Change the structure

2026-09-23 03:25:07 +03:00 · 2025-11-23 21:33:09 +03:00
parent 0f4256edad
commit 7d254b5658
36 changed files with 1261 additions and 184 deletions
@@ -0,0 +1,16 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./user/auth";
+import type { IceServersResponse } from "@/core/types";
+
+/**
+ * Fetches ICE server configuration for WebRTC
+ */
+export async function iceServers(token: string): Promise<IceServersResponse> {
+    const res = await fetch(`${API_BASE_URL}/webrtc/ice`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to fetch ICE servers");
+    return await res.json();
+}
+
+
@@ -0,0 +1,194 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
+import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "@/utils/crypto/symmetric";
+import { randomBytes } from "@/utils/crypto/kdf";
+import { getCurrentKeys } from "../user/auth";
+import { request } from "@/core/websocket";
+import type { SendDMRequest, DmEnvelope, DMEditRequest, DmEncryptedJSON, BaseDmEnvelope, User } from "@/core/types";
+import { b64, ub64 } from "@/utils/utils";
+import { fetchUserPublicKey } from "../crypto/identity";
+import { fetchUsers, searchUsers } from "../user/search";
+
+export async function decrypt(envelope: DmEnvelope, senderPublicKeyB64: string): Promise<string> {
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    // Obtain the key
+    const shared = ecdhSharedSecret(keys.privateKey, ub64(senderPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, ub64(envelope.salt), new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+    const mk = await aesGcmDecrypt(wk, ub64(envelope.iv2), ub64(envelope.wrappedMk));
+
+    // Decrypt
+    const msg = await aesGcmDecrypt(await importAesGcmKey(mk), ub64(envelope.iv), ub64(envelope.ciphertext));
+    return new TextDecoder().decode(msg);
+}
+
+export async function fetchMessages(userId: number, token: string, limit: number = 50, beforeId?: number): Promise<{ messages: DmEnvelope[]; has_more: boolean }> {
+    let url = `${API_BASE_URL}/dm/history/${userId}?limit=${limit}`;
+    if (beforeId) {
+        url += `&before_id=${beforeId}`;
+    }
+    const response = await globalThis.fetch(url, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!response.ok) return { messages: [], has_more: false };
+    const data = await response.json();
+    return { messages: data.messages || [], has_more: data.has_more ?? false };
+}
+
+export async function send(recipientId: number, recipientPublicKeyB64: string, plaintext: string, authToken: string, replyToId?: number): Promise<void> {
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    // Encryption key
+    const mk = randomBytes(32);
+    const wkSalt = randomBytes(16);
+    const shared = ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+
+    // Encrypt the message
+    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(plaintext));
+    const wrap = await aesGcmEncrypt(wk, mk);
+
+    const payload: SendDMRequest = {
+        recipientId: recipientId,
+        iv: b64(encMsg.iv),
+        ciphertext: b64(encMsg.ciphertext),
+        salt: b64(wkSalt),
+        iv2: b64(wrap.iv),
+        wrappedMk: b64(wrap.ciphertext)
+    };
+    if (replyToId) payload.replyToId = replyToId;
+
+    await request({
+        type: "dmSend",
+        credentials: {
+            scheme: "Bearer",
+            credentials: authToken
+        },
+        data: payload
+    });
+}
+
+export async function sendWithFiles(recipientId: number, recipientPublicKeyB64: string, plaintextJson: string, files: File[], token: string): Promise<void> {
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    const mk = randomBytes(32);
+    const wkSalt = randomBytes(16);
+    const shared = await ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+
+    const wrap = await aesGcmEncrypt(wk, mk);
+
+    const form = new FormData();
+    const names: string[] = [];
+    function sliceBuffer(u8: Uint8Array): ArrayBuffer {
+        return (u8.buffer as ArrayBuffer).slice(u8.byteOffset, u8.byteOffset + u8.byteLength);
+    }
+
+    for (const f of files) {
+        // Encrypt file with same mk
+        const data = new Uint8Array(await f.arrayBuffer());
+        const enc = await aesGcmEncrypt(await importAesGcmKey(mk), data);
+        const blob = new Blob([sliceBuffer(enc.iv), sliceBuffer(enc.ciphertext)], { type: "application/octet-stream" });
+        const serverName = f.name; // server uses provided name
+        names.push(serverName);
+        form.append("files", new File([blob], serverName));
+    }
+    form.append("fileNames", JSON.stringify(names));
+
+    // Merge files metadata into plaintext JSON and encrypt
+    let obj: DmEncryptedJSON;
+    try {
+        obj = JSON.parse(plaintextJson);
+    } catch {
+        obj = { type: "text", data: { content: String(plaintextJson) } };
+    }
+
+    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(JSON.stringify(obj)));
+    form.append("dm_payload", JSON.stringify({
+        recipientId: recipientId,
+        iv: b64(encMsg.iv),
+        ciphertext: b64(encMsg.ciphertext),
+        salt: b64(wkSalt),
+        iv2: b64(wrap.iv),
+        wrappedMk: b64(wrap.ciphertext)
+    } satisfies BaseDmEnvelope));
+
+    await globalThis.fetch(`${API_BASE_URL}/dm/send`, {
+        method: "POST",
+        headers: getAuthHeaders(token, false),
+        body: form
+    });
+}
+
+export async function edit(id: number, recipientPublicKeyB64: string, newPlaintextJson: string, authToken: string): Promise<void> {
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    // We cannot reuse the old mk safely without knowing it; generate a fresh mk and wrap
+    const mk = randomBytes(32);
+    const wkSalt = randomBytes(16);
+    const shared = await ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(newPlaintextJson));
+    const wrap = await aesGcmEncrypt(wk, mk);
+
+    await request({
+        type: "dmEdit",
+        credentials: { scheme: "Bearer", credentials: authToken },
+        data: {
+            id,
+            iv: b64(encMsg.iv),
+            ciphertext: b64(encMsg.ciphertext),
+            iv2: b64(wrap.iv),
+            wrappedMk: b64(wrap.ciphertext),
+            salt: b64(wkSalt)
+        }
+    } as DMEditRequest);
+}
+
+export async function deleteMessage(id: number, recipientId: number, authToken: string): Promise<void> {
+    await request({
+        type: "dmDelete",
+        credentials: { scheme: "Bearer", credentials: authToken },
+        data: { id, recipientId }
+    });
+}
+
+export interface ConversationResponse {
+    user: User;
+    lastMessage: DmEnvelope;
+    unreadCount: number;
+}
+
+export async function conversations(token: string): Promise<ConversationResponse[]> {
+    const res = await fetch(`${API_BASE_URL}/dm/conversations`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.conversations || [];
+}
+
+/**
+ * Marks a DM as read
+ */
+export async function markRead(id: number, authToken: string): Promise<void> {
+    await request({
+        type: "dmMarkRead",
+        credentials: { scheme: "Bearer", credentials: authToken },
+        data: { id }
+    });
+}
+
+// Re-export user functions for convenience
+export { fetchUsers, searchUsers, fetchUserPublicKey };
+
+
@@ -0,0 +1,99 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+import type { Message, Messages, SendMessageRequest } from "@/core/types";
+import { request } from "@/core/websocket";
+
+/**
+ * Fetches public chat messages
+ */
+export async function fetchMessages(token: string, limit: number = 50, beforeId?: number): Promise<{ messages: Message[]; has_more: boolean }> {
+    let url = `${API_BASE_URL}/get_messages?limit=${limit}`;
+    if (beforeId) {
+        url += `&before_id=${beforeId}`;
+    }
+    const response = await globalThis.fetch(url, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!response.ok) return { messages: [], has_more: false };
+    const data: Messages & { has_more?: boolean } = await response.json();
+    return { messages: data.messages || [], has_more: data.has_more ?? false };
+}
+
+/**
+ * Sends a public chat message via WebSocket
+ */
+export async function send(content: string, replyToId: number | null, authToken: string): Promise<void> {
+    await request({
+        data: {
+            content: content.trim(),
+            reply_to_id: replyToId ?? null
+        },
+        credentials: {
+            scheme: "Bearer",
+            credentials: authToken
+        },
+        type: "sendMessage"
+    } satisfies SendMessageRequest);
+}
+
+/**
+ * Sends a public chat message with files via HTTP
+ */
+export async function sendWithFiles(
+    content: string,
+    replyToId: number | null,
+    files: File[],
+    authToken: string
+): Promise<void> {
+    const form = new FormData();
+    form.append("payload", JSON.stringify({
+        content: content.trim(),
+        reply_to_id: replyToId ?? null
+    } satisfies SendMessageRequest["data"]));
+    for (const f of files) form.append("files", f, f.name);
+    const res = await globalThis.fetch(`${API_BASE_URL}/send_message`, {
+        method: "POST",
+        headers: getAuthHeaders(authToken, false),
+        body: form
+    });
+    if (!res.ok) {
+        const error = await res.text();
+        throw new Error(error || "Failed to send message with files");
+    }
+}
+
+/**
+ * Edits a public chat message
+ */
+export async function edit(messageId: number, newContent: string, authToken: string): Promise<void> {
+    const res = await globalThis.fetch(`${API_BASE_URL}/edit_message/${messageId}`, {
+        method: "PUT",
+        headers: getAuthHeaders(authToken, true),
+        body: JSON.stringify({ content: newContent })
+    });
+    if (!res.ok) throw new Error("Failed to edit message");
+}
+
+/**
+ * Deletes a public chat message
+ */
+export async function deleteMessage(messageId: number, authToken: string): Promise<void> {
+    const res = await globalThis.fetch(`${API_BASE_URL}/delete_message/${messageId}`, {
+        method: "DELETE",
+        headers: getAuthHeaders(authToken, true)
+    });
+    if (!res.ok) throw new Error("Failed to delete message");
+}
+
+/**
+ * Marks a message as read
+ */
+export async function markRead(messageId: number, authToken: string): Promise<void> {
+    const res = await globalThis.fetch(`${API_BASE_URL}/messages/mark_read`, {
+        method: "POST",
+        headers: getAuthHeaders(authToken, true),
+        body: JSON.stringify({ message_id: messageId })
+    });
+    if (!res.ok) throw new Error("Failed to mark message as read");
+}
+
@@ -0,0 +1,37 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+import type { BackupBlob } from "@/core/types";
+
+/**
+ * Fetches the current user's backup blob
+ */
+export async function fetchBackupBlob(token: string): Promise<string | null> {
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
+        method: "GET",
+        headers
+    });
+    if (res.ok) {
+        const response: BackupBlob = await res.json();
+        return response.blob;
+    } else {
+        return null;
+    }
+}
+
+/**
+ * Uploads the current user's backup blob
+ */
+export async function uploadBackupBlob(blobJson: string, token: string): Promise<void> {
+    const payload: BackupBlob = { blob: blobJson }
+
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload)
+    });
+    if (!res.ok) throw new Error("Failed to upload backup blob");
+}
+
+
@@ -0,0 +1,45 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+import type { UploadPublicKeyRequest } from "@/core/types";
+import { b64, ub64 } from "@/utils/utils";
+
+/**
+ * Fetches the current user's public key
+ */
+export async function fetchPublicKey(token: string): Promise<Uint8Array | null> {
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key`, { method: "GET", headers });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (!data?.publicKey) return null;
+    return ub64(data.publicKey);
+}
+
+/**
+ * Uploads the current user's public key
+ */
+export async function uploadPublicKey(publicKey: Uint8Array, token: string): Promise<void> {
+    const payload: UploadPublicKeyRequest = {
+        publicKey: b64(publicKey)
+    }
+
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload)
+    });
+    if (!res.ok) throw new Error("Failed to upload public key");
+}
+
+/**
+ * Fetches another user's public key by user ID
+ */
+export async function fetchUserPublicKey(userId: number, token: string): Promise<string | null> {
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key/of/${userId}`, { headers: getAuthHeaders(token, true) });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.publicKey;
+}
+
+
@@ -0,0 +1,14 @@
+// Placeholder for Signal Protocol pre-key management
+// Will be implemented when Signal Protocol is added
+
+export async function upload(_bundle: unknown, _token: string): Promise<void> {
+    // TODO: Implement Signal Protocol pre-key upload
+    throw new Error("Not implemented yet");
+}
+
+export async function fetch(_userId: number, _token: string): Promise<unknown> {
+    // TODO: Implement Signal Protocol pre-key fetch
+    throw new Error("Not implemented yet");
+}
+
+
@@ -1,39 +1,43 @@
 import { API_BASE_URL } from "@/core/config";
-import { getAuthHeaders } from "./account";
+import { getAuthHeaders } from "./user/auth";

-/**
- * Gets the URL for a normal (unencrypted) file
- */
-export function getNormalFileUrl(filename: string): string {
-    return `${API_BASE_URL}/uploads/files/normal/${filename}`;
-}
+export const normal = {
+    /**
+     * Gets the URL for a normal (unencrypted) file
+     */
+    url(filename: string): string {
+        return `${API_BASE_URL}/uploads/files/normal/${filename}`;
+    },

-/**
- * Gets the URL for an encrypted file
- */
-export function getEncryptedFileUrl(filename: string): string {
-    return `${API_BASE_URL}/uploads/files/encrypted/${filename}`;
-}
+    /**
+     * Fetches a normal file (unencrypted)
+     */
+    async fetch(filename: string, token: string): Promise<Blob> {
+        const res = await fetch(this.url(filename), {
+            headers: getAuthHeaders(token, false)
+        });
+        if (!res.ok) throw new Error("Failed to fetch file");
+        return await res.blob();
+    }
+};

-/**
- * Fetches a normal file (unencrypted)
- */
-export async function fetchNormalFile(filename: string, token: string): Promise<Blob> {
-    const res = await fetch(getNormalFileUrl(filename), {
-        headers: getAuthHeaders(token, false)
-    });
-    if (!res.ok) throw new Error("Failed to fetch file");
-    return await res.blob();
-}
+export const encrypted = {
+    /**
+     * Gets the URL for an encrypted file
+     */
+    url(filename: string): string {
+        return `${API_BASE_URL}/uploads/files/encrypted/${filename}`;
+    },

-/**
- * Fetches an encrypted file
- */
-export async function fetchEncryptedFile(filename: string, token: string): Promise<Blob> {
-    const res = await fetch(getEncryptedFileUrl(filename), {
-        headers: getAuthHeaders(token, false)
-    });
-    if (!res.ok) throw new Error("Failed to fetch encrypted file");
-    return await res.blob();
-}
+    /**
+     * Fetches an encrypted file
+     */
+    async fetch(filename: string, token: string): Promise<Blob> {
+        const res = await fetch(this.url(filename), {
+            headers: getAuthHeaders(token, false)
+        });
+        if (!res.ok) throw new Error("Failed to fetch encrypted file");
+        return await res.blob();
+    }
+};

@@ -0,0 +1,50 @@
+import * as chatsGeneral from "./chats/general";
+import * as chatsDm from "./chats/dm";
+import * as userProfile from "./user/profile";
+import * as userAuth from "./user/auth";
+import * as userDevices from "./user/devices";
+import * as userSearch from "./user/search";
+import * as cryptoPrekeys from "./crypto/prekeys";
+import * as cryptoIdentity from "./crypto/identity";
+import * as cryptoBackup from "./crypto/backup";
+import * as moderationBlocklist from "./moderation/blocklist";
+import * as moderationUsers from "./moderation/users";
+import * as callsModule from "./calls";
+import * as filesModule from "./files";
+import * as pushModule from "./push";
+
+const api = {
+    chats: {
+        general: chatsGeneral,
+        dm: chatsDm
+    },
+    user: {
+        profile: userProfile,
+        auth: userAuth,
+        devices: userDevices,
+        search: userSearch
+    },
+    crypto: {
+        prekeys: cryptoPrekeys,
+        identity: cryptoIdentity,
+        backup: cryptoBackup
+    },
+    moderation: {
+        blocklist: moderationBlocklist,
+        users: moderationUsers
+    },
+    calls: callsModule,
+    files: filesModule,
+    push: pushModule
+};
+
+export default api;
+
+export const chats = api.chats;
+export const user = api.user;
+export const crypto = api.crypto;
+export const moderation = api.moderation;
+export const calls = api.calls;
+export const files = api.files;
+export const push = api.push;
+
@@ -0,0 +1,55 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+
+export interface BlocklistResponse {
+    words: string[];
+}
+
+export interface BlocklistUpdateRequest {
+    words: string[];
+}
+
+export interface BlocklistUpdateResponse {
+    added?: string[];
+    removed?: string[];
+    words: string[];
+}
+
+/**
+ * Fetches the current blocklist (admin only)
+ */
+export async function get(token: string): Promise<BlocklistResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to fetch blocklist");
+    return await res.json();
+}
+
+/**
+ * Adds words to the blocklist (admin only)
+ */
+export async function add(words: string[], token: string): Promise<BlocklistUpdateResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({ words })
+    });
+    if (!res.ok) throw new Error("Failed to add to blocklist");
+    return await res.json();
+}
+
+/**
+ * Removes words from the blocklist (admin only)
+ */
+export async function remove(words: string[], token: string): Promise<BlocklistUpdateResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        method: "DELETE",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({ words })
+    });
+    if (!res.ok) throw new Error("Failed to remove from blocklist");
+    return await res.json();
+}
+
+
@@ -0,0 +1,89 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+
+/**
+ * Toggles verification status for a user (owner only)
+ */
+export async function verify(userId: number, token: string): Promise<{verified: boolean} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/verify`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error verifying user:', error);
+        return null;
+    }
+}
+
+/**
+ * Suspends a user account (admin only)
+ */
+export async function suspend(userId: number, reason: string, token: string): Promise<{status: string; message: string; reason: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/suspend`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true),
+            body: JSON.stringify({ reason })
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error suspending user:', error);
+        return null;
+    }
+}
+
+/**
+ * Unsuspends a user account (admin only)
+ */
+export async function unsuspend(userId: number, token: string): Promise<{status: string; message: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/unsuspend`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error unsuspending user:', error);
+        return null;
+    }
+}
+
+/**
+ * Deletes a user account (admin only)
+ */
+export async function deleteUser(userId: number, token: string): Promise<{status: string; message: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/delete`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error deleting user:', error);
+        return null;
+    }
+}
+
+
@@ -1,5 +1,5 @@
 import { API_BASE_URL } from "@/core/config";
-import { getAuthHeaders } from "./account";
+import { getAuthHeaders } from "./user/auth";

 export interface PushSubscriptionRequest {
    endpoint: string;
@@ -14,37 +14,39 @@ export interface PushSubscriptionResponse {
    message: string;
 }

-/**
- * Subscribes the current user to push notifications
- */
-export async function subscribeToPush(
-    subscription: PushSubscriptionRequest,
-    token: string
-): Promise<PushSubscriptionResponse> {
-    const res = await fetch(`${API_BASE_URL}/push/subscribe`, {
-        method: "POST",
-        headers: getAuthHeaders(token, true),
-        body: JSON.stringify(subscription)
-    });
-    if (!res.ok) {
-        const error = await res.json().catch(() => ({ detail: "Failed to subscribe to push notifications" }));
-        throw new Error(error.detail || "Failed to subscribe to push notifications");
-    }
-    return await res.json();
-}
+export const subscription = {
+    /**
+     * Subscribes the current user to push notifications
+     */
+    async subscribe(
+        subscription: PushSubscriptionRequest,
+        token: string
+    ): Promise<PushSubscriptionResponse> {
+        const res = await fetch(`${API_BASE_URL}/push/subscribe`, {
+            method: "POST",
+            headers: getAuthHeaders(token, true),
+            body: JSON.stringify(subscription)
+        });
+        if (!res.ok) {
+            const error = await res.json().catch(() => ({ detail: "Failed to subscribe to push notifications" }));
+            throw new Error(error.detail || "Failed to subscribe to push notifications");
+        }
+        return await res.json();
+    },

-/**
- * Unsubscribes the current user from push notifications
- */
-export async function unsubscribeFromPush(token: string): Promise<PushSubscriptionResponse> {
-    const res = await fetch(`${API_BASE_URL}/push/unsubscribe`, {
-        method: "DELETE",
-        headers: getAuthHeaders(token, true)
-    });
-    if (!res.ok) {
-        const error = await res.json().catch(() => ({ detail: "Failed to unsubscribe from push notifications" }));
-        throw new Error(error.detail || "Failed to unsubscribe from push notifications");
+    /**
+     * Unsubscribes the current user from push notifications
+     */
+    async unsubscribe(token: string): Promise<PushSubscriptionResponse> {
+        const res = await fetch(`${API_BASE_URL}/push/unsubscribe`, {
+            method: "DELETE",
+            headers: getAuthHeaders(token, true)
+        });
+        if (!res.ok) {
+            const error = await res.json().catch(() => ({ detail: "Failed to unsubscribe from push notifications" }));
+            throw new Error(error.detail || "Failed to unsubscribe from push notifications");
+        }
+        return await res.json();
    }
-    return await res.json();
-}
+};

@@ -0,0 +1,221 @@
+import { API_BASE_URL } from "@/core/config";
+import type { LoginRequest, RegisterRequest, LoginResponse, Headers } from "@/core/types";
+import { generateX25519KeyPair } from "@/utils/crypto/asymmetric";
+import { encodeBlob, encryptBackupWithPassword, decryptBackupWithPassword, decodeBlob } from "@/utils/crypto/backup";
+import { b64, ub64 } from "@/utils/utils";
+import { hkdfExtractAndExpand } from "@/utils/crypto/kdf";
+import { fetchPublicKey, uploadPublicKey } from "../crypto/identity";
+import { fetchBackupBlob, uploadBackupBlob } from "../crypto/backup";
+
+/**
+ * Generates authentication headers for API requests
+ * @param {string | null} token - Authentication token
+ * @param {boolean} json - Whether to include JSON content type header
+ * @returns {Headers} Headers object with authentication and content type
+ */
+export function getAuthHeaders(token: string | null, json: boolean = true): Headers {
+    const headers: Headers = {};
+
+    if (json) {
+        headers["Content-Type"] = "application/json";
+    }
+
+    if (token) {
+        headers['Authorization'] = `Bearer ${token}`;
+    }
+    return headers;
+}
+
+export interface CheckAuthResponse {
+    authenticated: boolean;
+    username: string;
+    admin: boolean;
+}
+
+export interface LogoutResponse {
+    status: string;
+    message: string;
+}
+
+export interface UserKeyPairMemory {
+	publicKey: Uint8Array;
+	privateKey: Uint8Array;
+}
+
+let currentPublicKey: Uint8Array | null = null;
+let currentPrivateKey: Uint8Array | null = null;
+
+export function getCurrentKeys(): UserKeyPairMemory | null {
+	if (currentPublicKey && currentPrivateKey) return { publicKey: currentPublicKey, privateKey: currentPrivateKey };
+	return null;
+}
+
+function saveKeys(
+	publicKey: Uint8Array<ArrayBufferLike>,
+	privateKey: Uint8Array<ArrayBufferLike>
+) {
+	const encodedPublicKey = b64(publicKey);
+	const encodedPrivateKey = b64(privateKey);
+
+	localStorage.setItem("publicKey", encodedPublicKey);
+	localStorage.setItem("privateKey", encodedPrivateKey);
+}
+
+/**
+ * Checks if the current user is authenticated
+ */
+export async function checkAuth(token: string): Promise<CheckAuthResponse> {
+    const res = await fetch(`${API_BASE_URL}/check_auth`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to check auth");
+    return await res.json();
+}
+
+/**
+ * Logs in a user with username and password
+ */
+export async function login(request: LoginRequest): Promise<LoginResponse> {
+    const res = await fetch(`${API_BASE_URL}/login`, {
+        method: "POST",
+        headers: getAuthHeaders(null, true),
+        body: JSON.stringify(request)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Login failed" }));
+        throw new Error(error.detail || "Login failed");
+    }
+    return await res.json();
+}
+
+/**
+ * Registers a new user
+ */
+export async function register(request: RegisterRequest): Promise<LoginResponse> {
+    const res = await fetch(`${API_BASE_URL}/register`, {
+        method: "POST",
+        headers: getAuthHeaders(null, true),
+        body: JSON.stringify(request)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Registration failed" }));
+        throw new Error(error.detail || "Registration failed");
+    }
+    return await res.json();
+}
+
+/**
+ * Logs out the current user
+ */
+export async function logout(token: string): Promise<LogoutResponse> {
+    const res = await fetch(`${API_BASE_URL}/logout`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to logout");
+    return await res.json();
+}
+
+/**
+ * Derive a client-side authentication secret so the raw password never leaves the client.
+ * Uses PBKDF2 (via WebCrypto) + HKDF to produce a stable 32-byte key, then base64.
+ */
+export async function deriveAuthSecret(username: string, password: string): Promise<string> {
+    // Use per-user salt derived from username; in future we can fetch a server-provided salt
+    const salt = new TextEncoder().encode(`fromchat.user:${username}`);
+    // Derive 32 bytes using HKDF; PBKDF2 already used within importPassword
+    const derived = await hkdfExtractAndExpand(new TextEncoder().encode(password), salt, new TextEncoder().encode("auth-secret"), 32);
+    return b64(derived);
+}
+
+export async function ensureKeysOnLogin(password: string, token: string): Promise<UserKeyPairMemory> {
+	// Try to restore from backup
+	const blobJson = await fetchBackupBlob(token);
+	if (blobJson) {
+		const blob = decodeBlob(blobJson);
+		const bundle = await decryptBackupWithPassword(password, blob);
+		currentPrivateKey = bundle.privateKey;
+		// Ensure public key exists on server; if not, derive from private (not possible via libsafely), so keep previous
+		// In our simple scheme, we rely on server having the public key or we reupload generated one on first setup
+		const serverPub = await fetchPublicKey(token);
+		if (serverPub) {
+			currentPublicKey = serverPub;
+		} else {
+			// We don't have the corresponding public key from server; regenerate pair to resync
+			const pair = generateX25519KeyPair();
+			currentPublicKey = pair.publicKey;
+			currentPrivateKey = pair.privateKey;
+			await uploadPublicKey(currentPublicKey, token);
+			const newBlob = await encryptBackupWithPassword(password, { version: 1, privateKey: currentPrivateKey });
+			await uploadBackupBlob(encodeBlob(newBlob), token);
+		}
+
+		saveKeys(currentPublicKey!, currentPrivateKey!);
+
+		return {
+			publicKey: currentPublicKey!,
+			privateKey: currentPrivateKey!
+		};
+	}
+
+	// First-time setup: generate keys and upload
+	const pair = generateX25519KeyPair();
+	currentPublicKey = pair.publicKey;
+	currentPrivateKey = pair.privateKey;
+	await uploadPublicKey(currentPublicKey, token);
+	const encBlob = await encryptBackupWithPassword(password, { version: 1, privateKey: currentPrivateKey });
+	await uploadBackupBlob(encodeBlob(encBlob), token);
+
+	saveKeys(pair.publicKey, pair.privateKey);
+
+	return pair;
+}
+
+export function restoreKeys() {
+	currentPublicKey = ub64(localStorage.getItem("publicKey")!);
+	currentPrivateKey = ub64(localStorage.getItem("privateKey")!);
+}
+
+export function getAuthToken(): string | null {
+	return localStorage.getItem("authToken");
+}
+
+/**
+ * Changes the user's password
+ */
+export async function changePassword(
+    token: string,
+    username: string,
+    currentPassword: string,
+    newPassword: string,
+    logoutAllExceptCurrent: boolean
+): Promise<void> {
+    const currentDerived = await deriveAuthSecret(username, currentPassword);
+    const newDerived = await deriveAuthSecret(username, newPassword);
+    const res = await fetch(`${API_BASE_URL}/change-password`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({
+            currentPasswordDerived: currentDerived,
+            newPasswordDerived: newDerived,
+            logoutAllExceptCurrent
+        })
+    });
+    if (!res.ok) throw new Error("Failed to change password");
+}
+
+/**
+ * Deletes the current user's account
+ */
+export async function deleteAccount(token: string): Promise<{ status: string; message: string }> {
+    const res = await fetch(`${API_BASE_URL}/account/delete`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Failed to delete account" }));
+        throw new Error(error.detail || "Failed to delete account");
+    }
+    return await res.json();
+}
+
+
@@ -0,0 +1,37 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./auth";
+
+export interface DeviceInfo {
+    session_id: string;
+    device_name?: string;
+    device_type?: string;
+    os_name?: string;
+    os_version?: string;
+    browser_name?: string;
+    browser_version?: string;
+    brand?: string;
+    model?: string;
+    created_at?: string;
+    last_seen?: string;
+    revoked?: boolean;
+    current?: boolean;
+}
+
+export async function list(token: string): Promise<DeviceInfo[]> {
+    const res = await fetch(`${API_BASE_URL}/devices`, { headers: getAuthHeaders(token, true) });
+    if (!res.ok) throw new Error("Failed to fetch devices");
+    const data = await res.json();
+    return data.devices as DeviceInfo[];
+}
+
+export async function revoke(token: string, sessionId: string): Promise<void> {
+    const res = await fetch(`${API_BASE_URL}/devices/${sessionId}`, { method: "DELETE", headers: getAuthHeaders(token, true) });
+    if (!res.ok) throw new Error("Failed to revoke device");
+}
+
+export async function revokeAll(token: string): Promise<void> {
+    const res = await fetch(`${API_BASE_URL}/devices/logout-all`, { method: "POST", headers: getAuthHeaders(token, true) });
+    if (!res.ok) throw new Error("Failed to logout all devices");
+}
+
+
@@ -0,0 +1,191 @@
+import { getAuthHeaders } from "./auth";
+import { API_BASE_URL } from "@/core/config";
+import type { UserProfile } from "@/core/types";
+
+export interface ProfileData {
+    profile_picture?: string;
+    username?: string;
+    display_name?: string;
+    description?: string;
+}
+
+export interface UploadResponse {
+    profile_picture_url: string;
+}
+
+/**
+ * Loads user profile data from the server
+ */
+export async function get(token: string): Promise<ProfileData | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/profile`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            const data = await response.json();
+            // Map backend fields to frontend fields
+            return {
+                profile_picture: data.profile_picture,
+                username: data.username,
+                display_name: data.display_name,
+                description: data.bio
+            };
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error loading profile:', error);
+        return null;
+    }
+}
+
+/**
+ * Uploads a profile picture to the server
+ */
+export async function uploadPicture(token: string, file: Blob): Promise<UploadResponse | null> {
+    try {
+        const formData = new FormData();
+        formData.append('profile_picture', file, 'profile_picture.jpg');
+
+        const response = await fetch(`${API_BASE_URL}/upload-profile-picture`, {
+            method: 'POST',
+            body: formData,
+            headers: getAuthHeaders(token, false)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+        return null;
+    } catch (error) {
+        console.error('Upload error:', error);
+        return null;
+    }
+}
+
+/**
+ * Updates user profile information
+ */
+export async function update(token: string, data: Partial<ProfileData>): Promise<boolean> {
+    try {
+        // Map frontend fields to backend fields
+        const backendData = {
+            username: data.username,
+            display_name: data.display_name,
+            description: data.description
+        };
+
+        const response = await fetch(`${API_BASE_URL}/user/profile`, {
+            method: 'PUT',
+            headers: {
+                ...getAuthHeaders(token, true),
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify(backendData)
+        });
+
+        return response.ok;
+    } catch (error) {
+        console.error('Error updating profile:', error);
+        return false;
+    }
+}
+
+/**
+ * Updates user bio
+ */
+export async function updateBio(token: string, bio: string): Promise<boolean> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/bio`, {
+            method: 'PUT',
+            headers: getAuthHeaders(token, true),
+            body: JSON.stringify({ bio })
+        });
+
+        return response.ok;
+    } catch (error) {
+        console.error('Error updating bio:', error);
+        return false;
+    }
+}
+
+/**
+ * Fetches user profile data by username
+ */
+export async function fetchByUsername(token: string, username: string): Promise<UserProfile | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${username}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error fetching user profile:', error);
+        return null;
+    }
+}
+
+/**
+ * Fetches user profile data by user ID
+ */
+export async function fetchById(token: string, userId: number): Promise<UserProfile | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/id/${userId}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error fetching user profile by ID:', error);
+        return null;
+    }
+}
+
+/**
+ * In-memory cache for user similarity results
+ * Key: userId, Value: similarity result
+ */
+const similarityCache = new Map<number, {isSimilar: boolean, similarTo?: string} | null>();
+
+/**
+ * Checks if a user is similar to any verified user
+ * Results are cached in memory to avoid redundant API calls
+ */
+export async function checkSimilarity(userId: number, token: string): Promise<{isSimilar: boolean, similarTo?: string} | null> {
+    // Check cache first
+    if (similarityCache.has(userId)) {
+        return similarityCache.get(userId) ?? null;
+    }
+
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/check-similarity/${userId}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        let result: {isSimilar: boolean, similarTo?: string} | null = null;
+        if (response.ok) {
+            result = await response.json();
+        }
+
+        // Cache the result (even if null/error)
+        similarityCache.set(userId, result);
+        return result;
+    } catch (error) {
+        console.error('Error checking user similarity:', error);
+        const result: null = null;
+        // Cache null result to avoid retrying on errors
+        similarityCache.set(userId, result);
+        return result;
+    }
+}
+
+
@@ -0,0 +1,40 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./auth";
+import type { User } from "@/core/types";
+
+/**
+ * Fetches a list of all users (excluding current user)
+ */
+export async function fetchUsers(token: string): Promise<User[]> {
+    const res = await fetch(`${API_BASE_URL}/users`, { headers: getAuthHeaders(token, true) });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.users || [];
+}
+
+/**
+ * Searches for users by username query
+ */
+export async function searchUsers(query: string, token: string): Promise<User[]> {
+    if (query.length < 2) return [];
+
+    const res = await fetch(`${API_BASE_URL}/users/search?q=${encodeURIComponent(query)}`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.users || [];
+}
+
+/**
+ * Fetches a user by ID
+ */
+export async function get(userId: number, token: string): Promise<User | null> {
+    const res = await fetch(`${API_BASE_URL}/users/${userId}`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+}
+
+
@@ -2,7 +2,7 @@ import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "@/utils/crypto/sy
 import { randomBytes } from "@/utils/crypto/kdf";
 import { b64, ub64 } from "@/utils/utils";
 import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
-import { getCurrentKeys } from "@/core/api/account";
+import api from "@/core/api";
 import type { WrappedSessionKeyPayload } from "@/core/types";

 export interface CallSessionKey {
@@ -186,7 +186,7 @@ const CALL_INFO = new Uint8Array([2]);
 * @returns Promise that resolves to the wrapped session key payload
 */
 export async function wrapCallSessionKeyForRecipient(recipientPublicKeyB64: string, sessionKey: Uint8Array): Promise<WrappedSessionKeyPayload> {
-    const keys = getCurrentKeys();
+    const keys = api.user.auth.getCurrentKeys();
    if (!keys) throw new Error("Keys not initialized");

    const salt = randomBytes(16);
@@ -209,7 +209,7 @@ export async function createSharedSecretAndDeriveSessionKey(
    sessionKeyHash: string,
    isInitiator: boolean
 ): Promise<CallSessionKey> {
-    const keys = getCurrentKeys();
+    const keys = api.user.auth.getCurrentKeys();
    if (!keys) throw new Error("Keys not initialized");

    // Create shared secret using ECDH
@@ -226,7 +226,7 @@ export async function createSharedSecretAndDeriveSessionKey(
 * @returns Promise that resolves to the unwrapped session key
 */
 export async function unwrapCallSessionKeyFromSender(senderPublicKeyB64: string, payload: WrappedSessionKeyPayload): Promise<Uint8Array> {
-    const keys = getCurrentKeys();
+    const keys = api.user.auth.getCurrentKeys();
    if (!keys) throw new Error("Keys not initialized");

    const salt = ub64(payload.salt);
@@ -1,9 +1,7 @@
-import { getAuthToken } from "@/core/api/account";
+import api from "@/core/api";
 import type { CallSignalingMessage, WrappedSessionKeyPayload } from "@/core/types";
-import { getIceServers as fetchIceServers } from "@/core/api/webrtc";
 import { request } from "@/core/websocket";
 import { wrapCallSessionKeyForRecipient, unwrapCallSessionKeyFromSender, rotateCallSessionKey } from "./encryption";
-import { fetchUserPublicKey } from "@/core/api/dm";
 import { importAesGcmKey } from "@/utils/crypto/symmetric";
 import E2EEWorker from "./e2eeWorker?worker";
 import { delay } from "@/utils/utils";
@@ -100,9 +98,9 @@ export class WebRTCCall {
     */
    private async getIceServers(): Promise<RTCIceServer[]> {
        try {
-            const token = getAuthToken();
+            const token = api.user.auth.getAuthToken();
            if (!token) throw new Error("No auth token");
-            const data = await fetchIceServers(token);
+            const data = await api.calls.iceServers(token);
            return data.iceServers || [];
        } catch (error) {
            console.warn("Failed to fetch ICE servers:", error);
@@ -774,7 +772,7 @@ async function sendSignalingMessage(message: CallSignalingMessage) {
        type: "call_signaling",
        credentials: {
            scheme: "Bearer",
-            credentials: getAuthToken()!
+            credentials: api.user.auth.getAuthToken()!
        },
        data: message
    });
@@ -857,7 +855,7 @@ export async function sendCallSessionKey(userId: number, sessionKeyHash: string)

 export async function sendWrappedCallSessionKey(userId: number, sessionKey: Uint8Array, sessionKeyHash: string): Promise<void> {
    try {
-        const recipientPublicKey = await fetchUserPublicKey(userId, getAuthToken()!);
+        const recipientPublicKey = await api.chats.dm.fetchUserPublicKey(userId, api.user.auth.getAuthToken()!);
        if (!recipientPublicKey) {
            console.warn("No recipient public key for", userId);
            return;
@@ -892,7 +890,7 @@ export async function receiveWrappedSessionKey(
    sessionKeyHash?: string
 ): Promise<void> {
    try {
-        const senderPublicKey = await fetchUserPublicKey(fromUserId, getAuthToken()!);
+        const senderPublicKey = await api.chats.dm.fetchUserPublicKey(fromUserId, api.user.auth.getAuthToken()!);
        if (!senderPublicKey) {
            console.error("Failed to get sender public key");
            return;
@@ -1,5 +1,5 @@
 import { useState, useEffect } from "react";
-import { checkUserSimilarity } from "@/core/api/account/profile";
+import api from "@/core/api";
 import { useUserStore } from "@/state/user";
 import { MaterialIcon } from "@/utils/material";

@@ -18,7 +18,7 @@ export function StatusBadge({ verified, userId, size = "small" }: StatusBadgePro
    // Check similarity for unverified users
    useEffect(() => {
        if (!verified && userId && user.authToken) {
-            checkUserSimilarity(userId, user.authToken)
+            api.user.profile.checkSimilarity(userId, user.authToken)
                .then(result => {
                    setIsSimilarToVerified(result?.isSimilar || false);
                })
@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { verifyUser } from "@/core/api/account/profile";
+import api from "@/core/api";
 import { useUserStore } from "@/state/user";
 import { MaterialButton } from "@/utils/material";

@@ -23,7 +23,7 @@ export function VerifyButton({ userId, verified, onVerificationChange }: VerifyB
        
        setIsVerifying(true);
        try {
-            const result = await verifyUser(userId, user.authToken);
+            const result = await api.moderation.users.verify(userId, user.authToken);
            if (result) {
                onVerificationChange?.(result.verified);
            }
@@ -1,4 +1,4 @@
-import { subscribeToPush } from "@/core/api/push";
+import api from "@/core/api";
 import { isElectron } from "@/core/electron/electron";
 import { websocket } from "@/core/websocket";
 import type { NewMessageWebSocketMessage, WebSocketMessage } from "@/core/types";
@@ -89,7 +89,7 @@ async function sendSubscriptionToServer(token: string): Promise<boolean> {
    };

    try {
-        await subscribeToPush(subscriptionData, token);
+        await api.push.subscription.subscribe(subscriptionData, token);
        return true;
    } catch (error) {
        console.error("Failed to send subscription to server:", error);