feat(voice): add opt-in peer-to-peer calls and country rollouts (#3367)

fluxer_admin/src/api/types/instance_config.rs

@@ -27,6 +27,8 @@ pub struct InstanceConfigResponse {
     #[serde(default)]
     pub domain_migration: DomainMigrationConfigResponse,
     #[serde(default)]
+    pub voice_p2p: VoiceP2pConfigResponse,
+    #[serde(default)]
     pub captcha: CaptchaConfigResponse,
     #[serde(default)]
     pub experiment_delivery: ExperimentDeliveryConfigResponse,
@@ -506,7 +508,10 @@ impl VoiceE2eeScope {
 }
 
 pub const EXPERIMENT_MAX_TARGETED_USERS: usize = 1_000;
+pub const EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES: usize = 250;
 pub const DOMAIN_MIGRATION_DEFAULT_SALT: &str = "domain-migration-v1";
+pub const VOICE_P2P_DEFAULT_SALT: &str = "voice-p2p-v1";
+pub const VOICE_P2P_MAX_PARTICIPANTS_RANGE: std::ops::RangeInclusive<u32> = 2..=4;
 pub const CAPTCHA_COST_RANGE: std::ops::RangeInclusive<u32> = 1_000..=20_000;
 pub const CAPTCHA_MAX_COUNTER_RANGE: std::ops::RangeInclusive<u32> = 100..=20_000;
 
@@ -530,6 +535,7 @@ pub struct DomainMigrationConfigResponse {
     pub enabled: bool,
     pub config_version: u64,
     pub rollout_basis_points: u32,
+    pub rollout_country_codes: Vec<String>,
     pub rollout_salt: String,
     pub included_user_ids: Vec<String>,
     pub included_guild_ids: Vec<String>,
@@ -545,6 +551,7 @@ impl Default for DomainMigrationConfigResponse {
             enabled: false,
             config_version: 0,
             rollout_basis_points: 0,
+            rollout_country_codes: Vec::new(),
             rollout_salt: DOMAIN_MIGRATION_DEFAULT_SALT.to_owned(),
             included_user_ids: Vec::new(),
             included_guild_ids: Vec::new(),
@@ -563,6 +570,8 @@ pub struct DomainMigrationConfigUpdateRequest {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub rollout_basis_points: Option<u32>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_country_codes: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub rollout_salt: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub included_user_ids: Option<Vec<String>>,
@@ -578,6 +587,60 @@ pub struct DomainMigrationConfigUpdateRequest {
     pub standalone_forwarding: Option<bool>,
 }
 
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(default)]
+pub struct VoiceP2pConfigResponse {
+    pub enabled: bool,
+    pub config_version: u64,
+    pub rollout_basis_points: u32,
+    pub rollout_country_codes: Vec<String>,
+    pub rollout_salt: String,
+    pub included_user_ids: Vec<String>,
+    pub included_guild_ids: Vec<String>,
+    pub include_premium_users: bool,
+    pub excluded_user_ids: Vec<String>,
+    pub max_participants: u32,
+}
+
+impl Default for VoiceP2pConfigResponse {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            config_version: 0,
+            rollout_basis_points: 0,
+            rollout_country_codes: Vec::new(),
+            rollout_salt: VOICE_P2P_DEFAULT_SALT.to_owned(),
+            included_user_ids: Vec::new(),
+            included_guild_ids: Vec::new(),
+            include_premium_users: false,
+            excluded_user_ids: Vec::new(),
+            max_participants: *VOICE_P2P_MAX_PARTICIPANTS_RANGE.start(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Default, Serialize)]
+pub struct VoiceP2pConfigUpdateRequest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub enabled: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_basis_points: Option<u32>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_country_codes: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub rollout_salt: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub included_guild_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub include_premium_users: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub excluded_user_ids: Option<Vec<String>>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_participants: Option<u32>,
+}
+
 #[derive(Clone, Debug, Deserialize, Serialize)]
 #[serde(default)]
 pub struct CaptchaConfigResponse {
@@ -724,6 +787,8 @@ pub struct InstanceConfigUpdateRequest {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub domain_migration: Option<DomainMigrationConfigUpdateRequest>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub voice_p2p: Option<VoiceP2pConfigUpdateRequest>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub captcha: Option<CaptchaConfigUpdateRequest>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub experiment_delivery: Option<ExperimentDeliveryConfigUpdateRequest>,
@@ -1028,17 +1093,22 @@ mod tests {
                 .expect("admin schema");
         let domain_migration = serde_json::from_value::<DomainMigrationConfigResponse>(json!({}))
             .expect("default domain migration config");
+        let voice_p2p = serde_json::from_value::<VoiceP2pConfigResponse>(json!({}))
+            .expect("default voice p2p config");
         let captcha = serde_json::from_value::<CaptchaConfigResponse>(json!({}))
             .expect("default captcha config");
         let delivery = serde_json::from_value::<ExperimentDeliveryConfigResponse>(json!({}))
             .expect("default delivery config");
         let domain_migration =
             serde_json::to_value(domain_migration).expect("serializable domain migration config");
+        let voice_p2p = serde_json::to_value(voice_p2p).expect("serializable voice p2p config");
         let captcha = serde_json::to_value(captcha).expect("serializable captcha config");
         let delivery = serde_json::to_value(delivery).expect("serializable delivery config");
         let generated_domain_migration: generated_types::DomainMigrationConfigResponse =
             serde_json::from_value(domain_migration.clone())
                 .expect("generated domain migration config contract");
+        let generated_voice_p2p: generated_types::VoiceP2pConfigResponse =
+            serde_json::from_value(voice_p2p.clone()).expect("generated voice p2p config contract");
         let generated_captcha: generated_types::CaptchaConfigResponse =
             serde_json::from_value(captcha.clone()).expect("generated captcha config contract");
         let generated_delivery: generated_types::ExperimentDeliveryConfigResponse =
@@ -1048,6 +1118,11 @@ mod tests {
                 .expect("serializable generated domain migration config"),
             domain_migration
         );
+        assert_eq!(
+            serde_json::to_value(generated_voice_p2p)
+                .expect("serializable generated voice p2p config"),
+            voice_p2p
+        );
         assert_eq!(
             serde_json::to_value(generated_captcha).expect("serializable generated captcha config"),
             captcha
@@ -1059,6 +1134,7 @@ mod tests {
         );
         for (name, value) in [
             ("DomainMigrationConfigResponse", domain_migration),
+            ("VoiceP2pConfigResponse", voice_p2p),
             ("CaptchaConfigResponse", captcha),
             ("ExperimentDeliveryConfigResponse", delivery),
         ] {
@@ -1093,4 +1169,25 @@ mod tests {
             json!({})
         );
     }
+
+    #[test]
+    fn voice_p2p_update_preserves_empty_lists_and_omitted_fields() {
+        let update = VoiceP2pConfigUpdateRequest {
+            included_user_ids: Some(Vec::new()),
+            excluded_user_ids: Some(Vec::new()),
+            ..Default::default()
+        };
+        let value = serde_json::to_value(update).expect("serializable update");
+        serde_json::from_value::<generated_types::VoiceP2pConfigUpdateRequest>(value.clone())
+            .expect("generated update contract");
+        assert_eq!(
+            value,
+            json!({"included_user_ids": [], "excluded_user_ids": []})
+        );
+        assert_eq!(
+            serde_json::to_value(VoiceP2pConfigUpdateRequest::default())
+                .expect("serializable update"),
+            json!({})
+        );
+    }
 }

fluxer_admin/src/routes/system_actions.rs

@@ -8,18 +8,19 @@ use crate::{
             AppPublicConfigUpdateRequest, AppRegistrationConfigUpdateRequest,
             AppSetupConfigUpdateRequest, CAPTCHA_COST_RANGE, CAPTCHA_MAX_COUNTER_RANGE,
             CaptchaConfigUpdateRequest, CreateRegistrationUrlRequest,
-            DomainMigrationConfigUpdateRequest, EXPERIMENT_MAX_TARGETED_USERS,
-            ExperimentDeliveryConfigUpdateRequest, GatewayRolloutConfigUpdateRequest,
-            GatewayRolloutMode, InstanceAttachmentDecayUpdateRequest,
-            InstanceBlueskyIntegrationUpdateRequest, InstanceBlueskyKeyIntegrationUpdateRequest,
-            InstanceConfigUpdateRequest, InstanceEmailIntegrationUpdateRequest,
-            InstanceEmailSmtpIntegrationUpdateRequest, InstanceEmailSmtpTestRequest,
-            InstanceGifIntegrationUpdateRequest, InstanceIntegrationsUpdateRequest,
-            InstanceMediaUpdateRequest, InstancePolicyUpdateRequest,
-            InstanceRegistrationConfigUpdateRequest, InstanceServicesUpdateRequest,
-            InstanceYoutubeIntegrationUpdateRequest, LimitConfigUpdateRequest, LimitRule,
-            LimitRuleFilters, PremiumMode, PushRelayConfigUpdateRequest, RegistrationMode,
-            SsoConfigUpdateRequest, VoiceE2eeScope,
+            DomainMigrationConfigUpdateRequest, EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES,
+            EXPERIMENT_MAX_TARGETED_USERS, ExperimentDeliveryConfigUpdateRequest,
+            GatewayRolloutConfigUpdateRequest, GatewayRolloutMode,
+            InstanceAttachmentDecayUpdateRequest, InstanceBlueskyIntegrationUpdateRequest,
+            InstanceBlueskyKeyIntegrationUpdateRequest, InstanceConfigUpdateRequest,
+            InstanceEmailIntegrationUpdateRequest, InstanceEmailSmtpIntegrationUpdateRequest,
+            InstanceEmailSmtpTestRequest, InstanceGifIntegrationUpdateRequest,
+            InstanceIntegrationsUpdateRequest, InstanceMediaUpdateRequest,
+            InstancePolicyUpdateRequest, InstanceRegistrationConfigUpdateRequest,
+            InstanceServicesUpdateRequest, InstanceYoutubeIntegrationUpdateRequest,
+            LimitConfigUpdateRequest, LimitRule, LimitRuleFilters, PremiumMode,
+            PushRelayConfigUpdateRequest, RegistrationMode, SsoConfigUpdateRequest,
+            VOICE_P2P_MAX_PARTICIPANTS_RANGE, VoiceE2eeScope, VoiceP2pConfigUpdateRequest,
         },
     },
     config::AdminConfig,
@@ -220,6 +221,10 @@ pub async fn instance_config_post(
             Ok(update) => instance_config_result(client.update_instance_config(&update).await),
             Err(message) => FlashData::error(message),
         },
+        "update_voice_p2p" => match build_voice_p2p_update(&form) {
+            Ok(update) => instance_config_result(client.update_instance_config(&update).await),
+            Err(message) => FlashData::error(message),
+        },
         "update_captcha" => match build_captcha_update(&form) {
             Ok(update) => instance_config_result(client.update_instance_config(&update).await),
             Err(message) => FlashData::error(message),
@@ -557,6 +562,32 @@ fn parse_experiment_user_ids(value: &str, label: &str) -> Result<Vec<String>, St
     Ok(ids)
 }
 
+fn parse_experiment_country_codes(value: &str) -> Result<Vec<String>, String> {
+    let mut codes: Vec<String> = Vec::new();
+    let candidates = value
+        .split(|character: char| character == ',' || character.is_whitespace())
+        .filter(|candidate| !candidate.is_empty());
+    for (index, candidate) in candidates.enumerate() {
+        if candidate.len() != 2 || !candidate.bytes().all(|byte| byte.is_ascii_alphabetic()) {
+            return Err(format!(
+                "Rollout countries entry {} must be a two-letter country code",
+                index + 1
+            ));
+        }
+        let code = candidate.to_ascii_uppercase();
+        if codes.contains(&code) {
+            continue;
+        }
+        if codes.len() == EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES {
+            return Err(format!(
+                "Rollout countries must contain at most {EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES} unique codes"
+            ));
+        }
+        codes.push(code);
+    }
+    Ok(codes)
+}
+
 fn build_push_relay_update(form: &MultiValueForm) -> InstanceConfigUpdateRequest {
     InstanceConfigUpdateRequest {
         push_relay: Some(PushRelayConfigUpdateRequest {
@@ -579,6 +610,10 @@ fn build_domain_migration_update(
                 0,
                 EXPERIMENT_ROLLOUT_BASIS_POINTS_MAX,
             )?,
+            rollout_country_codes: Some(parse_experiment_country_codes(
+                form.first("domain_migration_rollout_country_codes")
+                    .unwrap_or_default(),
+            )?),
             rollout_salt: parse_experiment_rollout_salt(form, "domain_migration_rollout_salt")?,
             included_user_ids: Some(parse_experiment_user_ids(
                 form.first("domain_migration_included_user_ids")
@@ -609,6 +644,50 @@ fn build_domain_migration_update(
     })
 }
 
+fn build_voice_p2p_update(form: &MultiValueForm) -> Result<InstanceConfigUpdateRequest, String> {
+    Ok(InstanceConfigUpdateRequest {
+        voice_p2p: Some(VoiceP2pConfigUpdateRequest {
+            enabled: Some(form.bool_value("voice_p2p_enabled")),
+            rollout_basis_points: parse_form_number(
+                form,
+                "voice_p2p_rollout_basis_points",
+                "Rollout basis points",
+                0,
+                EXPERIMENT_ROLLOUT_BASIS_POINTS_MAX,
+            )?,
+            rollout_country_codes: Some(parse_experiment_country_codes(
+                form.first("voice_p2p_rollout_country_codes")
+                    .unwrap_or_default(),
+            )?),
+            rollout_salt: parse_experiment_rollout_salt(form, "voice_p2p_rollout_salt")?,
+            included_user_ids: Some(parse_experiment_user_ids(
+                form.first("voice_p2p_included_user_ids")
+                    .unwrap_or_default(),
+                "Included user IDs",
+            )?),
+            included_guild_ids: Some(parse_experiment_user_ids(
+                form.first("voice_p2p_included_guild_ids")
+                    .unwrap_or_default(),
+                "Included guild IDs",
+            )?),
+            include_premium_users: Some(form.bool_value("voice_p2p_include_premium_users")),
+            excluded_user_ids: Some(parse_experiment_user_ids(
+                form.first("voice_p2p_excluded_user_ids")
+                    .unwrap_or_default(),
+                "Excluded user IDs",
+            )?),
+            max_participants: parse_form_number(
+                form,
+                "voice_p2p_max_participants",
+                "Maximum participants",
+                *VOICE_P2P_MAX_PARTICIPANTS_RANGE.start(),
+                *VOICE_P2P_MAX_PARTICIPANTS_RANGE.end(),
+            )?,
+        }),
+        ..Default::default()
+    })
+}
+
 fn build_captcha_update(form: &MultiValueForm) -> Result<InstanceConfigUpdateRequest, String> {
     Ok(InstanceConfigUpdateRequest {
         captcha: Some(CaptchaConfigUpdateRequest {
@@ -1340,10 +1419,62 @@ mod tests {
         );
     }
 
+    #[test]
+    fn parse_experiment_country_codes_splits_uppercases_and_dedupes() {
+        assert_eq!(
+            parse_experiment_country_codes("  se ,NO\nbr\r\n fi\tSE ,, no ").expect("valid codes"),
+            vec![
+                "SE".to_owned(),
+                "NO".to_owned(),
+                "BR".to_owned(),
+                "FI".to_owned()
+            ]
+        );
+        assert_eq!(
+            parse_experiment_country_codes(" \n ").expect("valid codes"),
+            Vec::<String>::new()
+        );
+    }
+
+    #[test]
+    fn parse_experiment_country_codes_rejects_malformed_codes() {
+        for value in ["S", "SWE", "S1", "5E", "<>", "ÅL"] {
+            assert_eq!(
+                parse_experiment_country_codes(&format!("SE,{value}")).expect_err("invalid code"),
+                "Rollout countries entry 2 must be a two-letter country code",
+                "{value}"
+            );
+        }
+    }
+
+    #[test]
+    fn parse_experiment_country_codes_rejects_exceeding_the_cap() {
+        let codes = (b'A'..=b'Z')
+            .flat_map(|first| {
+                (b'A'..=b'Z').map(move |second| format!("{}{}", first as char, second as char))
+            })
+            .collect::<Vec<_>>();
+        let at_cap = codes[..EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES].join(" ");
+        assert_eq!(
+            parse_experiment_country_codes(&format!("{at_cap} aa"))
+                .expect("valid codes at cap")
+                .len(),
+            EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES
+        );
+        assert_eq!(
+            parse_experiment_country_codes(&format!(
+                "{at_cap} {}",
+                codes[EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES]
+            ))
+            .expect_err("too many codes"),
+            "Rollout countries must contain at most 250 unique codes"
+        );
+    }
+
     #[test]
     fn build_domain_migration_update_reads_the_rollout_fields() {
         let form = MultiValueForm::parse(
-            b"domain_migration_enabled=true&domain_migration_rollout_basis_points=%20250%20&domain_migration_rollout_salt=%20domain-migration-v2%20&domain_migration_included_user_ids=1500000000000000001%0A1500000000000000002&domain_migration_excluded_user_ids=1500000000000000003%2C%201500000000000000004&domain_migration_anonymous_rollout_basis_points=%20100%20&domain_migration_standalone_forwarding=true&domain_migration_included_guild_ids=1500000000000000005%0A1500000000000000006%2C1500000000000000005&domain_migration_include_premium_users=true",
+            b"domain_migration_enabled=true&domain_migration_rollout_basis_points=%20250%20&domain_migration_rollout_salt=%20domain-migration-v2%20&domain_migration_included_user_ids=1500000000000000001%0A1500000000000000002&domain_migration_excluded_user_ids=1500000000000000003%2C%201500000000000000004&domain_migration_anonymous_rollout_basis_points=%20100%20&domain_migration_standalone_forwarding=true&domain_migration_included_guild_ids=1500000000000000005%0A1500000000000000006%2C1500000000000000005&domain_migration_include_premium_users=true&domain_migration_rollout_country_codes=se%2C%20NO%0Ase",
         );
         let update = build_domain_migration_update(&form)
             .expect("valid form")
@@ -1369,6 +1500,10 @@ mod tests {
         assert_eq!(update.anonymous_rollout_basis_points, Some(100));
         assert_eq!(update.standalone_forwarding, Some(true));
         assert_eq!(update.include_premium_users, Some(true));
+        assert_eq!(
+            update.rollout_country_codes,
+            Some(vec!["SE".to_owned(), "NO".to_owned()])
+        );
         assert_eq!(
             update.included_guild_ids,
             Some(vec![
@@ -1386,6 +1521,7 @@ mod tests {
             serde_json::to_value(request).expect("serializable update"),
             serde_json::json!({"domain_migration": {
                 "enabled": false,
+                "rollout_country_codes": [],
                 "included_user_ids": [],
                 "included_guild_ids": [],
                 "include_premium_users": false,
@@ -1430,6 +1566,10 @@ mod tests {
                 "domain_migration_excluded_user_ids=123%2Cinvalid",
                 "Excluded user IDs entry 2 must contain 1 to 20 decimal digits",
             ),
+            (
+                "domain_migration_rollout_country_codes=SE%2CSWE",
+                "Rollout countries entry 2 must be a two-letter country code",
+            ),
         ] {
             let form = MultiValueForm::parse(form.as_bytes());
             assert_eq!(
@@ -1519,6 +1659,90 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_voice_p2p_update_reads_the_rollout_fields() {
+        let form = MultiValueForm::parse(
+            b"voice_p2p_enabled=true&voice_p2p_rollout_basis_points=%20500%20&voice_p2p_rollout_salt=%20voice-p2p-v2%20&voice_p2p_included_user_ids=1500000000000000001&voice_p2p_excluded_user_ids=1500000000000000002&voice_p2p_included_guild_ids=1500000000000000005%0A1500000000000000006%2C1500000000000000005&voice_p2p_include_premium_users=true&voice_p2p_rollout_country_codes=se%2C%20NO%0Ase&voice_p2p_max_participants=%203%20",
+        );
+        let update = build_voice_p2p_update(&form)
+            .expect("valid form")
+            .voice_p2p
+            .expect("voice p2p update");
+        assert_eq!(update.enabled, Some(true));
+        assert_eq!(update.rollout_basis_points, Some(500));
+        assert_eq!(update.rollout_salt, Some("voice-p2p-v2".to_owned()));
+        assert_eq!(update.include_premium_users, Some(true));
+        assert_eq!(update.max_participants, Some(3));
+        assert_eq!(
+            update.rollout_country_codes,
+            Some(vec!["SE".to_owned(), "NO".to_owned()])
+        );
+        assert_eq!(
+            update.included_guild_ids,
+            Some(vec![
+                "1500000000000000005".to_owned(),
+                "1500000000000000006".to_owned()
+            ])
+        );
+        assert_eq!(
+            update.included_user_ids,
+            Some(vec!["1500000000000000001".to_owned()])
+        );
+        assert_eq!(
+            update.excluded_user_ids,
+            Some(vec!["1500000000000000002".to_owned()])
+        );
+    }
+
+    #[test]
+    fn build_voice_p2p_update_leaves_the_feature_inert_when_nothing_is_submitted() {
+        let form = MultiValueForm::parse(b"_csrf=token");
+        let request = build_voice_p2p_update(&form).expect("valid form");
+        assert_eq!(
+            serde_json::to_value(request).expect("serializable update"),
+            serde_json::json!({"voice_p2p": {
+                "enabled": false,
+                "rollout_country_codes": [],
+                "included_user_ids": [],
+                "included_guild_ids": [],
+                "include_premium_users": false,
+                "excluded_user_ids": [],
+            }})
+        );
+    }
+
+    #[test]
+    fn build_voice_p2p_update_rejects_invalid_rollout_fields() {
+        for (form, message) in [
+            (
+                "voice_p2p_rollout_basis_points=10001",
+                "Rollout basis points must be a whole number between 0 and 10000",
+            ),
+            (
+                "voice_p2p_included_guild_ids=1500000000000000005%0Anot-a-guild",
+                "Included guild IDs entry 2 must contain 1 to 20 decimal digits",
+            ),
+            (
+                "voice_p2p_rollout_country_codes=SE%2CSWE",
+                "Rollout countries entry 2 must be a two-letter country code",
+            ),
+            (
+                "voice_p2p_max_participants=5",
+                "Maximum participants must be a whole number between 2 and 4",
+            ),
+            (
+                "voice_p2p_max_participants=1",
+                "Maximum participants must be a whole number between 2 and 4",
+            ),
+        ] {
+            let form = MultiValueForm::parse(form.as_bytes());
+            assert_eq!(
+                build_voice_p2p_update(&form).expect_err("invalid field"),
+                message
+            );
+        }
+    }
+
     #[test]
     fn build_experiment_delivery_update_leaves_both_fields_unchanged_when_absent() {
         let form = MultiValueForm::parse(b"_csrf=token");

fluxer_admin/src/templates/pages/instance_config.rs

@@ -5,11 +5,12 @@ use crate::{
         AccountIdentityConfigResponse, AccountIdentityMode, AppPublicConfigResponse,
         CAPTCHA_COST_RANGE, CAPTCHA_MAX_COUNTER_RANGE, CaptchaConfigResponse,
         DOMAIN_MIGRATION_DEFAULT_SALT, DomainMigrationConfigResponse,
-        EXPERIMENT_MAX_TARGETED_USERS, ExperimentDeliveryConfigResponse,
-        GatewayRolloutConfigResponse, InstanceConfigResponse, InstanceIntegrationsResponse,
-        InstanceMediaResponse, InstancePolicyResponse, InstanceRegistrationResponse,
-        LimitConfigResponse, PendingRegistrationResponse, PushRelayConfigResponse,
-        RegistrationUrlResponse, SsoConfigResponse, TagStyle,
+        EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES, EXPERIMENT_MAX_TARGETED_USERS,
+        ExperimentDeliveryConfigResponse, GatewayRolloutConfigResponse, InstanceConfigResponse,
+        InstanceIntegrationsResponse, InstanceMediaResponse, InstancePolicyResponse,
+        InstanceRegistrationResponse, LimitConfigResponse, PendingRegistrationResponse,
+        PushRelayConfigResponse, RegistrationUrlResponse, SsoConfigResponse, TagStyle,
+        VOICE_P2P_DEFAULT_SALT, VOICE_P2P_MAX_PARTICIPANTS_RANGE, VoiceP2pConfigResponse,
     },
     config::AdminConfig,
     middleware::auth::AuthContext,
@@ -58,6 +59,22 @@ fn entry_count_hint(count: usize, cap: usize) -> Markup {
     }
 }
 
+fn experiment_rollout_country_codes_field(name: &str, country_codes: &[String]) -> Markup {
+    html! {
+        div class="flex flex-col gap-2" {
+            (text_input(name, "Rollout Countries", &country_codes.join(", "), "SE, NO, FI"))
+            (entry_count_hint(country_codes.len(), EXPERIMENT_MAX_ROLLOUT_COUNTRY_CODES))
+            p class="text-xs text-neutral-500" {
+                "Two-letter ISO 3166-1 country codes, separated by commas or spaces. When set, \
+                 the user rollout percentage only applies to requests from these countries, and \
+                 a request with an unknown country is left out. Leave empty to apply the \
+                 percentage everywhere. The always-on lists, the premium switch and the \
+                 never-on list ignore the country. Invalid entries prevent the save."
+            }
+        }
+    }
+}
+
 fn number_field(
     name: &str,
     label: &str,
@@ -193,6 +210,7 @@ pub fn instance_config_page(
                         @if !instance_config.self_hosted {
                             (domain_migration_section(base, csrf_token, &instance_config.domain_migration))
                         }
+                        (voice_p2p_section(base, csrf_token, &instance_config.voice_p2p))
                         (experiment_delivery_section(base, csrf_token, &instance_config.experiment_delivery))
                         @if let Some(limit_config) = limit_config {
                             (limit_config_section(base, limit_config))
@@ -1193,6 +1211,10 @@ fn domain_migration_section(
                         Some(0), Some(10000), "1",
                         Some("Share of logged-out devices sent to the new origin, in basis points. Each device is bucketed on its own random ID."),
                     ))
+                    (experiment_rollout_country_codes_field(
+                        "domain_migration_rollout_country_codes",
+                        &domain_migration.rollout_country_codes,
+                    ))
                     div class="flex flex-col gap-2" {
                         (text_input(
                             "domain_migration_rollout_salt",
@@ -1287,6 +1309,162 @@ fn domain_migration_section(
     )
 }
 
+fn voice_p2p_section(base: &str, csrf_token: &str, voice_p2p: &VoiceP2pConfigResponse) -> Markup {
+    let status = if voice_p2p.enabled {
+        ("Live", BadgeVariant::Success)
+    } else {
+        ("Inert", BadgeVariant::Default)
+    };
+    let included_user_ids = voice_p2p.included_user_ids.join("\n");
+    let excluded_user_ids = voice_p2p.excluded_user_ids.join("\n");
+    section_card_with_description(
+        "Peer-to-peer voice",
+        "Lets selected users start small voice calls that connect the participants directly \
+         instead of through the voice servers. A peer-to-peer call only moves to the voice \
+         servers when a participant switches it or its region changes.",
+        html! {
+            form method="post" action={(base) "/instance-config?action=update_voice_p2p"} {
+                (csrf_input(csrf_token))
+                div class="space-y-6" {
+                    div class="flex flex-wrap items-center gap-2" {
+                        h3 class="text-sm font-semibold text-neutral-900" { "Master switch" }
+                        (badge(status.0, status.1))
+                        span class="text-xs text-neutral-500" {
+                            "Config version " (voice_p2p.config_version)
+                        }
+                    }
+                    (checkbox(
+                        "voice_p2p_enabled",
+                        "true",
+                        "Let the selected users start peer-to-peer calls",
+                        voice_p2p.enabled,
+                        true,
+                    ))
+                    p class="text-xs text-neutral-500" {
+                        "Off is the safe state and the kill switch. With this unchecked every new \
+                         call uses the voice servers and a running peer-to-peer call accepts no \
+                         new joins, so the rollout and targeting fields below have no effect at \
+                         all. While it is on, the fields below select who can start a \
+                         peer-to-peer call, and anyone who agrees to a direct connection can \
+                         join one."
+                    }
+
+                    h3 class="text-sm font-semibold text-neutral-900" { "Call size" }
+                    (number_field(
+                        "voice_p2p_max_participants",
+                        "Maximum participants",
+                        &voice_p2p.max_participants.to_string(),
+                        Some(*VOICE_P2P_MAX_PARTICIPANTS_RANGE.start()),
+                        Some(*VOICE_P2P_MAX_PARTICIPANTS_RANGE.end()),
+                        "1",
+                        Some("Most participants a peer-to-peer call can hold, 2 through 4. Clients only offer a peer-to-peer call in a direct message or group with at most this many members, and a join past it is refused as full. Lowering it never removes anyone from a running call."),
+                    ))
+
+                    h3 class="text-sm font-semibold text-neutral-900" { "Rollout" }
+                    (number_field(
+                        "voice_p2p_rollout_basis_points",
+                        "Rollout (basis points)",
+                        &voice_p2p.rollout_basis_points.to_string(),
+                        Some(0), Some(10000), "1",
+                        Some("Share of users who can start peer-to-peer calls, in basis points: 0 is nobody, 100 is 1%, 10000 is everybody."),
+                    ))
+                    (experiment_rollout_country_codes_field(
+                        "voice_p2p_rollout_country_codes",
+                        &voice_p2p.rollout_country_codes,
+                    ))
+                    div class="flex flex-col gap-2" {
+                        (text_input(
+                            "voice_p2p_rollout_salt",
+                            "Rollout Salt",
+                            &voice_p2p.rollout_salt,
+                            VOICE_P2P_DEFAULT_SALT,
+                        ))
+                        p class="text-xs text-neutral-500" {
+                            "Seeds the bucketing hash. Changing it reshuffles which users fall \
+                             inside the percentage above. Leave it alone to keep the current \
+                             cohort stable."
+                        }
+                    }
+                    div class="flex flex-col gap-2" {
+                        (textarea_input(
+                            "voice_p2p_included_user_ids",
+                            "Always-on User IDs",
+                            "1500000000000000001\n1500000000000000002",
+                            &included_user_ids,
+                            4,
+                            false,
+                        ))
+                        (entry_count_hint(
+                            voice_p2p.included_user_ids.len(),
+                            EXPERIMENT_MAX_TARGETED_USERS,
+                        ))
+                        p class="text-xs text-neutral-500" {
+                            "One snowflake per line, or comma separated. These users are targeted \
+                             regardless of the percentage above. IDs must contain 1 to 20 decimal \
+                             digits. Invalid entries prevent the save. Blank entries and duplicate \
+                             IDs are ignored."
+                        }
+                    }
+                    div class="flex flex-col gap-2" {
+                        (checkbox(
+                            "voice_p2p_include_premium_users",
+                            "true",
+                            "Include premium users",
+                            voice_p2p.include_premium_users,
+                            true,
+                        ))
+                        p class="text-xs text-neutral-500" {
+                            "Includes every account with active premium perks, regardless of the \
+                             percentage above. The never-on list still wins."
+                        }
+                    }
+                    div class="flex flex-col gap-2" {
+                        (textarea_input(
+                            "voice_p2p_included_guild_ids",
+                            "Always-on Guild IDs",
+                            "1500000000000000005\n1500000000000000006",
+                            &voice_p2p.included_guild_ids.join("\n"),
+                            4,
+                            false,
+                        ))
+                        (entry_count_hint(
+                            voice_p2p.included_guild_ids.len(),
+                            EXPERIMENT_MAX_TARGETED_USERS,
+                        ))
+                        p class="text-xs text-neutral-500" {
+                            "Same format, with guild IDs. Every member of a listed guild is \
+                             included regardless of the percentage above, unless the user is \
+                             in the never-on list."
+                        }
+                    }
+                    div class="flex flex-col gap-2" {
+                        (textarea_input(
+                            "voice_p2p_excluded_user_ids",
+                            "Never-on User IDs",
+                            "1500000000000000003\n1500000000000000004",
+                            &excluded_user_ids,
+                            4,
+                            false,
+                        ))
+                        (entry_count_hint(
+                            voice_p2p.excluded_user_ids.len(),
+                            EXPERIMENT_MAX_TARGETED_USERS,
+                        ))
+                        p class="text-xs text-neutral-500" {
+                            "Same format. Exclusion wins over both the always-on list and the \
+                             percentage."
+                        }
+                    }
+
+                    (form_actions(html! {
+                        (submit_button("Save Peer-to-Peer Voice Configuration"))
+                    }))
+                }
+            }
+        },
+    )
+}
+
 fn estimate_low_end_solve_seconds(cost: u32, max_counter: u32) -> f64 {
     0.75 * f64::from(cost) * f64::from(max_counter) / 1_050_000.0
 }
@@ -2094,11 +2272,49 @@ mod tests {
         assert!(markup.contains("name=\"domain_migration_anonymous_rollout_basis_points\""));
         assert!(markup.contains("value=\"250\""));
         assert!(markup.contains("name=\"domain_migration_standalone_forwarding\""));
+        assert!(markup.contains("name=\"domain_migration_rollout_country_codes\""));
         assert!(markup.contains("1 of 1000 stored"));
         assert!(markup.contains("2 of 1000 stored"));
         assert!(!markup.contains("at the cap"));
     }
 
+    #[test]
+    fn voice_p2p_section_shows_the_rollout_and_list_counts() {
+        let voice_p2p = VoiceP2pConfigResponse {
+            enabled: true,
+            config_version: 3,
+            rollout_basis_points: 250,
+            rollout_country_codes: vec!["SE".to_owned(), "NO".to_owned()],
+            max_participants: 3,
+            included_user_ids: vec!["1500000000000000001".to_owned()],
+            excluded_user_ids: vec![
+                "1500000000000000002".to_owned(),
+                "1500000000000000003".to_owned(),
+            ],
+            ..VoiceP2pConfigResponse::default()
+        };
+        let markup = voice_p2p_section("/admin", "csrf", &voice_p2p).into_string();
+        assert!(markup.contains("Peer-to-peer voice"));
+        assert!(markup.contains("action=update_voice_p2p"));
+        assert!(markup.contains("name=\"voice_p2p_enabled\""));
+        assert!(markup.contains("name=\"voice_p2p_rollout_basis_points\""));
+        assert!(markup.contains("value=\"250\""));
+        assert!(markup.contains("name=\"voice_p2p_max_participants\""));
+        assert!(markup.contains("value=\"3\""));
+        assert!(markup.contains("min=\"2\""));
+        assert!(markup.contains("max=\"4\""));
+        assert!(markup.contains("name=\"voice_p2p_include_premium_users\""));
+        assert!(markup.contains("name=\"voice_p2p_included_guild_ids\""));
+        assert!(markup.contains("name=\"voice_p2p_rollout_country_codes\""));
+        assert!(markup.contains("value=\"SE, NO\""));
+        assert!(markup.contains("2 of 250 stored"));
+        assert!(markup.contains("Config version 3"));
+        assert!(markup.contains("1 of 1000 stored"));
+        assert!(markup.contains("2 of 1000 stored"));
+        assert!(!markup.contains("anonymous_rollout_basis_points"));
+        assert!(!markup.contains("standalone_forwarding"));
+    }
+
     #[test]
     fn push_relay_section_shows_the_consent_toggle() {
         let accepted = PushRelayConfigResponse {