Major architecture update: stable identity, component validation, media indexing, and protocol docs

Add baseline unit tests and fix home server normalization
Implement components + uploads flow and gateway-aligned payloads
2026-02-27 19:33:35 +03:00 · 2026-02-20 17:45:10 +03:00 · 2026-02-20 17:41:08 +03:00 · 2026-02-20 16:37:30 +03:00 · 2026-02-20 15:01:55 +03:00 · 2026-02-20 04:24:27 +03:00
21 changed files with 3764 additions and 402 deletions
@@ -21,3 +21,12 @@ build/
 # OS
 .DS_Store
 Thumbs.db
 # Conversation exports (local only)
 conversation_export/
 uploads/
 objectbox/
 objectbox.dll
 # AI
 .claude
@@ -1,248 +1,162 @@
-# Chat Server Architecture - Complete Reference
+# Reliquary Server Architecture
-## Project Overview
+## 1. Overview
 Reliquary is a self-hosted chat server with:
 - JWT auth
 - ObjectBox persistence
 - WebSocket gateway fanout
 - Component-based messages
 - Decoupled upload pipeline (upload first, message commit anytime)
-Self-hosted Discord alternative with decentralized identity. Each user has a "home server" where their identity lives, and can join other "guest servers" seamlessly using cryptographic signatures.
+## 2. Identity and Roles (Current)
 - `userId` is an immutable opaque identifier (host-independent).
 - `handle` is derived metadata: `@username@home`.
 - `ChatUser.roles` controls authorization (`admin`, `member`, etc.).
 - `GET /api/me` returns `roles` so the client can gate admin UI.
-## Core Architecture Decisions
+### Runtime Config Split
 - `server.bind_host` + `server.bind_port`: where Relic listens locally.
 - `server.public_base_url`: canonical external URL used for identity/handles/cross-server metadata.
 - This avoids conflating local bind settings with public identity/routing.
-### Home Server Model
+### First Admin Bootstrap
- **NO identity server** - just use one regular server as "home"
+- Config key: `server.first_setup` in `config.yaml`.
- **NO federation protocol** - servers don't talk to each other
+- When `first_setup: true`, the first registered local user gets `admin`.
- **Client does everything** - syncs, cross-server requests, profile updates
+- Later registrations remain `member`.
-### Identity System
+## 3. Storage Model
 - Ed25519 keypair generated on registration
 - Private key = proof of identity
 - Public key stored on home server at `/.well-known/users/:username`
 - userId format: `username@serverhost`
-### Single Sign-On Flow
+### 3.1 Entities
-1. User registers/logs in ONCE on home server
+- `ChatUser`: identity/profile/auth data.
-2. Gets JWT token + encrypted keypair
+- `ChatChannel`: channel metadata.
-3. To join other servers: sign a message with private key
+- `ChatMessage`: channel message, search text, and `componentsJson`.
-4. Other server verifies signature against home server's public key
+- `ChatFile`: canonical media object for:
-5. No password ever sent to guest servers
+  - message attachments
  - user avatar media
  - server icon/banner media
 - `ServerSettings`: singleton row for mutable server presentation settings.
---
+### 3.2 ChatFile Fields (Important)
 - `attachmentId` (unique external ID; API-facing)
 - `originalFileName` (preserved filename metadata)
 - `storedFileName` (physical disk key)
 - `sha256`
 - `mimeType`, `sizeBytes`, `width`, `height`
 - `usageType`: `message | avatar | server_icon | server_banner`
 - `status`: `pending | ready | failed`
-## What's Implemented
+## 4. Upload and Message Flow
-### ✅ Done
+### 4.1 Recommended Client Flow (Implemented Server Contract)
- User model with keypair, home server reference
+1. Client stages attachment in composer/component editor.
- Channel and Message models
+2. Client calls `POST /api/uploads/init` to create pending upload.
- Crypto service (keypair generation, signing, verification)
+3. Client uploads bytes to `PUT /api/uploads/:uploadId`.
- JWT authentication middleware
+4. Client sends `POST /api/messages` with components referencing `uploadId`/`attachmentId`.
- Register handler (creates keypair)
+5. If upload completes after message create, server emits `message.updated`.
 - Login handler (returns encrypted keypair for device sync)
 - Join server handler (signature-based verification - stub)
 - Public endpoints for cross-server identity verification
 - Channel CRUD
 - Message CRUD with author caching
-### ❌ Not Implemented
+### 4.2 Why This Flow
- HTTP client for cross-server public key fetching
+- No chronological jumping for text.
- WebSocket for real-time messages
+- Immediate local optimistic UI.
- Profile sync (push updates to all servers)
+- Progressive media readiness via gateway updates.
- Sticker packs (future feature)
+- Server keeps authoritative metadata and storage consistency.
 - File uploads
 - Permissions system (roles exist but not enforced)
 - Message editing/deletion permissions
---
+## 5. API Surface
-## Database Models
+### 5.0 Identity Contract
 - Registration returns:
  - `userId` (opaque stable ID)
  - `username`
  - `handle` (computed, mutable as home host changes)
 - Cross-server join request now expects:
  - `userId`
  - `username`
  - `homeServer`
  - `timestamp`
  - `signature` over `userId:timestamp`
-```dart
+### 5.1 Uploads and Attachments
-// User - works for both HOME and GUEST servers
+- `POST /api/uploads/init` (auth)
-@Entity()
+- `PUT /api/uploads/:uploadId` (auth)
-class User {
+- `POST /api/uploads` (auth, legacy single-step compatibility)
-  int id;
+- `GET /attachments/:attachmentId` (public immutable media URL)
-  String userId;           // "alice@homeserver.com"
+- `GET /api/channels/:channelId/media` (auth, gallery index feed)
  String username;
  String? displayName, avatarUrl, bio;
  String publicKey;        // Ed25519, always stored
  // HOME SERVER ONLY:
  String? passwordHash;
  String? encryptedPrivateKey;  // For device sync
  String? keyPairSalt;
  bool isLocal;            // true = this is home server
  String? homeServer;      // if guest, where is home?
  List<String> roles;      // Server-specific
  DateTime createdAt, lastSyncedAt;
 }
-@Entity()
+### 5.2 Profile and Server Media
-class Channel {
+- `PATCH /api/me` (auth): update profile text fields.
-  int id;
+- `PUT /api/me/avatar` (auth): bind uploaded media as avatar.
-  String name;
+- `GET /avatars/:userId` (public alias for current avatar).
-  String? description;
+- `GET /icons/:serverId` (public alias for current server icon).
-  DateTime createdAt;
+- `GET /banners/:serverId` (public alias for current server banner).
 }
-@Entity()
+### 5.3 Server Settings
-class Message {
+- `GET /api/server/settings` (auth)
-  int id;
+- `PATCH /api/server/settings` (admin)
-  int channelId;
+- `PUT /api/server/icon` (admin)
-  
+- `PUT /api/server/banner` (admin)
-  // Author info (includes cross-server fetch capability)
+
-  int authorLocalId;
+## 6. Gateway Behavior
-  String authorUserId;       // "alice@home.server"
+- Existing events:
-  String? authorHomeServer;
+  - `message.created`
-  
+  - `message.updated`
-  // Cached snapshot at message time
+  - `message.deleted`
-  String authorUsername;
+- For upload-driven updates:
-  String? authorAvatarUrl;
+  - A message can be created with media items in `uploading`.
-  
+  - When upload becomes ready, server rewrites affected components and emits `message.updated`.
-  String content;
+
-  DateTime createdAt, editedAt;
+## 7. Component Media Item Contract (Client)
 Each media item in a component should carry stable IDs and upload state:
 ```json
 {
  "itemId": "local_or_stable_id",
  "source": "local_upload|external_url",
  "uploadId": "pending_or_ready_attachment_id",
  "attachmentId": "same_as_uploadId_when_known",
  "status": "uploading|ready|failed",
  "url": "/attachments/<attachmentId>",
  "originalFileName": "image.png",
  "mimeType": "image/webp",
  "sizeBytes": 12345,
  "width": 1280,
  "height": 720,
  "thumbHash": "optional"
 }
 ```
---
+### 7.1 Validation Rules (Server)
 - Every component node must include:
  - `id` (string)
  - `type` (string)
  - `typeVersion` (positive int)
  - `data` (object)
 - Nested components are supported under `data.children` with depth/size limits.
 - Media item rules:
  - `source=local_upload` => `attachmentId` required.
  - `source=external_url` => valid `http/https` `url` required.
 - Invalid component payloads are rejected server-side.
-## API Endpoints
+## 8. Client Implementation Notes
-### Public (No Auth)
+### 8.1 Staging and Transform Choice
-```
+On file pick/drop, choose transform mode before upload starts:
-POST /auth/register     → Create account on HOME server (generates keypair)
+- `Compressed WebP` (recommended default)
-POST /auth/login        → Login to HOME server (returns keypair backup)
+- `WebP`
-POST /auth/join         → Join THIS server with signature (no password)
+- `Original`
-GET /.well-known/users/:username   → Public profile + public key
+If user changes mode for a staged file:
-GET /.well-known/verify/:userId    → Verify user exists
+- cancel in-flight upload
-GET /.well-known/server            → Server info
+- reprocess
-```
+- re-upload
-### Protected (JWT Required)
+### 8.2 Metadata Trust
-```
+Client may send metadata hints, but server metadata is canonical.
-GET  /api/me                      → Current user profile
+Client should refresh with upload response values.
-GET  /api/channels                → List channels
+### 8.3 Caching
-POST /api/channels                → Create channel
+- `/attachments/:attachmentId`: immutable and long-cache.
-GET  /api/channels/:id            → Get channel
+- `/avatars`, `/icons`, `/banners`: mutable aliases; revalidate frequently.
-GET  /api/messages?channelId=X    → Get messages
+## 9. AVIF and JPEG XL Policy
-POST /api/messages                → Send message
+- MVP default: WebP (best compatibility/perf tradeoff).
-PUT  /api/messages/:id            → Edit message
+- AVIF: optional client mode if target platform decode support is verified.
-DELETE /api/messages/:id          → Delete message
+- JPEG XL: defer for now due to uneven ecosystem support.
 ```
 ---
 ## Key Files
 ```
 lib/
 ├── server.dart              # Entry point, routes, ObjectBox init
 ├── models.dart              # User, Channel, Message entities
 ├── objectbox.g.dart         # Generated
 │
 ├── config/config.dart       # Server host, JWT secret, port
 │
 └── src/
    ├── auth/
    │   ├── crypto_service.dart   # Keypair, signing, encryption
    │   └── auth_middleware.dart  # JWT verification
    │
    ├── handlers/
    │   ├── auth_handlers.dart    # register, login, join, me
    │   ├── public_handlers.dart  # .well-known/* 
    │   ├── channel_handlers.dart
    │   └── message_handlers.dart
    │
    └── utils/extensions.dart     # Request/Response helpers
 ```
 ---
 ## Join Server Flow (Needs Implementation)
 ```
 CLIENT                              GUEST SERVER              HOME SERVER
  │                                      │                         │
  │ POST /auth/join                      │                         │
  │ {userId, homeServer, timestamp,      │                         │
  │  signature}                          │                         │
  │─────────────────────────────────────►│                         │
  │                                      │                         │
  │                                      │ GET /.well-known/users/ │
  │                                      │ alice                   │
  │                                      │────────────────────────►│
  │                                      │                         │
  │                                      │ {publicKey, ...}        │
  │                                      │◄────────────────────────│
  │                                      │                         │
  │                                      │ verify signature         │
  │                                      │ create shadow account    │
  │                                      │                         │
  │ {token, localId}                     │                         │
  │◄─────────────────────────────────────│                         │
 ```
 The `fetchPublicKeyFromHomeServer()` function in `auth_handlers.dart` needs actual HTTP implementation.
 ---
 ## Tech Stack
 - **Framework**: Relic 1.0 (Dart web server)
 - **Database**: ObjectBox
 - **Auth**: JWT + Ed25519 signatures
 - **Crypto**: crypton package for Ed25519
 - **Password**: bcrypt
 ---
 ## Design Decisions Rationale
 | Decision | Why |
 |----------|-----|
 | No identity server | Avoids hosting another service, one server = home |
 | No server-to-server | Eliminates federation complexity, client handles everything |
 | Keypair identity | Allows passwordless joins, proves identity cryptographically |
 | Message author caching | Messages readable even if home server is down |
 | userId format `user@server` | Simple, familiar, self-documenting |
 ---
 ## Constraints
 - User CANNOT quit home server (that's where identity lives)
 - User CANNOT change home server easily (migration = future feature)
 - Home server MUST be online to join NEW servers
 - Home server offline = can still use already-joined servers (cached keys)
 ---
 ## Future Features (Out of Scope for MVP)
 1. **Sticker Packs** - Telegram-style, live on community servers, clients cache
 2. **Home Server Migration** - Sign migration certificate, chain of trust
 3. **File Uploads** - With cross-server URLs
 4. **Message Forwarding** - Embed with link to original
 5. **Permissions** - Role-based access to channels
 6. **WebSocket** - Real-time message delivery
 ---
 ## Config to Change
 ```dart
 // lib/config/config.dart
 static const String serverHost = 'your-actual-domain.com';  // CHANGE THIS
 static const String jwtSecret = 'use-env-variable';         // CHANGE THIS
 ```
 ---
 ## Next Steps
 1. Implement HTTP client in `fetchPublicKeyFromHomeServer()`
 2. Add WebSocket for real-time
 3. Add profile sync (client pushes to all servers on change)
 4. Test cross-server join flow
 5. Add proper error handling and logging
@@ -0,0 +1,140 @@
 # Reliquary Protocol (MVP v1)
 This document defines the current wire contract used by the server.
 ## 1. Identity
 - `userId`: immutable opaque ID.
 - `username`: home-server unique, mutable.
 - `handle`: derived string `@username@home`.
 - `homeServer`: canonical public base URL.
 ## 2. Auth
 ### `POST /auth/register`
 Request:
 ```json
 { "username": "alice", "password": "password123" }
 ```
 Response fields include:
 - `token`
 - `userId`
 - `username`
 - `handle`
 - `publicKey`
 - encrypted key backup fields
 ### `POST /auth/login`
 Request:
 ```json
 { "username": "alice", "password": "password123" }
 ```
 Response includes token + profile/key fields.
 ### `POST /auth/join`
 Request:
 ```json
 {
  "userId": "opaque_id",
  "username": "alice",
  "homeServer": "https://chat.example.com",
  "timestamp": 1730000000,
  "signature": "base64..."
 }
 ```
 Signature is over `userId:timestamp`.
 ## 3. Message Components
 Each component node must include:
 - `id` (string)
 - `type` (string)
 - `typeVersion` (positive int)
 - `data` (object)
 Optional:
 - `fallback`, `modifiers`
 Nested components are supported under `data.children`.
 ## 4. Media Item Sources
 Media references support two sources:
 1. Local upload:
 ```json
 {
  "source": "local_upload",
  "attachmentId": "att_...",
  "status": "uploading|ready|failed"
 }
 ```
 2. External URL:
 ```json
 {
  "source": "external_url",
  "url": "https://example.com/image.jpg",
  "status": "ready"
 }
 ```
 Optional metadata snapshot:
 - `mimeType`, `sizeBytes`, `width`, `height`, `thumbHash`, `originalFileName`, `caption`.
 ## 5. Uploads
 ### `POST /api/uploads/init` (auth)
 Creates pending upload and returns `uploadId` (same ID namespace as attachment ID).
 ### `PUT /api/uploads/:uploadId` (auth)
 Completes upload with file bytes and returns canonical metadata:
 - `attachmentId`, `url`, `status`, `mimeType`, `sizeBytes`, dimensions, hash.
 ### `POST /api/uploads` (auth)
 Legacy single-step compatibility endpoint.
 ### `GET /attachments/:attachmentId`
 Immutable media URL.
 ## 6. Messages
 ### `POST /api/messages` (auth)
 Request includes:
 - `channelId`
 - `components` or `componentsJson`
 - optional `content`
 Server behavior:
 - validates structure and media refs
 - normalizes media items
 - computes searchable `content`
 - persists `componentsJson`
 ### `GET /api/messages?channelId=...`
 Returns message list with `componentsJson`.
 ## 7. Gallery Index
 ### `GET /api/channels/:channelId/media` (auth)
 Returns indexed media rows for grid views.
 Query params:
 - `limit` (default 50, max 100)
 - `before` cursor
 - `kind` (`image|video|file`)
 Each row includes:
 - linkage (`messageId`, `channelId`, `authorUserId`)
 - source (`attachmentId` or `externalUrl`)
 - display metadata (`mimeType`, dimensions, filename, etc.)
 ## 8. Gateway
 WebSocket path: `/gateway`
 Message events:
 - `message.created`
 - `message.updated`
 - `message.deleted`
 Upload resolution can cause `message.updated`.
@@ -11,6 +11,7 @@ Each user has a **home server** where their identity lives (keypair), and can se
 - **Client does everything** - syncs, cross-server requests, profile updates
 See [ARCHITECTURE.md](./ARCHITECTURE.md) for full details.
 See [CLIENT_INTEGRATION.md](./CLIENT_INTEGRATION.md) for client protocol/API integration details.
 ## Quick Start
@@ -43,4 +44,4 @@ lib/
 - **Framework**: Relic 1.0
 - **Database**: ObjectBox
- **Auth**: JWT + Ed25519 signatures
+- **Auth**: JWT + ECDSA signatures
@@ -1,14 +1,162 @@
 import 'dart:io';
 import 'dart:convert';
 import 'dart:math';
 import 'package:yaml/yaml.dart';
 class Config {
-  // Server settings
+  static late String bindHost;
-  static const int port = 9870;
+  static late int bindPort;
  static late String publicBaseUrl;
  static late String serverName;
  static late String jwtSecret;
  static late bool configured;
  static late bool setupMode;
  static late int bootstrapAdminLimit;
  static late bool devDbTools;
  // IMPORTANT: Set this to your actual server host/domain
  // Used for generating userId: "username@serverHost"
  static const String serverHost = 'localhost:9870';
  static const String serverName = 'Chat Server';
  // JWT settings
  // TODO: Move to environment variable in production
  static const String jwtSecret = 'your_super_secret_key_change_in_production';
  static const Duration tokenExpiry = Duration(days: 7);
  static void initialize() {
    final configFile = File('config.yaml');
    if (!configFile.existsSync()) {
      final generatedSecret = _generateJwtSecret();
      configFile.writeAsStringSync(_defaultConfig(generatedSecret));
      print('✅ Generated config.yaml (first run).');
      print('⚠️ Review server.public_base_url and security.jwt_secret before production use.');
    }
    final yamlString = configFile.readAsStringSync();
    final yamlMap = loadYaml(yamlString) as YamlMap;
    final serverMap = yamlMap['server'] as YamlMap?;
    final securityMap = yamlMap['security'] as YamlMap?;
    serverName = (serverMap?['name'] as String?)?.trim() ?? '';
    bindHost = (serverMap?['bind_host'] as String?)?.trim() ?? (serverMap?['host'] as String?)?.trim() ?? '127.0.0.1';
    bindPort = (serverMap?['bind_port'] as int?) ?? (serverMap?['port'] as int?) ?? 9870;
    final rawPublicBaseUrl =
        (serverMap?['public_base_url'] as String?)?.trim() ?? _legacyPublicBaseUrlFromHost((serverMap?['host'] as String?)?.trim());
    publicBaseUrl = _normalizePublicBaseUrl(rawPublicBaseUrl) ?? '';
    configured = (serverMap?['configured'] as bool?) ?? false;
    setupMode = (serverMap?['first_setup'] as bool?) ?? false;
    bootstrapAdminLimit = (serverMap?['bootstrap_admin_limit'] as int?) ?? 1;
    devDbTools = (serverMap?['dev_db_tools'] as bool?) ?? false;
    jwtSecret = (securityMap?['jwt_secret'] as String?)?.trim() ?? '';
    if (serverName.isEmpty) {
      throw StateError('config.yaml: server.name is required.');
    }
    if (bindHost.isEmpty) {
      throw StateError('config.yaml: server.bind_host is required.');
    }
    if (bindPort <= 0 || bindPort > 65535) {
      throw StateError('config.yaml: server.bind_port must be between 1 and 65535.');
    }
    if (publicBaseUrl.isEmpty) {
      throw StateError(
        'config.yaml: server.public_base_url is required (example: https://chat.example.com).',
      );
    }
    if (jwtSecret.isEmpty) {
      throw StateError('config.yaml: security.jwt_secret is required.');
    }
    if (!configured) {
      throw StateError(
        'Server setup is not complete.\n'
        'Edit config.yaml and set:\n'
        '  server.configured: true\n'
        'After reviewing server.public_base_url and security.jwt_secret.',
      );
    }
    if (bootstrapAdminLimit < 0) {
      throw StateError('config.yaml: server.bootstrap_admin_limit must be >= 0.');
    }
    print(
      '🚀 Server Config Loaded: $serverName (bind=$bindHost:$bindPort, public=$publicBaseUrl, configured=$configured, setupMode=$setupMode, bootstrapAdminLimit=$bootstrapAdminLimit, devDbTools=$devDbTools)',
    );
  }
  static String _generateJwtSecret() {
    final random = Random.secure();
    final bytes = List<int>.generate(32, (_) => random.nextInt(256));
    return base64UrlEncode(bytes);
  }
  static String _defaultConfig(String generatedSecret) => '''
 # Reliquary Server Configuration
 server:
  # Display name shown in clients
  name: "Reliquary Server"
  # Local bind address for the HTTP server
  bind_host: "127.0.0.1"
  # Local bind port for the HTTP server
  bind_port: 9870
  # Public base URL used for identity, handles, and cross-server references
  # Dev example: http://localhost:9870
  # Prod example: https://chat.example.com
  public_base_url: "http://localhost:9870"
  # Set to true after reviewing this file; server refuses to start while false
  configured: false
  # First local registration becomes admin
  first_setup: true
  # Number of local registrations auto-promoted to admin while first_setup=true
  bootstrap_admin_limit: 1
  # Testing-only DB admin/debug endpoints
  dev_db_tools: true
 security:
  # Auto-generated on first run; replace for production
  jwt_secret: "$generatedSecret"
 ''';
  static String get publicHost {
    final uri = Uri.tryParse(publicBaseUrl);
    if (uri == null || uri.host.isEmpty) {
      return publicBaseUrl;
    }
    return uri.hasPort ? '${uri.host}:${uri.port}' : uri.host;
  }
  static String? _normalizePublicBaseUrl(String? value) {
    if (value == null || value.trim().isEmpty) {
      return null;
    }
    final uri = Uri.tryParse(value.trim());
    if (uri == null || uri.host.isEmpty) {
      return null;
    }
    if (uri.scheme != 'http' && uri.scheme != 'https') {
      return null;
    }
    return Uri(
      scheme: uri.scheme,
      host: uri.host,
      port: uri.hasPort ? uri.port : null,
    ).toString().replaceAll(RegExp(r'/$'), '');
  }
  static String? _legacyPublicBaseUrlFromHost(String? hostValue) {
    if (hostValue == null || hostValue.trim().isEmpty) {
      return null;
    }
    final host = hostValue.trim();
    if (host.contains('://')) {
      return host;
    }
    final lower = host.toLowerCase();
    final isLocal = lower.startsWith('localhost') || lower.startsWith('127.') || lower.startsWith('[::1]');
    final scheme = isLocal ? 'http' : 'https';
    return '$scheme://$host';
  }
 }
@@ -16,7 +16,7 @@ class ChatUser {
  @Id()
  int id = 0;
-  // Global identifier: "username@homeserver.com"
+  // Global immutable identifier (opaque, host-independent).
  @Unique()
  String userId;
@@ -28,7 +28,7 @@ class ChatUser {
  String? bio;
  // Identity
-  String publicKey; // Ed25519 public key, always stored
+  String publicKey; // ECDSA public key, always stored
  // HOME SERVER ONLY: Auth & key backup
  String? passwordHash;
@@ -37,8 +37,7 @@ class ChatUser {
  // Server relationship
  bool isLocal; // true = this is their home server
-  String?
+  String? homeServer; // if guest, where is their home? (e.g., "https://my.server.com")
      homeServer; // if guest, where is their home? (e.g., "https://my.server.com")
  // Server-specific
  List<String> roles; // ["admin", "moderator", "member"]
@@ -98,7 +97,7 @@ class ChatMessage {
  // Author info - includes enough for cross-server profile fetch
  int authorLocalId;
-  String authorUserId; // "alice@homeserver.com"
+  String authorUserId; // Immutable userId
  String? authorHomeServer; // for profile fetching
  // Cached for display (snapshot at message time)
@@ -106,6 +105,7 @@ class ChatMessage {
  String? authorAvatarUrl;
  String content;
  String componentsJson;
  @Property(type: PropertyType.date)
  DateTime createdAt;
@@ -119,9 +119,126 @@ class ChatMessage {
    required this.authorUserId,
    required this.authorUsername,
    required this.content,
    required this.componentsJson,
    this.authorHomeServer,
    this.authorAvatarUrl,
    DateTime? createdAt,
    this.editedAt,
  }) : createdAt = createdAt ?? DateTime.now();
 }
@Entity()
 class ChatFile {
  @Id()
  int id = 0;
  @Unique()
  String attachmentId;
  int uploaderId;
  String path;
  String originalFileName;
  String storedFileName;
  String sha256;
  String mimeType;
  int width;
  int height;
  int sizeBytes;
  bool isAttached;
  String usageType; // message | avatar | server_icon | server_banner
  String status; // pending | ready | failed
  String? errorCode;
  @Property(type: PropertyType.date)
  DateTime createdAt;
  ChatFile({
    required this.attachmentId,
    required this.uploaderId,
    required this.path,
    required this.originalFileName,
    required this.storedFileName,
    required this.sha256,
    required this.mimeType,
    required this.width,
    required this.height,
    required this.sizeBytes,
    this.usageType = 'message',
    this.status = 'pending',
    this.isAttached = false,
    this.errorCode,
    DateTime? createdAt,
  }) : createdAt = createdAt ?? DateTime.now();
 }
@Entity()
 class ServerSettings {
  @Id()
  int id = 0;
  @Unique()
  String singletonKey;
  String serverName;
  String? description;
  String? iconAttachmentId;
  String? bannerAttachmentId;
  String? updatedByUserId;
  @Property(type: PropertyType.date)
  DateTime updatedAt;
  ServerSettings({
    this.singletonKey = 'default',
    required this.serverName,
    this.description,
    this.iconAttachmentId,
    this.bannerAttachmentId,
    this.updatedByUserId,
    DateTime? updatedAt,
  }) : updatedAt = updatedAt ?? DateTime.now();
 }
@Entity()
 class ChatMessageMedia {
  @Id()
  int id = 0;
  int messageId;
  int channelId;
  String authorUserId;
  // local_upload
  String? attachmentId;
  // external_url
  String? externalUrl;
  // image | video | file
  String kind;
  String? mimeType;
  String? originalFileName;
  int? sizeBytes;
  int? width;
  int? height;
  String? thumbHash;
  @Property(type: PropertyType.date)
  DateTime createdAt;
  ChatMessageMedia({
    required this.messageId,
    required this.channelId,
    required this.authorUserId,
    required this.kind,
    this.attachmentId,
    this.externalUrl,
    this.mimeType,
    this.originalFileName,
    this.sizeBytes,
    this.width,
    this.height,
    this.thumbHash,
    DateTime? createdAt,
  }) : createdAt = createdAt ?? DateTime.now();
 }
@@ -1,12 +1,17 @@
-import 'package:hotreloader/hotreloader.dart';
+import 'dart:io';
 import 'package:relic/relic.dart';
 import 'config/config.dart';
 import 'src/auth/auth_middleware.dart';
 import 'src/gateway/gateway_handlers.dart';
 import 'src/handlers/auth_handlers.dart';
 import 'src/handlers/channel_handlers.dart';
 import 'src/handlers/dev_db_handlers.dart';
 import 'src/handlers/message_handlers.dart';
 import 'src/handlers/public_handlers.dart';
 import 'src/handlers/settings_handlers.dart';
 import 'src/handlers/upload_handlers.dart';
 import 'src/state/app_state.dart';
 RelicApp? _currentApp;
@@ -26,12 +31,32 @@ Future<void> startServer() async {
    ..get('/.well-known/users/:username', publicUserHandler)
    ..get('/.well-known/verify/:userId', publicVerifyHandler)
    ..get('/.well-known/server', publicServerInfoHandler)
    ..get('/uploads/:fileName', getUploadFileHandler)
    ..get('/attachments/:attachmentId', getAttachmentHandler)
    ..get('/avatars/:userId', getAvatarAliasHandler)
    ..get('/icons/:serverId', getServerIconAliasHandler)
    ..get('/banners/:serverId', getServerBannerAliasHandler)
    ..get('/gateway', gatewayHandler)
    // ============ PROTECTED ENDPOINTS (requires auth) ============
    ..use('/api', jwtMiddleware)
    // Current user
    ..get('/api/me', getMeHandler)
    ..patch('/api/me', updateProfileHandler)
    ..put('/api/me/avatar', setAvatarHandler)
    // Server settings
    ..get('/api/server/settings', getServerSettingsHandler)
    ..patch('/api/server/settings', patchServerSettingsHandler)
    ..put('/api/server/icon', setServerIconHandler)
    ..put('/api/server/banner', setServerBannerHandler)
    // Dev DB tools (testing only, admin only, requires config flag)
    ..get('/api/dev/db/snapshot', getDevDbSnapshotHandler)
    ..post('/api/dev/db/reset', resetDevDbHandler)
    ..post('/api/dev/users/promote-admin', promoteUserToAdminHandler)
    ..post('/api/dev/users/demote-admin', demoteUserFromAdminHandler)
    // Channels
    ..get('/api/channels', getChannelsHandler)
@@ -40,6 +65,10 @@ Future<void> startServer() async {
    // Messages
    ..get('/api/messages', getMessagesHandler)
    ..get('/api/channels/:channelId/media', getChannelMediaHandler)
    ..post('/api/uploads/init', initUploadHandler)
    ..put('/api/uploads/:uploadId', completeUploadHandler)
    ..post('/api/uploads', uploadFileHandler)
    ..post('/api/messages', sendMessageHandler)
    ..put('/api/messages/:messageId', editMessageHandler)
    ..delete('/api/messages/:messageId', deleteMessageHandler)
@@ -49,26 +78,28 @@ Future<void> startServer() async {
    ..fallback = respondWith((_) => Response.notFound());
  print('');
-  print('╔════════════════════════════════════════════╗');
+  print('🚀 Server starting...');
-  print('║  🚀 Server starting...                      ║');
+  print('Bind: ${'${Config.bindHost}:${Config.bindPort}'.padRight(34)}');
-  print('║  Host: ${Config.serverHost.padRight(34)}║');
+  print('Public URL: ${Config.publicBaseUrl.padRight(26)}');
  print('║  URL:  http://localhost:${Config.port.toString().padRight(26)}║');
  print('╚════════════════════════════════════════════╝');
  print('');
-  await _currentApp!.serve(port: Config.port);
+  final bindAddress = InternetAddress.tryParse(Config.bindHost) ?? (await InternetAddress.lookup(Config.bindHost)).first;
  await _currentApp!.serve(
    address: bindAddress,
    port: Config.bindPort,
  );
 }
 Future<void> stopServer() async {
  await _currentApp?.close();
  _currentApp = null;
 }
 void main() async {
-  initializeStore();
+  Config.initialize();
-  // Enable hot reload in development
+  initializeStore();
  await HotReloader.create(
    onAfterReload: (ctx) async {
      print('🔄 Changes detected! Restarting server...');
      await startServer();
    },
  );
  await startServer();
 }
@@ -29,7 +29,7 @@ class KeyPair {
 }
 class CryptoService {
-  /// Generate a new Ed25519 key pair
+  /// Generate a new ECDSA key pair
  static KeyPair generateKeyPair() {
    final keyPair = crypton.ECKeypair.fromRandom();
    return KeyPair(
@@ -0,0 +1,442 @@
 import 'dart:async';
 import 'dart:convert';
 import 'package:relic/relic.dart';
 import 'package:web_socket/web_socket.dart';
 import '../auth/crypto_service.dart';
 import '../state/app_state.dart';
 final _gatewayRegistry = _GatewayRegistry();
 /// WebSocket gateway with JWT auth and channel subscriptions.
 Result gatewayHandler(Request req) {
  final token = _extractGatewayToken(req);
  if (token == null) {
    return Response.unauthorized(
      body: Body.fromString('Bearer token required'),
    );
  }
  final payload = AuthService.verifyToken(token);
  if (payload == null) {
    return Response.forbidden(
      body: Body.fromString('Invalid or expired token'),
    );
  }
  final userId = payload['sub'] as String?;
  final username = payload['username'] as String?;
  if (userId == null || userId.isEmpty) {
    return Response.forbidden(
      body: Body.fromString('Invalid token payload'),
    );
  }
  return WebSocketUpgrade((webSocket) {
    webSocket.pingInterval = const Duration(seconds: 30);
    final connection = _gatewayRegistry.register(
      socket: webSocket,
      userId: userId,
      username: username,
    );
    _sendGatewayPayload(
      connection.id,
      {
        'op': 'ready',
        'connectionId': connection.id,
        'userId': connection.userId,
        if (connection.username != null) 'username': connection.username,
      },
    );
    webSocket.events.listen(
      (event) {
        switch (event) {
          case TextDataReceived(text: final text):
            _handleGatewayTextMessage(connection.id, text);
          case BinaryDataReceived():
            _sendProtocolError(
              connection.id,
              'Binary payloads are not supported',
            );
          case CloseReceived():
            _gatewayRegistry.unregister(connection.id);
        }
      },
      onError: (_, __) {
        _gatewayRegistry.unregister(connection.id);
      },
      onDone: () {
        _gatewayRegistry.unregister(connection.id);
      },
    );
  });
 }
 void broadcastMessageCreated({
  required int channelId,
  required Map<String, dynamic> message,
 }) {
  _gatewayRegistry.broadcastToChannel(channelId, {
    'op': 'event',
    'event': 'message.created',
    'channelId': channelId,
    'message': message,
    'emittedAt': DateTime.now().toUtc().toIso8601String(),
  });
 }
 void broadcastMessageUpdated({
  required int channelId,
  required Map<String, dynamic> message,
 }) {
  _gatewayRegistry.broadcastToChannel(channelId, {
    'op': 'event',
    'event': 'message.updated',
    'channelId': channelId,
    'message': message,
    'emittedAt': DateTime.now().toUtc().toIso8601String(),
  });
 }
 void broadcastMessageDeleted({
  required int channelId,
  required int messageId,
 }) {
  _gatewayRegistry.broadcastToChannel(channelId, {
    'op': 'event',
    'event': 'message.deleted',
    'channelId': channelId,
    'messageId': messageId,
    'emittedAt': DateTime.now().toUtc().toIso8601String(),
  });
 }
 String? _extractGatewayToken(Request req) {
  final authHeader = req.headers.authorization;
  if (authHeader is BearerAuthorizationHeader) {
    final token = authHeader.token.trim();
    if (token.isNotEmpty) {
      return token;
    }
  }
  final rawAuthorization = req.headers[Headers.authorizationHeader];
  if (rawAuthorization != null && rawAuthorization.isNotEmpty) {
    final value = rawAuthorization.first.trim();
    if (value.toLowerCase().startsWith('bearer ')) {
      final token = value.substring(7).trim();
      if (token.isNotEmpty) {
        return token;
      }
    }
  }
  final queryToken = req.url.queryParameters['token']?.trim();
  if (queryToken != null && queryToken.isNotEmpty) {
    return queryToken;
  }
  final queryAccessToken = req.url.queryParameters['access_token']?.trim();
  if (queryAccessToken != null && queryAccessToken.isNotEmpty) {
    return queryAccessToken;
  }
  return null;
 }
 void _handleGatewayTextMessage(String connectionId, String text) {
  final connection = _gatewayRegistry.getConnection(connectionId);
  if (connection == null) {
    return;
  }
  final payload = _decodePayload(text);
  if (payload == null) {
    _sendProtocolError(connectionId, 'Invalid JSON payload');
    return;
  }
  final rawOp = payload['op'];
  if (rawOp is! String || rawOp.trim().isEmpty) {
    _sendProtocolError(connectionId, '`op` is required');
    return;
  }
  switch (rawOp.trim().toLowerCase()) {
    case 'subscribe':
      _handleSubscribe(connectionId, payload);
    case 'unsubscribe':
      _handleUnsubscribe(connectionId, payload);
    case 'ping':
    case 'heartbeat':
      _sendGatewayPayload(connectionId, {
        'op': 'pong',
        'ts': DateTime.now().toUtc().toIso8601String(),
      });
    case 'pong':
      return;
    default:
      _sendProtocolError(connectionId, 'Unsupported op `$rawOp`');
  }
 }
 void _handleSubscribe(String connectionId, Map<String, dynamic> payload) {
  final channelIds = _parseChannelIds(payload);
  if (channelIds.isEmpty) {
    _sendProtocolError(
      connectionId,
      'subscribe requires `channelId` or `channelIds`',
    );
    return;
  }
  final knownChannelIds = <int>[];
  final unknownChannelIds = <int>[];
  for (final channelId in channelIds) {
    if (channelBox.get(channelId) == null) {
      unknownChannelIds.add(channelId);
    } else {
      knownChannelIds.add(channelId);
    }
  }
  final subscribed = _gatewayRegistry.subscribe(connectionId, knownChannelIds);
  _sendGatewayPayload(connectionId, {
    'op': 'subscribed',
    'channelIds': subscribed,
    'subscriptions': _gatewayRegistry.subscriptions(connectionId),
    if (unknownChannelIds.isNotEmpty) 'unknownChannelIds': unknownChannelIds,
  });
 }
 void _handleUnsubscribe(String connectionId, Map<String, dynamic> payload) {
  final channelIds = _parseChannelIds(payload);
  if (channelIds.isEmpty) {
    _sendProtocolError(
      connectionId,
      'unsubscribe requires `channelId` or `channelIds`',
    );
    return;
  }
  final unsubscribed = _gatewayRegistry.unsubscribe(connectionId, channelIds);
  _sendGatewayPayload(connectionId, {
    'op': 'unsubscribed',
    'channelIds': unsubscribed,
    'subscriptions': _gatewayRegistry.subscriptions(connectionId),
  });
 }
 Map<String, dynamic>? _decodePayload(String text) {
  try {
    final decoded = jsonDecode(text);
    if (decoded is Map<String, dynamic>) {
      return decoded;
    }
    if (decoded is Map) {
      return decoded.map(
        (key, value) => MapEntry(key.toString(), value),
      );
    }
    return null;
  } catch (_) {
    return null;
  }
 }
 Set<int> _parseChannelIds(Map<String, dynamic> payload) {
  final channelIds = <int>{};
  void parseAndAdd(Object? value) {
    final parsed = switch (value) {
      int id when id > 0 => id,
      String id => int.tryParse(id),
      _ => null,
    };
    if (parsed != null && parsed > 0) {
      channelIds.add(parsed);
    }
  }
  parseAndAdd(payload['channelId']);
  final channelIdList = payload['channelIds'];
  if (channelIdList is List) {
    for (final value in channelIdList) {
      parseAndAdd(value);
    }
  }
  return channelIds;
 }
 void _sendProtocolError(String connectionId, String message) {
  _sendGatewayPayload(connectionId, {
    'op': 'error',
    'message': message,
  });
 }
 void _sendGatewayPayload(String connectionId, Map<String, dynamic> payload) {
  final connection = _gatewayRegistry.getConnection(connectionId);
  if (connection == null) {
    return;
  }
  final sent = _safeSend(connection, payload);
  if (!sent) {
    _gatewayRegistry.unregister(connectionId);
  }
 }
 bool _safeSend(_GatewayConnection connection, Map<String, dynamic> payload) {
  try {
    return connection.socket.trySendText(jsonEncode(payload));
  } catch (_) {
    return false;
  }
 }
 class _GatewayRegistry {
  final Map<String, _GatewayConnection> _connections = {};
  final Map<int, Set<String>> _subscribersByChannel = {};
  int _nextConnectionId = 1;
  _GatewayConnection register({
    required RelicWebSocket socket,
    required String userId,
    String? username,
  }) {
    final id = 'gw_${_nextConnectionId++}';
    final connection = _GatewayConnection(
      id: id,
      socket: socket,
      userId: userId,
      username: username,
    );
    _connections[id] = connection;
    return connection;
  }
  _GatewayConnection? getConnection(String connectionId) {
    return _connections[connectionId];
  }
  List<int> subscriptions(String connectionId) {
    final connection = _connections[connectionId];
    if (connection == null) {
      return const <int>[];
    }
    return connection.subscriptions.toList()..sort();
  }
  List<int> subscribe(String connectionId, Iterable<int> channelIds) {
    final connection = _connections[connectionId];
    if (connection == null) {
      return const <int>[];
    }
    for (final channelId in channelIds) {
      connection.subscriptions.add(channelId);
      _subscribersByChannel.putIfAbsent(channelId, () => <String>{}).add(
            connectionId,
          );
    }
    return channelIds.toSet().toList()..sort();
  }
  List<int> unsubscribe(String connectionId, Iterable<int> channelIds) {
    final connection = _connections[connectionId];
    if (connection == null) {
      return const <int>[];
    }
    final removed = <int>[];
    for (final channelId in channelIds) {
      final didRemove = connection.subscriptions.remove(channelId);
      if (didRemove) {
        removed.add(channelId);
      }
      final subscribers = _subscribersByChannel[channelId];
      if (subscribers != null) {
        subscribers.remove(connectionId);
        if (subscribers.isEmpty) {
          _subscribersByChannel.remove(channelId);
        }
      }
    }
    removed.sort();
    return removed;
  }
  void unregister(String connectionId) {
    final connection = _connections.remove(connectionId);
    if (connection == null) {
      return;
    }
    for (final channelId in connection.subscriptions) {
      final subscribers = _subscribersByChannel[channelId];
      if (subscribers == null) {
        continue;
      }
      subscribers.remove(connectionId);
      if (subscribers.isEmpty) {
        _subscribersByChannel.remove(channelId);
      }
    }
    if (!connection.socket.isClosed) {
      unawaited(connection.socket.tryClose(1000, 'Disconnected'));
    }
  }
  void broadcastToChannel(int channelId, Map<String, dynamic> payload) {
    final subscribers = _subscribersByChannel[channelId];
    if (subscribers == null || subscribers.isEmpty) {
      return;
    }
    final deadConnections = <String>[];
    final subscriberIds = subscribers.toList(growable: false);
    for (final connectionId in subscriberIds) {
      final connection = _connections[connectionId];
      if (connection == null) {
        deadConnections.add(connectionId);
        continue;
      }
      final sent = _safeSend(connection, payload);
      if (!sent) {
        deadConnections.add(connectionId);
      }
    }
    for (final connectionId in deadConnections) {
      unregister(connectionId);
    }
  }
 }
 class _GatewayConnection {
  final String id;
  final RelicWebSocket socket;
  final String userId;
  final String? username;
  final Set<int> subscriptions = <int>{};
  _GatewayConnection({
    required this.id,
    required this.socket,
    required this.userId,
    required this.username,
  });
 }
@@ -1,5 +1,6 @@
 import 'dart:convert';
 import 'dart:io';
 import 'dart:math';
 import 'package:chat_server/models.dart';
 import 'package:chat_server/objectbox.g.dart';
@@ -29,16 +30,6 @@ class RemoteIdentity {
  });
 }
 class ParsedUserId {
  final String username;
  final String host;
  ParsedUserId({
    required this.username,
    required this.host,
  });
 }
 /// Register on HOME server
 /// Creates user with keypair for identity
 Future<Response> registerHandler(Request req) async {
@@ -85,22 +76,30 @@ Future<Response> registerHandler(Request req) async {
  // Hash password
  final passwordHash = AuthService.hashPassword(password);
-  // Create user with userId format: "username@this.server"
+  // Create immutable opaque identity ID.
-  final userId = '${username}@${Config.serverHost}';
+  final userId = generateUserId();
  final isBootstrapAdmin = Config.setupMode && _adminCount() < Config.bootstrapAdminLimit;
  final roles = isBootstrapAdmin ? <String>['admin'] : <String>['member'];
  final user = ChatUser(
    userId: userId,
    username: username,
    publicKey: keyPair.publicKey,
    isLocal: true,
    homeServer: Config.publicBaseUrl,
    passwordHash: passwordHash,
    encryptedPrivateKey: encryptedKey.encryptedData,
    keyPairSalt: encryptedKey.salt,
-    roles: ['member'],
+    roles: roles,
  );
  final localId = userBox.put(user);
  if (isBootstrapAdmin) {
    print('🔐 Setup mode: granted initial admin to $userId');
  }
  // Generate token
  final token = AuthService.generateToken(userId, username);
@@ -108,11 +107,14 @@ Future<Response> registerHandler(Request req) async {
    body: {
      'token': token,
      'userId': userId,
-      'username': username,
+      'username': user.username,
      'handle': toUserHandle(user.username, Config.publicBaseUrl),
      'publicKey': keyPair.publicKey,
      'encryptedPrivateKey': encryptedKey.encryptedData,
      'keyPairSalt': encryptedKey.salt,
      'localId': localId,
      'roles': roles,
      'isBootstrapAdmin': isBootstrapAdmin,
    }.toBody,
  );
 }
@@ -147,8 +149,7 @@ Future<Response> loginHandler(Request req) async {
  // Check if this is actually their home server
  if (!user.isLocal) {
    return Response.badRequest(
-      body:
+      body: Body.fromString('This is not your home server. Login there instead.'),
          Body.fromString('This is not your home server. Login there instead.'),
    );
  }
@@ -167,6 +168,7 @@ Future<Response> loginHandler(Request req) async {
      'token': token,
      'userId': user.userId,
      'username': user.username,
      'handle': toUserHandle(user.username, user.homeServer ?? Config.publicBaseUrl),
      'displayName': user.displayName,
      'avatarUrl': user.avatarUrl,
      'publicKey': user.publicKey,
@@ -181,27 +183,27 @@ Future<Response> loginHandler(Request req) async {
 /// No password required - proves identity via private key signature
 Future<Response> joinServerHandler(Request req) async {
  final body = await req.asJson();
-  final userId = body['userId'] as String?; // "alice@homeserver.com"
+  final userId = body['userId'] as String?;
-  final homeServer = body['homeServer'] as String?; // "https://homeserver.com"
+  final username = (body['username'] as String?)?.trim();
  final homeServer = body['homeServer'] as String?;
  final timestamp = body['timestamp'] as int?;
  final signature = body['signature'] as String?;
  // Validate required fields
-  if (userId == null || timestamp == null || signature == null) {
+  if (userId == null ||
      userId.isEmpty ||
      username == null ||
      username.isEmpty ||
      homeServer == null ||
      homeServer.trim().isEmpty ||
      timestamp == null ||
      signature == null) {
    return Response.badRequest(
-      body: Body.fromString(
+      body: Body.fromString('userId, username, homeServer, timestamp, and signature required'),
          'userId, timestamp, and signature required (homeServer optional)'),
    );
  }
-  final parsedUser = parseUserId(userId);
+  final resolvedHomeServer = normalizeHomeServer(homeServer);
  if (parsedUser == null) {
    return Response.badRequest(
      body: Body.fromString('Invalid userId format. Expected username@host'),
    );
  }
  final resolvedHomeServer = normalizeHomeServer(homeServer ?? parsedUser.host);
  if (resolvedHomeServer == null) {
    return Response.badRequest(
@@ -209,12 +211,6 @@ Future<Response> joinServerHandler(Request req) async {
    );
  }
  if (!homeServerMatchesUserIdHost(resolvedHomeServer, parsedUser.host)) {
    return Response.badRequest(
      body: Body.fromString('homeServer does not match userId host'),
    );
  }
  // Check timestamp is recent (within 5 minutes)
  final now = DateTime.now().millisecondsSinceEpoch ~/ 1000;
  if ((now - timestamp).abs() > 300) {
@@ -226,7 +222,7 @@ Future<Response> joinServerHandler(Request req) async {
  // Fetch current identity from home server
  final identity = await fetchIdentityFromHomeServer(
    resolvedHomeServer,
-    parsedUser.username,
+    username,
  );
  if (identity == null) {
@@ -236,7 +232,7 @@ Future<Response> joinServerHandler(Request req) async {
  }
  // Ensure fetched identity matches what caller claims
-  if (identity.userId != userId || identity.username != parsedUser.username) {
+  if (identity.userId != userId || identity.username != username) {
    return Response.forbidden(
      body: Body.fromString('Identity mismatch from home server'),
    );
@@ -245,8 +241,7 @@ Future<Response> joinServerHandler(Request req) async {
  // Verify signature
  // Signature is over: "{userId}:{timestamp}"
  final messageToVerify = '$userId:$timestamp';
-  final isValid =
+  final isValid = CryptoService.verify(messageToVerify, signature, identity.publicKey);
      CryptoService.verify(messageToVerify, signature, identity.publicKey);
  if (!isValid) {
    return Response.forbidden(
@@ -269,8 +264,7 @@ Future<Response> joinServerHandler(Request req) async {
    existingUser.lastSyncedAt = DateTime.now();
    userBox.put(existingUser);
-    final token =
+    final token = AuthService.generateToken(existingUser.userId, existingUser.username);
        AuthService.generateToken(existingUser.userId, existingUser.username);
    userLocalIdProperty[req] = existingUser.id;
    return Response.ok(
@@ -278,6 +272,7 @@ Future<Response> joinServerHandler(Request req) async {
        'token': token,
        'userId': existingUser.userId,
        'username': existingUser.username,
        'handle': toUserHandle(existingUser.username, existingUser.homeServer ?? Config.publicBaseUrl),
        'localId': existingUser.id,
        'alreadyJoined': true,
      }.toBody,
@@ -308,6 +303,7 @@ Future<Response> joinServerHandler(Request req) async {
      'token': token,
      'userId': userId,
      'username': user.username,
      'handle': toUserHandle(user.username, user.homeServer ?? Config.publicBaseUrl),
      'localId': localId,
      'alreadyJoined': false,
    }.toBody,
@@ -324,8 +320,7 @@ Future<RemoteIdentity?> fetchIdentityFromHomeServer(
  try {
    final baseUrl = homeServer.replaceAll(RegExp(r'/$'), '');
-    final endpoint = Uri.parse(
+    final endpoint = Uri.parse('$baseUrl/.well-known/users/${Uri.encodeComponent(username)}');
        '$baseUrl/.well-known/users/${Uri.encodeComponent(username)}');
    final request = await client.getUrl(endpoint);
    request.headers.set(HttpHeaders.acceptHeader, 'application/json');
@@ -366,22 +361,6 @@ Future<RemoteIdentity?> fetchIdentityFromHomeServer(
  }
 }
 ParsedUserId? parseUserId(String userId) {
  final parts = userId.split('@');
  if (parts.length != 2) {
    return null;
  }
  final username = parts[0].trim();
  final host = parts[1].trim();
  if (username.isEmpty || host.isEmpty) {
    return null;
  }
  return ParsedUserId(username: username, host: host);
 }
 String? normalizeHomeServer(String homeServerOrHost) {
  final trimmed = homeServerOrHost.trim();
  if (trimmed.isEmpty) {
@@ -389,53 +368,41 @@ String? normalizeHomeServer(String homeServerOrHost) {
  }
  final hasScheme = trimmed.contains('://');
-  final candidate =
+  final candidate = hasScheme ? trimmed : '${defaultSchemeForHost(trimmed)}://$trimmed';
      hasScheme ? trimmed : '${defaultSchemeForHost(trimmed)}://$trimmed';
  final uri = Uri.tryParse(candidate);
  if (uri == null || uri.host.isEmpty) {
    return null;
  }
-  return uri
+  final normalized = Uri(
-      .replace(path: '', query: null, fragment: null)
+    scheme: uri.scheme,
-      .toString()
+    userInfo: uri.userInfo,
-      .replaceAll(RegExp(r'/$'), '');
+    host: uri.host,
    port: uri.hasPort ? uri.port : null,
  ).toString();
  return normalized.replaceAll(RegExp(r'/$'), '');
 }
 String defaultSchemeForHost(String host) {
  final lowerHost = host.toLowerCase();
-  if (lowerHost.startsWith('localhost') ||
+  if (lowerHost.startsWith('localhost') || lowerHost.startsWith('127.') || lowerHost.startsWith('[::1]')) {
      lowerHost.startsWith('127.') ||
      lowerHost.startsWith('[::1]')) {
    return 'http';
  }
  return 'https';
 }
-bool homeServerMatchesUserIdHost(String homeServerUrl, String userIdHost) {
+int _adminCount() {
-  final uri = Uri.tryParse(homeServerUrl);
+  var count = 0;
-  if (uri == null || uri.host.isEmpty) {
+  final users = userBox.getAll();
-    return false;
+  for (final user in users) {
-  }
+    if (user.roles.contains('admin')) {
-
+      count++;
  final normalizedUserIdHost = userIdHost.trim().toLowerCase();
  final urlHost = uri.host.toLowerCase();
  final urlHostWithPort = uri.hasPort ? '$urlHost:${uri.port}' : urlHost;
  if (normalizedUserIdHost == urlHostWithPort) {
    return true;
  }
  if (!uri.hasPort) {
    final defaultPort = uri.scheme == 'http' ? 80 : 443;
    if (normalizedUserIdHost == '$urlHost:$defaultPort') {
      return true;
    }
  }
-
+  return count;
  return false;
 }
 /// Get current user's profile
@@ -462,6 +429,7 @@ Future<Response> getMeHandler(Request req) async {
    body: {
      'userId': user.userId,
      'username': user.username,
      'handle': toUserHandle(user.username, user.homeServer ?? Config.publicBaseUrl),
      'displayName': user.displayName,
      'avatarUrl': user.avatarUrl,
      'bio': user.bio,
@@ -472,3 +440,27 @@ Future<Response> getMeHandler(Request req) async {
    }.toBody,
  );
 }
 String generateUserId() {
  const alphabet = '0123456789abcdefghijklmnopqrstuvwxyz';
  final random = Random.secure();
  while (true) {
    final bytes = List<int>.generate(16, (_) => random.nextInt(256));
    final id = bytes.map((b) => alphabet[b % alphabet.length]).join();
    final query = userBox.query(ChatUser_.userId.equals(id)).build();
    final exists = query.findFirst() != null;
    query.close();
    if (!exists) {
      return id;
    }
  }
 }
 String toUserHandle(String username, String homeServer) {
  final uri = Uri.tryParse(homeServer);
  if (uri != null && uri.host.isNotEmpty) {
    final host = uri.hasPort ? '${uri.host}:${uri.port}' : uri.host;
    return '@$username@$host';
  }
  return '@$username@${homeServer.trim()}';
 }
@@ -0,0 +1,280 @@
 import 'dart:io';
 import 'package:chat_server/models.dart';
 import 'package:chat_server/objectbox.g.dart';
 import 'package:relic/relic.dart';
 import '../../config/config.dart';
 import '../auth/auth_middleware.dart';
 import '../state/app_state.dart';
 import '../utils/extensions.dart';
 const _maxSnapshotLimit = 500;
 Future<Response> getDevDbSnapshotHandler(Request req) async {
  final guard = _guardDevDbTools(req);
  if (guard != null) {
    return guard;
  }
  final rawLimit = req.url.queryParameters['limit'];
  final parsedLimit = rawLimit == null ? 100 : int.tryParse(rawLimit);
  if (parsedLimit == null || parsedLimit <= 0) {
    return Response.badRequest(
      body: Body.fromString('Invalid limit'),
    );
  }
  final limit = parsedLimit > _maxSnapshotLimit ? _maxSnapshotLimit : parsedLimit;
  final users = userBox.getAll().take(limit).map(_userToMap).toList();
  final channels = channelBox.getAll().take(limit).map(_channelToMap).toList();
  final messages = messageBox.getAll().take(limit).map(_messageToMap).toList();
  final files = fileBox.getAll().take(limit).map(_fileToMap).toList();
  final messageMedia = messageMediaBox.getAll().take(limit).map(_messageMediaToMap).toList();
  final settings = serverSettingsBox.getAll().take(limit).map(_settingsToMap).toList();
  return Response.ok(
    body: {
      'limit': limit,
      'counts': {
        'users': userBox.count(),
        'channels': channelBox.count(),
        'messages': messageBox.count(),
        'files': fileBox.count(),
        'messageMedia': messageMediaBox.count(),
        'serverSettings': serverSettingsBox.count(),
      },
      'users': users,
      'channels': channels,
      'messages': messages,
      'files': files,
      'messageMedia': messageMedia,
      'serverSettings': settings,
    }.toBody,
  );
 }
 Future<Response> resetDevDbHandler(Request req) async {
  final guard = _guardDevDbTools(req);
  if (guard != null) {
    return guard;
  }
  final body = await req.asJson();
  if ((body['confirm'] as String?) != 'RESET') {
    return Response.badRequest(
      body: Body.fromString('Body must include {"confirm":"RESET"}'),
    );
  }
  messageBox.removeAll();
  channelBox.removeAll();
  fileBox.removeAll();
  messageMediaBox.removeAll();
  serverSettingsBox.removeAll();
  userBox.removeAll();
  final uploadsDir = Directory('uploads');
  if (uploadsDir.existsSync()) {
    for (final entity in uploadsDir.listSync()) {
      if (entity is File) {
        entity.deleteSync();
      }
    }
  }
  return Response.ok(
    body: {
      'reset': true,
      'counts': {
        'users': userBox.count(),
        'channels': channelBox.count(),
        'messages': messageBox.count(),
        'files': fileBox.count(),
        'messageMedia': messageMediaBox.count(),
        'serverSettings': serverSettingsBox.count(),
      },
    }.toBody,
  );
 }
 Future<Response> promoteUserToAdminHandler(Request req) async {
  final guard = _guardDevDbTools(req);
  if (guard != null) {
    return guard;
  }
  final body = await req.asJson();
  final userId = (body['userId'] as String?)?.trim();
  if (userId == null || userId.isEmpty) {
    return Response.badRequest(
      body: Body.fromString('userId is required'),
    );
  }
  final query = userBox.query(ChatUser_.userId.equals(userId)).build();
  final user = query.findFirst();
  query.close();
  if (user == null) {
    return Response.notFound(
      body: Body.fromString('User not found'),
    );
  }
  if (!user.roles.contains('admin')) {
    user.roles = [...user.roles, 'admin'];
    userBox.put(user);
  }
  return Response.ok(
    body: {
      'updated': true,
      'userId': user.userId,
      'roles': user.roles,
    }.toBody,
  );
 }
 Future<Response> demoteUserFromAdminHandler(Request req) async {
  final guard = _guardDevDbTools(req);
  if (guard != null) {
    return guard;
  }
  final body = await req.asJson();
  final userId = (body['userId'] as String?)?.trim();
  if (userId == null || userId.isEmpty) {
    return Response.badRequest(
      body: Body.fromString('userId is required'),
    );
  }
  final query = userBox.query(ChatUser_.userId.equals(userId)).build();
  final user = query.findFirst();
  query.close();
  if (user == null) {
    return Response.notFound(
      body: Body.fromString('User not found'),
    );
  }
  user.roles = user.roles.where((role) => role != 'admin').toList();
  userBox.put(user);
  return Response.ok(
    body: {
      'updated': true,
      'userId': user.userId,
      'roles': user.roles,
    }.toBody,
  );
 }
 Response? _guardDevDbTools(Request req) {
  if (!Config.devDbTools) {
    return Response.forbidden(
      body: Body.fromString('Dev DB tools are disabled in config'),
    );
  }
  final authUserId = userIdProperty[req];
  if (authUserId == null) {
    return Response.unauthorized(
      body: Body.fromString('Not authenticated'),
    );
  }
  final query = userBox.query(ChatUser_.userId.equals(authUserId)).build();
  final user = query.findFirst();
  query.close();
  if (user == null) {
    return Response.unauthorized(
      body: Body.fromString('User not found'),
    );
  }
  if (!user.roles.contains('admin')) {
    return Response.forbidden(
      body: Body.fromString('Admin role required'),
    );
  }
  return null;
 }
 Map<String, dynamic> _userToMap(ChatUser user) => {
      'id': user.id,
      'userId': user.userId,
      'username': user.username,
      'displayName': user.displayName,
      'avatarUrl': user.avatarUrl,
      'bio': user.bio,
      'isLocal': user.isLocal,
      'homeServer': user.homeServer,
      'roles': user.roles,
      'createdAt': user.createdAt.toIso8601String(),
      'lastSyncedAt': user.lastSyncedAt?.toIso8601String(),
    };
 Map<String, dynamic> _channelToMap(ChatChannel channel) => {
      'id': channel.id,
      'name': channel.name,
      'description': channel.description,
      'createdAt': channel.createdAt.toIso8601String(),
    };
 Map<String, dynamic> _messageToMap(ChatMessage message) => {
      'id': message.id,
      'channelId': message.channelId,
      'authorLocalId': message.authorLocalId,
      'authorUserId': message.authorUserId,
      'authorUsername': message.authorUsername,
      'content': message.content,
      'componentsJson': message.componentsJson,
      'createdAt': message.createdAt.toIso8601String(),
      'editedAt': message.editedAt?.toIso8601String(),
    };
 Map<String, dynamic> _fileToMap(ChatFile file) => {
      'id': file.id,
      'attachmentId': file.attachmentId,
      'uploaderId': file.uploaderId,
      'path': file.path,
      'originalFileName': file.originalFileName,
      'storedFileName': file.storedFileName,
      'mimeType': file.mimeType,
      'sizeBytes': file.sizeBytes,
      'width': file.width,
      'height': file.height,
      'usageType': file.usageType,
      'status': file.status,
      'isAttached': file.isAttached,
      'createdAt': file.createdAt.toIso8601String(),
    };
 Map<String, dynamic> _settingsToMap(ServerSettings settings) => {
      'id': settings.id,
      'singletonKey': settings.singletonKey,
      'serverName': settings.serverName,
      'description': settings.description,
      'iconAttachmentId': settings.iconAttachmentId,
      'bannerAttachmentId': settings.bannerAttachmentId,
      'updatedByUserId': settings.updatedByUserId,
      'updatedAt': settings.updatedAt.toIso8601String(),
    };
 Map<String, dynamic> _messageMediaToMap(ChatMessageMedia media) => {
      'id': media.id,
      'messageId': media.messageId,
      'channelId': media.channelId,
      'authorUserId': media.authorUserId,
      'attachmentId': media.attachmentId,
      'externalUrl': media.externalUrl,
      'kind': media.kind,
      'mimeType': media.mimeType,
      'originalFileName': media.originalFileName,
      'sizeBytes': media.sizeBytes,
      'width': media.width,
      'height': media.height,
      'thumbHash': media.thumbHash,
      'createdAt': media.createdAt.toIso8601String(),
    };
@@ -2,6 +2,7 @@ import 'package:chat_server/objectbox.g.dart';
 import 'package:relic/relic.dart';
 import '../../config/config.dart';
 import 'auth_handlers.dart';
 import '../state/app_state.dart';
 import '../utils/extensions.dart';
@@ -38,10 +39,11 @@ Future<Response> publicUserHandler(Request req) async {
      'userId': user.userId,
      'username': user.username,
      'displayName': user.displayName,
      'handle': toUserHandle(user.username, user.homeServer ?? Config.publicBaseUrl),
      'avatarUrl': user.avatarUrl,
      'bio': user.bio,
      'publicKey': user.publicKey,
-      'homeServer': Config.serverHost,
+      'homeServer': user.homeServer ?? Config.publicBaseUrl,
      'createdAt': user.createdAt.toIso8601String(),
    }.toBody,
  );
@@ -84,6 +86,7 @@ Future<Response> publicVerifyHandler(Request req) async {
      'userId': user.userId,
      'publicKey': user.publicKey,
      'username': user.username,
      'handle': toUserHandle(user.username, user.homeServer ?? Config.publicBaseUrl),
    }.toBody,
  );
 }
@@ -93,11 +96,18 @@ Future<Response> publicVerifyHandler(Request req) async {
 /// GET /.well-known/server
 /// Returns: { serverHost, serverName, version }
 Future<Response> publicServerInfoHandler(Request req) async {
  final settingsQuery = serverSettingsBox.query(ServerSettings_.singletonKey.equals('default')).build();
  final settings = settingsQuery.findFirst();
  settingsQuery.close();
  return Response.ok(
    body: {
-      'serverHost': Config.serverHost,
+      'serverHost': Config.publicHost,
-      'serverName': Config.serverName,
+      'publicBaseUrl': Config.publicBaseUrl,
      'serverName': settings?.serverName ?? Config.serverName,
      'version': '0.1.0',
      'iconUrl': settings?.iconAttachmentId == null ? null : '/icons/${Uri.encodeComponent(Config.publicHost)}',
      'bannerUrl': settings?.bannerAttachmentId == null ? null : '/banners/${Uri.encodeComponent(Config.publicHost)}',
      'features': ['identity', 'chat', 'sticker-packs'],
    }.toBody,
  );
@@ -0,0 +1,348 @@
 import 'dart:io';
 import 'package:chat_server/models.dart';
 import 'package:chat_server/objectbox.g.dart';
 import 'package:relic/relic.dart';
 import '../../config/config.dart';
 import '../auth/auth_middleware.dart';
 import '../state/app_state.dart';
 import '../utils/extensions.dart';
 Future<Response> getServerSettingsHandler(Request req) async {
  final auth = _requireCurrentUser(req);
  if (auth.$2 != null) {
    return auth.$2!;
  }
  final settings = _ensureServerSettings();
  return Response.ok(
    body: _serverSettingsToMap(settings).toBody,
  );
 }
 Future<Response> patchServerSettingsHandler(Request req) async {
  final auth = _requireCurrentUser(req);
  if (auth.$2 != null) {
    return auth.$2!;
  }
  final user = auth.$1!;
  if (!_isAdmin(user)) {
    return Response.forbidden(
      body: Body.fromString('Admin role required'),
    );
  }
  final body = await req.asJson();
  final settings = _ensureServerSettings();
  final nextServerName = (body['serverName'] as String?)?.trim();
  final nextDescription = (body['description'] as String?)?.trim();
  if (nextServerName != null && nextServerName.isNotEmpty) {
    settings.serverName = nextServerName;
  }
  if (body.containsKey('description')) {
    settings.description = nextDescription != null && nextDescription.isNotEmpty ? nextDescription : null;
  }
  settings.updatedByUserId = user.userId;
  settings.updatedAt = DateTime.now();
  serverSettingsBox.put(settings);
  return Response.ok(
    body: _serverSettingsToMap(settings).toBody,
  );
 }
 Future<Response> updateProfileHandler(Request req) async {
  final auth = _requireCurrentUser(req);
  if (auth.$2 != null) {
    return auth.$2!;
  }
  final user = auth.$1!;
  final body = await req.asJson();
  final displayName = (body['displayName'] as String?)?.trim();
  final bio = (body['bio'] as String?)?.trim();
  if (body.containsKey('displayName')) {
    user.displayName = displayName != null && displayName.isNotEmpty ? displayName : null;
  }
  if (body.containsKey('bio')) {
    user.bio = bio != null && bio.isNotEmpty ? bio : null;
  }
  userBox.put(user);
  return Response.ok(
    body: {
      'userId': user.userId,
      'username': user.username,
      'displayName': user.displayName,
      'avatarUrl': user.avatarUrl,
      'bio': user.bio,
      'roles': user.roles,
    }.toBody,
  );
 }
 Future<Response> setAvatarHandler(Request req) async {
  final auth = _requireCurrentUser(req);
  if (auth.$2 != null) {
    return auth.$2!;
  }
  final user = auth.$1!;
  final body = await req.asJson();
  final attachmentId = (body['attachmentId'] as String?)?.trim();
  if (attachmentId == null || attachmentId.isEmpty) {
    return Response.badRequest(
      body: Body.fromString('attachmentId is required'),
    );
  }
  final query = fileBox.query(ChatFile_.attachmentId.equals(attachmentId)).build();
  final file = query.findFirst();
  query.close();
  if (file == null || file.status != 'ready') {
    return Response.notFound(
      body: Body.fromString('Attachment not found or not ready'),
    );
  }
  if (file.uploaderId != user.id) {
    return Response.forbidden(
      body: Body.fromString('Attachment must be uploaded by current user'),
    );
  }
  file.usageType = 'avatar';
  fileBox.put(file);
  user.avatarUrl = '/avatars/${Uri.encodeComponent(user.userId)}';
  userBox.put(user);
  return Response.ok(
    body: {
      'userId': user.userId,
      'avatarAttachmentId': file.attachmentId,
      'avatarUrl': user.avatarUrl,
    }.toBody,
  );
 }
 Future<Response> setServerIconHandler(Request req) async {
  return _setServerMedia(req, usageType: 'server_icon', target: 'icon');
 }
 Future<Response> setServerBannerHandler(Request req) async {
  return _setServerMedia(req, usageType: 'server_banner', target: 'banner');
 }
 Future<Response> getAvatarAliasHandler(Request req) async {
  final userId = req.rawPathParameters[#userId];
  if (userId == null || userId.isEmpty) {
    return Response.badRequest(
      body: Body.fromString('userId is required'),
    );
  }
  final query = userBox.query(ChatUser_.userId.equals(userId)).build();
  final user = query.findFirst();
  query.close();
  if (user == null || user.avatarUrl == null) {
    return Response.notFound(
      body: Body.fromString('Avatar not found'),
    );
  }
  final avatarQuery = fileBox
      .query(
        ChatFile_.uploaderId.equals(user.id) & ChatFile_.usageType.equals('avatar') & ChatFile_.status.equals('ready'),
      )
      .order(ChatFile_.id, flags: Order.descending)
      .build();
  final avatar = avatarQuery.findFirst();
  avatarQuery.close();
  if (avatar == null) {
    return Response.notFound(
      body: Body.fromString('Avatar not found'),
    );
  }
  return _serveAttachment(avatar.attachmentId, mutableAlias: true);
 }
 Future<Response> getServerIconAliasHandler(Request req) async {
  final serverId = req.rawPathParameters[#serverId];
  if (!_matchesCurrentServer(serverId)) {
    return Response.notFound(
      body: Body.fromString('Server not found'),
    );
  }
  final settings = _ensureServerSettings();
  final attachmentId = settings.iconAttachmentId;
  if (attachmentId == null || attachmentId.isEmpty) {
    return Response.notFound(
      body: Body.fromString('Server icon not found'),
    );
  }
  return _serveAttachment(attachmentId, mutableAlias: true);
 }
 Future<Response> getServerBannerAliasHandler(Request req) async {
  final serverId = req.rawPathParameters[#serverId];
  if (!_matchesCurrentServer(serverId)) {
    return Response.notFound(
      body: Body.fromString('Server not found'),
    );
  }
  final settings = _ensureServerSettings();
  final attachmentId = settings.bannerAttachmentId;
  if (attachmentId == null || attachmentId.isEmpty) {
    return Response.notFound(
      body: Body.fromString('Server banner not found'),
    );
  }
  return _serveAttachment(attachmentId, mutableAlias: true);
 }
 Future<Response> _setServerMedia(
  Request req, {
  required String usageType,
  required String target,
 }) async {
  final auth = _requireCurrentUser(req);
  if (auth.$2 != null) {
    return auth.$2!;
  }
  final user = auth.$1!;
  if (!_isAdmin(user)) {
    return Response.forbidden(
      body: Body.fromString('Admin role required'),
    );
  }
  final body = await req.asJson();
  final attachmentId = (body['attachmentId'] as String?)?.trim();
  if (attachmentId == null || attachmentId.isEmpty) {
    return Response.badRequest(
      body: Body.fromString('attachmentId is required'),
    );
  }
  final query = fileBox.query(ChatFile_.attachmentId.equals(attachmentId)).build();
  final file = query.findFirst();
  query.close();
  if (file == null || file.status != 'ready') {
    return Response.notFound(
      body: Body.fromString('Attachment not found or not ready'),
    );
  }
  file.usageType = usageType;
  fileBox.put(file);
  final settings = _ensureServerSettings();
  if (target == 'icon') {
    settings.iconAttachmentId = attachmentId;
  } else {
    settings.bannerAttachmentId = attachmentId;
  }
  settings.updatedByUserId = user.userId;
  settings.updatedAt = DateTime.now();
  serverSettingsBox.put(settings);
  return Response.ok(
    body: _serverSettingsToMap(settings).toBody,
  );
 }
 (ChatUser?, Response?) _requireCurrentUser(Request req) {
  final userId = userIdProperty[req];
  if (userId == null) {
    return (null, Response.unauthorized(body: Body.fromString('Not authenticated')));
  }
  final query = userBox.query(ChatUser_.userId.equals(userId)).build();
  final user = query.findFirst();
  query.close();
  if (user == null) {
    return (null, Response.unauthorized(body: Body.fromString('User not found')));
  }
  return (user, null);
 }
 bool _isAdmin(ChatUser user) => user.roles.contains('admin');
 ServerSettings _ensureServerSettings() {
  final query = serverSettingsBox.query(ServerSettings_.singletonKey.equals('default')).build();
  final existing = query.findFirst();
  query.close();
  if (existing != null) {
    return existing;
  }
  final settings = ServerSettings(serverName: Config.serverName);
  settings.id = serverSettingsBox.put(settings);
  return settings;
 }
 bool _matchesCurrentServer(String? serverId) {
  if (serverId == null || serverId.isEmpty) {
    return false;
  }
  if (serverId == 'current') {
    return true;
  }
  return serverId == Config.publicHost;
 }
 Map<String, dynamic> _serverSettingsToMap(ServerSettings settings) {
  return {
    'serverId': Config.publicHost,
    'publicBaseUrl': Config.publicBaseUrl,
    'serverName': settings.serverName,
    'description': settings.description,
    'iconUrl': settings.iconAttachmentId == null ? null : '/icons/${Uri.encodeComponent(Config.publicHost)}',
    'bannerUrl': settings.bannerAttachmentId == null ? null : '/banners/${Uri.encodeComponent(Config.publicHost)}',
    'iconAttachmentId': settings.iconAttachmentId,
    'bannerAttachmentId': settings.bannerAttachmentId,
    'updatedAt': settings.updatedAt.toIso8601String(),
    'updatedByUserId': settings.updatedByUserId,
  };
 }
 Future<Response> _serveAttachment(
  String attachmentId, {
  required bool mutableAlias,
 }) async {
  final query = fileBox.query(ChatFile_.attachmentId.equals(attachmentId)).build();
  final file = query.findFirst();
  query.close();
  if (file == null || file.status != 'ready' || file.storedFileName.isEmpty) {
    return Response.notFound(
      body: Body.fromString('Attachment not found'),
    );
  }
  final diskPath = 'uploads${Platform.pathSeparator}${file.storedFileName}';
  final diskFile = File(diskPath);
  if (!diskFile.existsSync()) {
    return Response.notFound(
      body: Body.fromString('Attachment file missing on disk'),
    );
  }
  final cacheControl = mutableAlias ? 'public, max-age=0, must-revalidate' : 'public, max-age=31536000, immutable';
  return Response.ok(
    headers: Headers.fromMap(
      {
        Headers.contentTypeHeader: [file.mimeType],
        Headers.cacheControlHeader: [cacheControl],
      },
    ),
    body: Body.fromData(diskFile.readAsBytesSync()),
  );
 }
@@ -0,0 +1,529 @@
 import 'dart:io';
 import 'dart:math';
 import 'dart:typed_data';
 import 'package:chat_server/models.dart';
 import 'package:chat_server/objectbox.g.dart';
 import 'package:crypto/crypto.dart';
 import 'package:mime/mime.dart';
 import 'package:relic/relic.dart';
 import '../auth/auth_middleware.dart';
 import '../state/app_state.dart';
 import '../utils/extensions.dart';
 import 'message_handlers.dart';
 const _uploadsDir = 'uploads';
 const _maxUploadBytes = 50 * 1024 * 1024;
 Future<Response> initUploadHandler(Request req) async {
  final currentUser = _requireCurrentUser(req);
  if (currentUser.$2 != null) {
    return currentUser.$2!;
  }
  final user = currentUser.$1!;
  final body = await req.asJson();
  final usageType = (body['usageType'] as String?)?.trim() ?? 'message';
  final originalFileName = (body['originalFileName'] as String?)?.trim() ?? '';
  final declaredMimeType = (body['mimeType'] as String?)?.trim() ?? 'application/octet-stream';
  final declaredWidth = _asInt(body['width']) ?? 0;
  final declaredHeight = _asInt(body['height']) ?? 0;
  final declaredSizeBytes = _asInt(body['sizeBytes']) ?? 0;
  if (!_isAllowedUsageType(usageType)) {
    return Response.badRequest(
      body: Body.fromString('Invalid usageType'),
    );
  }
  final attachmentId = _generateAttachmentId();
  final entity = ChatFile(
    attachmentId: attachmentId,
    uploaderId: user.id,
    path: '',
    originalFileName: originalFileName.isEmpty ? 'upload-${attachmentId.substring(0, 8)}' : originalFileName,
    storedFileName: '',
    sha256: '',
    mimeType: declaredMimeType,
    width: declaredWidth,
    height: declaredHeight,
    sizeBytes: declaredSizeBytes,
    usageType: usageType,
    status: 'pending',
  );
  final id = fileBox.put(entity);
  entity.id = id;
  return Response.ok(
    body: {
      'uploadId': entity.attachmentId,
      'attachmentId': entity.attachmentId,
      'status': entity.status,
      'usageType': entity.usageType,
    }.toBody,
  );
 }
 Future<Response> completeUploadHandler(Request req) async {
  final currentUser = _requireCurrentUser(req);
  if (currentUser.$2 != null) {
    return currentUser.$2!;
  }
  final user = currentUser.$1!;
  final uploadId = req.rawPathParameters[#uploadId];
  if (uploadId == null || uploadId.isEmpty) {
    return Response.badRequest(
      body: Body.fromString('uploadId is required'),
    );
  }
  final query = fileBox.query(ChatFile_.attachmentId.equals(uploadId)).build();
  final file = query.findFirst();
  query.close();
  if (file == null) {
    return Response.notFound(
      body: Body.fromString('Upload not found'),
    );
  }
  if (file.uploaderId != user.id) {
    return Response.forbidden(
      body: Body.fromString('You cannot complete another user\'s upload'),
    );
  }
  if (file.status == 'ready') {
    return Response.ok(body: _fileResponseMap(file).toBody);
  }
  final uploadData = await _readUploadData(req);
  if (uploadData.$2 != null) {
    file.status = 'failed';
    file.errorCode = 'invalid_upload_payload';
    fileBox.put(file);
    return uploadData.$2!;
  }
  final bytes = uploadData.$1!;
  final payloadMimeType = uploadData.$3;
  final payloadFileName = uploadData.$4;
  if (bytes.isEmpty) {
    file.status = 'failed';
    file.errorCode = 'empty_file';
    fileBox.put(file);
    return Response.badRequest(
      body: Body.fromString('Uploaded file is empty'),
    );
  }
  _finalizeUpload(
    file: file,
    bytes: bytes,
    payloadMimeType: payloadMimeType,
    payloadFileName: payloadFileName,
  );
  await resolvePendingUploadsInMessages(file.attachmentId);
  return Response.ok(
    body: _fileResponseMap(file).toBody,
  );
 }
 Future<Response> uploadFileHandler(Request req) async {
  final currentUser = _requireCurrentUser(req);
  if (currentUser.$2 != null) {
    return currentUser.$2!;
  }
  final user = currentUser.$1!;
  final uploadData = await _readUploadData(req);
  if (uploadData.$2 != null) {
    return uploadData.$2!;
  }
  final bytes = uploadData.$1!;
  final payloadMimeType = uploadData.$3;
  final payloadFileName = uploadData.$4;
  final attachmentId = _generateAttachmentId();
  final file = ChatFile(
    attachmentId: attachmentId,
    uploaderId: user.id,
    path: '',
    originalFileName: payloadFileName ?? 'upload-${attachmentId.substring(0, 8)}',
    storedFileName: '',
    sha256: '',
    mimeType: _normalizeMimeType(payloadMimeType),
    width: 0,
    height: 0,
    sizeBytes: bytes.length,
    usageType: 'message',
    status: 'pending',
  );
  file.id = fileBox.put(file);
  _finalizeUpload(
    file: file,
    bytes: bytes,
    payloadMimeType: payloadMimeType,
    payloadFileName: payloadFileName,
  );
  return Response.ok(
    body: _fileResponseMap(file).toBody,
  );
 }
 Future<Response> getAttachmentHandler(Request req) async {
  final attachmentId = req.rawPathParameters[#attachmentId];
  if (attachmentId == null || attachmentId.isEmpty) {
    return Response.badRequest(
      body: Body.fromString('Invalid attachment ID'),
    );
  }
  final query = fileBox.query(ChatFile_.attachmentId.equals(attachmentId)).build();
  final file = query.findFirst();
  query.close();
  if (file == null || file.status != 'ready') {
    return Response.notFound(
      body: Body.fromString('Attachment not found'),
    );
  }
  final diskPath = _resolveDiskPath(file);
  final diskFile = File(diskPath);
  if (!diskFile.existsSync()) {
    return Response.notFound(
      body: Body.fromString('Attachment file missing on disk'),
    );
  }
  return Response.ok(
    headers: Headers.fromMap(
      {
        Headers.contentTypeHeader: [file.mimeType],
        Headers.cacheControlHeader: ['public, max-age=31536000, immutable'],
      },
    ),
    body: Body.fromData(diskFile.readAsBytesSync()),
  );
 }
 Future<Response> getUploadFileHandler(Request req) async {
  final fileName = req.rawPathParameters[#fileName];
  if (fileName == null || fileName.isEmpty || fileName.contains('..')) {
    return Response.badRequest(
      body: Body.fromString('Invalid file name'),
    );
  }
  final diskPath = '$_uploadsDir${Platform.pathSeparator}$fileName';
  final file = File(diskPath);
  if (!file.existsSync()) {
    return Response.notFound(
      body: Body.fromString('File not found'),
    );
  }
  return Response.ok(
    body: Body.fromData(file.readAsBytesSync()),
  );
 }
 (ChatUser?, Response?) _requireCurrentUser(Request req) {
  final userId = userIdProperty[req];
  if (userId == null) {
    return (
      null,
      Response.unauthorized(
        body: Body.fromString('Not authenticated'),
      )
    );
  }
  final query = userBox.query(ChatUser_.userId.equals(userId)).build();
  final user = query.findFirst();
  query.close();
  if (user == null) {
    return (
      null,
      Response.unauthorized(
        body: Body.fromString('User not found'),
      )
    );
  }
  return (user, null);
 }
 Future<(Uint8List?, Response?, String?, String?)> _readUploadData(Request req) async {
  final contentTypeHeader = req.headers[Headers.contentTypeHeader]?.first;
  final boundary = _extractBoundary(contentTypeHeader);
  if (boundary != null) {
    final multipartParts =
        await req.read(maxLength: _maxUploadBytes).cast<List<int>>().transform(MimeMultipartTransformer(boundary)).toList();
    if (multipartParts.isEmpty) {
      return (null, Response.badRequest(body: Body.fromString('No files in request')), null, null);
    }
    final uploadPart = multipartParts.firstWhere(
      (part) => (part.headers['content-disposition'] ?? '').contains('filename='),
      orElse: () => multipartParts.first,
    );
    final bytesBuilder = BytesBuilder(copy: false);
    await for (final chunk in uploadPart) {
      bytesBuilder.add(chunk);
    }
    final bytes = bytesBuilder.toBytes();
    final mimeType = uploadPart.headers['content-type'];
    final filename = _extractFilename(uploadPart.headers['content-disposition'] ?? '');
    return (bytes, null, mimeType, filename);
  }
  final bytesBuilder = BytesBuilder(copy: false);
  await for (final chunk in req.read(maxLength: _maxUploadBytes)) {
    bytesBuilder.add(chunk);
  }
  final mimeType = contentTypeHeader;
  return (bytesBuilder.toBytes(), null, mimeType, null);
 }
 Map<String, dynamic> _fileResponseMap(ChatFile file) {
  return {
    'uploadId': file.attachmentId,
    'attachmentId': file.attachmentId,
    'id': file.id,
    'url': file.path,
    'status': file.status,
    'usageType': file.usageType,
    'originalFileName': file.originalFileName,
    'storedFileName': file.storedFileName,
    'mimeType': file.mimeType,
    'sizeBytes': file.sizeBytes,
    'width': file.width,
    'height': file.height,
    'sha256': file.sha256,
  };
 }
 void _finalizeUpload({
  required ChatFile file,
  required Uint8List bytes,
  String? payloadMimeType,
  String? payloadFileName,
 }) {
  final detectedMime = _normalizeMimeType(
    payloadMimeType ?? file.mimeType,
  );
  final dimensions = _extractImageDimensions(bytes, detectedMime);
  final extension = _resolveExtension(
    payloadFileName ?? file.originalFileName,
    detectedMime,
  );
  final storedFileName = '${file.attachmentId}$extension';
  final directory = Directory(_uploadsDir);
  if (!directory.existsSync()) {
    directory.createSync(recursive: true);
  }
  final diskPath = '${directory.path}${Platform.pathSeparator}$storedFileName';
  File(diskPath).writeAsBytesSync(bytes, flush: true);
  file.path = '/attachments/${file.attachmentId}';
  file.storedFileName = storedFileName;
  file.sha256 = sha256.convert(bytes).toString();
  file.mimeType = detectedMime;
  file.width = dimensions.$1;
  file.height = dimensions.$2;
  file.sizeBytes = bytes.length;
  file.status = 'ready';
  file.errorCode = null;
  fileBox.put(file);
 }
 String _generateAttachmentId() {
  const alphabet = '0123456789abcdefghijklmnopqrstuvwxyz';
  final random = Random.secure();
  String next() {
    final bytes = List<int>.generate(20, (_) => random.nextInt(256));
    final sb = StringBuffer();
    for (final byte in bytes) {
      sb.write(alphabet[byte % alphabet.length]);
    }
    return sb.toString();
  }
  while (true) {
    final id = next();
    final exists = fileBox.query(ChatFile_.attachmentId.equals(id)).build().findFirst();
    if (exists == null) {
      return id;
    }
  }
 }
 bool _isAllowedUsageType(String usageType) {
  return usageType == 'message' || usageType == 'avatar' || usageType == 'server_icon' || usageType == 'server_banner';
 }
 int? _asInt(Object? value) {
  return switch (value) {
    int v => v,
    double v => v.round(),
    String v => int.tryParse(v),
    _ => null,
  };
 }
 String _resolveDiskPath(ChatFile file) {
  final storedFileName = file.storedFileName.trim();
  if (storedFileName.isNotEmpty) {
    return '$_uploadsDir${Platform.pathSeparator}$storedFileName';
  }
  final path = file.path;
  if (path.startsWith('/uploads/')) {
    final fileName = path.substring('/uploads/'.length);
    return '$_uploadsDir${Platform.pathSeparator}$fileName';
  }
  final attachmentPath = path.startsWith('/attachments/') ? path.substring('/attachments/'.length) : path;
  return '$_uploadsDir${Platform.pathSeparator}$attachmentPath';
 }
 String _normalizeMimeType(String? mimeType) {
  final cleaned = (mimeType ?? '').split(';').first.trim().toLowerCase();
  if (cleaned.isEmpty) {
    return 'application/octet-stream';
  }
  return cleaned;
 }
 String? _extractBoundary(String? contentTypeHeader) {
  if (contentTypeHeader == null) {
    return null;
  }
  if (!contentTypeHeader.toLowerCase().startsWith('multipart/form-data')) {
    return null;
  }
  final match = RegExp(
    r'boundary="?([^\";]+)"?',
    caseSensitive: false,
  ).firstMatch(contentTypeHeader);
  return match?.group(1);
 }
 String? _extractFilename(String contentDisposition) {
  final match = RegExp(
    r'filename="([^"]+)"',
    caseSensitive: false,
  ).firstMatch(contentDisposition);
  if (match == null) {
    return null;
  }
  final decoded = Uri.decodeFull(match.group(1)!);
  return decoded.split(RegExp(r'[\\/]')).last;
 }
 String _resolveExtension(String? fileName, String mimeType) {
  final lowerName = fileName?.toLowerCase();
  if (lowerName != null) {
    final dotIndex = lowerName.lastIndexOf('.');
    if (dotIndex > 0 && dotIndex < lowerName.length - 1) {
      return lowerName.substring(dotIndex);
    }
  }
  return switch (mimeType.toLowerCase()) {
    'image/png' => '.png',
    'image/jpeg' || 'image/jpg' => '.jpg',
    'image/gif' => '.gif',
    'image/webp' => '.webp',
    'image/avif' => '.avif',
    'video/mp4' => '.mp4',
    _ => '.bin',
  };
 }
 (int, int) _extractImageDimensions(Uint8List bytes, String mimeType) {
  final lowerMime = mimeType.toLowerCase();
  if (lowerMime == 'image/png' && bytes.length >= 24) {
    final width = _readUint32BigEndian(bytes, 16);
    final height = _readUint32BigEndian(bytes, 20);
    return (width, height);
  }
  if ((lowerMime == 'image/jpeg' || lowerMime == 'image/jpg') && bytes.length > 4) {
    final jpeg = _extractJpegDimensions(bytes);
    if (jpeg != null) {
      return jpeg;
    }
  }
  if (lowerMime == 'image/gif' && bytes.length >= 10) {
    final width = bytes[6] | (bytes[7] << 8);
    final height = bytes[8] | (bytes[9] << 8);
    return (width, height);
  }
  return (0, 0);
 }
 int _readUint32BigEndian(Uint8List bytes, int offset) {
  return (bytes[offset] << 24) | (bytes[offset + 1] << 16) | (bytes[offset + 2] << 8) | bytes[offset + 3];
 }
 (int, int)? _extractJpegDimensions(Uint8List bytes) {
  if (bytes[0] != 0xFF || bytes[1] != 0xD8) {
    return null;
  }
  var offset = 2;
  while (offset + 9 < bytes.length) {
    if (bytes[offset] != 0xFF) {
      offset++;
      continue;
    }
    final marker = bytes[offset + 1];
    final hasSize = marker != 0xD8 && marker != 0xD9;
    if (!hasSize) {
      offset += 2;
      continue;
    }
    if (offset + 4 >= bytes.length) {
      return null;
    }
    final length = (bytes[offset + 2] << 8) | bytes[offset + 3];
    if (length < 2 || offset + 2 + length > bytes.length) {
      return null;
    }
    final isSofMarker = (marker >= 0xC0 && marker <= 0xC3) ||
        (marker >= 0xC5 && marker <= 0xC7) ||
        (marker >= 0xC9 && marker <= 0xCB) ||
        (marker >= 0xCD && marker <= 0xCF);
    if (isSofMarker && offset + 9 < bytes.length) {
      final height = (bytes[offset + 5] << 8) | bytes[offset + 6];
      final width = (bytes[offset + 7] << 8) | bytes[offset + 8];
      return (width, height);
    }
    offset += 2 + length;
  }
  return null;
 }
@@ -5,10 +5,16 @@ late final Store store;
 late final Box<ChatUser> userBox;
 late final Box<ChatChannel> channelBox;
 late final Box<ChatMessage> messageBox;
 late final Box<ChatMessageMedia> messageMediaBox;
 late final Box<ChatFile> fileBox;
 late final Box<ServerSettings> serverSettingsBox;
 void initializeStore() {
  store = openStore();
  userBox = store.box<ChatUser>();
  channelBox = store.box<ChatChannel>();
  messageBox = store.box<ChatMessage>();
  messageMediaBox = store.box<ChatMessageMedia>();
  fileBox = store.box<ChatFile>();
  serverSettingsBox = store.box<ServerSettings>();
 }
@@ -137,6 +137,14 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "2.0.4"
  cli_config:
    dependency: transitive
    description:
      name: cli_config
      sha256: ac20a183a07002b700f0c25e61b7ee46b23c309d76ab7b7640a028f18e4d99ec
      url: "https://pub.dev"
    source: hosted
    version: "0.2.0"
  clock:
    dependency: transitive
    description:
@@ -169,6 +177,14 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "3.1.2"
  coverage:
    dependency: transitive
    description:
      name: coverage
      sha256: "5da775aa218eaf2151c721b16c01c7676fbfdd99cebba2bf64e8b807a28ff94d"
      url: "https://pub.dev"
    source: hosted
    version: "1.15.0"
  crypto:
    dependency: "direct main"
    description:
@@ -265,14 +281,6 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "2.3.2"
  hotreloader:
    dependency: "direct main"
    description:
      name: hotreloader
      sha256: bc167a1163807b03bada490bfe2df25b0d744df359227880220a5cbd04e5734b
      url: "https://pub.dev"
    source: hosted
    version: "4.3.0"
  http:
    dependency: transitive
    description:
@@ -341,10 +349,10 @@ packages:
    dependency: transitive
    description:
      name: matcher
-      sha256: "12956d0ad8390bbcc63ca2e1469c0619946ccb52809807067a7020d57e647aa6"
+      sha256: dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2
      url: "https://pub.dev"
    source: hosted
-    version: "0.12.18"
+    version: "0.12.17"
  meta:
    dependency: transitive
    description:
@@ -354,13 +362,21 @@ packages:
    source: hosted
    version: "1.18.1"
  mime:
-    dependency: transitive
+    dependency: "direct main"
    description:
      name: mime
      sha256: "41a20518f0cb1256669420fdba0cd90d21561e560ac240f26ef8322e45bb7ed6"
      url: "https://pub.dev"
    source: hosted
    version: "2.0.0"
  node_preamble:
    dependency: transitive
    description:
      name: node_preamble
      sha256: "6e7eac89047ab8a8d26cf16127b5ed26de65209847630400f9aefd7cd5c730db"
      url: "https://pub.dev"
    source: hosted
    version: "2.0.2"
  objectbox:
    dependency: "direct main"
    description:
@@ -457,6 +473,22 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "1.4.2"
  shelf_packages_handler:
    dependency: transitive
    description:
      name: shelf_packages_handler
      sha256: "89f967eca29607c933ba9571d838be31d67f53f6e4ee15147d5dc2934fee1b1e"
      url: "https://pub.dev"
    source: hosted
    version: "3.0.2"
  shelf_static:
    dependency: transitive
    description:
      name: shelf_static
      sha256: c87c3875f91262785dade62d135760c2c69cb217ac759485334c5857ad89f6e3
      url: "https://pub.dev"
    source: hosted
    version: "1.1.3"
  shelf_web_socket:
    dependency: transitive
    description:
@@ -473,6 +505,22 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "1.5.0"
  source_map_stack_trace:
    dependency: transitive
    description:
      name: source_map_stack_trace
      sha256: c0713a43e323c3302c2abe2a1cc89aa057a387101ebd280371d6a6c9fa68516b
      url: "https://pub.dev"
    source: hosted
    version: "2.1.2"
  source_maps:
    dependency: transitive
    description:
      name: source_maps
      sha256: "190222579a448b03896e0ca6eca5998fa810fda630c1d65e2f78b3f638f54812"
      url: "https://pub.dev"
    source: hosted
    version: "0.10.13"
  source_span:
    dependency: transitive
    description:
@@ -521,14 +569,30 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "1.2.2"
  test:
    dependency: "direct dev"
    description:
      name: test
      sha256: "75906bf273541b676716d1ca7627a17e4c4070a3a16272b7a3dc7da3b9f3f6b7"
      url: "https://pub.dev"
    source: hosted
    version: "1.26.3"
  test_api:
    dependency: transitive
    description:
      name: test_api
-      sha256: "93167629bfc610f71560ab9312acdda4959de4df6fac7492c89ff0d3886f6636"
+      sha256: ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55
      url: "https://pub.dev"
    source: hosted
-    version: "0.7.9"
+    version: "0.7.7"
  test_core:
    dependency: transitive
    description:
      name: test_core
      sha256: "0cc24b5ff94b38d2ae73e1eb43cc302b77964fbf67abad1e296025b78deb53d0"
      url: "https://pub.dev"
    source: hosted
    version: "0.6.12"
  timing:
    dependency: transitive
    description:
@@ -585,8 +649,16 @@ packages:
      url: "https://pub.dev"
    source: hosted
    version: "3.0.3"
-  yaml:
+  webkit_inspection_protocol:
    dependency: transitive
    description:
      name: webkit_inspection_protocol
      sha256: "87d3f2333bb240704cd3f1c6b5b7acd8a10e7f0bc28c28dcf14e782014f4a572"
      url: "https://pub.dev"
    source: hosted
    version: "1.2.1"
  yaml:
    dependency: "direct main"
    description:
      name: yaml
      sha256: b9da305ac7c39faa3f030eccd175340f968459dae4af175130b3fc47e40d76ce
@@ -13,9 +13,11 @@ dependencies:
  crypton:
  crypto:
  collection:
-  hotreloader:
+  yaml:
  mime:
 dev_dependencies:
  test:
  objectbox_generator:
  build_runner:
  lints:
@@ -0,0 +1,61 @@
 import 'package:chat_server/src/handlers/auth_handlers.dart';
 import 'package:test/test.dart';
 void main() {
  group('normalizeHomeServer', () {
    test('normalizes host without scheme', () {
      expect(
        normalizeHomeServer('chat.example.com'),
        'https://chat.example.com',
      );
      expect(
        normalizeHomeServer('localhost:9870'),
        'http://localhost:9870',
      );
    });
    test('strips trailing slash/path/query/fragment', () {
      expect(
        normalizeHomeServer('https://example.com/a/b?x=1#y'),
        'https://example.com',
      );
      expect(
        normalizeHomeServer('https://example.com/'),
        'https://example.com',
      );
    });
    test('returns null for invalid input', () {
      expect(normalizeHomeServer(''), isNull);
      expect(normalizeHomeServer('://bad'), isNull);
    });
  });
  group('defaultSchemeForHost', () {
    test('returns http for localhost-style hosts', () {
      expect(defaultSchemeForHost('localhost:9870'), 'http');
      expect(defaultSchemeForHost('127.0.0.1:9870'), 'http');
      expect(defaultSchemeForHost('[::1]:9870'), 'http');
    });
    test('returns https for non-local hosts', () {
      expect(defaultSchemeForHost('chat.example.com'), 'https');
    });
  });
  group('toUserHandle', () {
    test('uses URL host and port', () {
      expect(
        toUserHandle('alice', 'https://chat.example.com:8443'),
        '@alice@chat.example.com:8443',
      );
    });
    test('falls back to raw home server string', () {
      expect(
        toUserHandle('alice', 'chat.example.com'),
        '@alice@chat.example.com',
      );
    });
  });
 }
@@ -0,0 +1,42 @@
 import 'package:chat_server/src/auth/crypto_service.dart';
 import 'package:test/test.dart';
 void main() {
  group('AuthService password hashing', () {
    test('hash + verify works', () {
      const password = 'pass1234';
      final hash = AuthService.hashPassword(password);
      expect(hash, isNotEmpty);
      expect(AuthService.verifyPassword(password, hash), isTrue);
      expect(AuthService.verifyPassword('wrong-password', hash), isFalse);
    });
  });
  group('CryptoService signing', () {
    test('signatures verify with matching keypair', () {
      final keyPair = CryptoService.generateKeyPair();
      const payload = 'alice@localhost:9870:1700000000';
      final signature = CryptoService.sign(payload, keyPair.privateKey);
      final ok = CryptoService.verify(payload, signature, keyPair.publicKey);
      expect(ok, isTrue);
    });
    test('signature fails for modified payload', () {
      final keyPair = CryptoService.generateKeyPair();
      const payload = 'payload-a';
      const tamperedPayload = 'payload-b';
      final signature = CryptoService.sign(payload, keyPair.privateKey);
      final ok = CryptoService.verify(
        tamperedPayload,
        signature,
        keyPair.publicKey,
      );
      expect(ok, isFalse);
    });
  });
 }
@@ -0,0 +1,326 @@
 import 'dart:async';
 import 'dart:convert';
 import 'dart:io';
 import 'dart:math';
 import 'package:chat_server/config/config.dart';
 import 'package:chat_server/server.dart';
 import 'package:chat_server/src/state/app_state.dart';
 import 'package:test/test.dart';
 void main() {
  final repoDir = Directory.current.path;
  final configPath = '$repoDir${Platform.pathSeparator}config.yaml';
  final objectboxDir = '$repoDir${Platform.pathSeparator}objectbox';
  final uploadsDir = '$repoDir${Platform.pathSeparator}uploads';
  late String originalConfig;
  late Uri baseUri;
  final random = Random();
  Future<void> waitUntilServerReady(Uri uri) async {
    final client = HttpClient();
    try {
      for (var i = 0; i < 120; i++) {
        try {
          final req = await client.getUrl(uri.resolve('/.well-known/server'));
          final res = await req.close();
          if (res.statusCode == 200) {
            await res.drain();
            return;
          }
          await res.drain();
        } catch (_) {}
        await Future<void>.delayed(const Duration(milliseconds: 250));
      }
      fail('Server did not become ready in time.');
    } finally {
      client.close(force: true);
    }
  }
  setUpAll(() async {
    originalConfig = File(configPath).existsSync() ? File(configPath).readAsStringSync() : '';
    final bindPort = 12000 + random.nextInt(2000);
    final testConfig = '''
 server:
  name: "Reliquary Test Server"
  bind_host: "127.0.0.1"
  bind_port: $bindPort
  public_base_url: "http://127.0.0.1:$bindPort"
  configured: true
  first_setup: true
  bootstrap_admin_limit: 2
  dev_db_tools: true
 security:
  jwt_secret: "integration_test_secret_1234567890"
 ''';
    File(configPath).writeAsStringSync(testConfig);
    baseUri = Uri.parse('http://127.0.0.1:$bindPort');
    final dataMdb = File('$objectboxDir${Platform.pathSeparator}data.mdb');
    final lockMdb = File('$objectboxDir${Platform.pathSeparator}lock.mdb');
    if (dataMdb.existsSync()) {
      dataMdb.deleteSync();
    }
    if (lockMdb.existsSync()) {
      lockMdb.deleteSync();
    }
    final uploads = Directory(uploadsDir);
    if (uploads.existsSync()) {
      for (final entity in uploads.listSync()) {
        if (entity is File) {
          entity.deleteSync();
        }
      }
    }
    Config.initialize();
    initializeStore();
    unawaited(startServer());
    await waitUntilServerReady(baseUri);
  });
  tearDownAll(() async {
    await stopServer();
    if (originalConfig.isEmpty) {
      File(configPath).deleteSync();
    } else {
      File(configPath).writeAsStringSync(originalConfig);
    }
  });
  test('auth + upload + component messages + gallery index', () async {
    final client = HttpClient();
    try {
      Future<Map<String, dynamic>> postJson(
        String path,
        Map<String, dynamic> body, {
        String? token,
      }) async {
        final req = await client.postUrl(baseUri.resolve(path));
        req.headers.set(HttpHeaders.contentTypeHeader, 'application/json');
        if (token != null) {
          req.headers.set(HttpHeaders.authorizationHeader, 'Bearer $token');
        }
        req.write(jsonEncode(body));
        final res = await req.close();
        final text = await utf8.decodeStream(res);
        expect(res.statusCode, anyOf(200, 201), reason: '$path -> $text');
        return jsonDecode(text) as Map<String, dynamic>;
      }
      Future<Map<String, dynamic>> getJson(
        String path, {
        String? token,
      }) async {
        final req = await client.getUrl(baseUri.resolve(path));
        if (token != null) {
          req.headers.set(HttpHeaders.authorizationHeader, 'Bearer $token');
        }
        final res = await req.close();
        final text = await utf8.decodeStream(res);
        expect(res.statusCode, 200, reason: '$path -> $text');
        return jsonDecode(text) as Map<String, dynamic>;
      }
      Future<Map<String, dynamic>> uploadFile(
        String filePath, {
        required String token,
      }) async {
        final file = File(filePath);
        expect(file.existsSync(), isTrue, reason: 'Missing test asset: $filePath');
        final bytes = file.readAsBytesSync();
        final rawFileName = file.uri.pathSegments.last;
        final safeFileName = rawFileName.replaceAll(RegExp(r'[^a-zA-Z0-9._-]'), '_');
        final lower = rawFileName.toLowerCase();
        final contentType = lower.endsWith('.mp4')
            ? 'video/mp4'
            : lower.endsWith('.png')
                ? 'image/png'
                : lower.endsWith('.jpg') || lower.endsWith('.jpeg')
                    ? 'image/jpeg'
                    : lower.endsWith('.gif')
                        ? 'image/gif'
                        : 'application/octet-stream';
        final boundary = '----reliquary-test-boundary';
        final req = await client.postUrl(baseUri.resolve('/api/uploads'));
        req.headers.set(HttpHeaders.authorizationHeader, 'Bearer $token');
        req.headers.set(
          HttpHeaders.contentTypeHeader,
          'multipart/form-data; boundary=$boundary',
        );
        req.write('--$boundary\r\n');
        req.write(
          'Content-Disposition: form-data; name="file"; filename="$safeFileName"\r\n',
        );
        req.write('Content-Type: $contentType\r\n\r\n');
        req.add(bytes);
        req.write('\r\n--$boundary--\r\n');
        final res = await req.close();
        final text = await utf8.decodeStream(res);
        expect(res.statusCode, 200, reason: '/api/uploads -> $text');
        return jsonDecode(text) as Map<String, dynamic>;
      }
      final register = await postJson('/auth/register', {
        'username': 'alice',
        'password': 'password123',
      });
      final token = register['token'] as String;
      final channel = await postJson(
        '/api/channels',
        {'name': 'integration-channel', 'description': 'integration'},
        token: token,
      );
      final channelId = channel['id'] as int;
      final uploadedPng = await uploadFile(
        '$repoDir${Platform.pathSeparator}scripts${Platform.pathSeparator}media${Platform.pathSeparator}Untitled-1.png',
        token: token,
      );
      final pngAttachmentId = uploadedPng['attachmentId'] as String;
      final uploadedPsd = await uploadFile(
        '$repoDir${Platform.pathSeparator}scripts${Platform.pathSeparator}media${Platform.pathSeparator}ftnr-symbol.psd',
        token: token,
      );
      final psdAttachmentId = uploadedPsd['attachmentId'] as String;
      expect(psdAttachmentId, isNotEmpty);
      final uploadedMp4 = await uploadFile(
        '$repoDir${Platform.pathSeparator}scripts${Platform.pathSeparator}media${Platform.pathSeparator}Zelsus： Enemy Within [jUKjVrDFUug].mp4',
        token: token,
      );
      final mp4AttachmentId = uploadedMp4['attachmentId'] as String;
      expect(mp4AttachmentId, isNotEmpty);
      final localMessage = await postJson(
        '/api/messages',
        {
          'channelId': channelId,
          'components': [
            {
              'id': 'cmp_local_gallery',
              'type': 'gallery',
              'typeVersion': 1,
              'fallback': 'Local upload gallery',
              'data': {
                'items': [
                  {
                    'id': 'itm_local_1',
                    'source': 'local_upload',
                    'attachmentId': pngAttachmentId,
                  }
                ]
              }
            }
          ]
        },
        token: token,
      );
      expect(localMessage['componentsJson'], contains('"source":"local_upload"'));
      expect(localMessage['componentsJson'], contains('"status":"ready"'));
      final fileAndVideoMessage = await postJson(
        '/api/messages',
        {
          'channelId': channelId,
          'components': [
            {
              'id': 'cmp_files',
              'type': 'gallery',
              'typeVersion': 1,
              'fallback': 'Local file + local video + external file link',
              'data': {
                'items': [
                  {
                    'id': 'itm_psd',
                    'source': 'local_upload',
                    'attachmentId': psdAttachmentId,
                    'caption': 'PSD unsupported preview candidate'
                  },
                  {'id': 'itm_mp4', 'source': 'local_upload', 'attachmentId': mp4AttachmentId, 'caption': 'MP4 playback candidate'},
                  {
                    'id': 'itm_ext_file',
                    'source': 'external_url',
                    'url': 'https://example.com/assets/archive.zip',
                    'mimeType': 'application/zip',
                    'originalFileName': 'archive.zip'
                  }
                ]
              }
            }
          ]
        },
        token: token,
      );
      expect(fileAndVideoMessage['componentsJson'], contains('"itm_psd"'));
      expect(fileAndVideoMessage['componentsJson'], contains('"itm_mp4"'));
      expect(fileAndVideoMessage['componentsJson'], contains('"external_url"'));
      final externalMessage = await postJson(
        '/api/messages',
        {
          'channelId': channelId,
          'components': [
            {
              'id': 'cmp_external_gallery',
              'type': 'gallery',
              'typeVersion': 1,
              'fallback': 'External gallery',
              'data': {
                'items': [
                  {
                    'id': 'itm_ext_1',
                    'source': 'external_url',
                    'url': 'https://pbs.twimg.com/media/HCI8WPKaYAAKhkj?format=jpg&name=medium',
                    'mimeType': 'image/jpeg',
                    'originalFileName': 'HCI8WPKaYAAKhkj.jpg',
                  },
                  {
                    'id': 'itm_ext_2',
                    'source': 'external_url',
                    'url': 'https://pbs.twimg.com/media/HCKAMLxaUAAhYJS?format=jpg&name=medium',
                    'mimeType': 'image/jpeg',
                    'originalFileName': 'HCKAMLxaUAAhYJS.jpg',
                  }
                ]
              }
            }
          ]
        },
        token: token,
      );
      expect(externalMessage['componentsJson'], contains('"source":"external_url"'));
      expect(externalMessage['componentsJson'], contains('"status":"ready"'));
      final messages = await getJson('/api/messages?channelId=$channelId&limit=10', token: token);
      final messageList = (messages['messages'] as List).cast<Map<String, dynamic>>();
      expect(messageList.length, greaterThanOrEqualTo(2));
      final media = await getJson('/api/channels/$channelId/media?limit=10', token: token);
      final mediaItems = (media['media'] as List).cast<Map<String, dynamic>>();
      expect(mediaItems.length, greaterThanOrEqualTo(6));
      final hasExternal = mediaItems.any((m) => (m['externalUrl'] as String?)?.contains('pbs.twimg.com/media/HCI8WPKaYAAKhkj') == true);
      final hasPngLocal = mediaItems.any((m) => (m['attachmentId'] as String?) == pngAttachmentId);
      final hasPsdLocal = mediaItems.any((m) => (m['attachmentId'] as String?) == psdAttachmentId);
      final hasMp4Local = mediaItems.any((m) => (m['attachmentId'] as String?) == mp4AttachmentId);
      final hasExternalFile = mediaItems.any((m) => (m['externalUrl'] as String?) == 'https://example.com/assets/archive.zip');
      final hasVideoKind = mediaItems.any((m) => (m['attachmentId'] as String?) == mp4AttachmentId && m['kind'] == 'video');
      expect(hasExternal, isTrue);
      expect(hasPngLocal, isTrue);
      expect(hasPsdLocal, isTrue);
      expect(hasMp4Local, isTrue);
      expect(hasExternalFile, isTrue);
      expect(hasVideoKind, isTrue);
    } finally {
      client.close(force: true);
    }
  });
 }
Author	SHA1	Message	Date
Foxyz	01c110bbe1	Major architecture update: stable identity, component validation, media indexing, and protocol docs	2026-02-27 19:33:35 +03:00
Foxyz	ce7c97d13a	Add baseline unit tests and fix home server normalization	2026-02-20 17:45:10 +03:00
Foxyz	a93d619b4c	Implement components + uploads flow and gateway-aligned payloads	2026-02-20 17:41:08 +03:00
Foxyz	458be6f991	Revised ARCHITECTURE.md based on CLIENT_INTEGRATION.md, to match the current implementation	2026-02-20 16:37:30 +03:00
Foxyz	2222e2af4a	Updated ARCHITECTURE.md with new and refined ideas	2026-02-20 15:01:55 +03:00
Foxyz	ccf966ffc1	Add gateway realtime fanout and cursor pagination docs	2026-02-20 04:24:27 +03:00
Foxyz	4399eafc90	Align architecture doc with current crypto implementation	2026-02-20 03:50:56 +03:00
Foxyz	3f7d50f6a2	Document realtime gateway and notifications/push architecture	2026-02-20 03:50:31 +03:00