fix(admin): omit synthetic accounts from user lookup and search (#2705)

.github/ISSUE_TEMPLATE/bug-report.yaml

@@ -36,8 +36,7 @@ body:
       label: Build information
       description: >-
         Open User Settings, scroll to the bottom of the left sidebar, and select
-        the build information. Fluxer copies it to the clipboard. On mobile,
-        select the build information at the bottom of the settings list.
+        the build information. Fluxer copies it to the clipboard.
     validations:
       required: true
 

.github/ISSUE_TEMPLATE/config.yml

@@ -1,15 +1,15 @@
 # yaml-language-server: $schema=https://www.schemastore.org/github-issue-config.json
 blank_issues_enabled: false
 contact_links:
+  - name: Mobile client bugs
+    url: https://github.com/fluxerapp/flutter_client#bug-reporting
+    about: Read the reporting instructions for the Fluxer mobile client.
   - name: Account and billing support
     url: https://fluxer.app/help
     about: Find account help and support contact details.
   - name: Feature proposals
     url: https://github.com/orgs/fluxerapp/discussions
     about: Propose a feature in a discussion.
-  - name: Security vulnerabilities
-    url: https://github.com/fluxerapp/fluxer/security/advisories/new
-    about: Submit a private vulnerability report.
   - name: Translations
     url: https://weblate.fluxer.tools
     about: Improve an existing locale or start a new one.

.github/workflows/build-desktop.yaml

@@ -525,6 +525,7 @@ jobs:
       S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
       DESKTOP_HANDOFF_PREFIX: _handoff/desktop/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
       DESKTOP_RELEASE_ASSETS_PREFIX: _handoff/desktop-release-assets/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
+      DESKTOP_METADATA_PREFIX: _handoff/desktop-metadata/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
       S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
       S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
       PUBLIC_DL_BASE: https://api.fluxer.app/dl
@@ -602,7 +603,9 @@ jobs:
     env:
       CHANNEL: ${{ needs.meta.outputs.build_channel }}
       VERSION: ${{ needs.meta.outputs.version }}
+      S3_DESKTOP_PREFIX: ${{ needs.meta.outputs.s3_prefix }}
       DESKTOP_RELEASE_ASSETS_PREFIX: _handoff/desktop-release-assets/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
+      DESKTOP_METADATA_PREFIX: _handoff/desktop-metadata/${{ needs.meta.outputs.build_channel }}/${{ needs.meta.outputs.version }}/${{ needs.meta.outputs.source_sha }}
       S3_ENDPOINT: ${{ vars.DOWNLOADS_S3_ENDPOINT }}
       S3_BUCKET: ${{ vars.DOWNLOADS_S3_BUCKET }}
       AWS_ACCESS_KEY_ID: ${{ secrets.DOWNLOADS_AWS_ACCESS_KEY_ID || secrets.AWS_ACCESS_KEY_ID }}
@@ -660,3 +663,8 @@ jobs:
         run: >-
           cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
           --step publish_release_marker
+
+      - name: Publish payload metadata to S3
+        run: >-
+          cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- build-desktop
+          --step publish_payload_metadata

.github/workflows/tests.yaml

@@ -314,8 +314,8 @@ jobs:
           path: |
             ~/.cache/rebar3
             fluxer_gateway/_build
-            !fluxer_gateway/_build/default/lib/fluxer_gateway
-            !fluxer_gateway/_build/test/lib/fluxer_gateway
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
           key: >-
             rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
             'fluxer_gateway/rebar.config') }}
@@ -345,8 +345,8 @@ jobs:
           path: |
             ~/.cache/rebar3
             fluxer_gateway/_build
-            !fluxer_gateway/_build/default/lib/fluxer_gateway
-            !fluxer_gateway/_build/test/lib/fluxer_gateway
+            !fluxer_gateway/_build/default/lib/fluxer_gateway/**
+            !fluxer_gateway/_build/test/lib/fluxer_gateway/**
           key: >-
             rebar3-${{ runner.os }}-otp28-rebar3.24.0-${{ hashFiles('fluxer_gateway/rebar.lock',
             'fluxer_gateway/rebar.config') }}
@@ -426,6 +426,31 @@ jobs:
             'packages/markdown_parser/rust/Cargo.toml', 'packages/markdown_parser/rust/.cargo/config.toml',
             'packages/markdown_parser/rust/src/**') }}
 
+  lint:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
+
+      - name: Install Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        with:
+          node-version: '24'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Check formatting and lint
+        run: pnpm exec biome ci .
+
+      - name: Lint JSX for browser-translation safety
+        run: pnpm exec eslint . --max-warnings 0
+
   i18n:
     runs-on: ubuntu-24.04
     timeout-minutes: 25

biome.json

@@ -84,7 +84,18 @@
 				},
 				"useConst": "error",
 				"noNonNullAssertion": "off",
-				"noParameterAssign": "off"
+				"noParameterAssign": "off",
+				"noRestrictedImports": {
+					"level": "error",
+					"options": {
+						"paths": {
+							"@lingui/react": {
+								"importNames": ["I18nProvider"],
+								"message": "Use AppI18nProvider from @app/features/i18n/components/AppI18nProvider so <Trans> output stays safe under page translation."
+							}
+						}
+					}
+				}
 			},
 			"a11y": {
 				"recommended": true,
@@ -116,10 +127,21 @@
 	},
 	"assist": {"actions": {"source": {"organizeImports": "on"}}},
 	"overrides": [
+		{
+			"includes": ["fluxer_app/src/**/*.tsx"],
+			"plugins": ["./tools/lint/no-adjacent-jsx-text.grit"]
+		},
 		{
 			"includes": ["fluxer_docs/scripts/VerifyDocsCoverage.ts"],
 			"linter": {"rules": {"suspicious": {"noTemplateCurlyInString": "off"}}}
 		},
+		{
+			"includes": [
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.tsx",
+				"fluxer_app/src/features/i18n/components/AppI18nProvider.test.tsx"
+			],
+			"linter": {"rules": {"style": {"noRestrictedImports": "off"}}}
+		},
 		{
 			"includes": ["**/*.astro"],
 			"linter": {"rules": {"correctness": {"noUnusedImports": "off", "noUnusedVariables": "off"}}},

deploy/self-hosting/.env.example

@@ -3,12 +3,20 @@
 # A name absent from this file is one Compose does not forward, and it reaches a
 # service only through a Compose override file that adds it to that service's
 # environment. packages/config/src/__tests__/DeployEnvCoverage.test.ts fails when
-# a Compose edit forgets the matching line here.
+# a Compose edit forgets the matching line here. Compose expands this file from
+# top to bottom, so a line written with ${...} has to sit below every name it
+# reads.
 
 FLUXER_DOMAIN=chat.example.com
 FLUXER_PUBLIC_SCHEME=https
 FLUXER_PUBLIC_PORT=443
 
+# The three lines above are the address browsers use, and every endpoint the
+# services advertise carries the port from FLUXER_PUBLIC_PORT. They do not move
+# what the host publishes. FLUXER_HTTP_PORT and FLUXER_HTTPS_PORT further down
+# do that, and a non-default port needs the matching one set as well. Both
+# complete recipes are written out beside them.
+
 # How browsers reach this instance.
 #
 # Default: Fluxer binds 80 and 443 and gets its own Let's Encrypt certificate.
@@ -33,50 +41,71 @@ FLUXER_PUBLIC_PORT=443
 # address if it reaches Fluxer from a public IP.
 #FLUXER_EDGE_TRUSTED_PROXIES=private_ranges
 
-# The public origin browsers use, without a trailing slash. Derived from the three
-# values above and correct for the usual https-on-443 setup, so leave it alone
-# unless you serve Fluxer on a non-default port, where the port must appear here.
+# The origin browsers see, without a trailing slash. Leave it unset and each
+# service builds one from the three values at the top of this file. Set it and it
+# wins: every service reads the host, the scheme and the port out of it and
+# ignores those three names. Use it when browsers reach the instance on a host
+# FLUXER_DOMAIN does not name. It has to be a bare origin, a scheme and a host
+# and an optional port and nothing after them, or the services refuse to start.
+# It does not move the edge listener or the published ports either, so set the
+# publish below to the port written here.
 #FLUXER_PUBLIC_ORIGIN=https://chat.example.com
 
-# Overrides the address Fluxer's edge listens on. Honoured in the default mode
-# only: docker-compose.proxy.yml sets the literal :8080 and Compose lets the last
-# file win, so a value here is discarded under the proxy overlay with no warning.
-# Set it only for an unusual default-mode layout, such as serving several
-# hostnames or binding a non-default TLS port.
-#FLUXER_EDGE_SITE_ADDRESS=chat.example.com
+# Overrides the address the edge listens on inside its container. Compose builds
+# it from FLUXER_PUBLIC_SCHEME and FLUXER_DOMAIN with no port, and the edge keeps
+# its container ports at 80 and 443 whatever the public port is. Caddy matches a
+# site by host and ignores the port in the Host header, so a request arriving on
+# a non-default published port still lands on this site. Put a port in this value
+# only if you also publish that same container port below, or nothing will be
+# listening where the publish points. Honoured in the default mode only:
+# docker-compose.proxy.yml sets the literal :8080 and tunnel.compose.yml the
+# literal :80, and Compose lets the last file win, so a value here is discarded
+# under either overlay with no warning. Set it for an unusual default-mode
+# layout, such as serving several hostnames. Write the scheme into it: a bare
+# hostname means automatic HTTPS on 443 whatever FLUXER_PUBLIC_SCHEME says.
+#FLUXER_EDGE_SITE_ADDRESS=https://chat.example.com
 
 # The old name for the value above. It is read only when
 # FLUXER_EDGE_SITE_ADDRESS is unset, so an existing .env keeps the listener
 # it already had. Rename it to FLUXER_EDGE_SITE_ADDRESS at your convenience.
 #FLUXER_CADDY_SITE_ADDRESS=
 
-# FLUXER_PUBLIC_ORIGIN is the origin browsers see. It must carry the port
-# whenever FLUXER_PUBLIC_PORT is not the default for its scheme, because an
-# origin written with a default port never matches a browser Origin header.
-# Serving on any other port means setting all three, plus the published port
-# below, and pointing FLUXER_EDGE_SITE_ADDRESS at the same scheme and host.
-# Compose expands this file from top to bottom, so FLUXER_PUBLIC_ORIGIN has to
-# stay below the two values it reads. Above them it silently expands to a bare
-# host with a trailing colon.
-#FLUXER_PUBLIC_SCHEME=http
-#FLUXER_PUBLIC_PORT=19080
-#FLUXER_PUBLIC_ORIGIN=${FLUXER_PUBLIC_SCHEME}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT}
-#FLUXER_HTTP_PORT=19080
-
-# Ports Caddy publishes on the host. Caddy still listens on 80 and 443 inside
-# the container, so change only these when something else already owns the
-# standard ports or another proxy sits in front. Both take an optional bind
-# address in front of the port, and 127.0.0.1 keeps the publish off every
-# public interface. FLUXER_HTTPS_PORT moves the TCP and the UDP publish
-# together, because HTTP/3 needs both on the same port.
+# Host side of the edge's publishes, and the only two names that decide which
+# host ports Fluxer binds. The container side is fixed. Container 80 carries the
+# HTTP to HTTPS redirect and the Let's Encrypt HTTP challenge under an https
+# scheme, and the site itself under an http one. Container 443 carries the TLS
+# site. FLUXER_HTTPS_PORT moves the TCP and the UDP publish together, because
+# HTTP/3 needs both on the same port. Both take an optional bind address in front
+# of the port, and 127.0.0.1 keeps the publish off every public interface. Give
+# them different host ports: the same host port on both is two publishes of one
+# port and the edge refuses to start.
 #FLUXER_HTTP_PORT=80
 #FLUXER_HTTPS_PORT=443
 #FLUXER_HTTP_PORT=127.0.0.1:80
 #FLUXER_HTTPS_PORT=127.0.0.1:443
 
+# HTTPS on 8443, complete. Host 80 stays published and still answers the ACME
+# challenge. Let's Encrypt only ever connects to the public 80 or 443, so the
+# certificate is issued if a router in front forwards public 80 to this host and
+# is not issued otherwise. Serve your own certificate from the Caddyfile when it
+# cannot.
+#FLUXER_PUBLIC_PORT=8443
+#FLUXER_HTTPS_PORT=8443
+
+# Plain HTTP on 19080, complete. The port 80 publish moves to 19080, so nothing
+# binds host 80. Under an http scheme nothing listens on container 443, so the
+# last line parks that publish on loopback for a host that wants 443 for
+# something else. Drop it and 443 is published and idle, which is what earlier
+# releases did.
+#FLUXER_PUBLIC_SCHEME=http
+#FLUXER_PUBLIC_PORT=19080
+#FLUXER_HTTP_PORT=19080
+#FLUXER_HTTPS_PORT=127.0.0.1:443
+
 # A tunnel or another proxy in front of the stack needs no HTTPS publish at all.
 # tunnel.compose.yml ships beside this file and replaces Caddy's published ports
-# with a single loopback HTTP publish, so nothing binds 443. FLUXER_HTTP_PORT
+# with a single loopback HTTP publish, so nothing binds 443, and points the edge
+# at plain HTTP on that publish so it stops redirecting to https. FLUXER_HTTP_PORT
 # still moves that one publish. Set the line below and plain docker compose
 # commands pick the file up, or add it to your own -f flags if you pass any. The
 # file uses the !override tag, which needs Compose 2.24.4 or newer.
@@ -88,6 +117,60 @@ FLUXER_IMAGE_TAG=v1
 
 POSTGRES_PASSWORD=CHANGE_ME
 MEILI_MASTER_KEY=CHANGE_ME
+# The stack ships its own Postgres and its own object store, and points at both
+# by service name. Set these to run either one outside the stack. Leave them
+# unset and the bundled services are used. Taking a service out of the stack
+# means an upgrade skips the backup step that reaches into it, and backing that
+# store up belongs to whoever runs it.
+#FLUXER_POSTGRES_HOST=db.example.com
+#FLUXER_POSTGRES_PORT=5432
+#FLUXER_POSTGRES_DATABASE=fluxer
+#FLUXER_POSTGRES_USERNAME=fluxer
+#FLUXER_POSTGRES_SSL=true
+#FLUXER_S3_ENDPOINT=https://s3.eu-central-1.amazonaws.com
+#FLUXER_S3_PUBLIC_ENDPOINT=https://cdn.example.com
+#FLUXER_S3_REGION=eu-central-1
+#FLUXER_S3_FORCE_PATH_STYLE=false
+# Bucket names. The bundled object store creates whichever names these hold, so
+# the two stay in step. An object store outside the stack needs the buckets to
+# exist already.
+#FLUXER_S3_BUCKET_CDN=fluxer
+#FLUXER_S3_BUCKET_UPLOADS=fluxer-uploads
+#FLUXER_S3_BUCKET_DOWNLOADS=fluxer-downloads
+#FLUXER_S3_BUCKET_REPORTS=fluxer-reports
+#FLUXER_S3_BUCKET_HARVESTS=fluxer-harvests
+
+# The rest of the bundled services, pointed somewhere else the same way. Leave a
+# line unset and the service in the stack is used. Taking a service out of the
+# stack goes in an override file listed in COMPOSE_FILE, because an upgrade
+# replaces docker-compose.yml.
+#FLUXER_KV_URL=redis://cache.example.com:6379/0
+#FLUXER_NATS_URL=nats://mq.example.com:4222
+#FLUXER_NATS_JETSTREAM_URL=nats://mq.example.com:4222
+#FLUXER_SVC_NATS_URL=nats://mq.example.com:4222
+#FLUXER_SEARCH_URL=https://search.example.com
+#FLUXER_LIVEKIT_INTERNAL_URL=http://livekit.example.com:7880
+
+# Voice off. The livekit service still runs until an override file takes it out.
+#FLUXER_LIVEKIT_ENABLED=false
+
+# Optional systems, each off unless the instance is configured for it.
+#FLUXER_SMS_ENABLED=false
+#FLUXER_STRIPE_ENABLED=false
+#FLUXER_NCMEC_ENABLED=false
+#FLUXER_CLAMAV_ENABLED=false
+
+# The client address. Set the header name a proxy in front actually writes, and
+# turn the trust off when nothing sits in front, because a trusted header an
+# attacker can set is a spoofed client address.
+#FLUXER_CLIENT_IP_HEADER_NAME=cf-connecting-ip
+#FLUXER_TRUST_CLIENT_IP_HEADER=true
+
+# How much the services write. trace, debug, info, warn, error or fatal. Every
+# service names the object storage endpoint and its addressing at info on start,
+# so a bucket that answers 404 is visible without raising this.
+#LOG_LEVEL=debug
+
 FLUXER_S3_ACCESS_KEY=fluxer
 FLUXER_S3_SECRET_KEY=CHANGE_ME
 
@@ -100,6 +183,12 @@ FLUXER_MEDIA_PROXY_UPLOAD_RELAY_SECRET_BASE64=CHANGE_ME
 FLUXER_ADMIN_SECRET_KEY_BASE=CHANGE_ME
 FLUXER_ADMIN_OAUTH_CLIENT_SECRET=CHANGE_ME
 
+# The token every service sends to NATS. The bundled NATS runs without
+# authentication, so this stays empty unless a Compose override points the stack
+# at an external NATS that requires a token. Compose forwards the name to every
+# container that connects.
+#FLUXER_NATS_AUTH_TOKEN=
+
 FLUXER_VAPID_PUBLIC_KEY=CHANGE_ME
 FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 
@@ -147,9 +236,11 @@ FLUXER_VAPID_PRIVATE_KEY=CHANGE_ME
 LIVEKIT_API_KEY=fluxer
 LIVEKIT_API_SECRET=CHANGE_ME
 
-# The URL browsers use for voice signalling. Derived from FLUXER_PUBLIC_SCHEME,
-# FLUXER_DOMAIN and FLUXER_PUBLIC_PORT as wss://host[:port]/livekit when empty.
-# Set it only when LiveKit is served from another host.
+# The URL browsers use for voice signalling. Compose builds it from
+# FLUXER_PUBLIC_ORIGIN, or from FLUXER_PUBLIC_SCHEME, FLUXER_DOMAIN and
+# FLUXER_PUBLIC_PORT, as that origin followed by /livekit. The client rewrites a
+# leading http to ws itself. Set it only when LiveKit is served from another
+# host.
 #FLUXER_LIVEKIT_URL=
 
 # Media ports. LiveKit advertises these in ICE candidates, so the host must
@@ -157,6 +248,16 @@ LIVEKIT_API_SECRET=CHANGE_ME
 #FLUXER_LIVEKIT_TCP_PORT=7881
 #FLUXER_LIVEKIT_UDP_PORT=7882
 
+# LiveKit finds the address browsers dial by asking a STUN server. A host that
+# cannot reach one over UDP stops with "could not resolve external IP", and the
+# address is then set by hand: put it in FLUXER_LIVEKIT_NODE_IP and set
+# FLUXER_LIVEKIT_USE_EXTERNAL_IP to false. Point the two STUN entries at another
+# server to keep the lookup and leave Google out of it.
+#FLUXER_LIVEKIT_USE_EXTERNAL_IP=false
+#FLUXER_LIVEKIT_NODE_IP=203.0.113.10
+#FLUXER_LIVEKIT_STUN_PRIMARY=stun.l.google.com:19302
+#FLUXER_LIVEKIT_STUN_SECONDARY=stun1.l.google.com:19302
+
 FLUXER_KLIPY_API_KEY=
 
 FLUXER_EMAIL_ENABLED=false
@@ -178,7 +279,7 @@ FLUXER_CAPTCHA_TURNSTILE_SITE_KEY=
 FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY=
 FLUXER_DISCOVERY_ENABLED=true
 
-# Container memory. The 25 limits sum to 16.75 GiB, which is a sum of ceilings and
+# Container memory. The 25 limits sum to 18.25 GiB, which is a sum of ceilings and
 # not an allocation, so the defaults fit a host with 8 GB and are sized for 16 GB.
 # The four reservations are cgroup memory.low, which biases the kernel away from
 # reclaiming from the services whose death takes the whole instance down. They do
@@ -189,7 +290,7 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_VALKEY_MEMORY_LIMIT=256mb
 #FLUXER_NATS_MEMORY_LIMIT=256mb
 #FLUXER_MEILISEARCH_MEMORY_LIMIT=768mb
-#FLUXER_SEAWEEDFS_MEMORY_LIMIT=512mb
+#FLUXER_SEAWEEDFS_MEMORY_LIMIT=2gb
 #FLUXER_SEAWEEDFS_INIT_MEMORY_LIMIT=128mb
 #FLUXER_LIVEKIT_MEMORY_LIMIT=512mb
 #FLUXER_API_MEMORY_LIMIT=2560mb
@@ -217,6 +318,14 @@ FLUXER_DISCOVERY_ENABLED=true
 # which is the container ceiling the indexer shares with the search process.
 #FLUXER_MEILISEARCH_MAX_INDEXING_MEMORY=384mb
 
+# SeaweedFS heap ceiling. Go collects against this value instead of against the
+# container limit, which it cannot see, so without it an upload burst grows the
+# heap past FLUXER_SEAWEEDFS_MEMORY_LIMIT and the kernel OOM-kills the container
+# mid-upload (exit 137). Keep it near three quarters of that limit, and raise both
+# together: the peak is the parts of one upload in flight at once, which is 25 MB
+# times 20 for a 500 MB attachment.
+#FLUXER_SEAWEEDFS_GOMEMLIMIT=1536MiB
+
 # Node sizes its own heap from the container memory limit by default, at roughly
 # 55 percent of it, which always leaves room for the buffers and stacks that live
 # outside the heap. Leave these unset unless you have a reason to pin the value.
@@ -256,10 +365,16 @@ FLUXER_DISCOVERY_ENABLED=true
 #FLUXER_ERLANG_SCHEDULERS_MAX=16
 
 # In-flight request ceiling for the four services Compose forwards it to: the
-# users and messages routers and their shards. The Rust built-in defaults are 192
-# for messages, 320 for snowflakes and 64 elsewhere, and they govern every service
-# Compose does not forward this to.
-#FLUXER_SVC_MAX_CONCURRENT_REQUESTS=20
+# users and messages routers and their shards. Leave it unset and each service
+# uses its own built-in default, which is what the numbers below describe. Set it
+# and the one value replaces the built-in default on all four, so size it for the
+# busiest of them rather than for the smallest. The built-in defaults are 192 for
+# messages, 320 for snowflakes and 64 elsewhere, and they govern every service
+# Compose does not forward this to. A router holds a slot for the whole round
+# trip to its shard, so this is a ceiling on requests in flight at once and not a
+# rate: too low a value does not slow requests down, it rejects them, and the api
+# turns that rejection into a 503.
+#FLUXER_SVC_MAX_CONCURRENT_REQUESTS=192
 
 # The api and the Rust services name their fixed Postgres statement shapes so the
 # server can reuse their plans. Named prepared statements require a session that

deploy/self-hosting/Caddyfile

@@ -13,73 +13,51 @@
 	}
 
 	handle_path /api/* {
-		reverse_proxy api:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy api:8080
 	}
 
 	handle /gateway {
 		rewrite * /
-		reverse_proxy gateway:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy gateway:8080
 	}
 
 	handle_path /gateway/* {
-		reverse_proxy gateway:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy gateway:8080
 	}
 
 	handle_path /media/* {
-		reverse_proxy media-proxy:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy media-proxy:8080
 	}
 
 	handle_path /livekit/* {
-		reverse_proxy livekit:7880 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy livekit:7880
 	}
 
 	handle /admin {
 		rewrite * /
-		reverse_proxy admin:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy admin:8080
 	}
 
 	handle_path /admin/* {
-		reverse_proxy admin:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy admin:8080
 	}
 
 	@staticAssets path /web/* /emoji/* /libs/* /avatars/* /badges/* /desktop/* /embeds/*
 	handle @staticAssets {
-		reverse_proxy static-proxy:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy static-proxy:8080
 	}
 
 	handle /.well-known/fluxer {
-		reverse_proxy api:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy api:8080
 	}
 
 	handle {
-		reverse_proxy app-proxy:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy app-proxy:8080
 	}
 }
 
 :8088 {
 	handle /.well-known/fluxer {
-		reverse_proxy api:8080 {
-			header_up X-Forwarded-For {client_ip}
-		}
+		reverse_proxy api:8080
 	}
 }

deploy/self-hosting/docker-compose.yml

@@ -2,60 +2,63 @@ name: fluxer
 
 x-fluxer-postgres-env: &fluxer-postgres-env
   FLUXER_DATABASE_BACKEND: postgres
-  FLUXER_POSTGRES_HOST: postgres
-  FLUXER_POSTGRES_PORT: "5432"
-  FLUXER_POSTGRES_DATABASE: fluxer
-  FLUXER_POSTGRES_USERNAME: fluxer
+  FLUXER_POSTGRES_HOST: ${FLUXER_POSTGRES_HOST:-postgres}
+  FLUXER_POSTGRES_PORT: "${FLUXER_POSTGRES_PORT:-5432}"
+  FLUXER_POSTGRES_DATABASE: ${FLUXER_POSTGRES_DATABASE:-fluxer}
+  FLUXER_POSTGRES_USERNAME: ${FLUXER_POSTGRES_USERNAME:-fluxer}
   FLUXER_POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set POSTGRES_PASSWORD in .env}
-  FLUXER_POSTGRES_SSL: "false"
+  FLUXER_POSTGRES_SSL: "${FLUXER_POSTGRES_SSL:-false}"
   FLUXER_POSTGRES_PREPARED_STATEMENTS: ${FLUXER_POSTGRES_PREPARED_STATEMENTS:-true}
 
 x-fluxer-env: &fluxer-env
   <<: *fluxer-postgres-env
   FLUXER_ENV: production
   NODE_ENV: production
+  LOG_LEVEL: ${LOG_LEVEL:-info}
   FLUXER_SELF_HOSTED: "true"
   FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
   FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
   FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
-  FLUXER_TRUST_CLIENT_IP_HEADER: "true"
-  FLUXER_CLIENT_IP_HEADER_NAME: x-forwarded-for
+  FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
+  FLUXER_TRUST_CLIENT_IP_HEADER: "${FLUXER_TRUST_CLIENT_IP_HEADER:-true}"
+  FLUXER_CLIENT_IP_HEADER_NAME: ${FLUXER_CLIENT_IP_HEADER_NAME:-x-forwarded-for}
   FLUXER_API_HEADERS_TIMEOUT_MS: ${FLUXER_API_HEADERS_TIMEOUT_MS:-30000}
   FLUXER_API_REQUEST_TIMEOUT_MS: ${FLUXER_API_REQUEST_TIMEOUT_MS:-120000}
 
-  FLUXER_KV_URL: redis://valkey:6379/0
-  FLUXER_NATS_URL: nats://nats:4222
-  FLUXER_NATS_JETSTREAM_URL: nats://nats:4222
-  FLUXER_SVC_NATS_URL: nats://nats:4222
+  FLUXER_KV_URL: ${FLUXER_KV_URL:-redis://valkey:6379/0}
+  FLUXER_NATS_URL: ${FLUXER_NATS_URL:-nats://nats:4222}
+  FLUXER_NATS_JETSTREAM_URL: ${FLUXER_NATS_JETSTREAM_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
+  FLUXER_NATS_AUTH_TOKEN: ${FLUXER_NATS_AUTH_TOKEN:-}
+  FLUXER_SVC_NATS_URL: ${FLUXER_SVC_NATS_URL:-${FLUXER_NATS_URL:-nats://nats:4222}}
   FLUXER_SVC_SHARD_COUNT: "1"
 
   FLUXER_SEARCH_ENGINE: meilisearch
-  FLUXER_SEARCH_URL: http://meilisearch:7700
+  FLUXER_SEARCH_URL: ${FLUXER_SEARCH_URL:-http://meilisearch:7700}
   FLUXER_SEARCH_API_KEY: ${MEILI_MASTER_KEY:?set MEILI_MASTER_KEY in .env}
 
-  FLUXER_S3_ENDPOINT: http://seaweedfs:8333
-  FLUXER_S3_PUBLIC_ENDPOINT: http://seaweedfs:8333
-  FLUXER_S3_REGION: us-east-1
+  FLUXER_S3_ENDPOINT: ${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}
+  FLUXER_S3_PUBLIC_ENDPOINT: ${FLUXER_S3_PUBLIC_ENDPOINT:-${FLUXER_S3_ENDPOINT:-http://seaweedfs:8333}}
+  FLUXER_S3_REGION: ${FLUXER_S3_REGION:-us-east-1}
   FLUXER_S3_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
   FLUXER_S3_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
-  FLUXER_S3_FORCE_PATH_STYLE: "true"
-  FLUXER_S3_BUCKET_CDN: fluxer
-  FLUXER_S3_BUCKET_UPLOADS: fluxer-uploads
-  FLUXER_S3_BUCKET_DOWNLOADS: fluxer-downloads
-  FLUXER_S3_BUCKET_REPORTS: fluxer-reports
-  FLUXER_S3_BUCKET_HARVESTS: fluxer-harvests
+  FLUXER_S3_FORCE_PATH_STYLE: "${FLUXER_S3_FORCE_PATH_STYLE:-true}"
+  FLUXER_S3_BUCKET_CDN: ${FLUXER_S3_BUCKET_CDN:-fluxer}
+  FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
+  FLUXER_S3_BUCKET_DOWNLOADS: ${FLUXER_S3_BUCKET_DOWNLOADS:-fluxer-downloads}
+  FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
+  FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
   AWS_ACCESS_KEY_ID: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
   AWS_SECRET_ACCESS_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
-  AWS_DEFAULT_REGION: us-east-1
+  AWS_DEFAULT_REGION: ${FLUXER_S3_REGION:-us-east-1}
   AWS_EC2_METADATA_DISABLED: "true"
 
-  FLUXER_LIVEKIT_ENABLED: "true"
+  FLUXER_LIVEKIT_ENABLED: "${FLUXER_LIVEKIT_ENABLED:-true}"
   FLUXER_LIVEKIT_API_KEY: ${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}
   FLUXER_LIVEKIT_API_SECRET: ${LIVEKIT_API_SECRET:?set LIVEKIT_API_SECRET in .env}
-  FLUXER_LIVEKIT_INTERNAL_URL: http://livekit:7880
+  FLUXER_LIVEKIT_INTERNAL_URL: ${FLUXER_LIVEKIT_INTERNAL_URL:-http://livekit:7880}
   FLUXER_LIVEKIT_WEBHOOK_URL: http://api:8080/webhooks/livekit
   FLUXER_LIVEKIT_DEFAULT_REGION: '{"id":"default","name":"Default","emoji":"🌍","latitude":0,"longitude":0}'
-  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/livekit}
+  FLUXER_LIVEKIT_URL: ${FLUXER_LIVEKIT_URL:-${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}:${FLUXER_PUBLIC_PORT:-443}}/livekit}
 
   FLUXER_KLIPY_API_KEY: ${FLUXER_KLIPY_API_KEY:-}
 
@@ -70,16 +73,16 @@ x-fluxer-env: &fluxer-env
   FLUXER_EMAIL_SMTP_PASSWORD: ${FLUXER_EMAIL_SMTP_PASSWORD:-}
   FLUXER_EMAIL_SMTP_SECURE: ${FLUXER_EMAIL_SMTP_SECURE:-true}
 
-  FLUXER_SMS_ENABLED: "false"
+  FLUXER_SMS_ENABLED: "${FLUXER_SMS_ENABLED:-false}"
   FLUXER_CAPTCHA_ENABLED: ${FLUXER_CAPTCHA_ENABLED:-false}
   FLUXER_CAPTCHA_PROVIDER: ${FLUXER_CAPTCHA_PROVIDER:-none}
   FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SITE_KEY:-}
   FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY: ${FLUXER_CAPTCHA_HCAPTCHA_SECRET_KEY:-}
   FLUXER_CAPTCHA_TURNSTILE_SITE_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SITE_KEY:-}
   FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY: ${FLUXER_CAPTCHA_TURNSTILE_SECRET_KEY:-}
-  FLUXER_STRIPE_ENABLED: "false"
-  FLUXER_NCMEC_ENABLED: "false"
-  FLUXER_CLAMAV_ENABLED: "false"
+  FLUXER_STRIPE_ENABLED: "${FLUXER_STRIPE_ENABLED:-false}"
+  FLUXER_NCMEC_ENABLED: "${FLUXER_NCMEC_ENABLED:-false}"
+  FLUXER_CLAMAV_ENABLED: "${FLUXER_CLAMAV_ENABLED:-false}"
   FLUXER_DISCOVERY_ENABLED: ${FLUXER_DISCOVERY_ENABLED:-true}
 
   FLUXER_SUDO_MODE_SECRET: ${FLUXER_SUDO_MODE_SECRET:?set FLUXER_SUDO_MODE_SECRET in .env}
@@ -131,7 +134,7 @@ services:
       - "${FLUXER_HTTPS_PORT:-443}:443"
       - "${FLUXER_HTTPS_PORT:-443}:443/udp"
     environment:
-      FLUXER_EDGE_SITE_ADDRESS: ${FLUXER_EDGE_SITE_ADDRESS:-${FLUXER_CADDY_SITE_ADDRESS:-${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}}}
+      FLUXER_EDGE_SITE_ADDRESS: ${FLUXER_EDGE_SITE_ADDRESS:-${FLUXER_CADDY_SITE_ADDRESS:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}}}
       FLUXER_EDGE_TRUSTED_PROXIES: ${FLUXER_EDGE_TRUSTED_PROXIES:-private_ranges}
     volumes:
       - ./Caddyfile:/etc/caddy/Caddyfile:ro
@@ -258,9 +261,11 @@ services:
     deploy:
       resources:
         limits:
-          memory: ${FLUXER_SEAWEEDFS_MEMORY_LIMIT:-512mb}
+          memory: ${FLUXER_SEAWEEDFS_MEMORY_LIMIT:-2gb}
     restart: unless-stopped
     networks: [fluxer]
+    environment:
+      GOMEMLIMIT: ${FLUXER_SEAWEEDFS_GOMEMLIMIT:-1536MiB}
     command: ["server", "-s3", "-dir=/data"]
     volumes:
       - seaweedfs-data:/data
@@ -284,11 +289,16 @@ services:
     environment:
       FLUXER_S3_ACCESS_KEY: ${FLUXER_S3_ACCESS_KEY:?set FLUXER_S3_ACCESS_KEY in .env}
       FLUXER_S3_SECRET_KEY: ${FLUXER_S3_SECRET_KEY:?set FLUXER_S3_SECRET_KEY in .env}
+      FLUXER_S3_BUCKET_CDN: ${FLUXER_S3_BUCKET_CDN:-fluxer}
+      FLUXER_S3_BUCKET_UPLOADS: ${FLUXER_S3_BUCKET_UPLOADS:-fluxer-uploads}
+      FLUXER_S3_BUCKET_DOWNLOADS: ${FLUXER_S3_BUCKET_DOWNLOADS:-fluxer-downloads}
+      FLUXER_S3_BUCKET_REPORTS: ${FLUXER_S3_BUCKET_REPORTS:-fluxer-reports}
+      FLUXER_S3_BUCKET_HARVESTS: ${FLUXER_S3_BUCKET_HARVESTS:-fluxer-harvests}
     entrypoint:
       - /bin/sh
       - -c
       - >
-        buckets="fluxer fluxer-uploads fluxer-downloads fluxer-reports fluxer-harvests";
+        buckets="$$FLUXER_S3_BUCKET_CDN $$FLUXER_S3_BUCKET_UPLOADS $$FLUXER_S3_BUCKET_DOWNLOADS $$FLUXER_S3_BUCKET_REPORTS $$FLUXER_S3_BUCKET_HARVESTS";
         missing="$$buckets";
         for attempt in $$(seq 1 60); do
           if ! nc -z seaweedfs 9333 2>/dev/null; then
@@ -332,10 +342,11 @@ services:
         rtc:
           tcp_port: ${FLUXER_LIVEKIT_TCP_PORT:-7881}
           udp_port: ${FLUXER_LIVEKIT_UDP_PORT:-7882}
-          use_external_ip: true
+          use_external_ip: ${FLUXER_LIVEKIT_USE_EXTERNAL_IP:-true}
+          node_ip: "${FLUXER_LIVEKIT_NODE_IP:-}"
           stun_servers:
-            - stun.l.google.com:19302
-            - stun1.l.google.com:19302
+            - ${FLUXER_LIVEKIT_STUN_PRIMARY:-stun.l.google.com:19302}
+            - ${FLUXER_LIVEKIT_STUN_SECONDARY:-stun1.l.google.com:19302}
         webhook:
           api_key: ${LIVEKIT_API_KEY:?set LIVEKIT_API_KEY in .env}
           urls:
@@ -490,6 +501,10 @@ services:
     environment:
       FLUXER_APP_PROXY_HOST: 0.0.0.0
       FLUXER_APP_PROXY_PORT: "8080"
+      FLUXER_BASE_DOMAIN: ${FLUXER_DOMAIN:?set FLUXER_DOMAIN in .env}
+      FLUXER_PUBLIC_SCHEME: ${FLUXER_PUBLIC_SCHEME:-https}
+      FLUXER_PUBLIC_PORT: ${FLUXER_PUBLIC_PORT:-443}
+      FLUXER_PUBLIC_ORIGIN: ${FLUXER_PUBLIC_ORIGIN:-}
       DISCOVERY_UPSTREAM_URL: http://edge:8088/.well-known/fluxer
       PUBLIC_BOOTSTRAP_API_ENDPOINT: /api
       PUBLIC_BOOTSTRAP_API_PUBLIC_ENDPOINT: ${FLUXER_PUBLIC_ORIGIN:-${FLUXER_PUBLIC_SCHEME:-https}://${FLUXER_DOMAIN}}/api
@@ -550,7 +565,7 @@ services:
       <<: *fluxer-env
       FLUXER_SVC_NAME: users
       FLUXER_SVC_MODE: router
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-20}"
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
     healthcheck: *fluxer-svc-healthcheck
     depends_on:
       nats: {condition: service_healthy}
@@ -568,7 +583,7 @@ services:
       FLUXER_SVC_MODE: shard
       FLUXER_SVC_SHARD_ID: "0"
       FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-20}"
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
     healthcheck: *fluxer-svc-healthcheck
     depends_on:
       nats: {condition: service_healthy}
@@ -618,7 +633,7 @@ services:
       <<: *fluxer-env
       FLUXER_SVC_NAME: messages
       FLUXER_SVC_MODE: router
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-20}"
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
     healthcheck: *fluxer-svc-healthcheck
     depends_on:
       nats: {condition: service_healthy}
@@ -636,7 +651,7 @@ services:
       FLUXER_SVC_MODE: shard
       FLUXER_SVC_SHARD_ID: "0"
       FLUXER_POSTGRES_MAX_CONNECTIONS: "20"
-      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-20}"
+      FLUXER_SVC_MAX_CONCURRENT_REQUESTS: "${FLUXER_SVC_MAX_CONCURRENT_REQUESTS:-}"
     healthcheck: *fluxer-svc-healthcheck
     depends_on:
       nats: {condition: service_healthy}

deploy/self-hosting/tunnel.compose.yml

@@ -2,3 +2,5 @@ services:
   edge:
     ports: !override
       - "${FLUXER_HTTP_PORT:-127.0.0.1:80}:80"
+    environment:
+      FLUXER_EDGE_SITE_ADDRESS: ":80"

eslint.config.mjs

@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import reactGoogleTranslate from 'eslint-plugin-react-google-translate';
+import tseslint from 'typescript-eslint';
+
+export default [
+	{
+		ignores: [
+			'**/node_modules/**',
+			'**/dist/**',
+			'**/build/**',
+			'**/coverage/**',
+			'**/*.generated.*',
+			'fluxer_app/src/features/i18n/locales/*/messages.mjs',
+		],
+	},
+	{
+		files: ['fluxer_app/src/**/*.tsx'],
+		linterOptions: {
+			reportUnusedDisableDirectives: 'error',
+		},
+		languageOptions: {
+			parser: tseslint.parser,
+			parserOptions: {
+				project: './fluxer_app/tsconfig.json',
+				tsconfigRootDir: import.meta.dirname,
+			},
+		},
+		plugins: {'react-google-translate': reactGoogleTranslate},
+		rules: {
+			'react-google-translate/no-conditional-text-nodes-with-siblings': [
+				'error',
+				{ignoreParents: ['Trans', 'Plural', 'Select', 'SelectOrdinal']},
+			],
+			'react-google-translate/no-return-text-nodes': 'error',
+		},
+	},
+];

fluxer_admin/openapi-admin.json

@@ -2772,7 +2772,7 @@
 						"content": {"application/json": {"schema": {"$ref": "#/components/schemas/Error"}}}
 					}
 				},
-				"description": "Partially updates a guild. The permissions required are selected by the fields present in the body and are evaluated with all-of semantics: name requires GUILD_UPDATE_NAME, vanity_url_code requires GUILD_UPDATE_VANITY, new_owner_id requires GUILD_TRANSFER_OWNERSHIP, add_features and remove_features require GUILD_UPDATE_FEATURES, and fields together with every other setting requires GUILD_UPDATE_SETTINGS. A body carrying no field requires the wildcard permission. Every applied change is logged to the audit log.",
+				"description": "Partially updates a guild. The permissions required are selected by the fields present in the body and are evaluated with all-of semantics: name requires GUILD_UPDATE_NAME, vanity_url_code requires GUILD_UPDATE_VANITY, new_owner_id requires GUILD_TRANSFER_OWNERSHIP, add_features and remove_features require GUILD_UPDATE_FEATURES, and fields together with every other setting requires GUILD_UPDATE_SETTINGS. A body with no fields applies no change. Every applied change is logged to the audit log.",
 				"security": [{"adminApiKey": []}],
 				"parameters": [
 					{
@@ -9801,7 +9801,7 @@
 			},
 			"GuildFeatureSchema": {
 				"type": "string",
-				"description": "A guild feature flag Known values: ANIMATED_ICON, ANIMATED_BANNER, BANNER, CLONE_EMOJI_DISABLED, CLONE_STICKER_DISABLED, DETACHED_BANNER, INVITE_SPLASH, INVITES_DISABLED, RAID_DETECTED, TEXT_CHANNEL_FLEXIBLE_NAMES, HIDE_OWNER_CROWN, MORE_EMOJI, MORE_STICKERS, UNLIMITED_EMOJI, UNLIMITED_STICKERS, EXPRESSION_PURGE_ALLOWED, VANITY_URL, DISCOVERABLE, PARTNERED, VERIFIED, VIP_VOICE, VOICE_E2EE, UNAVAILABLE_FOR_EVERYONE, UNAVAILABLE_FOR_EVERYONE_BUT_STAFF, UNAVAILABLE_HIDDEN, VISIONARY, LARGE_GUILD_OVERRIDE, VERY_LARGE_GUILD (other values allowed)"
+				"description": "A guild feature flag Known values: ANIMATED_ICON, ANIMATED_BANNER, AUDIO_BITRATE_128_KBPS, AUDIO_BITRATE_256_KBPS, AUDIO_BITRATE_384_KBPS, BANNER, CLONE_EMOJI_DISABLED, CLONE_STICKER_DISABLED, DETACHED_BANNER, INVITE_SPLASH, INVITES_DISABLED, RAID_DETECTED, TEXT_CHANNEL_FLEXIBLE_NAMES, HIDE_OWNER_CROWN, MORE_EMOJI, MORE_STICKERS, UNLIMITED_EMOJI, UNLIMITED_STICKERS, EXPRESSION_PURGE_ALLOWED, VANITY_URL, DISCOVERABLE, PARTNERED, VERIFIED, VIP_VOICE, VOICE_E2EE, UNAVAILABLE_FOR_EVERYONE, UNAVAILABLE_FOR_EVERYONE_BUT_STAFF, UNAVAILABLE_HIDDEN, VISIONARY, LARGE_GUILD_OVERRIDE, VERY_LARGE_GUILD (other values allowed)"
 			},
 			"AddGuildMembersAdminBulkJobCreateRequest": {
 				"type": "object",
@@ -12287,14 +12287,7 @@
 					"max_concurrent_guild_starts": {"type": "integer", "minimum": 1, "maximum": 10000, "format": "int32"},
 					"gateway_dispatch_relay_shards": {"type": "integer", "minimum": 1, "maximum": 10000, "format": "int32"},
 					"gateway_dispatch_relay_max_queue": {"type": "integer", "minimum": 0, "maximum": 1000000, "format": "int32"},
-					"voice_e2ee_scope": {"enum": ["guild_feature_only", "platform_wide"], "type": "string"},
-					"voice_reconciliation_v3_percentage": {"type": "number", "minimum": 0, "maximum": 100},
-					"voice_reconciliation_v3_interval_ms": {
-						"type": "integer",
-						"minimum": 500,
-						"maximum": 60000,
-						"format": "int32"
-					}
+					"voice_e2ee_scope": {"enum": ["guild_feature_only", "platform_wide"], "type": "string"}
 				}
 			},
 			"InstanceConfigUpdateRequest": {
@@ -12534,14 +12527,7 @@
 					"max_concurrent_guild_starts": {"type": "integer", "minimum": 1, "maximum": 10000, "format": "int32"},
 					"gateway_dispatch_relay_shards": {"type": "integer", "minimum": 1, "maximum": 10000, "format": "int32"},
 					"gateway_dispatch_relay_max_queue": {"type": "integer", "minimum": 0, "maximum": 1000000, "format": "int32"},
-					"voice_e2ee_scope": {"enum": ["guild_feature_only", "platform_wide"], "type": "string"},
-					"voice_reconciliation_v3_percentage": {"type": "number", "minimum": 0, "maximum": 100},
-					"voice_reconciliation_v3_interval_ms": {
-						"type": "integer",
-						"minimum": 500,
-						"maximum": 60000,
-						"format": "int32"
-					}
+					"voice_e2ee_scope": {"enum": ["guild_feature_only", "platform_wide"], "type": "string"}
 				}
 			},
 			"BrandingAssetUploadRequest": {
@@ -12923,25 +12909,14 @@
 				]
 			},
 			"AdminReportListResponse": {
-				"oneOf": [
-					{
-						"type": "object",
-						"properties": {
-							"reports": {"type": "array", "items": {"$ref": "#/components/schemas/ReportAdminResponseSchema"}},
-							"total": {"type": "number"},
-							"offset": {"type": "number"},
-							"limit": {"type": "number"}
-						},
-						"required": ["reports", "total", "offset", "limit"]
-					},
-					{
-						"type": "object",
-						"properties": {
-							"reports": {"type": "array", "items": {"$ref": "#/components/schemas/ReportAdminResponseSchema"}}
-						},
-						"required": ["reports"]
-					}
-				]
+				"type": "object",
+				"properties": {
+					"reports": {"type": "array", "items": {"$ref": "#/components/schemas/ReportAdminResponseSchema"}},
+					"total": {"type": "number"},
+					"offset": {"type": "number"},
+					"limit": {"type": "number"}
+				},
+				"required": ["reports", "total", "offset", "limit"]
 			},
 			"ReportAdminResponseSchema": {
 				"type": "object",
@@ -13916,6 +13891,14 @@
 						"type": "number"
 					},
 					"is_active": {"type": "boolean", "description": "Whether the server is currently active"},
+					"soft_connection_limit": {
+						"description": "Connection count above which placement prefers another server, or null when the server has no limit",
+						"nullable": true,
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 2147483647,
+						"format": "int32"
+					},
 					"vip_only": {"type": "boolean", "description": "Whether this server is restricted to VIP users"},
 					"required_guild_features": {
 						"type": "array",
@@ -13953,6 +13936,7 @@
 					"latitude",
 					"longitude",
 					"is_active",
+					"soft_connection_limit",
 					"vip_only",
 					"required_guild_features",
 					"allowed_guild_ids",
@@ -14252,6 +14236,14 @@
 								"type": "number"
 							},
 							"is_active": {"type": "boolean", "description": "Whether the server is currently active"},
+							"soft_connection_limit": {
+								"description": "Connection count above which placement prefers another server, or null when the server has no limit",
+								"nullable": true,
+								"type": "integer",
+								"minimum": 1,
+								"maximum": 2147483647,
+								"format": "int32"
+							},
 							"vip_only": {"type": "boolean", "description": "Whether this server is restricted to VIP users"},
 							"required_guild_features": {
 								"type": "array",
@@ -14289,6 +14281,7 @@
 							"latitude",
 							"longitude",
 							"is_active",
+							"soft_connection_limit",
 							"vip_only",
 							"required_guild_features",
 							"allowed_guild_ids",
@@ -14324,6 +14317,14 @@
 						"type": "number"
 					},
 					"is_active": {"type": "boolean", "description": "Whether the server is currently active"},
+					"soft_connection_limit": {
+						"description": "Connection count above which placement prefers another server, or null for no limit",
+						"nullable": true,
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 2147483647,
+						"format": "int32"
+					},
 					"vip_only": {"type": "boolean", "description": "Whether this server is restricted to VIP users"},
 					"required_guild_features": {
 						"type": "array",
@@ -14381,6 +14382,14 @@
 								"type": "number"
 							},
 							"is_active": {"type": "boolean", "description": "Whether the server is currently active"},
+							"soft_connection_limit": {
+								"description": "Connection count above which placement prefers another server, or null when the server has no limit",
+								"nullable": true,
+								"type": "integer",
+								"minimum": 1,
+								"maximum": 2147483647,
+								"format": "int32"
+							},
 							"vip_only": {"type": "boolean", "description": "Whether this server is restricted to VIP users"},
 							"required_guild_features": {
 								"type": "array",
@@ -14418,6 +14427,7 @@
 							"latitude",
 							"longitude",
 							"is_active",
+							"soft_connection_limit",
 							"vip_only",
 							"required_guild_features",
 							"allowed_guild_ids",
@@ -14453,6 +14463,14 @@
 						"type": "number"
 					},
 					"is_active": {"type": "boolean", "description": "Whether the server is currently active"},
+					"soft_connection_limit": {
+						"description": "Connection count above which placement prefers another server, or null for no limit",
+						"nullable": true,
+						"type": "integer",
+						"minimum": 1,
+						"maximum": 2147483647,
+						"format": "int32"
+					},
 					"vip_only": {"type": "boolean", "description": "Whether this server is restricted to VIP users"},
 					"required_guild_features": {
 						"type": "array",

fluxer_admin/src/api/archives.rs

@@ -2,7 +2,7 @@
 
 use crate::api::generated::types as generated_types;
 
-use super::client::{AdminApiClient, ApiResult};
+use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{Archive, ArchiveDownloadUrlResponse, ListArchivesResponse};
 
 impl AdminApiClient {
@@ -45,16 +45,31 @@ impl AdminApiClient {
         include_expired: bool,
         requested_by: Option<&str>,
     ) -> ApiResult<ListArchivesResponse> {
-        let query_params = [
-            ("subject_type", subject_type),
-            ("subject_id", subject_id.unwrap_or_default()),
-            ("requested_by", requested_by.unwrap_or_default()),
-            (
-                "include_expired",
-                if include_expired { "true" } else { "false" },
-            ),
-        ];
-        self.get("/admin/archives", Some(&query_params)).await
+        let subject_id = subject_id.filter(|id| !id.is_empty());
+        let search_every_subject_type = subject_type == "all" && subject_id.is_some();
+        let subject_types: &[&str] = if search_every_subject_type {
+            &["user", "guild"]
+        } else {
+            std::slice::from_ref(&subject_type)
+        };
+        let mut archives = Vec::new();
+        for &subject_type in subject_types {
+            let query_params = [
+                ("subject_type", subject_type),
+                ("subject_id", subject_id.unwrap_or_default()),
+                ("requested_by", requested_by.unwrap_or_default()),
+                (
+                    "include_expired",
+                    if include_expired { "true" } else { "false" },
+                ),
+            ];
+            match self.get("/admin/archives", Some(&query_params)).await {
+                Ok(ListArchivesResponse { archives: page }) => archives.extend(page),
+                Err(ApiError::Http { status: 403, .. }) if search_every_subject_type => {}
+                Err(error) => return Err(error),
+            }
+        }
+        Ok(ListArchivesResponse { archives })
     }
 
     pub async fn get_archive_download_url(

fluxer_admin/src/api/search.rs

@@ -2,7 +2,7 @@
 
 use crate::api::generated::types as generated_types;
 
-use super::client::{AdminApiClient, ApiResult};
+use super::client::{AdminApiClient, ApiError, ApiResult};
 use super::types::{IndexRefreshStatusResponse, RefreshSearchIndexResponse};
 
 impl AdminApiClient {
@@ -32,6 +32,85 @@ impl AdminApiClient {
             .get_admin_search_index_refresh(job_id)
             .await
             .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        index_refresh_status(response.into_inner())
+    }
+}
+
+fn index_refresh_status(
+    response: generated_types::IndexRefreshStatusResponse,
+) -> ApiResult<IndexRefreshStatusResponse> {
+    match response {
+        generated_types::IndexRefreshStatusResponse::Variant0 { status } => {
+            Ok(IndexRefreshStatusResponse::NotFound {
+                status: status.to_string(),
+            })
+        }
+        generated_types::IndexRefreshStatusResponse::Variant1 {
+            status,
+            index_type,
+            total,
+            indexed,
+            started_at,
+            completed_at,
+            failed_at,
+            error,
+        } => Ok(IndexRefreshStatusResponse::Progress {
+            status: status.to_string(),
+            index_type: Some(index_type),
+            total: total
+                .map(|value| float_to_u64(value, "total"))
+                .transpose()?,
+            indexed: indexed
+                .map(|value| float_to_u64(value, "indexed"))
+                .transpose()?,
+            started_at,
+            completed_at,
+            failed_at,
+            error,
+        }),
+    }
+}
+
+fn float_to_u64(value: f64, field: &str) -> ApiResult<u64> {
+    crate::api::generated::number_to_u64(value, field).map_err(ApiError::Parse)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn maps_a_running_refresh_to_progress() {
+        let json = r#"{"status":"in_progress","index_type":"users","total":50000,"indexed":1200,"started_at":"2026-09-06T00:00:00Z"}"#;
+        let response: generated_types::IndexRefreshStatusResponse =
+            serde_json::from_str(json).unwrap();
+        match index_refresh_status(response).unwrap() {
+            IndexRefreshStatusResponse::Progress {
+                status,
+                index_type,
+                total,
+                indexed,
+                started_at,
+                ..
+            } => {
+                assert_eq!(status, "in_progress");
+                assert_eq!(index_type.as_deref(), Some("users"));
+                assert_eq!(total, Some(50_000));
+                assert_eq!(indexed, Some(1_200));
+                assert_eq!(started_at.as_deref(), Some("2026-09-06T00:00:00Z"));
+            }
+            other => panic!("expected a progress status, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn maps_a_missing_refresh_to_not_found() {
+        let json = r#"{"status":"not_found"}"#;
+        let response: generated_types::IndexRefreshStatusResponse =
+            serde_json::from_str(json).unwrap();
+        match index_refresh_status(response).unwrap() {
+            IndexRefreshStatusResponse::NotFound { status } => assert_eq!(status, "not_found"),
+            other => panic!("expected a not found status, got {other:?}"),
+        }
     }
 }

fluxer_admin/src/api/types/voice.rs

@@ -28,6 +28,7 @@ pub struct VoiceServer {
     pub latitude: Option<f64>,
     pub longitude: Option<f64>,
     pub is_active: Option<bool>,
+    pub soft_connection_limit: Option<i64>,
     pub vip_only: Option<bool>,
     #[serde(default)]
     pub required_guild_features: Vec<String>,

fluxer_admin/src/api/voice.rs

@@ -55,15 +55,13 @@ impl AdminApiClient {
         params: &serde_json::Value,
     ) -> ApiResult<UpdateVoiceRegionResponse> {
         let region_id = required_field(params, "id")?;
-        let body =
-            serde_json::from_value::<generated_types::UpdateVoiceRegionRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let response = self
-            .generated()
-            .update_admin_voice_region(&region_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        validate_against::<generated_types::UpdateVoiceRegionRequest>(params)?;
+        self.patch_with_reason(
+            &format!("/admin/voice/regions/{}", urlencoding::encode(&region_id)),
+            Some(params),
+            None,
+        )
+        .await
     }
 
     pub async fn delete_voice_region(&self, id: &str) -> ApiResult<DeleteVoiceResponse> {
@@ -102,6 +100,7 @@ impl AdminApiClient {
         params: &serde_json::Value,
     ) -> ApiResult<CreateVoiceServerResponse> {
         let region_id = required_field(params, "region_id")?;
+        paired_coordinates(params)?;
         let body =
             serde_json::from_value::<generated_types::CreateVoiceServerRequest>(params.clone())
                 .map_err(|e| ApiError::Parse(e.to_string()))?;
@@ -119,15 +118,18 @@ impl AdminApiClient {
     ) -> ApiResult<UpdateVoiceServerResponse> {
         let region_id = required_field(params, "region_id")?;
         let server_id = required_field(params, "server_id")?;
-        let body =
-            serde_json::from_value::<generated_types::UpdateVoiceServerRequest>(params.clone())
-                .map_err(|e| ApiError::Parse(e.to_string()))?;
-        let response = self
-            .generated()
-            .update_admin_voice_server(&region_id, &server_id, &body)
-            .await
-            .map_err(|e| self.generated_error(e))?;
-        self.generated_value(response.into_inner())
+        paired_coordinates(params)?;
+        validate_against::<generated_types::UpdateVoiceServerRequest>(params)?;
+        self.patch_with_reason(
+            &format!(
+                "/admin/voice/regions/{}/servers/{}",
+                urlencoding::encode(&region_id),
+                urlencoding::encode(&server_id)
+            ),
+            Some(params),
+            None,
+        )
+        .await
     }
 
     pub async fn delete_voice_server(
@@ -148,6 +150,23 @@ fn bool_param(value: bool) -> &'static str {
     if value { "true" } else { "false" }
 }
 
+fn validate_against<T: serde::de::DeserializeOwned>(params: &serde_json::Value) -> ApiResult<()> {
+    serde_json::from_value::<T>(params.clone())
+        .map(drop)
+        .map_err(|e| ApiError::Parse(e.to_string()))
+}
+
+fn paired_coordinates(params: &serde_json::Value) -> ApiResult<()> {
+    let has_coordinate = |field: &str| params.get(field).is_some_and(|value| !value.is_null());
+    if has_coordinate("latitude") == has_coordinate("longitude") {
+        Ok(())
+    } else {
+        Err(ApiError::Parse(
+            "latitude and longitude must both be set or both be left empty".to_owned(),
+        ))
+    }
+}
+
 fn required_field(params: &serde_json::Value, field: &str) -> ApiResult<String> {
     params
         .get(field)

fluxer_admin/src/config/mod.rs

@@ -129,6 +129,11 @@ impl AdminConfig {
     pub fn secure_cookies(&self) -> bool {
         self.admin_endpoint.starts_with("https://")
     }
+
+    pub fn admin_origin(&self) -> Option<String> {
+        let origin = url::Url::parse(&self.admin_endpoint).ok()?.origin();
+        origin.is_tuple().then(|| origin.ascii_serialization())
+    }
 }
 
 impl RuntimeEnv {
@@ -202,6 +207,7 @@ mod tests {
             unsafe { env::remove_var(name) };
         }
         unsafe { env::remove_var("FLUXER_PUBLIC_PORT") };
+        unsafe { env::remove_var("FLUXER_PUBLIC_ORIGIN") };
         unsafe { env::set_var("FLUXER_ADMIN_SECRET_KEY_BASE", "test-secret") };
         for (name, value) in vars {
             unsafe { env::set_var(name, value) };
@@ -350,7 +356,7 @@ mod tests {
             ("FLUXER_BASE_DOMAIN", "fluxer.example"),
             ("FLUXER_PUBLIC_PORT", "19080"),
             ("FLUXER_ADMIN_ENDPOINT", "http://fluxer.example/admin"),
-            ("FLUXER_APP_ENDPOINT", "http://fluxer.example:19080"),
+            ("FLUXER_APP_ENDPOINT", "http://fluxer.example"),
             ("FLUXER_MEDIA_ENDPOINT", "http://fluxer.example/media"),
             ("FLUXER_STATIC_CDN_ENDPOINT", "https://cdn.example.net"),
             (

fluxer_admin/src/middleware/csrf.rs

@@ -27,7 +27,6 @@ pub async fn csrf_protection(
 ) -> Response {
     let config = state.config();
     let secret = config.secret_key_base.clone();
-    let admin_endpoint = config.admin_endpoint.clone();
     let secure_cookies = config.secure_cookies();
 
     let user_id = request
@@ -50,7 +49,7 @@ pub async fn csrf_protection(
             .iter()
             .any(|suffix| path.ends_with(suffix));
         if !is_ignored {
-            if !is_same_site_request(&request, &admin_endpoint) {
+            if !is_same_site_request(&request, config.admin_origin().as_deref()) {
                 return StatusCode::FORBIDDEN.into_response();
             }
             let header_token = extract_csrf_header(&request);
@@ -167,7 +166,7 @@ async fn extract_csrf_from_form_body(
     Ok((request, token))
 }
 
-fn is_same_site_request(request: &Request, admin_endpoint: &str) -> bool {
+fn is_same_site_request(request: &Request, admin_origin: Option<&str>) -> bool {
     if let Some(site) = request
         .headers()
         .get("sec-fetch-site")
@@ -180,7 +179,7 @@ fn is_same_site_request(request: &Request, admin_endpoint: &str) -> bool {
         .get(header::ORIGIN)
         .and_then(|value| value.to_str().ok())
     {
-        Some(origin) => origin == admin_endpoint,
+        Some(origin) => admin_origin.is_some_and(|expected| origin == expected),
         None => true,
     }
 }
@@ -275,6 +274,98 @@ mod tests {
         );
     }
 
+    async fn action_status(admin_endpoint: &str, origin: &str) -> StatusCode {
+        let state = state_with_admin_endpoint(admin_endpoint);
+        let app = Router::new()
+            .route("/", get(|| async { "ok" }).post(|| async { "ok" }))
+            .layer(from_fn_with_state(state, csrf_protection));
+        let issued = app
+            .clone()
+            .oneshot(Request::builder().uri("/").body(Body::empty()).unwrap())
+            .await
+            .expect("router responds");
+        let cookie = issued
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .filter_map(|value| value.split(';').next())
+            .find(|pair| pair.contains("csrf_token=") && !pair.ends_with('='))
+            .expect("a csrf cookie is issued")
+            .to_owned();
+        let token = cookie.split_once('=').expect("a cookie value").1.to_owned();
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .method(Method::POST)
+                    .uri("/")
+                    .header(header::COOKIE, cookie.as_str())
+                    .header(header::ORIGIN, origin)
+                    .header(CSRF_HEADER_NAME, token.as_str())
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .expect("router responds");
+        response.status()
+    }
+
+    #[tokio::test]
+    async fn a_matching_origin_passes_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn a_matching_origin_on_a_non_default_port_passes_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://admin.example.test:19080",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+    }
+
+    #[tokio::test]
+    async fn a_foreign_origin_fails_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://evil.example.test:19080",
+        )
+        .await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn another_port_on_the_admin_host_fails_the_same_site_check() {
+        let status = action_status(
+            "https://admin.example.test:19080/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn an_unparseable_admin_endpoint_fails_closed() {
+        let status = action_status("not-an-endpoint", "https://admin.example.test").await;
+        assert_eq!(status, StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn an_explicit_default_port_matches_a_portless_origin() {
+        let status = action_status(
+            "https://admin.example.test:443/admin",
+            "https://admin.example.test",
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK);
+    }
+
     #[test]
     fn oauth2_callback_is_exempt() {
         let exempt = IGNORED_PATH_SUFFIXES

fluxer_admin/src/routes/message_actions.rs

@@ -251,7 +251,7 @@ pub(crate) async fn bulk_actions_post(
                 .bulk_add_guild_members(&guild_id, &user_ids, audit_log_reason.as_deref())
                 .await
         }
-        "bulk-schedule-user-deletion" => {
+        "bulk-schedule-user-deletion" | "bulk_delete_users" => {
             let user_ids = form.list_values_any(&["user_ids[]", "user_ids"]);
             let reason_code = form.parse_u32("reason_code").unwrap_or(2);
             let days = form.parse_u32("days_until_deletion").unwrap_or(14);
@@ -272,12 +272,6 @@ pub(crate) async fn bulk_actions_post(
                 .bulk_delete_user_messages(&user_ids, audit_log_reason.as_deref())
                 .await
         }
-        "bulk_delete_users" => {
-            let user_ids = form.list_values_any(&["user_ids[]", "user_ids"]);
-            client
-                .bulk_schedule_user_deletion(&user_ids, 0, 30, None, audit_log_reason.as_deref())
-                .await
-        }
         _ => {
             return flash::redirect_with_flash(
                 &format!("{base}/bulk-actions"),
@@ -302,7 +296,7 @@ pub(crate) async fn bulk_actions_post(
             tracing::warn!(%error, action, "admin API request failed: submit bulk action");
             flash::redirect_with_flash(
                 &format!("{base}/bulk-actions"),
-                FlashData::error("Failed to submit bulk action"),
+                FlashData::error(format!("Failed to submit bulk action: {error}")),
                 config.secure_cookies(),
             )
         }

fluxer_admin/src/routes/reports.rs

@@ -2,6 +2,7 @@
 
 use crate::{
     api::client::{AdminApiClient, ApiResultExt},
+    config::AdminConfig,
     middleware::{
         auth::AuthContext,
         csrf,
@@ -22,6 +23,8 @@ use axum::{
 };
 use serde::Deserialize;
 
+const MAX_REPORT_OFFSET: u32 = 10_000;
+
 #[derive(Deserialize)]
 struct ReportsQuery {
     q: Option<String>,
@@ -70,6 +73,14 @@ async fn reports_list(
     let page = query.page.unwrap_or(0);
     let limit = query.limit.unwrap_or(25).clamp(1, 200);
     let offset = page.saturating_mul(limit);
+    if offset > MAX_REPORT_OFFSET {
+        return reports_error_page(
+            config,
+            &auth.0,
+            "That page is out of range. The reports search returns at most the first 10000 reports, so narrow the filters and start again.",
+        );
+    }
+    let search_query = query.q.as_deref().and_then(clean_string);
     let (sort_by, sort_order) = decode_sort(query.sort.as_deref());
     let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
     let status = query.status.as_deref().and_then(|s| s.parse::<i32>().ok());
@@ -79,7 +90,7 @@ async fn reports_list(
         .and_then(|s| s.parse::<i32>().ok());
     let reports = client
         .search_reports(
-            query.q.as_deref(),
+            search_query.as_deref(),
             status,
             report_type,
             query.category.as_deref(),
@@ -102,7 +113,7 @@ async fn reports_list(
         &auth.0,
         reports.as_ref(),
         &templates::pages::reports_list::ReportFilters {
-            query: query.q.as_deref(),
+            query: search_query.as_deref(),
             status: query.status.as_deref(),
             report_type: query.report_type.as_deref(),
             category: query.category.as_deref(),
@@ -120,6 +131,18 @@ async fn reports_list(
     Html(markup.into_string()).into_response()
 }
 
+fn reports_error_page(config: &AdminConfig, auth: &AuthContext, message: &str) -> Response {
+    let markup = templates::layout::admin_layout(
+        config,
+        auth,
+        "Reports",
+        "reports",
+        None,
+        templates::components::error_display::error_alert(message),
+    );
+    Html(markup.into_string()).into_response()
+}
+
 async fn report_detail(
     State(state): State<AppState>,
     headers: HeaderMap,

fluxer_admin/src/routes/users.rs

@@ -2,7 +2,10 @@
 
 use crate::{
     acl,
-    api::client::{AdminApiClient, ApiResultExt},
+    api::{
+        client::{AdminApiClient, ApiResult, ApiResultExt},
+        types::AdminUser,
+    },
     middleware::{auth::AuthContext, csrf::CsrfToken, flash, htmx},
     routes::user_tabs,
     state::AppState,
@@ -18,6 +21,8 @@ use axum::{
 };
 use serde::Deserialize;
 
+const USER_ID_LOOKUP_BATCH: usize = 100;
+
 #[derive(Deserialize)]
 struct UserListQuery {
     q: Option<String>,
@@ -83,14 +88,10 @@ async fn users_list(
     let can_view_email = acl::has_permission(admin_acls, acl::USER_VIEW_EMAIL);
     let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
     let results = if params.has_id_lookup() {
-        let users = client
-            .lookup_users_by_ids(&params.requested_ids)
+        lookup_users_in_batches(&client, &params.requested_ids)
             .await
-            .map_err(
-                |error| tracing::warn!(%error, "admin API request failed: lookup users by ids"),
-            )
-            .unwrap_or_default();
-        Some((users, false))
+            .log_error("lookup users by ids")
+            .map(|users| (users, false))
     } else if params.has_search() {
         let offset = params.page.saturating_mul(params.limit);
         client
@@ -124,6 +125,17 @@ async fn users_list(
     Html(markup.into_string()).into_response()
 }
 
+async fn lookup_users_in_batches(
+    client: &AdminApiClient,
+    user_ids: &[String],
+) -> ApiResult<Vec<AdminUser>> {
+    let mut users = Vec::new();
+    for batch in user_ids.chunks(USER_ID_LOOKUP_BATCH) {
+        users.extend(client.lookup_users_by_ids(batch).await?);
+    }
+    Ok(users)
+}
+
 async fn user_detail(
     State(state): State<AppState>,
     headers: HeaderMap,

fluxer_admin/src/routes/voice.rs

@@ -4,7 +4,7 @@ use crate::{
     api::client::AdminApiClient,
     middleware::{auth::AuthContext, csrf},
     state::AppState,
-    templates,
+    templates::{self, pages::voice_servers::VoiceServersPageParams},
 };
 use axum::{
     Router,
@@ -13,12 +13,34 @@ use axum::{
     routing::get,
 };
 use serde::Deserialize;
+use std::collections::HashMap;
 
 #[derive(Deserialize)]
 struct VoiceServersQuery {
     region_id: Option<String>,
 }
 
+async fn load_server_connection_counts(client: &AdminApiClient) -> HashMap<String, i64> {
+    let response = match client.get_gateway_voice_state_counts().await {
+        Ok(response) => response,
+        Err(error) => {
+            tracing::warn!(%error, "admin API request failed: load voice state counts");
+            return HashMap::new();
+        }
+    };
+    let Some(servers) = response.data.get("servers").and_then(|v| v.as_array()) else {
+        return HashMap::new();
+    };
+    servers
+        .iter()
+        .filter_map(|entry| {
+            let server_id = entry.get("server_id")?.as_str()?.to_owned();
+            let count = entry.get("voice_state_count")?.as_i64()?;
+            Some((server_id, count))
+        })
+        .collect()
+}
+
 pub fn router() -> Router<AppState> {
     Router::new()
         .route(
@@ -79,17 +101,21 @@ async fn voice_servers_page(
             let markup = templates::pages::voice_servers::voice_servers_page(
                 config,
                 &auth.0,
-                None,
-                None,
-                None,
-                None,
-                &csrf_token,
+                &VoiceServersPageParams {
+                    region_id: None,
+                    region_name: None,
+                    servers: None,
+                    connection_counts: &HashMap::new(),
+                    error: None,
+                    csrf_token: &csrf_token,
+                },
             );
             return Html(markup.into_string()).into_response();
         }
     };
 
     let client = AdminApiClient::new(state.http_client(), config, &auth.0.session);
+    let connection_counts = load_server_connection_counts(&client).await;
 
     let region_name = match client.get_voice_region(region_id, false).await {
         Ok(resp) => resp
@@ -107,11 +133,14 @@ async fn voice_servers_page(
             let markup = templates::pages::voice_servers::voice_servers_page(
                 config,
                 &auth.0,
-                Some(region_id),
-                Some(&region_name),
-                Some(&resp.servers),
-                None,
-                &csrf_token,
+                &VoiceServersPageParams {
+                    region_id: Some(region_id),
+                    region_name: Some(&region_name),
+                    servers: Some(&resp.servers),
+                    connection_counts: &connection_counts,
+                    error: None,
+                    csrf_token: &csrf_token,
+                },
             );
             Html(markup.into_string()).into_response()
         }
@@ -120,11 +149,14 @@ async fn voice_servers_page(
             let markup = templates::pages::voice_servers::voice_servers_page(
                 config,
                 &auth.0,
-                Some(region_id),
-                Some(&region_name),
-                None,
-                Some(&msg),
-                &csrf_token,
+                &VoiceServersPageParams {
+                    region_id: Some(region_id),
+                    region_name: Some(&region_name),
+                    servers: None,
+                    connection_counts: &connection_counts,
+                    error: Some(&msg),
+                    csrf_token: &csrf_token,
+                },
             );
             Html(markup.into_string()).into_response()
         }

fluxer_admin/src/routes/voice_actions.rs

@@ -49,19 +49,26 @@ pub(crate) fn build_region_body(form: &MultiValueForm) -> serde_json::Value {
     }
     body.insert("is_default".into(), form.bool_value("is_default").into());
     body.insert("vip_only".into(), form.bool_value("vip_only").into());
-    body.insert(
-        "required_guild_features".into(),
-        form.list_values_any(&["required_guild_features[]", "required_guild_features"])
-            .into(),
-    );
-    body.insert(
-        "allowed_guild_ids".into(),
-        form.list_values_any(&["allowed_guild_ids[]", "allowed_guild_ids"])
-            .into(),
-    );
+    insert_submitted_list(&mut body, form, "required_guild_features");
+    insert_submitted_list(&mut body, form, "allowed_guild_ids");
     serde_json::Value::Object(body)
 }
 
+fn insert_submitted_list(
+    body: &mut serde_json::Map<String, serde_json::Value>,
+    form: &MultiValueForm,
+    field: &str,
+) {
+    let repeated = format!("{field}[]");
+    if !form.contains_key(&repeated) && !form.contains_key(field) {
+        return;
+    }
+    body.insert(
+        field.to_owned(),
+        form.list_values_any(&[repeated.as_str(), field]).into(),
+    );
+}
+
 pub(crate) fn build_server_body(form: &MultiValueForm) -> serde_json::Value {
     let mut body = serde_json::Map::new();
     if let Some(v) = form.clean("region_id") {
@@ -92,17 +99,19 @@ pub(crate) fn build_server_body(form: &MultiValueForm) -> serde_json::Value {
         body.insert("longitude".into(), lng.into());
     }
     body.insert("is_active".into(), form.bool_value("is_active").into());
+    if let Some(raw) = form.first("soft_connection_limit") {
+        let trimmed = raw.trim();
+        if trimmed.is_empty() {
+            body.insert("soft_connection_limit".into(), serde_json::Value::Null);
+        } else if let Ok(limit) = trimmed.parse::<i64>()
+            && limit > 0
+        {
+            body.insert("soft_connection_limit".into(), limit.into());
+        }
+    }
     body.insert("vip_only".into(), form.bool_value("vip_only").into());
-    body.insert(
-        "required_guild_features".into(),
-        form.list_values_any(&["required_guild_features[]", "required_guild_features"])
-            .into(),
-    );
-    body.insert(
-        "allowed_guild_ids".into(),
-        form.list_values_any(&["allowed_guild_ids[]", "allowed_guild_ids"])
-            .into(),
-    );
+    insert_submitted_list(&mut body, form, "required_guild_features");
+    insert_submitted_list(&mut body, form, "allowed_guild_ids");
     serde_json::Value::Object(body)
 }
 
@@ -255,6 +264,86 @@ mod tests {
         assert_eq!(body["allowed_guild_ids"], serde_json::json!(["1", "2"]));
     }
 
+    #[test]
+    fn build_server_body_clears_restriction_lists_the_form_submitted_empty() {
+        let form = MultiValueForm::parse(
+            b"region_id=us-east&server_id=s1&required_guild_features=&allowed_guild_ids=",
+        );
+        let body = build_server_body(&form);
+        assert_eq!(body["required_guild_features"], serde_json::json!([]));
+        assert_eq!(body["allowed_guild_ids"], serde_json::json!([]));
+    }
+
+    #[test]
+    fn build_server_body_leaves_restriction_lists_alone_when_the_form_omits_them() {
+        let form = MultiValueForm::parse(
+            b"region_id=us-east&server_id=s1&endpoint=wss%3A%2F%2Fvoice.example&is_active=false&vip_only=true",
+        );
+        let body = build_server_body(&form);
+        let object = body.as_object().unwrap();
+        assert!(!object.contains_key("required_guild_features"));
+        assert!(!object.contains_key("allowed_guild_ids"));
+        assert_eq!(body["is_active"], serde_json::json!(false));
+    }
+
+    #[test]
+    fn build_region_body_clears_restriction_lists_the_form_submitted_empty() {
+        let form = MultiValueForm::parse(b"id=us-east&required_guild_features=&allowed_guild_ids=");
+        let body = build_region_body(&form);
+        assert_eq!(body["required_guild_features"], serde_json::json!([]));
+        assert_eq!(body["allowed_guild_ids"], serde_json::json!([]));
+    }
+
+    #[test]
+    fn build_region_body_leaves_restriction_lists_alone_when_the_form_omits_them() {
+        let form = MultiValueForm::parse(b"id=us-east&name=US%20East");
+        let body = build_region_body(&form);
+        let object = body.as_object().unwrap();
+        assert!(!object.contains_key("required_guild_features"));
+        assert!(!object.contains_key("allowed_guild_ids"));
+    }
+
+    #[test]
+    fn build_server_body_sets_soft_connection_limit_from_a_positive_value() {
+        let form =
+            MultiValueForm::parse(b"region_id=us-east&server_id=s1&soft_connection_limit=250");
+        let body = build_server_body(&form);
+        assert_eq!(body["soft_connection_limit"], serde_json::json!(250));
+    }
+
+    #[test]
+    fn build_server_body_clears_soft_connection_limit_when_the_field_is_empty() {
+        let form = MultiValueForm::parse(b"region_id=us-east&server_id=s1&soft_connection_limit=");
+        let body = build_server_body(&form);
+        assert_eq!(body["soft_connection_limit"], serde_json::Value::Null);
+    }
+
+    #[test]
+    fn build_server_body_omits_soft_connection_limit_when_the_field_is_absent_or_invalid() {
+        let absent = MultiValueForm::parse(b"region_id=us-east&server_id=s1&is_active=true");
+        assert!(
+            !build_server_body(&absent)
+                .as_object()
+                .unwrap()
+                .contains_key("soft_connection_limit")
+        );
+        let invalid =
+            MultiValueForm::parse(b"region_id=us-east&server_id=s1&soft_connection_limit=abc");
+        assert!(
+            !build_server_body(&invalid)
+                .as_object()
+                .unwrap()
+                .contains_key("soft_connection_limit")
+        );
+        let zero = MultiValueForm::parse(b"region_id=us-east&server_id=s1&soft_connection_limit=0");
+        assert!(
+            !build_server_body(&zero)
+                .as_object()
+                .unwrap()
+                .contains_key("soft_connection_limit")
+        );
+    }
+
     #[test]
     fn build_server_body_preserves_single_and_repeated_values() {
         let form = MultiValueForm::parse(

fluxer_admin/src/templates/pages/bulk_actions.rs

@@ -147,6 +147,9 @@ const SUSPICIOUS_ACTIVITY_FLAGS: &[&str] = &[
 const GUILD_FEATURES: &[&str] = &[
     "ANIMATED_ICON",
     "ANIMATED_BANNER",
+    "AUDIO_BITRATE_128_KBPS",
+    "AUDIO_BITRATE_256_KBPS",
+    "AUDIO_BITRATE_384_KBPS",
     "BANNER",
     "CLONE_EMOJI_DISABLED",
     "CLONE_STICKER_DISABLED",

fluxer_admin/src/templates/pages/guild_detail_tabs/features.rs

@@ -14,6 +14,9 @@ use maud::{Markup, html};
 const GUILD_FEATURES: &[&str] = &[
     "ANIMATED_ICON",
     "ANIMATED_BANNER",
+    "AUDIO_BITRATE_128_KBPS",
+    "AUDIO_BITRATE_256_KBPS",
+    "AUDIO_BITRATE_384_KBPS",
     "BANNER",
     "CLONE_EMOJI_DISABLED",
     "CLONE_STICKER_DISABLED",

fluxer_admin/src/templates/pages/user_detail_tabs/overview.rs

@@ -560,6 +560,8 @@ fn traits_form(
     }
 }
 
+const DERIVED_TRAITS: [&str; 1] = ["premium"];
+
 fn parse_trait_definitions(limit_config: Option<&LimitConfigResponse>) -> Vec<&str> {
     limit_config
         .map(|response| {
@@ -569,6 +571,7 @@ fn parse_trait_definitions(limit_config: Option<&LimitConfigResponse>) -> Vec<&s
                 .iter()
                 .map(|value| value.trim())
                 .filter(|value| !value.is_empty())
+                .filter(|value| !DERIVED_TRAITS.contains(value))
                 .collect()
         })
         .unwrap_or_default()
@@ -579,5 +582,6 @@ fn custom_traits<'a>(user: &'a AdminUser, trait_definitions: &[&str]) -> Vec<&'a
         .iter()
         .map(String::as_str)
         .filter(|trait_name| !trait_definitions.contains(trait_name))
+        .filter(|trait_name| !DERIVED_TRAITS.contains(trait_name))
         .collect()
 }

fluxer_admin/src/templates/pages/voice_servers.rs

@@ -18,19 +18,33 @@ use crate::{
     },
 };
 use maud::{Markup, html};
+use std::collections::HashMap;
 
 use super::voice_servers_forms::{create_server_form, edit_server_form};
 
+pub struct VoiceServersPageParams<'a> {
+    pub region_id: Option<&'a str>,
+    pub region_name: Option<&'a str>,
+    pub servers: Option<&'a [VoiceServer]>,
+    pub connection_counts: &'a HashMap<String, i64>,
+    pub error: Option<&'a str>,
+    pub csrf_token: &'a str,
+}
+
 pub fn voice_servers_page(
     config: &AdminConfig,
     auth: &AuthContext,
-    region_id: Option<&str>,
-    region_name: Option<&str>,
-    servers: Option<&[VoiceServer]>,
-    error: Option<&str>,
-    csrf_token: &str,
+    p: &VoiceServersPageParams<'_>,
 ) -> Markup {
     let base = &config.base_path;
+    let VoiceServersPageParams {
+        region_id,
+        region_name,
+        servers,
+        connection_counts,
+        error,
+        csrf_token,
+    } = *p;
     let options = LayoutOptions {
         csrf_token,
         inspected_voice_region_id: region_id,
@@ -67,7 +81,7 @@ pub fn voice_servers_page(
                     html! {},
                 ))
                 @if let Some(servers) = servers {
-                    (servers_list(config, rid, servers, csrf_token))
+                    (servers_list(config, rid, servers, connection_counts, csrf_token))
                 }
                 div id="create" class="mt-8" {
                     (create_server_form(config, rid, csrf_token))
@@ -109,6 +123,7 @@ fn servers_list(
     config: &AdminConfig,
     region_id: &str,
     servers: &[VoiceServer],
+    connection_counts: &HashMap<String, i64>,
     csrf_token: &str,
 ) -> Markup {
     if servers.is_empty() {
@@ -121,7 +136,7 @@ fn servers_list(
     html! {
         div class="space-y-4" {
             @for server in servers {
-                (server_card(config, region_id, server, csrf_token))
+                (server_card(config, region_id, server, connection_counts.get(&server.server_id).copied(), csrf_token))
             }
         }
     }
@@ -131,6 +146,7 @@ fn server_card(
     config: &AdminConfig,
     region_id: &str,
     server: &VoiceServer,
+    connection_count: Option<i64>,
     csrf_token: &str,
 ) -> Markup {
     let base = &config.base_path;
@@ -145,6 +161,15 @@ fn server_card(
     let lng_str = server
         .longitude
         .map_or_else(|| "Region default".to_string(), |v| v.to_string());
+    let soft_limit_str = server
+        .soft_connection_limit
+        .map_or_else(|| "No limit".to_string(), |v| v.to_string());
+    let connections_str =
+        connection_count.map_or_else(|| "Unavailable".to_string(), |v| v.to_string());
+    let at_soft_limit = matches!(
+        (server.soft_connection_limit, connection_count),
+        (Some(limit), Some(count)) if limit > 0 && count >= limit
+    );
 
     card(html! {
         div class="mb-4 flex flex-col gap-1" {
@@ -155,6 +180,9 @@ fn server_card(
                 } @else {
                     (badge("INACTIVE", BadgeVariant::Default))
                 }
+                @if at_soft_limit {
+                    (badge("AT SOFT LIMIT", BadgeVariant::Warning))
+                }
                 (voice_status_badges(vip_only, has_features, has_guild_ids))
             }
             p class="text-sm text-neutral-500" { (endpoint) }
@@ -164,6 +192,8 @@ fn server_card(
             (data_field_text("Status", if is_active { "Active" } else { "Inactive" }))
             (data_field_text("Latitude", &lat_str))
             (data_field_text("Longitude", &lng_str))
+            (data_field_text("Soft connection limit", &soft_limit_str))
+            (data_field_text("Live connections", &connections_str))
         }
         (voice_features_list(&server.required_guild_features))
         (voice_guild_ids_list(&server.allowed_guild_ids))

fluxer_admin/src/templates/pages/voice_servers_forms.rs

@@ -26,6 +26,9 @@ pub fn edit_server_form(
     let lat_val = server.latitude.map_or_else(String::new, |v| v.to_string());
     let lng_val = server.longitude.map_or_else(String::new, |v| v.to_string());
     let is_active = server.is_active.unwrap_or(false);
+    let soft_limit_val = server
+        .soft_connection_limit
+        .map_or_else(String::new, |v| v.to_string());
     let vip_only = server.vip_only.unwrap_or(false);
     let features_csv = server.required_guild_features.join(", ");
     let guild_ids_csv = server.allowed_guild_ids.join(", ");
@@ -57,6 +60,15 @@ pub fn edit_server_form(
                         "Optional per-server coordinate override",
                     ))
                 }
+                (form_field_with_helper(
+                    "Soft Connection Limit",
+                    &format!("{id_prefix}-soft-connection-limit"),
+                    "soft_connection_limit",
+                    "number",
+                    &soft_limit_val,
+                    "Leave empty for no limit",
+                    "Placement prefers another server once this server holds this many connections",
+                ))
                 (form_field_with_helper(
                     "API Key",
                     &format!("{id_prefix}-api-key"),
@@ -105,6 +117,15 @@ pub fn create_server_form(config: &AdminConfig, region_id: &str, csrf_token: &st
                 (form_field_with_id("API Secret", "new-server-api-secret", "api_secret", "password", "", "LiveKit API secret", true))
                 (form_field_with_id("Latitude (optional)", "new-server-latitude", "latitude", "number", "", "40.7128", false))
                 (form_field_with_id("Longitude (optional)", "new-server-longitude", "longitude", "number", "", "-74.0060", false))
+                (form_field_with_helper(
+                    "Soft Connection Limit (optional)",
+                    "new-server-soft-connection-limit",
+                    "soft_connection_limit",
+                    "number",
+                    "",
+                    "Leave empty for no limit",
+                    "Placement prefers another server once this server holds this many connections",
+                ))
             }
             div class="space-y-3" {
                 (checkbox("is_active", "true", "Server is active", true, true))

fluxer_admin/tests/csrf_legacy_cookie.rs

@@ -18,6 +18,7 @@ use tower::ServiceExt;
 const SECRET_KEY: &str = "legacy-csrf-cookie-test-secret";
 const ADMIN_ORIGIN: &str = "https://admin.example.test";
 const LEGACY_HEX_TOKEN: &str = "8f14e45fceea167a5a36dedd4bea25438f14e45fceea167a5a36dedd4bea2543";
+const CREATED_KEY_SECRET: &str = "fa_1900000000000000001_OneTimeSecretForTests";
 
 struct TestApp {
     router: Router,
@@ -128,6 +129,10 @@ async fn load_page(app: &TestApp, cookie: &str) -> (String, String) {
     let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
     let text = String::from_utf8(body.to_vec()).unwrap();
     assert_eq!(status, StatusCode::OK, "{text}");
+    assert!(
+        text.contains("AdminUser"),
+        "the page did not render the admin the mock API returns"
+    );
     let cookie_token = host_csrf_cookie(&headers)
         .unwrap_or_else(|| panic!("no __Host-csrf_token in Set-Cookie: {headers:?}"));
     let page_token = form_csrf_value(&text).expect("no _csrf hidden input rendered");
@@ -166,7 +171,16 @@ async fn submit_action(app: &TestApp, cookie: &str, form_token: &str) -> StatusC
         )
         .await
         .unwrap();
-    response.status()
+    let status = response.status();
+    let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    let text = String::from_utf8(body.to_vec()).unwrap();
+    if status == StatusCode::OK {
+        assert!(
+            text.contains(CREATED_KEY_SECRET),
+            "the action did not render the key the mock API creates"
+        );
+    }
+    status
 }
 
 fn host_csrf_cookie(headers: &HeaderMap) -> Option<String> {
@@ -207,11 +221,11 @@ async fn spawn_mock_api() -> String {
 
 async fn mock_api(method: Method, uri: Uri) -> Response {
     match (method, uri.path()) {
-        (Method::GET, "/admin/users/me") => Json(json!({ "user": admin_user() })).into_response(),
+        (Method::GET, "/admin/users/@me") => Json(json!({ "user": admin_user() })).into_response(),
         (Method::GET, "/admin/api-keys") => Json(json!([])).into_response(),
         (Method::POST, "/admin/api-keys") => Json(json!({
             "key_id": "1900000000000000001",
-            "key": "fa_1900000000000000001_OneTimeSecretForTests",
+            "key": CREATED_KEY_SECRET,
             "name": "Legacy Cookie Key",
             "created_at": "2026-07-10T15:00:00.000Z",
             "expires_at": null,

fluxer_admin/tests/voice_restriction_writes.rs

@@ -0,0 +1,336 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+use axum::{
+    Json, Router,
+    body::{Body, to_bytes},
+    extract::State,
+    http::{Method, Request, StatusCode, Uri, header},
+    response::{IntoResponse, Response},
+};
+use fluxer_admin::{
+    build_router,
+    config::{AdminConfig, ProxyConfig, RuntimeEnv},
+    session,
+};
+use serde_json::{Value, json};
+use std::sync::{Arc, Mutex};
+use tokio::net::TcpListener;
+use tower::ServiceExt;
+
+const SECRET_KEY: &str = "voice-restriction-writes-test-secret";
+const REGION_ID: &str = "europe-north";
+const SERVER_ID: &str = "europe-north-server-1";
+
+type CapturedBodies = Arc<Mutex<Vec<(String, Value)>>>;
+
+#[tokio::test]
+async fn clearing_the_restriction_fields_reaches_the_api_as_empty_lists() {
+    let app = setup().await;
+    let csrf_token = csrf_token(&app).await;
+    let status = post_form(
+        &app,
+        "/voice-servers?action=update",
+        &format!(
+            "_csrf={csrf_token}&region_id={REGION_ID}&server_id={SERVER_ID}\
+             &endpoint=wss%3A%2F%2Fvoice.example.com&is_active=true\
+             &required_guild_features=&allowed_guild_ids=&soft_connection_limit="
+        ),
+    )
+    .await;
+    assert_eq!(status, StatusCode::SEE_OTHER);
+
+    let body = captured_body(
+        &app,
+        "PATCH /admin/voice/regions/europe-north/servers/europe-north-server-1",
+    );
+    assert_eq!(body["required_guild_features"], json!([]));
+    assert_eq!(body["allowed_guild_ids"], json!([]));
+    assert_eq!(body["soft_connection_limit"], Value::Null);
+    assert_eq!(body["vip_only"], json!(false));
+}
+
+#[tokio::test]
+async fn activating_a_server_leaves_the_restriction_fields_untouched() {
+    let app = setup().await;
+    let csrf_token = csrf_token(&app).await;
+    let status = post_form(
+        &app,
+        "/voice-servers?action=update",
+        &format!(
+            "_csrf={csrf_token}&region_id={REGION_ID}&server_id={SERVER_ID}\
+             &endpoint=wss%3A%2F%2Fvoice.example.com&is_active=false&vip_only=true"
+        ),
+    )
+    .await;
+    assert_eq!(status, StatusCode::SEE_OTHER);
+
+    let body = captured_body(
+        &app,
+        "PATCH /admin/voice/regions/europe-north/servers/europe-north-server-1",
+    );
+    let object = body.as_object().expect("object body");
+    assert!(!object.contains_key("required_guild_features"));
+    assert!(!object.contains_key("allowed_guild_ids"));
+    assert_eq!(body["is_active"], json!(false));
+    assert_eq!(body["vip_only"], json!(true));
+}
+
+#[tokio::test]
+async fn clearing_the_region_restriction_fields_reaches_the_api_as_empty_lists() {
+    let app = setup().await;
+    let csrf_token = csrf_token(&app).await;
+    let status = post_form(
+        &app,
+        "/voice-regions?action=update",
+        &format!(
+            "_csrf={csrf_token}&id={REGION_ID}&name=Northern%20Europe&emoji=%F0%9F%87%B8%F0%9F%87%AA\
+             &latitude=59.33&longitude=18.06&required_guild_features=&allowed_guild_ids="
+        ),
+    )
+    .await;
+    assert_eq!(status, StatusCode::SEE_OTHER);
+
+    let body = captured_body(&app, "PATCH /admin/voice/regions/europe-north");
+    assert_eq!(body["required_guild_features"], json!([]));
+    assert_eq!(body["allowed_guild_ids"], json!([]));
+}
+
+struct TestApp {
+    router: Router,
+    session_cookie: String,
+    captured: CapturedBodies,
+}
+
+async fn setup() -> TestApp {
+    let captured: CapturedBodies = Arc::new(Mutex::new(Vec::new()));
+    let api_endpoint = spawn_mock_api(Arc::clone(&captured)).await;
+    let router = build_router(test_config(api_endpoint));
+    let session_value = session::create_session("1500000000000000000", "test-token", SECRET_KEY);
+    TestApp {
+        router,
+        session_cookie: format!("{}={session_value}", session::SESSION_COOKIE_NAME),
+        captured,
+    }
+}
+
+fn captured_body(app: &TestApp, route: &str) -> Value {
+    let captured = app.captured.lock().expect("captured bodies");
+    captured
+        .iter()
+        .find(|(seen, _)| seen == route)
+        .map(|(_, body)| body.clone())
+        .unwrap_or_else(|| {
+            panic!(
+                "no request captured for {route}, saw {:?}",
+                captured.iter().map(|(seen, _)| seen).collect::<Vec<_>>()
+            )
+        })
+}
+
+async fn csrf_token(app: &TestApp) -> String {
+    let response = app
+        .router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(Method::GET)
+                .uri("/voice-regions")
+                .header(header::COOKIE, &app.session_cookie)
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::OK);
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .find_map(|value| {
+            let pair = value.split(';').next()?;
+            let token = pair
+                .strip_prefix("__Host-csrf_token=")
+                .or_else(|| pair.strip_prefix("csrf_token="))?;
+            (!token.is_empty()).then(|| token.to_owned())
+        })
+        .expect("csrf_token cookie")
+}
+
+async fn post_form(app: &TestApp, uri: &str, body: &str) -> StatusCode {
+    let csrf = body
+        .split('&')
+        .find_map(|pair| pair.strip_prefix("_csrf="))
+        .expect("form carries a csrf token");
+    let response = app
+        .router
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method(Method::POST)
+                .uri(uri)
+                .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+                .header(
+                    header::COOKIE,
+                    format!("{}; __Host-csrf_token={csrf}", app.session_cookie),
+                )
+                .body(Body::from(body.to_owned()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    response.status()
+}
+
+async fn spawn_mock_api(captured: CapturedBodies) -> String {
+    let listener = TcpListener::bind(("127.0.0.1", 0)).await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    tokio::spawn(async move {
+        axum::serve(
+            listener,
+            Router::new().fallback(mock_api).with_state(captured),
+        )
+        .await
+        .unwrap();
+    });
+    format!("http://{addr}")
+}
+
+async fn mock_api(
+    State(captured): State<CapturedBodies>,
+    method: Method,
+    uri: Uri,
+    request: Request<Body>,
+) -> Response {
+    let path = uri.path().to_owned();
+    if method == Method::PATCH {
+        let bytes = to_bytes(request.into_body(), usize::MAX).await.unwrap();
+        let body: Value = serde_json::from_slice(&bytes).unwrap_or(Value::Null);
+        captured
+            .lock()
+            .expect("captured bodies")
+            .push((format!("PATCH {path}"), body));
+    }
+    match (method, path.as_str()) {
+        (Method::GET, "/admin/users/@me") => Json(json!({ "user": admin_user() })).into_response(),
+        (Method::PATCH, "/admin/voice/regions/europe-north") => {
+            Json(json!({ "region": region() })).into_response()
+        }
+        (Method::PATCH, "/admin/voice/regions/europe-north/servers/europe-north-server-1") => {
+            Json(json!({ "server": server() })).into_response()
+        }
+        (Method::GET, "/admin/voice/regions") => {
+            Json(json!({ "regions": [region()] })).into_response()
+        }
+        _ => (
+            StatusCode::NOT_FOUND,
+            Json(json!({ "message": "not found" })),
+        )
+            .into_response(),
+    }
+}
+
+fn region() -> Value {
+    json!({
+        "id": REGION_ID,
+        "name": "Northern Europe",
+        "emoji": "flag",
+        "latitude": 59.33,
+        "longitude": 18.06,
+        "is_default": true,
+        "vip_only": false,
+        "required_guild_features": [],
+        "allowed_guild_ids": [],
+        "allowed_user_ids": [],
+        "created_at": null,
+        "updated_at": null
+    })
+}
+
+fn server() -> Value {
+    json!({
+        "region_id": REGION_ID,
+        "server_id": SERVER_ID,
+        "endpoint": "wss://voice.example.com",
+        "latitude": null,
+        "longitude": null,
+        "is_active": true,
+        "soft_connection_limit": null,
+        "vip_only": false,
+        "required_guild_features": [],
+        "allowed_guild_ids": [],
+        "allowed_user_ids": [],
+        "created_at": null,
+        "updated_at": null
+    })
+}
+
+fn admin_user() -> Value {
+    json!({
+        "id": "1500000000000000000",
+        "username": "AdminUser",
+        "discriminator": 1,
+        "avatar": null,
+        "banner": null,
+        "email": "[email protected]",
+        "email_verified": true,
+        "email_bounced": false,
+        "global_name": "AdminUser",
+        "bio": null,
+        "pronouns": null,
+        "accent_color": null,
+        "date_of_birth": null,
+        "locale": "en-US",
+        "acls": ["*"],
+        "traits": [],
+        "flags": "0",
+        "premium_flags": 0,
+        "bot": false,
+        "system": false,
+        "premium_type": null,
+        "premium_since": null,
+        "premium_until": null,
+        "premium_grace_ends_at": null,
+        "premium_lifetime_sequence": null,
+        "suspicious_activity_flags": 0,
+        "phone_verification_deferred": false,
+        "has_totp": false,
+        "authenticator_types": [],
+        "has_verified_phone": false,
+        "temp_banned_until": null,
+        "pending_deletion_at": null,
+        "pending_bulk_message_deletion_at": null,
+        "deletion_reason_code": null,
+        "deletion_public_reason": null,
+        "last_active_at": null,
+        "last_active_ip": null,
+        "last_active_ip_reverse": null,
+        "last_active_location": null
+    })
+}
+
+fn test_config(api_endpoint: String) -> AdminConfig {
+    AdminConfig {
+        env: RuntimeEnv::Test,
+        host: "127.0.0.1".to_owned(),
+        port: 0,
+        secret_key_base: SECRET_KEY.to_owned(),
+        base_path: String::new(),
+        api_endpoint,
+        media_endpoint: "https://media.example.test".to_owned(),
+        static_cdn_endpoint: "https://static.example.test".to_owned(),
+        admin_endpoint: "https://admin.example.test".to_owned(),
+        web_app_endpoint: "https://app.example.test".to_owned(),
+        kv_url: String::new(),
+        oauth_client_id: "admin-client".to_owned(),
+        oauth_client_secret: "admin-secret".to_owned(),
+        oauth_redirect_uri: "https://admin.example.test/callback".to_owned(),
+        build_version: "test".to_owned(),
+        release_channel: "test".to_owned(),
+        self_hosted: false,
+        proxy: ProxyConfig {
+            trust_client_ip_header: false,
+            client_ip_header_name: "x-forwarded-for".to_owned(),
+        },
+    }
+}

fluxer_api/pkgs/geoip/src/GeoipLookup.ts

@@ -2,7 +2,7 @@
 
 import {getRegionDisplayName} from '@fluxer/geo_utils/src/RegionFormatting';
 import {getSameIpDecisionKey, isValidIp, normalizeIpString} from '@fluxer/ip_utils/src/IpAddress';
-import maxmind, {type CityResponse, type Reader} from 'maxmind';
+import maxmind, {type AsnResponse, type CityResponse, type Reader} from 'maxmind';
 
 export const UNKNOWN_LOCATION = 'Unknown Location';
 
@@ -15,6 +15,15 @@ export interface GeoipResult {
 	countryName: string | null;
 	latitude?: number | null;
 	longitude?: number | null;
+	accuracyRadiusKm?: number | null;
+	timeZone?: string | null;
+}
+
+export interface GeoipAsnResult {
+	normalizedIp: string | null;
+	asn: number | null;
+	asnOrg: string | null;
+	available: boolean;
 }
 
 type CacheEntry = {
@@ -22,12 +31,21 @@ type CacheEntry = {
 	expiresAt: number;
 };
 
+type AsnCacheEntry = {
+	result: GeoipAsnResult;
+	expiresAt: number;
+};
+
 const CACHE_TTL_MS = 10 * 60 * 1000;
 const CACHE_MAX_ENTRIES = 10_000;
 const geoipCache = new Map<string, CacheEntry>();
+const asnCache = new Map<string, AsnCacheEntry>();
 
 let maxmindReader: Reader<CityResponse> | null = null;
 let maxmindReaderPromise: Promise<Reader<CityResponse>> | null = null;
+let maxmindAsnReader: Reader<AsnResponse> | null = null;
+let maxmindAsnReaderPromise: Promise<Reader<AsnResponse>> | null = null;
+let maxmindAsnUnavailable = false;
 
 function buildFallbackResult(normalizedIp: string): GeoipResult {
 	return {
@@ -39,6 +57,17 @@ function buildFallbackResult(normalizedIp: string): GeoipResult {
 		countryName: null,
 		latitude: null,
 		longitude: null,
+		accuracyRadiusKm: null,
+		timeZone: null,
+	};
+}
+
+function buildAsnFallbackResult(normalizedIp: string | null): GeoipAsnResult {
+	return {
+		normalizedIp: normalizedIp || null,
+		asn: null,
+		asnOrg: null,
+		available: false,
 	};
 }
 
@@ -59,6 +88,24 @@ async function ensureReader(dbPath: string): Promise<Reader<CityResponse>> {
 	return maxmindReaderPromise;
 }
 
+async function ensureAsnReader(dbPath: string): Promise<Reader<AsnResponse>> {
+	if (maxmindAsnReader) return maxmindAsnReader;
+	if (!maxmindAsnReaderPromise) {
+		maxmindAsnReaderPromise = maxmind
+			.open<AsnResponse>(dbPath, {watchForUpdates: true, watchForUpdatesNonPersistent: true})
+			.then((reader) => {
+				maxmindAsnReader = reader;
+				return reader;
+			})
+			.catch((error) => {
+				maxmindAsnReaderPromise = null;
+				maxmindAsnUnavailable = true;
+				throw error;
+			});
+	}
+	return maxmindAsnReaderPromise;
+}
+
 function stateLabel(record?: CityResponse): string | null {
 	const subdivision = record?.subdivisions?.[0];
 	if (!subdivision) return null;
@@ -112,6 +159,31 @@ function setCachedGeoipResult(cacheKey: string, result: GeoipResult): void {
 	geoipCache.set(cacheKey, {result, expiresAt: Date.now() + CACHE_TTL_MS});
 }
 
+function getCachedAsnResult(cacheKey: string, normalizedIp: string): GeoipAsnResult | null {
+	const cached = asnCache.get(cacheKey);
+	if (!cached) {
+		return null;
+	}
+	if (Date.now() >= cached.expiresAt) {
+		asnCache.delete(cacheKey);
+		return null;
+	}
+	asnCache.delete(cacheKey);
+	asnCache.set(cacheKey, cached);
+	return {...cached.result, normalizedIp};
+}
+
+function setCachedAsnResult(cacheKey: string, result: GeoipAsnResult): void {
+	asnCache.delete(cacheKey);
+	if (asnCache.size >= CACHE_MAX_ENTRIES) {
+		const oldestKey = asnCache.keys().next().value;
+		if (oldestKey !== undefined) {
+			asnCache.delete(oldestKey);
+		}
+	}
+	asnCache.set(cacheKey, {result, expiresAt: Date.now() + CACHE_TTL_MS});
+}
+
 async function lookupMaxmind(clean: string, dbPath: string): Promise<GeoipResult> {
 	try {
 		const reader = await ensureReader(dbPath);
@@ -128,12 +200,32 @@ async function lookupMaxmind(clean: string, dbPath: string): Promise<GeoipResult
 			countryName: record.country?.names?.en ?? (countryCode ? countryDisplayName(countryCode) : null) ?? null,
 			latitude: record.location?.latitude ?? null,
 			longitude: record.location?.longitude ?? null,
+			accuracyRadiusKm: record.location?.accuracy_radius ?? null,
+			timeZone: record.location?.time_zone ?? null,
 		};
 	} catch {
 		return buildFallbackResult(clean);
 	}
 }
 
+async function lookupMaxmindAsn(clean: string, dbPath: string): Promise<GeoipAsnResult> {
+	try {
+		const reader = await ensureAsnReader(dbPath);
+		const record = reader.get(clean);
+		if (!record) {
+			return {normalizedIp: clean, asn: null, asnOrg: null, available: true};
+		}
+		return {
+			normalizedIp: clean,
+			asn: record.autonomous_system_number ?? null,
+			asnOrg: record.autonomous_system_organization ?? null,
+			available: true,
+		};
+	} catch {
+		return buildAsnFallbackResult(clean);
+	}
+}
+
 async function resolveGeoip(clean: string, dbPath: string): Promise<GeoipResult> {
 	const cacheKey = getSameIpDecisionKey(clean) ?? clean;
 	const cached = getCachedGeoipResult(cacheKey, clean);
@@ -145,6 +237,17 @@ async function resolveGeoip(clean: string, dbPath: string): Promise<GeoipResult>
 	return result;
 }
 
+async function resolveAsn(clean: string, dbPath: string): Promise<GeoipAsnResult> {
+	const cacheKey = getSameIpDecisionKey(clean) ?? clean;
+	const cached = getCachedAsnResult(cacheKey, clean);
+	if (cached) {
+		return cached;
+	}
+	const result = await lookupMaxmindAsn(clean, dbPath);
+	setCachedAsnResult(cacheKey, result);
+	return result;
+}
+
 export async function lookupGeoipByIp(ip: string, dbPath: string | undefined): Promise<GeoipResult> {
 	if (!dbPath) {
 		return buildFallbackResult(ip);
@@ -156,6 +259,27 @@ export async function lookupGeoipByIp(ip: string, dbPath: string | undefined): P
 	return resolveGeoip(clean, dbPath);
 }
 
+export async function lookupAsnByIp(ip: string, asnDbPath: string | undefined): Promise<GeoipAsnResult> {
+	if (!asnDbPath || maxmindAsnUnavailable) {
+		return buildAsnFallbackResult(null);
+	}
+	const clean = normalizeIpString(ip);
+	if (!isValidIp(clean)) {
+		return buildAsnFallbackResult(clean);
+	}
+	return resolveAsn(clean, asnDbPath);
+}
+
+export function resetGeoipReadersForTesting(): void {
+	maxmindReader = null;
+	maxmindReaderPromise = null;
+	maxmindAsnReader = null;
+	maxmindAsnReaderPromise = null;
+	maxmindAsnUnavailable = false;
+	geoipCache.clear();
+	asnCache.clear();
+}
+
 export function formatGeoipLocation(result: GeoipResult): string | null {
 	const parts: Array<string> = [];
 	if (result.city) parts.push(result.city);

fluxer_api/pkgs/geoip/src/GeoipStartup.ts

@@ -12,6 +12,7 @@ const GEOIP_DOWNLOAD_PATH_QUERY_PARAM = 'download_path';
 const GEOIP_ASN_DOWNLOAD_PATH_QUERY_PARAM = 'asn_download_path';
 const GEOIP_ASN_KEY_QUERY_PARAM = 'asn_key';
 const DEFAULT_GEOIP_TEMPORARY_DIRECTORY = '/tmp/fluxer/geoip';
+const DEFAULT_GEOIP_ASN_DB_BASENAME = 'GeoLite2-ASN.mmdb';
 
 type GeoipSourceMode = 'filesystem' | 's3';
 
@@ -167,9 +168,11 @@ async function downloadS3Object(
 }
 
 function createGeoipFilesystemSourceConfig(rawValue: string | undefined): GeoipFilesystemSourceConfig {
+	const maxmindDbPath = rawValue === '' ? undefined : rawValue;
 	return {
 		mode: 'filesystem',
-		maxmindDbPath: rawValue === '' ? undefined : rawValue,
+		maxmindDbPath,
+		maxmindAsnDbPath: maxmindDbPath ? path.join(path.dirname(maxmindDbPath), DEFAULT_GEOIP_ASN_DB_BASENAME) : undefined,
 	};
 }
 

fluxer_api/pkgs/geoip/src/IpInfoService.ts

@@ -9,6 +9,11 @@ const CACHE_KEY_PREFIX = 'ipinfo:max:';
 const ISO_DATE_REGEX = /^\d{4}-\d{2}-\d{2}$/u;
 const POSITIVE_CACHE_TTL_SECONDS = 7 * 24 * 60 * 60;
 const NEGATIVE_CACHE_TTL_SECONDS = 14 * 24 * 60 * 60;
+const FAILURE_TTL_REQUEST_FAILED_SECONDS = 60;
+const FAILURE_TTL_HTTP_ERROR_SECONDS = 300;
+const FAILURE_TTL_QUOTA_SECONDS = 900;
+const FAILURE_TTL_SCHEMA_MISMATCH_SECONDS = 600;
+const FAILURE_TTL_BACKGROUND_CAP_SECONDS = 120;
 
 export interface IpInfoGeoBlock {
 	countryCode: string | null;
@@ -73,6 +78,41 @@ export interface IpInfoCache {
 	set<T>(key: string, value: T, ttlSeconds?: number): Promise<void>;
 }
 
+export type IpInfoLookupPriority = 'critical' | 'standard' | 'background';
+
+export interface IpInfoLookupBudget {
+	tryConsume(priority: IpInfoLookupPriority): Promise<boolean>;
+}
+
+export interface CachedIpInfoFailure extends IpInfoLookupResult {
+	cachedFailure: true;
+	failureOutcome: 'http_error' | 'request_failed' | 'schema_mismatch';
+	failureHttpStatus: number | null;
+	cachedAtMs: number;
+}
+
+export function resolveIpInfoLookupPriority(source: string | undefined): IpInfoLookupPriority {
+	if (source === 'admin.ip_ban' || source === 'admin.scheduled_deletion_suspicious_ip') return 'critical';
+	if (source === 'AbusiveIpAutoBanner') return 'background';
+	return 'standard';
+}
+
+export function isCachedIpInfoFailure(value: unknown): value is CachedIpInfoFailure {
+	return typeof value === 'object' && value !== null && (value as {available?: unknown}).available === false;
+}
+
+function failureCacheTtlSeconds(
+	outcome: CachedIpInfoFailure['failureOutcome'],
+	httpStatus: number | null,
+	priority: IpInfoLookupPriority,
+): number {
+	let ttl = FAILURE_TTL_HTTP_ERROR_SECONDS;
+	if (outcome === 'request_failed') ttl = FAILURE_TTL_REQUEST_FAILED_SECONDS;
+	else if (outcome === 'schema_mismatch') ttl = FAILURE_TTL_SCHEMA_MISMATCH_SECONDS;
+	else if (httpStatus === 402 || httpStatus === 403 || httpStatus === 429) ttl = FAILURE_TTL_QUOTA_SECONDS;
+	return priority === 'background' ? Math.min(ttl, FAILURE_TTL_BACKGROUND_CAP_SECONDS) : ttl;
+}
+
 export interface IpInfoLookupContext {
 	source?: string;
 	reason?: string;
@@ -86,7 +126,7 @@ export interface IpInfoRequestAuditEvent {
 	source: string;
 	reason: string | null;
 	metadata?: Record<string, string | number | boolean | null>;
-	outcome: 'http_success' | 'http_error' | 'request_failed' | 'schema_mismatch';
+	outcome: 'http_success' | 'http_error' | 'request_failed' | 'schema_mismatch' | 'budget_shed';
 	httpStatus: number | null;
 	available: boolean;
 	riskNote: string;
@@ -110,6 +150,7 @@ interface IpInfoServiceContext {
 	apiKey: string;
 	cache: IpInfoCache;
 	auditLogger?: IpInfoRequestAuditLogger;
+	budget?: IpInfoLookupBudget;
 }
 
 export interface IpInfoService {
@@ -177,8 +218,12 @@ export function createIpInfoService(ctx: IpInfoServiceContext): IpInfoService {
 	return {
 		async lookup(ip: string, context?: IpInfoLookupContext): Promise<IpInfoLookupResult> {
 			const cacheKey = `${CACHE_KEY_PREFIX}${getSameIpDecisionKey(ip) ?? ip}`;
+			const priority = resolveIpInfoLookupPriority(context?.source);
 			const cached = await ctx.cache.get<IpInfoLookupResult>(cacheKey);
 			if (cached !== null) {
+				if (isCachedIpInfoFailure(cached)) {
+					return unavailable(ip, cached.riskNote);
+				}
 				return {...cached, ip};
 			}
 			const existing = inflight.get(cacheKey);
@@ -222,6 +267,30 @@ export function createIpInfoService(ctx: IpInfoServiceContext): IpInfoService {
 				return params.result;
 			};
 			const performLookup = async (): Promise<IpInfoLookupResult> => {
+				if (ctx.budget && !(await ctx.budget.tryConsume(priority))) {
+					return finalize({
+						result: unavailable(ip, `IPInfo lookup shed (budget exhausted, priority: ${priority})`),
+						outcome: 'budget_shed',
+						httpStatus: null,
+					});
+				}
+				const finalizeFailure = async (params: {
+					result: IpInfoLookupResult;
+					outcome: CachedIpInfoFailure['failureOutcome'];
+					httpStatus: number | null;
+				}): Promise<IpInfoLookupResult> => {
+					const entry: CachedIpInfoFailure = {
+						...params.result,
+						cachedFailure: true,
+						failureOutcome: params.outcome,
+						failureHttpStatus: params.httpStatus,
+						cachedAtMs: Date.now(),
+					};
+					await ctx.cache
+						.set(cacheKey, entry, failureCacheTtlSeconds(params.outcome, params.httpStatus, priority))
+						.catch(() => {});
+					return finalize(params);
+				};
 				let payload: unknown;
 				try {
 					const res = await fetch(fetchUrl, {
@@ -229,7 +298,7 @@ export function createIpInfoService(ctx: IpInfoServiceContext): IpInfoService {
 						headers: {Accept: 'application/json'},
 					});
 					if (!res.ok) {
-						return finalize({
+						return finalizeFailure({
 							result: unavailable(ip, `IPInfo HTTP ${res.status}`),
 							outcome: 'http_error',
 							httpStatus: res.status,
@@ -238,7 +307,7 @@ export function createIpInfoService(ctx: IpInfoServiceContext): IpInfoService {
 					payload = await res.json();
 				} catch (err) {
 					const detail = err instanceof Error ? err.message : String(err);
-					return finalize({
+					return finalizeFailure({
 						result: unavailable(ip, `IPInfo request failed: ${detail}`),
 						outcome: 'request_failed',
 						httpStatus: null,
@@ -246,7 +315,7 @@ export function createIpInfoService(ctx: IpInfoServiceContext): IpInfoService {
 				}
 				const parsedResponse = RawIpInfoResponseSchema.safeParse(payload);
 				if (!parsedResponse.success) {
-					return finalize({
+					return finalizeFailure({
 						result: unavailable(ip, formatSchemaMismatch(parsedResponse.error)),
 						outcome: 'schema_mismatch',
 						httpStatus: 200,
@@ -261,8 +330,10 @@ export function createIpInfoService(ctx: IpInfoServiceContext): IpInfoService {
 					httpStatus: 200,
 				});
 			};
-			const promise = performLookup().finally(() => {
-				inflight.delete(cacheKey);
+			const promise: Promise<IpInfoLookupResult> = performLookup().finally(() => {
+				if (inflight.get(cacheKey) === promise) {
+					inflight.delete(cacheKey);
+				}
 			});
 			inflight.set(cacheKey, promise);
 			return promise;

fluxer_api/pkgs/geoip/src/TieredIpInfoCache.ts

@@ -8,6 +8,7 @@ interface TieredIpInfoCacheOptions {
 	hot: IpInfoCache;
 	cold: IpInfoCache;
 	hotTtlSeconds?: number;
+	skipColdWrite?: (value: unknown) => boolean;
 }
 
 export function createTieredIpInfoCache(opts: TieredIpInfoCacheOptions): IpInfoCache {
@@ -18,14 +19,17 @@ export function createTieredIpInfoCache(opts: TieredIpInfoCacheOptions): IpInfoC
 			if (hit !== null) return hit;
 			const cold = await opts.cold.get<T>(key).catch(() => null);
 			if (cold === null) return null;
+			if (opts.skipColdWrite?.(cold) === true) return cold;
 			void opts.hot.set(key, cold, hotTtl).catch(() => {});
 			return cold;
 		},
 		async set<T>(key: string, value: T, ttlSeconds?: number): Promise<void> {
-			await Promise.all([
-				opts.hot.set(key, value, hotTtl).catch(() => {}),
-				opts.cold.set(key, value, ttlSeconds).catch(() => {}),
-			]);
+			const effectiveHotTtl = Math.max(1, Math.min(hotTtl, ttlSeconds ?? hotTtl));
+			const writes: Array<Promise<void>> = [opts.hot.set(key, value, effectiveHotTtl).catch(() => {})];
+			if (opts.skipColdWrite?.(value) !== true) {
+				writes.push(opts.cold.set(key, value, ttlSeconds).catch(() => {}));
+			}
+			await Promise.all(writes);
 		},
 	};
 }

fluxer_api/src/api/Config.test.ts

@@ -81,6 +81,22 @@ function withUploadRelaySecret(master: MasterConfig, secretBase64: string): Mast
 	};
 }
 
+function withStripeLegacyPrices(
+	master: MasterConfig,
+	legacyPrices: Record<string, Array<string> | undefined> | undefined,
+): MasterConfig {
+	return {
+		...master,
+		integrations: {
+			...master.integrations,
+			stripe: {
+				...master.integrations.stripe,
+				legacy_prices: legacyPrices,
+			},
+		},
+	};
+}
+
 describe('buildAPIConfigFromMaster upload relay secret', () => {
 	let master: MasterConfig;
 	beforeAll(async () => {
@@ -111,3 +127,42 @@ describe('buildAPIConfigFromMaster upload relay secret', () => {
 		);
 	});
 });
+
+describe('buildAPIConfigFromMaster stripe legacy prices', () => {
+	let master: MasterConfig;
+	beforeAll(async () => {
+		master = await loadConfig();
+	});
+
+	it('carries the retired stripe price map from master config onto the api config', () => {
+		const legacyPrices = {
+			monthly_brl: ['price_retired_monthly_brl'],
+			yearly_brl: ['price_retired_yearly_brl_a', 'price_retired_yearly_brl_b'],
+			monthly_try: ['price_1TMYpdFPC94Os7FdZVRx98Up'],
+		};
+		expect(buildAPIConfigFromMaster(withStripeLegacyPrices(master, legacyPrices)).stripe.legacyPrices).toEqual(
+			legacyPrices,
+		);
+	});
+
+	it('carries the retired price map even when no live prices are configured', () => {
+		const withoutPrices: MasterConfig = {
+			...master,
+			integrations: {
+				...master.integrations,
+				stripe: {
+					...master.integrations.stripe,
+					prices: undefined,
+					legacy_prices: {monthly_try: ['price_1TMYpdFPC94Os7FdZVRx98Up']},
+				},
+			},
+		};
+		const config = buildAPIConfigFromMaster(withoutPrices);
+		expect(config.stripe.prices).toBeUndefined();
+		expect(config.stripe.legacyPrices).toEqual({monthly_try: ['price_1TMYpdFPC94Os7FdZVRx98Up']});
+	});
+
+	it('leaves the retired price map undefined when master config does not set one', () => {
+		expect(buildAPIConfigFromMaster(withStripeLegacyPrices(master, undefined)).stripe.legacyPrices).toBeUndefined();
+	});
+});

fluxer_api/src/api/Config.ts

@@ -372,17 +372,29 @@ export function buildAPIConfigFromMaster(master: MasterConfig): APIConfig {
 						monthlyUsd: master.integrations.stripe.prices.monthly_usd,
 						monthlyEur: master.integrations.stripe.prices.monthly_eur,
 						monthlyBrl: master.integrations.stripe.prices.monthly_brl,
+						monthlyDkk: master.integrations.stripe.prices.monthly_dkk,
 						monthlyInr: master.integrations.stripe.prices.monthly_inr,
+						monthlyNok: master.integrations.stripe.prices.monthly_nok,
 						monthlyPln: master.integrations.stripe.prices.monthly_pln,
+						monthlySek: master.integrations.stripe.prices.monthly_sek,
 						monthlyTry: master.integrations.stripe.prices.monthly_try,
 						yearlyUsd: master.integrations.stripe.prices.yearly_usd,
 						yearlyEur: master.integrations.stripe.prices.yearly_eur,
 						yearlyBrl: master.integrations.stripe.prices.yearly_brl,
+						yearlyDkk: master.integrations.stripe.prices.yearly_dkk,
 						yearlyInr: master.integrations.stripe.prices.yearly_inr,
+						yearlyNok: master.integrations.stripe.prices.yearly_nok,
 						yearlyPln: master.integrations.stripe.prices.yearly_pln,
+						yearlySek: master.integrations.stripe.prices.yearly_sek,
 						yearlyTry: master.integrations.stripe.prices.yearly_try,
 						gift1MonthUsd: master.integrations.stripe.prices.gift_1_month_usd,
 						gift1MonthEur: master.integrations.stripe.prices.gift_1_month_eur,
+						gift1MonthSek: master.integrations.stripe.prices.gift_1_month_sek,
+						gift1YearSek: master.integrations.stripe.prices.gift_1_year_sek,
+						gift1MonthDkk: master.integrations.stripe.prices.gift_1_month_dkk,
+						gift1YearDkk: master.integrations.stripe.prices.gift_1_year_dkk,
+						gift1MonthNok: master.integrations.stripe.prices.gift_1_month_nok,
+						gift1YearNok: master.integrations.stripe.prices.gift_1_year_nok,
 						gift1MonthBrl: master.integrations.stripe.prices.gift_1_month_brl,
 						gift1MonthInr: master.integrations.stripe.prices.gift_1_month_inr,
 						gift1MonthPln: master.integrations.stripe.prices.gift_1_month_pln,
@@ -395,6 +407,7 @@ export function buildAPIConfigFromMaster(master: MasterConfig): APIConfig {
 						gift1YearTry: master.integrations.stripe.prices.gift_1_year_try,
 					}
 				: undefined,
+			legacyPrices: master.integrations.stripe.legacy_prices,
 		},
 		bunny: {
 			purgeEnabled: master.integrations.bunny.purge_enabled,

fluxer_api/src/api/admin/controllers/ArchiveAdminController.ts

@@ -30,6 +30,19 @@ function requireArchiveSubjectAccess(adminAcls: Set<string>, subjectType: 'user'
 	throw new MissingACLError(subjectType === 'user' ? AdminACLs.ARCHIVE_TRIGGER_USER : AdminACLs.ARCHIVE_TRIGGER_GUILD);
 }
 
+function resolveListSubjectType(adminAcls: Set<string>, requested: 'all' | 'user' | 'guild'): 'all' | 'user' | 'guild' {
+	if (requested !== 'all') {
+		requireArchiveSubjectAccess(adminAcls, requested);
+		return requested;
+	}
+	const viewUser = canViewArchive(adminAcls, 'user');
+	const viewGuild = canViewArchive(adminAcls, 'guild');
+	if (viewUser && viewGuild) return 'all';
+	if (viewUser) return 'user';
+	if (viewGuild) return 'guild';
+	throw new MissingACLError(AdminACLs.ARCHIVE_VIEW_ALL);
+}
+
 export function ArchiveAdminController(app: HonoApp) {
 	app.post(
 		'/admin/users/:user_id/archives',
@@ -104,18 +117,8 @@ export function ArchiveAdminController(app: HonoApp) {
 			const adminArchiveService = ctx.get('adminArchiveService');
 			const adminAcls = ctx.get('adminUserAcls');
 			const query = ctx.req.valid('query');
-			if (
-				query.subject_type === 'all' &&
-				!adminAcls.has(AdminACLs.ARCHIVE_VIEW_ALL) &&
-				!adminAcls.has(AdminACLs.WILDCARD)
-			) {
-				throw new MissingACLError(AdminACLs.ARCHIVE_VIEW_ALL);
-			}
-			if (query.subject_type !== 'all') {
-				requireArchiveSubjectAccess(adminAcls, query.subject_type);
-			}
 			const result = await adminArchiveService.listArchives({
-				subjectType: query.subject_type,
+				subjectType: resolveListSubjectType(adminAcls, query.subject_type),
 				subjectId: query.subject_id ?? undefined,
 				requestedBy: query.requested_by ?? undefined,
 				limit: query.limit,

fluxer_api/src/api/admin/controllers/GuildAdminController.ts

@@ -72,7 +72,10 @@ function selectGuildUpdateACLs(body: UpdateGuildRequest): Array<string> {
 	if (body.new_owner_id !== undefined) {
 		required.push(AdminACLs.GUILD_TRANSFER_OWNERSHIP);
 	}
-	return required.length > 0 ? required : [AdminACLs.WILDCARD];
+	if (required.length > 0) {
+		return required;
+	}
+	return Object.keys(body).length === 0 ? [] : [AdminACLs.WILDCARD];
 }
 
 function requireAllAdminACLs(granted: ReadonlySet<string>, required: ReadonlyArray<string>): void {
@@ -148,7 +151,7 @@ export function GuildAdminController(app: HonoApp) {
 			operationId: 'update_admin_guild',
 			summary: 'Update guild',
 			description:
-				'Partially updates a guild. The permissions required are selected by the fields present in the body and are evaluated with all-of semantics: name requires GUILD_UPDATE_NAME, vanity_url_code requires GUILD_UPDATE_VANITY, new_owner_id requires GUILD_TRANSFER_OWNERSHIP, add_features and remove_features require GUILD_UPDATE_FEATURES, and fields together with every other setting requires GUILD_UPDATE_SETTINGS. A body carrying no field requires the wildcard permission. Every applied change is logged to the audit log.',
+				'Partially updates a guild. The permissions required are selected by the fields present in the body and are evaluated with all-of semantics: name requires GUILD_UPDATE_NAME, vanity_url_code requires GUILD_UPDATE_VANITY, new_owner_id requires GUILD_TRANSFER_OWNERSHIP, add_features and remove_features require GUILD_UPDATE_FEATURES, and fields together with every other setting requires GUILD_UPDATE_SETTINGS. A body with no fields applies no change. Every applied change is logged to the audit log.',
 			responseSchema: GuildUpdateResponse,
 			statusCode: 200,
 			security: 'adminApiKey',

fluxer_api/src/api/admin/controllers/ReportAdminController.ts

@@ -88,12 +88,12 @@ export function ReportAdminController(app: HonoApp) {
 			const adminService = ctx.get('adminService');
 			const adminUserAcls = ctx.get('adminUserAcls');
 			const query = ctx.req.valid('query');
-			if (usesReportSearchIndex(query)) {
+			if (query.status === undefined || usesReportSearchIndex(query)) {
 				return ctx.json(
 					await adminService.reportServiceAggregate.searchReports(toSearchReportsRequest(query), adminUserAcls),
 				);
 			}
-			const status = query.status === undefined ? 0 : REPORT_STATUS_BY_FILTER[query.status];
+			const status = REPORT_STATUS_BY_FILTER[query.status];
 			return ctx.json(
 				await adminService.reportServiceAggregate.listReports(status, adminUserAcls, query.limit, query.offset),
 			);

fluxer_api/src/api/admin/services/AdminBanManagementService.ts

@@ -30,8 +30,8 @@ import {phraseBlocklistCache} from '../../middleware/PhraseBlocklistCache';
 import {profileSubstringBlocklistCache} from '../../middleware/ProfileSubstringBlocklistCache';
 import {urlBlocklistCache} from '../../middleware/UrlBlocklistCache';
 import {
+	getIpBanBlastRadiusVerdict,
 	getSuspiciousIpSkipReason,
-	hasHighCgnatBlastRadiusRisk,
 	isSingleIpBanCandidate,
 } from '../../risk/IpBanCgnatGuard';
 import {isIpBanExempt} from '../../risk/IpBanExemptions';
@@ -292,7 +292,7 @@ export class AdminBanManagementService {
 			return false;
 		}
 		try {
-			const highRisk = await hasHighCgnatBlastRadiusRisk(ip, this.deps.ipInfoService, {
+			const {cgnat: highRisk} = await getIpBanBlastRadiusVerdict(ip, this.deps.ipInfoService, {
 				source: 'admin.ip_ban',
 				reason: 'pre_write_cgnat_guard',
 			});

fluxer_api/src/api/admin/services/AdminMessageService.ts

@@ -229,14 +229,11 @@ export class AdminMessageService {
 			hitsPerPage: limit,
 			page: 1,
 		});
-		const messageEntries = result.hits.map((hit) => ({
-			channelId: createChannelID(BigInt(hit.channelId)),
-			messageId: createMessageID(BigInt(hit.id)),
-		}));
-		const resolvedMessages = await Promise.all(
-			messageEntries.map(({channelId, messageId}) => this.getMessageResponseForAdmin(channelId, messageId)),
-		);
-		const messageResponses = resolvedMessages.filter((message): message is MessageResponse => message !== null);
+		const messageResponses = await createMessageResponseDataService().buildMessages({
+			userId: createUserID(0n),
+			messages: result.messages,
+			access: await this.getMessageResponseAccessForAdmin(channelId),
+		});
 		const attachmentStatuses = await this.getAttachmentStatusesForMessages(messageResponses);
 		const priorReports = await this.getPriorReportsForMessages(messageResponses);
 		const adminMessages = messageResponses.map((message) =>
@@ -282,19 +279,6 @@ export class AdminMessageService {
 		});
 	}
 
-	private async getMessageResponseForAdmin(
-		channelId: ChannelID,
-		messageId: MessageID,
-	): Promise<MessageResponse | null> {
-		const access = await this.getMessageResponseAccessForAdmin(channelId);
-		return createMessageResponseDataService().getMessage({
-			userId: createUserID(0n),
-			channelId,
-			messageId,
-			access,
-		});
-	}
-
 	private async getPriorReportsForMessages(messages: Array<MessageResponse>): Promise<Map<string, Array<string>>> {
 		const authorIds = messages.map((message) => createUserID(BigInt(message.author.id)));
 		return this.deps.ncmecSubmissionService.getUserPriorReportIds(authorIds);

fluxer_api/src/api/admin/services/AdminReportService.ts

@@ -74,7 +74,7 @@ export class AdminReportService {
 		const {reportService} = this.deps;
 		const requestedLimit = limit || 50;
 		const currentOffset = offset || 0;
-		const reports = await reportService.listReportsByStatus(status, requestedLimit, currentOffset);
+		const {reports, total} = await reportService.listReportsByStatus(status, requestedLimit, currentOffset);
 		const requestCache = createRequestCache();
 		const reportNsfwLookupCache = createReportNsfwLookupCache();
 		const reportResponses = await Promise.all(
@@ -84,6 +84,9 @@ export class AdminReportService {
 		);
 		return {
 			reports: reportResponses,
+			total,
+			offset: currentOffset,
+			limit: requestedLimit,
 		};
 	}
 

fluxer_api/src/api/admin/services/AdminSearchService.ts

@@ -5,6 +5,7 @@ import {InputValidationError} from '@fluxer/errors/src/domains/core/InputValidat
 import type {WorkerJobPayload} from '@pkgs/worker/src/contracts/WorkerTypes';
 import type {ApiContext} from '../../ApiContext';
 import {createGuildID, createUserID, type UserID} from '../../BrandedTypes';
+import {isSyntheticUserId} from '../../constants/Core';
 import type {IGuildRepositoryAggregate} from '../../guild/repositories/IGuildRepositoryAggregate';
 import {Logger} from '../../Logger';
 import {getGuildSearchService, getUserSearchService} from '../../SearchFactory';
@@ -129,12 +130,11 @@ export class AdminSearchService {
 			throw new FeatureTemporarilyDisabledError();
 		}
 		const query = data.query?.trim() || '';
-		const isIdQuery = /^\d+$/.test(query);
+		const directUserId = /^\d+$/.test(query) ? createUserID(BigInt(query)) : null;
+		const canResolveDirectUser = directUserId !== null && !isSyntheticUserId(directUserId) && data.offset === 0;
 		const [searchResult, directUser] = await Promise.all([
 			userSearchService.search(query, {}, {limit: data.limit, offset: data.offset}),
-			isIdQuery && data.offset === 0
-				? userRepository.findUnique(createUserID(BigInt(query))).catch(() => null)
-				: Promise.resolve(null),
+			canResolveDirectUser ? userRepository.findUnique(directUserId).catch(() => null) : Promise.resolve(null),
 		]);
 		const {hits, total} = searchResult;
 		const userIds = hits.map((hit) => createUserID(BigInt(hit.id)));

fluxer_api/src/api/admin/services/AdminUserLookupService.ts

@@ -3,6 +3,7 @@
 import type {LookupUserRequest} from '@fluxer/schema/src/domains/admin/AdminUserSchemas';
 import type {ApiContext} from '../../ApiContext';
 import {createUserID} from '../../BrandedTypes';
+import {isSyntheticUserId} from '../../constants/Core';
 import {Logger} from '../../Logger';
 import {mapUserToAdminResponse} from '../models/UserTypes';
 
@@ -32,7 +33,7 @@ export class AdminUserLookupService {
 		} else if (/^\d+$/.test(query)) {
 			try {
 				const userId = createUserID(BigInt(query));
-				user = await userRepository.findUnique(userId);
+				user = isSyntheticUserId(userId) ? null : await userRepository.findUnique(userId);
 			} catch (error) {
 				Logger.debug({query, error}, 'Failed to lookup user by numeric ID, invalid ID format');
 				user = null;

fluxer_api/src/api/admin/services/AdminUserSecurityService.ts

@@ -45,6 +45,7 @@ import {Logger} from '../../Logger';
 import {getInstanceConfigRepository} from '../../middleware/ServiceSingletons';
 import type {IRiskHistoryRepository} from '../../risk/HistoricalOutcomeRepository';
 import type {HistoricalOutcomeCode} from '../../risk/RiskHistoryTypes';
+import {resolveAssignedTraits} from '../../user/UserTraits';
 import {getIpAddressReverse, getLocationLabelFromIp} from '../../utils/IpUtils';
 import {resolveSessionClientInfo} from '../../utils/SessionClientIdentity';
 import {mapUserToAdminResponse} from '../models/UserTypes';
@@ -315,7 +316,7 @@ export class AdminUserSecurityService {
 		if (!user) {
 			throw new UnknownUserError();
 		}
-		await AuthSession.terminateAllUserSessions(this.deps.apiContext, userId);
+		const terminatedCount = await AuthSession.terminateAllUserSessions(this.deps.apiContext, userId);
 		await auditService.createAuditLog({
 			adminUserId,
 			targetType: 'user',
@@ -324,6 +325,7 @@ export class AdminUserSecurityService {
 			auditLogReason,
 			metadata: new Map(),
 		});
+		return {terminated_count: terminatedCount};
 	}
 
 	async setUserAcls(
@@ -382,7 +384,8 @@ export class AdminUserSecurityService {
 		if (!user) {
 			throw new UnknownUserError();
 		}
-		const traitSet = data.traits.length > 0 ? new Set(data.traits) : null;
+		const assigned = resolveAssignedTraits(user.traits ?? [], data.traits);
+		const traitSet = assigned.size > 0 ? assigned : null;
 		const updatedUser = await userRepository.patchUpsert(
 			userId,
 			{

fluxer_api/src/api/admin/services/AdminVoiceService.ts

@@ -235,6 +235,7 @@ export class AdminVoiceService {
 			serverId: data.server_id,
 			endpoint: data.endpoint,
 			isActive: data.is_active ?? true,
+			softConnectionLimit: data.soft_connection_limit ?? null,
 			apiKey: data.api_key ?? null,
 			apiSecret: data.api_secret ?? null,
 			latitude: data.latitude ?? null,
@@ -271,6 +272,7 @@ export class AdminVoiceService {
 		if (data.latitude !== undefined) updates.latitude = data.latitude;
 		if (data.longitude !== undefined) updates.longitude = data.longitude;
 		if (data.is_active !== undefined) updates.isActive = data.is_active;
+		if (data.soft_connection_limit !== undefined) updates.softConnectionLimit = data.soft_connection_limit;
 		updates.restrictions = patchVoiceRestrictions(existing.restrictions, data);
 		updates.updatedAt = new Date();
 		await voiceRepository.upsertServer(updates);
@@ -339,6 +341,7 @@ export class AdminVoiceService {
 			latitude: server.latitude ?? null,
 			longitude: server.longitude ?? null,
 			is_active: server.isActive,
+			soft_connection_limit: server.softConnectionLimit ?? null,
 			vip_only: server.restrictions.vipOnly,
 			required_guild_features: Array.from(server.restrictions.requiredGuildFeatures),
 			allowed_guild_ids: allowedGuildIds,

fluxer_api/src/api/admin/services/guild/AdminGuildUpdateService.ts

@@ -196,6 +196,18 @@ export class AdminGuildUpdateService {
 			patch.nsfw_level = data.nsfw_level;
 			metadata.set('nsfw_level', data.nsfw_level.toString());
 		}
+		if (data.nsfw !== undefined) {
+			patch.nsfw = data.nsfw;
+			metadata.set('nsfw', data.nsfw.toString());
+		}
+		if (data.content_warning_level !== undefined) {
+			patch.content_warning_level = data.content_warning_level;
+			metadata.set('content_warning_level', data.content_warning_level.toString());
+		}
+		if (data.content_warning_text !== undefined) {
+			patch.content_warning_text = data.content_warning_text;
+			metadata.set('content_warning_text', data.content_warning_text ?? '');
+		}
 		if (data.explicit_content_filter !== undefined) {
 			patch.explicit_content_filter = data.explicit_content_filter;
 			metadata.set('explicit_content_filter', data.explicit_content_filter.toString());

fluxer_api/src/api/admin/tests/AdminGuildRoutes.test.ts

@@ -81,15 +81,17 @@ describe('Admin guild routes', () => {
 			.expect(HTTP_STATUS.FORBIDDEN, 'MISSING_ACL')
 			.execute();
 	});
-	test('PATCH /admin/guilds/{guild_id} rejects an empty patch without the wildcard ACL', async () => {
+	test('PATCH /admin/guilds/{guild_id} applies no change for an empty patch', async () => {
 		const admin = await createTestAccount(harness);
 		await setUserACLs(harness, admin, ['admin:authenticate', 'guild:update:name']);
-		const guild = await createGuild(harness, admin.token, `Empty Patch Guild ${Date.now()}`);
-		await createBuilder(harness, `${admin.token}`)
+		const name = `Empty Patch Guild ${Date.now()}`;
+		const guild = await createGuild(harness, admin.token, name);
+		const result = await createBuilder<AdminGuildUpdate>(harness, `${admin.token}`)
 			.patch(`/admin/guilds/${guild.id}`)
 			.body({})
-			.expect(HTTP_STATUS.FORBIDDEN, 'MISSING_ACL')
+			.expect(HTTP_STATUS.OK)
 			.execute();
+		expect(result.guild.name).toBe(name);
 	});
 	test('guild member add, ban and removal use the member and ban sub-resources', async () => {
 		const admin = await createTestAccount(harness);

fluxer_api/src/api/admin/tests/AdminUserDirectory.test.ts

@@ -21,6 +21,8 @@ interface UserListResponse {
 	total: number;
 }
 
+const SYNTHETIC_USER_IDS = ['0', '1'];
+
 async function setLastActiveIp(harness: ApiTestHarness, token: string, ip: string): Promise<void> {
 	await createBuilder(harness, `${token}`)
 		.get('/users/@me')
@@ -170,5 +172,35 @@ describe('Admin user directory', () => {
 			expect(result.users.map((user) => user.id)).toEqual([target.userId]);
 			expect(result.users[0]?.email).toBeNull();
 		});
+		test.each(SYNTHETIC_USER_IDS)('omits the synthetic account %s from the resolve selector', async (userId) => {
+			const admin = await createTestAccount(harness);
+			await setUserACLs(harness, admin, [AdminACLs.AUTHENTICATE, AdminACLs.USER_LOOKUP]);
+			const result = await createBuilder<UserListResponse>(harness, `${admin.token}`)
+				.get(`/admin/users?resolve=${userId}`)
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			expect(result.users).toEqual([]);
+			expect(result.total).toBe(0);
+		});
+		test.each(SYNTHETIC_USER_IDS)('omits the synthetic account %s from the q selector', async (userId) => {
+			const admin = await createTestAccount(harness);
+			await setUserACLs(harness, admin, [AdminACLs.AUTHENTICATE, AdminACLs.USER_LOOKUP]);
+			const result = await createBuilder<UserListResponse>(harness, `${admin.token}`)
+				.get(`/admin/users?q=${userId}`)
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			expect(result.users.map((user) => user.id)).not.toContain(userId);
+		});
+	});
+	describe('GET /admin/users/:user_id', () => {
+		test.each(SYNTHETIC_USER_IDS)('reports no user for the synthetic account %s', async (userId) => {
+			const admin = await createTestAccount(harness);
+			await setUserACLs(harness, admin, [AdminACLs.AUTHENTICATE, AdminACLs.USER_LOOKUP]);
+			const result = await createBuilder<UserListResponse>(harness, `${admin.token}`)
+				.get(`/admin/users/${userId}`)
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			expect(result.users).toEqual([]);
+		});
 	});
 });

fluxer_api/src/api/admin/tests/VoiceAdminController.test.ts

@@ -266,4 +266,161 @@ describe('VoiceAdminController', () => {
 		expect(persisted?.apiKey).toBe(fixture.initialApiKey);
 		expect(persisted?.apiSecret).toBe(fixture.initialApiSecret);
 	});
+	test('stores, keeps, and clears a voice server soft connection limit', async () => {
+		const admin = await createAdminWithAcls(harness, [
+			AdminACLs.VOICE_REGION_CREATE,
+			AdminACLs.VOICE_SERVER_CREATE,
+			AdminACLs.VOICE_SERVER_LIST,
+			AdminACLs.VOICE_SERVER_UPDATE,
+		]);
+		const regionId = 'voice-region-soft-limit';
+		const serverId = 'voice-server-soft-limit';
+		await createBuilder<CreateVoiceRegionResponse>(harness, `${admin.token}`)
+			.post('/admin/voice/regions')
+			.body({
+				id: regionId,
+				name: `Region ${regionId}`,
+				emoji: ':earth_americas:',
+				latitude: 1,
+				longitude: 2,
+			})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		const created = await createBuilder<CreateVoiceServerResponse>(harness, `${admin.token}`)
+			.post(`/admin/voice/regions/${regionId}/servers`)
+			.body({
+				server_id: serverId,
+				endpoint: 'https://voice-soft-limit.example.com/socket',
+				api_key: 'soft-limit-api-key',
+				api_secret: 'soft-limit-api-secret',
+				soft_connection_limit: 250,
+			})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		expect(created.server.soft_connection_limit).toBe(250);
+		expect((await voiceRepository.getServer(regionId, serverId))?.softConnectionLimit).toBe(250);
+		await createBuilder<UpdateVoiceServerResponse>(harness, `${admin.token}`)
+			.patch(`/admin/voice/regions/${regionId}/servers/${serverId}`)
+			.body({endpoint: 'https://voice-soft-limit-2.example.com/socket'})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		expect((await voiceRepository.getServer(regionId, serverId))?.softConnectionLimit).toBe(250);
+		const cleared = await createBuilder<UpdateVoiceServerResponse>(harness, `${admin.token}`)
+			.patch(`/admin/voice/regions/${regionId}/servers/${serverId}`)
+			.body({soft_connection_limit: null})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		expect(cleared.server.soft_connection_limit).toBeNull();
+		expect((await voiceRepository.getServer(regionId, serverId))?.softConnectionLimit).toBeNull();
+	});
+	test('clears voice server restriction lists when empty arrays are supplied', async () => {
+		const admin = await createAdminWithAcls(harness, [
+			AdminACLs.VOICE_REGION_CREATE,
+			AdminACLs.VOICE_SERVER_CREATE,
+			AdminACLs.VOICE_SERVER_UPDATE,
+		]);
+		const regionId = 'voice-region-clear-restrictions';
+		const serverId = 'voice-server-clear-restrictions';
+		await createBuilder<CreateVoiceRegionResponse>(harness, `${admin.token}`)
+			.post('/admin/voice/regions')
+			.body({
+				id: regionId,
+				name: `Region ${regionId}`,
+				emoji: ':earth_americas:',
+				latitude: 1,
+				longitude: 2,
+			})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		await createBuilder<CreateVoiceServerResponse>(harness, `${admin.token}`)
+			.post(`/admin/voice/regions/${regionId}/servers`)
+			.body({
+				server_id: serverId,
+				endpoint: 'https://voice-clear.example.com/socket',
+				api_key: 'clear-api-key',
+				api_secret: 'clear-api-secret',
+				required_guild_features: ['VIP_VOICE'],
+				allowed_guild_ids: [1234567890123456789n.toString()],
+			})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		const stored = await voiceRepository.getServer(regionId, serverId);
+		expect(Array.from(stored?.restrictions.requiredGuildFeatures ?? [])).toEqual(['VIP_VOICE']);
+		expect(stored?.restrictions.allowedGuildIds.size).toBe(1);
+		const cleared = await createBuilder<UpdateVoiceServerResponse>(harness, `${admin.token}`)
+			.patch(`/admin/voice/regions/${regionId}/servers/${serverId}`)
+			.body({required_guild_features: [], allowed_guild_ids: []})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		expect(cleared.server.required_guild_features).toEqual([]);
+		expect(cleared.server.allowed_guild_ids).toEqual([]);
+		const persisted = await voiceRepository.getServer(regionId, serverId);
+		expect(persisted?.restrictions.requiredGuildFeatures.size).toBe(0);
+		expect(persisted?.restrictions.allowedGuildIds.size).toBe(0);
+	});
+	test('leaves voice server restriction lists unchanged when they are omitted', async () => {
+		const admin = await createAdminWithAcls(harness, [
+			AdminACLs.VOICE_REGION_CREATE,
+			AdminACLs.VOICE_SERVER_CREATE,
+			AdminACLs.VOICE_SERVER_UPDATE,
+		]);
+		const regionId = 'voice-region-keep-restrictions';
+		const serverId = 'voice-server-keep-restrictions';
+		await createBuilder<CreateVoiceRegionResponse>(harness, `${admin.token}`)
+			.post('/admin/voice/regions')
+			.body({
+				id: regionId,
+				name: `Region ${regionId}`,
+				emoji: ':earth_americas:',
+				latitude: 1,
+				longitude: 2,
+			})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		await createBuilder<CreateVoiceServerResponse>(harness, `${admin.token}`)
+			.post(`/admin/voice/regions/${regionId}/servers`)
+			.body({
+				server_id: serverId,
+				endpoint: 'https://voice-keep.example.com/socket',
+				api_key: 'keep-api-key',
+				api_secret: 'keep-api-secret',
+				required_guild_features: ['VIP_VOICE'],
+			})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		await createBuilder<UpdateVoiceServerResponse>(harness, `${admin.token}`)
+			.patch(`/admin/voice/regions/${regionId}/servers/${serverId}`)
+			.body({is_active: false})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		const persisted = await voiceRepository.getServer(regionId, serverId);
+		expect(Array.from(persisted?.restrictions.requiredGuildFeatures ?? [])).toEqual(['VIP_VOICE']);
+		expect(persisted?.isActive).toBe(false);
+	});
+	test('rejects a voice server soft connection limit below one', async () => {
+		const admin = await createAdminWithAcls(harness, [AdminACLs.VOICE_REGION_CREATE, AdminACLs.VOICE_SERVER_CREATE]);
+		const regionId = 'voice-region-soft-limit-invalid';
+		await createBuilder<CreateVoiceRegionResponse>(harness, `${admin.token}`)
+			.post('/admin/voice/regions')
+			.body({
+				id: regionId,
+				name: `Region ${regionId}`,
+				emoji: ':earth_americas:',
+				latitude: 1,
+				longitude: 2,
+			})
+			.expect(HTTP_STATUS.OK)
+			.execute();
+		await createBuilder(harness, `${admin.token}`)
+			.post(`/admin/voice/regions/${regionId}/servers`)
+			.body({
+				server_id: 'voice-server-soft-limit-invalid',
+				endpoint: 'https://voice-soft-limit-invalid.example.com/socket',
+				api_key: 'soft-limit-invalid-api-key',
+				api_secret: 'soft-limit-invalid-api-secret',
+				soft_connection_limit: 0,
+			})
+			.expect(HTTP_STATUS.BAD_REQUEST, APIErrorCodes.INVALID_FORM_BODY)
+			.execute();
+	});
 });

fluxer_api/src/api/auth/AuthPassword.ts

@@ -209,7 +209,7 @@ export async function forgotPassword(ctx: ApiContext, {data, request}: ForgotPas
 	}
 	const hasValidDns = await emailDnsValidation.hasValidDnsRecords(data.email);
 	if (!hasValidDns) {
-		throw InputValidationError.fromCode('email', ValidationErrorCodes.INVALID_EMAIL_ADDRESS);
+		throw InputValidationError.fromCode('email', ValidationErrorCodes.EMAIL_DOMAIN_CANNOT_RECEIVE_MAIL);
 	}
 	const user = await users.findByEmail(data.email);
 	if (!user) {

fluxer_api/src/api/auth/AuthRegistration.ts

@@ -187,7 +187,7 @@ export async function register(
 		contactDomain = normalizePolicyContactDomain(extractEmailDomain(rawEmail));
 		const hasValidDns = await emailDnsValidation.hasValidDnsRecords(rawEmail);
 		if (!hasValidDns) {
-			throw InputValidationError.fromCode('email', ValidationErrorCodes.INVALID_EMAIL_ADDRESS);
+			throw InputValidationError.fromCode('email', ValidationErrorCodes.EMAIL_DOMAIN_CANNOT_RECEIVE_MAIL);
 		}
 		contactDomainBlocked = accountPolicyEvaluator.isBlockedRegistrationEmailDomain(contactDomain);
 		if (contactDomainBlocked) {

fluxer_api/src/api/auth/AuthSession.ts

@@ -178,18 +178,19 @@ export async function logoutAuthSessions(
 	});
 }
 
-export async function terminateAllUserSessions(ctx: ApiContext, userId: UserID): Promise<void> {
+export async function terminateAllUserSessions(ctx: ApiContext, userId: UserID): Promise<number> {
 	const {users, gateway} = ctx.services;
 	const authSessions = await users.listAuthSessions(userId);
 	await users.deleteAllPushSubscriptions(userId);
 	await gateway.invalidatePushSubscriptions({userId});
-	if (authSessions.length === 0) return;
+	if (authSessions.length === 0) return 0;
 	const hashes = authSessions.map((s) => s.sessionIdHash);
 	await users.deleteAuthSessions(userId, hashes);
 	await gateway.terminateSession({
 		userId,
 		sessionIdHashes: authSessions.map((s) => Buffer.from(s.sessionIdHash).toString('base64url')),
 	});
+	return authSessions.length;
 }
 
 export async function replaceCurrentAuthSession(

fluxer_api/src/api/auth/tests/DeferredPhoneGate.test.ts

@@ -632,6 +632,8 @@ describe('Deferred phone verification gate', () => {
 			await configurePhoneGate({deferred_phone_gate_window_hours: 0.0001});
 			const outsideWindow = await createGuildWithInvite(harness);
 			await addFillerMember(outsideWindow.inviteCode);
+			const beforeJoin = await readFlags(subject.userId);
+			expect(beforeJoin & DEFERRED_PHONE_ON_COMMUNITY_JOIN).not.toBe(0);
 			await createBuilder(harness, subject.token).post(`/invites/${outsideWindow.inviteCode}`).expect(200).execute();
 
 			const flags = await readFlags(subject.userId);

fluxer_api/src/api/channel/controllers/ChannelController.ts

@@ -123,6 +123,7 @@ export function ChannelController(app: HonoApp) {
 				const existing = await ctx.get('channelService').channelData.operations.getChannel({
 					userId: ctx.get('user').id,
 					channelId,
+					skipNsfwValidation: true,
 				});
 				ctx.set('channelUpdateType', existing.type);
 				return undefined;

fluxer_api/src/api/channel/services/AttachmentUploadService.ts

@@ -11,6 +11,7 @@ import {
 } from '@fluxer/constants/src/LimitConstants';
 import {ValidationErrorCodes} from '@fluxer/constants/src/ValidationErrorCodes';
 import {CannotSendMessageToNonTextChannelError} from '@fluxer/errors/src/domains/channel/CannotSendMessageToNonTextChannelError';
+import {UnknownChannelError} from '@fluxer/errors/src/domains/channel/UnknownChannelError';
 import {UnknownMessageError} from '@fluxer/errors/src/domains/channel/UnknownMessageError';
 import {FeatureTemporarilyDisabledError} from '@fluxer/errors/src/domains/core/FeatureTemporarilyDisabledError';
 import {FileSizeTooLargeError} from '@fluxer/errors/src/domains/core/FileSizeTooLargeError';
@@ -18,6 +19,7 @@ import {InputValidationError} from '@fluxer/errors/src/domains/core/InputValidat
 import {MissingPermissionsError} from '@fluxer/errors/src/domains/core/MissingPermissionsError';
 import {UnknownUserError} from '@fluxer/errors/src/domains/user/UnknownUserError';
 import {ServiceUnavailableError} from '@fluxer/errors/src/HttpErrors';
+import type {GuildResponse} from '@fluxer/schema/src/domains/guild/GuildResponseSchemas';
 import type {
 	CompleteMultipartAttachmentUploadItem,
 	CompleteMultipartAttachmentUploadResult,
@@ -26,7 +28,9 @@ import type {
 } from '@fluxer/schema/src/domains/message/AttachmentUploadSchemas';
 import type {AttachmentID, ChannelID, MessageID, UserID} from '../../BrandedTypes';
 import {Config} from '../../Config';
+import {SYSTEM_USER_ID} from '../../constants/Core';
 import type {IPurgeQueue} from '../../infrastructure/BunnyPurgeQueue';
+import type {IGatewayService} from '../../infrastructure/IGatewayService';
 import type {IStorageService} from '../../infrastructure/IStorageService';
 import type {LimitConfigService} from '../../limits/LimitConfigService';
 import {resolveLimitSafe} from '../../limits/LimitConfigUtils';
@@ -64,6 +68,8 @@ interface DeleteAttachmentParams {
 	requestCache: RequestCache;
 }
 
+type UploadActor = 'member' | 'webhook';
+
 interface UploadFormDataAttachmentsParams {
 	userId: UserID;
 	channelId: ChannelID;
@@ -76,6 +82,7 @@ interface UploadFormDataAttachmentsParams {
 		id: number;
 		filename: string;
 	}>;
+	actor?: UploadActor;
 }
 
 interface RequestPresignedAttachmentUploadUrlsParams {
@@ -104,6 +111,7 @@ export class AttachmentUploadService {
 		private messageInteractionService: MessageInteractionService,
 		private messageService: MessageService,
 		private limitConfigService: LimitConfigService,
+		private gatewayService: IGatewayService,
 	) {}
 
 	async uploadFormDataAttachments({
@@ -112,8 +120,9 @@ export class AttachmentUploadService {
 		clientIp,
 		files,
 		attachmentMetadata,
+		actor = 'member',
 	}: UploadFormDataAttachmentsParams): Promise<Array<UploadedAttachment>> {
-		const {maxFileSize} = await this.getUploadPermissionAndLimit({userId, channelId});
+		const {maxFileSize} = await this.getUploadPermissionAndLimit({userId, channelId, actor});
 		assertAttachmentFileSizesWithinLimit(
 			files.map(({file}) => file.size),
 			maxFileSize,
@@ -168,7 +177,7 @@ export class AttachmentUploadService {
 		if (!Config.presignedAttachmentUploadsEnabled) {
 			throw new FeatureTemporarilyDisabledError();
 		}
-		const {maxFileSize} = await this.getUploadPermissionAndLimit({userId, channelId});
+		const {maxFileSize} = await this.getUploadPermissionAndLimit({userId, channelId, actor: 'member'});
 		assertAttachmentFileSizesWithinLimit(
 			attachments.map(({file_size}) => file_size),
 			maxFileSize,
@@ -275,7 +284,7 @@ export class AttachmentUploadService {
 		if (!Config.presignedAttachmentUploadsEnabled) {
 			throw new FeatureTemporarilyDisabledError();
 		}
-		const {maxFileSize} = await this.getUploadPermissionAndLimit({userId, channelId});
+		const {maxFileSize} = await this.getUploadPermissionAndLimit({userId, channelId, actor: 'member'});
 		const bucket = Config.s3.buckets.uploads;
 		return Promise.all(
 			uploads.map(async ({upload_filename, upload_id}, index) => {
@@ -412,21 +421,24 @@ export class AttachmentUploadService {
 		}
 	}
 
-	private async getUploadPermissionAndLimit({userId, channelId}: {userId: UserID; channelId: ChannelID}): Promise<{
+	private async getUploadPermissionAndLimit({
+		userId,
+		channelId,
+		actor,
+	}: {
+		userId: UserID;
+		channelId: ChannelID;
+		actor: UploadActor;
+	}): Promise<{
 		maxFileSize: number;
 	}> {
-		const {channel, guild, checkPermission, member} =
-			await this.messageInteractionService.authService.getChannelAuthenticated({
-				userId,
-				channelId,
-			});
+		const {channel, guild} =
+			actor === 'webhook'
+				? await this.getWebhookUploadChannel(channelId)
+				: await this.getMemberUploadChannel({userId, channelId});
 		if (!TEXT_BASED_CHANNEL_TYPES.has(channel.type)) {
 			throw new CannotSendMessageToNonTextChannelError();
 		}
-		if (guild) {
-			await checkPermission(Permissions.SEND_MESSAGES | Permissions.ATTACH_FILES);
-			assertGuildMemberCanCommunicate(member);
-		}
 		const user = await this.userRepository.findUnique(userId);
 		if (!user) {
 			throw new UnknownUserError();
@@ -439,6 +451,41 @@ export class AttachmentUploadService {
 		const maxFileSize = user.isBot ? Math.min(resolvedMaxFileSize, ATTACHMENT_MAX_SIZE_BOT) : resolvedMaxFileSize;
 		return {maxFileSize};
 	}
+
+	private async getMemberUploadChannel({userId, channelId}: {userId: UserID; channelId: ChannelID}): Promise<{
+		channel: Channel;
+		guild: GuildResponse | null;
+	}> {
+		const {channel, guild, checkPermission, member} =
+			await this.messageInteractionService.authService.getChannelAuthenticated({
+				userId,
+				channelId,
+			});
+		if (guild) {
+			await checkPermission(Permissions.SEND_MESSAGES | Permissions.ATTACH_FILES);
+			assertGuildMemberCanCommunicate(member);
+		}
+		return {channel, guild};
+	}
+
+	private async getWebhookUploadChannel(channelId: ChannelID): Promise<{
+		channel: Channel;
+		guild: GuildResponse | null;
+	}> {
+		const channel = await this.channelRepository.channelData.findUnique(channelId);
+		if (!channel) {
+			throw new UnknownChannelError();
+		}
+		if (!channel.guildId) {
+			return {channel, guild: null};
+		}
+		const guild = await this.gatewayService.getGuildData({
+			guildId: channel.guildId,
+			userId: SYSTEM_USER_ID,
+			skipMembershipCheck: true,
+		});
+		return {channel, guild};
+	}
 }
 
 async function mapWithConcurrency<T, TResult>(

fluxer_api/src/api/channel/services/ChannelDataService.ts

@@ -111,7 +111,7 @@ export class ChannelDataService {
 		clientFeatures: ReadonlySet<string>;
 		requestCache: RequestCache;
 	}): Promise<Channel> {
-		const {channel} = await this.auth.getChannelAuthenticated({userId, channelId});
+		const {channel} = await this.auth.getChannelAuthenticated({userId, channelId, skipNsfwValidation: true});
 		if (channel.type === ChannelTypes.GROUP_DM) {
 			return await this.groupDmUpdate.updateGroupDmChannel({
 				userId,

fluxer_api/src/api/channel/services/ChannelService.ts

@@ -162,6 +162,7 @@ export class ChannelService {
 			this.interactions,
 			this.messages,
 			limitConfigService,
+			gatewayService,
 		);
 		this.groupDms = new GroupDmOperationsService(
 			channelRepository,

fluxer_api/src/api/channel/services/channel_data/ChannelOperationsService.ts

@@ -7,7 +7,7 @@ import {
 	GUILD_TEXT_BASED_CHANNEL_TYPES,
 	Permissions,
 } from '@fluxer/constants/src/ChannelConstants';
-import {ContentWarningLevel, GuildFeatures} from '@fluxer/constants/src/GuildConstants';
+import {ContentWarningLevel, clampVoiceChannelBitrate, GuildFeatures} from '@fluxer/constants/src/GuildConstants';
 import {MAX_CHANNELS_PER_CATEGORY} from '@fluxer/constants/src/LimitConstants';
 import {ValidationErrorCodes} from '@fluxer/constants/src/ValidationErrorCodes';
 import {InvalidChannelTypeError} from '@fluxer/errors/src/domains/channel/InvalidChannelTypeError';
@@ -90,8 +90,20 @@ export class ChannelOperationsService {
 		private rateLimitService: IRateLimitService,
 	) {}
 
-	async getChannel({userId, channelId}: {userId: UserID; channelId: ChannelID}): Promise<Channel> {
-		const {channel} = await this.channelAuthService.getChannelAuthenticated({userId, channelId});
+	async getChannel({
+		userId,
+		channelId,
+		skipNsfwValidation,
+	}: {
+		userId: UserID;
+		channelId: ChannelID;
+		skipNsfwValidation?: boolean;
+	}): Promise<Channel> {
+		const {channel} = await this.channelAuthService.getChannelAuthenticated({
+			userId,
+			channelId,
+			skipNsfwValidation,
+		});
 		return channel;
 	}
 
@@ -127,6 +139,7 @@ export class ChannelOperationsService {
 		const {channel, guild, checkPermission} = await this.channelAuthService.getChannelAuthenticated({
 			userId,
 			channelId,
+			skipNsfwValidation: true,
 		});
 		if (channel.type === ChannelTypes.GROUP_DM) {
 			throw new InvalidChannelTypeError();
@@ -247,13 +260,17 @@ export class ChannelOperationsService {
 				validateCapacity: requestedParentId !== null && requestedParentId !== (channel.parentId ?? null),
 			});
 		}
+		let nextBitrate = channel.bitrate;
+		if (data.bitrate !== undefined && channel.type === ChannelTypes.GUILD_VOICE) {
+			nextBitrate = data.bitrate === null ? null : clampVoiceChannelBitrate(data.bitrate, guild.features ?? []);
+		}
 		const updatedChannelData = {
 			...channel.toRow(),
 			name: channelName,
 			topic: data.topic !== undefined ? data.topic : channel.topic,
 			url: data.url !== undefined && channel.type === ChannelTypes.GUILD_LINK ? data.url : channel.url,
 			parent_id: requestedParentId,
-			bitrate: data.bitrate !== undefined && channel.type === ChannelTypes.GUILD_VOICE ? data.bitrate : channel.bitrate,
+			bitrate: nextBitrate,
 			user_limit:
 				data.user_limit !== undefined && channel.type === ChannelTypes.GUILD_VOICE
 					? data.user_limit
@@ -456,7 +473,11 @@ export class ChannelOperationsService {
 		if (this.voiceAvailabilityService === null) {
 			return [];
 		}
-		const {channel, guild} = await this.channelAuthService.getChannelAuthenticated({userId, channelId});
+		const {channel, guild} = await this.channelAuthService.getChannelAuthenticated({
+			userId,
+			channelId,
+			skipNsfwValidation: true,
+		});
 		if (channel.type !== ChannelTypes.GUILD_VOICE) {
 			throw new InvalidChannelTypeError();
 		}

fluxer_api/src/api/channel/services/interaction/MessagePinService.ts

@@ -24,6 +24,8 @@ import type {MessagePersistenceService} from '../message/MessagePersistenceServi
 import {createMessageResponseDataService} from '../message/MessageResponseDataService';
 import {MessageInteractionBase} from './MessageInteractionBase';
 
+const PIN_LIST_UNBOUNDED_TIMESTAMP = new Date('9999-12-31T23:59:59.999Z');
+
 export class MessagePinService extends MessageInteractionBase {
 	constructor(
 		gatewayService: IGatewayService,
@@ -81,7 +83,7 @@ export class MessagePinService extends MessageInteractionBase {
 		const pageSize = Math.min(limit ?? 50, 50);
 		const cutoffTimestamp = hasReadHistory ? null : new Date(authChannel.guild!.message_history_cutoff!).getTime();
 		const filtered: Array<Message> = [];
-		let before = beforeTimestamp ?? new Date();
+		let before = beforeTimestamp ?? PIN_LIST_UNBOUNDED_TIMESTAMP;
 		let exhausted = false;
 		while (filtered.length <= pageSize && !exhausted) {
 			const messages = await this.channelRepository.messageInteractions.listChannelPins(

fluxer_api/src/api/channel/services/message/MessageHelpers.ts

@@ -308,7 +308,7 @@ export async function createMessageSnapshotsForForward(
 	return [new MessageSnapshotModel(snapshotData)];
 }
 
-function collectEmbedReferencedAttachmentCdnKeys(message: Message): Array<string> {
+function collectEmbedReferencedAttachmentCdnKeys(message: Message, ownKeys: ReadonlySet<string>): Array<string> {
 	const mediaPrefix = `${Config.endpoints.media}/`;
 	const keys = new Set<string>();
 	const consider = (url: string | null | undefined): void => {
@@ -316,7 +316,7 @@ function collectEmbedReferencedAttachmentCdnKeys(message: Message): Array<string
 			return;
 		}
 		const key = url.slice(mediaPrefix.length);
-		if (key.startsWith('attachments/')) {
+		if (ownKeys.has(key)) {
 			keys.add(key);
 		}
 	};
@@ -342,6 +342,11 @@ export async function purgeMessageAttachments(
 ): Promise<void> {
 	const cdnKeys = new Set<string>();
 	const cdnUrls: Array<string> = [];
+	const ownedCdnKeys = new Set<string>(
+		collectMessageAttachments(message).map((attachment) =>
+			makeAttachmentCdnKey(message.channelId, attachment.id, attachment.filename),
+		),
+	);
 	for (const attachment of collectMessageAttachments(message)) {
 		const cdnKey = makeAttachmentCdnKey(message.channelId, attachment.id, attachment.filename);
 		if (cdnKeys.has(cdnKey)) {
@@ -352,7 +357,7 @@ export async function purgeMessageAttachments(
 			cdnUrls.push(makeAttachmentCdnUrl(message.channelId, attachment.id, attachment.filename));
 		}
 	}
-	for (const embedKey of collectEmbedReferencedAttachmentCdnKeys(message)) {
+	for (const embedKey of collectEmbedReferencedAttachmentCdnKeys(message, ownedCdnKeys)) {
 		if (cdnKeys.has(embedKey)) {
 			continue;
 		}

fluxer_api/src/api/channel/services/message/MessageProcessingService.test.ts

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {ChannelTypes} from '@fluxer/constants/src/ChannelConstants';
+import {describe, expect, it} from 'vitest';
+import {
+	type ChannelID,
+	createChannelID,
+	createMessageID,
+	createUserID,
+	type MessageID,
+	type UserID,
+} from '../../../BrandedTypes';
+import type {ChannelRow} from '../../../database/types/ChannelTypes';
+import type {IGatewayService} from '../../../infrastructure/IGatewayService';
+import type {UserCacheService} from '../../../infrastructure/UserCacheService';
+import type {RequestCache} from '../../../middleware/RequestCacheMiddleware';
+import {Channel} from '../../../models/Channel';
+import type {IUserRepository} from '../../../user/IUserRepository';
+import {MessageProcessingService} from './MessageProcessingService';
+
+const CHANNEL_ID = createChannelID(1532860318772891648n);
+const AUTHOR_ID = createUserID(1471426754353995881n);
+const RECIPIENT_ID = createUserID(1485344055661987728n);
+const MESSAGE_ID = createMessageID(1546325276953149440n);
+
+function dmChannelRow(lastMessageId: MessageID | null): ChannelRow {
+	return {
+		channel_id: CHANNEL_ID,
+		guild_id: null,
+		type: ChannelTypes.DM,
+		name: null,
+		topic: null,
+		icon_hash: null,
+		url: null,
+		parent_id: null,
+		position: null,
+		owner_id: null,
+		recipient_ids: new Set<UserID>([AUTHOR_ID, RECIPIENT_ID]),
+		nsfw: null,
+		content_warning_level: null,
+		content_warning_text: null,
+		rate_limit_per_user: null,
+		bitrate: null,
+		user_limit: null,
+		voice_connection_limit: null,
+		rtc_region: null,
+		last_message_id: lastMessageId,
+		last_pin_timestamp: null,
+		permission_overwrites: null,
+		nicks: null,
+		soft_deleted: false,
+		indexed_at: null,
+		version: 0,
+	};
+}
+
+function buildService(): {service: MessageProcessingService; opened: Array<Channel>} {
+	const opened: Array<Channel> = [];
+	const userRepository = {
+		isDmChannelOpen: async (userId: UserID, _channelId: ChannelID) => userId === AUTHOR_ID,
+		openPrivateChannelForUser: async (_userId: UserID, channel: Channel) => {
+			opened.push(channel);
+		},
+	} as unknown as IUserRepository;
+	const userCacheService = {
+		getUserPartialResponses: async (userIds: Array<UserID>) =>
+			new Map(userIds.map((userId) => [userId, {id: userId.toString()}])),
+	} as unknown as UserCacheService;
+	const gatewayService = {
+		dispatchPresence: async () => {},
+	} as unknown as IGatewayService;
+	const service = new MessageProcessingService(
+		undefined as never,
+		userRepository,
+		userCacheService,
+		gatewayService,
+		undefined as never,
+		undefined as never,
+	);
+	return {service, opened};
+}
+
+describe('MessageProcessingService.updateDMRecipients', () => {
+	it('snapshots the new message id when the in-request channel is stale', async () => {
+		const {service, opened} = buildService();
+		await service.updateDMRecipients({
+			channel: new Channel(dmChannelRow(null)),
+			channelId: CHANNEL_ID,
+			messageId: MESSAGE_ID,
+			requestCache: {} as RequestCache,
+		});
+		expect(opened).toHaveLength(1);
+		expect(opened[0].lastMessageId).toBe(MESSAGE_ID);
+	});
+
+	it('keeps a newer last message id already present on the channel', async () => {
+		const {service, opened} = buildService();
+		const newer = createMessageID(MESSAGE_ID + 10n);
+		await service.updateDMRecipients({
+			channel: new Channel(dmChannelRow(newer)),
+			channelId: CHANNEL_ID,
+			messageId: MESSAGE_ID,
+			requestCache: {} as RequestCache,
+		});
+		expect(opened).toHaveLength(1);
+		expect(opened[0].lastMessageId).toBe(newer);
+	});
+});

fluxer_api/src/api/channel/services/message/MessageProcessingService.ts

@@ -9,7 +9,7 @@ import type {GatewayChannelMention, IGatewayService} from '../../../infrastructu
 import type {UserCacheService} from '../../../infrastructure/UserCacheService';
 import {Logger} from '../../../Logger';
 import type {RequestCache} from '../../../middleware/RequestCacheMiddleware';
-import type {Channel} from '../../../models/Channel';
+import {Channel} from '../../../models/Channel';
 import type {Message} from '../../../models/Message';
 import type {User} from '../../../models/User';
 import type {ReadStateService} from '../../../read_state/ReadStateService';
@@ -33,6 +33,13 @@ interface MentionProcessingResult {
 	mentionChannels: Array<GatewayChannelMention>;
 }
 
+function channelWithLastMessageId(channel: Channel, messageId: MessageID): Channel {
+	if (channel.lastMessageId != null && channel.lastMessageId >= messageId) {
+		return channel;
+	}
+	return new Channel({...channel.toRow(), last_message_id: messageId});
+}
+
 export class MessageProcessingService {
 	constructor(
 		private channelRepository: IChannelRepositoryAggregate,
@@ -64,10 +71,12 @@ export class MessageProcessingService {
 	async updateDMRecipients({
 		channel,
 		channelId,
+		messageId,
 		requestCache,
 	}: {
 		channel: Channel;
 		channelId: ChannelID;
+		messageId: MessageID;
 		requestCache: RequestCache;
 	}): Promise<void> {
 		if (channel.guildId || channel.type !== ChannelTypes.DM) return;
@@ -76,11 +85,12 @@ export class MessageProcessingService {
 		const openStates = await this.batchCheckDmChannelOpen(recipientIds, channelId);
 		const closedRecipients = openStates.filter((state) => !state.isOpen);
 		if (closedRecipients.length === 0) return;
+		const snapshotChannel = channelWithLastMessageId(channel, messageId);
 		await Promise.all(
 			closedRecipients.map((state) =>
 				this.openDmAndDispatch({
 					recipientId: state.recipientId,
-					channel,
+					channel: snapshotChannel,
 					requestCache,
 				}),
 			),

fluxer_api/src/api/channel/services/message/MessageRequestParser.ts

@@ -34,6 +34,7 @@ type AttachmentMetadata = ClientAttachmentRequest | ClientUploadedAttachmentRequ
 
 interface ParseMultipartMessageDataOptions {
 	onPayloadParsed?: (payload: unknown) => void;
+	actor?: 'member' | 'webhook';
 }
 
 export async function parseMultipartMessageData(
@@ -158,6 +159,7 @@ export async function parseMultipartMessageData(
 				clientIp,
 				files: filesWithIndices,
 				attachmentMetadata: inlineNewAttachments,
+				actor: options?.actor,
 			});
 		const uploadedMap = new Map(uploadedAttachments.map((attachment) => [attachment.id, attachment]));
 		const processedInlineAttachments = inlineNewAttachments.map((clientData) => {

fluxer_api/src/api/channel/services/message/MessageRetrievalService.ts

@@ -4,11 +4,10 @@ import {ChannelTypes, Permissions} from '@fluxer/constants/src/ChannelConstants'
 import {UnknownMessageError} from '@fluxer/errors/src/domains/channel/UnknownMessageError';
 import {FeatureTemporarilyDisabledError} from '@fluxer/errors/src/domains/core/FeatureTemporarilyDisabledError';
 import type {MessageSearchRequest} from '@fluxer/schema/src/domains/message/MessageRequestSchemas';
-import type {MessageResponse, MessageSearchResponse} from '@fluxer/schema/src/domains/message/MessageResponseSchemas';
+import type {MessageSearchResponse} from '@fluxer/schema/src/domains/message/MessageResponseSchemas';
 import {snowflakeToDate} from '@fluxer/snowflake/src/Snowflake';
 import {AttachmentDecayService} from '../../../attachment/AttachmentDecayService';
 import type {AttachmentID, ChannelID, MessageID, UserID} from '../../../BrandedTypes';
-import {createChannelID, createMessageID} from '../../../BrandedTypes';
 import type {UserCacheService} from '../../../infrastructure/UserCacheService';
 import type {RequestCache} from '../../../middleware/RequestCacheMiddleware';
 import type {Channel} from '../../../models/Channel';
@@ -192,29 +191,19 @@ export class MessageRetrievalService {
 			hitsPerPage,
 			page,
 		});
-		const messageEntries = result.hits.map((hit) => ({
-			channelId: createChannelID(BigInt(hit.channelId)),
-			messageId: createMessageID(BigInt(hit.id)),
-		}));
 		const access = {
 			sourceGuildId: channel.guildId,
 			messageHistoryCutoff: !hasReadHistory ? (authChannel.guild?.message_history_cutoff ?? null) : null,
 			canReadMessageHistory: hasReadHistory,
 		};
-		const responseDataService = createMessageResponseDataService();
-		const foundMessages = await Promise.all(
-			messageEntries.map(({channelId, messageId}) =>
-				responseDataService.getMessage({
-					userId,
-					channelId,
-					messageId,
-					access,
-				}),
-			),
+		const builtMessages = await createMessageResponseDataService().buildMessages({
+			userId,
+			messages: result.messages,
+			access,
+		});
+		const messageResponses = builtMessages.map(
+			({referenced_message: _referencedMessage, ...searchMessage}) => searchMessage,
 		);
-		const messageResponses = foundMessages
-			.filter((message): message is MessageResponse => message !== null)
-			.map(({referenced_message: _referencedMessage, ...searchMessage}) => searchMessage);
 		return {
 			channels: messageResponses.length > 0 ? [await this.mapSearchChannelResponse(channel, userId, requestCache)] : [],
 			messages: messageResponses,

fluxer_api/src/api/channel/services/message/MessageSendService.ts

@@ -9,7 +9,12 @@ import {
 	SENDABLE_MESSAGE_FLAGS,
 } from '@fluxer/constants/src/ChannelConstants';
 import {GuildNSFWLevel, GuildOperations} from '@fluxer/constants/src/GuildConstants';
-import {RelationshipTypes, SensitiveMediaFilterLevel, UserFlags} from '@fluxer/constants/src/UserConstants';
+import {
+	DELETED_USER_ID,
+	RelationshipTypes,
+	SensitiveMediaFilterLevel,
+	UserFlags,
+} from '@fluxer/constants/src/UserConstants';
 import {ValidationErrorCodes} from '@fluxer/constants/src/ValidationErrorCodes';
 import {UnknownChannelError} from '@fluxer/errors/src/domains/channel/UnknownChannelError';
 import {UnknownMessageError} from '@fluxer/errors/src/domains/channel/UnknownMessageError';
@@ -211,15 +216,18 @@ export class MessageSendService {
 		return processed.length > 0 ? processed : undefined;
 	}
 
-	private resolveWebhookAttachmentUploadUserId(
+	private async resolveWebhookAttachmentUploadUserId(
 		webhook: Webhook,
 		attachments?: Array<AttachmentRequestData>,
-	): UserID | undefined {
-		const uploadUserId = webhook.creatorId ?? undefined;
-		if (uploadUserId === undefined && this.attachmentsToProcess(attachments) !== undefined) {
-			throw InputValidationError.fromCode('attachments', ValidationErrorCodes.INVALID_MESSAGE_DATA);
+	): Promise<UserID | undefined> {
+		if (this.attachmentsToProcess(attachments) === undefined) {
+			return webhook.creatorId ?? undefined;
 		}
-		return uploadUserId;
+		if (!webhook.creatorId) {
+			return createUserID(DELETED_USER_ID);
+		}
+		const creator = await this.deps.userRepository.findUnique(webhook.creatorId);
+		return creator ? webhook.creatorId : createUserID(DELETED_USER_ID);
 	}
 
 	private getOneToOneDmRecipientId(channel: Channel, senderId: UserID): UserID | null {
@@ -980,7 +988,7 @@ export class MessageSendService {
 			await this.settlePostCreateWork(messageId, [
 				{
 					step: 'update_dm_recipients',
-					promise: this.deps.processingService.updateDMRecipients({channel, channelId, requestCache}),
+					promise: this.deps.processingService.updateDMRecipients({channel, channelId, messageId, requestCache}),
 				},
 				{
 					step: 'process_message_after_creation',
@@ -1184,7 +1192,7 @@ export class MessageSendService {
 			flags: this.deps.validationService.calculateMessageFlags(data),
 			embeds: data.embeds,
 			attachments: this.attachmentsToProcess(data.attachments),
-			attachmentUploadUserId: this.resolveWebhookAttachmentUploadUserId(webhook, data.attachments),
+			attachmentUploadUserId: await this.resolveWebhookAttachmentUploadUserId(webhook, data.attachments),
 			stickerIds: data.sticker_ids ? data.sticker_ids.flatMap((stickerId) => createStickerID(stickerId)) : undefined,
 			messageReference,
 			messageSnapshots,
@@ -1269,7 +1277,7 @@ export class MessageSendService {
 			data,
 			channel,
 			guild,
-			attachmentUploadUserId: this.resolveWebhookAttachmentUploadUserId(webhook, data.attachments),
+			attachmentUploadUserId: await this.resolveWebhookAttachmentUploadUserId(webhook, data.attachments),
 			allowEmbeds: true,
 		});
 		await this.deps.dispatchService.dispatchMessageUpdate({channel, message: updatedMessage, requestCache});

fluxer_api/src/api/channel/tests/ChannelOperationPermissions.test.ts

@@ -46,6 +46,18 @@ describe('Channel Operation Permissions', () => {
 			.expect(HTTP_STATUS.FORBIDDEN)
 			.execute();
 	});
+	it('should let a minor manage a mature channel without reading it', async () => {
+		const owner = await createTestAccount(harness, {dateOfBirth: '2010-01-01'});
+		const guild = await createGuild(harness, owner.token, 'Mature Channel Guild');
+		const systemChannel = await getChannel(harness, owner.token, guild.system_channel_id!);
+		await updateChannel(harness, owner.token, systemChannel.id, {nsfw: true});
+		const renamed = await updateChannel(harness, owner.token, systemChannel.id, {name: 'still-manageable'});
+		expect(renamed.name).toBe('still-manageable');
+		await createBuilder(harness, owner.token)
+			.get(`/channels/${systemChannel.id}/messages`)
+			.expect(HTTP_STATUS.FORBIDDEN)
+			.execute();
+	});
 	it('should reject member from updating channel without MANAGE_CHANNELS', async () => {
 		const owner = await createTestAccount(harness);
 		const member = await createTestAccount(harness);

fluxer_api/src/api/config/APIConfig.ts

@@ -226,17 +226,29 @@ export interface APIConfig {
 			monthlyUsd?: string;
 			monthlyEur?: string;
 			monthlyBrl?: string;
+			monthlyDkk?: string;
 			monthlyInr?: string;
+			monthlyNok?: string;
 			monthlyPln?: string;
+			monthlySek?: string;
 			monthlyTry?: string;
 			yearlyUsd?: string;
 			yearlyEur?: string;
 			yearlyBrl?: string;
+			yearlyDkk?: string;
 			yearlyInr?: string;
+			yearlyNok?: string;
 			yearlyPln?: string;
+			yearlySek?: string;
 			yearlyTry?: string;
 			gift1MonthUsd?: string;
 			gift1MonthEur?: string;
+			gift1MonthSek?: string;
+			gift1YearSek?: string;
+			gift1MonthDkk?: string;
+			gift1YearDkk?: string;
+			gift1MonthNok?: string;
+			gift1YearNok?: string;
 			gift1MonthBrl?: string;
 			gift1MonthInr?: string;
 			gift1MonthPln?: string;
@@ -248,6 +260,7 @@ export interface APIConfig {
 			gift1YearPln?: string;
 			gift1YearTry?: string;
 		};
+		legacyPrices?: Record<string, Array<string> | undefined>;
 	};
 	bunny: {
 		purgeEnabled: boolean;

fluxer_api/src/api/constants/Core.ts

@@ -1,5 +1,10 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import {createUserID} from '../BrandedTypes';
+import {DELETED_USER_ID} from '@fluxer/constants/src/UserConstants';
+import {createUserID, type UserID} from '../BrandedTypes';
 
 export const SYSTEM_USER_ID = createUserID(0n);
+
+export function isSyntheticUserId(userId: UserID): boolean {
+	return userId === SYSTEM_USER_ID || userId === DELETED_USER_ID;
+}

fluxer_api/src/api/database/types/VoiceTypes.ts

@@ -39,6 +39,7 @@ export interface VoiceServerRow {
 	latitude: number | null;
 	longitude: number | null;
 	is_active: boolean | null;
+	soft_connection_limit: number | null;
 	vip_only: boolean | null;
 	required_guild_features: Set<string> | null;
 	allowed_guild_ids: Set<bigint> | null;
@@ -56,6 +57,7 @@ export const VOICE_SERVER_COLUMNS = [
 	'latitude',
 	'longitude',
 	'is_active',
+	'soft_connection_limit',
 	'vip_only',
 	'required_guild_features',
 	'allowed_guild_ids',

fluxer_api/src/api/donation/services/DonationCheckoutService.ts

@@ -40,7 +40,7 @@ export class DonationCheckoutService {
 		}
 		const hasValidDns = await this.emailDnsValidationService.hasValidDnsRecords(params.email);
 		if (!hasValidDns) {
-			throw InputValidationError.fromCode('email', ValidationErrorCodes.INVALID_EMAIL_ADDRESS);
+			throw InputValidationError.fromCode('email', ValidationErrorCodes.EMAIL_DOMAIN_CANNOT_RECEIVE_MAIL);
 		}
 		const isRecurring = params.interval !== null;
 		const existingDonor = await this.donationRepository.findDonorByEmail(params.email);

fluxer_api/src/api/donation/services/DonationMagicLinkService.ts

@@ -24,7 +24,7 @@ export class DonationMagicLinkService {
 	async sendMagicLink(email: string): Promise<void> {
 		const hasValidDns = await this.emailDnsValidationService.hasValidDnsRecords(email);
 		if (!hasValidDns) {
-			throw InputValidationError.fromCode('email', ValidationErrorCodes.INVALID_EMAIL_ADDRESS);
+			throw InputValidationError.fromCode('email', ValidationErrorCodes.EMAIL_DOMAIN_CANNOT_RECEIVE_MAIL);
 		}
 		const donor = await this.donationRepository.findDonorByEmail(email);
 		if (!donor) {

fluxer_api/src/api/download/DownloadService.ts

@@ -17,7 +17,7 @@ import {
 	StorageObjectRangeNotSatisfiableError,
 } from '../infrastructure/IStorageService';
 import {Logger} from '../Logger';
-import {isJsonRecord, parseJsonRecord, parseJsonUnknown} from '../utils/JsonBoundaryUtils';
+import {isJsonRecord, parseJsonRecord} from '../utils/JsonBoundaryUtils';
 import {
 	parseDesktopArtifactScope,
 	parseDesktopReleaseDescriptor,
@@ -58,6 +58,7 @@ function isUnsatisfiableRangeError(error: unknown): boolean {
 	);
 }
 const MAX_DESKTOP_OBJECTS_PER_PREFIX = 10_000;
+const MAX_DESKTOP_RELEASE_CANDIDATES = 10;
 const DESKTOP_BUCKET_PREFIX = 'desktop';
 const DESKTOP_TEST_BUCKET_PREFIX = 'desktop-test';
 const DOWNLOAD_KEY_ALLOWED_PREFIXES = [`${DESKTOP_BUCKET_PREFIX}/`, `${DESKTOP_TEST_BUCKET_PREFIX}/`];
@@ -198,6 +199,14 @@ export type GitHubDesktopReleaseResolution =
 	| {kind: 'awaiting_release'}
 	| {kind: 'ready'; location: string};
 
+type DesktopReleaseState = {kind: 'untracked'} | {kind: 'unpublished'} | {kind: 'published'; descriptorText: string};
+
+type ListedDesktopVersion = {
+	version: string;
+	pub_date: Date;
+	files: Map<DesktopFormat, {filename: string; sha256Key: string | null}>;
+};
+
 export class DownloadService {
 	constructor(private readonly storageService: IStorageService) {}
 
@@ -216,41 +225,28 @@ export class DownloadService {
 		) {
 			return {kind: 'not_current'};
 		}
-		const descriptorKey = `${DESKTOP_BUCKET_PREFIX}/${scope.channel}/${GITHUB_RELEASE_MARKER_DIRECTORY}/${manifest.version}.json`;
-		const descriptorText = await this.readOptionalTextFromStorage(descriptorKey);
-		if (descriptorText == null) {
+		const release = await this.readDesktopReleaseState(scope.channel, manifest.version);
+		if (release.kind === 'untracked') {
 			return {kind: 'not_current'};
 		}
-		const descriptor = parseDesktopReleaseDescriptor(parseJsonUnknown(descriptorText));
+		if (release.kind === 'unpublished') {
+			return {kind: 'awaiting_release'};
+		}
+		const descriptor = parseDesktopReleaseDescriptor(parseJsonRecord(release.descriptorText));
 		if (
 			!descriptor ||
 			descriptor.channel !== scope.channel ||
 			descriptor.version !== manifest.version ||
 			descriptor.release_tag !== `fluxer-desktop-${scope.channel}@${manifest.version}`
 		) {
-			throw new Error(`Invalid GitHub desktop release descriptor: ${descriptorKey}`);
+			throw new Error(
+				`Invalid GitHub desktop release descriptor: ${DESKTOP_BUCKET_PREFIX}/${scope.channel}/${GITHUB_RELEASE_MARKER_DIRECTORY}/${manifest.version}.json`,
+			);
 		}
 		const releaseAsset = descriptor.assets.find((asset) => asset.storage_key === key);
 		if (!releaseAsset) {
 			return {kind: 'not_current'};
 		}
-		const markerKey = `${DESKTOP_BUCKET_PREFIX}/${scope.channel}/${GITHUB_RELEASE_MARKER_DIRECTORY}/${manifest.version}.ready.json`;
-		const marker = await this.readOptionalJsonObjectFromStorage(markerKey);
-		if (marker == null) {
-			return {kind: 'awaiting_release'};
-		}
-		const readiness = parseDesktopReleaseReadiness(marker);
-		const descriptorSha256 = createHash('sha256').update(descriptorText).digest('hex');
-		if (
-			!readiness ||
-			readiness.channel !== descriptor.channel ||
-			readiness.version !== descriptor.version ||
-			readiness.release_tag !== descriptor.release_tag ||
-			readiness.source_sha !== descriptor.source_sha ||
-			readiness.descriptor_sha256 !== descriptorSha256
-		) {
-			throw new Error(`Invalid GitHub desktop release readiness marker: ${markerKey}`);
-		}
 		return {
 			kind: 'ready',
 			location: `${GITHUB_RELEASE_DOWNLOAD_BASE_URL}/${encodeURIComponent(descriptor.release_tag)}/${encodeURIComponent(releaseAsset.release_asset)}`,
@@ -269,18 +265,22 @@ export class DownloadService {
 			return null;
 		}
 		const manifestKey = `${prefix}/manifest.json`;
+		const releasability = new Map<string, boolean>();
 		try {
 			const manifest = await this.readJsonObjectFromStorage(manifestKey);
-			if (!isDesktopManifest(manifest)) {
-				return this.resolveLatestDesktopKeyFromObjects(params);
+			if (
+				!isDesktopManifest(manifest) ||
+				!(await this.isReleasableDesktopVersion(params, manifest.version, releasability))
+			) {
+				return this.resolveLatestDesktopKeyFromObjects(params, releasability);
 			}
 			const entry = manifest.files[params.format];
 			if (!entry) {
-				return this.resolveLatestDesktopKeyFromObjects(params);
+				return this.resolveLatestDesktopKeyFromObjects(params, releasability);
 			}
 			const filename = this.extractFilename(entry);
 			if (filename.trim().length === 0) {
-				return this.resolveLatestDesktopKeyFromObjects(params);
+				return this.resolveLatestDesktopKeyFromObjects(params, releasability);
 			}
 			const resolvedFilename = await this.resolveManifestFilename({
 				channel: params.channel,
@@ -291,7 +291,11 @@ export class DownloadService {
 				test: params.test,
 			});
 			if (!resolvedFilename) {
-				return this.resolveLatestDesktopKeyFromObjects(params);
+				return this.resolveLatestDesktopKeyFromObjects(params, releasability);
+			}
+			const parsed = this.parseVersionFromFilename(resolvedFilename, params.channel, params.plat, params.arch);
+			if (parsed && parsed.version !== manifest.version) {
+				return this.resolveLatestDesktopKeyFromObjects(params, releasability);
 			}
 			return this.buildDesktopArtifactKey({
 				channel: params.channel,
@@ -302,7 +306,7 @@ export class DownloadService {
 			});
 		} catch (error) {
 			if (error instanceof S3ServiceException && (error.name === 'NoSuchKey' || error.name === 'NotFound')) {
-				return this.resolveLatestDesktopKeyFromObjects(params);
+				return this.resolveLatestDesktopKeyFromObjects(params, releasability);
 			}
 			throw error;
 		}
@@ -320,10 +324,14 @@ export class DownloadService {
 			return null;
 		}
 		const manifestKey = `${prefix}/manifest.json`;
+		const releasability = new Map<string, boolean>();
 		try {
 			const manifest = await this.readJsonObjectFromStorage(manifestKey);
-			if (!isDesktopManifest(manifest)) {
-				return this.getLatestDesktopVersionFromObjects(params);
+			if (
+				!isDesktopManifest(manifest) ||
+				!(await this.isReleasableDesktopVersion(params, manifest.version, releasability))
+			) {
+				return this.getLatestDesktopVersionFromObjects(params, releasability);
 			}
 			const result = await this.getLatestDesktopVersionFromManifest(params, manifest);
 			if (result) {
@@ -331,11 +339,11 @@ export class DownloadService {
 			}
 		} catch (error) {
 			if (error instanceof S3ServiceException && (error.name === 'NoSuchKey' || error.name === 'NotFound')) {
-				return this.getLatestDesktopVersionFromObjects(params);
+				return this.getLatestDesktopVersionFromObjects(params, releasability);
 			}
 			throw error;
 		}
-		return this.getLatestDesktopVersionFromObjects(params);
+		return this.getLatestDesktopVersionFromObjects(params, releasability);
 	}
 
 	async listDesktopVersions(params: {
@@ -351,158 +359,17 @@ export class DownloadService {
 		versions: Array<VersionInfo>;
 		hasMore: boolean;
 	}> {
-		const basePrefix = desktopArtifactPrefix(params);
-		if (!basePrefix) {
-			return {versions: [], hasMore: false};
+		let listedVersions = await this.listDesktopVersionFiles(params);
+		if (params.before) {
+			listedVersions = listedVersions.filter((entry) => this.compareVersions(entry.version, params.before ?? '') > 0);
 		}
-		const prefix = `${basePrefix}/`;
-		try {
-			const objects = await this.listDesktopArtifacts(prefix);
-			if (objects.length === 0) {
-				return {versions: [], hasMore: false};
-			}
-			const versionMap = new Map<
-				string,
-				{
-					pub_date: Date;
-					files: Map<
-						DesktopFormat,
-						{
-							filename: string;
-							sha256Key: string | null;
-						}
-					>;
-				}
-			>();
-			const sha256Files = new Set<string>();
-			for (const obj of objects) {
-				if (obj.key.endsWith('.sha256')) {
-					sha256Files.add(obj.key);
-				}
-			}
-			for (const obj of objects) {
-				const filename = obj.key.slice(prefix.length);
-				if (filename.includes('/') || filename.endsWith('.sha256') || filename === 'manifest.json') {
-					continue;
-				}
-				const parsed = this.parseVersionFromFilename(filename, params.channel, params.plat, params.arch);
-				if (!parsed) {
-					continue;
-				}
-				const {version, format} = parsed;
-				const sha256Key = sha256Files.has(`${obj.key}.sha256`) ? `${obj.key}.sha256` : null;
-				if (!versionMap.has(version)) {
-					versionMap.set(version, {
-						pub_date: obj.lastModified ?? new Date(),
-						files: new Map(),
-					});
-				}
-				const entry = versionMap.get(version);
-				if (entry) {
-					if (!entry.files.has(format)) {
-						entry.files.set(format, {filename, sha256Key});
-					}
-					if (obj.lastModified && obj.lastModified > entry.pub_date) {
-						entry.pub_date = obj.lastModified;
-					}
-				}
-			}
-			const sortedVersions = Array.from(versionMap.keys()).sort(this.compareVersions);
-			let filteredVersions = sortedVersions;
-			if (params.before) {
-				filteredVersions = filteredVersions.filter((v) => this.compareVersions(v, params.before ?? '') > 0);
-			}
-			if (params.after) {
-				filteredVersions = filteredVersions.filter((v) => this.compareVersions(v, params.after ?? '') < 0);
-			}
-			const hasMore = filteredVersions.length > params.limit;
-			const paginatedVersions = filteredVersions.slice(0, params.limit);
-			const sha256Promises: Array<
-				Promise<{
-					key: string;
-					hash: string | null;
-				}>
-			> = [];
-			for (const version of paginatedVersions) {
-				const entry = versionMap.get(version);
-				if (!entry) {
-					continue;
-				}
-				for (const [, fileInfo] of entry.files) {
-					if (fileInfo.sha256Key) {
-						sha256Promises.push(
-							(async () => {
-								try {
-									const streamResult = await this.storageService.streamObject({
-										bucket: Config.s3.buckets.downloads,
-										key: fileInfo.sha256Key as string,
-									});
-									if (streamResult) {
-										const body = Readable.toWeb(streamResult.body);
-										const text = await new Response(body as ReadableStream).text();
-										return {key: fileInfo.sha256Key as string, hash: text.trim().split(/\s+/u)[0]};
-									}
-								} catch {
-									return {key: fileInfo.sha256Key as string, hash: null};
-								}
-								return {key: fileInfo.sha256Key as string, hash: null};
-							})(),
-						);
-					}
-				}
-			}
-			const sha256Results = await Promise.all(sha256Promises);
-			const sha256Map = new Map<string, string | null>();
-			for (const result of sha256Results) {
-				sha256Map.set(result.key, result.hash);
-			}
-			const versions: Array<VersionInfo> = [];
-			for (const version of paginatedVersions) {
-				const entry = versionMap.get(version);
-				if (!entry) {
-					continue;
-				}
-				const files: Record<string, VersionFile> = {};
-				for (const [format, fileInfo] of entry.files) {
-					const sha256 = fileInfo.sha256Key ? (sha256Map.get(fileInfo.sha256Key) ?? null) : null;
-					const validSha256 = sha256 && this.isValidSha256(sha256) ? sha256 : null;
-					files[format] = {
-						url: this.buildDesktopVersionUrl({
-							channel: params.channel,
-							plat: params.plat,
-							arch: params.arch,
-							version,
-							format,
-							baseUrl: params.baseUrl,
-							test: params.test,
-						}),
-						sha256: validSha256,
-						checksum_url: validSha256
-							? this.buildDesktopVersionChecksumUrl({
-									channel: params.channel,
-									plat: params.plat,
-									arch: params.arch,
-									version,
-									format,
-									baseUrl: params.baseUrl,
-									test: params.test,
-								})
-							: null,
-					};
-				}
-				versions.push({
-					version,
-					pub_date: entry.pub_date.toISOString(),
-					files,
-				});
-			}
-			return {versions, hasMore};
-		} catch (error) {
-			if (error instanceof S3ServiceException && (error.name === 'NoSuchKey' || error.name === 'NotFound')) {
-				return {versions: [], hasMore: false};
-			}
-			throw error;
+		if (params.after) {
+			listedVersions = listedVersions.filter((entry) => this.compareVersions(entry.version, params.after ?? '') < 0);
 		}
+		return {
+			versions: await this.buildListedDesktopVersions(params, listedVersions.slice(0, params.limit)),
+			hasMore: listedVersions.length > params.limit,
+		};
 	}
 
 	async resolveVersionedDesktopKey(params: {
@@ -558,10 +425,10 @@ export class DownloadService {
 	}): Promise<DesktopChecksumFile | null> {
 		const version = await this.getLatestDesktopVersion(params);
 		const file = version?.files[params.format];
-		if (!file?.sha256 || !this.isValidSha256(file.sha256)) {
+		if (!version || !file?.sha256 || !this.isValidSha256(file.sha256)) {
 			return null;
 		}
-		const key = await this.resolveLatestDesktopKey(params);
+		const key = await this.resolveVersionedDesktopKey({...params, version: version.version});
 		if (!key) {
 			return null;
 		}
@@ -586,8 +453,16 @@ export class DownloadService {
 		if (objectSha256) {
 			return this.buildDesktopChecksumFile(key, filename, objectSha256);
 		}
-		const latest = await this.getLatestDesktopVersion(params);
-		const file = latest?.version === params.version ? latest.files[params.format] : undefined;
+		const prefix = desktopArtifactPrefix(params);
+		if (!prefix) {
+			return null;
+		}
+		const manifest = await this.readOptionalJsonObjectFromStorage(`${prefix}/manifest.json`);
+		const versionInfo =
+			isDesktopManifest(manifest) && manifest.version === params.version
+				? await this.getLatestDesktopVersionFromManifest(params, manifest)
+				: null;
+		const file = versionInfo?.files[params.format];
 		if (!file?.sha256 || !this.isValidSha256(file.sha256)) {
 			return null;
 		}
@@ -768,6 +643,77 @@ export class DownloadService {
 		}
 	}
 
+	private async readDesktopReleaseState(channel: DesktopChannel, version: string): Promise<DesktopReleaseState> {
+		const descriptorKey = `${DESKTOP_BUCKET_PREFIX}/${channel}/${GITHUB_RELEASE_MARKER_DIRECTORY}/${version}.json`;
+		const markerKey = `${DESKTOP_BUCKET_PREFIX}/${channel}/${GITHUB_RELEASE_MARKER_DIRECTORY}/${version}.ready.json`;
+		const [descriptorText, markerText] = await Promise.all([
+			this.readOptionalTextFromStorage(descriptorKey),
+			this.readOptionalTextFromStorage(markerKey),
+		]);
+		if (descriptorText == null) {
+			return {kind: 'untracked'};
+		}
+		if (markerText == null) {
+			return {kind: 'unpublished'};
+		}
+		const readiness = parseDesktopReleaseReadiness(parseJsonRecord(markerText));
+		if (
+			!readiness ||
+			readiness.channel !== channel ||
+			readiness.version !== version ||
+			readiness.release_tag !== `fluxer-desktop-${channel}@${version}` ||
+			readiness.descriptor_sha256 !== createHash('sha256').update(descriptorText).digest('hex')
+		) {
+			Logger.error({key: markerKey}, 'Invalid GitHub desktop release readiness marker');
+			return {kind: 'unpublished'};
+		}
+		return {kind: 'published', descriptorText};
+	}
+
+	private async isReleasableDesktopVersion(
+		params: {channel: DesktopChannel; test?: boolean},
+		version: string,
+		releasability: Map<string, boolean>,
+	): Promise<boolean> {
+		if (params.test || Config.instance.selfHosted) {
+			return true;
+		}
+		const checked = releasability.get(version);
+		if (checked !== undefined) {
+			return checked;
+		}
+		let releasable = true;
+		try {
+			releasable = (await this.readDesktopReleaseState(params.channel, version)).kind !== 'unpublished';
+		} catch (error) {
+			Logger.error({error, channel: params.channel, version}, 'Failed to read desktop release readiness');
+		}
+		releasability.set(version, releasable);
+		return releasable;
+	}
+
+	private async findNewestReleasableDesktopVersion<T extends {version: string}>(
+		params: {channel: DesktopChannel; test?: boolean},
+		candidates: ReadonlyArray<T>,
+		releasability: Map<string, boolean>,
+	): Promise<T | null> {
+		const newestCandidates = candidates.slice(0, MAX_DESKTOP_RELEASE_CANDIDATES);
+		for (const candidate of newestCandidates) {
+			if (await this.isReleasableDesktopVersion(params, candidate.version, releasability)) {
+				return candidate;
+			}
+		}
+		const [newest] = newestCandidates;
+		if (!newest) {
+			return null;
+		}
+		Logger.error(
+			{channel: params.channel, version: newest.version},
+			'No recent desktop version has a published release',
+		);
+		return newest;
+	}
+
 	private isValidSha256(value: string): boolean {
 		return /^[a-f0-9]{64}$/u.test(value);
 	}
@@ -789,7 +735,13 @@ export class DownloadService {
 		) {
 			return manifestFilename;
 		}
-		return this.findLatestFilenameForRequestedArch(params);
+		for (const entry of await this.listDesktopVersionFiles(params)) {
+			const file = entry.files.get(params.format);
+			if (file) {
+				return file.filename;
+			}
+		}
+		return null;
 	}
 
 	private async listDesktopArtifacts(prefix: string): Promise<ReadonlyArray<{key: string; lastModified?: Date}>> {
@@ -826,44 +778,145 @@ export class DownloadService {
 		return params.filename.toLowerCase().endsWith('.exe');
 	}
 
-	private async findLatestFilenameForRequestedArch(params: LatestFilenameLookupParams): Promise<string | null> {
+	private async listDesktopVersionFiles(params: {
+		channel: DesktopChannel;
+		plat: DesktopPlatform;
+		arch: DesktopArch;
+		test?: boolean;
+	}): Promise<Array<ListedDesktopVersion>> {
 		const basePrefix = desktopArtifactPrefix(params);
 		if (!basePrefix) {
-			return null;
+			return [];
 		}
 		const prefix = `${basePrefix}/`;
-		const objects = await this.listDesktopArtifacts(prefix);
-		if (objects.length === 0) {
-			return null;
+		try {
+			const objects = await this.listDesktopArtifacts(prefix);
+			const versionMap = new Map<string, ListedDesktopVersion>();
+			const sha256Files = new Set<string>();
+			for (const obj of objects) {
+				if (obj.key.endsWith('.sha256')) {
+					sha256Files.add(obj.key);
+				}
+			}
+			for (const obj of objects) {
+				const filename = obj.key.slice(prefix.length);
+				if (filename.includes('/') || filename.endsWith('.sha256') || filename === 'manifest.json') {
+					continue;
+				}
+				const parsed = this.parseVersionFromFilename(filename, params.channel, params.plat, params.arch);
+				if (!parsed) {
+					continue;
+				}
+				const {version, format} = parsed;
+				const sha256Key = sha256Files.has(`${obj.key}.sha256`) ? `${obj.key}.sha256` : null;
+				if (!versionMap.has(version)) {
+					versionMap.set(version, {
+						version,
+						pub_date: obj.lastModified ?? new Date(),
+						files: new Map(),
+					});
+				}
+				const entry = versionMap.get(version);
+				if (entry) {
+					if (!entry.files.has(format)) {
+						entry.files.set(format, {filename, sha256Key});
+					}
+					if (obj.lastModified && obj.lastModified > entry.pub_date) {
+						entry.pub_date = obj.lastModified;
+					}
+				}
+			}
+			return Array.from(versionMap.values()).sort((left, right) => this.compareVersions(left.version, right.version));
+		} catch (error) {
+			if (error instanceof S3ServiceException && (error.name === 'NoSuchKey' || error.name === 'NotFound')) {
+				return [];
+			}
+			throw error;
 		}
-		let latestFilename: string | null = null;
-		let latestVersion: string | null = null;
-		for (const obj of objects) {
-			const filename = obj.key.slice(prefix.length);
-			if (filename.length === 0) {
-				continue;
-			}
-			if (
-				filename.includes('/') ||
-				filename.endsWith('.sha256') ||
-				filename.endsWith('.blockmap') ||
-				filename.endsWith('.yml') ||
-				filename === 'manifest.json' ||
-				filename === 'RELEASES.json' ||
-				filename === 'releases.json'
-			) {
-				continue;
-			}
-			const parsed = this.parseVersionFromFilename(filename, params.channel, params.plat, params.arch);
-			if (!parsed || parsed.format !== params.format) {
-				continue;
-			}
-			if (!latestVersion || this.compareVersions(parsed.version, latestVersion) < 0) {
-				latestVersion = parsed.version;
-				latestFilename = filename;
+	}
+
+	private async buildListedDesktopVersions(
+		params: {
+			channel: DesktopChannel;
+			plat: DesktopPlatform;
+			arch: DesktopArch;
+			baseUrl?: string;
+			test?: boolean;
+		},
+		listedVersions: ReadonlyArray<ListedDesktopVersion>,
+	): Promise<Array<VersionInfo>> {
+		const sha256Promises: Array<
+			Promise<{
+				key: string;
+				hash: string | null;
+			}>
+		> = [];
+		for (const entry of listedVersions) {
+			for (const [, fileInfo] of entry.files) {
+				if (fileInfo.sha256Key) {
+					sha256Promises.push(
+						(async () => {
+							try {
+								const streamResult = await this.storageService.streamObject({
+									bucket: Config.s3.buckets.downloads,
+									key: fileInfo.sha256Key as string,
+								});
+								if (streamResult) {
+									const body = Readable.toWeb(streamResult.body);
+									const text = await new Response(body as ReadableStream).text();
+									return {key: fileInfo.sha256Key as string, hash: text.trim().split(/\s+/u)[0]};
+								}
+							} catch {
+								return {key: fileInfo.sha256Key as string, hash: null};
+							}
+							return {key: fileInfo.sha256Key as string, hash: null};
+						})(),
+					);
+				}
 			}
 		}
-		return latestFilename;
+		const sha256Results = await Promise.all(sha256Promises);
+		const sha256Map = new Map<string, string | null>();
+		for (const result of sha256Results) {
+			sha256Map.set(result.key, result.hash);
+		}
+		const versions: Array<VersionInfo> = [];
+		for (const entry of listedVersions) {
+			const files: Record<string, VersionFile> = {};
+			for (const [format, fileInfo] of entry.files) {
+				const sha256 = fileInfo.sha256Key ? (sha256Map.get(fileInfo.sha256Key) ?? null) : null;
+				const validSha256 = sha256 && this.isValidSha256(sha256) ? sha256 : null;
+				files[format] = {
+					url: this.buildDesktopVersionUrl({
+						channel: params.channel,
+						plat: params.plat,
+						arch: params.arch,
+						version: entry.version,
+						format,
+						baseUrl: params.baseUrl,
+						test: params.test,
+					}),
+					sha256: validSha256,
+					checksum_url: validSha256
+						? this.buildDesktopVersionChecksumUrl({
+								channel: params.channel,
+								plat: params.plat,
+								arch: params.arch,
+								version: entry.version,
+								format,
+								baseUrl: params.baseUrl,
+								test: params.test,
+							})
+						: null,
+				};
+			}
+			versions.push({
+				version: entry.version,
+				pub_date: entry.pub_date.toISOString(),
+				files,
+			});
+		}
+		return versions;
 	}
 
 	private escapeRegex(str: string): string {
@@ -1030,16 +1083,25 @@ export class DownloadService {
 		return key;
 	}
 
-	private async resolveLatestDesktopKeyFromObjects(params: LatestFilenameLookupParams): Promise<string | null> {
-		const filename = await this.findLatestFilenameForRequestedArch(params);
-		if (!filename) {
+	private async resolveLatestDesktopKeyFromObjects(
+		params: LatestFilenameLookupParams,
+		releasability: Map<string, boolean>,
+	): Promise<string | null> {
+		const listedVersions = await this.listDesktopVersionFiles(params);
+		const latest = await this.findNewestReleasableDesktopVersion(
+			params,
+			listedVersions.filter((entry) => entry.files.has(params.format)),
+			releasability,
+		);
+		const file = latest?.files.get(params.format);
+		if (!file) {
 			return null;
 		}
 		return this.buildDesktopArtifactKey({
 			channel: params.channel,
 			plat: params.plat,
 			arch: params.arch,
-			filename,
+			filename: file.filename,
 			test: params.test,
 		});
 	}
@@ -1189,22 +1251,23 @@ export class DownloadService {
 		};
 	}
 
-	private async getLatestDesktopVersionFromObjects(params: {
-		channel: DesktopChannel;
-		plat: DesktopPlatform;
-		arch: DesktopArch;
-		baseUrl?: string;
-		test?: boolean;
-	}): Promise<VersionInfo | null> {
-		const {versions} = await this.listDesktopVersions({
-			channel: params.channel,
-			plat: params.plat,
-			arch: params.arch,
-			limit: 1,
-			baseUrl: params.baseUrl,
-			test: params.test,
-		});
-		return versions[0] ?? null;
+	private async getLatestDesktopVersionFromObjects(
+		params: {
+			channel: DesktopChannel;
+			plat: DesktopPlatform;
+			arch: DesktopArch;
+			baseUrl?: string;
+			test?: boolean;
+		},
+		releasability: Map<string, boolean>,
+	): Promise<VersionInfo | null> {
+		const listedVersions = await this.listDesktopVersionFiles(params);
+		const latest = await this.findNewestReleasableDesktopVersion(params, listedVersions, releasability);
+		if (!latest) {
+			return null;
+		}
+		const [versionInfo] = await this.buildListedDesktopVersions(params, [latest]);
+		return versionInfo ?? null;
 	}
 
 	private async resolveDesktopFileSha256(params: {

fluxer_api/src/api/download/tests/DownloadService.release.test.ts

@@ -0,0 +1,337 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {createHash} from 'node:crypto';
+import {Readable} from 'node:stream';
+import {S3ServiceException} from '@aws-sdk/client-s3';
+import {describe, expect, it} from 'vitest';
+import {getConfig} from '../../Config';
+import type {IStorageService} from '../../infrastructure/IStorageService';
+import {DownloadService} from '../DownloadService';
+
+const PREFIX = 'desktop/canary/linux/x64';
+const TEST_PREFIX = 'desktop-test/canary/linux/x64';
+const RELEASES_PREFIX = 'desktop/canary/github-releases';
+const SOURCE_SHA = 'b'.repeat(40);
+const V904 = '2026.904.135113';
+const V908 = '2026.908.173325';
+const V909 = '2026.909.202036';
+
+const LATEST_PARAMS = {channel: 'canary', plat: 'linux', arch: 'x64'} as const;
+const APPIMAGE_PARAMS = {...LATEST_PARAMS, format: 'appimage'} as const;
+
+const RELEASE_ROUTES: ReadonlyArray<readonly [string, string, number]> = [
+	['darwin', 'arm64', 4],
+	['darwin', 'x64', 4],
+	['linux', 'arm64', 4],
+	['linux', 'x64', 4],
+	['win32', 'arm64', 6],
+	['win32', 'x64', 6],
+];
+
+type StoredObjects = Map<string, string>;
+
+function sha256Hex(value: string): string {
+	return createHash('sha256').update(value).digest('hex');
+}
+
+function appImageFilename(version: string): string {
+	return `Fluxer-Canary-${version}-linux-x86_64.AppImage`;
+}
+
+function uploadBuild(objects: StoredObjects, version: string, options: {prefix?: string; checksum?: boolean} = {}) {
+	const prefix = options.prefix ?? PREFIX;
+	const filename = appImageFilename(version);
+	objects.set(`${prefix}/${filename}`, filename);
+	if (options.checksum !== false) {
+		objects.set(`${prefix}/${filename}.sha256`, `${sha256Hex(filename)}  ${filename}`);
+	}
+	objects.set(
+		`${prefix}/manifest.json`,
+		JSON.stringify({
+			channel: 'canary',
+			platform: 'linux',
+			arch: 'x64',
+			version,
+			pub_date: '2026-09-08T18:06:00Z',
+			files: {appimage: {filename, sha256: sha256Hex(filename)}},
+		}),
+	);
+}
+
+function publishDescriptor(objects: StoredObjects, version: string, routes = RELEASE_ROUTES): string {
+	const assets = routes.flatMap(([plat, arch, count]) =>
+		Array.from({length: count}, (_, index) => {
+			const filename =
+				plat === 'linux' && arch === 'x64' && index === 0
+					? appImageFilename(version)
+					: `Fluxer-Canary-${version}-${plat}-${arch}-${index}.bin`;
+			return {
+				storage_key: `desktop/canary/${plat}/${arch}/${filename}`,
+				release_asset: filename,
+				sha256: sha256Hex(filename),
+				size: 1,
+			};
+		}),
+	);
+	const descriptor = JSON.stringify({
+		schema_version: 1,
+		channel: 'canary',
+		version,
+		release_tag: `fluxer-desktop-canary@${version}`,
+		source_sha: SOURCE_SHA,
+		assets,
+	});
+	objects.set(`${RELEASES_PREFIX}/${version}.json`, descriptor);
+	return descriptor;
+}
+
+function publishMarker(objects: StoredObjects, version: string, descriptor: string) {
+	objects.set(
+		`${RELEASES_PREFIX}/${version}.ready.json`,
+		JSON.stringify({
+			schema_version: 1,
+			channel: 'canary',
+			version,
+			release_tag: `fluxer-desktop-canary@${version}`,
+			source_sha: SOURCE_SHA,
+			descriptor_sha256: sha256Hex(descriptor),
+		}),
+	);
+}
+
+function releaseBuild(objects: StoredObjects, version: string) {
+	const descriptor = publishDescriptor(objects, version);
+	uploadBuild(objects, version);
+	publishMarker(objects, version, descriptor);
+}
+
+function incidentObjects(): StoredObjects {
+	const objects: StoredObjects = new Map();
+	releaseBuild(objects, V904);
+	publishDescriptor(objects, V908);
+	uploadBuild(objects, V908);
+	return objects;
+}
+
+function createService(objects: StoredObjects, onRead?: (key: string) => void) {
+	const reads: Array<string> = [];
+	const listings: Array<string> = [];
+	const storageService = {
+		streamObject: async (params: {key: string}) => {
+			reads.push(params.key);
+			onRead?.(params.key);
+			const body = objects.get(params.key);
+			if (body == null) {
+				return null;
+			}
+			const buffer = Buffer.from(body, 'utf8');
+			return {body: Readable.from([buffer]), contentLength: buffer.byteLength};
+		},
+		listObjects: async (params: {prefix: string}) => {
+			listings.push(params.prefix);
+			return Array.from(objects.keys())
+				.filter((key) => key.startsWith(params.prefix))
+				.sort()
+				.map((key) => ({key}));
+		},
+		getObjectMetadata: async (_bucket: string, key: string) =>
+			objects.has(key) ? {contentLength: 1, contentType: 'application/octet-stream'} : null,
+	} as unknown as IStorageService;
+	return {service: new DownloadService(storageService), reads, listings};
+}
+
+async function resolveLatest(service: DownloadService, test?: boolean) {
+	const metadata = await service.getLatestDesktopVersion({...LATEST_PARAMS, test});
+	const key = await service.resolveLatestDesktopKey({...APPIMAGE_PARAMS, test});
+	const checksum = await service.resolveLatestDesktopChecksumFile({...APPIMAGE_PARAMS, test});
+	return {version: metadata?.version, key, checksum: checksum?.body};
+}
+
+function latestOf(version: string, prefix = PREFIX) {
+	const filename = appImageFilename(version);
+	return {version, key: `${prefix}/${filename}`, checksum: `${sha256Hex(filename)}  ${filename}\n`};
+}
+
+describe('desktop release readiness', () => {
+	it('offers a published manifest version after reading only its release state', async () => {
+		const objects: StoredObjects = new Map();
+		releaseBuild(objects, V904);
+		releaseBuild(objects, V909);
+		const {service, reads, listings} = createService(objects);
+		await expect(service.getLatestDesktopVersion({...LATEST_PARAMS})).resolves.toMatchObject({version: V909});
+		expect(reads).toEqual([
+			`${PREFIX}/manifest.json`,
+			`${RELEASES_PREFIX}/${V909}.json`,
+			`${RELEASES_PREFIX}/${V909}.ready.json`,
+		]);
+		expect(listings).toEqual([]);
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V909));
+	});
+
+	it('falls back to the newest published version while the manifest version awaits its release', async () => {
+		const {service} = createService(incidentObjects());
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V904));
+	});
+
+	it('reads each release state once and one checksum while the manifest version awaits its release', async () => {
+		const {service, reads, listings} = createService(incidentObjects());
+		await expect(service.getLatestDesktopVersion({...LATEST_PARAMS})).resolves.toMatchObject({version: V904});
+		expect(reads).toEqual([
+			`${PREFIX}/manifest.json`,
+			`${RELEASES_PREFIX}/${V908}.json`,
+			`${RELEASES_PREFIX}/${V908}.ready.json`,
+			`${RELEASES_PREFIX}/${V904}.json`,
+			`${RELEASES_PREFIX}/${V904}.ready.json`,
+			`${PREFIX}/${appImageFilename(V904)}.sha256`,
+		]);
+		expect(listings).toEqual([`${PREFIX}/`]);
+	});
+
+	it('offers a manifest version that has no release descriptor', async () => {
+		const objects: StoredObjects = new Map();
+		uploadBuild(objects, V904);
+		uploadBuild(objects, V908);
+		const {service} = createService(objects);
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V908));
+	});
+
+	it('treats a readiness marker that does not match the stored descriptor as unpublished', async () => {
+		const objects: StoredObjects = new Map();
+		releaseBuild(objects, V904);
+		publishDescriptor(objects, V908);
+		uploadBuild(objects, V908);
+		publishMarker(objects, V908, 'another descriptor');
+		const {service} = createService(objects);
+		await expect(service.resolveGitHubDesktopRelease(`${PREFIX}/${appImageFilename(V908)}`)).resolves.toEqual({
+			kind: 'awaiting_release',
+		});
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V904));
+	});
+
+	it('offers a version whose descriptor the parser rejects when its readiness marker matches', async () => {
+		const objects: StoredObjects = new Map();
+		releaseBuild(objects, V904);
+		const descriptor = publishDescriptor(
+			objects,
+			V908,
+			RELEASE_ROUTES.map(([plat, arch, count]) => [plat, arch, plat === 'linux' ? count - 1 : count] as const),
+		);
+		uploadBuild(objects, V908);
+		publishMarker(objects, V908, descriptor);
+		const {service} = createService(objects);
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V908));
+		await expect(service.resolveGitHubDesktopRelease(`${PREFIX}/${appImageFilename(V908)}`)).rejects.toThrow(
+			'Invalid GitHub desktop release descriptor',
+		);
+	});
+
+	it.each([
+		['descriptor', `${RELEASES_PREFIX}/${V908}.json`],
+		['readiness marker', `${RELEASES_PREFIX}/${V908}.ready.json`],
+	])('offers the manifest version when reading its release %s fails with a storage error', async (_name, failingKey) => {
+		const {service} = createService(incidentObjects(), (key) => {
+			if (key === failingKey) {
+				throw new S3ServiceException({
+					name: 'SlowDown',
+					$fault: 'server',
+					$metadata: {httpStatusCode: 503},
+					message: 'Please reduce your request rate.',
+				});
+			}
+		});
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V908));
+	});
+
+	it('still resolves the unpublished version through versioned routes', async () => {
+		const objects: StoredObjects = new Map();
+		releaseBuild(objects, V904);
+		publishDescriptor(objects, V908);
+		uploadBuild(objects, V908, {checksum: false});
+		const {service} = createService(objects);
+		const params = {...APPIMAGE_PARAMS, version: V908};
+		const filename = appImageFilename(V908);
+		await expect(service.resolveVersionedDesktopKey(params)).resolves.toBe(`${PREFIX}/${filename}`);
+		await expect(service.resolveVersionedDesktopChecksumFile(params)).resolves.toMatchObject({
+			sha256: sha256Hex(filename),
+		});
+	});
+
+	it('keeps offering the manifest version on self-hosted instances', async () => {
+		const config = getConfig();
+		const originalSelfHosted = config.instance.selfHosted;
+		config.instance.selfHosted = true;
+		try {
+			const {service, reads} = createService(incidentObjects());
+			await expect(resolveLatest(service)).resolves.toEqual(latestOf(V908));
+			expect(reads.filter((key) => key.startsWith(RELEASES_PREFIX))).toEqual([]);
+		} finally {
+			config.instance.selfHosted = originalSelfHosted;
+		}
+	});
+
+	it('keeps offering the newest test build', async () => {
+		const objects: StoredObjects = new Map();
+		publishDescriptor(objects, V908);
+		uploadBuild(objects, V908, {prefix: TEST_PREFIX});
+		const {service, reads} = createService(objects);
+		await expect(resolveLatest(service, true)).resolves.toEqual(latestOf(V908, TEST_PREFIX));
+		expect(reads.filter((key) => key.startsWith(RELEASES_PREFIX))).toEqual([]);
+	});
+
+	it('offers 904 while 908 awaits its release, then 909 once its marker lands', async () => {
+		const objects = incidentObjects();
+		const {service} = createService(objects);
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V904));
+		await expect(service.resolveGitHubDesktopRelease(`${PREFIX}/${appImageFilename(V908)}`)).resolves.toEqual({
+			kind: 'awaiting_release',
+		});
+		const descriptor = publishDescriptor(objects, V909);
+		uploadBuild(objects, V909);
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V904));
+		publishMarker(objects, V909, descriptor);
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V909));
+		await expect(service.resolveGitHubDesktopRelease(`${PREFIX}/${appImageFilename(V909)}`)).resolves.toEqual({
+			kind: 'ready',
+			location: `https://github.com/fluxerapp/fluxer/releases/download/${encodeURIComponent(`fluxer-desktop-canary@${V909}`)}/${appImageFilename(V909)}`,
+		});
+	});
+
+	it('offers the newest version when ten unpublished versions hide a published one', async () => {
+		const objects: StoredObjects = new Map();
+		releaseBuild(objects, V904);
+		const newest = '2026.908.170009';
+		for (let build = 0; build < 10; build++) {
+			const version = `2026.908.${170000 + build}`;
+			publishDescriptor(objects, version);
+			uploadBuild(objects, version);
+		}
+		const {service, reads} = createService(objects);
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(newest));
+		expect(reads).not.toContain(`${RELEASES_PREFIX}/${V904}.ready.json`);
+	});
+
+	it('pairs the latest checksum with the filename of the same version when a marker lands mid-request', async () => {
+		const objects = incidentObjects();
+		const descriptor = publishDescriptor(objects, V909);
+		uploadBuild(objects, V909);
+		let manifestReads = 0;
+		const {service} = createService(objects, (key) => {
+			if (key !== `${PREFIX}/manifest.json`) {
+				return;
+			}
+			manifestReads += 1;
+			if (manifestReads === 2) {
+				publishMarker(objects, V909, descriptor);
+			}
+		});
+		const checksum = await service.resolveLatestDesktopChecksumFile({...APPIMAGE_PARAMS});
+		expect(checksum?.body).toBe(latestOf(V904).checksum);
+	});
+
+	it('lists an unpublished version while latest skips it', async () => {
+		const {service} = createService(incidentObjects());
+		const listed = await service.listDesktopVersions({...LATEST_PARAMS, limit: 10});
+		expect(listed.versions.map((entry) => entry.version)).toEqual([V908, V904]);
+		await expect(resolveLatest(service)).resolves.toEqual(latestOf(V904));
+	});
+});

fluxer_api/src/api/download/tests/DownloadService.versions.test.ts

@@ -0,0 +1,143 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {Readable} from 'node:stream';
+import {describe, expect, it} from 'vitest';
+import type {IStorageService} from '../../infrastructure/IStorageService';
+import {DownloadService} from '../DownloadService';
+
+const PREFIX = 'desktop/canary/linux/x64';
+const BASE_URL = 'https://api.example.test';
+const V1 = '2026.901.100000';
+const V2 = '2026.902.100000';
+const V3 = '2026.903.100000';
+const V4 = '2026.904.100000';
+const V5 = '2026.905.100000';
+
+const LIST_PARAMS = {channel: 'canary', plat: 'linux', arch: 'x64', baseUrl: BASE_URL} as const;
+
+type StoredObject = {body?: string; lastModified?: Date};
+type StoredObjects = Map<string, StoredObject>;
+
+function appImageFilename(version: string): string {
+	return `Fluxer-Canary-${version}-linux-x86_64.AppImage`;
+}
+
+function debFilename(version: string): string {
+	return `Fluxer-Canary-${version}-linux-amd64.deb`;
+}
+
+function addArtifact(objects: StoredObjects, filename: string, options: {sha256?: string; lastModified?: Date} = {}) {
+	objects.set(`${PREFIX}/${filename}`, {lastModified: options.lastModified});
+	if (options.sha256 !== undefined) {
+		objects.set(`${PREFIX}/${filename}.sha256`, {body: `${options.sha256}  ${filename}\n`});
+	}
+}
+
+function createService(objects: StoredObjects) {
+	const reads: Array<string> = [];
+	const storageService = {
+		streamObject: async (params: {key: string}) => {
+			reads.push(params.key);
+			const object = objects.get(params.key);
+			if (object?.body == null) {
+				return null;
+			}
+			const buffer = Buffer.from(object.body, 'utf8');
+			return {body: Readable.from([buffer]), contentLength: buffer.byteLength};
+		},
+		listObjects: async (params: {prefix: string}) =>
+			Array.from(objects.entries())
+				.filter(([key]) => key.startsWith(params.prefix))
+				.sort(([left], [right]) => (left < right ? -1 : 1))
+				.map(([key, object]) => ({key, lastModified: object.lastModified})),
+		getObjectMetadata: async () => null,
+	} as unknown as IStorageService;
+	return {service: new DownloadService(storageService), reads};
+}
+
+function versionNumbers(versions: Array<{version: string}>): Array<string> {
+	return versions.map((entry) => entry.version);
+}
+
+describe('desktop version listing', () => {
+	it('lists versions newest first with the files of each version', async () => {
+		const objects: StoredObjects = new Map();
+		addArtifact(objects, appImageFilename(V1), {lastModified: new Date('2026-09-01T10:00:00Z')});
+		addArtifact(objects, appImageFilename(V3), {lastModified: new Date('2026-09-03T10:00:00Z')});
+		addArtifact(objects, debFilename(V3), {lastModified: new Date('2026-09-03T12:00:00Z')});
+		addArtifact(objects, appImageFilename(V5), {lastModified: new Date('2026-09-05T10:00:00Z')});
+		const {service} = createService(objects);
+		const listed = await service.listDesktopVersions({...LIST_PARAMS, limit: 10});
+		expect(versionNumbers(listed.versions)).toEqual([V5, V3, V1]);
+		expect(listed.hasMore).toBe(false);
+		expect(Object.keys(listed.versions[1].files).sort()).toEqual(['appimage', 'deb']);
+		expect(listed.versions[1].pub_date).toBe('2026-09-03T12:00:00.000Z');
+		expect(listed.versions[0].files.appimage.url).toBe(`${BASE_URL}/dl/desktop/canary/linux/x64/${V5}/appimage`);
+	});
+
+	it('excludes names that are not artefacts for the requested coordinate', async () => {
+		const objects: StoredObjects = new Map();
+		addArtifact(objects, appImageFilename(V3), {sha256: 'a'.repeat(64)});
+		objects.set(`${PREFIX}/nested/${appImageFilename(V5)}`, {});
+		objects.set(`${PREFIX}/manifest.json`, {body: '{}'});
+		objects.set(`${PREFIX}/RELEASES.json`, {body: '{}'});
+		objects.set(`${PREFIX}/releases.json`, {body: '{}'});
+		objects.set(`${PREFIX}/latest-linux.yml`, {body: 'version: 1'});
+		objects.set(`${PREFIX}/${appImageFilename(V4)}.blockmap`, {});
+		objects.set(`${PREFIX}/Fluxer-Canary-${V4}-linux-aarch64.AppImage`, {});
+		objects.set(`${PREFIX}/Fluxer-Canary-${V4}-mac-universal.dmg`, {});
+		const {service} = createService(objects);
+		const listed = await service.listDesktopVersions({...LIST_PARAMS, limit: 10});
+		expect(versionNumbers(listed.versions)).toEqual([V3]);
+		expect(Object.keys(listed.versions[0].files)).toEqual(['appimage']);
+	});
+
+	it('pages with limit, before and after and reports whether more remain', async () => {
+		const objects: StoredObjects = new Map();
+		for (const version of [V1, V2, V3, V4, V5]) {
+			addArtifact(objects, appImageFilename(version));
+		}
+		const {service} = createService(objects);
+		const firstPage = await service.listDesktopVersions({...LIST_PARAMS, limit: 2});
+		expect(versionNumbers(firstPage.versions)).toEqual([V5, V4]);
+		expect(firstPage.hasMore).toBe(true);
+		const olderPage = await service.listDesktopVersions({...LIST_PARAMS, limit: 2, before: V3});
+		expect(versionNumbers(olderPage.versions)).toEqual([V2, V1]);
+		expect(olderPage.hasMore).toBe(false);
+		const newerPage = await service.listDesktopVersions({...LIST_PARAMS, limit: 2, after: V3});
+		expect(versionNumbers(newerPage.versions)).toEqual([V5, V4]);
+		expect(newerPage.hasMore).toBe(false);
+		const between = await service.listDesktopVersions({...LIST_PARAMS, limit: 1, before: V5, after: V1});
+		expect(versionNumbers(between.versions)).toEqual([V4]);
+		expect(between.hasMore).toBe(true);
+	});
+
+	it('reports the sibling hash and treats a missing or malformed one as absent', async () => {
+		const hash = 'b'.repeat(64);
+		const objects: StoredObjects = new Map();
+		addArtifact(objects, appImageFilename(V3), {sha256: hash});
+		addArtifact(objects, appImageFilename(V2));
+		addArtifact(objects, appImageFilename(V1), {sha256: 'C'.repeat(64)});
+		const {service} = createService(objects);
+		const listed = await service.listDesktopVersions({...LIST_PARAMS, limit: 10});
+		expect(listed.versions[0].files.appimage).toEqual({
+			url: `${BASE_URL}/dl/desktop/canary/linux/x64/${V3}/appimage`,
+			sha256: hash,
+			checksum_url: `${BASE_URL}/dl/desktop/canary/linux/x64/${V3}/appimage.sha256`,
+		});
+		expect(listed.versions[1].files.appimage.sha256).toBeNull();
+		expect(listed.versions[1].files.appimage.checksum_url).toBeNull();
+		expect(listed.versions[2].files.appimage.sha256).toBeNull();
+		expect(listed.versions[2].files.appimage.checksum_url).toBeNull();
+	});
+
+	it('reads a checksum only for the versions it returns', async () => {
+		const objects: StoredObjects = new Map();
+		for (const version of [V1, V2, V3, V4, V5]) {
+			addArtifact(objects, appImageFilename(version), {sha256: 'd'.repeat(64)});
+		}
+		const {service, reads} = createService(objects);
+		await service.listDesktopVersions({...LIST_PARAMS, limit: 2});
+		expect(reads).toEqual([`${PREFIX}/${appImageFilename(V5)}.sha256`, `${PREFIX}/${appImageFilename(V4)}.sha256`]);
+	});
+});

fluxer_api/src/api/guild/services/GuildDiscoveryService.ts

@@ -401,7 +401,7 @@ export class GuildDiscoveryService extends IGuildDiscoveryService {
 		const language =
 			params.primaryLanguage && isValidDiscoveryLanguage(params.primaryLanguage) ? params.primaryLanguage : undefined;
 		const tag = params.tag && params.tag.trim().length > 0 ? normalizeDiscoveryTag(params.tag) : undefined;
-		const sortBy = params.sortBy === 'member_count' ? 'memberCount' : 'relevance';
+		const sortBy = params.sortBy === 'relevance' ? 'relevance' : 'memberCount';
 		const filters: GuildSearchFilters = {
 			isDiscoverable: true,
 			discoveryCategory: params.categoryId,
@@ -444,7 +444,6 @@ export class GuildDiscoveryService extends IGuildDiscoveryService {
 				for (const guild of guilds) {
 					const counts = freshCounts.get(BigInt(guild.id) as GuildID);
 					if (counts) {
-						guild.member_count = counts.memberCount;
 						guild.online_count = counts.onlineCount;
 					}
 				}

fluxer_api/src/api/guild/services/GuildModerationService.ts

@@ -19,7 +19,7 @@ import type {UserCacheService} from '../../infrastructure/UserCacheService';
 import {Logger} from '../../Logger';
 import type {RequestCache} from '../../middleware/RequestCacheMiddleware';
 import type {GuildBan} from '../../models/GuildBan';
-import {hasHighCgnatBlastRadiusRisk, isSingleIpBanCandidate} from '../../risk/IpBanCgnatGuard';
+import {getIpBanBlastRadiusVerdict, isSingleIpBanCandidate} from '../../risk/IpBanCgnatGuard';
 import {isIpBanExempt} from '../../risk/IpBanExemptions';
 import type {IUserRepository} from '../../user/IUserRepository';
 import type {WorkerTaskName} from '../../worker/WorkerLaneConfig';
@@ -237,19 +237,20 @@ export class GuildModerationService {
 			return true;
 		}
 		try {
-			const highRisk = await hasHighCgnatBlastRadiusRisk(userIp, this.ipInfoService, {
+			const {cgnat, sharedAccess} = await getIpBanBlastRadiusVerdict(userIp, this.ipInfoService, {
 				source: 'guild.ip_ban',
 				reason: 'join_cgnat_guard',
 			});
+			const highRisk = cgnat || sharedAccess;
 			if (highRisk) {
 				Logger.warn(
 					{userIp, bannedIp},
-					'Skipping guild IP ban match because IPInfo indicates high CGNAT blast-radius risk',
+					'Skipping guild IP ban match because IPInfo indicates high shared-network blast-radius risk',
 				);
 			}
 			return !highRisk;
 		} catch (error) {
-			Logger.warn({error, userIp, bannedIp}, 'IPInfo CGNAT guard failed while checking guild IP ban');
+			Logger.warn({error, userIp, bannedIp}, 'IPInfo blast-radius guard failed while checking guild IP ban');
 			return true;
 		}
 	}

fluxer_api/src/api/guild/services/GuildSearchService.ts

@@ -68,23 +68,10 @@ export class GuildSearchService {
 		const includeNsfwRequested = searchParams.include_nsfw ?? false;
 		const canUserAccessNsfw =
 			guildIsAgeRestricted || includeNsfwRequested ? await this.getCanUserAccessNsfw(userId) : false;
-		if (guildIsAgeRestricted) {
-			if (!canUserAccessNsfw) {
-				throw new NsfwContentRequiresAgeVerificationError();
-			}
-			if (!includeNsfwRequested) {
-				const hitsPerPage = searchParams.hits_per_page ?? 25;
-				const page = searchParams.page ?? 1;
-				return {
-					channels: [],
-					messages: [],
-					total: 0,
-					hits_per_page: hitsPerPage,
-					page,
-				};
-			}
+		if (guildIsAgeRestricted && !canUserAccessNsfw) {
+			throw new NsfwContentRequiresAgeVerificationError();
 		}
-		const canIncludeNsfw = includeNsfwRequested && canUserAccessNsfw;
+		const canIncludeNsfw = canUserAccessNsfw && (includeNsfwRequested || guildIsAgeRestricted);
 		const guildNsfw = guildData?.nsfw ?? false;
 		const channels = await this.channelRepository.listChannels(channelIds);
 		const channelMap = new Map<string, Channel>();
@@ -169,7 +156,7 @@ export class GuildSearchService {
 			page,
 			cursor,
 		});
-		const mappedResponses = await this.responseMapper.mapSearchResultToResponses(result, userId, requestCache);
+		const mappedResponses = await this.responseMapper.mapSearchResultToResponses(result.messages, userId, requestCache);
 		return {
 			messages: mappedResponses.messages,
 			channels: mappedResponses.channels,
@@ -251,7 +238,7 @@ export class GuildSearchService {
 			page,
 			cursor,
 		});
-		const mappedResponses = await this.responseMapper.mapSearchResultToResponses(result, userId, requestCache);
+		const mappedResponses = await this.responseMapper.mapSearchResultToResponses(result.messages, userId, requestCache);
 		return {
 			messages: mappedResponses.messages,
 			channels: mappedResponses.channels,

fluxer_api/src/api/guild/services/channel/ChannelOperationsService.ts

@@ -2,7 +2,7 @@
 
 import {AuditLogActionType} from '@fluxer/constants/src/AuditLogActionType';
 import {ALL_PERMISSIONS, ChannelTypes, Permissions} from '@fluxer/constants/src/ChannelConstants';
-import {ContentWarningLevel, GuildFeatures} from '@fluxer/constants/src/GuildConstants';
+import {ContentWarningLevel, GuildFeatures, resolveVoiceChannelBitrate} from '@fluxer/constants/src/GuildConstants';
 import {
 	MAX_CHANNELS_PER_CATEGORY,
 	MAX_GUILD_CHANNELS,
@@ -119,12 +119,16 @@ export class ChannelOperationsService {
 			);
 		}
 		let channelName = params.data.name;
-		if (params.data.type === ChannelTypes.GUILD_TEXT) {
+		let guildFeatures: Array<string> | null = null;
+		if (params.data.type === ChannelTypes.GUILD_TEXT || params.data.type === ChannelTypes.GUILD_VOICE) {
 			const guildData = await this.gatewayService.getGuildData({
 				guildId: params.guildId,
 				userId: params.userId,
 			});
-			const hasFlexibleNamesEnabled = guildData.features.includes(GuildFeatures.TEXT_CHANNEL_FLEXIBLE_NAMES);
+			guildFeatures = guildData.features;
+		}
+		if (params.data.type === ChannelTypes.GUILD_TEXT) {
+			const hasFlexibleNamesEnabled = (guildFeatures ?? []).includes(GuildFeatures.TEXT_CHANNEL_FLEXIBLE_NAMES);
 			if (!hasFlexibleNamesEnabled) {
 				channelName = ChannelNameType.parse(channelName);
 			}
@@ -156,7 +160,10 @@ export class ChannelOperationsService {
 			content_warning_level: requestedContentWarningLevel,
 			content_warning_text: requestedContentWarningText,
 			rate_limit_per_user: params.data.rate_limit_per_user ?? 0,
-			bitrate: params.data.type === ChannelTypes.GUILD_VOICE ? (params.data.bitrate ?? 64000) : null,
+			bitrate:
+				params.data.type === ChannelTypes.GUILD_VOICE
+					? resolveVoiceChannelBitrate(params.data.bitrate, guildFeatures)
+					: null,
 			user_limit: params.data.type === ChannelTypes.GUILD_VOICE ? (params.data.user_limit ?? 0) : null,
 			voice_connection_limit:
 				params.data.type === ChannelTypes.GUILD_VOICE

fluxer_api/src/api/guild/services/data/GuildOperationsService.ts

@@ -10,11 +10,13 @@ import {
 	GuildSplashCardAlignment,
 	GuildVerificationLevel,
 	JoinSourceTypes,
+	resolveVoiceChannelBitrate,
 	SystemChannelFlags,
 } from '@fluxer/constants/src/GuildConstants';
 import {
 	MAX_GUILD_CHANNELS,
 	MAX_GUILD_ROLES,
+	VOICE_CHANNEL_BITRATE_DEFAULT,
 	VOICE_CHANNEL_CONNECTION_LIMIT_DEFAULT,
 } from '@fluxer/constants/src/LimitConstants';
 import {DEFAULT_GUILD_FOLDER_ICON} from '@fluxer/constants/src/UserConstants';
@@ -934,7 +936,14 @@ export class GuildOperationsService {
 		addChannel(textCategoryId, ChannelTypes.GUILD_CATEGORY, DEFAULT_TEXT_CATEGORY_NAME, null, 0);
 		addChannel(voiceCategoryId, ChannelTypes.GUILD_CATEGORY, DEFAULT_VOICE_CATEGORY_NAME, null, 1);
 		addChannel(generalChannelId, ChannelTypes.GUILD_TEXT, DEFAULT_TEXT_CHANNEL_NAME, textCategoryId, 0);
-		addChannel(generalVoiceId, ChannelTypes.GUILD_VOICE, DEFAULT_VOICE_CHANNEL_NAME, voiceCategoryId, 0, 64000);
+		addChannel(
+			generalVoiceId,
+			ChannelTypes.GUILD_VOICE,
+			DEFAULT_VOICE_CHANNEL_NAME,
+			voiceCategoryId,
+			0,
+			VOICE_CHANNEL_BITRATE_DEFAULT,
+		);
 		batch.addPrepared(
 			GuildRoles.insert({
 				guild_id: guildId,
@@ -1105,7 +1114,7 @@ export class GuildOperationsService {
 					content_warning_level: null,
 					content_warning_text: null,
 					rate_limit_per_user: channel.rate_limit_per_user ?? 0,
-					bitrate: isVoice ? (channel.bitrate ?? 64000) : null,
+					bitrate: isVoice ? resolveVoiceChannelBitrate(channel.bitrate, null) : null,
 					user_limit: isVoice ? (channel.user_limit ?? 0) : null,
 					voice_connection_limit: isVoice
 						? (channel.voice_connection_limit ?? VOICE_CHANNEL_CONNECTION_LIMIT_DEFAULT)

fluxer_api/src/api/guild/services/member/GuildMemberValidationService.ts

@@ -14,7 +14,7 @@ import type {GuildID, RoleID, UserID} from '../../../BrandedTypes';
 import {guildIdToRoleId} from '../../../BrandedTypes';
 import {Logger} from '../../../Logger';
 import type {GuildMember} from '../../../models/GuildMember';
-import {hasHighCgnatBlastRadiusRisk, isSingleIpBanCandidate} from '../../../risk/IpBanCgnatGuard';
+import {getIpBanBlastRadiusVerdict, isSingleIpBanCandidate} from '../../../risk/IpBanCgnatGuard';
 import {isIpBanExempt} from '../../../risk/IpBanExemptions';
 import type {IUserRepository} from '../../../user/IUserRepository';
 import type {IGuildRepositoryAggregate} from '../../repositories/IGuildRepositoryAggregate';
@@ -119,14 +119,15 @@ export class GuildMemberValidationService {
 			return true;
 		}
 		try {
-			const highRisk = await hasHighCgnatBlastRadiusRisk(userIp, this.ipInfoService, {
+			const {cgnat, sharedAccess} = await getIpBanBlastRadiusVerdict(userIp, this.ipInfoService, {
 				source: 'guild.member_ip_ban',
 				reason: 'join_cgnat_guard',
 			});
+			const highRisk = cgnat || sharedAccess;
 			if (highRisk) {
 				Logger.warn(
 					{userIp, bannedIp},
-					'Skipping guild member IP ban match because IPInfo indicates high CGNAT blast-radius risk',
+					'Skipping guild member IP ban match because IPInfo indicates high shared-network blast-radius risk',
 				);
 			}
 			return !highRisk;

fluxer_api/src/api/guild/tests/DiscoverySearchAndJoin.test.ts

@@ -8,13 +8,21 @@ import type {
 	DiscoveryCategoryResponse,
 	DiscoveryGuildListResponse,
 } from '@fluxer/schema/src/domains/guild/GuildDiscoverySchemas';
+import type {WorkerTaskHelpers} from '@pkgs/worker/src/contracts/WorkerTask';
 import {afterEach, beforeEach, describe, expect, test} from 'vitest';
 import {createTestAccount, setUserACLs} from '../../auth/tests/AuthTestUtils';
+import type {GuildID} from '../../BrandedTypes';
 import {createTestBotAccount} from '../../bot/tests/BotTestUtils';
+import {setInjectedGatewayService} from '../../middleware/ServiceRegistry';
+import {getGuildRepository} from '../../middleware/ServiceSingletons';
 import {banUser} from '../../moderation/tests/ModerationTestUtils';
 import {type ApiTestHarness, createApiTestHarness} from '../../test/ApiTestHarness';
+import {NoopLogger} from '../../test/mocks/NoopLogger';
+import {NoopGatewayService} from '../../test/NoopGatewayService';
 import {HTTP_STATUS, TEST_IDS} from '../../test/TestConstants';
 import {createBuilder, createBuilderWithoutAuth} from '../../test/TestRequestBuilder';
+import syncDiscoveryIndex from '../../worker/tasks/SyncDiscoveryIndex';
+import {clearWorkerDependencies, setWorkerDependenciesForTest} from '../../worker/WorkerContext';
 import {createGuild, getUserGuilds} from './GuildTestUtils';
 
 async function setGuildMemberCount(harness: ApiTestHarness, guildId: string, memberCount: number): Promise<void> {
@@ -24,6 +32,30 @@ async function setGuildMemberCount(harness: ApiTestHarness, guildId: string, mem
 		.execute();
 }
 
+interface LiveGuildCounts {
+	memberCount: number;
+	onlineCount: number;
+}
+
+const WORKER_HELPERS = {logger: new NoopLogger()} as unknown as WorkerTaskHelpers;
+
+class LiveCountsGatewayService extends NoopGatewayService {
+	constructor(private readonly liveCounts: Map<string, LiveGuildCounts>) {
+		super();
+	}
+
+	override async getDiscoveryGuildCounts(guildIds: Array<GuildID>): Promise<Map<GuildID, LiveGuildCounts>> {
+		const counts = new Map<GuildID, LiveGuildCounts>();
+		for (const guildId of guildIds) {
+			const live = this.liveCounts.get(guildId.toString());
+			if (live) {
+				counts.set(guildId, live);
+			}
+		}
+		return counts;
+	}
+}
+
 async function applyAndApprove(
 	harness: ApiTestHarness,
 	ownerToken: string,
@@ -44,12 +76,39 @@ async function applyAndApprove(
 		.execute();
 }
 
+async function createApprovedDiscoveryGuild(
+	harness: ApiTestHarness,
+	adminToken: string,
+	name: string,
+	memberCount: number,
+): Promise<string> {
+	const owner = await createTestAccount(harness);
+	const guild = await createGuild(harness, owner.token, name);
+	await setGuildMemberCount(harness, guild.id, memberCount);
+	await applyAndApprove(
+		harness,
+		owner.token,
+		adminToken,
+		guild.id,
+		`${name} welcomes everyone`,
+		DiscoveryCategories.GAMING,
+	);
+	return guild.id;
+}
+
+function expectNonIncreasing(counts: Array<number>): void {
+	for (let index = 1; index < counts.length; index++) {
+		expect(counts[index]).toBeLessThanOrEqual(counts[index - 1]);
+	}
+}
+
 describe('Discovery Search and Join', () => {
 	let harness: ApiTestHarness;
 	beforeEach(async () => {
 		harness = await createApiTestHarness({search: 'enabled'});
 	});
 	afterEach(async () => {
+		clearWorkerDependencies();
 		await harness?.shutdown();
 	});
 	describe('categories', () => {
@@ -257,6 +316,82 @@ describe('Discovery Search and Join', () => {
 				.execute();
 			expect(results.guilds.length).toBeLessThanOrEqual(2);
 		});
+		test('should order results by the member count it reports back', async () => {
+			const liveCounts = new Map<string, LiveGuildCounts>();
+			setInjectedGatewayService(new LiveCountsGatewayService(liveCounts));
+			const admin = await createTestAccount(harness);
+			await setUserACLs(harness, admin, ['admin:authenticate', 'discovery:review']);
+			const guildIds: Array<string> = [];
+			for (const memberCount of [50, 40, 30, 20, 10]) {
+				guildIds.push(
+					await createApprovedDiscoveryGuild(harness, admin.token, `Ordered Guild ${memberCount}`, memberCount),
+				);
+			}
+			liveCounts.set(guildIds[0], {memberCount: 5, onlineCount: 3});
+			liveCounts.set(guildIds[4], {memberCount: 500, onlineCount: 7});
+			const searcher = await createTestAccount(harness);
+			const results = await createBuilder<DiscoveryGuildListResponse>(harness, searcher.token)
+				.get('/discovery/guilds?sort_by=member_count&limit=48')
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			expect(results.guilds.map((guild) => guild.id)).toEqual(guildIds);
+			expectNonIncreasing(results.guilds.map((guild) => guild.member_count));
+			expect(results.guilds[0].online_count).toBe(3);
+			expect(results.guilds[4].online_count).toBe(7);
+		});
+		test('should rank by member count when the client omits sort_by', async () => {
+			const admin = await createTestAccount(harness);
+			await setUserACLs(harness, admin, ['admin:authenticate', 'discovery:review']);
+			const guildsByCount = new Map<number, string>();
+			for (const memberCount of [30, 10, 20]) {
+				guildsByCount.set(
+					memberCount,
+					await createApprovedDiscoveryGuild(harness, admin.token, `Unsorted Guild ${memberCount}`, memberCount),
+				);
+			}
+			const searcher = await createTestAccount(harness);
+			const results = await createBuilder<DiscoveryGuildListResponse>(harness, searcher.token)
+				.get('/discovery/guilds?limit=48')
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			expect(results.guilds.map((guild) => guild.id)).toEqual([
+				guildsByCount.get(30),
+				guildsByCount.get(20),
+				guildsByCount.get(10),
+			]);
+			expectNonIncreasing(results.guilds.map((guild) => guild.member_count));
+		});
+		test('should not repeat guilds across pages when the discovery index is resynced', async () => {
+			const liveCounts = new Map<string, LiveGuildCounts>();
+			const gatewayService = new LiveCountsGatewayService(liveCounts);
+			setInjectedGatewayService(gatewayService);
+			const admin = await createTestAccount(harness);
+			await setUserACLs(harness, admin, ['admin:authenticate', 'discovery:review']);
+			const guildIds: Array<string> = [];
+			for (const [index, memberCount] of [60, 50, 40, 40, 30, 30].entries()) {
+				guildIds.push(await createApprovedDiscoveryGuild(harness, admin.token, `Paged Guild ${index}`, memberCount));
+			}
+			const searcher = await createTestAccount(harness);
+			const firstPage = await createBuilder<DiscoveryGuildListResponse>(harness, searcher.token)
+				.get('/discovery/guilds?sort_by=member_count&limit=2&offset=0')
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			expect(firstPage.guilds.map((guild) => guild.id)).toEqual([guildIds[0], guildIds[1]]);
+			liveCounts.set(guildIds[0], {memberCount: 5, onlineCount: 0});
+			setWorkerDependenciesForTest({guildRepository: getGuildRepository(), gatewayService});
+			await syncDiscoveryIndex({}, WORKER_HELPERS);
+			const secondPage = await createBuilder<DiscoveryGuildListResponse>(harness, searcher.token)
+				.get('/discovery/guilds?sort_by=member_count&limit=2&offset=2')
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			const thirdPage = await createBuilder<DiscoveryGuildListResponse>(harness, searcher.token)
+				.get('/discovery/guilds?sort_by=member_count&limit=2&offset=4')
+				.expect(HTTP_STATUS.OK)
+				.execute();
+			const paged = [...firstPage.guilds, ...secondPage.guilds, ...thirdPage.guilds].map((guild) => guild.id);
+			expect(new Set(paged).size).toBe(paged.length);
+			expect([...paged].sort()).toEqual([...guildIds].sort());
+		});
 		test('should require login to search', async () => {
 			await createBuilderWithoutAuth(harness).get('/discovery/guilds').expect(HTTP_STATUS.UNAUTHORIZED).execute();
 		});

fluxer_api/src/api/guild/tests/GuildChannelManagement.test.ts

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
 import {ChannelTypes, Permissions} from '@fluxer/constants/src/ChannelConstants';
+import {GuildFeatures} from '@fluxer/constants/src/GuildConstants';
 import type {ChannelResponse} from '@fluxer/schema/src/domains/channel/ChannelSchemas';
 import {afterEach, beforeEach, describe, expect, test} from 'vitest';
 import {createTestAccount} from '../../auth/tests/AuthTestUtils';
@@ -25,6 +26,14 @@ describe('Guild Channel Management', () => {
 	afterEach(async () => {
 		await harness?.shutdown();
 	});
+	async function addGuildFeaturesForTesting(guildId: string, features: Array<string>): Promise<void> {
+		await createBuilder<{
+			success: boolean;
+		}>(harness, '')
+			.post(`/test/guilds/${guildId}/features`)
+			.body({add_features: features})
+			.execute();
+	}
 	describe('Channel Name Updates', () => {
 		test('should normalize channel name with spaces to hyphens', async () => {
 			const account = await createTestAccount(harness);
@@ -582,7 +591,7 @@ describe('Guild Channel Management', () => {
 				.expect(HTTP_STATUS.BAD_REQUEST)
 				.execute();
 		});
-		test('should reject bitrate above maximum (320000)', async () => {
+		test('should reject bitrate above maximum (384000)', async () => {
 			const account = await createTestAccount(harness);
 			const guild = await createGuild(harness, account.token, 'Test Guild');
 			const voiceChannel = await createChannel(
@@ -594,7 +603,7 @@ describe('Guild Channel Management', () => {
 			);
 			await createBuilder(harness, account.token)
 				.patch(`/channels/${voiceChannel.id}`)
-				.body({type: ChannelTypes.GUILD_VOICE, bitrate: 320001})
+				.body({type: ChannelTypes.GUILD_VOICE, bitrate: 384001})
 				.expect(HTTP_STATUS.BAD_REQUEST)
 				.execute();
 		});
@@ -678,7 +687,7 @@ describe('Guild Channel Management', () => {
 				.execute();
 			expect(data.bitrate).toBe(8000);
 		});
-		test('should accept maximum bitrate (320000)', async () => {
+		test('should clamp bitrate to 96000 without an audio bitrate feature', async () => {
 			const account = await createTestAccount(harness);
 			const guild = await createGuild(harness, account.token, 'Test Guild');
 			const voiceChannel = await createChannel(
@@ -690,9 +699,74 @@ describe('Guild Channel Management', () => {
 			);
 			const data = await createBuilder<ChannelResponse>(harness, account.token)
 				.patch(`/channels/${voiceChannel.id}`)
-				.body({type: ChannelTypes.GUILD_VOICE, bitrate: 320000})
+				.body({type: ChannelTypes.GUILD_VOICE, bitrate: 384000})
 				.execute();
-			expect(data.bitrate).toBe(320000);
+			expect(data.bitrate).toBe(96000);
+		});
+		test('should clamp bitrate to the feature the guild holds', async () => {
+			const account = await createTestAccount(harness);
+			const guild = await createGuild(harness, account.token, 'Test Guild');
+			await addGuildFeaturesForTesting(guild.id, [GuildFeatures.AUDIO_BITRATE_256_KBPS]);
+			const voiceChannel = await createChannel(
+				harness,
+				account.token,
+				guild.id,
+				'voice-channel',
+				ChannelTypes.GUILD_VOICE,
+			);
+			const data = await createBuilder<ChannelResponse>(harness, account.token)
+				.patch(`/channels/${voiceChannel.id}`)
+				.body({type: ChannelTypes.GUILD_VOICE, bitrate: 384000})
+				.execute();
+			expect(data.bitrate).toBe(256000);
+		});
+		test('should accept maximum bitrate (384000) with the 384 kbps feature', async () => {
+			const account = await createTestAccount(harness);
+			const guild = await createGuild(harness, account.token, 'Test Guild');
+			await addGuildFeaturesForTesting(guild.id, [GuildFeatures.AUDIO_BITRATE_384_KBPS]);
+			const voiceChannel = await createChannel(
+				harness,
+				account.token,
+				guild.id,
+				'voice-channel',
+				ChannelTypes.GUILD_VOICE,
+			);
+			const data = await createBuilder<ChannelResponse>(harness, account.token)
+				.patch(`/channels/${voiceChannel.id}`)
+				.body({type: ChannelTypes.GUILD_VOICE, bitrate: 384000})
+				.execute();
+			expect(data.bitrate).toBe(384000);
+		});
+		test('should store the default bitrate on a new voice channel', async () => {
+			const account = await createTestAccount(harness);
+			const guild = await createGuild(harness, account.token, 'Test Guild');
+			const voiceChannel = await createChannel(
+				harness,
+				account.token,
+				guild.id,
+				'voice-channel',
+				ChannelTypes.GUILD_VOICE,
+			);
+			expect(voiceChannel.bitrate).toBe(64000);
+		});
+		test('should clamp bitrate on create without an audio bitrate feature', async () => {
+			const account = await createTestAccount(harness);
+			const guild = await createGuild(harness, account.token, 'Test Guild');
+			const data = await createBuilder<ChannelResponse>(harness, account.token)
+				.post(`/guilds/${guild.id}/channels`)
+				.body({type: ChannelTypes.GUILD_VOICE, name: 'loud-channel', bitrate: 384000})
+				.execute();
+			expect(data.bitrate).toBe(96000);
+		});
+		test('should keep bitrate on create with the 128 kbps feature', async () => {
+			const account = await createTestAccount(harness);
+			const guild = await createGuild(harness, account.token, 'Test Guild');
+			await addGuildFeaturesForTesting(guild.id, [GuildFeatures.AUDIO_BITRATE_128_KBPS]);
+			const data = await createBuilder<ChannelResponse>(harness, account.token)
+				.post(`/guilds/${guild.id}/channels`)
+				.body({type: ChannelTypes.GUILD_VOICE, name: 'loud-channel', bitrate: 128000})
+				.execute();
+			expect(data.bitrate).toBe(128000);
 		});
 		test('should accept maximum user limit (99)', async () => {
 			const account = await createTestAccount(harness);
@@ -734,6 +808,7 @@ describe('Guild Channel Management', () => {
 		test('should update both bitrate and user limit together', async () => {
 			const account = await createTestAccount(harness);
 			const guild = await createGuild(harness, account.token, 'Test Guild');
+			await addGuildFeaturesForTesting(guild.id, [GuildFeatures.AUDIO_BITRATE_128_KBPS]);
 			const voiceChannel = await createChannel(
 				harness,
 				account.token,

fluxer_api/src/api/infrastructure/AvatarService.ts

@@ -108,7 +108,7 @@ export class AvatarService {
 				type: 'base64',
 				base64: base64Data,
 				version: 2,
-				nsfw: 'block',
+				nsfw: 'allow',
 			}),
 			kind,
 			errorPath,
@@ -163,7 +163,7 @@ export class AvatarService {
 				type: 'base64',
 				base64: base64Data,
 				version: 2,
-				nsfw: 'block',
+				nsfw: 'allow',
 			}),
 			kind: 'avatar',
 			errorPath,

fluxer_api/src/api/infrastructure/DisabledLiveKitService.ts

@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import type {TrackSource} from 'livekit-server-sdk';
 import type {ChannelID, GuildID, UserID} from '../BrandedTypes';
 import type {VoiceRegionMetadata, VoiceServerRecord} from '../voice/VoiceModel';
 import type {ILiveKitService, ListActiveRoomsResult, ListParticipantsResult} from './ILiveKitService';
@@ -52,27 +51,6 @@ interface UpdateParticipantPermissionsParams {
 	deaf?: boolean;
 }
 
-interface MuteParticipantTrackParams {
-	userId: UserID;
-	guildId?: GuildID;
-	channelId: ChannelID;
-	connectionId: string;
-	regionId: string;
-	serverId: string;
-	trackSid: string;
-	muted: boolean;
-}
-
-interface RevokeParticipantPublishSourceParams {
-	userId: UserID;
-	guildId?: GuildID;
-	channelId: ChannelID;
-	connectionId: string;
-	regionId: string;
-	serverId: string;
-	source: TrackSource;
-}
-
 export class DisabledLiveKitService implements ILiveKitService {
 	async createToken(_params: CreateTokenParams): Promise<{
 		token: string;
@@ -87,14 +65,6 @@ export class DisabledLiveKitService implements ILiveKitService {
 
 	async disconnectParticipant(_params: DisconnectParticipantParams): Promise<void> {}
 
-	async muteParticipantTrack(_params: MuteParticipantTrackParams): Promise<boolean> {
-		return false;
-	}
-
-	async revokeParticipantPublishSource(_params: RevokeParticipantPublishSourceParams): Promise<boolean> {
-		return false;
-	}
-
 	async listParticipants(_params: {
 		guildId?: GuildID;
 		channelId: ChannelID;

fluxer_api/src/api/infrastructure/EmailDnsValidationService.ts

@@ -27,25 +27,51 @@ interface EmailDnsValidationServiceOptions {
 	enforceInTestMode?: boolean;
 	positiveTtlMs?: number;
 	negativeTtlMs?: number;
+	lookupTimeoutMs?: number;
+	maxCachedDomains?: number;
+	isEmailEnabled?: () => Promise<boolean>;
 }
 
 type DnsResolutionResult = 'valid' | 'invalid' | 'fallback' | 'transient_error';
+type DomainVerdict = 'valid' | 'invalid' | 'unverified';
 
 const DOMAIN_NOT_FOUND_CODES = new Set(['ENOTFOUND', 'ENONAME', 'EAI_NONAME', 'NXDOMAIN']);
 const DOMAIN_NO_RECORD_CODES = new Set(['ENODATA', 'ENOENT', 'NODATA']);
+const DNS_LOOKUP_TIMEOUT_MS = 2000;
+const DNS_LOOKUP_TRIES = 1;
+const MAX_CACHED_DOMAINS = 10000;
+
+async function isInstanceEmailEnabled(): Promise<boolean> {
+	const {getInstanceConfigRepository} = await import('../middleware/ServiceSingletons');
+	return getInstanceConfigRepository().isEmailEnabled();
+}
+
+function createLookupTimeoutError(): NodeJS.ErrnoException {
+	const error: NodeJS.ErrnoException = new Error('Email DNS lookup timed out');
+	error.code = 'ETIMEOUT';
+	return error;
+}
 
 export class EmailDnsValidationService implements IEmailDnsValidationService {
 	private readonly resolver: IDnsResolver;
 	private readonly enforceInTestMode: boolean;
 	private readonly positiveTtlMs: number;
 	private readonly negativeTtlMs: number;
+	private readonly lookupTimeoutMs: number;
+	private readonly maxCachedDomains: number;
+	private readonly isEmailEnabled: () => Promise<boolean>;
 	private readonly domainCache = new Map<string, DomainValidationCacheEntry>();
 
 	constructor(options: EmailDnsValidationServiceOptions = {}) {
-		this.resolver = options.resolver ?? new Resolver();
+		this.lookupTimeoutMs = options.lookupTimeoutMs ?? DNS_LOOKUP_TIMEOUT_MS;
+		this.resolver =
+			options.resolver ??
+			new Resolver({timeout: this.lookupTimeoutMs, tries: DNS_LOOKUP_TRIES, maxTimeout: this.lookupTimeoutMs});
 		this.enforceInTestMode = options.enforceInTestMode ?? false;
 		this.positiveTtlMs = options.positiveTtlMs ?? ms('30 minutes');
 		this.negativeTtlMs = options.negativeTtlMs ?? ms('5 minutes');
+		this.maxCachedDomains = options.maxCachedDomains ?? MAX_CACHED_DOMAINS;
+		this.isEmailEnabled = options.isEmailEnabled ?? isInstanceEmailEnabled;
 	}
 
 	async hasValidDnsRecords(email: string): Promise<boolean> {
@@ -56,13 +82,19 @@ export class EmailDnsValidationService implements IEmailDnsValidationService {
 		if (!domain) {
 			return false;
 		}
+		if (!(await this.isEmailEnabled())) {
+			return true;
+		}
 		const cached = this.getCachedDomainResult(domain);
 		if (cached !== null) {
 			return cached;
 		}
-		const isValid = await this.resolveDomain(domain);
-		this.setCachedDomainResult(domain, isValid);
-		return isValid;
+		const verdict = await this.resolveDomain(domain);
+		if (verdict === 'invalid') {
+			Logger.warn({domain}, 'Email domain publishes no mail exchange or address records, rejecting the address');
+		}
+		this.setCachedDomainResult(domain, verdict);
+		return verdict !== 'invalid';
 	}
 
 	private extractDomain(email: string): string | null {
@@ -82,41 +114,49 @@ export class EmailDnsValidationService implements IEmailDnsValidationService {
 			this.domainCache.delete(domain);
 			return null;
 		}
+		this.domainCache.delete(domain);
+		this.domainCache.set(domain, cached);
 		return cached.valid;
 	}
 
-	private setCachedDomainResult(domain: string, isValid: boolean): void {
-		const ttlMs = isValid ? this.positiveTtlMs : this.negativeTtlMs;
+	private setCachedDomainResult(domain: string, verdict: DomainVerdict): void {
+		const ttlMs = verdict === 'valid' ? this.positiveTtlMs : this.negativeTtlMs;
+		if (this.domainCache.size >= this.maxCachedDomains && !this.domainCache.has(domain)) {
+			const oldestDomain = this.domainCache.keys().next().value;
+			if (oldestDomain !== undefined) {
+				this.domainCache.delete(oldestDomain);
+			}
+		}
 		this.domainCache.set(domain, {
-			valid: isValid,
+			valid: verdict !== 'invalid',
 			expiresAtMs: Date.now() + ttlMs,
 		});
 	}
 
-	private async resolveDomain(domain: string): Promise<boolean> {
+	private async resolveDomain(domain: string): Promise<DomainVerdict> {
 		const mxResult = await this.resolveMx(domain);
 		if (mxResult === 'valid') {
-			return true;
+			return 'valid';
 		}
 		if (mxResult === 'invalid') {
-			return false;
+			return 'invalid';
 		}
 		if (mxResult === 'transient_error') {
-			return true;
+			return 'unverified';
 		}
 		const addressResult = await this.resolveAddressRecords(domain);
 		if (addressResult === 'valid') {
-			return true;
+			return 'valid';
 		}
 		if (addressResult === 'invalid') {
-			return false;
+			return 'invalid';
 		}
-		return true;
+		return 'unverified';
 	}
 
 	private async resolveMx(domain: string): Promise<DnsResolutionResult> {
 		try {
-			const records = await this.resolver.resolveMx(domain);
+			const records = await this.withLookupDeadline(this.resolver.resolveMx(domain));
 			if (records.length > 0) {
 				return 'valid';
 			}
@@ -128,8 +168,8 @@ export class EmailDnsValidationService implements IEmailDnsValidationService {
 
 	private async resolveAddressRecords(domain: string): Promise<DnsResolutionResult> {
 		const [ipv4Result, ipv6Result] = await Promise.allSettled([
-			this.resolver.resolve4(domain),
-			this.resolver.resolve6(domain),
+			this.withLookupDeadline(this.resolver.resolve4(domain)),
+			this.withLookupDeadline(this.resolver.resolve6(domain)),
 		]);
 		if (ipv4Result.status === 'fulfilled' && ipv4Result.value.length > 0) {
 			return 'valid';
@@ -147,6 +187,20 @@ export class EmailDnsValidationService implements IEmailDnsValidationService {
 		return 'invalid';
 	}
 
+	private async withLookupDeadline<T>(lookup: Promise<T>): Promise<T> {
+		let timer: ReturnType<typeof setTimeout> | undefined;
+		try {
+			return await Promise.race([
+				lookup,
+				new Promise<never>((_resolve, reject) => {
+					timer = setTimeout(() => reject(createLookupTimeoutError()), this.lookupTimeoutMs);
+				}),
+			]);
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+
 	private classifyResolverError(
 		error: unknown,
 		domain: string,

fluxer_api/src/api/infrastructure/EntityAssetService.ts

@@ -403,7 +403,7 @@ export class EntityAssetService {
 				type: 'base64',
 				base64: base64Data,
 				version: 2,
-				nsfw: 'block',
+				nsfw: 'allow',
 			}),
 			kind,
 			errorPath,

fluxer_api/src/api/infrastructure/ILiveKitService.ts

@@ -1,6 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import type {TrackSource} from 'livekit-server-sdk';
 import type {ChannelID, GuildID, UserID} from '../BrandedTypes';
 import type {VoiceRegionMetadata, VoiceServerRecord} from '../voice/VoiceModel';
 
@@ -55,27 +54,6 @@ interface DisconnectParticipantParams {
 	serverId: string;
 }
 
-interface MuteParticipantTrackParams {
-	userId: UserID;
-	guildId?: GuildID;
-	channelId: ChannelID;
-	connectionId: string;
-	regionId: string;
-	serverId: string;
-	trackSid: string;
-	muted: boolean;
-}
-
-interface RevokeParticipantPublishSourceParams {
-	userId: UserID;
-	guildId?: GuildID;
-	channelId: ChannelID;
-	connectionId: string;
-	regionId: string;
-	serverId: string;
-	source: TrackSource;
-}
-
 interface ListParticipantsParams {
 	guildId?: GuildID;
 	channelId: ChannelID;
@@ -131,10 +109,6 @@ export abstract class ILiveKitService {
 
 	abstract disconnectParticipant(params: DisconnectParticipantParams): Promise<void>;
 
-	abstract muteParticipantTrack(params: MuteParticipantTrackParams): Promise<boolean>;
-
-	abstract revokeParticipantPublishSource(params: RevokeParticipantPublishSourceParams): Promise<boolean>;
-
 	abstract listParticipants(params: ListParticipantsParams): Promise<ListParticipantsResult>;
 
 	abstract listActiveRooms(): Promise<ListActiveRoomsResult>;

fluxer_api/src/api/infrastructure/LiveKitService.ts

@@ -60,27 +60,6 @@ interface UpdateParticipantPermissionsParams {
 	deaf?: boolean;
 }
 
-interface MuteParticipantTrackParams {
-	userId: UserID;
-	guildId?: GuildID;
-	channelId: ChannelID;
-	connectionId: string;
-	regionId: string;
-	serverId: string;
-	trackSid: string;
-	muted: boolean;
-}
-
-interface RevokeParticipantPublishSourceParams {
-	userId: UserID;
-	guildId?: GuildID;
-	channelId: ChannelID;
-	connectionId: string;
-	regionId: string;
-	serverId: string;
-	source: TrackSource;
-}
-
 interface ServerClientConfig {
 	endpoint: string;
 	apiKey: string;
@@ -97,26 +76,6 @@ interface LiveKitPublishPermissions {
 
 export const VOICE_TOKEN_TTL_SECONDS = 60 * 10;
 
-const ALL_PUBLISH_SOURCES: ReadonlyArray<TrackSource> = [
-	TrackSource.MICROPHONE,
-	TrackSource.CAMERA,
-	TrackSource.SCREEN_SHARE,
-	TrackSource.SCREEN_SHARE_AUDIO,
-];
-
-interface LiveKitPublishGrant {
-	canPublish: boolean;
-	canPublishSources: Array<TrackSource>;
-}
-
-export function computeRevokedPublishGrant(current: LiveKitPublishGrant, source: TrackSource): LiveKitPublishGrant {
-	const allowed = current.canPublishSources.length > 0 ? current.canPublishSources : ALL_PUBLISH_SOURCES;
-	const revoked =
-		source === TrackSource.SCREEN_SHARE ? [TrackSource.SCREEN_SHARE, TrackSource.SCREEN_SHARE_AUDIO] : [source];
-	const canPublishSources = allowed.filter((allowedSource) => !revoked.includes(allowedSource));
-	return {canPublish: current.canPublish && canPublishSources.length > 0, canPublishSources};
-}
-
 export function computeLiveKitPublishSources(permissions: LiveKitPublishPermissions): Array<TrackSource> {
 	const sources: Array<TrackSource> = [];
 	if (permissions.canSpeak) {
@@ -341,72 +300,6 @@ export class LiveKitService extends ILiveKitService {
 		}
 	}
 
-	async muteParticipantTrack(params: MuteParticipantTrackParams): Promise<boolean> {
-		const {userId, guildId, channelId, connectionId, regionId, serverId, trackSid, muted} = params;
-		const roomName = this.getRoomName(guildId, channelId);
-		const participantIdentity = this.getParticipantIdentity(userId, connectionId);
-		const server = this.tryResolveServerClient(regionId, serverId);
-		if (server === null) {
-			Logger.debug(
-				{regionId, serverId, participantIdentity, roomName, trackSid},
-				'LiveKit track mute skipped, pinned server no longer exists in topology',
-			);
-			return false;
-		}
-		try {
-			await server.roomServiceClient.mutePublishedTrack(roomName, participantIdentity, trackSid, muted);
-			return true;
-		} catch (error) {
-			if (LiveKitService.isHttp404(error)) {
-				Logger.debug({participantIdentity, roomName, trackSid}, 'LiveKit track no longer published, nothing to mute');
-				return false;
-			}
-			Logger.error({error, participantIdentity, roomName, trackSid, muted}, 'Error muting LiveKit published track');
-			return false;
-		}
-	}
-
-	async revokeParticipantPublishSource(params: RevokeParticipantPublishSourceParams): Promise<boolean> {
-		const {userId, guildId, channelId, connectionId, regionId, serverId, source} = params;
-		const roomName = this.getRoomName(guildId, channelId);
-		const participantIdentity = this.getParticipantIdentity(userId, connectionId);
-		const server = this.tryResolveServerClient(regionId, serverId);
-		if (server === null) {
-			Logger.debug(
-				{regionId, serverId, participantIdentity, roomName, source},
-				'LiveKit publish source revoke skipped, pinned server no longer exists in topology',
-			);
-			return false;
-		}
-		try {
-			const participants = await server.roomServiceClient.listParticipants(roomName);
-			const participant = participants.find((p) => p.identity === participantIdentity);
-			if (!participant?.permission) {
-				Logger.debug(
-					{participantIdentity, roomName, source},
-					'LiveKit participant no longer in room, nothing to revoke',
-				);
-				return false;
-			}
-			const grant = computeRevokedPublishGrant(participant.permission, source);
-			await server.roomServiceClient.updateParticipant(roomName, participantIdentity, undefined, {
-				...participant.permission,
-				...grant,
-			});
-			return true;
-		} catch (error) {
-			if (LiveKitService.isHttp404(error)) {
-				Logger.debug(
-					{participantIdentity, roomName, source},
-					'LiveKit participant no longer in room, nothing to revoke',
-				);
-				return false;
-			}
-			Logger.error({error, participantIdentity, roomName, source}, 'Error revoking LiveKit publish source');
-			return false;
-		}
-	}
-
 	async listParticipants(params: {
 		guildId?: GuildID;
 		channelId: ChannelID;
@@ -431,9 +324,6 @@ export class LiveKitService extends ILiveKitService {
 				participants: participants.map((participant) => ({identity: participant.identity})),
 			};
 		} catch (error) {
-			if (LiveKitService.isHttp404(error)) {
-				return {status: 'ok', participants: []};
-			}
 			Logger.warn({error, regionId, serverId, roomName}, 'LiveKit listParticipants failed');
 			const status = LiveKitService.getHttpStatus(error);
 			const isRetryable = status != null && status >= 500;

fluxer_api/src/api/infrastructure/LiveKitWebhookService.ts

@@ -1,19 +1,14 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
 import type {WebhookEvent} from 'livekit-server-sdk';
-import {TrackSource, WebhookReceiver} from 'livekit-server-sdk';
+import {WebhookReceiver} from 'livekit-server-sdk';
 import type {ChannelID, GuildID} from '../BrandedTypes';
-import {Config} from '../Config';
 import {Logger} from '../Logger';
-import type {LimitConfigService} from '../limits/LimitConfigService';
-import {resolveLimitSafe} from '../limits/LimitConfigUtils';
-import {createLimitMatchContext} from '../limits/LimitMatchContextBuilder';
-import type {IUserRepository} from '../user/IUserRepository';
 import type {VoiceTopology} from '../voice/VoiceTopology';
 import type {IGatewayService} from './IGatewayService';
 import type {ILiveKitService} from './ILiveKitService';
 import type {IVoiceRoomStore} from './IVoiceRoomStore';
-import {isDMRoom, parseParticipantIdentity, parseParticipantMetadataWithRaw, parseRoomName} from './VoiceRoomContext';
+import {isDMRoom, parseParticipantMetadataWithRaw, parseRoomName} from './VoiceRoomContext';
 
 interface VoiceWebhookParticipantContext {
 	readonly type: 'dm' | 'guild';
@@ -34,10 +29,8 @@ export class LiveKitWebhookService {
 	constructor(
 		private voiceRoomStore: IVoiceRoomStore,
 		private gatewayService: IGatewayService,
-		private userRepository: IUserRepository,
 		private liveKitService: ILiveKitService,
 		private voiceTopology: VoiceTopology,
-		private limitConfigService: LimitConfigService,
 	) {
 		this.receivers = new Map();
 		this.serverMap = new Map();
@@ -466,176 +459,6 @@ export class LiveKitWebhookService {
 		}
 	}
 
-	async handleTrackPublished(event: WebhookEvent, apiKey: string): Promise<void> {
-		if (event.event !== 'track_published') {
-			return;
-		}
-		const {room, participant, track} = event;
-		if (!room || !participant || !track) {
-			Logger.debug('Track published without required data, skipping');
-			return;
-		}
-		Logger.debug(
-			{
-				apiKey,
-				roomName: room.name,
-				participantIdentity: participant.identity,
-				trackType: track.type,
-				width: track.width,
-				height: track.height,
-			},
-			'Processing LiveKit track_published event',
-		);
-		if (track.type !== 1) {
-			return;
-		}
-		if (track.source !== TrackSource.CAMERA && track.source !== TrackSource.SCREEN_SHARE) {
-			return;
-		}
-		const trackSourceLabel = track.source === TrackSource.SCREEN_SHARE ? 'screen_share' : 'camera';
-		try {
-			const identity = parseParticipantIdentity(participant.identity);
-			if (!identity) {
-				Logger.warn({identity: participant.identity}, 'Unexpected participant identity format');
-				return;
-			}
-			const {userId, connectionId} = identity;
-			const user = await this.userRepository.findUnique(userId);
-			if (!user) {
-				Logger.warn({userId: userId.toString()}, 'User not found for track_published event');
-				return;
-			}
-			if (Config.instance.selfHosted) {
-				return;
-			}
-			const ctx = createLimitMatchContext({user});
-			const hasHigherQuality = resolveLimitSafe(
-				this.limitConfigService.getConfigSnapshot(),
-				ctx,
-				'feature_higher_video_quality',
-				0,
-			);
-			const canUseHigherQuality = hasHigherQuality > 0 && !user.isBot;
-			if (canUseHigherQuality) {
-				return;
-			}
-			const FREE_MAX_WIDTH = 1280;
-			const FREE_MAX_HEIGHT = 720;
-			const exceedsResolution = track.width > FREE_MAX_WIDTH || track.height > FREE_MAX_HEIGHT;
-			if (!exceedsResolution) {
-				return;
-			}
-			Logger.warn(
-				{
-					userId: userId.toString(),
-					isBot: user.isBot,
-					width: track.width,
-					height: track.height,
-					trackSource: trackSourceLabel,
-				},
-				'User without higher video quality entitlement published video exceeding free tier limits - muting track and revoking source',
-			);
-			if (!track.sid) {
-				Logger.warn(
-					{userId: userId.toString(), roomName: room.name, trackSource: trackSourceLabel},
-					'Track published without a sid, cannot enforce free tier video limits',
-				);
-				return;
-			}
-			const roomContext = parseRoomName(room.name);
-			if (!roomContext) {
-				Logger.warn({roomName: room.name}, 'Unknown room name format, cannot enforce free tier video limits');
-				return;
-			}
-			let regionId: string | undefined;
-			let serverId: string | undefined;
-			if (participant.metadata) {
-				const parsed = parseParticipantMetadataWithRaw(participant.metadata);
-				if (parsed) {
-					regionId = parsed.raw.region_id;
-					serverId = parsed.raw.server_id;
-				}
-			}
-			if (!regionId || !serverId) {
-				const serverInfo = this.serverMap.get(apiKey);
-				if (serverInfo) {
-					regionId = serverInfo.regionId;
-					serverId = serverInfo.serverId;
-				}
-			}
-			if (!regionId || !serverId) {
-				const guildId = isDMRoom(roomContext) ? undefined : roomContext.guildId;
-				const pinnedServer = await this.voiceRoomStore.getPinnedRoomServer(guildId, roomContext.channelId);
-				if (pinnedServer) {
-					regionId = pinnedServer.regionId;
-					serverId = pinnedServer.serverId;
-				}
-			}
-			if (!regionId || !serverId) {
-				Logger.warn(
-					{participantId: participant.identity, roomName: room.name, apiKey},
-					'Missing region or server info, cannot enforce free tier video limits',
-				);
-				return;
-			}
-			const guildId = isDMRoom(roomContext) ? undefined : roomContext.guildId;
-			Logger.debug(
-				{
-					userId: userId.toString(),
-					type: roomContext.type,
-					guildId: guildId?.toString(),
-					channelId: roomContext.channelId.toString(),
-					regionId,
-					serverId,
-					isBot: user.isBot,
-					width: track.width,
-					height: track.height,
-					trackSource: trackSourceLabel,
-				},
-				'Muting oversized track and revoking its publish source for user without higher video quality entitlement',
-			);
-			const muted = await this.liveKitService.muteParticipantTrack({
-				userId,
-				guildId,
-				channelId: roomContext.channelId,
-				connectionId,
-				regionId,
-				serverId,
-				trackSid: track.sid,
-				muted: true,
-			});
-			const revoked = await this.liveKitService.revokeParticipantPublishSource({
-				userId,
-				guildId,
-				channelId: roomContext.channelId,
-				connectionId,
-				regionId,
-				serverId,
-				source: track.source,
-			});
-			Logger.info(
-				{
-					userId: userId.toString(),
-					type: roomContext.type,
-					guildId: guildId?.toString(),
-					channelId: roomContext.channelId.toString(),
-					isBot: user.isBot,
-					width: track.width,
-					height: track.height,
-					trackSource: trackSourceLabel,
-					trackSid: track.sid,
-					muted,
-					revoked,
-				},
-				muted || revoked
-					? 'Enforced free tier video limits on user without higher video quality entitlement'
-					: 'Failed to enforce free tier video limits on user without higher video quality entitlement',
-			);
-		} catch (error) {
-			Logger.error({error}, 'Error processing track_published event');
-		}
-	}
-
 	async processEvent(data: {event: WebhookEvent; apiKey: string}): Promise<void> {
 		const {event, apiKey} = data;
 		Logger.debug({event: event.event, apiKey}, 'Dispatching LiveKit webhook event');
@@ -650,9 +473,6 @@ export class LiveKitWebhookService {
 			case 'room_finished':
 				await this.handleRoomFinished(event, apiKey);
 				break;
-			case 'track_published':
-				await this.handleTrackPublished(event, apiKey);
-				break;
 			default:
 				Logger.debug({event: event.event}, 'Ignoring LiveKit webhook event');
 		}

fluxer_api/src/api/infrastructure/StorageService.test.ts

@@ -143,6 +143,32 @@ describe('StorageService.getPresignedUploadURL', () => {
 			},
 		);
 	});
+
+	it('gives both clients the configured addressing rather than pinning one to path style', async () => {
+		await withS3Config(
+			{
+				endpoint: 'https://s3.example.test',
+				presignedUrlBase: '',
+				forcePathStyle: false,
+				region: 'eu-central-1',
+				accessKeyId: 'fluxer',
+				secretAccessKey: 'fluxer-secret',
+				buckets: {uploads: 'fluxer-uploads'},
+			},
+			async () => {
+				const service = new StorageService();
+				const probe = service as unknown as {
+					client: {config: {forcePathStyle?: unknown}};
+					presignClient: {config: {forcePathStyle?: unknown}};
+				};
+				const resolve = async (value: unknown): Promise<unknown> =>
+					typeof value === 'function' ? await (value as () => Promise<unknown>)() : value;
+
+				expect(await resolve(probe.client.config.forcePathStyle)).toBe(false);
+				expect(await resolve(probe.presignClient.config.forcePathStyle)).toBe(false);
+			},
+		);
+	});
 });
 
 describe('StorageService.copyObjectWithMetadataStripping', () => {

fluxer_api/src/api/infrastructure/StorageService.ts

@@ -127,7 +127,7 @@ export class StorageService implements IStorageService {
 			region: this.provider.region,
 			accessKeyId: this.provider.accessKeyId,
 			secretAccessKey: this.provider.secretAccessKey,
-			forcePathStyle: true,
+			forcePathStyle: this.provider.forcePathStyle,
 		});
 		this.presignClient = buildPooledS3Client({
 			endpoint: this.resolvePresignEndpoint(),
@@ -136,6 +136,15 @@ export class StorageService implements IStorageService {
 			secretAccessKey: this.provider.secretAccessKey,
 			forcePathStyle: this.provider.forcePathStyle,
 		});
+		Logger.info(
+			{
+				endpoint: this.provider.endpoint,
+				presignEndpoint: this.resolvePresignEndpoint(),
+				region: this.provider.region,
+				addressing: this.provider.forcePathStyle ? 'path' : 'virtual-host',
+			},
+			'Object storage client ready',
+		);
 	}
 
 	private resolvePresignEndpoint(): string {

fluxer_api/src/api/infrastructure/tests/EmailDnsValidationService.test.ts

@@ -0,0 +1,220 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {ms} from 'itty-time';
+import {describe, expect, it} from 'vitest';
+import {Config} from '../../Config';
+import {getInstanceConfigRepository} from '../../middleware/ServiceSingletons';
+import {EmailDnsValidationService} from '../EmailDnsValidationService';
+
+interface MxRecord {
+	exchange: string;
+	priority: number;
+}
+
+function dnsError(code: string): NodeJS.ErrnoException {
+	const error: NodeJS.ErrnoException = new Error(`dns lookup failed with ${code}`);
+	error.code = code;
+	return error;
+}
+
+class FakeDnsResolver {
+	readonly lookups: Array<string> = [];
+	mxRecords: Array<MxRecord> = [{exchange: 'mx.example.com', priority: 10}];
+	mxErrorCode: string | null = null;
+	addressErrorCode: string | null = 'ENOTFOUND';
+	addresses: Array<string> = [];
+	stall = false;
+
+	async resolveMx(domain: string): Promise<Array<MxRecord>> {
+		this.lookups.push(`mx:${domain}`);
+		if (this.stall) {
+			return new Promise<Array<MxRecord>>(() => {});
+		}
+		if (this.mxErrorCode) {
+			throw dnsError(this.mxErrorCode);
+		}
+		return this.mxRecords;
+	}
+
+	async resolve4(domain: string): Promise<Array<string>> {
+		this.lookups.push(`a:${domain}`);
+		if (this.addressErrorCode) {
+			throw dnsError(this.addressErrorCode);
+		}
+		return this.addresses;
+	}
+
+	async resolve6(domain: string): Promise<Array<string>> {
+		this.lookups.push(`aaaa:${domain}`);
+		if (this.addressErrorCode) {
+			throw dnsError(this.addressErrorCode);
+		}
+		return this.addresses;
+	}
+}
+
+describe('EmailDnsValidationService', () => {
+	it('skips the lookup when the instance sends no mail', async () => {
+		const resolver = new FakeDnsResolver();
+		resolver.mxErrorCode = 'ENOTFOUND';
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => false,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(resolver.lookups).toEqual([]);
+	});
+
+	it('looks the domain up when the instance sends mail', async () => {
+		const resolver = new FakeDnsResolver();
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(resolver.lookups).toEqual(['mx:gmail.com']);
+	});
+
+	it('follows the env email flag when no gate is supplied and the operator set nothing', async () => {
+		expect(Config.email.enabled).toBe(true);
+		const resolver = new FakeDnsResolver();
+		const service = new EmailDnsValidationService({resolver, enforceInTestMode: true});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(resolver.lookups).toEqual(['mx:gmail.com']);
+	});
+
+	it('follows the runtime instance email setting over the env flag', async () => {
+		expect(Config.email.enabled).toBe(true);
+		await getInstanceConfigRepository().setInstanceIntegrationsConfig({email: {enabled: false}});
+		const resolver = new FakeDnsResolver();
+		resolver.mxErrorCode = 'ENOTFOUND';
+		const service = new EmailDnsValidationService({resolver, enforceInTestMode: true});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(resolver.lookups).toEqual([]);
+	});
+
+	it('still rejects a syntactically broken address when the instance sends no mail', async () => {
+		const resolver = new FakeDnsResolver();
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => false,
+		});
+		expect(await service.hasValidDnsRecords('probe@')).toBe(false);
+		expect(resolver.lookups).toEqual([]);
+	});
+
+	it('rejects a domain that does not exist', async () => {
+		const resolver = new FakeDnsResolver();
+		resolver.mxErrorCode = 'ENOTFOUND';
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(false);
+		expect(resolver.lookups).toEqual(['mx:asdf.asdf']);
+	});
+
+	it('accepts a domain that publishes address records but no mail records', async () => {
+		const resolver = new FakeDnsResolver();
+		resolver.mxErrorCode = 'ENODATA';
+		resolver.addressErrorCode = null;
+		resolver.addresses = ['198.51.100.10'];
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(resolver.lookups).toEqual(['mx:mail-less.test', 'a:mail-less.test', 'aaaa:mail-less.test']);
+	});
+
+	it('rejects a domain that publishes neither mail nor address records', async () => {
+		const resolver = new FakeDnsResolver();
+		resolver.mxErrorCode = 'ENODATA';
+		resolver.addressErrorCode = 'ENODATA';
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(false);
+		expect(resolver.lookups).toEqual(['mx:no-records.test', 'a:no-records.test', 'aaaa:no-records.test']);
+	});
+
+	it('allows the address when the resolver fails transiently', async () => {
+		const resolver = new FakeDnsResolver();
+		resolver.mxErrorCode = 'ESERVFAIL';
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+	});
+
+	it('does not cache a transient failure as a verified domain', async () => {
+		const resolver = new FakeDnsResolver();
+		resolver.mxErrorCode = 'ESERVFAIL';
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+			positiveTtlMs: ms('30 minutes'),
+			negativeTtlMs: 0,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(resolver.lookups).toEqual(['mx:asdf.asdf', 'mx:asdf.asdf']);
+	});
+
+	it('caches a verified domain for the positive ttl', async () => {
+		const resolver = new FakeDnsResolver();
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+			positiveTtlMs: ms('30 minutes'),
+			negativeTtlMs: 0,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(resolver.lookups).toEqual(['mx:gmail.com']);
+	});
+
+	it('gives up on a stalled resolver instead of hanging', async () => {
+		const resolver = new FakeDnsResolver();
+		resolver.stall = true;
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+			lookupTimeoutMs: 10,
+		});
+		const startedAtMs = Date.now();
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(true);
+		expect(Date.now() - startedAtMs).toBeLessThan(ms('5 seconds'));
+		expect(resolver.lookups).toEqual(['mx:stalled.test']);
+	});
+
+	it('bounds the domain cache', async () => {
+		const resolver = new FakeDnsResolver();
+		resolver.mxErrorCode = 'ENOTFOUND';
+		const service = new EmailDnsValidationService({
+			resolver,
+			enforceInTestMode: true,
+			isEmailEnabled: async () => true,
+			maxCachedDomains: 2,
+		});
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(false);
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(false);
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(false);
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(false);
+		expect(resolver.lookups).toEqual(['mx:first.test', 'mx:second.test', 'mx:third.test']);
+		expect(await service.hasValidDnsRecords('[email protected]')).toBe(false);
+		expect(resolver.lookups).toEqual(['mx:first.test', 'mx:second.test', 'mx:third.test', 'mx:first.test']);
+	});
+});

fluxer_api/src/api/infrastructure/tests/LiveKitService.test.ts

@@ -1,19 +1,9 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
-import type {WebhookEvent} from 'livekit-server-sdk';
 import {AccessToken, TrackSource} from 'livekit-server-sdk';
-import {describe, expect, it, vi} from 'vitest';
-import {createUserID} from '../../BrandedTypes';
-import {getConfig} from '../../Config';
-import type {LimitConfigService} from '../../limits/LimitConfigService';
-import type {User} from '../../models/User';
-import type {IUserRepository} from '../../user/IUserRepository';
-import type {VoiceTopology} from '../../voice/VoiceTopology';
-import type {IGatewayService} from '../IGatewayService';
-import type {ILiveKitService} from '../ILiveKitService';
-import type {IVoiceRoomStore} from '../IVoiceRoomStore';
-import {computeLiveKitPublishSources, computeRevokedPublishGrant, VOICE_TOKEN_TTL_SECONDS} from '../LiveKitService';
-import {LiveKitWebhookService} from '../LiveKitWebhookService';
+import {describe, expect, it} from 'vitest';
+import {createChannelID, createGuildID} from '../../BrandedTypes';
+import {computeLiveKitPublishSources, LiveKitService, VOICE_TOKEN_TTL_SECONDS} from '../LiveKitService';
 
 function decodeJwtPayload(token: string): Record<string, unknown> {
 	const [, payload] = token.split('.');
@@ -55,45 +45,6 @@ describe('LiveKitService publish permissions', () => {
 			canPublishSources: ['microphone', 'screen_share', 'screen_share_audio'],
 		});
 	});
-	it('revokes only the offending source and keeps the rest of the grant', () => {
-		expect(
-			computeRevokedPublishGrant(
-				{
-					canPublish: true,
-					canPublishSources: [
-						TrackSource.MICROPHONE,
-						TrackSource.CAMERA,
-						TrackSource.SCREEN_SHARE,
-						TrackSource.SCREEN_SHARE_AUDIO,
-					],
-				},
-				TrackSource.CAMERA,
-			),
-		).toEqual({
-			canPublish: true,
-			canPublishSources: [TrackSource.MICROPHONE, TrackSource.SCREEN_SHARE, TrackSource.SCREEN_SHARE_AUDIO],
-		});
-	});
-	it('revokes screen share audio together with screen share video', () => {
-		expect(
-			computeRevokedPublishGrant(
-				{
-					canPublish: true,
-					canPublishSources: [TrackSource.MICROPHONE, TrackSource.SCREEN_SHARE, TrackSource.SCREEN_SHARE_AUDIO],
-				},
-				TrackSource.SCREEN_SHARE,
-			),
-		).toEqual({canPublish: true, canPublishSources: [TrackSource.MICROPHONE]});
-	});
-	it('treats an empty source list as every source and never leaves it empty', () => {
-		expect(computeRevokedPublishGrant({canPublish: true, canPublishSources: []}, TrackSource.CAMERA)).toEqual({
-			canPublish: true,
-			canPublishSources: [TrackSource.MICROPHONE, TrackSource.SCREEN_SHARE, TrackSource.SCREEN_SHARE_AUDIO],
-		});
-		expect(
-			computeRevokedPublishGrant({canPublish: true, canPublishSources: [TrackSource.CAMERA]}, TrackSource.CAMERA),
-		).toEqual({canPublish: false, canPublishSources: []});
-	});
 	it('bounds voice token lifetime to the configured TTL', async () => {
 		const token = new AccessToken('test-key', 'test-secret', {
 			identity: 'user_1_conn',
@@ -108,107 +59,77 @@ describe('LiveKitService publish permissions', () => {
 	});
 });
 
-function createFreeUser(): User {
-	return {
-		id: createUserID(1n),
-		isBot: false,
-		premiumType: null,
-		premiumUntil: null,
-		premiumGiftExtensionEndsAt: null,
-		premiumWillCancel: false,
-		premiumGraceEndsAt: null,
-		flags: 0n,
-		premiumFlags: 0,
-		traits: new Set<string>(),
-	} as unknown as User;
+class FakeTwirpError extends Error {
+	status: number;
+	code?: string;
+	constructor(message: string, status: number, code?: string) {
+		super(message);
+		this.name = 'TwirpError';
+		this.status = status;
+		this.code = code;
+	}
 }
 
-function createTrackPublishedEvent(width: number, height: number): WebhookEvent {
-	return {
-		event: 'track_published',
-		room: {name: 'guild_2_channel_3'},
-		participant: {identity: 'user_1_conn'},
-		track: {type: 1, source: TrackSource.CAMERA, sid: 'TR_oversized', width, height},
-	} as unknown as WebhookEvent;
-}
-
-function createWebhookHarness() {
-	const muteParticipantTrack = vi.fn().mockResolvedValue(true);
-	const revokeParticipantPublishSource = vi.fn().mockResolvedValue(true);
-	const disconnectParticipant = vi.fn().mockResolvedValue(undefined);
-	const disconnectVoiceUserIfInChannel = vi.fn().mockResolvedValue(undefined);
-	const service = new LiveKitWebhookService(
-		{
-			getPinnedRoomServer: vi.fn().mockResolvedValue({regionId: 'region-1', serverId: 'region-1-server-1'}),
-		} as unknown as IVoiceRoomStore,
-		{disconnectVoiceUserIfInChannel} as unknown as IGatewayService,
-		{findUnique: vi.fn().mockResolvedValue(createFreeUser())} as unknown as IUserRepository,
-		{muteParticipantTrack, revokeParticipantPublishSource, disconnectParticipant} as unknown as ILiveKitService,
-		{
-			getAllRegions: () => [],
-			getServersForRegion: () => [],
-			registerSubscriber: () => {},
-		} as unknown as VoiceTopology,
-		{getConfigSnapshot: () => null} as unknown as LimitConfigService,
-	);
-	return {
+function createServiceWithRoomServiceClient(roomServiceClient: unknown): LiveKitService {
+	const service = Object.create(LiveKitService.prototype) as LiveKitService;
+	Reflect.set(
 		service,
-		muteParticipantTrack,
-		revokeParticipantPublishSource,
-		disconnectParticipant,
-		disconnectVoiceUserIfInChannel,
-	};
+		'serverClients',
+		new Map([
+			[
+				'region-1',
+				new Map([
+					[
+						'region-1-server-1',
+						{
+							endpoint: 'ws://livekit.test/livekit',
+							apiKey: 'test-key',
+							apiSecret: 'test-secret',
+							isActive: true,
+							roomServiceClient,
+						},
+					],
+				]),
+			],
+		]),
+	);
+	return service;
 }
 
-describe('LiveKit free tier video resolution enforcement', () => {
-	it('mutes the oversized track and revokes its source instead of ending the call', async () => {
-		const {
-			service,
-			muteParticipantTrack,
-			revokeParticipantPublishSource,
-			disconnectParticipant,
-			disconnectVoiceUserIfInChannel,
-		} = createWebhookHarness();
+describe('LiveKitService listParticipants', () => {
+	const params = {
+		guildId: createGuildID(1n),
+		channelId: createChannelID(2n),
+		regionId: 'region-1',
+		serverId: 'region-1-server-1',
+	};
 
-		await service.handleTrackPublished(createTrackPublishedEvent(1920, 1080), 'api-key');
-
-		expect(muteParticipantTrack).toHaveBeenCalledTimes(1);
-		expect(muteParticipantTrack).toHaveBeenCalledWith(
-			expect.objectContaining({trackSid: 'TR_oversized', muted: true, regionId: 'region-1'}),
-		);
-		expect(revokeParticipantPublishSource).toHaveBeenCalledTimes(1);
-		expect(revokeParticipantPublishSource).toHaveBeenCalledWith(
-			expect.objectContaining({source: TrackSource.CAMERA, connectionId: 'conn', regionId: 'region-1'}),
-		);
-		expect(disconnectParticipant).not.toHaveBeenCalled();
-		expect(disconnectVoiceUserIfInChannel).not.toHaveBeenCalled();
+	it('reports a 404 as an unreadable room instead of an empty one', async () => {
+		const service = createServiceWithRoomServiceClient({
+			listParticipants: async () => {
+				throw new FakeTwirpError('not_found', 404, 'not_found');
+			},
+		});
+		const result = await service.listParticipants(params);
+		expect(result.status).toBe('error');
 	});
 
-	it('leaves tracks within the free tier limits alone', async () => {
-		const {service, muteParticipantTrack, revokeParticipantPublishSource, disconnectParticipant} =
-			createWebhookHarness();
-
-		await service.handleTrackPublished(createTrackPublishedEvent(1280, 720), 'api-key');
-
-		expect(muteParticipantTrack).not.toHaveBeenCalled();
-		expect(revokeParticipantPublishSource).not.toHaveBeenCalled();
-		expect(disconnectParticipant).not.toHaveBeenCalled();
+	it('reports a bad_route 404 as an unreadable room instead of an empty one', async () => {
+		const service = createServiceWithRoomServiceClient({
+			listParticipants: async () => {
+				throw new FakeTwirpError('invalid path prefix', 404, 'bad_route');
+			},
+		});
+		const result = await service.listParticipants(params);
+		expect(result.status).toBe('error');
+		expect(result.status === 'error' && result.retryable).toBe(false);
 	});
 
-	it('does not enforce resolution limits on self-hosted instances', async () => {
-		const {service, muteParticipantTrack, revokeParticipantPublishSource, disconnectParticipant} =
-			createWebhookHarness();
-		const config = getConfig();
-		const originalSelfHosted = config.instance.selfHosted;
-		config.instance.selfHosted = true;
-		try {
-			await service.handleTrackPublished(createTrackPublishedEvent(3840, 2160), 'api-key');
-		} finally {
-			config.instance.selfHosted = originalSelfHosted;
-		}
-
-		expect(muteParticipantTrack).not.toHaveBeenCalled();
-		expect(revokeParticipantPublishSource).not.toHaveBeenCalled();
-		expect(disconnectParticipant).not.toHaveBeenCalled();
+	it('still reports a genuinely empty room as empty', async () => {
+		const service = createServiceWithRoomServiceClient({
+			listParticipants: async () => [],
+		});
+		const result = await service.listParticipants(params);
+		expect(result).toEqual({status: 'ok', participants: []});
 	});
 });

fluxer_api/src/api/instance/DateOfBirthCollectionCache.ts

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import {Config} from '../Config';
+
+let cachedCollectDateOfBirth: boolean | null = null;
+
+export function getDefaultDateOfBirthCollection(): boolean {
+	return !Config.instance.selfHosted;
+}
+
+export function instanceCollectsDateOfBirth(): boolean {
+	return cachedCollectDateOfBirth ?? getDefaultDateOfBirthCollection();
+}
+
+export function setCachedDateOfBirthCollection(collect: boolean): void {
+	cachedCollectDateOfBirth = collect;
+}

fluxer_api/src/api/instance/GatewayRolloutConfigPublisher.test.ts

@@ -63,8 +63,6 @@ describe('GatewayRolloutConfigPublisher', () => {
 			gateway_dispatch_relay_shards: 32,
 			gateway_dispatch_relay_max_queue: 50000,
 			voice_e2ee_scope: 'guild_feature_only',
-			voice_reconciliation_v3_percentage: 100,
-			voice_reconciliation_v3_interval_ms: 2000,
 		};
 
 		await publisher.publish(config);

fluxer_api/src/api/instance/InstanceConfigRepository.ts

@@ -17,6 +17,7 @@ import {resolveDeferredPhoneGateEnabled, setCachedDeferredPhoneGateEnabled} from
 import {InstanceConfiguration} from '../Tables';
 import {DEFAULT_DECAY_CONSTANTS, DEFAULT_RENEWAL_CONSTANTS} from '../utils/AttachmentDecay';
 import {isJsonRecord, parseJsonArray, parseJsonRecord} from '../utils/JsonBoundaryUtils';
+import {getDefaultDateOfBirthCollection, setCachedDateOfBirthCollection} from './DateOfBirthCollectionCache';
 import {normalizeSsoAllowedEmailDomains} from './SsoConfigValidation';
 
 const GATEWAY_ROLLOUT_CONFIG_KEY = 'gateway_rollout_config';
@@ -41,8 +42,6 @@ const DEFAULT_GATEWAY_ROLLOUT_CONFIG: GatewayRolloutConfig = {
 	gateway_dispatch_relay_shards: 32,
 	gateway_dispatch_relay_max_queue: 50000,
 	voice_e2ee_scope: 'guild_feature_only',
-	voice_reconciliation_v3_percentage: 100,
-	voice_reconciliation_v3_interval_ms: 2000,
 };
 export type InstanceRegistrationMode = 'open' | 'approval' | 'closed';
 export interface InstanceRegistrationConfig {
@@ -357,11 +356,21 @@ function getDefaultAppPublicConfig(): InstanceAppPublicConfig {
 			privacy_url: null,
 		},
 		registration: {
-			collect_date_of_birth: !Config.instance.selfHosted,
+			collect_date_of_birth: getDefaultDateOfBirthCollection(),
 		},
 	};
 }
 
+function parseAppPublicConfig(raw: string): InstanceAppPublicConfig {
+	try {
+		const parsed: unknown = JSON.parse(raw);
+		return normalizeAppPublicConfig(parsed);
+	} catch (error) {
+		Logger.warn({error}, 'Invalid app public config JSON, returning defaults');
+		return getDefaultAppPublicConfig();
+	}
+}
+
 function normalizeAppPublicConfig(value: unknown): InstanceAppPublicConfig {
 	const defaults = getDefaultAppPublicConfig();
 	if (!isJsonRecord(value)) {
@@ -939,6 +948,7 @@ export class InstanceConfigRepository {
 				this.configCache = await this.fetchAllConfigsFromDatabase();
 			} while (this.refreshRequested);
 			this.syncDeferredPhoneGateCache(this.configCache.get(INSTANCE_POLICY_CONFIG_KEY) ?? null);
+			this.syncDateOfBirthCollectionCache(this.configCache.get(APP_PUBLIC_CONFIG_KEY) ?? null);
 		})().finally(() => {
 			this.refreshPromise = null;
 		});
@@ -950,6 +960,11 @@ export class InstanceConfigRepository {
 		setCachedDeferredPhoneGateEnabled(resolveDeferredPhoneGateEnabled(policy));
 	}
 
+	private syncDateOfBirthCollectionCache(raw: string | null): void {
+		const appPublic = raw ? normalizeAppPublicConfig(parseJsonRecord(raw)) : getDefaultAppPublicConfig();
+		setCachedDateOfBirthCollection(appPublic.registration.collect_date_of_birth);
+	}
+
 	private updateCachedConfigs(entries: Array<[string, string]>): void {
 		if (!this.configCache) {
 			return;
@@ -1067,16 +1082,9 @@ export class InstanceConfigRepository {
 
 	async getAppPublicConfig(): Promise<InstanceAppPublicConfig> {
 		const raw = await this.getConfig(APP_PUBLIC_CONFIG_KEY);
-		if (!raw) {
-			return getDefaultAppPublicConfig();
-		}
-		try {
-			const parsed: unknown = JSON.parse(raw);
-			return normalizeAppPublicConfig(parsed);
-		} catch (error) {
-			Logger.warn({error}, 'Invalid app public config JSON, returning defaults');
-			return getDefaultAppPublicConfig();
-		}
+		const config = raw ? parseAppPublicConfig(raw) : getDefaultAppPublicConfig();
+		setCachedDateOfBirthCollection(config.registration.collect_date_of_birth);
+		return config;
 	}
 
 	async setAppPublicConfig(config: {
@@ -1105,6 +1113,7 @@ export class InstanceConfigRepository {
 			},
 		});
 		await this.setConfig(APP_PUBLIC_CONFIG_KEY, JSON.stringify(next));
+		setCachedDateOfBirthCollection(next.registration.collect_date_of_birth);
 		return next;
 	}
 

fluxer_api/src/api/middleware/AbusiveIpAutoBanner.ts

@@ -15,6 +15,7 @@ import type {HonoEnv} from '../types/HonoEnv';
 import {parseJsonRecord} from '../utils/JsonBoundaryUtils';
 import {ipBanCache} from './IpBanMiddleware';
 import {getIpInfoService} from './ServiceMiddleware';
+import {getKVClient} from './ServiceRegistry';
 import {getCacheService} from './ServiceSingletons';
 
 type IpClass = 'datacenter' | 'anonymous' | 'mobile' | 'residential' | 'unknown';
@@ -51,6 +52,22 @@ interface AbuseSignalOptions {
 	weight?: number;
 }
 
+interface PeerIpClassHint {
+	ipClass: IpClass;
+	expiresAtMs: number;
+}
+
+interface OutboundIpClass {
+	lookupIp: string;
+	ipClass: IpClass;
+}
+
+interface ResolvedBanClass {
+	ipClass: IpClass;
+	authoritative: boolean;
+	blocked: boolean;
+}
+
 const WINDOW_MS = positiveNumberFromEnv('FLUXER_ABUSE_WINDOW_MS', 60_000);
 const THRESHOLD_DATACENTER = positiveNumberFromEnv('FLUXER_ABUSE_THRESHOLD_DATACENTER', 20);
 const THRESHOLD_ANONYMOUS = positiveNumberFromEnv('FLUXER_ABUSE_THRESHOLD_ANONYMOUS', 500);
@@ -73,6 +90,14 @@ const REQUIRED_SCORE_WINDOWS_FOR_AUTO_BAN = positiveNumberFromEnv(
 	3,
 );
 const REPLICATION_CHANNEL = 'abuse_tracker:ticks';
+const IP_CLASS_CHANNEL = 'abuse_tracker:ipclass';
+const IP_CLASS_CLAIM_PREFIX = 'abuse:ipclass:claim:';
+const IP_CLASS_CLAIM_ENABLED = process.env.FLUXER_ABUSE_IP_CLASS_CLAIM_ENABLED !== '0';
+const IP_CLASS_CLAIM_TTL_SECONDS = positiveNumberFromEnv('FLUXER_ABUSE_IP_CLASS_CLAIM_TTL_SEC', 15);
+const DEFAULT_IP_CLASS_PENDING_TTL_MS = positiveNumberFromEnv('FLUXER_ABUSE_IP_CLASS_PENDING_TTL_MS', 20_000);
+const DEFAULT_IP_CLASS_NEGATIVE_TTL_MS = positiveNumberFromEnv('FLUXER_ABUSE_IP_CLASS_NEGATIVE_TTL_MS', 300_000);
+const DEFAULT_IP_CLASS_HINT_TTL_MS = positiveNumberFromEnv('FLUXER_ABUSE_IP_CLASS_HINT_TTL_MS', 600_000);
+const IP_CLASSES = ['datacenter', 'anonymous', 'mobile', 'residential', 'unknown'] as const;
 const POD_ID = process.env.HOSTNAME ?? randomUUID();
 
 type ReplicatedTick = [banKey: string, scoreDelta: number, tokenHashes: Array<string>, lookupIp: string];
@@ -83,11 +108,23 @@ interface ReplicationMessage {
 	ts: number;
 }
 
+type IpClassEntry = [banKey: string, lookupIp: string, ipClass: IpClass];
+
+interface IpClassMessage {
+	sender: string;
+	entries: Array<IpClassEntry>;
+	ts: number;
+}
+
 const records = new Map<string, AbuseRecord>();
 const outboundDeltas = new Map<string, OutboundEntry>();
 const persistentScoreWindows = new Map<string, PersistentScoreState>();
 const ipClassCache = new Map<string, IpClass>();
-const ipClassPending = new Set<string>();
+const ipClassPending = new Map<string, number>();
+const ipClassNegativeUntil = new Map<string, number>();
+const peerIpClassHints = new Map<string, PeerIpClassHint>();
+const outboundIpClasses = new Map<string, OutboundIpClass>();
+const pendingIpClassTasks = new Set<Promise<void>>();
 const recordedClientErrorRequests = new WeakSet<Request>();
 const pendingAutoBanTasks = new Set<Promise<void>>();
 const adminRepository = new AdminRepository();
@@ -97,6 +134,9 @@ let flushTimer: NodeJS.Timeout | null = null;
 let kvSubscription: IKVSubscription | null = null;
 let messageHandler: ((channel: string, message: string) => void) | null = null;
 let errorHandler: ((error: Error) => void) | null = null;
+let ipClassPendingTtlMs = DEFAULT_IP_CLASS_PENDING_TTL_MS;
+let ipClassNegativeTtlMs = DEFAULT_IP_CLASS_NEGATIVE_TTL_MS;
+let ipClassHintTtlMs = DEFAULT_IP_CLASS_HINT_TTL_MS;
 
 function positiveNumberFromEnv(name: string, fallback: number): number {
 	const raw = process.env[name];
@@ -164,13 +204,99 @@ function shouldSkipAutoBanForIpClass(ipClass: IpClass): boolean {
 	return ipClass === 'mobile';
 }
 
+function isIpClass(value: unknown): value is IpClass {
+	return typeof value === 'string' && (IP_CLASSES as ReadonlyArray<string>).includes(value);
+}
+
+function getOwnIpClass(key: string, now: number): IpClass | null {
+	const cached = ipClassCache.get(key);
+	if (cached === undefined) return null;
+	const negativeUntilMs = ipClassNegativeUntil.get(key);
+	if (negativeUntilMs !== undefined && negativeUntilMs <= now) {
+		ipClassCache.delete(key);
+		ipClassNegativeUntil.delete(key);
+		return null;
+	}
+	return cached;
+}
+
+function isOwnIpClassNegative(key: string, now: number): boolean {
+	const negativeUntilMs = ipClassNegativeUntil.get(key);
+	return negativeUntilMs !== undefined && negativeUntilMs > now;
+}
+
+function setOwnIpClass(key: string, lookupIp: string, ipClass: IpClass, negative: boolean): void {
+	ipClassCache.set(key, ipClass);
+	if (negative) {
+		ipClassNegativeUntil.set(key, Date.now() + ipClassNegativeTtlMs);
+	} else {
+		ipClassNegativeUntil.delete(key);
+		peerIpClassHints.delete(key);
+	}
+	ipClassPending.delete(key);
+	if (!negative && ipClass !== 'unknown') {
+		queueOutboundIpClass(key, lookupIp, ipClass);
+	}
+	const rec = records.get(key);
+	if (rec) maybeFireAutoBan(key, rec);
+}
+
+function isIpClassPending(key: string, now: number): boolean {
+	const expiresAtMs = ipClassPending.get(key);
+	if (expiresAtMs === undefined) return false;
+	if (expiresAtMs <= now) {
+		ipClassPending.delete(key);
+		return false;
+	}
+	return true;
+}
+
+function getPeerClassHint(key: string, now: number): IpClass | null {
+	const hint = peerIpClassHints.get(key);
+	if (!hint) return null;
+	if (hint.expiresAtMs <= now) {
+		peerIpClassHints.delete(key);
+		return null;
+	}
+	return hint.ipClass;
+}
+
+function recordPeerClassHint(key: string, ipClass: IpClass): void {
+	peerIpClassHints.set(key, {ipClass, expiresAtMs: Date.now() + ipClassHintTtlMs});
+}
+
+function isStricterThanUnknown(ipClass: IpClass): boolean {
+	return (
+		scoreThresholdFor(ipClass) <= scoreThresholdFor('unknown') &&
+		tokenDiversityThresholdFor(ipClass) <= tokenDiversityThresholdFor('unknown')
+	);
+}
+
+function resolveClassForBan(key: string, now: number): ResolvedBanClass {
+	const own = getOwnIpClass(key, now);
+	if (own !== null && !isOwnIpClassNegative(key, now)) return {ipClass: own, authoritative: true, blocked: false};
+	const hint = getPeerClassHint(key, now);
+	if (hint !== null && isStricterThanUnknown(hint)) return {ipClass: hint, authoritative: true, blocked: false};
+	if (hint !== null) return {ipClass: 'unknown', authoritative: false, blocked: true};
+	if (own !== null) return {ipClass: own, authoritative: true, blocked: false};
+	return {ipClass: 'unknown', authoritative: false, blocked: isIpClassPending(key, now)};
+}
+
 function pruneIfNeeded(now: number): void {
 	if (records.size < MAX_TRACKED_IPS) return;
+	for (const [key, expiresAtMs] of ipClassPending) {
+		if (expiresAtMs <= now) ipClassPending.delete(key);
+	}
+	for (const [key, hint] of peerIpClassHints) {
+		if (hint.expiresAtMs <= now) peerIpClassHints.delete(key);
+	}
 	for (const [key, rec] of records) {
-		if (rec.windowStartMs + WINDOW_MS < now) {
+		if (rec.windowStartMs + WINDOW_MS < now && !ipClassPending.has(key)) {
 			records.delete(key);
 			ipClassCache.delete(key);
-			ipClassPending.delete(key);
+			ipClassNegativeUntil.delete(key);
+			peerIpClassHints.delete(key);
+			outboundIpClasses.delete(key);
 		}
 		if (records.size < MAX_TRACKED_IPS * 0.9) return;
 	}
@@ -222,9 +348,11 @@ function queueOutboundDelta(
 	}
 }
 
-function shouldEnsureIpClassLookup(key: string, rec: AbuseRecord): boolean {
-	if (ipClassCache.has(key) || ipClassPending.has(key)) return false;
-	return rec.score >= MIN_SCORE_FOR_IP_LOOKUP || rec.distinctTokenHashes.size >= MIN_TOKENS_FOR_IP_LOOKUP;
+function shouldEnsureIpClassLookup(key: string, rec: AbuseRecord, now: number): boolean {
+	if (getOwnIpClass(key, now) !== null || isIpClassPending(key, now)) return false;
+	if (getPeerClassHint(key, now) !== null) return false;
+	if (rec.score < MIN_SCORE_FOR_IP_LOOKUP && rec.distinctTokenHashes.size < MIN_TOKENS_FOR_IP_LOOKUP) return false;
+	return ipBanCache.getMatch(rec.lookupIp) === null;
 }
 
 function markScoreThresholdWindow(key: string, rec: AbuseRecord, now: number): number {
@@ -247,33 +375,53 @@ function markScoreThresholdWindow(key: string, rec: AbuseRecord, now: number): n
 	return state.count;
 }
 
+async function claimIpClassLookup(key: string): Promise<boolean> {
+	if (!IP_CLASS_CLAIM_ENABLED) return true;
+	if (!kvPublisher) return true;
+	try {
+		return await getKVClient().setnx(`${IP_CLASS_CLAIM_PREFIX}${key}`, POD_ID, IP_CLASS_CLAIM_TTL_SECONDS);
+	} catch {
+		return true;
+	}
+}
+
+async function runIpClassLookup(key: string, lookupIp: string): Promise<void> {
+	try {
+		if (!(await claimIpClassLookup(key))) return;
+		const result = await getIpInfoService().lookup(lookupIp, {source: 'AbusiveIpAutoBanner', reason: 'classify'});
+		setOwnIpClass(key, lookupIp, classifyIpInfo(result), !result.available);
+	} catch (err) {
+		setOwnIpClass(key, lookupIp, 'unknown', true);
+		Logger.warn({err, ip: lookupIp}, '[abuse-auto-ban] IP classification lookup failed');
+	}
+}
+
 function ensureIpClassLookup(key: string, lookupIp: string): void {
-	if (ipClassCache.has(key) || ipClassPending.has(key)) return;
-	ipClassPending.add(key);
-	void (async () => {
-		try {
-			const result = await getIpInfoService().lookup(lookupIp, {source: 'AbusiveIpAutoBanner', reason: 'classify'});
-			ipClassCache.set(key, classifyIpInfo(result));
-		} catch (err) {
-			ipClassCache.set(key, 'unknown');
-			Logger.warn({err, ip: lookupIp}, '[abuse-auto-ban] IP classification lookup failed');
-		} finally {
-			ipClassPending.delete(key);
-			const rec = records.get(key);
-			if (rec) maybeFireAutoBan(key, rec);
-		}
-	})();
+	const now = Date.now();
+	if (getOwnIpClass(key, now) !== null || isIpClassPending(key, now)) return;
+	ipClassPending.set(key, now + ipClassPendingTtlMs);
+	const task = runIpClassLookup(key, lookupIp);
+	pendingIpClassTasks.add(task);
+	void task.finally(() => {
+		pendingIpClassTasks.delete(task);
+	});
 }
 
 function maybeFireAutoBan(key: string, rec: AbuseRecord): void {
 	if (rec.autoBanFired) return;
-	const ipClass = ipClassCache.get(key) ?? 'unknown';
+	const now = Date.now();
+	if (ipBanCache.getMatch(rec.lookupIp) !== null) {
+		rec.autoBanFired = true;
+		return;
+	}
+	const resolved = resolveClassForBan(key, now);
+	const ipClass = resolved.ipClass;
 	const scoreThreshold = scoreThresholdFor(ipClass);
 	const tokenThreshold = tokenDiversityThresholdFor(ipClass);
 	const overScore = rec.score >= scoreThreshold;
 	const overTokenDiversity = rec.distinctTokenHashes.size >= tokenThreshold;
 	if (!overScore && !overTokenDiversity) return;
-	if (!ipClassCache.has(key) && ipClassPending.has(key)) {
+	if (resolved.blocked) {
 		return;
 	}
 	if (shouldSkipAutoBanForIpClass(ipClass)) {
@@ -369,7 +517,7 @@ export function recordAbuseSignal(ip: string | null, reason: string, opts: Abuse
 		queuedTokenHash = opts.tokenHash;
 	}
 	queueOutboundDelta(signalIp, weight, queuedTokenHash, hadToken);
-	if (shouldEnsureIpClassLookup(signalIp.banKey, rec)) {
+	if (shouldEnsureIpClassLookup(signalIp.banKey, rec, now)) {
 		ensureIpClassLookup(signalIp.banKey, signalIp.lookupIp);
 	}
 	maybeFireAutoBan(signalIp.banKey, rec);
@@ -404,7 +552,7 @@ function applyReplicatedTick(tick: ReplicatedTick): void {
 		if (rec.distinctTokenHashes.size >= MAX_TOKEN_HASHES_PER_IP) break;
 		rec.distinctTokenHashes.add(tokenHash);
 	}
-	if (shouldEnsureIpClassLookup(banKey, rec)) {
+	if (shouldEnsureIpClassLookup(banKey, rec, now)) {
 		ensureIpClassLookup(banKey, lookupIp);
 	}
 	maybeFireAutoBan(banKey, rec);
@@ -435,7 +583,56 @@ async function flushOutbound(): Promise<void> {
 	}
 }
 
+function queueOutboundIpClass(key: string, lookupIp: string, ipClass: IpClass): void {
+	if (!kvPublisher) return;
+	if (!outboundIpClasses.has(key) && outboundIpClasses.size >= MAX_TRACKED_IPS) return;
+	outboundIpClasses.set(key, {lookupIp, ipClass});
+}
+
+async function flushOutboundIpClasses(): Promise<void> {
+	if (!kvPublisher || outboundIpClasses.size === 0) return;
+	const entries: Array<IpClassEntry> = [];
+	const selectedKeys: Array<string> = [];
+	for (const [key, entry] of outboundIpClasses) {
+		entries.push([key, entry.lookupIp, entry.ipClass]);
+		selectedKeys.push(key);
+		if (entries.length >= MAX_BATCH_TICKS) break;
+	}
+	const message: IpClassMessage = {sender: POD_ID, entries, ts: Date.now()};
+	try {
+		await kvPublisher.publish(IP_CLASS_CHANNEL, JSON.stringify(message));
+		for (const key of selectedKeys) {
+			outboundIpClasses.delete(key);
+		}
+	} catch (err) {
+		Logger.warn({err, entryCount: entries.length}, '[abuse-auto-ban] Failed to publish abuse IP class batch');
+	}
+}
+
+function handleIpClassMessage(message: string): void {
+	const msg = parseJsonRecord(message);
+	if (!msg || msg.sender === POD_ID || !Array.isArray(msg.entries)) return;
+	for (const rawEntry of msg.entries) {
+		if (!Array.isArray(rawEntry) || rawEntry.length < 3) continue;
+		const [banKey, lookupIp, ipClass] = rawEntry;
+		if (typeof banKey !== 'string' || typeof lookupIp !== 'string' || !isIpClass(ipClass)) continue;
+		if (ipClass === 'unknown') continue;
+		const signalIp = normalizeSignalIp(lookupIp);
+		if (!signalIp || signalIp.banKey !== banKey) continue;
+		const rec = records.get(banKey);
+		if (!rec) continue;
+		const now = Date.now();
+		if (getOwnIpClass(banKey, now) !== null && !isOwnIpClassNegative(banKey, now)) continue;
+		recordPeerClassHint(banKey, ipClass);
+		maybeFireAutoBan(banKey, rec);
+	}
+}
+
 function handleReplicationMessage(channel: string, message: string): void {
+	if (channel === IP_CLASS_CHANNEL) {
+		handleIpClassMessage(message);
+		return;
+	}
 	if (channel !== REPLICATION_CHANNEL) return;
 	const msg = parseJsonRecord(message);
 	if (!msg || msg.sender === POD_ID || !Array.isArray(msg.ticks)) return;
@@ -469,11 +666,12 @@ export async function startAbuseReplicationSubscriber(kvClient: IKVProvider | nu
 	};
 	try {
 		await subscription.connect();
-		await subscription.subscribe(REPLICATION_CHANNEL);
+		await subscription.subscribe(REPLICATION_CHANNEL, IP_CLASS_CHANNEL);
 		subscription.on('message', messageHandler);
 		subscription.on('error', errorHandler);
 		flushTimer = setInterval(() => {
 			void flushOutbound();
+			void flushOutboundIpClasses();
 		}, BATCH_FLUSH_MS);
 		if (typeof flushTimer === 'object' && flushTimer && 'unref' in flushTimer) {
 			(flushTimer as {unref(): void}).unref();
@@ -514,11 +712,28 @@ export async function drainAbuseAutoBanTasksForTests(): Promise<void> {
 	await Promise.all([...pendingAutoBanTasks]);
 }
 
+export async function drainAbuseIpClassLookupsForTests(): Promise<void> {
+	await Promise.all([...pendingIpClassTasks]);
+}
+
+export function setAbuseIpClassTtlsForTests(opts: {negativeMs?: number; hintMs?: number; pendingMs?: number}): void {
+	if (opts.negativeMs !== undefined) ipClassNegativeTtlMs = opts.negativeMs;
+	if (opts.hintMs !== undefined) ipClassHintTtlMs = opts.hintMs;
+	if (opts.pendingMs !== undefined) ipClassPendingTtlMs = opts.pendingMs;
+}
+
 export function resetAbuseTrackingForTests(): void {
 	records.clear();
 	outboundDeltas.clear();
 	persistentScoreWindows.clear();
 	ipClassCache.clear();
 	ipClassPending.clear();
+	ipClassNegativeUntil.clear();
+	peerIpClassHints.clear();
+	outboundIpClasses.clear();
+	pendingIpClassTasks.clear();
 	pendingAutoBanTasks.clear();
+	ipClassPendingTtlMs = DEFAULT_IP_CLASS_PENDING_TTL_MS;
+	ipClassNegativeTtlMs = DEFAULT_IP_CLASS_NEGATIVE_TTL_MS;
+	ipClassHintTtlMs = DEFAULT_IP_CLASS_HINT_TTL_MS;
 }

fluxer_api/src/api/middleware/ServiceMiddleware.ts

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
 import crypto from 'node:crypto';
+import {lookupAsnByIp, lookupGeoipByIp} from '@pkgs/geoip/src/GeoipLookup';
 import {createIpInfoService, createUnavailableIpInfoService, type IpInfoService} from '@pkgs/geoip/src/IpInfoService';
 import {createMiddleware} from 'hono/factory';
 import type {ApiContext} from '../ApiContext';
@@ -58,8 +59,14 @@ import {createIpInfoChecker} from '../risk/adapters/IpInfoAdapter';
 import {createReverseDnsLookup} from '../risk/adapters/ReverseDnsAdapter';
 import {DeterministicRiskEngine} from '../risk/DeterministicRiskEngine';
 import {CassandraHistoricalOutcomeRepository} from '../risk/HistoricalOutcomeRepository';
+import {createKvIpInfoLookupBudget} from '../risk/IpInfoBudget';
 import {buildIpInfoCache, buildIpInfoRequestAuditLogger} from '../risk/IpInfoCacheFactory';
 import {CassandraRegistrationEventsRepository} from '../risk/RegistrationEventsRepository';
+import {
+	type IpInfoPrescreenVerdict,
+	ipInfoPrescreenOptionsFromEnv,
+	prescreenIpInfoLookup,
+} from '../risk/RegistrationIpPrescreen';
 import {CassandraRiskAssessmentRepository} from '../risk/RiskAssessmentRepository';
 import {createRiskToolbox} from '../risk/RiskToolboxFactory';
 import {CassandraSuspiciousIpRepository} from '../risk/SuspiciousIpRepository';
@@ -268,6 +275,7 @@ export function getIpInfoService(): IpInfoService {
 		apiKey: Config.risk.ipinfoApiKey,
 		cache,
 		auditLogger: buildIpInfoRequestAuditLogger(),
+		budget: createKvIpInfoLookupBudget({getKvClient: getKVClient}),
 	});
 	return _ipInfoService;
 }
@@ -293,7 +301,14 @@ function getRegistrationRiskEvaluator(): IRegistrationRiskEvaluator {
 		return _registrationRiskEvaluator;
 	}
 	const ipInfoService = getIpInfoService();
-	const ipInfoChecker = Config.risk.ipinfoApiKey ? createIpInfoChecker({ipInfoService}) : undefined;
+	const lookupLocalCity = (ip: string) => lookupGeoipByIp(ip, Config.geoip.maxmindDbPath);
+	const lookupLocalAsn = (ip: string) => lookupAsnByIp(ip, Config.geoip.maxmindAsnDbPath);
+	const prescreenOptions = ipInfoPrescreenOptionsFromEnv();
+	const prescreen = async (ip: string): Promise<IpInfoPrescreenVerdict> => {
+		const [city, asn] = await Promise.all([lookupLocalCity(ip), lookupLocalAsn(ip)]);
+		return prescreenIpInfoLookup({countryIso: city.countryCode, asn: asn.asn, asnOrg: asn.asnOrg}, prescreenOptions);
+	};
+	const ipInfoChecker = Config.risk.ipinfoApiKey ? createIpInfoChecker({ipInfoService, prescreen}) : undefined;
 	const cacheService = getCacheService();
 	const reverseDnsLookup = createReverseDnsLookup({cacheService});
 	const toolbox = createRiskToolbox({
@@ -305,6 +320,8 @@ function getRegistrationRiskEvaluator(): IRegistrationRiskEvaluator {
 		historicalOutcomeRepository: getHistoricalOutcomeRepository(),
 		suspiciousIpRepository: getSuspiciousIpRepository(),
 		cacheService,
+		lookupLocalCity,
+		lookupLocalAsn,
 	});
 	const engine = new DeterministicRiskEngine(toolbox, {
 		logger: Logger,
@@ -331,10 +348,8 @@ function getLiveKitWebhookService(): LiveKitWebhookService | null {
 			_liveKitWebhookService = new LiveKitWebhookService(
 				voiceRoomStore,
 				getGatewayService(),
-				getUserRepository(),
 				liveKitService,
 				voiceTopology,
-				getLimitConfigService(),
 			);
 		}
 	}

fluxer_api/src/api/middleware/ServiceRegistry.ts

@@ -28,6 +28,7 @@ import {setInjectedSearchProvider} from '../SearchFactory';
 import type {ISearchProvider} from '../search/ISearchProvider';
 import {VoiceAvailabilityService} from '../voice/VoiceAvailabilityService';
 import {VoiceRepository} from '../voice/VoiceRepository';
+import {VoiceServerLoadTracker} from '../voice/VoiceServerLoad';
 import {VoiceTopology} from '../voice/VoiceTopology';
 import type {WorkerTaskName} from '../worker/WorkerLaneConfig';
 
@@ -289,7 +290,10 @@ export async function ensureVoiceResourcesInitialized(): Promise<void> {
 			const topology = new VoiceTopology(voiceRepository, voiceConfigSubscriber);
 			await topology.initialize();
 			voiceTopology = topology;
-			voiceAvailabilityService = new VoiceAvailabilityService(topology);
+			voiceAvailabilityService = new VoiceAvailabilityService(
+				topology,
+				new VoiceServerLoadTracker({gatewayService: getGatewayService()}),
+			);
 			liveKitServiceInstance = new LiveKitService(topology);
 			voiceRoomStoreInstance = new VoiceRoomStore(getKVClient());
 		})().finally(() => {

fluxer_api/src/api/middleware/tests/AbusiveIpAutoBanner.test.ts

@@ -1,15 +1,21 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 
+import {getSameIpDecisionKey} from '@fluxer/ip_utils/src/IpAddress';
 import type {IpInfoLookupResult} from '@pkgs/geoip/src/IpInfoService';
 import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
 import {AdminRepository} from '../../admin/AdminRepository';
 import type {ApiTestHarness} from '../../test/ApiTestHarness';
 import {createApiTestHarness} from '../../test/ApiTestHarness';
+import type {MockKVProvider} from '../../test/mocks/MockKVProvider';
 import {
 	drainAbuseAutoBanTasksForTests,
+	drainAbuseIpClassLookupsForTests,
 	hashAuthToken,
 	recordAbuseSignal,
 	resetAbuseTrackingForTests,
+	setAbuseIpClassTtlsForTests,
+	startAbuseReplicationSubscriber,
+	stopAbuseReplicationSubscriber,
 } from '../AbusiveIpAutoBanner';
 import {ipBanCache} from '../IpBanMiddleware';
 import {setInjectedIpInfoService} from '../ServiceMiddleware';
@@ -65,6 +71,11 @@ function ipInfoResult(ip: string, overrides: Partial<IpInfoLookupResult> = {}):
 	};
 }
 
+function claimCallCount(harness: ApiTestHarness, banKey: string): number {
+	const kvProvider = harness.kvProvider as MockKVProvider;
+	return kvProvider.setnxSpy.mock.calls.filter(([key]) => key === `abuse:ipclass:claim:${banKey}`).length;
+}
+
 async function waitForAssertion(assertion: () => void): Promise<void> {
 	const deadline = Date.now() + 1000;
 	let lastError: unknown;
@@ -84,6 +95,7 @@ async function waitForAssertion(assertion: () => void): Promise<void> {
 describe('AbusiveIpAutoBanner', () => {
 	let harness: ApiTestHarness;
 	let adminRepository: AdminRepository;
+	let lookupCount = 0;
 	beforeAll(async () => {
 		harness = await createApiTestHarness();
 		adminRepository = new AdminRepository();
@@ -92,13 +104,18 @@ describe('AbusiveIpAutoBanner', () => {
 		await harness.reset();
 		resetAbuseTrackingForTests();
 		ipBanCache.resetCaches();
+		lookupCount = 0;
 		setInjectedIpInfoService({
 			async lookup(ip: string) {
+				lookupCount += 1;
 				return ipInfoResult(ip);
 			},
 		});
+		await stopAbuseReplicationSubscriber();
+		await startAbuseReplicationSubscriber(harness.kvProvider);
 	});
 	afterAll(async () => {
+		await stopAbuseReplicationSubscriber();
 		setInjectedIpInfoService(undefined);
 		await harness.shutdown();
 	});
@@ -117,7 +134,7 @@ describe('AbusiveIpAutoBanner', () => {
 	it('does not auto-ban after a single score-only spike', async () => {
 		const ip = '8.8.4.4';
 		recordAbuseSignal(ip, 'http_429', {weight: 150});
-		await new Promise((resolve) => setTimeout(resolve, 25));
+		await drainAbuseIpClassLookupsForTests();
 		await drainAbuseAutoBanTasksForTests();
 		expect(ipBanCache.isBanned(ip)).toBe(false);
 		await expect(adminRepository.isIpBanned(ip)).resolves.toBe(false);
@@ -135,7 +152,7 @@ describe('AbusiveIpAutoBanner', () => {
 		for (let i = 0; i < 10; i += 1) {
 			recordAbuseSignal(ip, 'auth_failure:session', {tokenHash: hashAuthToken(`mobile-invalid-${i}`)});
 		}
-		await new Promise((resolve) => setTimeout(resolve, 25));
+		await drainAbuseIpClassLookupsForTests();
 		await drainAbuseAutoBanTasksForTests();
 		expect(ipBanCache.isBanned(ip)).toBe(false);
 		await expect(adminRepository.isIpBanned(ip)).resolves.toBe(false);
@@ -153,7 +170,7 @@ describe('AbusiveIpAutoBanner', () => {
 		for (let i = 0; i < 100; i += 1) {
 			recordAbuseSignal(ip, 'auth_failure:session', {tokenHash: hashAuthToken(`mobile-threshold-${i}`)});
 		}
-		await new Promise((resolve) => setTimeout(resolve, 25));
+		await drainAbuseIpClassLookupsForTests();
 		await drainAbuseAutoBanTasksForTests();
 		expect(ipBanCache.isBanned(ip)).toBe(false);
 		await expect(adminRepository.isIpBanned(ip)).resolves.toBe(false);
@@ -168,4 +185,68 @@ describe('AbusiveIpAutoBanner', () => {
 			await expect(adminRepository.isIpBanned(ip)).resolves.toBe(false);
 		}
 	});
+	it('claims the class lookup exactly once for a burst on the same IP', async () => {
+		const ip = '8.8.8.8';
+		for (let i = 0; i < 10; i += 1) {
+			recordAbuseSignal(ip, 'auth_failure:session', {tokenHash: hashAuthToken(`claim-${i}`)});
+		}
+		await drainAbuseIpClassLookupsForTests();
+		await drainAbuseAutoBanTasksForTests();
+		expect(claimCallCount(harness, ip)).toBe(1);
+		expect(lookupCount).toBe(1);
+	});
+	it('does not pay for a lookup or ban when another pod owns the class claim', async () => {
+		const ip = '8.8.8.8';
+		await harness.kvProvider.setnx(`abuse:ipclass:claim:${ip}`, 'other-pod', 60);
+		for (let i = 0; i < 10; i += 1) {
+			recordAbuseSignal(ip, 'auth_failure:session', {tokenHash: hashAuthToken(`claim-loser-${i}`)});
+		}
+		await drainAbuseIpClassLookupsForTests();
+		await drainAbuseAutoBanTasksForTests();
+		expect(lookupCount).toBe(0);
+		expect(ipBanCache.isBanned(ip)).toBe(false);
+	});
+	it('does not classify an IPv4 address that is already banned', async () => {
+		const ip = '8.8.8.8';
+		ipBanCache.banTemp(ip, 3600);
+		for (let i = 0; i < 20; i += 1) {
+			recordAbuseSignal(ip, 'auth_failure:session', {tokenHash: hashAuthToken(`already-banned-${i}`)});
+		}
+		await drainAbuseIpClassLookupsForTests();
+		await drainAbuseAutoBanTasksForTests();
+		expect(lookupCount).toBe(0);
+		expect(claimCallCount(harness, ip)).toBe(0);
+	});
+	it('does not classify an IPv6 address inside an already banned /64', async () => {
+		const ip = '2606:4700:4700::1111';
+		const banKey = getSameIpDecisionKey(ip) ?? ip;
+		ipBanCache.banTemp(banKey, 3600);
+		for (let i = 0; i < 20; i += 1) {
+			recordAbuseSignal(ip, 'auth_failure:session', {tokenHash: hashAuthToken(`already-banned-v6-${i}`)});
+		}
+		await drainAbuseIpClassLookupsForTests();
+		await drainAbuseAutoBanTasksForTests();
+		expect(lookupCount).toBe(0);
+		expect(claimCallCount(harness, banKey)).toBe(0);
+	});
+	it('retries a failed classification once the negative TTL elapses', async () => {
+		const ip = '9.9.9.9';
+		setAbuseIpClassTtlsForTests({negativeMs: 50});
+		setInjectedIpInfoService({
+			async lookup(candidateIp: string) {
+				lookupCount += 1;
+				return ipInfoResult(candidateIp, {available: false});
+			},
+		});
+		recordAbuseSignal(ip, 'http_429', {weight: 25});
+		await drainAbuseIpClassLookupsForTests();
+		await drainAbuseAutoBanTasksForTests();
+		expect(lookupCount).toBe(1);
+		await new Promise((resolve) => setTimeout(resolve, 60));
+		await harness.kvProvider.del(`abuse:ipclass:claim:${ip}`);
+		recordAbuseSignal(ip, 'http_429', {weight: 25});
+		await drainAbuseIpClassLookupsForTests();
+		await drainAbuseAutoBanTasksForTests();
+		expect(lookupCount).toBe(2);
+	});
 });