories;
 
-use aes_gcm::{
-    aead::{AeadCore, AeadMutInPlace, OsRng},
-    Aes256Gcm, Key, KeyInit, Nonce,
-};
-use image::{DynamicImage, ImageBuffer};
-use revolt_config::{config, report_internal_error, FilesS3};
-use revolt_result::{create_error, Result};
+pub use implementation::*;
+pub use repositories::*;
 
-use aws_sdk_s3::{
-    config::{Credentials, Region},
-    Client, Config,
-};
+use std::io::{BufRead, Read, Seek};
+
+use image::DynamicImage;
+use revolt_config::{report_internal_error, Files, FilesLimit, FilesS3};
+use revolt_result::Result;
 
-use base64::prelude::*;
 use tempfile::NamedTempFile;
-use tiny_skia::Pixmap;
 
-/// Size of the authentication tag in the buffer
 pub const AUTHENTICATION_TAG_SIZE_BYTES: usize = 16;
 
-/// Create an S3 client
-pub fn create_client(s3_config: FilesS3) -> Client {
-    let provider_name = "my-creds";
-    let creds = Credentials::new(
-        s3_config.access_key_id,
-        s3_config.secret_access_key,
-        None,
-        None,
-        provider_name,
-    );
-
-    let config = Config::builder()
-        .region(Region::new(s3_config.region))
-        .endpoint_url(s3_config.endpoint)
-        .force_path_style(s3_config.path_style_buckets)
-        .credentials_provider(creds)
-        .build();
-
-    Client::from_conf(config)
-}
-
-/// Create an AES-256-GCM cipher
-pub fn create_cipher(key: &str) -> Aes256Gcm {
-    let key = &BASE64_STANDARD.decode(key).expect("valid base64 string")[..];
-    let key: &Key<Aes256Gcm> = key.into();
-    Aes256Gcm::new(key)
-}
-
 /// Fetch a file from S3 (and decrypt it)
-pub async fn fetch_from_s3(bucket_id: &str, path: &str, nonce: &str) -> Result<Vec<u8>> {
-    let config = config().await;
-    let client = create_client(config.files.s3);
-
-    // Send a request for the file
-    let mut obj =
-        report_internal_error!(client.get_object().bucket(bucket_id).key(path).send().await)?;
-
-    // Read the file from remote
-    let mut buf = vec![];
-    while let Some(bytes) = obj.body.next().await {
-        let data = report_internal_error!(bytes)?;
-        report_internal_error!(buf.write_all(&data))?;
-        // is there a more efficient way to do this?
-        // we just want the Vec<u8>
-    }
-
-    // File is not encrypted
-    if nonce.is_empty() {
-        return Ok(buf);
-    }
-
-    // Recover nonce as bytes
-    let nonce = &BASE64_STANDARD.decode(nonce).unwrap()[..];
-    let nonce: &Nonce<typenum::consts::U12> = nonce.into();
-
-    // Decrypt the file
-    create_cipher(&config.files.encryption_key)
-        .decrypt_in_place(nonce, b"", &mut buf)
-        .map_err(|_| create_error!(InternalError))?;
-
-    // Remove the authentication tag bytes that were added during encryption
-    buf.truncate(buf.len() - AUTHENTICATION_TAG_SIZE_BYTES);
-
-    Ok(buf)
+pub async fn fetch_from_s3(bucket_id: &str, path: &str, iv: &str) -> Result<Vec<u8>> {
+    let encryption = implementation::EncryptionKey::from_config().await;
+    let storage = implementation::S3Storage::from_config(encryption).await;
+    report_internal_error!(storage.fetch_and_decrypt_file(bucket_id, path, iv).await)
 }
 
 /// Encrypt and upload a file to S3 (returning its nonce/IV)
 pub async fn upload_to_s3(bucket_id: &str, path: &str, buf: &[u8]) -> Result<String> {
-    let config = config().await;
-    let client = create_client(config.files.s3);
-
-    // Generate a nonce
-    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
-
-    // Extend the buffer for in-place encryption
-    let mut buf = [buf, &[0; AUTHENTICATION_TAG_SIZE_BYTES]].concat();
-
-    // Encrypt the file in place
-    create_cipher(&config.files.encryption_key)
-        .encrypt_in_place(&nonce, b"", &mut buf)
-        .map_err(|_| create_error!(InternalError))?;
-
-    // Upload the file to remote
-    report_internal_error!(
-        client
-            .put_object()
-            .bucket(bucket_id)
-            .key(path)
-            .body(buf.into())
-            .send()
-            .await
-    )?;
-
-    Ok(BASE64_STANDARD.encode(nonce))
+    let encryption = implementation::EncryptionKey::from_config().await;
+    let storage = implementation::S3Storage::from_config(encryption).await;
+    report_internal_error!(storage.encrypt_and_upload_file(bucket_id, path, buf).await)
 }
 
 /// Delete a file from S3 by path
 pub async fn delete_from_s3(bucket_id: &str, path: &str) -> Result<()> {
-    let config = config().await;
-    let client = create_client(config.files.s3);
-
-    report_internal_error!(
-        client
-            .delete_object()
-            .bucket(bucket_id)
-            .key(path)
-            .send()
-            .await
-    )?;
-
-    Ok(())
+    let encryption = implementation::EncryptionKey::from_config().await;
+    let storage = implementation::S3Storage::from_config(encryption).await;
+    report_internal_error!(storage.delete_file(bucket_id, path).await)
 }
 
 /// Determine size of image at temp file
 pub fn image_size(f: &NamedTempFile) -> Option<(usize, usize)> {
-    if let Ok(size) = imagesize::size(f.path())
-        .inspect_err(|err| tracing::error!("Failed to generate image size! {err:?}"))
-    {
-        Some((size.width, size.height))
-    } else {
-        None
-    }
+    let media = MediaImpl::new(Files {
+        blocked_mime_types: Default::default(),
+        clamd_host: Default::default(),
+        encryption_key: Default::default(),
+        limit: FilesLimit {
+            max_mega_pixels: 0,
+            max_pixel_side: 0,
+            min_file_size: 0,
+            min_resolution: [0, 0],
+        },
+        preview: Default::default(),
+        s3: FilesS3 {
+            access_key_id: Default::default(),
+            default_bucket: Default::default(),
+            endpoint: Default::default(),
+            path_style_buckets: Default::default(),
+            region: Default::default(),
+            secret_access_key: Default::default(),
+        },
+        scan_mime_types: Default::default(),
+        webp_quality: Default::default(),
+    });
+
+    media.image_size(f)
 }
 
 /// Determine size of image with buffer
 pub fn image_size_vec(v: &[u8], mime: &str) -> Option<(usize, usize)> {
-    match mime {
-        "image/svg+xml" => {
-            let tree =
-                report_internal_error!(usvg::Tree::from_data(v, &Default::default())).ok()?;
+    let media = MediaImpl::new(Files {
+        blocked_mime_types: Default::default(),
+        clamd_host: Default::default(),
+        encryption_key: Default::default(),
+        limit: FilesLimit {
+            max_mega_pixels: 0,
+            max_pixel_side: 0,
+            min_file_size: 0,
+            min_resolution: [0, 0],
+        },
+        preview: Default::default(),
+        s3: FilesS3 {
+            access_key_id: Default::default(),
+            default_bucket: Default::default(),
+            endpoint: Default::default(),
+            path_style_buckets: Default::default(),
+            region: Default::default(),
+            secret_access_key: Default::default(),
+        },
+        scan_mime_types: Default::default(),
+        webp_quality: Default::default(),
+    });
 
-            let size = tree.size();
-            Some((size.width() as usize, size.height() as usize))
-        }
-        _ => {
-            if let Ok(size) = imagesize::blob_size(v)
-                .inspect_err(|err| tracing::error!("Failed to generate image size! {err:?}"))
-            {
-                Some((size.width, size.height))
-            } else {
-                None
-            }
-        }
-    }
+    media.image_size_vec(v, mime)
 }
 
 /// Determine size of video at temp file
 pub fn video_size(f: &NamedTempFile) -> Option<(i64, i64)> {
-    if let Ok(data) = ffprobe::ffprobe(f.path())
-        .inspect_err(|err| tracing::error!("Failed to ffprobe file! {err:?}"))
-    {
-        // Use first valid stream
-        for stream in data.streams {
-            if let (Some(w), Some(h)) = (stream.width, stream.height) {
-                return Some((w, h));
-            }
-        }
+    let media = MediaImpl::new(Files {
+        blocked_mime_types: Default::default(),
+        clamd_host: Default::default(),
+        encryption_key: Default::default(),
+        limit: FilesLimit {
+            max_mega_pixels: 0,
+            max_pixel_side: 0,
+            min_file_size: 0,
+            min_resolution: [0, 0],
+        },
+        preview: Default::default(),
+        s3: FilesS3 {
+            access_key_id: Default::default(),
+            default_bucket: Default::default(),
+            endpoint: Default::default(),
+            path_style_buckets: Default::default(),
+            region: Default::default(),
+            secret_access_key: Default::default(),
+        },
+        scan_mime_types: Default::default(),
+        webp_quality: Default::default(),
+    });
 
-        None
-    } else {
-        None
-    }
+    media.video_size(f)
 }
 
 /// Decode image from reader
 pub fn decode_image<R: Read + BufRead + Seek>(reader: &mut R, mime: &str) -> Result<DynamicImage> {
-    match mime {
-        // Read image using jxl-oxide crate
-        "image/jxl" => {
-            let jxl_image = report_internal_error!(jxl_oxide::JxlImage::builder().read(reader))?;
-            if let Ok(frame) = jxl_image.render_frame(0) {
-                match frame.color_channels().len() {
-                    3 => Ok(DynamicImage::ImageRgb8(
-                        DynamicImage::ImageRgb32F(
-                            ImageBuffer::from_vec(
-                                jxl_image.width(),
-                                jxl_image.height(),
-                                frame.image().buf().to_vec(),
-                            )
-                            .ok_or_else(|| create_error!(ImageProcessingFailed))?,
-                        )
-                        .to_rgb8(),
-                    )),
-                    4 => Ok(DynamicImage::ImageRgba8(
-                        DynamicImage::ImageRgba32F(
-                            ImageBuffer::from_vec(
-                                jxl_image.width(),
-                                jxl_image.height(),
-                                frame.image().buf().to_vec(),
-                            )
-                            .ok_or_else(|| create_error!(ImageProcessingFailed))?,
-                        )
-                        .to_rgba8(),
-                    )),
-                    _ => Err(create_error!(ImageProcessingFailed)),
-                }
-            } else {
-                Err(create_error!(ImageProcessingFailed))
-            }
-        }
-        // Read image using resvg
-        "image/svg+xml" => {
-            // usvg doesn't support Read trait so copy to buffer
-            let mut buf = Vec::new();
-            report_internal_error!(reader.read_to_end(&mut buf))?;
+    let media = MediaImpl::new(Files {
+        blocked_mime_types: Default::default(),
+        clamd_host: Default::default(),
+        encryption_key: Default::default(),
+        limit: FilesLimit {
+            max_mega_pixels: 0,
+            max_pixel_side: 0,
+            min_file_size: 0,
+            min_resolution: [0, 0],
+        },
+        preview: Default::default(),
+        s3: FilesS3 {
+            access_key_id: Default::default(),
+            default_bucket: Default::default(),
+            endpoint: Default::default(),
+            path_style_buckets: Default::default(),
+            region: Default::default(),
+            secret_access_key: Default::default(),
+        },
+        scan_mime_types: Default::default(),
+        webp_quality: Default::default(),
+    });
 
-            let tree = report_internal_error!(usvg::Tree::from_data(&buf, &Default::default()))?;
-            let size = tree.size();
-            let mut pixmap = Pixmap::new(size.width() as u32, size.height() as u32)
-                .ok_or_else(|| create_error!(ImageProcessingFailed))?;
-
-            let mut pixmap_mut = pixmap.as_mut();
-            resvg::render(&tree, Default::default(), &mut pixmap_mut);
-
-            Ok(DynamicImage::ImageRgba8(
-                ImageBuffer::from_vec(
-                    size.width() as u32,
-                    size.height() as u32,
-                    pixmap.data().to_vec(),
-                )
-                .ok_or_else(|| create_error!(ImageProcessingFailed))?,
-            ))
-        }
-        // Check if we can read using image-rs crate
-        _ => report_internal_error!(report_internal_error!(
-            image::ImageReader::new(reader).with_guessed_format()
-        )?
-        .decode()),
-    }
+    report_internal_error!(media.decode_image(reader, mime))
 }
 
 /// Check whether given reader has a valid image
 pub fn is_valid_image<R: Read + BufRead + Seek>(reader: &mut R, mime: &str) -> bool {
-    match mime {
-        // Check if we can read using jxl-oxide crate
-        "image/jxl" => jxl_oxide::JxlImage::builder()
-            .read(reader)
-            .inspect_err(|err| tracing::error!("Failed to read JXL! {err:?}"))
-            .is_ok(),
-        // Check if we can read using image-rs crate
-        _ => !matches!(
-            image::ImageReader::new(reader)
-                .with_guessed_format()
-                .inspect_err(|err| tracing::error!("Failed to read image! {err:?}"))
-                .map(|f| f.decode()),
-            Err(_) | Ok(Err(_))
-        ),
-    }
+    let media = MediaImpl::new(Files {
+        blocked_mime_types: Default::default(),
+        clamd_host: Default::default(),
+        encryption_key: Default::default(),
+        limit: FilesLimit {
+            max_mega_pixels: 0,
+            max_pixel_side: 0,
+            min_file_size: 0,
+            min_resolution: [0, 0],
+        },
+        preview: Default::default(),
+        s3: FilesS3 {
+            access_key_id: Default::default(),
+            default_bucket: Default::default(),
+            endpoint: Default::default(),
+            path_style_buckets: Default::default(),
+            region: Default::default(),
+            secret_access_key: Default::default(),
+        },
+        scan_mime_types: Default::default(),
+        webp_quality: Default::default(),
+    });
+
+    media.is_valid_image(reader, mime)
 }
 
 /// Create thumbnail from given image
 pub async fn create_thumbnail(image: DynamicImage, tag: &str) -> Vec<u8> {
-    // Load configuration
-    let config = config().await;
-    let [w, h] = config.files.preview.get(tag).unwrap();
-
-    // Create thumbnail
-    //.resize(width as u32, height as u32, image::imageops::FilterType::Gaussian)
-    // resize is about 2.5x slower,
-    // thumbnail doesn't have terrible quality
-    // so we use thumbnail
-    let image = image.thumbnail(image.width().min(*w as u32), image.height().min(*h as u32));
-
-    // Encode it into WEBP
-    let encoder = webp::Encoder::from_image(&image).expect("Could not create encoder.");
-    if config.files.webp_quality != 100.0 {
-        encoder.encode(config.files.webp_quality).to_vec()
-    } else {
-        encoder.encode_lossless().to_vec()
-    }
+    let media = MediaImpl::from_config().await;
+    media.create_thumbnail(image, tag)
 }

crates/core/files/src/repositories/encryption_repository.rs

@@ -0,0 +1,6 @@
+use anyhow::Result;
+
+pub trait EncryptionRepository: Send + Sync + 'static {
+    fn decrypt_buffer(&self, buf: Vec<u8>, iv: &str) -> anyhow::Result<Vec<u8>>;
+    fn encrypt_buffer(&self, buf: &[u8]) -> Result<(Vec<u8>, String)>;
+}

crates/core/files/src/repositories/file_storage_repository.rs

@@ -0,0 +1,22 @@
+use anyhow::Result;
+
+#[async_trait::async_trait]
+pub trait FileStorageRepository: Send + Sync + 'static {
+    async fn create_bucket(&self, bucket_id: &str) -> anyhow::Result<()>;
+
+    async fn fetch_and_decrypt_file(
+        &self,
+        bucket_id: &str,
+        path: &str,
+        iv: &str,
+    ) -> Result<Vec<u8>>;
+
+    async fn encrypt_and_upload_file(
+        &self,
+        bucket_id: &str,
+        path: &str,
+        buf: &[u8],
+    ) -> Result<String>;
+
+    async fn delete_file(&self, bucket_id: &str, path: &str) -> Result<()>;
+}

crates/core/files/src/repositories/media_repository.rs

@@ -0,0 +1,30 @@
+use anyhow::Result;
+use image::DynamicImage;
+use std::io::{BufRead, Read, Seek};
+use tempfile::NamedTempFile;
+use thiserror::Error;
+
+pub trait MediaRepository: Send + Sync + 'static {
+    fn image_size(&self, f: &NamedTempFile) -> Option<(usize, usize)>;
+    fn image_size_vec(&self, v: &[u8], mime: &str) -> Option<(usize, usize)>;
+
+    fn decode_image<R: Read + BufRead + Seek>(
+        &self,
+        reader: &mut R,
+        mime: &str,
+    ) -> Result<DynamicImage, MediaError>;
+
+    fn is_valid_image<R: Read + BufRead + Seek>(&self, reader: &mut R, mime: &str) -> bool;
+
+    fn create_thumbnail(&self, image: DynamicImage, tag: &str) -> Vec<u8>;
+
+    fn video_size(&self, f: &NamedTempFile) -> Option<(i64, i64)>;
+}
+
+#[derive(Debug, Error)]
+pub enum MediaError {
+    #[error("image processing failed because {cause}")]
+    ImageProcessingFailed { cause: String },
+    #[error(transparent)]
+    Unknown(#[from] anyhow::Error),
+}

crates/core/files/src/repositories/mod.rs

@@ -0,0 +1,7 @@
+mod encryption_repository;
+mod file_storage_repository;
+mod media_repository;
+
+pub use encryption_repository::EncryptionRepository;
+pub use file_storage_repository::FileStorageRepository;
+pub use media_repository::{MediaError, MediaRepository};

crates/core/files/tests/integration_test.rs

@@ -0,0 +1,31 @@
+use std::io::Cursor;
+
+use revolt_files::{EncryptionKey, FileStorageRepository, MediaImpl, MediaRepository, S3Storage};
+
+#[tokio::test]
+async fn test_image_roundtrip_png() {
+    let media = MediaImpl::from_config().await;
+    let encryption = EncryptionKey::from_config().await;
+    let s3 = S3Storage::from_config(encryption).await;
+
+    let buf = include_bytes!("./assets/test.png");
+    let bucket_id = uuid::Uuid::new_v4().to_string();
+
+    s3.create_bucket(&bucket_id).await.unwrap();
+
+    let mut reader = Cursor::new(buf);
+    media.decode_image(&mut reader, "image/png").unwrap();
+
+    let iv = s3
+        .encrypt_and_upload_file(&bucket_id, "/my-file", buf)
+        .await
+        .unwrap();
+
+    let buf = s3
+        .fetch_and_decrypt_file(&bucket_id, "/my-file", &iv)
+        .await
+        .unwrap();
+
+    let mut reader = Cursor::new(buf);
+    media.decode_image(&mut reader, "image/png").unwrap();
+}

crates/core/files/tests/s3_test.rs

@@ -0,0 +1,42 @@
+use revolt_files::{EncryptionKey, FileStorageRepository, S3Storage};
+
+#[tokio::test]
+async fn test_upload_and_download() {
+    let encryption = EncryptionKey::from_config().await;
+    let s3 = S3Storage::from_config(encryption).await;
+
+    let buf = [67];
+    let bucket_id = uuid::Uuid::new_v4().to_string();
+
+    s3.create_bucket(&bucket_id).await.unwrap();
+
+    let iv = s3
+        .encrypt_and_upload_file(&bucket_id, "/my-file", &buf)
+        .await
+        .unwrap();
+
+    let buf = s3
+        .fetch_and_decrypt_file(&bucket_id, "/my-file", &iv)
+        .await
+        .unwrap();
+
+    assert_eq!(buf.len(), 1);
+    assert_eq!(buf[0], 67);
+}
+
+#[tokio::test]
+async fn test_upload_and_delete() {
+    let encryption = EncryptionKey::from_config().await;
+    let s3 = S3Storage::from_config(encryption).await;
+
+    let buf = [67];
+    let bucket_id = uuid::Uuid::new_v4().to_string();
+
+    s3.create_bucket(&bucket_id).await.unwrap();
+
+    s3.encrypt_and_upload_file(&bucket_id, "/my-file", &buf)
+        .await
+        .unwrap();
+
+    s3.delete_file(&bucket_id, "/my-file").await.unwrap();
+}

crates/core/models/Cargo.toml

@@ -1,10 +1,11 @@
 [package]
 name = "revolt-models"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: API Models"
+repository = "https://github.com/stoatchat/stoatchat"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -20,8 +21,8 @@ default = ["serde", "partials", "rocket"]
 
 [dependencies]
 # Core
-revolt-config = { version = "0.9.4", path = "../config" }
-revolt-permissions = { version = "0.9.4", path = "../permissions" }
+revolt-config = { version = "0.10.0", path = "../config" }
+revolt-permissions = { version = "0.10.0", path = "../permissions" }
 
 # Utility
 regex = "1.11"

crates/core/models/src/v0/server_members.rs

@@ -95,6 +95,7 @@ auto_derived!(
         CanReceive,
         CanPublish,
         JoinedAt,
+        VoiceChannel,
     }
 
     /// Member removal intention

crates/core/parser/Cargo.toml

@@ -1,10 +1,11 @@
 [package]
 name = "revolt-parser"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "MIT"
 authors = ["Zomatree <me@zomatree.live>", "Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: Message Parser"
+repository = "https://github.com/stoatchat/stoatchat"
 
 [dependencies]
 logos = { version = "0.15" }

crates/core/permissions/Cargo.toml

@@ -1,10 +1,11 @@
 [package]
 name = "revolt-permissions"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: Permission Logic"
+repository = "https://github.com/stoatchat/stoatchat"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -21,7 +22,7 @@ async-std = { version = "1.8.0", features = ["attributes"] }
 
 [dependencies]
 # Core
-revolt-result = { version = "0.9.4", path = "../result" }
+revolt-result = { version = "0.10.0", path = "../result" }
 
 # Utility
 auto_ops = "0.3.0"

crates/core/presence/Cargo.toml

@@ -1,10 +1,11 @@
 [package]
 name = "revolt-presence"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: User Presence"
+repository = "https://github.com/stoatchat/stoatchat"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -16,7 +17,7 @@ redis-is-patched = []
 async-std = { version = "1.8.0", features = ["attributes"] }
 
 # Config for loading Redis URI
-revolt-config = { version = "0.9.4", path = "../config" }
+revolt-config = { version = "0.10.0", path = "../config" }
 
 [dependencies]
 # Utility

crates/core/ratelimits/Cargo.toml

@@ -1,18 +1,26 @@
 [package]
 name = "revolt-ratelimits"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2024"
+license = "MIT"
+authors = ["Zomatree <me@zomatree.live>", "Paul Makles <me@insrt.uk>"]
+description = "Revolt Backend: Ratelimit Handler"
+repository = "https://github.com/stoatchat/stoatchat"
 
 [features]
-rocket = ["dep:rocket", "dep:revolt_rocket_okapi", "revolt-database/rocket-impl"]
+rocket = [
+    "dep:rocket",
+    "dep:revolt_rocket_okapi",
+    "revolt-database/rocket-impl",
+]
 axum = ["dep:axum", "revolt-database/axum-impl"]
 
 default = ["rocket", "axum"]
 
 [dependencies]
-revolt-database = { version = "0.9.4", path = "../database"}
-revolt-result = { version = "0.9.4", path = "../result" }
-revolt-config = { version = "0.9.4", path = "../config" }
+revolt-database = { version = "0.10.0", path = "../database" }
+revolt-result = { version = "0.10.0", path = "../result" }
+revolt-config = { version = "0.10.0", path = "../config" }
 
 rocket = { version = "0.5.1", optional = true }
 revolt_rocket_okapi = { version = "0.10.0", optional = true }

crates/core/result/Cargo.toml

@@ -1,10 +1,11 @@
 [package]
 name = "revolt-result"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "MIT"
 authors = ["Paul Makles <me@insrt.uk>"]
 description = "Revolt Backend: Result and Error types"
+repository = "https://github.com/stoatchat/stoatchat"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
@@ -38,4 +39,4 @@ log = "0.4"
 # Axum
 axum = { version = "0.7.5", optional = true }
 
-sentry = { version = "0.31.5", optional = true }
+sentry = { version = "0.31.5", optional = true }

crates/daemons/crond/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-crond"
-version = "0.9.4"
+version = "0.10.0"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <me@insrt.uk>"]
 edition = "2021"
@@ -17,7 +17,7 @@ log = "0.4"
 tokio = { version = "1" }
 
 # Core
-revolt-database = { version = "0.9.4", path = "../../core/database" }
-revolt-result = { version = "0.9.4", path = "../../core/result" }
-revolt-config = { version = "0.9.4", path = "../../core/config" }
-revolt-files = { version = "0.9.4", path = "../../core/files" }
+revolt-database = { version = "0.10.0", path = "../../core/database" }
+revolt-result = { version = "0.10.0", path = "../../core/result" }
+revolt-config = { version = "0.10.0", path = "../../core/config" }
+revolt-files = { version = "0.10.0", path = "../../core/files" }

crates/daemons/pushd/Cargo.toml

@@ -1,21 +1,21 @@
 [package]
 name = "revolt-pushd"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 publish = false
 
 [dependencies]
-revolt-result = { version = "0.9.4", path = "../../core/result" }
-revolt-config = { version = "0.9.4", path = "../../core/config", features = [
+revolt-result = { version = "0.10.0", path = "../../core/result" }
+revolt-config = { version = "0.10.0", path = "../../core/config", features = [
     "report-macros",
     "anyhow"
 ] }
-revolt-database = { version = "0.9.4", path = "../../core/database" }
-revolt-models = { version = "0.9.4", path = "../../core/models", features = [
+revolt-database = { version = "0.10.0", path = "../../core/database" }
+revolt-models = { version = "0.10.0", path = "../../core/models", features = [
     "validator",
 ] }
-revolt-presence = { version = "0.9.4", path = "../../core/presence", features = [
+revolt-presence = { version = "0.10.0", path = "../../core/presence", features = [
     "redis-is-patched",
 ] }
 

crates/daemons/voice-ingress/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-voice-ingress"
-version = "0.9.4"
+version = "0.10.0"
 license = "AGPL-3.0-or-later"
 edition = "2021"
 publish = false

crates/delta/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-delta"
-version = "0.9.4"
+version = "0.10.0"
 license = "AGPL-3.0-or-later"
 authors = ["Paul Makles <paulmakles@gmail.com>"]
 edition = "2018"

crates/delta/src/main.rs

@@ -70,6 +70,15 @@ pub async fn web() -> Rocket<Build> {
         .iter()
         .map(|s| FromStr::from_str(s).unwrap())
         .collect(),
+        expose_headers: [
+            "X-Ratelimit-Limit",
+            "X-Ratelimit-Bucket",
+            "X-Ratelimit-Remaining",
+            "X-Ratelimit-Reset-After",
+        ]
+        .iter()
+        .map(|s| s.to_string())
+        .collect(),
         ..Default::default()
     }
     .to_cors()

crates/delta/src/routes/channels/message_unpin.rs

@@ -1,4 +1,7 @@
-use revolt_database::{util::{permissions::DatabasePermissionQuery, reference::Reference}, Channel, Database, FieldsMessage, PartialMessage, SystemMessage, User, AMQP};
+use revolt_database::{
+    util::{permissions::DatabasePermissionQuery, reference::Reference},
+    Channel, Database, FieldsMessage, PartialMessage, SystemMessage, User, AMQP,
+};
 use revolt_models::v0::MessageAuthor;
 use revolt_permissions::{calculate_channel_permissions, ChannelPermission};
 use revolt_result::{create_error, Result};

crates/delta/src/routes/servers/member_edit.rs

@@ -98,13 +98,21 @@ pub async fn edit(
         permissions.throw_if_lacking_channel_permission(ChannelPermission::DeafenMembers)?;
     }
 
-    let new_voice_channel = if let Some(new_channel) = &data.voice_channel {
+    if data.voice_channel.is_some() && data.remove.contains(&FieldsMember::VoiceChannel) {
+        return Err(create_error!(InvalidOperation))
+    }
+
+    if data.voice_channel.is_some() || data.remove.contains(&FieldsMember::VoiceChannel) {
         if !voice_client.is_enabled() {
             return Err(create_error!(LiveKitUnavailable));
         };
 
-        permissions.throw_if_lacking_channel_permission(ChannelPermission::MoveMembers)?;
+        if member.id.user != user.id {
+            permissions.throw_if_lacking_channel_permission(ChannelPermission::MoveMembers)?;
+        }
+    }
 
+    let new_voice_channel = if let Some(new_channel) = &data.voice_channel {
         // ensure the channel we are moving them to is in the server and is a voice channel
 
         let channel = Reference::from_unchecked(new_channel)
@@ -116,6 +124,9 @@ pub async fn edit(
             Err(create_error!(UnknownChannel))?
         }
 
+        let channel_permissions = calculate_channel_permissions(&mut query.clone().channel(&channel)).await;
+        channel_permissions.throw_if_lacking_channel_permission(ChannelPermission::Connect)?;
+
         if get_user_voice_channel_in_server(&target_user.id, &server.id)
             .await?
             .is_none()
@@ -189,10 +200,8 @@ pub async fn edit(
         partial.avatar = Some(File::use_user_avatar(db, &avatar, &user.id, &user.id).await?);
     }
 
-    let remove_contains_voice = remove.contains(FieldsMember::CanPublish) || remove.contains(FieldsMember::CanReceive);
-
     member
-        .update(db, partial, remove.into_iter().map(Into::into).collect())
+        .update(db, partial, remove.clone().into_iter().map(Into::into).collect())
         .await?;
 
     if let Some(new_voice_channel) = new_voice_channel {
@@ -234,7 +243,7 @@ pub async fn edit(
             .private(target_user.id.clone())
             .await;
         };
-    } else if can_publish.is_some() || can_receive.is_some() || remove_contains_voice {
+    } else if can_publish.is_some() || can_receive.is_some() || remove.contains(FieldsMember::CanPublish) || remove.contains(FieldsMember::CanReceive) {
         if let Some(channel) = get_user_voice_channel_in_server(&target_user.id, &server.id).await?
         {
             let node = get_channel_node(&channel).await?.unwrap();
@@ -253,5 +262,14 @@ pub async fn edit(
         };
     };
 
+    if remove.contains(&FieldsMember::VoiceChannel) {
+        if let Some(channel) = get_user_voice_channel_in_server(&target_user.id, &server.id).await?
+        {
+            let node = get_channel_node(&channel).await?.unwrap();
+
+            voice_client.remove_user(&node, &user.id, &channel).await?;
+        };
+    }
+
     Ok(Json(member.into()))
 }

crates/services/autumn/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-autumn"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 publish = false
@@ -44,16 +44,16 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 # Core crates
-revolt-files = { version = "0.9.4", path = "../../core/files" }
-revolt-config = { version = "0.9.4", path = "../../core/config" }
-revolt-database = { version = "0.9.4", path = "../../core/database", features = [
+revolt-files = { version = "0.10.0", path = "../../core/files" }
+revolt-config = { version = "0.10.0", path = "../../core/config" }
+revolt-database = { version = "0.10.0", path = "../../core/database", features = [
     "axum-impl",
 ] }
-revolt-result = { version = "0.9.4", path = "../../core/result", features = [
+revolt-result = { version = "0.10.0", path = "../../core/result", features = [
     "utoipa",
     "axum",
 ] }
-revolt-ratelimits = { version = "0.9.4", path = "../../core/ratelimits", features = ["axum"] }
+revolt-ratelimits = { version = "0.10.0", path = "../../core/ratelimits", features = ["axum"] }
 
 # Axum / web server
 tempfile = "3.12.0"

crates/services/autumn/src/api.rs

@@ -34,6 +34,12 @@ pub async fn router() -> Router<AppState> {
     let cors = CorsLayer::new()
         .allow_methods([Method::POST])
         .allow_headers(AllowHeaders::mirror_request())
+        .expose_headers(vec![
+            "X-RateLimit-Limit".try_into().unwrap(),
+            "X-RateLimit-Bucket".try_into().unwrap(),
+            "X-RateLimit-Remaining".try_into().unwrap(),
+            "X-RateLimit-Reset-After".try_into().unwrap(),
+        ])
         .allow_origin(Any);
 
     Router::new()

crates/services/gifbox/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-gifbox"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 publish = false
@@ -17,25 +17,26 @@ tokio = { version = "1.0", features = ["full"] }
 reqwest = { version = "0.12", features = ["json"] }
 
 # Core crates
-revolt-config = { version = "0.9.4", path = "../../core/config" }
-revolt-models = { version = "0.9.4", path = "../../core/models" }
-revolt-result = { version = "0.9.4", path = "../../core/result", features = [
+revolt-config = { version = "0.10.0", path = "../../core/config" }
+revolt-models = { version = "0.10.0", path = "../../core/models" }
+revolt-result = { version = "0.10.0", path = "../../core/result", features = [
     "utoipa",
     "axum",
 ] }
-revolt-coalesced = { version = "0.9.4", path = "../../core/coalesced", features = [
+revolt-coalesced = { version = "0.10.0", path = "../../core/coalesced", features = [
     "queue",
 ] }
-revolt-database = { version = "0.9.4", path = "../../core/database", features = [
+revolt-database = { version = "0.10.0", path = "../../core/database", features = [
     "axum-impl",
 ] }
-revolt-ratelimits = { version = "0.9.4", path = "../../core/ratelimits", features = [
+revolt-ratelimits = { version = "0.10.0", path = "../../core/ratelimits", features = [
     "axum",
 ] }
 
 # Axum / web server
 axum = { version = "0.7.5" }
 axum-extra = { version = "0.9", features = ["typed-header"] }
+tower-http = { version = "0.5.2", features = ["cors"] }
 
 # OpenAPI & documentation generation
 utoipa-scalar = { version = "0.1.0", features = ["axum"] }

crates/services/gifbox/src/routes/mod.rs

@@ -1,5 +1,9 @@
 use crate::AppState;
-use axum::routing::{get, Router};
+use axum::{
+    http::Method,
+    routing::{get, Router},
+};
+use tower_http::cors::{AllowHeaders, Any, CorsLayer};
 
 pub mod categories;
 pub mod root;
@@ -7,9 +11,21 @@ pub mod search;
 pub mod trending;
 
 pub fn router() -> Router<AppState> {
+    let cors = CorsLayer::new()
+        .allow_methods([Method::GET])
+        .allow_headers(AllowHeaders::mirror_request())
+        .expose_headers(vec![
+            "X-RateLimit-Limit".try_into().unwrap(),
+            "X-RateLimit-Bucket".try_into().unwrap(),
+            "X-RateLimit-Remaining".try_into().unwrap(),
+            "X-RateLimit-Reset-After".try_into().unwrap(),
+        ])
+        .allow_origin(Any);
+
     Router::new()
         .route("/", get(root::root))
         .route("/categories", get(categories::categories))
         .route("/search", get(search::search))
         .route("/trending", get(trending::trending))
+        .layer(cors)
 }

crates/services/january/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "revolt-january"
-version = "0.9.4"
+version = "0.10.0"
 edition = "2021"
 license = "AGPL-3.0-or-later"
 publish = false
@@ -33,13 +33,13 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 # Core crates
-revolt-config = { version = "0.9.4", path = "../../core/config" }
-revolt-models = { version = "0.9.4", path = "../../core/models" }
-revolt-result = { version = "0.9.4", path = "../../core/result", features = [
+revolt-config = { version = "0.10.0", path = "../../core/config" }
+revolt-models = { version = "0.10.0", path = "../../core/models" }
+revolt-result = { version = "0.10.0", path = "../../core/result", features = [
     "utoipa",
     "axum",
 ] }
-revolt-files = { version = "0.9.4", path = "../../core/files" }
+revolt-files = { version = "0.10.0", path = "../../core/files" }
 
 # Axum / web server
 axum = { version = "0.7.5" }

default.nix

@@ -1,28 +1,41 @@
-{
-  pkgs ? import <nixpkgs> { },
+{ pkgs ? import (fetchTarball {
+    url = "https://github.com/NixOS/nixpkgs/archive/77ef7a29d276c6d8303aece3444d61118ef71ac2.tar.gz";
+    sha256 = "0pm4l48jq8plzrrrisimahxqlcpx7qqq9c99hylmf7p3zlc3phsy";
+  }) {},
 }:
 
-pkgs.mkShell rec {
-  buildInputs = [
-    # Tools
-    pkgs.git
-    pkgs.just
+let
+  nix-ld-libs = pkgs.buildEnv {
+    name = "nix-ld-libs";
+    paths = with pkgs; [
+      stdenv.cc.cc.lib
+      zlib
+      openssl.out
+    ];
+    pathsToLink = [ "/lib" ];
+  };
 
-    # Cargo
-    pkgs.cargo
-    pkgs.cargo-nextest
-    pkgs.cargo-release
-
-    # Rust
-    pkgs.rustc
-    pkgs.clippy
-    pkgs.rustfmt
-    pkgs.pkg-config
-    pkgs.openssl.dev
-
-    # mdbook
-    pkgs.mdbook
+in pkgs.mkShell {
+  packages = with pkgs; [
+    mise
+    cargo-binstall
+    (writeShellScriptBin "fish" ''
+      exec ${pkgs.fish}/bin/fish -C 'mise activate fish | source' "$@"
+    '')
   ];
 
-  RUST_SRC_PATH = "${pkgs.rust.packages.stable.rustPlatform.rustLibSrc}";
-}
+  buildInputs = with pkgs; [
+    pkg-config
+    openssl.dev
+  ];
+
+  shellHook = ''
+    export TMPDIR=/tmp
+    export NIX_LD="${pkgs.stdenv.cc.libc}/lib/ld-linux-x86-64.so.2"
+    export NIX_LD_LIBRARY_PATH="${nix-ld-libs}/lib"
+    export LD_LIBRARY_PATH="${nix-ld-libs}/lib''${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+
+    export MISE_NODE_COMPILE=false
+    eval "$(mise activate bash)"
+  '';
+}

rust-toolchain.toml

@@ -1,2 +1,2 @@
 [toolchain]
-channel = "stable"
+channel = "1.92.0"

scripts/start.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-set -e
-cargo build \
-    --bin revolt-delta \
-    --bin revolt-bonfire \
-    --bin revolt-autumn \
-    --bin revolt-january \
-    --bin revolt-gifbox
-
-trap 'pkill -f revolt-' SIGINT
-cargo run --bin revolt-delta &
-cargo run --bin revolt-bonfire &
-cargo run --bin revolt-autumn &
-cargo run --bin revolt-january &
-cargo run --bin revolt-gifbox

version.txt

@@ -1 +1 @@
-0.9.4
+0.10.0