Merge branch 'main' into dependabot/npm_and_yarn/dotenv-cli-11.0.0

.cursor/rules/general.mdc

@@ -55,4 +55,7 @@ When working with this project, follow these rules:
 ## Styling
 - Use SCSS modules
 - Use nested styles
-- Put SCSS into one folder per page
+- Put SCSS into one folder per page
+
+## Animations with Framer Motion
+- Don't use variants if they are used only once

.dockerignore

@@ -0,0 +1,12 @@
+# Exclude data directory to prevent local database from being copied into production images
+backend/data/
+
+# Exclude logs
+backend/logs/
+
+# Exclude development files
+node_modules/
+.git/
+.gitignore
+README.md
+*.log

.github/workflows/deploy.yml

@@ -3,17 +3,17 @@ name: Deploy to server
 
 on:
   # Runs on pushes targeting the default branch
-  push:
-    branches: ["main"]
-    paths:
-      - "backend/**"
-      - "frontend/**"
-      - "deployment/**"
-      - "**/package.json"
-      - ".nvmrc"
-      - ".github/workflows/deploy.yml"
-      - "!frontend/electron/**"
-      - "!**.d.ts"
+  # push:
+  #   branches: ["main"]
+  #   paths:
+  #     - "backend/**"
+  #     - "frontend/**"
+  #     - "deployment/**"
+  #     - "**/package.json"
+  #     - ".nvmrc"
+  #     - ".github/workflows/deploy.yml"
+  #     - "!frontend/electron/**"
+  #     - "!**.d.ts"
   workflow_dispatch:
 
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
@@ -27,7 +27,7 @@ permissions:
 
 jobs:
   deploy:
-    runs-on: self-hosted
+    runs-on: raspberry-pi
     env:
       HOME: "/root"
     environment:
@@ -60,4 +60,4 @@ jobs:
           if ! systemctl restart fromchat && sleep 10 && systemctl status fromchat; then
             journalctl --no-pager -xeu fromchat
             exit 1
-          fi
+          fi

.gitignore

@@ -112,6 +112,7 @@ web_modules/
 
 # dotenv environment variable files
 .env
+.env.prod
 .env.development.local
 .env.test.local
 .env.production.local
@@ -574,4 +575,6 @@ backend/alembic/**
 !backend/alembic/env.py
 !backend/alembic/script.py.mako
 !frontend/src/css/lib
-**/*.module.scss.d.ts
+**/*.module.scss.d.ts
+
+.cursor/plans

.husky/post-push

@@ -0,0 +1,116 @@
+#!/bin/sh
+# Post-push hook: opens deploy command in system's native terminal
+# Cross-platform support: macOS, Linux, Windows, WSL
+
+# Get the project root directory
+PROJECT_ROOT="$(git rev-parse --show-toplevel)"
+cd "$PROJECT_ROOT" || exit 1
+
+# Command to run in terminal (deploy.sh will load .env from project root)
+COMMAND="npm run -s deploy"
+
+# Detect OS and open appropriate terminal
+detect_and_open_terminal() {
+    # Detect WSL
+    if [ -n "${WSL_DISTRO_NAME:-}" ] || [ -f /proc/version ] && grep -qi microsoft /proc/version 2>/dev/null; then
+        # WSL detected - try to open Windows Terminal, fallback to Linux terminals
+        if command -v wt.exe >/dev/null 2>&1; then
+            # Windows Terminal (preferred for WSL)
+            ESCAPED_PATH=$(echo "$PROJECT_ROOT" | sed "s/'/'\"'\"'/g")
+            ESCAPED_CMD=$(echo "$COMMAND" | sed "s/'/'\"'\"'/g")
+            wt.exe bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+        elif command -v wsl.exe >/dev/null 2>&1; then
+            # Fallback: use wsl.exe to open cmd
+            WINDOWS_PATH=$(wslpath -w "$PROJECT_ROOT" 2>/dev/null || echo "$PROJECT_ROOT")
+            cmd.exe /c "start cmd /k \"cd /d $WINDOWS_PATH && $COMMAND\""
+        else
+            # Fallback to Linux terminal
+            open_linux_terminal
+        fi
+    # macOS
+    elif [ "$(uname)" = "Darwin" ]; then
+        # macOS - use .command file with open command
+        # Clean up old script files and create a new one
+        rm -f /tmp/post-push-deploy-*.command 2>/dev/null
+        SCRIPT_FILE=$(mktemp /tmp/post-push-deploy-XXXXXX.command 2>/dev/null)
+        if [ -z "$SCRIPT_FILE" ] || [ ! -f "$SCRIPT_FILE" ]; then
+            # Fallback if mktemp fails
+            SCRIPT_FILE="/tmp/post-push-deploy-$$.command"
+        fi
+        {
+            echo "#!/bin/bash"
+            echo "clear"
+            echo "cd '$PROJECT_ROOT'"
+            echo "export PS1=''"
+            echo "set +x"
+            # Export DEPLOYMENT_SERVER if it was set in the hook environment
+            if [ -n "$DEPLOYMENT_SERVER_VALUE" ]; then
+                echo "export DEPLOYMENT_SERVER='$DEPLOYMENT_SERVER_VALUE'"
+            fi
+            echo "$COMMAND"
+            echo "echo ''"
+            echo "echo 'Press Enter to close...'"
+            echo "read -r"
+            echo "osascript -e 'tell application \"Terminal\" to close front window' &"
+        } > "$SCRIPT_FILE"
+        chmod +x "$SCRIPT_FILE"
+        # Use open command to launch .command file - opens only one Terminal window
+        open "$SCRIPT_FILE"
+    # Windows (Git Bash or similar)
+    elif [ -n "${MSYSTEM:-}" ] || [ -n "${MINGW64:-}" ] || [ -n "${MINGW32:-}" ]; then
+        # Git Bash on Windows
+        if command -v wt.exe >/dev/null 2>&1; then
+            # Windows Terminal
+            ESCAPED_PATH=$(echo "$PROJECT_ROOT" | sed "s/'/'\"'\"'/g")
+            ESCAPED_CMD=$(echo "$COMMAND" | sed "s/'/'\"'\"'/g")
+            wt.exe bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+        elif command -v cmd.exe >/dev/null 2>&1; then
+            # Command Prompt - convert path to Windows format
+            WINDOWS_PATH=$(echo "$PROJECT_ROOT" | sed 's|^/\([a-z]\)|\1:|' | sed 's|/|\\|g' | sed 's|\\|\\\\|g')
+            cmd.exe /c "start cmd /k \"cd /d $WINDOWS_PATH && $COMMAND\""
+        else
+            # Fallback
+            ESCAPED_PATH=$(echo "$PROJECT_ROOT" | sed "s/'/'\"'\"'/g")
+            start "Deploy" bash -c "cd '$ESCAPED_PATH' && $COMMAND; exec bash"
+        fi
+    # Linux
+    else
+        open_linux_terminal
+    fi
+}
+
+open_linux_terminal() {
+    # Escape path for use in shell commands
+    ESCAPED_PATH=$(echo "$PROJECT_ROOT" | sed "s/'/'\"'\"'/g")
+    
+    ESCAPED_CMD=$(echo "$COMMAND" | sed "s/'/'\"'\"'/g")
+    # Try different Linux terminal emulators
+    if command -v gnome-terminal >/dev/null 2>&1; then
+        gnome-terminal -- bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+    elif command -v x-terminal-emulator >/dev/null 2>&1; then
+        x-terminal-emulator -e bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+    elif command -v konsole >/dev/null 2>&1; then
+        konsole -e bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+    elif command -v xterm >/dev/null 2>&1; then
+        xterm -e bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+    elif command -v alacritty >/dev/null 2>&1; then
+        alacritty -e bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+    elif command -v kitty >/dev/null 2>&1; then
+        kitty bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+    elif command -v tilix >/dev/null 2>&1; then
+        tilix -e bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+    else
+        # Last resort: try to find any terminal
+        TERMINAL=$(command -v x-terminal-emulator gnome-terminal konsole xterm alacritty kitty tilix 2>/dev/null | head -1)
+        if [ -n "$TERMINAL" ]; then
+            "$TERMINAL" -e bash -c "cd '$ESCAPED_PATH' && set +x && echo 'Post-push: Running deploy...' && $ESCAPED_CMD && echo '' && echo 'Deploy completed. Press Enter to close...' && read -r && exit"
+        else
+            echo "Could not find a terminal emulator. Please run manually: cd '$PROJECT_ROOT' && $COMMAND"
+        fi
+    fi
+}
+
+# Run in background so git push doesn't wait
+# Add a small delay to ensure git push completes first
+(sleep 0.5 && detect_and_open_terminal) &
+

.vscode/settings.json

@@ -2,6 +2,10 @@
     "files.exclude": {
         "**/__pycache__": true,
         "**/package-lock.json": true,
-        "**/*.module.scss.d.ts": true
-    }
+        "**/*.module.scss.d.ts": true,
+        "**/.husky/_": true,
+        "**/.venv": true,
+        "**/node_modules": true
+    },
+    "python.terminal.activateEnvironment": false
 }

.vscode/tasks.json

@@ -33,7 +33,7 @@
                 "panel": "shared"
             },
             "group": {
-                "kind": "build",
+                "kind": "build"
             },
             "isBackground": true
         },
@@ -87,6 +87,18 @@
                 "focus": false,
                 "panel": "shared"
             }
+        },
+        {
+            "label": "Deploy",
+            "type": "shell",
+            "command": "npm run deploy",
+            "presentation": {
+                "echo": true,
+                "reveal": "always",
+                "focus": true,
+                "panel": "dedicated",
+                "clear": true
+            }
         }
     ]
 }

README.md

@@ -2,7 +2,7 @@
 
 FromChat - полностью открытый мессенджер. 
 
-Демо версию можно попробовать на [сайте](http://95.165.0.162:8301).
+Его можно попробовать на [сайте](http://fromchat.ru).
 
 ## Содержание:
 - [Основные моменты](#highlights)

backend/admin_cli.py

@@ -0,0 +1,417 @@
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import hmac
+import os
+import shlex
+import sys
+from getpass import getpass
+from typing import Iterable, List, Optional, Tuple
+import readline
+import httpx
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+
+
+class CLIError(Exception):
+    """Generic CLI error with a human-readable message."""
+
+
+def _hkdf_extract(salt: bytes, ikm: bytes) -> bytes:
+    return hmac.new(salt, ikm, hashlib.sha256).digest()
+
+
+def _hkdf_expand(prk: bytes, info: bytes, length: int) -> bytes:
+    blocks: list[bytes] = []
+    previous = b""
+    counter = 1
+    while len(b"".join(blocks)) < length:
+        previous = hmac.new(prk, previous + info + bytes([counter]), hashlib.sha256).digest()
+        blocks.append(previous)
+        counter += 1
+    return b"".join(blocks)[:length]
+
+
+def derive_auth_secret(username: str, password: str) -> str:
+    salt = f"fromchat.user:{username}".encode("utf-8")
+    prk = _hkdf_extract(salt, password.encode("utf-8"))
+    okm = _hkdf_expand(prk, b"auth-secret", 32)
+    return base64.b64encode(okm).decode("utf-8")
+
+
+def _read_single_key() -> str:
+    try:  # Windows
+        import msvcrt  # type: ignore
+
+        ch = msvcrt.getch()
+        return ch.decode("utf-8", errors="ignore").lower()
+    except ImportError:
+        import termios
+        import tty
+
+        fd = sys.stdin.fileno()
+        old_settings = termios.tcgetattr(fd)
+        try:
+            tty.setraw(fd)
+            ch = sys.stdin.read(1)
+        finally:
+            termios.tcsetattr(fd, termios.TCSADRAIN, old_settings)
+        return ch.lower()
+
+
+class AdminCLI:
+    def __init__(self, api_url: str) -> None:
+        self.console = Console()
+        self.api_url = api_url.rstrip("/")
+        self.client = httpx.Client(base_url=self.api_url, timeout=30.0)
+        self.username: Optional[str] = None
+        self.token: Optional[str] = None
+
+    # --------------------------- HTTP helpers --------------------------- #
+    def _auth_headers(self) -> dict:
+        headers: dict = {}
+        if self.token:
+            headers["Authorization"] = f"Bearer {self.token}"
+        return headers
+
+    def _request(self, method: str, path: str, *, auth: bool = True, **kwargs) -> httpx.Response:
+        rel_path = path.lstrip("/")
+        headers = kwargs.pop("headers", {})
+        if auth:
+            headers.update(self._auth_headers())
+        response = self.client.request(method, rel_path, headers=headers, **kwargs)
+        if response.status_code >= 400:
+            detail = ""
+            try:
+                payload = response.json()
+                if isinstance(payload, dict):
+                    detail = payload.get("detail") or payload.get("message") or ""
+            except Exception:
+                detail = response.text
+            message = f"{response.status_code} {response.reason_phrase}"
+            if detail:
+                message = f"{message}: {detail}"
+            raise CLIError(message.strip())
+        return response
+
+    # --------------------------- CLI primitives ------------------------- #
+    def _require_auth(self) -> None:
+        if not self.token:
+            raise CLIError("You must login before running this command.")
+
+    def _resolve_user(self, identifier: str) -> dict:
+        self._require_auth()
+        if identifier.isdigit():
+            response = self._request("GET", f"user/id/{identifier}")
+        else:
+            response = self._request("GET", f"user/{identifier.replace('@', '')}")
+        return response.json()
+
+    def _confirm(self, prompt: str) -> bool:
+        self.console.print(f"[bold yellow]{prompt}[/] [green](y)[/] / [red](n)[/]: ", end="")
+        choice = _read_single_key()
+        self.console.print("")  # move to next line
+        return choice == "y"
+
+    def _render_user(self, user: dict) -> None:
+        table = Table(show_header=False)
+        table.add_row("ID", str(user.get("id")))
+        table.add_row("Username", user.get("username", ""))
+        table.add_row("Display name", user.get("display_name", ""))
+        table.add_row("Verified", "✅" if user.get("verified") else "❌")
+        if user.get("suspended"):
+            table.add_row("Suspended", f"🚫 ({user.get('suspension_reason') or 'no reason'})")
+        else:
+            table.add_row("Suspended", "✅ Active")
+        self.console.print(table)
+
+    # --------------------------- Commands ------------------------------- #
+    def cmd_login(self, args: List[str]) -> None:
+        if args:
+            username = args[0]
+        else:
+            username = self.console.input("[bold cyan]Username[/]: ").strip()
+        if not username:
+            raise CLIError("Username is required.")
+
+        password = getpass("Password: ")
+        derived_password = derive_auth_secret(username, password)
+        payload = {"username": username, "password": derived_password}
+        response = self._request("POST", "login", json=payload, auth=False)
+        body = response.json()
+        token = body.get("token")
+        if not token:
+            raise CLIError("Authentication succeeded but token was not returned.")
+        self.token = token
+        self.username = username
+        self.console.print("[bold green]Login successful.[/]")
+
+    def cmd_suspend(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: suspend <user_id|username>")
+        identifier = args[0]
+        user = self._resolve_user(identifier)
+        self.console.print(Panel.fit("[bold red]Suspend user[/]", style="red"))
+        self._render_user(user)
+        reason = self.console.input("[bold yellow]Reason (press Enter to leave empty)[/]: ").strip()
+        if not self._confirm(f"Confirm suspension of {user.get('username')}?"):
+            self.console.print("[yellow]Suspension cancelled.[/]")
+            return
+        payload = {"reason": reason}
+        self._request("POST", f"user/{user['id']}/suspend", json=payload)
+        log_reason = reason or "no reason provided"
+        self.console.print(f"[bold red]User {user['username']} suspended ({log_reason}).[/]")
+
+    def cmd_unsuspend(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: unsuspend <user_id|username>")
+        identifier = args[0]
+        user = self._resolve_user(identifier)
+        self.console.print(Panel.fit("[bold green]Unsuspend user[/]", style="green"))
+        self._render_user(user)
+        if not self._confirm(f"Unsuspend {user.get('username')}?"):
+            self.console.print("[yellow]Unsuspension cancelled.[/]")
+            return
+        self._request("POST", f"user/{user['id']}/unsuspend")
+        self.console.print(f"[bold green]User {user['username']} unsuspended.[/]")
+
+    def cmd_block_word(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: block-word <word or phrase> [additional words...]")
+        self._require_auth()
+        words = args
+        response = self._request("POST", "moderation/blocklist", json={"words": words})
+        data = response.json()
+        added = data.get("added", [])
+        current = data.get("words", [])
+        if added:
+            self.console.print(f"[bold green]Added {len(added)} entr{'y' if len(added)==1 else 'ies'} to blocklist.[/]")
+        else:
+            self.console.print("[yellow]No new words added.[/]")
+        self.console.print(f"Blocklist size: {len(current)}")
+
+    def cmd_list_users(self) -> None:
+        self._require_auth()
+        payload = self._request("GET", "user/list").json()
+        users = payload.get("users", [])
+        table = Table(title="Users", show_lines=False)
+        table.add_column("ID")
+        table.add_column("Username")
+        table.add_column("Display name")
+        table.add_column("Suspended")
+        for user in users:
+            table.add_row(
+                str(user.get("id")),
+                user.get("username", ""),
+                user.get("display_name", ""),
+                "🚫" if user.get("suspended") else "✅",
+            )
+        self.console.print(table)
+
+    def cmd_user(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: user <user_id|username>")
+        user = self._resolve_user(args[0])
+        self._render_user(user)
+
+    def cmd_delete(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: delete <user_id|username>")
+        user = self._resolve_user(args[0])
+        self.console.print(Panel.fit("[bold red]Delete user[/]", style="red"))
+        self._render_user(user)
+        if not self._confirm(f"Permanently delete {user.get('username')}?"):
+            self.console.print("[yellow]Deletion cancelled.[/]")
+            return
+        self._request("POST", f"user/{user['id']}/delete")
+        self.console.print(f"[bold red]User {user['username']} deleted.[/]")
+
+    def cmd_unblock_word(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: unblock-word <word or phrase> [additional words...]")
+        self._require_auth()
+        response = self._request("DELETE", "moderation/blocklist", json={"words": args})
+        data = response.json()
+        removed = data.get("removed", [])
+        current = data.get("words", [])
+        if removed:
+            self.console.print(f"[bold green]Removed {len(removed)} entr{'y' if len(removed)==1 else 'ies'} from blocklist.[/]")
+        else:
+            self.console.print("[yellow]No matching words removed.[/]")
+        self.console.print(f"Blocklist size: {len(current)}")
+
+    def cmd_verify(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: verify <user_id|username>")
+        user = self._resolve_user(args[0])
+        if user.get("verified"):
+            self.console.print(f"[yellow]{user['username']} is already verified.[/]")
+            return
+        self._request("POST", f"user/{user['id']}/verify")
+        self.console.print(f"[bold green]{user['username']} marked as verified.[/]")
+
+    def cmd_unverify(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: unverify <user_id|username>")
+        user = self._resolve_user(args[0])
+        if not user.get("verified"):
+            self.console.print(f"[yellow]{user['username']} is already unverified.[/]")
+            return
+        self._request("POST", f"user/{user['id']}/verify")
+        self.console.print(f"[bold green]{user['username']} is now unverified.[/]")
+
+    def cmd_list_blocklist(self) -> None:
+        self._require_auth()
+        response = self._request("GET", "moderation/blocklist")
+        words = response.json().get("words", [])
+        if not words:
+            self.console.print("[cyan]Blocklist is empty.[/]")
+            return
+        table = Table(title="Blocked Words", show_lines=True)
+        table.add_column("Word / Phrase")
+        for entry in words:
+            table.add_row(entry)
+        self.console.print(table)
+
+    def cmd_unblock_ip(self, args: List[str]) -> None:
+        if not args:
+            raise CLIError("Usage: unblock-ip <ip_address>")
+        self._require_auth()
+        ip = args[0].strip()
+        if not ip:
+            raise CLIError("IP address cannot be empty")
+        response = self._request("POST", "moderation/unblock-ip", json={"ip": ip})
+        data = response.json()
+        message = data.get("message", "IP unblocked")
+        self.console.print(f"[bold green]{message}[/]")
+
+    def cmd_clear_all_rate_limits(self) -> None:
+        """Clear all rate limit entries. Use with caution."""
+        self._require_auth()
+        if not self._confirm("Clear ALL rate limit entries? This affects all IPs."):
+            self.console.print("[yellow]Operation cancelled.[/]")
+            return
+        response = self._request("POST", "moderation/clear-all-rate-limits")
+        data = response.json()
+        message = data.get("message", "Rate limits cleared")
+        self.console.print(f"[bold green]{message}[/]")
+
+    def cmd_help(self) -> None:
+        cmds = {
+            "login [username]": "Authenticate as owner/admin.",
+            "suspend <user>": "Suspend account (alias: ban).",
+            "unsuspend <user>": "Unsuspend account (alias: unban).",
+            "delete <user>": "Permanently delete the user account.",
+            "verify <user>": "Mark user as verified.",
+            "unverify <user>": "Remove verification flag.",
+            "block-word <words>": "Add words/phrases to chat filter.",
+            "unblock-word <words>": "Remove words/phrases from filter.",
+            "blocklist": "Show current blocklist.",
+            "unblock-ip <ip>": "Unblock an IP address from rate limiting.",
+            "clear-all-rate-limits": "Clear all rate limit entries (use with caution).",
+            "list": "List all users.",
+            "user <user>": "Show detailed user information.",
+            "whoami": "Display current session context.",
+            "help": "Show this help panel.",
+            "exit": "Quit the CLI.",
+        }
+        table = Table(title="Available Commands")
+        table.add_column("Command", style="cyan")
+        table.add_column("Description", style="white")
+        for cmd, desc in cmds.items():
+            table.add_row(cmd, desc)
+        self.console.print(table)
+
+    def cmd_whoami(self) -> None:
+        if not self.token:
+            self.console.print("[yellow]Not authenticated.[/]")
+            return
+        self.console.print(f"[green]Logged in as[/] [bold]{self.username}[/] ({self.api_url})")
+
+    # --------------------------- Main loop ------------------------------ #
+    def run(self) -> None:
+        self.console.print(Panel.fit("[bold magenta]FromChat Admin CLI[/]", style="magenta"))
+        while True:
+            prompt_identity = self.username or "guest"
+            try:
+                prompt_str = f"\033[36m{prompt_identity}\033[0m \033[1m>\033[0m "
+                raw = input(prompt_str).strip()
+            except (KeyboardInterrupt, EOFError):
+                self.console.print("\n[red]Exiting...[/]")
+                break
+
+            if not raw:
+                continue
+
+            try:
+                parts = shlex.split(raw)
+            except ValueError as exc:
+                self.console.print(f"[red]Parse error:[/] {exc}")
+                continue
+
+            command = parts[0].lstrip("/").lower()
+            args = parts[1:]
+
+            if command in {"exit", "quit"}:
+                self.console.print("[red]Goodbye.[/]")
+                break
+
+            try:
+                if command == "login":
+                    self.cmd_login(args)
+                elif command in {"suspend", "ban"}:
+                    self.cmd_suspend(args)
+                elif command in {"unsuspend", "unban"}:
+                    self.cmd_unsuspend(args)
+                elif command == "block-word":
+                    self.cmd_block_word(args)
+                elif command == "unblock-word":
+                    self.cmd_unblock_word(args)
+                elif command == "blocklist":
+                    self.cmd_list_blocklist()
+                elif command == "unblock-ip":
+                    self.cmd_unblock_ip(args)
+                elif command == "clear-all-rate-limits":
+                    self.cmd_clear_all_rate_limits()
+                elif command == "verify":
+                    self.cmd_verify(args)
+                elif command == "unverify":
+                    self.cmd_unverify(args)
+                elif command in {"delete", "remove"}:
+                    self.cmd_delete(args)
+                elif command == "list":
+                    self.cmd_list_users()
+                elif command == "user":
+                    self.cmd_user(args)
+                elif command == "help":
+                    self.cmd_help()
+                elif command == "whoami":
+                    self.cmd_whoami()
+                else:
+                    self.console.print("[yellow]Unknown command. Type /help for a list of commands.[/]")
+            except CLIError as err:
+                self.console.print(f"[red]Error:[/] {err}")
+            except httpx.RequestError as err:
+                self.console.print(f"[red]Network error:[/] {err}")
+
+        self.client.close()
+
+
+def main(argv: Optional[Iterable[str]] = None) -> None:
+    parser = argparse.ArgumentParser(description="FromChat Emergency Admin CLI")
+    parser.add_argument(
+        "--api-url",
+        default=os.getenv("FC_ADMIN_API_URL", "http://127.0.0.1:8300"),
+        help="Base API URL for the FromChat backend (default: %(default)s).",
+    )
+    args = parser.parse_args(list(argv) if argv is not None else None)
+    cli = AdminCLI(args.api_url)
+    cli.run()
+
+
+if __name__ == "__main__":
+    main()
+

backend/app.py

@@ -1,22 +1,29 @@
-from fastapi import FastAPI
+import asyncio
+import time
+from fastapi import FastAPI, Request
 from fastapi.middleware.cors import CORSMiddleware
 from contextlib import asynccontextmanager
 import subprocess
 import sys
 import os
-from constants import DATABASE_URL
-from routes import account, messaging, profile, push, webrtc, devices
+from routes import account, messaging, profile, push, webrtc, devices, moderation
 import logging
 from models import User
 from constants import OWNER_USERNAME
-from sqlalchemy import create_engine
-from sqlalchemy.orm import sessionmaker
+from utils import get_client_ip
+
+from db import POOL_CONFIG, SessionLocal
+from logging_config import access_logger  # noqa: F401 - ensure loggers configured
+from security.audit import log_access
+from security.rate_limit import limiter
+from slowapi.middleware import SlowAPIMiddleware
 
 logger = logging.getLogger("uvicorn.error")
 
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    # Startup - run migration in separate process to avoid logging interference
+    # Startup - run migration in subprocess to avoid logging interference
     try:
         logger.info("Starting database migration check...")
         # Run migration in a separate process
@@ -31,14 +38,10 @@ async def lifespan(app: FastAPI):
     except Exception as e:
         logger.error(f"Failed to run database migrations: {e}")
         raise
-    
+
     try:
-        engine = create_engine(DATABASE_URL)
-        SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
-        
         with SessionLocal() as db:
-            # Find the owner user
-            owner = db.query(User).filter(User.username == OWNER_USERNAME).first()
+            owner = db.query(User).filter(User.id == 1).first()
             if owner and not owner.verified:
                 owner.verified = True
                 db.commit()
@@ -47,10 +50,18 @@ async def lifespan(app: FastAPI):
                 logger.info(f"Owner user '{OWNER_USERNAME}' is already verified")
             else:
                 logger.warning(f"Owner user '{OWNER_USERNAME}' not found")
-                
     except Exception as e:
         logger.error(f"Failed to ensure owner verification: {e}")
     
+    logger.info(
+        "SQLAlchemy pool configured (size=%s, max_overflow=%s, timeout=%ss, recycle=%ss, pre_ping=%s)",
+        POOL_CONFIG["pool_size"],
+        POOL_CONFIG["max_overflow"],
+        POOL_CONFIG["pool_timeout"],
+        POOL_CONFIG["pool_recycle"],
+        POOL_CONFIG["pool_pre_ping"],
+    )
+
     # Start the messaging cleanup task
     try:
         from routes.messaging import messagingManager
@@ -59,13 +70,87 @@ async def lifespan(app: FastAPI):
     except Exception as e:
         logger.error(f"Failed to start messaging cleanup task: {e}")
     
+    # Reset all rate limits on startup to ensure clean state
+    # This prevents rate limits from persisting across restarts
+    try:
+        from security.rate_limit import reset_all_rate_limits
+        cleared = reset_all_rate_limits()
+        if cleared > 0:
+            logger.info(f"Cleared {cleared} rate limit entries on startup")
+    except Exception as e:
+        logger.warning(f"Failed to reset rate limits on startup: {e}")
+    
+    # Start the rate limit cleanup task
+    try:
+        from security.rate_limit import start_rate_limit_cleanup_task
+        cleanup_task = asyncio.create_task(start_rate_limit_cleanup_task())
+        logger.info("Rate limit cleanup task started")
+    except Exception as e:
+        logger.error(f"Failed to start rate limit cleanup task: {e}")
+        cleanup_task = None
+    
     yield
     
-    # Shutdown (if needed in the future)
+    # Shutdown - cancel cleanup task if it exists
+    if cleanup_task:
+        cleanup_task.cancel()
+        try:
+            await cleanup_task
+        except asyncio.CancelledError:
+            pass
 
 # Инициализация FastAPI
 app = FastAPI(title="FromChat", lifespan=lifespan)
 
+# Add rate limiting middleware
+app.state.limiter = limiter
+app.add_middleware(SlowAPIMiddleware)
+
+
+@app.middleware("http")
+async def access_logging_middleware(request: Request, call_next):
+    # Log incoming request and Authorization header presence for debugging auth issues
+    try:
+        auth_header = request.headers.get("authorization")
+        if auth_header:
+            short = auth_header[:20] + "..." if len(auth_header) > 20 else auth_header
+            logger.info("Incoming request %s %s Authorization=%s", request.method, request.url.path, short)
+        else:
+            logger.info("Incoming request %s %s Authorization=NONE", request.method, request.url.path)
+    except Exception:
+        pass
+    start = time.perf_counter()
+    try:
+        response = await call_next(request)
+    except Exception as exc:
+        duration = time.perf_counter() - start
+        user = getattr(getattr(request, "state", None), "current_user", None)
+        log_access(
+            "http_error",
+            method=request.method,
+            path=request.url.path,
+            status="error",
+            user=getattr(user, "username", None),
+            ip=get_client_ip(request),
+            duration=f"{duration:.3f}s",
+            error=str(exc),
+        )
+        raise
+    else:
+        duration = time.perf_counter() - start
+        user = getattr(getattr(request, "state", None), "current_user", None)
+        log_access(
+            "http_request",
+            method=request.method,
+            path=request.url.path,
+            status=response.status_code,
+            user=getattr(user, "username", None),
+            ip=get_client_ip(request),
+            duration=f"{duration:.3f}s",
+        )
+        return response
+
+
 # CORS
 app.add_middleware(
     CORSMiddleware,
@@ -89,4 +174,5 @@ app.include_router(messaging.router)
 app.include_router(profile.router)
 app.include_router(push.router, prefix="/push")
 app.include_router(webrtc.router, prefix="/webrtc")
-app.include_router(devices.router, prefix="/devices")
+app.include_router(devices.router, prefix="/devices")
+app.include_router(moderation.router)

backend/constants.py

@@ -1,9 +1,11 @@
 import os
 
-
 DATABASE_URL = "sqlite:///./data/database.db"
 JWT_ALGORITHM = "HS256"
-ACCESS_TOKEN_EXPIRE_HOURS = 24
+# Token inactivity expiration - token expires if not used for this duration
+TOKEN_INACTIVITY_EXPIRE_HOURS = 30 * 24  # 30 days of inactivity
+# Maximum token lifetime (safety net) - tokens expire after this regardless of usage
+MAX_TOKEN_LIFETIME_HOURS = 365 * 24  # 1 year maximum
 OWNER_USERNAME = "denis0001-dev"
 JWT_SECRET_KEY = os.getenv("JWT_SECRET")
 

backend/db.py

@@ -6,5 +6,35 @@ from constants import DATABASE_URL
 # Ensure data directory exists
 os.makedirs("data", exist_ok=True)
 
-engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
+POOL_SIZE = int(os.getenv("DB_POOL_SIZE", "20"))
+MAX_OVERFLOW = int(os.getenv("DB_MAX_OVERFLOW", "40"))
+POOL_RECYCLE = int(os.getenv("DB_POOL_RECYCLE", "1800"))
+POOL_TIMEOUT = int(os.getenv("DB_POOL_TIMEOUT", "30"))
+
+POOL_CONFIG = {
+    "pool_size": POOL_SIZE,
+    "max_overflow": MAX_OVERFLOW,
+    "pool_recycle": POOL_RECYCLE,
+    "pool_timeout": POOL_TIMEOUT,
+    "pool_pre_ping": True,
+}
+
+engine_kwargs = {
+    "pool_size": POOL_SIZE,
+    "max_overflow": MAX_OVERFLOW,
+    "pool_recycle": POOL_RECYCLE,
+    "pool_pre_ping": True,
+    "pool_timeout": POOL_TIMEOUT,
+}
+
+connect_args = {}
+if DATABASE_URL.startswith("sqlite"):
+    connect_args["check_same_thread"] = False
+
+engine = create_engine(
+    DATABASE_URL,
+    connect_args=connect_args,
+    **engine_kwargs,
+)
+
 SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)

backend/dependencies.py

@@ -1,11 +1,14 @@
-from fastapi import Depends, HTTPException, status
+from datetime import datetime, timedelta
+from fastapi import Depends, HTTPException, Request, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from sqlalchemy.orm import Session
-from utils import *
-from models import *
+from utils import verify_token
+from models import User, DeviceSession
 from db import SessionLocal
+import logging
 
 security = HTTPBearer()
+logger = logging.getLogger("uvicorn.error")
 
 # Зависимость для получения сессии БД
 def get_db():
@@ -17,12 +20,22 @@ def get_db():
 
 # Зависимость для получения текущего пользователя
 def get_current_user(
+    request: Request,
     credentials: HTTPAuthorizationCredentials = Depends(security),
-    db: Session = Depends(get_db)
+    db: Session = Depends(get_db),
 ) -> User:
     token = credentials.credentials
-    payload = verify_token(token)
+    try:
+        payload = verify_token(token)
+    except Exception as e:
+        logger.warning("get_current_user: token verification error: %s", str(e))
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
     if not payload:
+        logger.info("get_current_user: verify_token returned empty payload")
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid or expired token",
@@ -30,12 +43,19 @@ def get_current_user(
         )
     user = db.query(User).filter(User.id == payload["user_id"]).first()
     if not user:
+        logger.info("get_current_user: user not found for user_id=%s", payload.get("user_id"))
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="User not found",
             headers={"WWW-Authenticate": "Bearer"},
         )
 
+    if user.id == 1 and user.suspended:
+        user.suspended = False
+        user.suspension_reason = None
+        db.commit()
+        db.refresh(user)
+
     # Validate device session from JWT
     session_id = payload.get("session_id")
     if not session_id:
@@ -52,18 +72,34 @@ def get_current_user(
     )
 
     if not device_session or device_session.revoked:
+        logger.info("get_current_user: session missing/revoked for user_id=%s session_id=%s", user.id, session_id)
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Session revoked or not found",
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    # Touch last_seen on valid session
+    # Check if session has been inactive for too long (sliding expiration)
+    from constants import TOKEN_INACTIVITY_EXPIRE_HOURS
+    inactivity_threshold = datetime.now() - timedelta(hours=TOKEN_INACTIVITY_EXPIRE_HOURS)
+    if device_session.last_seen < inactivity_threshold:
+        # Session expired due to inactivity - revoke it
+        device_session.revoked = True
+        db.commit()
+        logger.info("get_current_user: session expired due to inactivity for user_id=%s session_id=%s", user.id, session_id)
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Session expired due to inactivity",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    # Touch last_seen on valid session (sliding expiration - extends token life)
     device_session.last_seen = datetime.now()
     db.commit()
 
     # Check if user is suspended
     if user.suspended:
+        logger.info("get_current_user: account suspended for user_id=%s reason=%s", user.id, user.suspension_reason)
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Account suspended",
@@ -72,9 +108,13 @@ def get_current_user(
 
     # Check if user is deleted
     if user.deleted:
+        logger.info("get_current_user: account deleted for user_id=%s", user.id)
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Account deleted",
         )
 
+    request.state.current_user = user
+    request.state.session_id = session_id
+
     return user

backend/logging_config.py

@@ -0,0 +1,89 @@
+import logging
+import os
+from datetime import datetime
+from logging.handlers import RotatingFileHandler
+from pathlib import Path
+from threading import RLock
+from typing import Dict
+
+LOGS_DIR = Path(__file__).resolve().parent / "logs"
+LOGS_DIR.mkdir(parents=True, exist_ok=True)
+
+
+class HumanReadableFileHandler(RotatingFileHandler):
+    def __init__(self, filename: Path, level: int) -> None:
+        super().__init__(filename, maxBytes=5 * 1024 * 1024, backupCount=5, encoding="utf-8", delay=True)
+        self.level = level
+        self._lock = RLock()
+        self._last_date: str | None = None
+        self._previous_entry: str | None = None
+
+    def emit(self, record: logging.LogRecord) -> None:
+        try:
+            message = record.getMessage().strip()
+            if not message:
+                return
+
+            timestamp = datetime.fromtimestamp(record.created)
+            date_str = timestamp.strftime("%d.%m.%Y")
+            time_str = timestamp.strftime("%H:%M:%S")
+            lines = [line.rstrip() for line in message.splitlines() if line.strip()]
+
+            with self._lock:
+                if self.stream is None:
+                    self.stream = self._open()
+
+                if self._last_date != date_str:
+                    if self._last_date is not None:
+                        self.stream.write("\n")
+                    separator = "-" * 11
+                    self.stream.write(f"\n\n{separator}\n{date_str}\n{separator}\n\n")
+                    self._last_date = date_str
+
+                entry_lines: list[str] = []
+                if lines:
+                    entry_lines.append(f"{time_str} {lines[0]}")
+                    for line in lines[1:]:
+                        if line.startswith("|"):
+                            entry_lines.append(f"    {line}")
+                        else:
+                            entry_lines.append(f"  ↳ {line}")
+                else:
+                    entry_lines.append(time_str)
+                entry_text = "\n".join(entry_lines)
+                if entry_text == self._previous_entry:
+                    return
+                self.stream.write(entry_text + "\n")
+                self._previous_entry = entry_text
+                self.flush()
+        except Exception:
+            self.handleError(record)
+
+
+_HANDLED_FILES: Dict[str, Path] = {}
+
+
+def _configure_logger(name: str, filename: str, level: int = logging.INFO) -> logging.Logger:
+    logger = logging.getLogger(name)
+    target_path = LOGS_DIR / filename
+
+    if _HANDLED_FILES.get(name) == target_path:
+        return logger
+
+    logger.handlers.clear()
+
+    handler = HumanReadableFileHandler(target_path, level)
+    handler.setLevel(level)
+    logger.addHandler(handler)
+    logger.setLevel(level)
+    logger.propagate = False
+
+    _HANDLED_FILES[name] = target_path
+    return logger
+
+
+security_logger = _configure_logger("security", "security.log")
+public_chat_logger = _configure_logger("public_chat", "public-chat.log")
+dm_logger = _configure_logger("dm", "dm.log")
+access_logger = _configure_logger("access", "access.log")
+

backend/migration.py

@@ -20,18 +20,33 @@ def run_migrations():
     Fully automated - handles all scenarios automatically.
     """
     try:
+        # FIRST: Check if database has any application tables (excluding alembic_version)
+        engine = create_engine(DATABASE_URL)
+        with engine.connect() as connection:
+            from sqlalchemy import inspect
+            inspector = inspect(connection)
+            existing_tables = [table for table in inspector.get_table_names()
+                             if not table.startswith('sqlite_') and table != 'alembic_version']
+
+        # If no application tables exist, create them directly from models
+        if not existing_tables:
+            logger.info("No application tables found. Creating all tables directly from models...")
+            from models import Base
+            Base.metadata.create_all(bind=engine)
+            logger.info("All tables created successfully from models.")
+
         # Get the directory where this script is located
         current_dir = os.path.dirname(os.path.abspath(__file__))
-        
+
         # Create Alembic configuration
         alembic_cfg = Config(os.path.join(current_dir, "alembic.ini"))
-        
+
         # Disable Alembic's logging configuration to avoid interfering with FastAPI
         alembic_cfg.set_main_option("configure_logging", "false")
-        
+
         # Set the database URL in the config
         alembic_cfg.set_main_option("sqlalchemy.url", DATABASE_URL)
-        
+
         # Check if any migration files exist
         versions_dir = os.path.join(current_dir, "alembic", "versions")
 

backend/models.py

@@ -113,6 +113,16 @@ class PushSubscription(Base):
     updated_at = Column(DateTime, default=datetime.now, onupdate=datetime.now)
 
 
+class FcmToken(Base):
+    __tablename__ = "fcm_token"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(Integer, ForeignKey("user.id"), nullable=False, index=True)
+    token = Column(Text, nullable=False, unique=True)
+    created_at = Column(DateTime, default=datetime.now)
+    updated_at = Column(DateTime, default=datetime.now, onupdate=datetime.now)
+
+
 class Reaction(Base):
     __tablename__ = "reaction"
 
@@ -283,5 +293,20 @@ class DMReactionResponse(BaseModel):
         from_attributes = True
 
 
+class UpdateLog(Base):
+    """Stores update sequence numbers and updates for gap detection"""
+    __tablename__ = "update_log"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(Integer, ForeignKey("user.id"), nullable=False, index=True)
+    sequence = Column(Integer, nullable=False, index=True)
+    updates = Column(Text, nullable=False)  # JSON array of updates
+    timestamp = Column(DateTime, default=datetime.now, index=True)
+
+    __table_args__ = (
+        UniqueConstraint("user_id", "sequence", name="uq_user_sequence"),
+    )
+
+
 # Tables are now created through Alembic migrations
 # Base.metadata.create_all(bind=engine)

backend/push_service.py

@@ -5,6 +5,11 @@ from typing import List, Optional
 from sqlalchemy.orm import Session
 from pywebpush import webpush, WebPushException
 from models import PushSubscription, User, Message, DMEnvelope
+from models import FcmToken
+import firebase_admin
+from firebase_admin import credentials as firebase_credentials
+from firebase_admin import messaging as firebase_messaging
+import base64
 
 logger = logging.getLogger("uvicorn.error")
 
@@ -12,6 +17,24 @@ class PushNotificationService:
     def __init__(self):
         self.vapid_private_key = os.getenv("VAPID_PRIVATE_KEY")
         self.vapid_public_key = os.getenv("VAPID_PUBLIC_KEY")
+        # Firebase Admin initialization (modern API). Only FIREBASE_CERT env is supported.
+        self.firebase_initialized = False
+        try:
+            firebase_cert = os.getenv("FIREBASE_CERT")
+            if not firebase_cert:
+                raise RuntimeError("FIREBASE_CERT env variable is required for Firebase Admin SDK initialization")
+
+            # Support raw JSON or base64-encoded JSON in FIREBASE_CERT
+            decoded = base64.b64decode(firebase_cert).decode("utf-8")
+            sa_dict = json.loads(decoded)
+
+            cred = firebase_credentials.Certificate(sa_dict)
+            firebase_admin.initialize_app(cred)
+            self.firebase_initialized = True
+            logger.info("Firebase Admin SDK initialized for push sending (FIREBASE_CERT)")
+        except Exception as e:
+            logger.error(f"Failed to initialize Firebase Admin SDK from FIREBASE_CERT: {e}")
+            raise
 
         if (not self.vapid_public_key) or (not self.vapid_private_key):
             raise ValueError("VAPID public or private key is None")
@@ -57,42 +80,61 @@ class PushNotificationService:
             users = db.query(User).filter(User.id != message.user_id)
             if exclude_user_id:
                 users = users.filter(User.id != exclude_user_id)
-            
+
             for user in users:
                 # Check if user has push subscription before trying to send
+                # Try all FCM tokens first (Android). If none or all fail, fall back to web push subscription.
+                fcm_rows = db.query(FcmToken).filter(FcmToken.user_id == user.id).all()
+                payload_data = {
+                    "type": "public_message",
+                    "message_id": message.id,
+                    "sender_id": message.user_id,
+                    "sender_username": message.author.username
+                }
+                title = f"{message.author.username}"
+                body = message.content[:100] + ("..." if len(message.content) > 100 else "")
+
+                if fcm_rows and self.firebase_initialized:
+                    for fcm in fcm_rows:
+                        try:
+                            self._send_fcm_to_token(fcm.token, title, body, payload_data)
+                        except Exception as e:
+                            logger.error(f"Failed to send FCM to user {user.id} token {fcm.token}: {e}")
+                            # Check if this is a permanent failure and clean up the token
+                            self._cleanup_failed_fcm_token(db, fcm, str(e))
+
                 subscription = db.query(PushSubscription).filter(PushSubscription.user_id == user.id).first()
-                if not subscription:
-                    continue
-                    
-                await self._send_notification_to_user(
-                    db, user.id, 
-                    f"New message from {message.author.username}",
-                    message.content[:100] + ("..." if len(message.content) > 100 else ""),
-                    message.author.profile_picture,
-                    {
-                        "type": "public_message",
-                        "message_id": message.id,
-                        "sender_id": message.user_id,
-                        "sender_username": message.author.username
-                    }
-                )
+                if subscription:
+                    await self._send_notification_to_user(
+                        db, user.id, title, body, message.author.profile_picture, payload_data
+                    )
         except Exception as e:
             logger.error(f"Failed to send public message notifications: {e}")
 
     async def send_dm_notification(self, db: Session, dm_envelope: DMEnvelope, sender: User):
         """Send push notification for a new DM"""
         try:
+            title = f"{sender.username}"
+            body = "New direct message"
+            payload_data = {
+                "type": "dm",
+                "dm_id": dm_envelope.id,
+                "sender_id": sender.id,
+                "sender_username": sender.username
+            }
+
+            fcm_rows = db.query(FcmToken).filter(FcmToken.user_id == dm_envelope.recipient_id).all()
+            if fcm_rows and self.firebase_initialized:
+                for fcm in fcm_rows:
+                    try:
+                        self._send_fcm_to_token(fcm.token, title, body, payload_data)
+                    except Exception as e:
+                        logger.error(f"Failed to send FCM to user {dm_envelope.recipient_id} token {fcm.token}: {e}")
+                        # Check if this is a permanent failure and clean up the token
+                        self._cleanup_failed_fcm_token(db, fcm, str(e))
+
             await self._send_notification_to_user(
-                db, dm_envelope.recipient_id,
-                f"New message from {sender.username}",
-                "You have a new direct message",
-                sender.profile_picture,
-                {
-                    "type": "dm",
-                    "dm_id": dm_envelope.id,
-                    "sender_id": sender.id,
-                    "sender_username": sender.username
-                }
+                db, dm_envelope.recipient_id, title, body, sender.profile_picture, payload_data
             )
         except Exception as e:
             logger.error(f"Failed to send DM notification: {e}")
@@ -107,7 +149,7 @@ class PushNotificationService:
             payload = {
                 "title": title,
                 "body": body,
-                "icon": icon or "/logo.png",
+                "icon": icon or "about:blank",
                 "tag": f"message_{user_id}",
                 "data": data
             }
@@ -136,6 +178,56 @@ class PushNotificationService:
         except Exception as e:
             logger.error(f"Failed to send push notification to user {user_id}: {e}")
 
+    def _send_fcm_to_token(self, token: str, title: str, body: str, data: dict):
+        """Send an FCM data-only push to a single device token using Firebase Admin SDK.
+        Notification display is handled by the app, not FCM."""
+        if not self.firebase_initialized:
+            raise RuntimeError("Firebase Admin SDK not initialized (FIREBASE_CERT required)")
+
+        try:
+            # Send only data payload - let the app handle notification display
+            # This prevents FCM from auto-showing notifications
+            msg = firebase_messaging.Message(
+                token=token,
+                data={
+                    "title": title,
+                    "body": body,
+                    **{k: str(v) for k, v in (data or {}).items()}
+                },
+                android=firebase_messaging.AndroidConfig(priority="high"),
+                apns=firebase_messaging.APNSConfig(headers={"apns-priority": "10"})
+            )
+            resp = firebase_messaging.send(msg)
+            return resp
+        except Exception as e:
+            logger.error(f"Firebase Admin send failed for token {token}: {e}")
+            raise
+
+    def _cleanup_failed_fcm_token(self, db: Session, fcm_token_entry, error_message: str):
+        """Clean up FCM tokens that have permanent failures"""
+        try:
+            # Check for permanent failure indicators in the error message
+            permanent_errors = [
+                "unregistered", "invalidregistration", "notregistered",
+                "sender_id_mismatch", "invalid_argument"
+            ]
+
+            error_lower = error_message.lower()
+            is_permanent = any(permanent_error in error_lower for permanent_error in permanent_errors)
+
+            if is_permanent:
+                logger.info(f"Removing permanently failed FCM token for user {fcm_token_entry.user_id}: {fcm_token_entry.token}")
+                db.query(FcmToken).filter(FcmToken.id == fcm_token_entry.id).delete()
+                db.commit()
+            else:
+                logger.debug(f"Temporary FCM failure for token {fcm_token_entry.token}, keeping token: {error_message}")
+        except Exception as e:
+            logger.error(f"Failed to cleanup FCM token {fcm_token_entry.token}: {e}")
+            try:
+                db.rollback()
+            except Exception:
+                pass
+
     async def unsubscribe_user(self, db: Session, user_id: int) -> bool:
         """Unsubscribe a user from push notifications"""
         try:

backend/requirements.txt

@@ -11,3 +11,7 @@ cryptography>=41.0.0
 alembic>=1.13.2
 better-profanity>=0.7.0
 user-agents>=2.2.0
+httpx>=0.27.2
+rich>=13.9.4
+slowapi>=0.1.9
+firebase_admin>=7.1.0

backend/routes/account.py

@@ -1,4 +1,6 @@
 from datetime import datetime
+from collections import defaultdict, deque
+import time
 from fastapi import APIRouter, Depends, HTTPException, status, Request
 from sqlalchemy.orm import Session
 from sqlalchemy import inspect, text
@@ -8,14 +10,38 @@ from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 
 from constants import OWNER_USERNAME
 from dependencies import get_current_user, get_db
-from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from models import LoginRequest, RegisterRequest, ChangePasswordRequest, User, CryptoPublicKey, CryptoBackup, DeviceSession
-from utils import create_token, get_password_hash, verify_password
+from utils import create_token, get_password_hash, verify_password, get_client_ip
 from validation import is_valid_password, is_valid_username, is_valid_display_name
 import os
 
+from security.audit import log_security
+from security.profanity import contains_profanity
+from security.rate_limit import rate_limit_per_ip
 router = APIRouter()
 
+_FAILED_ATTEMPT_WINDOW_SECONDS = 300
+_FAILED_ATTEMPT_THRESHOLD = 5
+_failed_login_attempts: dict[str, deque[float]] = defaultdict(deque)
+
+
+def _record_failed_login(identifier: str) -> bool:
+    now = time.time()
+    attempts = _failed_login_attempts[identifier]
+    attempts.append(now)
+
+    while attempts and now - attempts[0] > _FAILED_ATTEMPT_WINDOW_SECONDS:
+        attempts.popleft()
+
+    return len(attempts) >= _FAILED_ATTEMPT_THRESHOLD
+
+
+def _reset_failed_logins(identifier: str) -> None:
+    _failed_login_attempts.pop(identifier, None)
+
+def _is_admin(user: User) -> bool:
+    return user.id == 1
+
 def convert_user(user: User) -> dict:
     return {
         "id": user.id,
@@ -26,11 +52,11 @@ def convert_user(user: User) -> dict:
         "display_name": user.display_name,
         "profile_picture": user.profile_picture,
         "bio": user.bio,
-        "admin": user.username == OWNER_USERNAME,
+        "admin": _is_admin(user),
         "verified": user.verified,
         "suspended": user.suspended or False,
         "suspension_reason": user.suspension_reason,
-        "deleted": user.deleted or False
+        "deleted": (user.deleted or user.suspended) or False  # Treat suspended as deleted
     }
 
 @router.get("/check_auth")
@@ -38,23 +64,57 @@ def check_auth(current_user: User = Depends(get_current_user)):
     return {
         "authenticated": True,
         "username": current_user.username,
-        "admin": current_user.username == OWNER_USERNAME
+        "admin": _is_admin(current_user)
     }
 
 
 @router.post("/login")
-def login(request: LoginRequest, db: Session = Depends(get_db), http: Request = None):
-    user = db.query(User).filter(User.username == request.username.strip()).first()
+@rate_limit_per_ip("5/minute")
+def login(request: Request, login_request: LoginRequest, db: Session = Depends(get_db)):
+    username = login_request.username.strip()
+    client_ip = get_client_ip(request)
+    raw_ua = request.headers.get("user-agent")
 
-    if not user or not verify_password(request.password.strip(), user.password_hash):
+    user = db.query(User).filter(User.username == username).first()
+
+    if not user or not verify_password(login_request.password.strip(), user.password_hash):
+        log_security(
+            "login_failed",
+            severity="warning",
+            username=username,
+            ip=client_ip,
+            reason="invalid_credentials",
+        )
+        identifiers = [f"user:{username}"]
+        if client_ip:
+            identifiers.append(f"ip:{client_ip}")
+
+        suspicious = False
+        for identifier in identifiers:
+            if _record_failed_login(identifier):
+                suspicious = True
+
+        if suspicious:
+            total_failures = {
+                identifier: len(_failed_login_attempts.get(identifier, []))
+                for identifier in identifiers
+            }
+            log_security(
+                "auth_bruteforce_detected",
+                severity="warning",
+                username=username,
+                ip=client_ip,
+                failures=total_failures,
+                window_seconds=_FAILED_ATTEMPT_WINDOW_SECONDS,
+            )
         raise HTTPException(
             status_code=401,
             detail="Неверное имя пользователя или пароль"
         )
 
     # Create device session and embed into JWT
-    raw_ua = http.headers.get("user-agent") if http else None
-    device_name = http.headers.get("x-device-name") if http else None
+    raw_ua = request.headers.get("user-agent")
+    device_name = request.headers.get("x-device-name")
     ua = parse_ua(raw_ua or "")
     session_id = uuid.uuid4().hex
 
@@ -82,6 +142,23 @@ def login(request: LoginRequest, db: Session = Depends(get_db), http: Request =
 
     token = create_token(user.id, user.username, session_id)
 
+    identifiers = [f"user:{username}"]
+    if client_ip:
+        identifiers.append(f"ip:{client_ip}")
+    for identifier in identifiers:
+        _reset_failed_logins(identifier)
+
+    log_security(
+        "login_success",
+        username=user.username,
+        user_id=user.id,
+        ip=client_ip,
+        session_id=session_id,
+        device=device.device_type,
+        os=device.os_name,
+        browser=device.browser_name,
+    )
+
     return {
         "status": "success",
         "message": "Login successful",
@@ -91,34 +168,40 @@ def login(request: LoginRequest, db: Session = Depends(get_db), http: Request =
 
 
 @router.post("/register")
-def register(request: RegisterRequest, db: Session = Depends(get_db), http: Request = None):
-    username = request.username.strip()
-    display_name = request.display_name.strip()
-    password = request.password.strip()
-    confirm_password = request.confirm_password.strip()
+@rate_limit_per_ip("3/hour")
+def register(request: Request, register_request: RegisterRequest, db: Session = Depends(get_db)):
+    username = register_request.username.strip()
+    display_name = register_request.display_name.strip()
+    password = register_request.password.strip()
+    confirm_password = register_request.confirm_password.strip()
+    client_ip = get_client_ip(request)
+    raw_ua = request.headers.get("user-agent")
 
     # Determine if owner already exists
     owner_exists = db.query(User).filter(User.username == OWNER_USERNAME).first() is not None
 
-    # If owner not yet registered, only allow the owner to register
-    if not owner_exists and username != OWNER_USERNAME:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Регистрация временно закрыта до регистрации владельца"
-        )
-
     # Validate input
     if not is_valid_username(username):
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail="Имя пользователя должно быть от 3 до 20 символов и содержать только английские буквы, цифры, дефисы и подчеркивания"
         )
+    if contains_profanity(username):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Имя пользователя содержит запрещённые слова"
+        )
 
     if not is_valid_display_name(display_name):
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail="Отображаемое имя должно быть от 1 до 64 символов и не может быть пустым"
         )
+    if contains_profanity(display_name):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Отображаемое имя содержит запрещённые слова"
+        )
 
     if not is_valid_password(password):
         raise HTTPException(
@@ -132,13 +215,6 @@ def register(request: RegisterRequest, db: Session = Depends(get_db), http: Requ
             detail="Пароли не совпадают"
         )
 
-    # After owner exists, disallow registering the reserved owner username via public registration
-    if owner_exists and username == OWNER_USERNAME:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="Это имя пользователя зарезервировано"
-        )
-
     existing_user = db.query(User).filter(User.username == username).first()
     if existing_user:
         raise HTTPException(
@@ -165,8 +241,8 @@ def register(request: RegisterRequest, db: Session = Depends(get_db), http: Requ
     db.refresh(new_user)
 
     # Create initial device session
-    raw_ua = http.headers.get("user-agent") if http else None
-    device_name = http.headers.get("x-device-name") if http else None
+    raw_ua = request.headers.get("user-agent")
+    device_name = request.headers.get("x-device-name")
     ua = parse_ua(raw_ua or "")
     session_id = uuid.uuid4().hex
     device = DeviceSession(
@@ -190,6 +266,24 @@ def register(request: RegisterRequest, db: Session = Depends(get_db), http: Requ
 
     token = create_token(new_user.id, new_user.username, session_id)
 
+    os_name = ua.os.family or "Unknown OS"
+    if ua.os.version_string:
+        os_name = f"{os_name} {ua.os.version_string}"
+    browser_name = ua.browser.family or "Unknown browser"
+    if ua.browser.version_string:
+        browser_name = f"{browser_name} {ua.browser.version_string}"
+    user_agent_summary = f"{os_name}, {browser_name}"
+
+    log_security(
+        "registration_success",
+        username=new_user.username,
+        display_name=new_user.display_name,
+        user_id=new_user.id,
+        ip=client_ip,
+        user_agent=user_agent_summary,
+        owner=is_owner,
+    )
+
     return {
         "status": "success",
         "message": "Регистрация прошла успешно",
@@ -208,6 +302,8 @@ def set_public_key(payload: dict, current_user: User = Depends(get_current_user)
     pk = payload.get("publicKey")
     if not pk:
         raise HTTPException(status_code=400, detail="publicKey required")
+    if not isinstance(pk, str) or len(pk) > 10000 or len(pk) < 10:
+        raise HTTPException(status_code=400, detail="Invalid publicKey format")
     row = db.query(CryptoPublicKey).filter(CryptoPublicKey.user_id == current_user.id).first()
     if row:
         row.public_key_b64 = pk
@@ -229,6 +325,8 @@ def set_backup(payload: dict, current_user: User = Depends(get_current_user), db
     blob = payload.get("blob")
     if not blob:
         raise HTTPException(status_code=400, detail="blob required")
+    if not isinstance(blob, str) or len(blob) > 1000000:  # 1MB limit
+        raise HTTPException(status_code=400, detail="Invalid blob format or size exceeds 1MB")
     row = db.query(CryptoBackup).filter(CryptoBackup.user_id == current_user.id).first()
     if row:
         row.blob_json = blob
@@ -246,7 +344,7 @@ def delete_user_as_owner(
     db: Session = Depends(get_db)
 ):
     # Only owner can delete users
-    if current_user.username != OWNER_USERNAME:
+    if _is_admin(current_user):
         raise HTTPException(status_code=403, detail="Only owner can perform this action")
 
     user = db.query(User).filter(User.id == user_id).first()
@@ -254,7 +352,7 @@ def delete_user_as_owner(
         raise HTTPException(status_code=404, detail="User not found")
 
     # Prevent deleting the owner account via API
-    if user.username == OWNER_USERNAME:
+    if _is_admin(user):
         raise HTTPException(status_code=400, detail="Cannot delete owner account")
 
     # Manually delete user's messages to satisfy FK constraints
@@ -264,10 +362,20 @@ def delete_user_as_owner(
     db.delete(user)
     db.commit()
 
+    log_security(
+        "admin_delete_user",
+        severity="warning",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        target_username=user.username,
+        target_id=user.id,
+    )
+
     return {"status": "success", "deleted_user_id": user_id}
 
 @router.get("/logout")
 def logout(
+    http: Request,
     credentials: HTTPAuthorizationCredentials = Depends(HTTPBearer()),
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db)
@@ -285,6 +393,15 @@ def logout(
     current_user.last_seen = datetime.now()
     db.commit()
 
+    client_ip = get_client_ip(http)
+    log_security(
+        "logout",
+        username=current_user.username,
+        user_id=current_user.id,
+        ip=client_ip,
+        session_id=payload.get("session_id") if payload else None,
+    )
+
     return {
         "status": "success",
         "message": "Logged out successfully"
@@ -292,22 +409,24 @@ def logout(
 
 
 @router.post("/change-password")
+@rate_limit_per_ip("5/hour")
 def change_password(
-    request: ChangePasswordRequest,
+    request: Request,
+    password_request: ChangePasswordRequest,
     credentials: HTTPAuthorizationCredentials = Depends(HTTPBearer()),
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db)
 ):
     # Verify current derived password against stored hash
-    if not verify_password(request.currentPasswordDerived.strip(), current_user.password_hash):
+    if not verify_password(password_request.currentPasswordDerived.strip(), current_user.password_hash):
         raise HTTPException(status_code=401, detail="Текущий пароль неверный")
 
     # Update password hash to hash of new derived password
-    current_user.password_hash = get_password_hash(request.newPasswordDerived.strip())
+    current_user.password_hash = get_password_hash(password_request.newPasswordDerived.strip())
     db.commit()
 
     # Optionally revoke all other sessions, keeping the current one
-    if request.logoutAllExceptCurrent:
+    if password_request.logoutAllExceptCurrent:
         from utils import verify_token as _verify_token
         payload = _verify_token(credentials.credentials)
         if not payload:
@@ -319,11 +438,21 @@ def change_password(
         ).update({DeviceSession.revoked: True})
         db.commit()
 
+    client_ip = get_client_ip(request)
+    log_security(
+        "password_changed",
+        username=current_user.username,
+        user_id=current_user.id,
+        ip=client_ip,
+        logout_others=bool(password_request.logoutAllExceptCurrent),
+    )
+
     return {"status": "success"}
 
 
 @router.get("/users")
-def list_users(current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+@rate_limit_per_ip("30/minute")  # Per-IP limit to prevent abuse
+def list_users(request: Request, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
     users = db.query(User).order_by(User.username.asc()).all()
     return {
         "users": [
@@ -333,13 +462,15 @@ def list_users(current_user: User = Depends(get_current_user), db: Session = Dep
 
 
 @router.get("/crypto/public-key/of/{user_id}")
-def get_public_key_of(user_id: int, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+@rate_limit_per_ip("100/minute")  # Per-IP limit to prevent abuse
+def get_public_key_of(request: Request, user_id: int, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
     row = db.query(CryptoPublicKey).filter(CryptoPublicKey.user_id == user_id).first()
     return {"publicKey": row.public_key_b64 if row else None}
 
 
 @router.get("/users/search")
-def search_users(q: str, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+@rate_limit_per_ip("60/minute")  # Per-IP limit to prevent abuse
+def search_users(request: Request, q: str, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
     if len(q.strip()) < 2:
         return {"users": []}
     
@@ -425,11 +556,18 @@ async def delete_account(
     Delete the current user's own account - preserves messages/DMs/reactions/files
     """
     # Prevent admin/owner account self-deletion
-    if current_user.username == OWNER_USERNAME or current_user.id == 1:
+    if _is_admin(current_user):
         raise HTTPException(status_code=400, detail="Cannot delete admin/owner account")
     
     await _delete_user_data(current_user, db)
     
+    log_security(
+        "self_delete_account",
+        severity="warning",
+        user_id=current_user.id,
+        username=current_user.username,
+    )
+
     return {
         "status": "success",
         "message": "Account deleted successfully"

backend/routes/devices.py

@@ -60,6 +60,9 @@ def revoke_device(
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db)
 ):
+    if not session_id or len(session_id) > 64 or len(session_id) < 1:
+        raise HTTPException(status_code=400, detail="Invalid session ID")
+    
     s = (
         db.query(DeviceSession)
         .filter(DeviceSession.user_id == current_user.id, DeviceSession.session_id == session_id)

backend/routes/moderation.py

@@ -0,0 +1,114 @@
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel, Field
+from typing import List
+
+from constants import OWNER_USERNAME
+from dependencies import get_current_user
+from models import User
+from security.audit import log_security
+from security.profanity import add_to_blocklist, get_blocklist, remove_from_blocklist
+from security.rate_limit import reset_rate_limit_for_ip, clear_all_rate_limits
+
+
+class BlocklistUpdateRequest(BaseModel):
+    words: List[str] = Field(default_factory=list, min_items=1)
+
+
+class UnblockIPRequest(BaseModel):
+    ip: str = Field(..., min_length=1)
+
+
+router = APIRouter(prefix="/moderation", tags=["moderation"])
+
+
+def _ensure_owner(user: User) -> None:
+    if user.username != OWNER_USERNAME:
+        raise HTTPException(status_code=403, detail="Only owner can perform this action")
+
+
+@router.get("/blocklist")
+def list_blocklist(current_user: User = Depends(get_current_user)):
+    _ensure_owner(current_user)
+    return {"words": get_blocklist()}
+
+
+@router.post("/blocklist")
+def append_blocklist(
+    request: BlocklistUpdateRequest,
+    current_user: User = Depends(get_current_user)
+):
+    _ensure_owner(current_user)
+    added, updated = add_to_blocklist(request.words)
+    log_security(
+        "blocklist_add",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        added=added,
+    )
+    return {"added": added, "words": updated}
+
+
+@router.delete("/blocklist")
+def delete_from_blocklist(
+    request: BlocklistUpdateRequest,
+    current_user: User = Depends(get_current_user)
+):
+    _ensure_owner(current_user)
+    removed, updated = remove_from_blocklist(request.words)
+    log_security(
+        "blocklist_remove",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        removed=removed,
+    )
+    return {"removed": removed, "words": updated}
+
+
+@router.post("/unblock-ip")
+def unblock_ip(
+    request: UnblockIPRequest,
+    current_user: User = Depends(get_current_user)
+):
+    """Unblock an IP address from rate limiting."""
+    _ensure_owner(current_user)
+    ip = request.ip.strip()
+    
+    if not ip:
+        raise HTTPException(status_code=400, detail="IP address is required")
+    
+    cleared = reset_rate_limit_for_ip(ip)
+    
+    log_security(
+        "rate_limit_unblock",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        ip=ip,
+        success=cleared,
+    )
+    
+    if cleared:
+        return {"status": "success", "message": f"Rate limit cleared for IP: {ip}"}
+    else:
+        return {"status": "success", "message": f"No rate limit entries found for IP: {ip}"}
+
+
+@router.post("/clear-all-rate-limits")
+def clear_all_rate_limits_endpoint(
+    current_user: User = Depends(get_current_user)
+):
+    """Clear all rate limit entries. Use with caution."""
+    _ensure_owner(current_user)
+    
+    cleared = clear_all_rate_limits()
+    
+    log_security(
+        "rate_limit_clear_all",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        entries_cleared=cleared,
+    )
+    
+    return {"status": "success", "message": f"Cleared {cleared} rate limit entries"}
+
+
+

backend/routes/profile.py

@@ -3,11 +3,11 @@ import re
 from fastapi import APIRouter, Depends, HTTPException, UploadFile, File
 from fastapi.responses import FileResponse
 from sqlalchemy.orm import Session
-from sqlalchemy import inspect, text
 from PIL import Image
 import os
 import uuid
 import io
+from fastapi import Request
 
 from dependencies import get_db, get_current_user
 from models import User, UpdateBioRequest, UserProfileResponse
@@ -15,9 +15,20 @@ from pydantic import BaseModel
 from validation import is_valid_username, is_valid_display_name
 from similarity import is_user_similar_to_verified
 from .messaging import messagingManager
+from security.audit import log_security
+from security.profanity import contains_profanity
+from security.rate_limit import rate_limit_per_ip
 
 router = APIRouter()
 
+
+def _ensure_owner_unsuspended(user: User | None, db: Session):
+    if user and user.id == 1 and user.suspended:
+        user.suspended = False
+        user.suspension_reason = None
+        db.commit()
+        db.refresh(user)
+
 # Request models
 class UpdateProfileRequest(BaseModel):
     username: str | None = None
@@ -30,7 +41,9 @@ PROFILE_PICTURES_DIR = Path("data/uploads/pfp")
 os.makedirs(PROFILE_PICTURES_DIR, exist_ok=True)
 
 @router.post("/upload-profile-picture")
+@rate_limit_per_ip("10/minute")
 async def upload_profile_picture(
+    request: Request,
     profile_picture: UploadFile = File(...),
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db)
@@ -104,20 +117,60 @@ async def get_user_profile(
     """
     Get current user's profile information
     """
+    _ensure_owner_unsuspended(current_user, db)
+
+    return UserProfileResponse(
+        id=current_user.id,
+        username=current_user.username,
+        display_name=current_user.display_name,
+        profile_picture=current_user.profile_picture,
+        bio=current_user.bio,
+        online=current_user.online,
+        last_seen=current_user.last_seen,
+        created_at=current_user.created_at,
+        verified=current_user.verified,
+        suspended=current_user.suspended or False,
+        suspension_reason=current_user.suspension_reason,
+        deleted=(current_user.deleted or current_user.suspended) or False,  # Treat suspended as deleted
+    )
+
+
+@router.get("/user/list")
+async def list_users(
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db)
+):
+    if current_user.id != 1:
+        raise HTTPException(status_code=403, detail="Only admin can list users")
+
+    _ensure_owner_unsuspended(current_user, db)
+
+    users = db.query(User).order_by(User.username.asc()).all()
     return {
-        "id": current_user.id,
-        "username": current_user.username,
-        "display_name": current_user.display_name,
-        "profile_picture": current_user.profile_picture,
-        "bio": current_user.bio,
-        "online": current_user.online,
-        "last_seen": current_user.last_seen,
-        "created_at": current_user.created_at
+        "users": [
+            UserProfileResponse(
+                id=user.id,
+                username=user.username,
+                display_name=user.display_name,
+                profile_picture=user.profile_picture,
+                bio=user.bio,
+                online=user.online,
+                last_seen=user.last_seen,
+                created_at=user.created_at,
+                verified=user.verified,
+                suspended=user.suspended or False,
+                suspension_reason=user.suspension_reason,
+                deleted=(user.deleted or user.suspended) or False,  # Treat suspended as deleted
+            ).model_dump()
+            for user in users
+        ]
     }
 
 @router.put("/user/profile")
+@rate_limit_per_ip("10/minute")
 async def update_user_profile(
-    request: UpdateProfileRequest,
+    request: Request,
+    update_request: UpdateProfileRequest,
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db)
 ):
@@ -127,13 +180,18 @@ async def update_user_profile(
     updated = False
     
     # Update username if provided
-    if request.username is not None:
-        username = request.username.strip()
+    if update_request.username is not None:
+        username = update_request.username.strip()
         if not is_valid_username(username):
             raise HTTPException(
                 status_code=400, 
                 detail="Имя пользователя должно быть от 3 до 20 символов и содержать только английские буквы, цифры, дефисы и подчеркивания"
             )
+        if contains_profanity(username):
+            raise HTTPException(
+                status_code=400,
+                detail="Имя пользователя содержит запрещённые слова"
+            )
         
         # Check if username is already taken by another user
         existing_user = db.query(User).filter(User.username == username, User.id != current_user.id).first()
@@ -144,20 +202,25 @@ async def update_user_profile(
         updated = True
     
     # Update display name if provided
-    if request.display_name is not None:
-        display_name = request.display_name.strip()
+    if update_request.display_name is not None:
+        display_name = update_request.display_name.strip()
         if not is_valid_display_name(display_name):
             raise HTTPException(
                 status_code=400, 
                 detail="Отображаемое имя должно быть от 1 до 64 символов и не может быть пустым"
             )
+        if contains_profanity(display_name):
+            raise HTTPException(
+                status_code=400,
+                detail="Отображаемое имя содержит запрещённые слова"
+            )
         
         current_user.display_name = display_name
         updated = True
     
     # Update bio if provided
-    if request.description is not None:
-        bio = request.description.strip()
+    if update_request.description is not None:
+        bio = update_request.description.strip()
         if len(bio) > 500:
             raise HTTPException(status_code=400, detail="Bio must be 500 characters or less")
         
@@ -182,18 +245,20 @@ async def update_user_profile(
 
 
 @router.put("/user/bio")
+@rate_limit_per_ip("10/minute")
 async def update_user_bio(
-    request: UpdateBioRequest,
+    request: Request,
+    bio_request: UpdateBioRequest,
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db)
 ):
     """
     Update current user's bio
     """
-    if len(request.bio) > 500:  # Limit bio to 500 characters
+    if len(bio_request.bio) > 500:  # Limit bio to 500 characters
         raise HTTPException(status_code=400, detail="Bio must be 500 characters or less")
     
-    current_user.bio = request.bio.strip()
+    current_user.bio = bio_request.bio.strip()
     db.commit()
     
     return {
@@ -210,10 +275,32 @@ async def get_user_by_username(
     """
     Get user profile by username
     """
+    if not username or not is_valid_username(username):
+        raise HTTPException(status_code=400, detail="Invalid username format")
+    
     user = db.query(User).filter(User.username == username).first()
     
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
+
+    _ensure_owner_unsuspended(user, db)
+    
+    # Handle deleted or suspended users
+    if user.deleted or user.suspended:
+        return UserProfileResponse(
+            id=user.id,
+            username="deleted",
+            display_name="Deleted User",
+            profile_picture=None,
+            bio=None,
+            online=False,
+            last_seen=None,  # Clear last seen timestamp
+            created_at=None,  # Clear member since timestamp
+            verified=False,
+            suspended=False,
+            suspension_reason=None,
+            deleted=True
+        )
     
     return UserProfileResponse(
         id=user.id,
@@ -223,7 +310,11 @@ async def get_user_by_username(
         bio=user.bio,
         online=user.online,
         last_seen=user.last_seen,
-        created_at=user.created_at
+        created_at=user.created_at,
+        verified=user.verified,
+        suspended=user.suspended or False,
+        suspension_reason=user.suspension_reason,
+        deleted=(user.deleted or user.suspended) or False,  # Treat suspended as deleted
     )
 
 @router.get("/user/id/{user_id}")
@@ -234,13 +325,18 @@ async def get_user_by_id(
     """
     Get user profile by user ID
     """
+    if user_id <= 0:
+        raise HTTPException(status_code=400, detail="Invalid user ID")
+    
     user = db.query(User).filter(User.id == user_id).first()
     
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
+
+    _ensure_owner_unsuspended(user, db)
     
-    # Handle deleted users
-    if user.deleted:
+    # Handle deleted or suspended users
+    if user.deleted or user.suspended:
         return UserProfileResponse(
             id=user.id,
             username="deleted",
@@ -293,6 +389,15 @@ async def verify_user(
     target_user.verified = not target_user.verified
     db.commit()
     
+    log_security(
+        "admin_verify_toggle",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        target_username=target_user.username,
+        target_id=target_user.id,
+        verified=target_user.verified,
+    )
+
     return {
         "verified": target_user.verified,
         "message": f"User verification {'enabled' if target_user.verified else 'disabled'}"
@@ -363,6 +468,15 @@ async def suspend_user(
     target_user.suspension_reason = request.reason
     db.commit()
     
+    log_security(
+        "admin_suspend_user",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        target_username=target_user.username,
+        target_id=target_user.id,
+        reason=request.reason,
+    )
+
     # Send WebSocket suspension message
     try:
         await messagingManager.send_suspension_to_user(user_id, request.reason)
@@ -399,6 +513,14 @@ async def unsuspend_user(
     target_user.suspension_reason = None
     db.commit()
     
+    log_security(
+        "admin_unsuspend_user",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        target_username=target_user.username,
+        target_id=target_user.id,
+    )
+
     return {
         "status": "success",
         "message": f"User {target_user.username} has been unsuspended"
@@ -426,9 +548,22 @@ async def delete_user(
     if target_user.id == 1:
         raise HTTPException(status_code=400, detail="Cannot delete admin account")
     
+    snapshot_username = target_user.username
+    snapshot_display_name = target_user.display_name
+
     from .account import _delete_user_data
     await _delete_user_data(target_user, db)
     
+    log_security(
+        "admin_delete_user",
+        severity="warning",
+        actor=current_user.username,
+        actor_id=current_user.id,
+        target_username=snapshot_username,
+        target_display_name=snapshot_display_name,
+        target_id=target_user.id,
+    )
+
     return {
         "status": "success",
         "message": f"User {target_user.username} has been deleted"

backend/security/__init__.py

@@ -0,0 +1,2 @@
+# Package marker for security utilities
+

backend/security/audit.py

@@ -0,0 +1,406 @@
+from __future__ import annotations
+
+import logging
+from html import unescape
+from typing import Any, Callable, Dict, List
+
+from logging_config import access_logger, dm_logger, public_chat_logger, security_logger
+
+
+def _clean_username(username: Any) -> str:
+    if not username:
+        return "unknown user"
+    return f"@{username}"
+
+
+def _format_user(fields: Dict[str, Any], username_key: str = "username", user_id_key: str = "user_id") -> str:
+    username = fields.get(username_key)
+    if username is None and "_" in username_key:
+        base_key = username_key.split("_", 1)[0]
+        username = fields.get(base_key)
+
+    user_id = fields.get(user_id_key)
+    if user_id is None and "_" in user_id_key:
+        base_key = user_id_key.split("_", 1)[0]
+        user_id = fields.get(base_key)
+
+    if username and user_id is not None:
+        return f"{_clean_username(username)} (user id {user_id})"
+    if username:
+        return _clean_username(username)
+    if user_id is not None:
+        return f"user id {user_id}"
+    return "unknown user"
+
+
+def _format_actor(fields: Dict[str, Any], prefix: str) -> str:
+    return _format_user(fields, f"{prefix}_username", f"{prefix}_id")
+
+
+def _plural(label: str, count: int) -> str:
+    return f"{count} {label if count == 1 else label + 's'}"
+
+
+def _yes_no(flag: Any) -> str:
+    return "yes" if flag else "no"
+
+
+def _render_security(action: str, fields: Dict[str, Any]) -> List[str]:
+    if action == "login_success":
+        lines = [f"Login approved for {_format_user(fields)}"]
+        session = fields.get("session_id")
+        if session:
+            lines.append(f"Session: {session}")
+        client_bits: List[str] = []
+        if fields.get("device"):
+            client_bits.append(fields["device"])
+        if fields.get("os"):
+            client_bits.append(fields["os"])
+        if fields.get("browser"):
+            client_bits.append(fields["browser"])
+        if client_bits:
+            lines.append(f"Client: {', '.join(client_bits)}")
+        if fields.get("ip"):
+            lines.append(f"IP address: {fields['ip']}")
+        return lines
+    if action == "login_failed":
+        lines = [f"Login denied for {_format_user(fields)}"]
+        if fields.get("reason"):
+            lines.append(f"Reason: {fields['reason']}")
+        if fields.get("ip"):
+            lines.append(f"IP address: {fields['ip']}")
+        return lines
+    if action == "auth_bruteforce_detected":
+        lines = ["Brute-force login pattern detected"]
+        lines.append(f"Target: {_format_user(fields)}")
+        failures = fields.get("failures")
+        if isinstance(failures, dict):
+            for key, value in failures.items():
+                lines.append(f"{key}: {value}")
+        if fields.get("ip"):
+            lines.append(f"IP address: {fields['ip']}")
+        if fields.get("window_seconds"):
+            lines.append(f"Observation window: {fields['window_seconds']} seconds")
+        return lines
+    if action == "registration_success":
+        ip_raw = fields.get("ip")
+        ip_display = "localhost" if ip_raw in {"127.0.0.1", "::1"} else ip_raw
+        display_name = fields.get("display_name") or "Unknown"
+        username = fields.get("username")
+        user_id = fields.get("user_id")
+        user_agent = fields.get("user_agent") or "Unknown user agent"
+        lines = ["Account registered"]
+        lines.append(f"Display name: {display_name}")
+        lines.append(f"Username: {_clean_username(username) if username else 'unknown'}")
+        if ip_display:
+            lines.append(f"IP: {ip_display}")
+        if user_agent:
+            lines.append(f"User agent: {user_agent}")
+        if user_id is not None:
+            lines.append(f"User ID: {user_id}")
+        return lines
+    if action == "password_changed":
+        lines = [f"Password changed for {_format_user(fields)}"]
+        lines.append(f"Other sessions revoked: {_yes_no(fields.get('logout_others'))}")
+        if fields.get("ip"):
+            lines.append(f"IP address: {fields['ip']}")
+        return lines
+    if action == "logout":
+        lines = [f"Logout recorded for {_format_user(fields)}"]
+        if fields.get("session_id"):
+            lines.append(f"Session: {fields['session_id']}")
+        if fields.get("ip"):
+            lines.append(f"IP address: {fields['ip']}")
+        return lines
+    if action == "admin_delete_user":
+        return [
+            "Account removal",
+            f"Actor: {_format_actor(fields, 'actor')}",
+            f"Target: {_format_actor(fields, 'target')}",
+        ]
+    if action == "admin_suspend_user":
+        lines = [
+            "User suspension",
+            f"Actor: {_format_actor(fields, 'actor')}",
+            f"Target: {_format_actor(fields, 'target')}",
+        ]
+        if fields.get("reason"):
+            lines.append(f"Reason: {fields.get('reason')}")
+        return lines
+    if action == "admin_unsuspend_user":
+        return [
+            "User unsuspension",
+            f"Actor: {_format_actor(fields, 'actor')}",
+            f"Target: {_format_actor(fields, 'target')}",
+        ]
+    if action == "admin_verify_toggle":
+        return [
+            "User verification",
+            f"Actor: {_format_actor(fields, 'actor')}",
+            f"Target: {_format_actor(fields, 'target')}",
+            f"Verified: {_yes_no(fields.get('verified'))}",
+        ]
+    if action == "self_delete_account":
+        return [f"User {_format_user(fields)} deleted their account"]
+    if action == "auto_suspension_public_spam":
+        lines = [
+            f"Automatic suspension triggered for {_format_user(fields)}",
+        ]
+        match_type = fields.get("match_type")
+        if match_type:
+            lines.append(f"Match type: {match_type}")
+        similar = fields.get("similar_messages")
+        occurrences = fields.get("occurrences")
+        if similar:
+            lines.append(f"Similar messages detected: {similar}")
+        if occurrences and not similar:
+            lines.append(f"Occurrences: {occurrences}")
+        if fields.get("window_seconds"):
+            lines.append(f"Observation window: {fields['window_seconds']} seconds")
+        if fields.get("reason"):
+            lines.append(f"Reason: {fields['reason']}")
+        return lines
+    if action == "auto_suspension_public_burst":
+        lines = [
+            f"Automatic suspension triggered for {_format_user(fields)}",
+            f"Messages sent: {fields.get('count')} within {fields.get('window_seconds')} seconds",
+        ]
+        if fields.get("reason"):
+            lines.append(f"Reason: {fields['reason']}")
+        return lines
+    if action == "public_message_burst":
+        return [
+            f"Rapid messaging spike for {_format_user(fields)}",
+            f"Messages sent: {fields.get('count')} within {fields.get('window_seconds')} seconds",
+        ]
+    if action == "blocklist_add":
+        added = fields.get("added") or []
+        lines = [f"Blocklist updated by {_format_actor(fields, 'actor')}"]
+        if added:
+            lines.append(f"Added entries: {', '.join(added)}")
+        total = len(fields.get("words") or [])
+        lines.append(f"Total entries: {total}")
+        return lines
+    if action == "blocklist_remove":
+        removed = fields.get("removed") or []
+        lines = [f"Blocklist cleaned by {_format_actor(fields, 'actor')}"]
+        if removed:
+            lines.append(f"Removed entries: {', '.join(removed)}")
+        total = len(fields.get("words") or [])
+        lines.append(f"Total entries: {total}")
+        return lines
+    return [f"{action.replace('_', ' ').capitalize()}"] + [
+        f"{key.replace('_', ' ').capitalize()}: {value}"
+        for key, value in fields.items()
+        if value is not None
+    ]
+
+
+def _render_public_chat(action: str, fields: Dict[str, Any]) -> List[str]:
+    if action == "message_created":
+        lines = [f"Message #{fields.get('message_id')} sent by {_format_user(fields)}"]
+        if fields.get("reply_to"):
+            lines.append(f"In reply to message #{fields['reply_to']}")
+        attachments = fields.get("attachments")
+        if attachments:
+            lines.append(f"Attachments: {_plural('file', attachments)}")
+        
+        # If content was censored, log both raw and censored versions
+        if fields.get("raw_content") is not None:
+            lines.append("Raw content (before censoring):")
+            for line in unescape(fields["raw_content"]).splitlines():
+                lines.append(f"| {line}")
+            lines.append("Censored content (stored):")
+            for line in unescape(fields.get("censored_content", fields.get("content", ""))).splitlines():
+                lines.append(f"| {line}")
+        elif fields.get("content"):
+            lines.append("Content:")
+            for line in unescape(fields["content"]).splitlines():
+                lines.append(f"| {line}")
+        return lines
+    if action == "message_edited":
+        lines = [f"Message #{fields.get('message_id')} edited by {_format_user(fields)}"]
+        if fields.get("reply_to"):
+            lines.append(f"Reply to #{fields['reply_to']}")
+        if fields.get("previous_content"):
+            lines.append("Previous content:")
+            for line in unescape(fields["previous_content"] or "").splitlines() or [""]:
+                lines.append(f"| {line}")
+        
+        # If content was censored, log both raw and censored versions
+        if fields.get("raw_content") is not None:
+            lines.append("Raw content (before censoring):")
+            for line in unescape(fields["raw_content"]).splitlines():
+                lines.append(f"| {line}")
+            lines.append("Censored content (stored):")
+            for line in unescape(fields.get("censored_content", fields.get("content", ""))).splitlines():
+                lines.append(f"| {line}")
+        elif fields.get("content"):
+            lines.append("New content:")
+            for line in unescape(fields["content"] or "").splitlines() or [""]:
+                lines.append(f"| {line}")
+        
+        return lines
+    if action == "message_deleted":
+        lines = [
+            f"Message #{fields.get('message_id')} deleted",
+            f"Actor: {_format_actor(fields, 'actor')}",
+        ]
+        if fields.get("original_author_id") is not None:
+            lines.append(f"Original author: user #{fields['original_author_id']}")
+        if fields.get("content"):
+            lines.append("Previous content:")
+            for line in unescape(fields["content"]).splitlines():
+                lines.append(f"| {line}")
+        return lines
+    if action == "reaction_update":
+        lines = [
+            f"Reaction {fields.get('action', 'updated')} on message #{fields.get('message_id')}",
+            f"User: {_format_user(fields)}",
+        ]
+        if fields.get("emoji"):
+            lines.append(f"Emoji: {fields['emoji']}")
+        return lines
+    return [f"{action.replace('_', ' ').capitalize()}"] + [
+        f"{key.replace('_', ' ').capitalize()}: {value}"
+        for key, value in fields.items()
+        if value is not None
+    ]
+
+
+def _render_dm(action: str, fields: Dict[str, Any]) -> List[str]:
+    if action in {"message_sent", "message_sent_ws"}:
+        lines = [
+            f"Direct message #{fields.get('dm_envelope_id')} sent",
+            f"Sender: {_format_actor(fields, 'sender')}",
+        ]
+        if fields.get("recipient_id") is not None:
+            lines.append(f"Recipient: user id {fields['recipient_id']}")
+        attachments = fields.get("attachment_count")
+        if attachments:
+            lines.append(f"Attachments: {_plural('file', attachments)}")
+        if fields.get("reply_to"):
+            lines.append(f"In reply to DM #{fields['reply_to']}")
+        return lines
+    if action == "message_edited":
+        return [
+            f"Direct message #{fields.get('dm_envelope_id')} edited",
+            f"Author: {_format_user(fields)}",
+        ]
+    if action == "message_deleted":
+        lines = [
+            f"Direct message #{fields.get('dm_envelope_id')} deleted",
+            f"Actor: {_format_user(fields)}",
+        ]
+        if fields.get("recipient_id") is not None:
+            lines.append(f"Recipient: user id {fields['recipient_id']}")
+        return lines
+    if action == "reaction_update":
+        lines = [
+            f"Reaction {fields.get('action', 'updated')} on DM #{fields.get('dm_envelope_id')}",
+            f"User: {_format_user(fields)}",
+        ]
+        if fields.get("emoji"):
+            lines.append(f"Emoji: {fields['emoji']}")
+        return lines
+    return [f"{action.replace('_', ' ').capitalize()}"] + [
+        f"{key.replace('_', ' ').capitalize()}: {value}"
+        for key, value in fields.items()
+        if value is not None
+    ]
+
+
+def _render_access(action: str, fields: Dict[str, Any]) -> List[str]:
+    ip_raw = fields.get("ip")
+    ip_display = "localhost" if ip_raw in {"127.0.0.1", "::1"} else ip_raw
+    if action == "http_request":
+        first_line = f"{fields.get('method')} {fields.get('path')}"
+        if ip_display:
+            first_line += f" from {ip_display}"
+        first_line += f" -> {fields.get('status')}"
+        lines = [first_line]
+        if fields.get("user"):
+            lines.append(f"Authenticated user: {_clean_username(fields['user'])}")
+        return lines
+    if action == "http_error":
+        first_line = f"HTTP error during {fields.get('method')} {fields.get('path')}"
+        if ip_display:
+            first_line += f" from {ip_display}"
+        lines = [first_line]
+        if fields.get("error"):
+            lines.append(f"Exception: {fields['error']}")
+        if fields.get("user"):
+            lines.append(f"Authenticated user: {_clean_username(fields['user'])}")
+        return lines
+    if action == "ws_connect":
+        lines = ["WebSocket connected"]
+        if fields.get("path"):
+            lines.append(f"Endpoint: {fields['path']}")
+        if ip_display:
+            lines.append(f"IP: {ip_display}")
+        return lines
+    if action == "ws_disconnect":
+        lines = ["WebSocket disconnected"]
+        if fields.get("path"):
+            lines.append(f"Endpoint: {fields['path']}")
+        if fields.get("code") is not None:
+            reason = fields.get("reason") or "no reason"
+            lines.append(f"Code {fields['code']} ({reason})")
+        if ip_display:
+            lines.append(f"IP: {ip_display}")
+        return lines
+    if action == "ws_event":
+        event_name = fields.get("event")
+        path = fields.get("path")
+        first_line = "WS"
+        if path:
+            first_line += f" {path}"
+        if ip_display:
+            first_line += f" from {ip_display}"
+        if event_name:
+            first_line += f" -> {event_name}"
+        lines = [first_line]
+        if fields.get("user"):
+            lines.append(f"Authenticated user: {_format_user(fields, 'user', 'user_id')}")
+        for key, value in fields.items():
+            if key in {"path", "event", "user", "user_id", "ip"} or value is None:
+                continue
+            lines.append(f"{key.replace('_', ' ').capitalize()}: {value}")
+        return lines
+    return [f"{action.replace('_', ' ').capitalize()}"] + [
+        f"{key.replace('_', ' ').capitalize()}: {value}"
+        for key, value in fields.items()
+        if value is not None
+    ]
+
+
+def _log_event(
+    logger: logging.Logger,
+    renderer: Callable[[str, Dict[str, Any]], List[str]],
+    action: str,
+    severity: str,
+    fields: Dict[str, Any],
+) -> None:
+    lines = renderer(action, fields)
+    if not lines:
+        return
+    level = getattr(logging, severity.upper(), logging.INFO)
+    logger.log(level, "\n".join(lines))
+
+
+def log_security(action: str, severity: str = "info", **fields: Any) -> None:
+    _log_event(security_logger, _render_security, action, severity, fields)
+
+
+def log_public_chat(action: str, severity: str = "info", **fields: Any) -> None:
+    _log_event(public_chat_logger, _render_public_chat, action, severity, fields)
+
+
+def log_dm(action: str, severity: str = "info", **fields: Any) -> None:
+    sanitized_fields = {key: value for key, value in fields.items() if key != "content"}
+    _log_event(dm_logger, _render_dm, action, severity, sanitized_fields)
+
+
+def log_access(action: str, severity: str = "info", **fields: Any) -> None:
+    _log_event(access_logger, _render_access, action, severity, fields)
+

backend/security/profanity.py

@@ -0,0 +1,694 @@
+from __future__ import annotations
+
+import json
+import re
+import unicodedata
+from pathlib import Path
+from threading import RLock
+from typing import Iterable, List, Set, Tuple
+
+from better_profanity import Profanity
+
+BLOCKLIST_PATH = Path("data/profanity/blocklist.json")
+BLOCKLIST_PATH.parent.mkdir(parents=True, exist_ok=True)
+
+_CUSTOM_RU_TERMS: Set[str] = {
+    "бляд", "блять", "бля", "сука", "суки", "сучка", "мразь", "ебан",
+    "ебать", "ебёт", "ебет", "ебаная", "ебаная", "уёбок", "уебок", "уебище", "пизда",
+    "пиздец", "хуй", "хуя", "хуе", "хуё", "хуйня", "хер", "гондон",
+    "долбоёб", "долбоеб", "дебил", "член", "проститутка", "проститутки",
+    "урод", "хуесос", "хуесосы", "хуесосов", "хуесоса", "сос", "пидор",
+    "пидоры", "пидорас", "пидорасы", "пидорасов",
+}
+
+_ADULT_TERMS: Set[str] = {
+    "порно", "порнуха", "эротика", "эротический", "секс", "сексуальный",
+    "инцест", "порнография", "порностудия", "порновидео", "порносайт",
+    "сексчат", "сексчатик", "секслайв", "сексвидео",
+}
+
+_STATIC_TERMS: Set[str] = set(term.lower() for term in (_CUSTOM_RU_TERMS | _ADULT_TERMS))
+
+# Words that should never be flagged as profanity (whitelist)
+_WHITELIST: Set[str] = {
+    "говно",  # Allow this word
+}
+
+# Phrase patterns - these will be applied to normalized text (without special chars)
+_PHRASE_PATTERNS: Tuple[re.Pattern[str], ...] = (
+    re.compile(r"\bmax\s+is\s+better\b", re.IGNORECASE | re.UNICODE),
+    re.compile(r"\bмакс\s+лучше\b", re.IGNORECASE | re.UNICODE),
+    re.compile(r"\bfromchat\s+г[ао]вно\b", re.IGNORECASE | re.UNICODE),
+    re.compile(r"\bфромчат\s+г[ао]вно\b", re.IGNORECASE | re.UNICODE),
+    re.compile(r"\b18\+\b", re.IGNORECASE | re.UNICODE),
+    re.compile(r"\bxxx\b", re.IGNORECASE | re.UNICODE),
+    re.compile(r"\bайфон\s+топ\b", re.IGNORECASE | re.UNICODE),
+    re.compile(r"\bсамсунг\s+г[ао]вно\b", re.IGNORECASE | re.UNICODE),
+)
+
+# Patterns to check in original text (before normalization) to catch visual bypasses
+# These patterns check for special character combinations that visually form letters
+_ORIGINAL_TEXT_PATTERNS: Tuple[re.Pattern[str], ...] = (
+    # Catch "}{" used to visually form "х" followed by "С0С" or similar patterns
+    # This catches "хуесос" written as "}{¥€С0С" or variations
+    # Matches: }{ + any characters (including special chars) + С/с + 0 + С/с
+    # The pattern allows any characters between to catch special chars like ¥€
+    re.compile(r"}\{.*?[сcСC].*?[0оoОO].*?[сcСC]", re.IGNORECASE | re.UNICODE),
+    # Also catch "}{" followed by "уесос" with 0 instead of о
+    re.compile(r"}\{.*?[уyУY].*?[еeЕE].*?[сcСC].*?[0оoОO].*?[сcСC]", re.IGNORECASE | re.UNICODE),
+)
+
+# Map for normalizing homoglyphs (similar-looking characters)
+# Maps English/Latin characters to their Cyrillic equivalents and vice versa
+# Also includes Greek, full-width, and other Unicode variants
+_LEET_MAP = {
+    # Numbers to letters
+    "0": "о",
+    "1": "и",
+    "3": "е",
+    "4": "а",
+    # Latin to Cyrillic (lowercase)
+    "a": "а",
+    "c": "с",
+    "e": "е",
+    "f": "ф",
+    "g": "г",
+    "i": "и",
+    "m": "м",
+    "n": "н",
+    "o": "о",
+    "p": "п",
+    "s": "с",
+    "t": "т",
+    "u": "у",
+    "v": "в",
+    "x": "х",
+    "y": "у",
+    "z": "з",  # English 'z' to Cyrillic 'з'
+    # Latin to Cyrillic (uppercase)
+    "A": "а",
+    "C": "с",
+    "E": "е",
+    "F": "ф",
+    "G": "г",
+    "I": "и",
+    "M": "м",
+    "N": "н",
+    "O": "о",
+    "P": "п",
+    "S": "с",
+    "T": "т",
+    "U": "у",
+    "V": "в",
+    "X": "х",
+    "Y": "у",
+    "Z": "з",  # English 'Z' to Cyrillic 'з'
+    # Greek letters that look like Cyrillic/Latin
+    "α": "а",  # Greek alpha
+    "Α": "а",
+    "ο": "о",  # Greek omicron
+    "Ο": "о",
+    "ρ": "р",  # Greek rho (looks like Cyrillic р)
+    "Ρ": "р",
+    "υ": "у",  # Greek upsilon
+    "Υ": "у",
+    "χ": "х",  # Greek chi
+    "Χ": "х",
+    "ε": "е",  # Greek epsilon
+    "Ε": "е",
+    "ι": "и",  # Greek iota
+    "Ι": "и",
+    "ν": "н",  # Greek nu
+    "Ν": "н",
+    "μ": "м",  # Greek mu
+    "Μ": "м",
+    "π": "п",  # Greek pi
+    "Π": "п",
+    "τ": "т",  # Greek tau
+    "Τ": "т",
+    "γ": "г",  # Greek gamma
+    "Γ": "г",
+    "σ": "с",  # Greek sigma
+    "Σ": "с",
+    "φ": "ф",  # Greek phi
+    "Φ": "ф",
+    # Full-width Latin characters
+    "ａ": "а",
+    "Ａ": "а",
+    "ｃ": "с",
+    "Ｃ": "с",
+    "ｅ": "е",
+    "Ｅ": "е",
+    "ｆ": "ф",
+    "Ｆ": "ф",
+    "ｇ": "г",
+    "Ｇ": "г",
+    "ｉ": "и",
+    "Ｉ": "и",
+    "ｍ": "м",
+    "Ｍ": "м",
+    "ｎ": "н",
+    "Ｎ": "н",
+    "ｏ": "о",
+    "Ｏ": "о",
+    "ｐ": "п",
+    "Ｐ": "п",
+    "ｓ": "с",
+    "Ｓ": "с",
+    "ｔ": "т",
+    "Ｔ": "т",
+    "ｕ": "у",
+    "Ｕ": "у",
+    "ｖ": "в",
+    "Ｖ": "в",
+    "ｘ": "х",
+    "Ｘ": "х",
+    "ｙ": "у",
+    "Ｙ": "у",
+    "ｚ": "з",  # Full-width 'z' to Cyrillic 'з'
+    "Ｚ": "з",
+    # Cyrillic to canonical Cyrillic (identity mappings)
+    "а": "а",
+    "с": "с",
+    "е": "е",
+    "ё": "е",
+    "ф": "ф",
+    "г": "г",
+    "и": "и",
+    "м": "м",
+    "н": "н",
+    "о": "о",
+    "п": "п",
+    "т": "т",
+    "у": "у",
+    "ү": "у",  # Cyrillic capital U (U+04AE)
+    "Ү": "у",  # Cyrillic capital U (U+04AE)
+    "в": "в",
+    "х": "х",
+    "р": "р",
+    "з": "з",  # Cyrillic 'з'
+    "д": "д",  # Cyrillic 'д'
+    "б": "б",  # Cyrillic 'б'
+    "л": "л",  # Cyrillic 'л'
+    "я": "я",  # Cyrillic 'я'
+    "н": "н",  # Already mapped, but explicit
+    # Special characters
+    "@": "а",
+    # Multi-character visual bypasses (handled separately in preprocessing)
+    # "}{" visually forms "х" - handled in _preprocess_visual_bypasses
+}
+
+_RAW_PHRASE_GROUPS: Tuple[Tuple[str, Tuple[str, ...]], ...] = (
+    ("generic", ("айфон", "топ")),
+    ("generic", ("самсунг", "говно")),
+)
+
+_SENSITIVE_PHRASE_PATH = Path("data/profanity/sensitive_phrases.json")
+_PHRASE_CACHE: dict[str, Tuple[Tuple[str, ...], ...]] = {}
+
+
+def _preprocess_visual_bypasses(text: str) -> str:
+    """
+    Preprocess text to convert multi-character visual bypasses to their intended letters.
+    This handles cases like "}{" visually forming "х".
+    """
+    result = text
+    # Convert "}{" to "х" (visual bypass for Cyrillic х)
+    # The curly braces visually form the letter х when placed together
+    result = result.replace("}{", "х")
+    return result
+
+
+def _normalize_char(ch: str) -> str:
+    """Normalize a single character, mapping homoglyphs to canonical form."""
+    # First try direct mapping (preserves case for non-mapped chars)
+    if ch in _LEET_MAP:
+        return _LEET_MAP[ch]
+    # Then try lowercase mapping
+    lower = ch.lower()
+    if lower in _LEET_MAP:
+        return _LEET_MAP[lower]
+    # If no mapping and character is ASCII letter, return lowercase
+    # This preserves English words like "fromchat" as-is
+    if ch.isascii() and ch.isalpha():
+        return lower
+    # For other characters, return lowercase for consistency
+    return lower
+
+
+def _normalize_token(token: str) -> str:
+    """Normalize a token by mapping all homoglyphs."""
+    return "".join(_normalize_char(ch) for ch in token)
+
+
+def _normalize_text_for_profanity(text: str) -> str:
+    """
+    Normalize entire text by mapping homoglyphs to canonical forms.
+    This prevents bypasses like using English 'u' instead of Russian 'у'.
+    """
+    return "".join(_normalize_char(ch) for ch in text)
+
+
+def _strip_zero_width_chars(text: str) -> str:
+    """
+    Remove zero-width characters that could be used to bypass filters.
+    """
+    # Zero-width space, zero-width non-joiner, zero-width joiner, etc.
+    zero_width_chars = [
+        '\u200B',  # Zero-width space
+        '\u200C',  # Zero-width non-joiner
+        '\u200D',  # Zero-width joiner
+        '\uFEFF',  # Zero-width no-break space
+        '\u2060',  # Word joiner
+        '\u2061',  # Function application
+        '\u2062',  # Invisible times
+        '\u2063',  # Invisible separator
+        '\u2064',  # Invisible plus
+    ]
+    result = text
+    for zw_char in zero_width_chars:
+        result = result.replace(zw_char, '')
+    return result
+
+
+def _extract_alphanumeric_with_mapping(text: str, preserve_spaces: bool = False) -> tuple[str, list[int]]:
+    """
+    Extract only alphanumeric characters from text and create a mapping
+    from normalized positions to original positions.
+    
+    Args:
+        preserve_spaces: If True, preserve spaces in the normalized text (for phrase matching)
+    
+    Returns:
+        (normalized_text, position_map) where position_map[i] is the original
+        position of the i-th character in normalized_text
+    """
+    # First preprocess visual bypasses (like "}{" -> "х")
+    text = _preprocess_visual_bypasses(text)
+    
+    # Then normalize Unicode (composed vs decomposed)
+    normalized_unicode = unicodedata.normalize('NFKC', text)
+    
+    # For phrase matching, convert zero-width chars to spaces instead of stripping
+    if preserve_spaces:
+        zero_width_chars = ['\u200B', '\u200C', '\u200D', '\uFEFF', '\u2060', '\u2061', '\u2062', '\u2063', '\u2064']
+        for zw_char in zero_width_chars:
+            normalized_unicode = normalized_unicode.replace(zw_char, ' ')
+    else:
+        # Strip zero-width characters
+        normalized_unicode = _strip_zero_width_chars(normalized_unicode)
+    
+    normalized = []
+    position_map = []
+    
+    for i, ch in enumerate(normalized_unicode):
+        # Check if character is alphanumeric (including Cyrillic)
+        if ch.isalnum():
+            # For phrase matching, preserve ASCII letters as-is (just lowercase)
+            # to allow English words in patterns to match
+            if preserve_spaces and ch.isascii() and ch.isalpha():
+                normalized.append(ch.lower())
+            else:
+                # Normalize this character (homoglyphs, Cyrillic, etc.)
+                normalized.append(_normalize_char(ch))
+            position_map.append(i)
+        elif preserve_spaces:
+            # For phrase matching, treat any whitespace or non-alphanumeric as word separator
+            if ch.isspace() or not ch.isalnum():
+                # Normalize to single space to allow patterns to match
+                if normalized and normalized[-1] != ' ':  # Don't add consecutive spaces
+                    normalized.append(' ')
+                    position_map.append(i)
+    
+    return "".join(normalized), position_map
+
+
+def _check_profanity_substrings(normalized_text: str, profane_words: Set[str]) -> list[tuple[int, int]]:
+    """
+    Check for profane words as substrings or subsequences in normalized text.
+    This catches cases like "хуй" in "хууй" (with extra characters).
+    Returns list of (start, end) positions where profanity is found.
+    """
+    spans = []
+    normalized_lower = normalized_text.lower()
+    
+    for word in profane_words:
+        word_lower = word.lower()
+        
+        # First try exact substring match
+        start = 0
+        while True:
+            pos = normalized_lower.find(word_lower, start)
+            if pos == -1:
+                break
+            spans.append((pos, pos + len(word_lower)))
+            start = pos + 1
+        
+        # Also check if profane word appears as a subsequence (allowing extra chars)
+        # This catches cases like "хуй" in "хууй" or "х}{¥€уй" -> "хууй"
+        # Now applies to ALL words, not just length >= 4, to prevent bypasses
+        word_chars = list(word_lower)
+        text_chars = list(normalized_lower)
+        
+        # Stricter span limits based on word length to prevent false positives
+        # Shorter words get much stricter limits
+        if len(word_lower) <= 3:
+            max_span_ratio = 1.3  # Very strict for 3-char words (e.g., "хуй")
+        elif len(word_lower) == 4:
+            max_span_ratio = 1.4  # Strict for 4-char words
+        elif len(word_lower) <= 5:
+            max_span_ratio = 1.5  # Moderate for 5-char words
+        else:
+            max_span_ratio = 1.8  # Slightly more lenient for longer words
+        
+        # Try to find the word as a subsequence
+        i = 0  # position in text
+        j = 0  # position in word
+        seq_start = None
+        
+        while i < len(text_chars) and j < len(word_chars):
+            if text_chars[i] == word_chars[j]:
+                if seq_start is None:
+                    seq_start = i
+                j += 1
+                if j == len(word_chars):
+                    # Found the word as subsequence
+                    seq_end = i + 1
+                    # Check if the span is reasonable (not too long)
+                    span_length = seq_end - seq_start
+                    max_allowed_span = int(len(word_lower) * max_span_ratio)
+                    if span_length <= max_allowed_span:
+                        # Only add if it's not already covered by exact match
+                        if (seq_start, seq_end) not in spans:
+                            spans.append((seq_start, seq_end))
+                    # Reset to find next occurrence - continue from after the end of this match
+                    next_start = seq_start + 1
+                    seq_start = None
+                    j = 0
+                    i = next_start
+                    continue
+            i += 1
+    
+    return spans
+
+
+def _check_profanity_in_normalized(normalized_text: str) -> bool:
+    """
+    Check if normalized text contains profanity.
+    Uses both better_profanity library and substring matching for better detection.
+    
+    Returns True if profanity is found.
+    """
+    if not normalized_text:
+        return False
+    
+    # Check normalized text for profanity using better_profanity
+    censored = _profanity.censor(normalized_text, censor_char="\\*")
+    
+    # Check if better_profanity found anything
+    if "*" in censored:
+        return True
+    
+    # Also check for profane words as substrings (to catch cases like "хуй" in "хууй" or "хуйня")
+    profane_words = _STATIC_TERMS
+    substring_spans = _check_profanity_substrings(normalized_text, profane_words)
+    
+    # If we found any substring matches, there's profanity
+    if substring_spans:
+        return True
+    
+    return False
+
+
+def _tokenize_with_spans(text: str) -> List[Tuple[int, int, str]]:
+    tokens: List[Tuple[int, int, str]] = []
+    start: int | None = None
+    buffer: List[str] = []
+
+    for idx, ch in enumerate(text):
+        if ch.isalnum() or ch in {"@", "#", "_"}:
+            if start is None:
+                start = idx
+            buffer.append(ch)
+        else:
+            if buffer and start is not None:
+                token_raw = "".join(buffer)
+                tokens.append((start, idx, _normalize_token(token_raw)))
+                buffer.clear()
+                start = None
+    if buffer and start is not None:
+        token_raw = "".join(buffer)
+        tokens.append((start, len(text), _normalize_token(token_raw)))
+    return tokens
+
+
+def _edit_distance_limited(a: str, b: str, max_distance: int = 1) -> bool:
+    if a == b:
+        return True
+    if max_distance <= 0:
+        return False
+    if abs(len(a) - len(b)) > max_distance:
+        return False
+
+    previous = list(range(len(b) + 1))
+    for i, ca in enumerate(a, 1):
+        current = [i]
+        best = current[0]
+        for j, cb in enumerate(b, 1):
+            insert_cost = current[j - 1] + 1
+            delete_cost = previous[j] + 1
+            replace_cost = previous[j - 1] + (0 if ca == cb else 1)
+            cost = min(insert_cost, delete_cost, replace_cost)
+            current.append(cost)
+            if cost < best:
+                best = cost
+        if best > max_distance:
+            return False
+        previous = current
+    return previous[-1] <= max_distance
+
+
+def _load_sensitive_phrases() -> List[Tuple[str, ...]]:
+    if not _SENSITIVE_PHRASE_PATH.exists():
+        return []
+    try:
+        payload = json.loads(_SENSITIVE_PHRASE_PATH.read_text(encoding="utf-8"))
+        phrases: List[Tuple[str, ...]] = []
+        if isinstance(payload, list):
+            for entry in payload:
+                if isinstance(entry, list) and entry:
+                    normalized = tuple(str(part).strip() for part in entry if str(part).strip())
+                    if normalized:
+                        phrases.append(normalized)
+        return phrases
+    except Exception:
+        return []
+
+
+def _get_phrases(group: str) -> Tuple[Tuple[str, ...], ...]:
+    if group not in _PHRASE_CACHE:
+        base = [phrase for key, phrase in _RAW_PHRASE_GROUPS if key == group]
+        if group == "sensitive":
+            base.extend(_load_sensitive_phrases())
+        _PHRASE_CACHE[group] = tuple(
+            tuple(_normalize_token(part) for part in phrase)
+            for phrase in base
+        )
+    return _PHRASE_CACHE[group]
+
+
+def _find_fuzzy_phrase_spans(text: str, group: str = "generic") -> List[Tuple[int, int]]:
+    tokens = _tokenize_with_spans(text)
+    if not tokens:
+        return []
+
+    spans: List[Tuple[int, int]] = []
+    normalized_phrases = _get_phrases(group)
+
+    for index in range(len(tokens)):
+        for phrase in normalized_phrases:
+            if index + len(phrase) > len(tokens):
+                continue
+            matches = True
+            for offset, target in enumerate(phrase):
+                token = tokens[index + offset][2]
+                if not _edit_distance_limited(token, target):
+                    matches = False
+                    break
+            if matches:
+                span_start = tokens[index][0]
+                span_end = tokens[index + len(phrase) - 1][1]
+                spans.append((span_start, span_end))
+    return spans
+
+_dictionary_lock = RLock()
+_blocklist_signature: Tuple[str, ...] | None = None
+_profanity = Profanity()
+
+
+def _normalize_words(words: Iterable[str]) -> Set[str]:
+    normalized: Set[str] = set()
+    for raw in words:
+        if not raw:
+            continue
+        cleaned = re.sub(r"\s+", " ", str(raw)).strip().lower()
+        if cleaned:
+            normalized.add(cleaned)
+    return normalized
+
+
+def _load_blocklist() -> Set[str]:
+    if not BLOCKLIST_PATH.exists():
+        return set()
+    try:
+        data = json.loads(BLOCKLIST_PATH.read_text(encoding="utf-8"))
+        if isinstance(data, list):
+            return _normalize_words(data)
+    except Exception:
+        pass
+    return set()
+
+
+def _write_blocklist(words: Iterable[str]) -> None:
+    BLOCKLIST_PATH.write_text(
+        json.dumps(sorted(words), ensure_ascii=False, indent=2) + "\n",
+        encoding="utf-8"
+    )
+
+
+def _rebuild_dictionary(force: bool = False) -> None:
+    global _profanity, _blocklist_signature
+    with _dictionary_lock:
+        blocklist_list = sorted(_load_blocklist())
+        signature = tuple(blocklist_list)
+        if not force and _blocklist_signature == signature and _blocklist_signature is not None:
+            return
+
+        profanity = Profanity()
+        profanity.load_censor_words()
+        # Remove whitelisted words from the default word list
+        try:
+            for word in _WHITELIST:
+                profanity.remove_censor_words([word])
+        except AttributeError:
+            # If remove_censor_words doesn't exist, we'll handle it in post-processing
+            pass
+        combined = set(_STATIC_TERMS)
+        combined.update(blocklist_list)
+        # Remove whitelisted words from our custom terms
+        combined -= _WHITELIST
+        if combined:
+            profanity.add_censor_words(list(combined))
+
+        _profanity = profanity
+        _blocklist_signature = signature
+
+
+def _check_phrase_patterns(text: str) -> bool:
+    """
+    Check if text matches any phrase patterns.
+    Returns True if any pattern matches.
+    """
+    # Normalize text for phrase matching (remove special chars but preserve spaces)
+    normalized_text, _ = _extract_alphanumeric_with_mapping(text, preserve_spaces=True)
+    normalized_lower = normalized_text.lower()
+    
+    # Check phrase patterns
+    for pattern in _PHRASE_PATTERNS:
+        if pattern.search(normalized_lower):
+            return True
+    
+    # Check fuzzy phrase spans
+    if _find_fuzzy_phrase_spans(normalized_lower, "generic"):
+        return True
+    
+    return False
+
+
+def contains_profanity(text: str) -> bool:
+    """
+    Check if text contains profanity.
+    Returns True if profanity is detected.
+    """
+    if not text:
+        return False
+
+    _rebuild_dictionary()
+    
+    # Check original text patterns first (before normalization) to catch visual bypasses
+    # like "}{" used to form "х"
+    for pattern in _ORIGINAL_TEXT_PATTERNS:
+        if pattern.search(text):
+            return True
+    
+    # Check phrase patterns
+    if _check_phrase_patterns(text):
+        return True
+    
+    # Normalize text for whitelist matching (to handle special characters)
+    normalized_for_whitelist, _ = _extract_alphanumeric_with_mapping(text)
+    normalized_for_whitelist_lower = normalized_for_whitelist.lower()
+    
+    # Check if text contains whitelisted words - if the entire text is a whitelisted word, skip profanity check
+    for whitelist_word in _WHITELIST:
+        normalized_whitelist, _ = _extract_alphanumeric_with_mapping(whitelist_word)
+        normalized_whitelist_lower = normalized_whitelist.lower()
+        
+        # Check if the normalized text exactly matches a whitelisted word
+        if normalized_for_whitelist_lower == normalized_whitelist_lower:
+            return False
+    
+    # Extract only alphanumeric characters and normalize homoglyphs
+    # This removes special characters, emojis, etc. that could be used to bypass the filter
+    normalized_text, _ = _extract_alphanumeric_with_mapping(text)
+    
+    # Check profanity on normalized text (without special characters)
+    return _check_profanity_in_normalized(normalized_text)
+
+
+def contains_sensitive_phrase(text: str) -> bool:
+    if not text:
+        return False
+    if _find_fuzzy_phrase_spans(text, "sensitive"):
+        return True
+    return False
+
+
+def get_blocklist() -> List[str]:
+    with _dictionary_lock:
+        return sorted(_load_blocklist())
+
+
+def add_to_blocklist(words: Iterable[str]) -> Tuple[List[str], List[str]]:
+    normalized = _normalize_words(words)
+    if not normalized:
+        return [], get_blocklist()
+
+    with _dictionary_lock:
+        current = _load_blocklist()
+        added = sorted(normalized - current)
+        if not added:
+            return [], sorted(current)
+
+        updated = sorted(current | normalized)
+        _write_blocklist(updated)
+        _rebuild_dictionary(force=True)
+        return added, updated
+
+
+def remove_from_blocklist(words: Iterable[str]) -> Tuple[List[str], List[str]]:
+    normalized = _normalize_words(words)
+    if not normalized:
+        return [], get_blocklist()
+
+    with _dictionary_lock:
+        current = _load_blocklist()
+        removed = sorted(word for word in normalized if word in current)
+        if not removed:
+            return [], sorted(current)
+
+        updated = sorted(current - normalized)
+        _write_blocklist(updated)
+        _rebuild_dictionary(force=True)
+        return removed, updated
+

backend/security/rate_limit.py

@@ -0,0 +1,232 @@
+from __future__ import annotations
+
+import asyncio
+import logging
+import time
+from typing import Callable
+from fastapi import Request
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+from utils import get_client_ip
+
+logger = logging.getLogger("uvicorn.error")
+
+def get_ip_key(request: Request) -> str:
+    """Get rate limit key based on IP address."""
+    return get_client_ip(request) or get_remote_address(request)
+
+# Initialize limiter with IP-based key function
+# Note: We don't set default_limits to avoid affecting all users if one IP is attacked.
+# Each endpoint should have an explicit rate limit based on its sensitivity.
+# Rate limits automatically expire after the time window - IPs are not permanently blocked.
+limiter = Limiter(
+    key_func=get_ip_key,
+    default_limits=[],  # No global default - each endpoint must have explicit limits
+    storage_uri="memory://",  # In-memory storage (can be changed to Redis later)
+)
+
+
+# Rate limit decorator for IP-based limiting
+def rate_limit_per_ip(limit: str) -> Callable:
+    """Rate limit based on IP address."""
+    return limiter.limit(limit, key_func=get_ip_key)
+
+
+def _get_storage_dict(storage) -> dict | None:
+    """Get the internal storage dictionary from slowapi's memory storage."""
+    if hasattr(storage, "_storage") and isinstance(storage._storage, dict):
+        return storage._storage
+    elif hasattr(storage, "storage") and isinstance(storage.storage, dict):
+        return storage.storage
+    return None
+
+
+def reset_all_rate_limits() -> int:
+    """
+    Reset all rate limits by clearing the storage.
+    This should be called on startup to ensure a clean state.
+    Returns the number of entries cleared.
+    """
+    try:
+        # Access the private _storage attribute
+        storage = limiter._storage
+        storage_dict = _get_storage_dict(storage)
+        
+        if storage_dict is None:
+            # Try using the storage's reset method if available
+            if hasattr(storage, "reset"):
+                try:
+                    # Try reset() with no args first (clears all)
+                    storage.reset()
+                    logger.info("Reset all rate limits on startup using storage.reset()")
+                    return 1  # Assume it worked
+                except TypeError:
+                    # reset() might require arguments, try clearing differently
+                    try:
+                        # Some storage backends need explicit clearing
+                        if hasattr(storage, "clear"):
+                            storage.clear()
+                            logger.info("Reset all rate limits on startup using storage.clear()")
+                            return 1
+                    except Exception:
+                        pass
+                except Exception:
+                    pass
+            logger.warning("Could not reset rate limits: storage dict not accessible and no reset method")
+            return 0
+        
+        count = len(storage_dict)
+        if count > 0:
+            storage_dict.clear()
+            logger.info(f"Reset all rate limits on startup: cleared {count} entries")
+        return count
+    except Exception as e:
+        logger.warning(f"Failed to reset rate limits on startup: {e}")
+        return 0
+
+
+def reset_rate_limit_for_ip(ip: str) -> bool:
+    """
+    Manually reset rate limit for a specific IP address.
+    This clears all rate limit entries for the given IP.
+    Returns True if any entries were cleared, False otherwise.
+    """
+    if not ip:
+        return False
+    
+    try:
+        # Access the private _storage attribute
+        storage = limiter._storage
+        storage_dict = _get_storage_dict(storage)
+        
+        if storage_dict is None:
+            # Try alternative methods
+            if hasattr(storage, "reset"):
+                try:
+                    storage.reset(ip)
+                    return True
+                except Exception:
+                    pass
+            return False
+        
+        cleared = False
+        # slowapi stores entries with keys like "LIMITER:{ip}:{endpoint}"
+        # We need to find all keys that contain this IP
+        # Also handle cases where IP might be in different positions
+        keys_to_remove = []
+        
+        for key in list(storage_dict.keys()):
+            if isinstance(key, str):
+                # Check multiple patterns:
+                # - "LIMITER:{ip}:{endpoint}"
+                # - Keys containing the IP anywhere
+                # - Keys starting with the IP
+                if (key.startswith(f"LIMITER:{ip}:") or 
+                    key.startswith(f"LIMITER:{ip}") or
+                    f":{ip}:" in key or
+                    key.endswith(f":{ip}") or
+                    (ip in key and "LIMITER" in key)):
+                    keys_to_remove.append(key)
+        
+        for key in keys_to_remove:
+            try:
+                del storage_dict[key]
+                cleared = True
+                logger.info(f"Cleared rate limit key: {key}")
+            except KeyError:
+                pass
+        
+        if cleared:
+            logger.info(f"Successfully cleared rate limits for IP: {ip}")
+        else:
+            logger.warning(f"No rate limit entries found for IP: {ip}")
+        
+        return cleared
+    except Exception as e:
+        logger.warning(f"Failed to reset rate limit for IP {ip}: {e}")
+        return False
+
+
+def clear_all_rate_limits() -> int:
+    """
+    Clear all rate limit entries. Use with caution - this affects all IPs.
+    Returns the number of entries cleared.
+    """
+    try:
+        # Access the private _storage attribute
+        storage = limiter._storage
+        storage_dict = _get_storage_dict(storage)
+        
+        if storage_dict is None:
+            return 0
+        
+        count = len(storage_dict)
+        storage_dict.clear()
+        logger.warning(f"Cleared all {count} rate limit entries")
+        return count
+    except Exception as e:
+        logger.error(f"Failed to clear all rate limits: {e}")
+        return 0
+
+
+def cleanup_expired_rate_limits() -> int:
+    """
+    Clean up expired rate limit entries from memory storage.
+    This helps prevent rate limits from being stuck indefinitely.
+    Returns the number of entries cleaned up.
+    """
+    try:
+        # Access the private _storage attribute
+        storage = limiter._storage
+        storage_dict = _get_storage_dict(storage)
+        
+        if storage_dict is None:
+            return 0
+        
+        # slowapi's memory storage stores entries as tuples: (count, reset_time)
+        # Entries should expire naturally, but we'll clean up any that are clearly expired
+        now = time.time()
+        cleaned = 0
+        keys_to_remove = []
+        
+        for key, value in storage_dict.items():
+            if isinstance(value, (tuple, list)) and len(value) >= 2:
+                # Check if reset_time has passed (with some buffer)
+                reset_time = value[1] if isinstance(value[1], (int, float)) else 0
+                # Add 60 second buffer to ensure we don't remove active entries
+                if reset_time > 0 and now > (reset_time + 60):
+                    keys_to_remove.append(key)
+            elif isinstance(value, dict):
+                # Some storage formats use dicts with 'expiry' or 'reset' fields
+                expiry = value.get("expiry") or value.get("reset") or value.get("reset_time")
+                if expiry and isinstance(expiry, (int, float)) and now > (expiry + 60):
+                    keys_to_remove.append(key)
+        
+        for key in keys_to_remove:
+            try:
+                del storage_dict[key]
+                cleaned += 1
+            except KeyError:
+                pass
+        
+        if cleaned > 0:
+            logger.info(f"Cleaned up {cleaned} expired rate limit entries")
+        
+        return cleaned
+    except Exception as e:
+        logger.warning(f"Failed to cleanup expired rate limits: {e}")
+        return 0
+
+
+async def start_rate_limit_cleanup_task() -> None:
+    """Start a background task to periodically clean up expired rate limit entries."""
+    while True:
+        try:
+            await asyncio.sleep(300)  # Run every 5 minutes
+            cleanup_expired_rate_limits()
+        except asyncio.CancelledError:
+            break
+        except Exception as e:
+            logger.error(f"Error in rate limit cleanup task: {e}")
+            await asyncio.sleep(60)  # Wait 1 minute before retrying

backend/utils.py

@@ -1,18 +1,20 @@
 from datetime import datetime, timedelta
+from fastapi import Request
 import jwt
-from typing import Optional
+from typing import Optional, Any
 import bcrypt
 
-from constants import *
+from constants import MAX_TOKEN_LIFETIME_HOURS, JWT_SECRET_KEY, JWT_ALGORITHM
 
 # JWT Helper Functions
 def create_token(user_id: int, username: str, session_id: str) -> str:
-    expire = datetime.now() + timedelta(hours=ACCESS_TOKEN_EXPIRE_HOURS)
+    # Set a long expiration as safety net (actual expiration based on inactivity)
+    expire = datetime.now() + timedelta(hours=MAX_TOKEN_LIFETIME_HOURS)
     payload = {
         "user_id": user_id,
         "username": username,
         "session_id": session_id,
-        "exp": expire
+        "exp": int(expire.timestamp())  # JWT exp must be Unix timestamp (int)
     }
     return jwt.encode(payload, JWT_SECRET_KEY, algorithm=JWT_ALGORITHM)
 
@@ -31,4 +33,39 @@ def verify_password(plain_password: str, hashed_password: str) -> bool:
     return bcrypt.checkpw(plain_password.encode("utf-8"), hashed_password.encode("utf-8"))
 
 def get_password_hash(password: str) -> str:
-    return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
+    return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
+
+
+def get_client_ip(request: Request) -> Optional[str]:
+    if not request:
+        return None
+
+    headers = request.headers
+    
+    # First, check x-real-ip header (set by some proxies, or configured in Caddy)
+    real_ip = headers.get("x-real-ip") or headers.get("X-Real-IP")
+    if real_ip:
+        candidate = real_ip.strip()
+        if candidate:
+            return candidate
+    
+    # Fall back to x-forwarded-for header (Caddy sets this automatically)
+    forwarded = headers.get("x-forwarded-for") or headers.get("X-Forwarded-For")
+    if forwarded:
+        # X-Forwarded-For can contain multiple IPs: "client, proxy1, proxy2"
+        # Take the first one (original client IP)
+        candidate = forwarded.split(",")[0].strip()
+        if candidate:
+            return candidate
+
+    # Fall back to direct client connection (when not behind a proxy)
+    if request.client and request.client.host:
+        return request.client.host
+
+    # Last resort: check scope
+    if isinstance(request.scope, dict):
+        client_info = request.scope.get("client")
+        if isinstance(client_info, (list, tuple)) and client_info:
+            return client_info[0]
+
+    return None

backend/websocket/__init__.py

@@ -0,0 +1,7 @@
+from websocket.registry import WebSocketHandlerRegistry
+
+# Note: handler_registry and websocket_handler are not imported here to avoid circular dependency
+# Import them directly from websocket.handlers when needed
+
+__all__ = ["WebSocketHandlerRegistry"]
+

backend/websocket/handlers.py

@@ -0,0 +1,570 @@
+from datetime import datetime
+import json
+import logging
+import time
+from typing import Any
+from fastapi import HTTPException, WebSocket, Request
+from sqlalchemy.orm import Session
+
+from websocket.registry import WebSocketHandlerRegistry
+from routes.messaging import (
+    MessaggingSocketManager,
+    _send_message_internal,
+    _edit_message_internal,
+    get_messages,
+    edit_message,
+    delete_message,
+    add_reaction,
+    add_dm_reaction,
+)
+from models import (
+    User,
+    SendMessageRequest,
+    EditMessageRequest,
+    DMEnvelope,
+    ReactionRequest,
+    DMReactionRequest,
+    UpdateLog,
+)
+from security.audit import log_access, log_dm
+
+logger = logging.getLogger("uvicorn.error")
+
+# Create global registry instance
+handler_registry = WebSocketHandlerRegistry()
+
+# Create decorator alias
+websocket_handler = handler_registry.register
+
+
+def log(manager: MessaggingSocketManager, websocket: WebSocket, user: User | None, event: str, **extra: Any) -> None:
+    """Log WebSocket event."""
+    ws_path = getattr(getattr(websocket, "url", None), "path", None)
+    if not ws_path and isinstance(getattr(websocket, "scope", None), dict):
+        ws_path = websocket.scope.get("path")
+    ws_path = ws_path or "unknown"
+    headers = {}
+    if isinstance(getattr(websocket, "scope", None), dict):
+        headers = {k.decode("latin1"): v.decode("latin1") for k, v in websocket.scope.get("headers", [])}
+    xff = headers.get("x-forwarded-for")
+    client_ip = xff.split(",")[0].strip() if xff else (websocket.client.host if websocket.client else None)
+    
+    log_access(
+        "ws_event",
+        path=ws_path,
+        event=event,
+        user=user.username if user else None,
+        user_id=user.id if user else None,
+        ip=client_ip,
+        **extra,
+    )
+
+
+@websocket_handler("getUpdates", authRequired=True)
+async def getUpdates(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Handle gap detection - client requests updates from a specific sequence number."""
+    last_seq = data.get("lastSeq", 0)
+    manager.last_seq_by_ws[websocket] = last_seq
+    current_seq = manager.sequence_numbers.get(user.id, 0)
+    
+    # Query database for missed updates
+    missed_updates = []
+    if last_seq > 0 and last_seq < current_seq:
+        try:
+            # Get all updates between last_seq and current_seq
+            update_logs = db.query(UpdateLog).filter(
+                UpdateLog.user_id == user.id,
+                UpdateLog.sequence > last_seq,
+                UpdateLog.sequence <= current_seq
+            ).order_by(UpdateLog.sequence.asc()).all()
+            
+            # Each log entry contains a batch of updates with the same sequence number
+            for log_entry in update_logs:
+                updates = json.loads(log_entry.updates)
+                missed_updates.append({
+                    "seq": log_entry.sequence,
+                    "updates": updates
+                })
+        except Exception as e:
+            logger.error(f"Failed to retrieve missed updates: {e}")
+    
+    # Send missed updates directly (not through return value)
+    for batch in missed_updates:
+        await websocket.send_json({
+            "type": "updates",
+            "seq": batch["seq"],
+            "updates": batch["updates"]
+        })
+    
+    # Update the websocket's last sequence tracking
+    manager.last_seq_by_ws[websocket] = current_seq
+    log(manager, websocket, user, "getUpdates", last_seq=last_seq, current_seq=current_seq, missed_count=len(missed_updates))
+    
+    return {
+        "status": "ok",
+        "lastSeq": current_seq,
+        "missedCount": len(missed_updates)
+    }
+
+
+@websocket_handler("ping", authRequired=True)
+async def ping(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Handle ping - authenticate and set user online."""
+    # Set user online in DB
+    user.online = True
+    user.last_seen = datetime.now()
+    db.commit()
+    # Add to online users
+    manager.online_users.add(user.id)
+    # Broadcast status change
+    await manager.broadcast_status_change(user.id, True, user.last_seen.isoformat(), db)
+    
+    log(manager, websocket, user, "ping")
+    return {"status": "success"}
+
+
+@websocket_handler("getMessages", authRequired=True)
+async def getMessages(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Get all public chat messages."""
+    result = await get_messages(user, db)
+    log(manager, websocket, user, "getMessages")
+    return result
+
+
+@websocket_handler("sendMessage", authRequired=True)
+async def sendMessage(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Send a public chat message."""
+    message_request: SendMessageRequest = SendMessageRequest.model_validate(data)
+    
+    # Call internal function directly (rate limiting is handled at infrastructure level via Caddy)
+    response = await _send_message_internal(message_request, user, db, [])
+    await manager.broadcast({
+        "type": "newMessage",
+        "data": response["message"]
+    }, db)
+    
+    log(manager, websocket, user, "sendMessage", message_id=response["message"]["id"])
+    return response
+
+
+@websocket_handler("dmSend", authRequired=True)
+async def dmSend(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Send a direct message."""
+    payload = data
+    required = ["recipientId", "iv", "ciphertext", "salt", "iv2", "wrappedMk"]
+    for key in required:
+        if key not in payload:
+            raise HTTPException(status_code=400, detail=f"Missing {key}")
+    
+    env = DMEnvelope(
+        sender_id=user.id,
+        recipient_id=int(payload["recipientId"]),
+        iv_b64=payload["iv"],
+        ciphertext_b64=payload["ciphertext"],
+        salt_b64=payload["salt"],
+        iv2_b64=payload["iv2"],
+        wrapped_mk_b64=payload["wrappedMk"],
+        reply_to_id=payload.get("replyToId") if isinstance(payload.get("replyToId"), int) else None,
+    )
+    db.add(env)
+    db.commit()
+    db.refresh(env)
+    
+    payload_ws = {
+        "type": "dmNew",
+        "data": {
+            "id": env.id,
+            "senderId": env.sender_id,
+            "recipientId": env.recipient_id,
+            "iv": env.iv_b64,
+            "ciphertext": env.ciphertext_b64,
+            "salt": env.salt_b64,
+            "iv2": env.iv2_b64,
+            "wrappedMk": env.wrapped_mk_b64,
+            "timestamp": env.timestamp.isoformat(),
+            "replyToId": env.reply_to_id,
+        }
+    }
+    
+    # Send push notification for DM
+    try:
+        from push_service import push_service
+        await push_service.send_dm_notification(db, env, user)
+    except Exception as e:
+        logger.error(f"Failed to send push notification for DM {env.id}: {e}")
+    
+    await manager.send_update_to_user(env.recipient_id, "dmNew", payload_ws["data"], db)
+    await manager.send_update_to_user(env.sender_id, "dmNew", payload_ws["data"], db)
+    
+    log(manager, websocket, user, "dmSend", dm_envelope_id=env.id, recipient_id=env.recipient_id)
+    log_dm(
+        "message_sent_ws",
+        dm_envelope_id=env.id,
+        sender_id=user.id,
+        sender_username=user.username,
+        recipient_id=env.recipient_id,
+        reply_to=env.reply_to_id,
+    )
+    
+    return {"status": "ok", "id": env.id}
+
+
+@websocket_handler("editMessage", authRequired=True)
+async def editMessage(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Edit a public chat message."""
+    
+    message_id = data["message_id"]
+    edit_request: EditMessageRequest = EditMessageRequest.model_validate(data)
+    
+    response = await _edit_message_internal(message_id, edit_request, user, db)
+    await manager.broadcast({
+        "type": "messageEdited",
+        "data": response["message"]
+    }, db)
+    
+    log(manager, websocket, user, "editMessage", message_id=message_id)
+    return response
+
+
+@websocket_handler("dmEdit", authRequired=True)
+async def dmEdit(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Edit a direct message."""
+    payload = data
+    env_id = int(payload["id"])
+    env: DMEnvelope | None = db.query(DMEnvelope).filter(DMEnvelope.id == env_id).first()
+    if not env:
+        raise HTTPException(status_code=404, detail="DM not found")
+    if env.sender_id != user.id:
+        raise HTTPException(status_code=403, detail="You can only edit your own messages")
+    
+    # Replace ciphertext and iv
+    env.iv_b64 = payload["iv"]
+    env.ciphertext_b64 = payload["ciphertext"]
+    env.iv2_b64 = payload["iv2"]
+    env.wrapped_mk_b64 = payload["wrappedMk"]
+    env.salt_b64 = payload["salt"]
+    db.commit()
+    db.refresh(env)
+    
+    payload_ws = {
+        "type": "dmEdited",
+        "data": {
+            "id": env.id,
+            "senderId": env.sender_id,
+            "recipientId": env.recipient_id,
+            "iv": env.iv_b64,
+            "ciphertext": env.ciphertext_b64,
+            "iv2": env.iv2_b64,
+            "wrappedMk": env.wrapped_mk_b64,
+            "salt": env.salt_b64,
+            "timestamp": env.timestamp.isoformat(),
+        }
+    }
+    await manager.send_update_to_user(env.recipient_id, "dmEdited", payload_ws["data"], db)
+    await manager.send_update_to_user(env.sender_id, "dmEdited", payload_ws["data"], db)
+    
+    log(manager, websocket, user, "dmEdit", dm_envelope_id=env.id)
+    log_dm(
+        "message_edited",
+        dm_envelope_id=env.id,
+        user_id=user.id,
+        username=user.username,
+    )
+    
+    return {"status": "ok", "id": env.id}
+
+
+@websocket_handler("dmDelete", authRequired=True)
+async def dmDelete(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Delete a direct message."""
+    payload = data
+    env_id = int(payload["id"])
+    env: DMEnvelope | None = db.query(DMEnvelope).filter(DMEnvelope.id == env_id).first()
+    if not env:
+        raise HTTPException(status_code=404, detail="DM not found")
+    if env.sender_id != user.id:
+        raise HTTPException(status_code=403, detail="You can only delete your own messages")
+    
+    db.delete(env)
+    db.commit()
+    
+    payload_ws = {
+        "type": "dmDeleted",
+        "data": {
+            "id": env_id,
+            "senderId": user.id,
+            "recipientId": payload.get("recipientId")
+        }
+    }
+    await manager.send_update_to_user(env.recipient_id, "dmDeleted", payload_ws["data"], db)
+    await manager.send_update_to_user(env.sender_id, "dmDeleted", payload_ws["data"], db)
+    
+    log(manager, websocket, user, "dmDelete", dm_envelope_id=env_id)
+    log_dm(
+        "message_deleted",
+        dm_envelope_id=env_id,
+        user_id=user.id,
+        username=user.username,
+        recipient_id=env.recipient_id,
+    )
+    
+    return {"status": "ok", "id": env_id}
+
+
+@websocket_handler("deleteMessage", authRequired=True)
+async def deleteMessage(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Delete a public chat message."""
+    message_id = data["message_id"]
+    response = await delete_message(message_id, user, db)
+    await manager.broadcast({
+        "type": "messageDeleted",
+        "data": {"message_id": message_id}
+    }, db)
+    
+    log(manager, websocket, user, "deleteMessage", message_id=message_id)
+    return response
+
+
+@websocket_handler("addReaction", authRequired=True)
+async def addReaction(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Add or remove a reaction to a public chat message."""
+    reaction_request = ReactionRequest(
+        message_id=data["message_id"],
+        emoji=data["emoji"]
+    )
+    
+    response = await add_reaction(reaction_request, user, db)
+    
+    # Broadcast reaction update
+    await manager.broadcast({
+        "type": "reactionUpdate",
+        "data": {
+            "message_id": data["message_id"],
+            "emoji": data["emoji"],
+            "action": response["action"],
+            "user_id": user.id,
+            "username": user.username,
+            "reactions": response["reactions"]
+        }
+    }, db)
+    
+    log(manager, websocket, user, "addReaction", message_id=data["message_id"], emoji=data["emoji"], action=response["action"])
+    return response
+
+
+@websocket_handler("addDmReaction", authRequired=True)
+async def addDmReaction(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Add or remove a reaction to a direct message."""
+    reaction_request = DMReactionRequest(
+        dm_envelope_id=data["dm_envelope_id"],
+        emoji=data["emoji"]
+    )
+    
+    response = await add_dm_reaction(reaction_request, user, db)
+    
+    # Broadcast reaction update
+    await manager.broadcast({
+        "type": "dmReactionUpdate",
+        "data": {
+            "dm_envelope_id": data["dm_envelope_id"],
+            "emoji": data["emoji"],
+            "action": response["action"],
+            "user_id": user.id,
+            "username": user.username,
+            "reactions": response["reactions"]
+        }
+    }, db)
+    
+    log(manager, websocket, user, "addDmReaction", dm_envelope_id=data["dm_envelope_id"], emoji=data["emoji"], action=response["action"])
+    return response
+
+
+@websocket_handler("call_signaling", authRequired=True)
+async def call_signaling(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Forward WebRTC signaling between peers."""
+    payload = data or {}
+    to_user_id = int(payload.get("toUserId") or 0)
+    if not to_user_id:
+        raise HTTPException(status_code=400, detail="Missing toUserId")
+    
+    # Ensure sender is set by the server
+    payload["fromUserId"] = user.id
+    payload["fromUsername"] = user.username
+    
+    await manager.send_to_user(to_user_id, {
+        "type": "call_signaling",
+        "data": payload
+    })
+    
+    log(manager, websocket, user, "call_signaling", to_user_id=to_user_id)
+    return {"status": "ok"}
+
+
+@websocket_handler("call_video_toggle", authRequired=True)
+async def call_video_toggle(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Forward video toggle state between peers."""
+    payload = data or {}
+    to_user_id = int(payload.get("toUserId") or 0)
+    if not to_user_id:
+        raise HTTPException(status_code=400, detail="Missing toUserId")
+    
+    await manager.send_update_to_user(to_user_id, "call_signaling", {
+        "type": "call_video_toggle",
+        "fromUserId": user.id,
+        "toUserId": to_user_id,
+        "data": {"enabled": payload.get("enabled", False)}
+    }, db)
+    
+    log(manager, websocket, user, "call_video_toggle", to_user_id=to_user_id, enabled=payload.get("enabled", False))
+    return {"status": "ok"}
+
+
+@websocket_handler("call_screen_share_toggle", authRequired=True)
+async def call_screen_share_toggle(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Forward screen share toggle state between peers."""
+    payload = data or {}
+    to_user_id = int(payload.get("toUserId") or 0)
+    if not to_user_id:
+        raise HTTPException(status_code=400, detail="Missing toUserId")
+    
+    await manager.send_update_to_user(to_user_id, "call_signaling", {
+        "type": "call_screen_share_toggle",
+        "fromUserId": user.id,
+        "toUserId": to_user_id,
+        "data": {"enabled": payload.get("enabled", False)}
+    }, db)
+    
+    log(manager, websocket, user, "call_screen_share_toggle", to_user_id=to_user_id, enabled=payload.get("enabled", False))
+    return {"status": "ok"}
+
+
+@websocket_handler("subscribeStatus", authRequired=True)
+async def subscribeStatus(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Subscribe to status updates for a user."""
+    user_id_to_subscribe = int(data["userId"])
+    manager.ws_subscriptions[websocket].add(user_id_to_subscribe)
+    
+    # Get current status of the user
+    target_user = db.query(User).filter(User.id == user_id_to_subscribe).first()
+    if target_user:
+        # Send current status directly (not through return value)
+        await websocket.send_json({
+            "type": "statusUpdate",
+            "data": {
+                "userId": user_id_to_subscribe,
+                "online": target_user.online,
+                "lastSeen": target_user.last_seen.isoformat() if target_user.last_seen else None
+            }
+        })
+        log(manager, websocket, user, "subscribeStatus", target_user_id=user_id_to_subscribe)
+        return {"status": "ok"}
+    else:
+        log(manager, websocket, user, "subscribeStatus_error", target_user_id=user_id_to_subscribe, error="User not found")
+        raise HTTPException(status_code=404, detail="User not found")
+
+
+@websocket_handler("unsubscribeStatus", authRequired=True)
+async def unsubscribeStatus(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
+    """Unsubscribe from status updates for a user."""
+    user_id_to_unsubscribe = int(data["userId"])
+    manager.ws_subscriptions[websocket].discard(user_id_to_unsubscribe)
+    
+    log(manager, websocket, user, "unsubscribeStatus", target_user_id=user_id_to_unsubscribe)
+    return {"status": "ok"}
+
+
+@websocket_handler("typing", authRequired=True)
+async def typing(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> None:
+    """Handle typing indicator start for public chat."""
+    was_typing = manager.typing_state.get(user.id, False)
+    manager.typing_users[user.id] = time.time()
+    
+    # Only send update if state changed (started typing)
+    if not was_typing:
+        manager.typing_state[user.id] = True
+        # Broadcast to all connected users
+        await manager.broadcast({
+            "type": "typing",
+            "data": {
+                "userId": user.id,
+                "username": user.username
+            }
+        }, db)
+    
+    # No confirmation response - privacy protection
+
+
+@websocket_handler("stopTyping", authRequired=True)
+async def stopTyping(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> None:
+    """Handle typing indicator stop for public chat."""
+    was_typing = manager.typing_state.get(user.id, False)
+    if user.id in manager.typing_users:
+        del manager.typing_users[user.id]
+    
+    # Only send update if state changed (stopped typing)
+    if was_typing:
+        manager.typing_state[user.id] = False
+        # Broadcast to all connected users
+        await manager.broadcast({
+            "type": "stopTyping",
+            "data": {
+                "userId": user.id,
+                "username": user.username
+            }
+        }, db)
+    
+    # No confirmation response - privacy protection
+    log(manager, websocket, user, "stopTyping")
+
+
+@websocket_handler("dmTyping", authRequired=True)
+async def dmTyping(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> None:
+    """Handle typing indicator start for DM."""
+    recipient_id = int(data["recipientId"])
+    
+    if user.id not in manager.dm_typing_users:
+        manager.dm_typing_users[user.id] = {}
+    if user.id not in manager.dm_typing_state:
+        manager.dm_typing_state[user.id] = {}
+    
+    was_typing = manager.dm_typing_state[user.id].get(recipient_id, False)
+    manager.dm_typing_users[user.id][recipient_id] = time.time()
+    
+    # Only send update if state changed (started typing)
+    if not was_typing:
+        manager.dm_typing_state[user.id][recipient_id] = True
+        # Send only to recipient
+        await manager.send_update_to_user(recipient_id, "dmTyping", {
+            "userId": user.id,
+            "username": user.username
+        }, db)
+    
+    # No confirmation response - privacy protection
+
+
+@websocket_handler("stopDmTyping", authRequired=True)
+async def stopDmTyping(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> None:
+    """Handle typing indicator stop for DM."""
+    recipient_id = int(data["recipientId"])
+    
+    was_typing = False
+    if user.id in manager.dm_typing_state:
+        was_typing = manager.dm_typing_state[user.id].get(recipient_id, False)
+    
+    if user.id in manager.dm_typing_users and recipient_id in manager.dm_typing_users[user.id]:
+        del manager.dm_typing_users[user.id][recipient_id]
+        if not manager.dm_typing_users[user.id]:
+            del manager.dm_typing_users[user.id]
+    
+    # Only send update if state changed (stopped typing)
+    if was_typing:
+        if user.id in manager.dm_typing_state:
+            manager.dm_typing_state[user.id][recipient_id] = False
+        # Send only to recipient
+        await manager.send_update_to_user(recipient_id, "stopDmTyping", {
+            "userId": user.id,
+            "username": user.username
+        }, db)
+    
+    # No confirmation response - privacy protection
+

backend/websocket/registry.py

@@ -0,0 +1,33 @@
+from typing import Callable
+
+
+class WebSocketHandlerRegistry:
+    """Registry for WebSocket message handlers with authentication support."""
+    
+    def __init__(self):
+        self._handlers: dict[str, tuple[Callable, bool]] = {}
+    
+    def register(self, message_type: str, authRequired: bool = True):
+        """Register a handler for a message type.
+        
+        Args:
+            message_type: The WebSocket message type to handle
+            authRequired: If True, handler will receive authenticated User (not None) or raise 401
+        """
+        def decorator(func: Callable):
+            self._handlers[message_type] = (func, authRequired)
+            return func
+        return decorator
+    
+    def get_handler(self, message_type: str) -> tuple[Callable, bool] | None:
+        """Get handler and authRequired flag for a message type.
+        
+        Returns:
+            Tuple of (handler function, authRequired flag) or None if not found
+        """
+        return self._handlers.get(message_type)
+    
+    def get_all_types(self) -> list[str]:
+        """Get all registered message types for debugging/logging."""
+        return list(self._handlers.keys())
+

backend/websocket/utils.py

@@ -0,0 +1,92 @@
+from fastapi import HTTPException
+from fastapi.security import HTTPAuthorizationCredentials
+from sqlalchemy.orm import Session
+from types import SimpleNamespace
+from dependencies import get_current_user
+from models import User
+
+
+def extract_token_from_data(data: dict) -> str | None:
+    """Extract authentication token from WebSocket message data.
+    
+    Args:
+        data: WebSocket message data dictionary
+        
+    Returns:
+        Token string or None if not present
+    """
+    credentials = data.get("credentials")
+    if credentials and isinstance(credentials, dict):
+        return credentials.get("credentials")
+    return None
+
+
+def get_current_user_from_token(token: str, db: Session) -> User | None:
+    """Get user from authentication token.
+    
+    Args:
+        token: JWT token string
+        db: Database session
+        
+    Returns:
+        User object or None if token is invalid
+    """
+    try:
+        # Ensure session is in a usable state before querying
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        
+        dummy_request = SimpleNamespace()
+        dummy_request.state = SimpleNamespace()
+        
+        try:
+            from fastapi.security import HTTPBearer
+            security = HTTPBearer()
+            # We need to create credentials manually
+            credentials = HTTPAuthorizationCredentials(
+                scheme="Bearer",
+                credentials=token
+            )
+            return get_current_user(dummy_request, credentials, db)
+        except HTTPException:
+            return None
+    except Exception:
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        return None
+
+
+def authenticate_user(data: dict, db: Session, authRequired: bool) -> User | None:
+    """Authenticate user from WebSocket message data.
+    
+    Args:
+        data: WebSocket message data dictionary
+        db: Database session
+        authRequired: If True, raises 401 on missing/invalid token
+        
+    Returns:
+        User object (guaranteed not None if authRequired=True) or None
+        
+    Raises:
+        HTTPException: 401 if authRequired=True and token is missing/invalid
+    """
+    token = extract_token_from_data(data)
+    
+    if authRequired:
+        if not token:
+            raise HTTPException(status_code=401, detail="Missing credentials")
+        
+        user = get_current_user_from_token(token, db)
+        if not user:
+            raise HTTPException(status_code=401, detail="Invalid credentials")
+        
+        return user
+    else:
+        if token:
+            return get_current_user_from_token(token, db)
+        return None
+

deployment/.dockerignore

@@ -30,4 +30,5 @@ coverage
 test_results/
 out
 
-data
+data
+logs

deployment/Dockerfile.backend

@@ -14,12 +14,16 @@ FROM python:3.12-slim AS runtime
 WORKDIR /app
 RUN useradd -u 1000 app && \
     chown -R app /app
-USER app
 
 # 2.2. Copy content and create dirs
 COPY --chown=app backend .
 COPY --from=builder --chown=app /app/.venv .venv
-RUN mkdir -p /app/data
+RUN mkdir -p /app/data /app/logs && \
+    chown -R app /app/data /app/logs && \
+    printf '#!/bin/sh\nexec /app/.venv/bin/python /app/admin_cli.py "$@"\n' > /usr/local/bin/admin-cli && \
+    chmod +x /usr/local/bin/admin-cli
+
+USER app
 
 # 3. Final command
 ENTRYPOINT exec ./.venv/bin/fastapi run --port ${PORT:-8300} main.py

deployment/caddy/Caddyfile

@@ -0,0 +1,88 @@
+fromchat.ru {
+	reverse_proxy 172.18.0.1:8301 host.docker.internal:8301 172.17.0.1:8301 {
+		lb_policy first
+        header_up X-Real-IP {remote_host}
+	}
+
+	# Security headers
+	header {
+		X-XSS-Protection "1; mode=block" # Prevent XSS attacks
+		X-Content-Type-Options "nosniff" # Prevent MIME type sniffing
+		X-Frame-Options "DENY" # Prevent clickjacking
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';"
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		Permissions-Policy "geolocation=(), microphone=(self), camera=(self)"
+	}
+
+	rate_limit {
+		zone global {
+			key {remote_ip}
+			window 1m
+			burst 20
+			events 500
+		}
+	}
+
+	handle_errors {
+		@errors {
+			expression {err.status_code} >= 400
+		}
+
+		handle @errors {
+			rewrite * /{err.status_code}
+			reverse_proxy https://http.cat {
+				header_up Host {upstream_hostport}
+				replace_status {err.status_code}
+			}
+		}
+	}
+}
+
+beta.fromchat.ru {
+    reverse_proxy 95.165.0.162:8301 {
+        header_up X-Real-IP {remote_host}
+    }
+
+	# Security headers
+	header {
+		X-XSS-Protection "1; mode=block" # Prevent XSS attacks
+		X-Content-Type-Options "nosniff" # Prevent MIME type sniffing
+		X-Frame-Options "DENY" # Prevent clickjacking
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';"
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		Permissions-Policy "geolocation=(), microphone=(self), camera=(self)"
+	}
+
+	rate_limit {
+		zone global {
+			key {remote_ip}
+			window 1m
+			burst 20
+			events 1000
+		}
+	}
+
+	handle_errors {
+		@errors {
+			expression {err.status_code} >= 400
+		}
+
+		handle @errors {
+			rewrite * /{err.status_code}
+			reverse_proxy https://http.cat {
+				header_up Host {upstream_hostport}
+				replace_status {err.status_code}
+			}
+		}
+	}
+}
+
+api.getgadgets.toolbox-io.ru {
+    reverse_proxy 95.165.0.162:8400
+}
+
+getgadgets.toolbox-io.ru {
+    reverse_proxy 95.165.0.162:8401
+}

deployment/caddy/Dockerfile

@@ -0,0 +1,13 @@
+#
+# Custom Caddy built with:
+# - Rate limit plugin
+#
+
+FROM caddy:2-builder AS builder
+RUN xcaddy build \
+      --with github.com/mholt/caddy-ratelimit
+
+FROM caddy:2
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY Caddyfile /etc/caddy/Caddyfile

deployment/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   backend:
-    build: 
+    build:
       dockerfile: deployment/Dockerfile.backend
       context: ..
     environment:
@@ -8,8 +8,11 @@ services:
       JWT_SECRET: ${JWT_SECRET}
       VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
       VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
+      FIREBASE_CERT: ${FIREBASE_CERT}
     volumes:
-      - "data:/app/data"
+      - data:/app/data
+      - logs:/app/logs
+
     develop:
       watch:
         - action: sync+restart
@@ -19,7 +22,7 @@ services:
           path: ../backend/requirements.txt
 
   frontend:
-    build: 
+    build:
       dockerfile: deployment/frontend/Dockerfile
       context: ..
     environment:
@@ -39,6 +42,26 @@ services:
         - action: rebuild
           path: package.json
 
+  caddy:
+    build:
+      context: ./caddy
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - certs:/root/site/certs
+    environment:
+      XDG_DATA_HOME: /root/site/certs
+      XDG_CONFIG_HOME: /root/site/certs
+
 volumes:
   data:
-    name: fromchat-data
+    name: fromchat-data
+  logs:
+    name: fromchat-logs
+  certs:
+    name: fromchat-certs

deployment/frontend/Dockerfile

@@ -3,11 +3,13 @@ FROM node:24 AS frontend
 
 # 1.1. Install npm dependencies
 WORKDIR /app
+# Copy package.json and workspace package directory first (needed for workspace resolution)
 COPY package.json .
+COPY frontend/packages/ frontend/packages/
 RUN --mount=type=cache,target=/root/.npm \
     npm install --ignore-scripts
 
-# 1.2. Build
+# 1.2. Copy remaining frontend code and build
 COPY frontend frontend
 RUN npm run frontend:build
 

frontend/index.html

@@ -4,7 +4,7 @@
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
         <title>Loading...</title>
-        <link rel="icon" href="./src/images/logo.png" />
+        <link rel="icon" href="./src/images/logo.svg" />
     </head>
     <body>
         <div id="root"></div>

frontend/packages/fromchat-protocol/.gitignore

@@ -0,0 +1,7 @@
+node_modules/
+dist/
+*.log
+.DS_Store
+package-lock.json
+
+

frontend/packages/fromchat-protocol/.npmignore

@@ -0,0 +1,8 @@
+src/
+tsconfig.json
+node_modules/
+package-lock.json
+*.log
+.DS_Store
+
+

frontend/packages/fromchat-protocol/PUBLISHING.md

@@ -0,0 +1,171 @@
+# Publishing FromChat Protocol
+
+This guide explains how to publish the `@fromchat/protocol` package to npm or GitHub Packages.
+
+## Prerequisites
+
+1. **npm account**: Create one at [npmjs.com](https://www.npmjs.com/signup)
+2. **GitHub account**: For GitHub Packages
+3. **Node.js**: Version 18 or higher
+
+## Publishing to npm
+
+### Important: Scoped Package Setup
+
+The package uses the `@fromchat` scope. You have two options:
+
+**Option A: Create an npm organization (Recommended)**
+1. Go to [npmjs.com/org/create](https://www.npmjs.com/org/create)
+2. Create an organization named `fromchat`
+3. Add yourself as a member
+4. Then proceed with publishing below
+
+**Option B: Use unscoped package name**
+If you prefer not to create an organization, change the package name in `package.json`:
+```json
+{
+  "name": "fromchat-protocol"  // Remove the @fromchat/ scope
+}
+```
+Then update all imports in your codebase from `@fromchat/protocol` to `fromchat-protocol`.
+
+### 1. Build the package
+
+```bash
+cd frontend/packages/fromchat-protocol
+npm run build
+```
+
+This compiles TypeScript to JavaScript in the `dist/` directory.
+
+### 2. Login to npm
+
+```bash
+npm login
+```
+
+Enter your npm username, password, and email.
+
+### 3. Publish
+
+**If using scoped package (`@fromchat/protocol`):**
+```bash
+npm publish --access public
+```
+
+**If using unscoped package (`fromchat-protocol`):**
+```bash
+npm publish
+```
+
+The `--access public` flag is required for scoped packages (packages starting with `@`).
+
+### 4. Verify
+
+Check your package at: `https://www.npmjs.com/package/@fromchat/protocol`
+
+### 5. Update version for future releases
+
+```bash
+# Patch version (1.0.0 -> 1.0.1)
+npm version patch
+
+# Minor version (1.0.0 -> 1.1.0)
+npm version minor
+
+# Major version (1.0.0 -> 2.0.0)
+npm version major
+
+# Then publish
+npm publish --access public
+```
+
+## Publishing to GitHub Packages
+
+### 1. Create a GitHub Personal Access Token
+
+1. Go to GitHub Settings → Developer settings → Personal access tokens → Tokens (classic)
+2. Generate a new token with `write:packages` and `read:packages` permissions
+3. Save the token securely
+
+### 2. Configure npm to use GitHub Packages
+
+Create or edit `~/.npmrc`:
+
+```
+@fromchat:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=YOUR_GITHUB_TOKEN
+```
+
+Or add to `package.json`:
+
+```json
+{
+  "publishConfig": {
+    "registry": "https://npm.pkg.github.com"
+  }
+}
+```
+
+### 3. Update package.json
+
+Update the repository URL to match your GitHub repository:
+
+```json
+{
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/YOUR_USERNAME/YOUR_REPO.git",
+    "directory": "frontend/packages/fromchat-protocol"
+  }
+}
+```
+
+### 4. Build and publish
+
+```bash
+cd frontend/packages/fromchat-protocol
+npm run build
+npm publish
+```
+
+### 5. Install from GitHub Packages
+
+Users can install your package with:
+
+```bash
+npm install @fromchat/protocol@npm:@fromchat/protocol
+```
+
+Or add to `.npmrc`:
+
+```
+@fromchat:registry=https://npm.pkg.github.com
+```
+
+## Using the Published Package
+
+### From npm
+
+```bash
+npm install @fromchat/protocol
+```
+
+```typescript
+import { FromChatProtocol } from "@fromchat/protocol";
+```
+
+### From GitHub Packages
+
+```bash
+npm install @fromchat/protocol@npm:@fromchat/protocol
+```
+
+## Notes
+
+- The package is built to `dist/` directory
+- Source files in `src/` are excluded from the published package
+- Only `dist/` and `README.md` are included in the published package
+- The package uses ES modules (ESM) format
+- TypeScript definitions are included in `dist/`
+

frontend/packages/fromchat-protocol/README.md

@@ -0,0 +1,99 @@
+# FromChat Protocol
+
+Simple ECDH-based encryption protocol for direct messages.
+
+## Overview
+
+The FromChat Protocol provides end-to-end encryption for direct messages using:
+- **X25519** (ECDH) for key exchange
+- **HKDF** for key derivation
+- **AES-GCM** for symmetric encryption
+
+This module is completely independent and can be used in any JavaScript/TypeScript project.
+
+## Protocol Flow
+
+### Encryption
+
+1. Generate a random message key (mk) - 32 bytes
+2. Generate a random salt (wkSalt) - 16 bytes
+3. Derive shared secret from ECDH: `ecdhSharedSecret(myPrivateKey, theirPublicKey)`
+4. Derive wrapping key: `deriveWrappingKey(sharedSecret, wkSalt, info)` using HKDF
+5. Encrypt message with mk using AES-GCM → (iv, ciphertext)
+6. Encrypt (wrap) mk with wrapping key using AES-GCM → (iv2, wrappedMk)
+7. Send: `{ iv, ciphertext, salt, iv2, wrappedMk }`
+
+### Decryption
+
+1. Derive shared secret from ECDH
+2. Derive wrapping key from shared secret using salt from message
+3. Decrypt wrappedMk to get mk
+4. Decrypt ciphertext with mk
+
+## Usage
+
+```typescript
+import { FromChatProtocol } from "@fromchat/protocol";
+
+// Initialize with your private key
+const protocol = new FromChatProtocol(privateKey);
+
+// Encrypt a message
+const encrypted = await protocol.encryptMessage(recipientPublicKey, "Hello!");
+
+// Decrypt a message
+const decrypted = await protocol.decryptMessage(senderPublicKey, encrypted);
+```
+
+## API
+
+### `FromChatProtocol`
+
+#### Constructor
+- `constructor(privateKey: Uint8Array)` - Initialize protocol with your X25519 private key
+
+#### Methods
+- `encryptMessage(recipientPublicKey: Uint8Array, plaintext: string): Promise<EncryptedMessage>` - Encrypt a message
+- `decryptMessage(senderPublicKey: Uint8Array, message: EncryptedMessage): Promise<string>` - Decrypt a message
+
+### Types
+
+```typescript
+interface EncryptedMessage {
+  iv: string;        // Base64 encoded IV for message encryption
+  ciphertext: string; // Base64 encoded encrypted message
+  salt: string;      // Base64 encoded salt for wrapping key derivation
+  iv2: string;       // Base64 encoded IV for message key wrapping
+  wrappedMk: string; // Base64 encoded wrapped message key
+}
+```
+
+## Backup & Key Management
+
+The protocol also includes utilities for backing up and restoring private keys:
+
+```typescript
+import { 
+  encryptBackupWithPassword, 
+  decryptBackupWithPassword,
+  encodeBlob,
+  decodeBlob 
+} from "@fromchat/protocol";
+
+// Create a backup of a private key
+const bundle = { version: 1, privateKey: myPrivateKey };
+const encrypted = await encryptBackupWithPassword("my-password", bundle);
+const backupString = encodeBlob(encrypted); // Store this string
+
+// Restore from backup
+const encryptedBlob = decodeBlob(backupString);
+const restored = await decryptBackupWithPassword("my-password", encryptedBlob);
+```
+
+## Security Notes
+
+- Each message uses a fresh random message key
+- The protocol does not provide forward secrecy
+- Keys are derived using HKDF with SHA-256
+- All encryption uses AES-GCM with 12-byte IVs
+- Backup encryption uses PBKDF2 with 210,000 iterations

frontend/packages/fromchat-protocol/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@fromchat/protocol",
+  "version": "1.0.0",
+  "description": "FromChat Protocol - Simple ECDH-based encryption for direct messages. Independent and reusable encryption module.",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "encryption",
+    "ecdh",
+    "e2ee",
+    "end-to-end-encryption",
+    "x25519",
+    "aes-gcm",
+    "hkdf"
+  ],
+  "author": "denis0001-dev",
+  "license": "GPL-3.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Toolbox-io/FromChat.git",
+    "directory": "frontend/packages/fromchat-protocol"
+  },
+  "bugs": {
+    "url": "https://github.com/Toolbox-io/FromChat/issues"
+  },
+  "homepage": "https://github.com/Toolbox-io/FromChat#readme",
+  "dependencies": {
+    "tweetnacl": "^1.0.3"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.2",
+    "typescript": "^5.0.0"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=24.0.0"
+  }
+}

frontend/packages/fromchat-protocol/src/backup/backup.ts

@@ -1,5 +1,4 @@
-import { aesGcmDecrypt, aesGcmEncrypt } from "./symmetric";
-import { importPassword, deriveKEK, randomBytes } from "./kdf";
+import { aesGcmDecrypt, aesGcmEncrypt, importPassword, deriveKEK, randomBytes } from "../crypto/index";
 
 export interface PrivateKeyBundle {
 	version: 1;
@@ -65,4 +64,3 @@ export function decodeBlob(json: string): EncryptedBackupBlob {
 	return { salt: ub64(obj.salt), iv: ub64(obj.iv), ciphertext: ub64(obj.ciphertext) };
 }
 
-

frontend/packages/fromchat-protocol/src/crypto/asymmetric.ts

@@ -6,18 +6,16 @@ export interface X25519KeyPair {
 	privateKey: Uint8Array;
 }
 
-export type KeyPair = X25519KeyPair;
-
 export function generateX25519KeyPair(): X25519KeyPair {
 	const kp = nacl.box.keyPair();
 	return { publicKey: kp.publicKey, privateKey: kp.secretKey };
 }
 
 export function ecdhSharedSecret(myPrivateKey: Uint8Array, theirPublicKey: Uint8Array): Uint8Array {
-	// nacl.box.before returns shared key (Curve25519, XSalsa20-Poly1305 context). We use it as IKM into HKDF.
 	return nacl.box.before(theirPublicKey, myPrivateKey);
 }
 
 export async function deriveWrappingKey(sharedSecret: Uint8Array, salt: Uint8Array, info: Uint8Array): Promise<Uint8Array> {
 	return hkdfExtractAndExpand(sharedSecret.buffer as ArrayBuffer, salt, info, 32);
-}
+}
+

frontend/packages/fromchat-protocol/src/crypto/index.ts

@@ -0,0 +1,7 @@
+// Re-export all crypto functions for convenience
+export { generateX25519KeyPair, ecdhSharedSecret, deriveWrappingKey } from "./asymmetric";
+export type { X25519KeyPair } from "./asymmetric";
+export { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "./symmetric";
+export type { AesGcmCiphertext } from "./symmetric";
+export { hkdfExtractAndExpand, randomBytes, importPassword, deriveKEK } from "./kdf";
+

frontend/packages/fromchat-protocol/src/crypto/kdf.ts

@@ -1,3 +1,19 @@
+export async function hkdfExtractAndExpand(inputKeyMaterial: Uint8Array | ArrayBuffer, salt: Uint8Array | ArrayBuffer, info: Uint8Array | ArrayBuffer, length = 32): Promise<Uint8Array> {
+	const inputBuffer = inputKeyMaterial instanceof Uint8Array ? inputKeyMaterial.buffer as ArrayBuffer : inputKeyMaterial;
+	const saltBuffer = salt instanceof Uint8Array ? salt.buffer as ArrayBuffer : salt;
+	const infoBuffer = info instanceof Uint8Array ? info.buffer as ArrayBuffer : info;
+
+	const ikmKey = await crypto.subtle.importKey("raw", inputBuffer, { name: "HKDF" }, false, ["deriveBits"]);
+	const bits = await crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: saltBuffer, info: infoBuffer }, ikmKey, length * 8);
+	return new Uint8Array(bits);
+}
+
+export function randomBytes(length: number): Uint8Array {
+	const out = new Uint8Array(length);
+	crypto.getRandomValues(out);
+	return out;
+}
+
 export async function importPassword(password: string): Promise<CryptoKey> {
 	const enc = new TextEncoder();
 	return crypto.subtle.importKey("raw", enc.encode(password), "PBKDF2", false, ["deriveKey", "deriveBits"]);
@@ -13,19 +29,3 @@ export async function deriveKEK(passwordKey: CryptoKey, salt: Uint8Array | Array
 		["encrypt", "decrypt"]
 	);
 }
-
-export async function hkdfExtractAndExpand(inputKeyMaterial: Uint8Array | ArrayBuffer, salt: Uint8Array | ArrayBuffer, info: Uint8Array | ArrayBuffer, length = 32): Promise<Uint8Array> {
-	const inputBuffer = inputKeyMaterial instanceof Uint8Array ? inputKeyMaterial.buffer as ArrayBuffer : inputKeyMaterial;
-	const saltBuffer = salt instanceof Uint8Array ? salt.buffer as ArrayBuffer : salt;
-	const infoBuffer = info instanceof Uint8Array ? info.buffer as ArrayBuffer : info;
-
-	const ikmKey = await crypto.subtle.importKey("raw", inputBuffer, { name: "HKDF" }, false, ["deriveBits"]);
-	const bits = await crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: saltBuffer, info: infoBuffer }, ikmKey, length * 8);
-	return new Uint8Array(bits);
-}
-
-export function randomBytes(length: number): Uint8Array {
-	const out = new Uint8Array(length);
-	crypto.getRandomValues(out);
-	return out;
-}

frontend/packages/fromchat-protocol/src/crypto/symmetric.ts

@@ -11,12 +11,10 @@ export async function aesGcmEncrypt(key: CryptoKey, plaintext: Uint8Array | Arra
 }
 
 export async function aesGcmDecrypt(key: CryptoKey, iv: Uint8Array | ArrayBuffer, ciphertext: Uint8Array | ArrayBuffer): Promise<Uint8Array> {
-	// Normalize IV to ArrayBuffer (12 bytes for AES-GCM)
 	const ivBuf: ArrayBuffer = iv instanceof Uint8Array
 		? (iv.buffer as ArrayBuffer).slice(iv.byteOffset, iv.byteOffset + iv.byteLength)
 		: (iv as ArrayBuffer);
 
-	// Normalize ciphertext to a contiguous ArrayBuffer slice
 	const ctBuf: ArrayBuffer = ciphertext instanceof Uint8Array
 		? (ciphertext.buffer as ArrayBuffer).slice(ciphertext.byteOffset, ciphertext.byteOffset + ciphertext.byteLength)
 		: (ciphertext as ArrayBuffer);
@@ -26,9 +24,8 @@ export async function aesGcmDecrypt(key: CryptoKey, iv: Uint8Array | ArrayBuffer
 }
 
 export async function importAesGcmKey(rawKey: Uint8Array | ArrayBuffer): Promise<CryptoKey> {
-	// Normalize to a contiguous ArrayBuffer slice to avoid offset/length issues
 	const keyBuffer = rawKey instanceof Uint8Array
 		? (rawKey.buffer as ArrayBuffer).slice(rawKey.byteOffset, rawKey.byteOffset + rawKey.byteLength)
 		: (rawKey as ArrayBuffer);
 	return crypto.subtle.importKey("raw", keyBuffer, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
-}
+}

frontend/packages/fromchat-protocol/src/index.ts

@@ -0,0 +1,20 @@
+export { FromChatProtocol } from "./protocol/FromChatProtocol";
+export type { EncryptedMessage } from "./protocol/types";
+
+// Export crypto functions
+export { generateX25519KeyPair, ecdhSharedSecret, deriveWrappingKey } from "./crypto/asymmetric";
+export type { X25519KeyPair } from "./crypto/asymmetric";
+export { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "./crypto/symmetric";
+export type { AesGcmCiphertext } from "./crypto/symmetric";
+export { hkdfExtractAndExpand, randomBytes, importPassword, deriveKEK } from "./crypto/kdf";
+
+// Export backup functions
+export {
+	encryptBackupWithPassword,
+	decryptBackupWithPassword,
+	encodeBlob,
+	decodeBlob,
+	serializeBundle,
+	deserializeBundle
+} from "./backup/backup";
+export type { PrivateKeyBundle, EncryptedBackupBlob } from "./backup/backup";

frontend/packages/fromchat-protocol/src/protocol/FromChatProtocol.ts

@@ -0,0 +1,102 @@
+import { ecdhSharedSecret, deriveWrappingKey } from "../crypto/asymmetric";
+import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "../crypto/symmetric";
+import { randomBytes } from "../crypto/kdf";
+import type { EncryptedMessage } from "./types";
+
+/**
+ * FromChat Protocol - Simple ECDH-based encryption
+ * 
+ * Protocol:
+ * 1. Generate random message key (mk) - 32 bytes
+ * 2. Generate random salt (wkSalt) - 16 bytes
+ * 3. Derive shared secret from ECDH (X25519)
+ * 4. Derive wrapping key from shared secret using HKDF with salt
+ * 5. Encrypt message with mk using AES-GCM
+ * 6. Encrypt (wrap) mk with wrapping key using AES-GCM
+ * 7. Send: { iv, ciphertext, salt, iv2, wrappedMk }
+ */
+export class FromChatProtocol {
+	private privateKey: Uint8Array;
+
+	constructor(privateKey: Uint8Array) {
+		this.privateKey = privateKey;
+	}
+
+	/**
+	 * Encrypt a message for a recipient
+	 * @param recipientPublicKey - Recipient's X25519 public key
+	 * @param plaintext - Message to encrypt
+	 * @returns Encrypted message with all necessary fields
+	 */
+	async encryptMessage(recipientPublicKey: Uint8Array, plaintext: string): Promise<EncryptedMessage> {
+		// Generate random message key
+		const mk = randomBytes(32);
+		
+		// Generate random salt for wrapping key derivation
+		const wkSalt = randomBytes(16);
+		
+		// Derive shared secret from ECDH
+		const shared = ecdhSharedSecret(this.privateKey, recipientPublicKey);
+		
+		// Derive wrapping key from shared secret using HKDF
+		const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+		const wk = await importAesGcmKey(wkRaw);
+		
+		// Encrypt the message with message key
+		const plaintextBytes = new TextEncoder().encode(plaintext);
+		const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), plaintextBytes);
+		
+		// Encrypt (wrap) the message key with wrapping key
+		const wrap = await aesGcmEncrypt(wk, mk);
+		
+		// Convert to base64 for transmission
+		return {
+			iv: btoa(String.fromCharCode(...encMsg.iv)),
+			ciphertext: btoa(String.fromCharCode(...encMsg.ciphertext)),
+			salt: btoa(String.fromCharCode(...wkSalt)),
+			iv2: btoa(String.fromCharCode(...wrap.iv)),
+			wrappedMk: btoa(String.fromCharCode(...wrap.ciphertext))
+		};
+	}
+
+	/**
+	 * Decrypt a message from a sender
+	 * @param senderPublicKey - Sender's X25519 public key
+	 * @param message - Encrypted message
+	 * @returns Decrypted plaintext
+	 */
+	async decryptMessage(senderPublicKey: Uint8Array, message: EncryptedMessage): Promise<string> {
+		// Decode base64 fields
+		const salt = new Uint8Array(
+			atob(message.salt).split("").map(c => c.charCodeAt(0))
+		);
+		const iv2 = new Uint8Array(
+			atob(message.iv2).split("").map(c => c.charCodeAt(0))
+		);
+		const wrappedMk = new Uint8Array(
+			atob(message.wrappedMk).split("").map(c => c.charCodeAt(0))
+		);
+		const iv = new Uint8Array(
+			atob(message.iv).split("").map(c => c.charCodeAt(0))
+		);
+		const ciphertext = new Uint8Array(
+			atob(message.ciphertext).split("").map(c => c.charCodeAt(0))
+		);
+		
+		// Derive shared secret from ECDH
+		const shared = ecdhSharedSecret(this.privateKey, senderPublicKey);
+		
+		// Derive wrapping key from shared secret using salt from message
+		const wkRaw = await deriveWrappingKey(shared, salt, new Uint8Array([1]));
+		const wk = await importAesGcmKey(wkRaw);
+		
+		// Decrypt (unwrap) the message key
+		const mk = await aesGcmDecrypt(wk, iv2, wrappedMk);
+		
+		// Decrypt the message with message key
+		const decrypted = await aesGcmDecrypt(await importAesGcmKey(mk), iv, ciphertext);
+		
+		return new TextDecoder().decode(decrypted);
+	}
+}
+

frontend/packages/fromchat-protocol/src/protocol/types.ts

@@ -0,0 +1,10 @@
+/**
+ * Encrypted message format
+ */
+export interface EncryptedMessage {
+	iv: string; // Base64 encoded IV for message encryption
+	ciphertext: string; // Base64 encoded encrypted message
+	salt: string; // Base64 encoded salt for wrapping key derivation
+	iv2: string; // Base64 encoded IV for message key wrapping
+	wrappedMk: string; // Base64 encoded wrapped message key
+}

frontend/packages/fromchat-protocol/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "lib": ["ES2020", "DOM"],
+    "declaration": true,
+    "declarationMap": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "sourceMap": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

frontend/plugins/optimizeSvg.ts

@@ -0,0 +1,67 @@
+import type { Plugin } from 'vite';
+import { optimize } from 'svgo';
+
+export interface OptimizeSvgOptions {
+    /**
+     * Whether to enable SVG optimization
+     * @default true
+     */
+    enabled?: boolean;
+}
+
+const svgoConfig: Parameters<typeof optimize>[1] = {
+    multipass: true,
+    plugins: [
+        {
+            name: 'preset-default',
+            params: {
+                overrides: {
+                    // Keep IDs if they might be referenced (minify instead of remove)
+                    cleanupIds: {
+                        remove: false,
+                        minify: true
+                    }
+                }
+            }
+        }
+    ]
+};
+
+/**
+ * Optimizes SVG files during build by:
+ * - Minifying SVG code
+ * - Removing metadata and comments
+ * - Removing unnecessary attributes
+ * - Optimizing paths and shapes
+ */
+export function optimizeSvg(options?: OptimizeSvgOptions): Plugin {
+    const enabled = options?.enabled !== false;
+
+    return {
+        name: 'optimize-svg',
+        apply: 'build',
+        enforce: 'post',
+        async generateBundle(options, bundle) {
+            if (!enabled) return;
+
+            // Optimize SVGs in the bundle
+            for (const [fileName, chunk] of Object.entries(bundle)) {
+                if (fileName.endsWith('.svg') && chunk.type === 'asset') {
+                    try {
+                        const svgContent = typeof chunk.source === 'string' 
+                            ? chunk.source 
+                            : Buffer.from(chunk.source).toString('utf-8');
+                        
+                        const result = optimize(svgContent, svgoConfig);
+
+                        if (result.data && result.data !== svgContent) {
+                            chunk.source = result.data;
+                        }
+                    } catch (error) {
+                        console.warn(`Failed to optimize SVG ${fileName}:`, error);
+                    }
+                }
+            }
+        }
+    };
+}

frontend/src/App.tsx

@@ -1,23 +1,26 @@
-import { BrowserRouter, Routes, Route, useNavigate, matchRoutes, type RouteObject } from "react-router-dom";
+import { BrowserRouter, Routes, Route, useNavigate, useLocation, matchRoutes, Navigate, type RouteObject } from "react-router-dom";
+import { AnimatePresence, motion } from "motion/react";
 import { ElectronTitleBar } from "./Electron";
-import { useAppState } from "./pages/chat/state";
-import { lazy, useEffect, useState } from "react";
+import { useUserStore } from "./state/user";
+import { lazy, useEffect, useRef, useState } from "react";
 import { parseProfileLink } from "./core/profileLinks";
 import NotFoundPage from "./pages/not-found/NotFoundPage";
 import ProtectedRoute from "./pages/ProtectedRoute";
 import DownloadAppPage from "./pages/download-app/DownloadAppPage";
 import { SuspensionDialog } from "./pages/chat/ui/SuspensionDialog";
+import { AlertDialogProvider } from "./core/components/AlertDialog";
+import { delay } from "./utils/utils";
 
 // Lazy load route components
 const HomePage = lazy(() => import("./pages/home/HomePage"));
-const LoginPage = lazy(() => import("./pages/auth/LoginPage"));
-const RegisterPage = lazy(() => import("./pages/auth/RegisterPage"));
+const AuthPage = lazy(() => import("./pages/auth/AuthPage"));
 const ChatPage = lazy(() => import("./pages/chat/ui/ChatPage"));
 
 const routeConfig: RouteObject[] = [
     { path: "/", element: <HomePage /> },
-    { path: "/login", element: <LoginPage /> },
-    { path: "/register", element: <RegisterPage /> },
+    { path: "/auth", element: <AuthPage /> },
+    { path: "/login", element: <Navigate to="/auth?mode=login" replace /> },
+    { path: "/register", element: <Navigate to="/auth?mode=register" replace /> },
     { path: "/download-app", element: <DownloadAppPage /> },
     {
         path: "/chat",
@@ -66,25 +69,70 @@ function SmartCatchAll() {
     }
 }
 
-export default function App() {
-    const { restoreUserFromStorage, user } = useAppState();
-    const [authReady, setAuthReady] = useState(false);
+function AnimatedRoutes() {
+    const location = useLocation();
+    const prevPathnameRef = useRef(location.pathname);
 
-    useEffect(() => {
-        restoreUserFromStorage().finally(() => {
-            setAuthReady(true);
-        });
-    }, [restoreUserFromStorage]);
-    
-    return authReady && (
-        <BrowserRouter>
-            <ElectronTitleBar />
-            <div id="main-wrapper">
-                <Routes>
+    return (
+        <AnimatePresence mode="sync" initial={false}>
+            <motion.div
+                key={location.pathname}
+                onAnimationStart={() => {
+                    if (prevPathnameRef.current !== location.pathname) {
+                        prevPathnameRef.current = location.pathname;
+                        document.body.style.overflow = "hidden";
+                    }
+                }}
+                onAnimationComplete={async () => {
+                    await delay(500);
+                    document.body.style.overflow = "";
+                }}
+                initial={{ opacity: 0, scale: 0.8 }}
+                animate={{ opacity: 1, scale: 1 }}
+                exit={{ opacity: 1, scale: 1.1 }}
+                transition={{ 
+                    type: "spring",
+                    stiffness: 300,
+                    damping: 30,
+                    mass: 0.8
+                }}
+                style={{ 
+                    transformOrigin: "center center",
+                    width: "100%",
+                    height: "100%",
+                    position: "absolute",
+                    top: 0,
+                    left: 0,
+                    right: 0,
+                    bottom: 0
+                }}
+            >
+                <Routes location={location}>
                     {routeConfig.map((route, index) => (
                         <Route key={index} path={route.path} element={route.element} />
                     ))}
                 </Routes>
+            </motion.div>
+        </AnimatePresence>
+    );
+}
+
+export default function App() {
+    const { restoreFromStorage, user } = useUserStore();
+    const [authReady, setAuthReady] = useState(false);
+
+    useEffect(() => {
+        restoreFromStorage().finally(() => {
+            setAuthReady(true);
+        });
+    }, [restoreFromStorage]);
+    
+    return authReady && (
+        <BrowserRouter>
+            <ElectronTitleBar />
+            <AlertDialogProvider />
+            <div id="main-wrapper">
+                <AnimatedRoutes />
             </div>
             {user.isSuspended && (
                 <SuspensionDialog 

frontend/src/core/api/account/devices.ts

@@ -1,5 +1,5 @@
 import { API_BASE_URL } from "@/core/config";
-import { getAuthHeaders } from "@/core/api/authApi";
+import { getAuthHeaders } from "./index";
 
 export interface DeviceInfo {
     session_id: string;
@@ -18,20 +18,19 @@ export interface DeviceInfo {
 }
 
 export async function listDevices(token: string): Promise<DeviceInfo[]> {
-    const res = await fetch(`${API_BASE_URL}/devices`, { headers: getAuthHeaders(token) });
+    const res = await fetch(`${API_BASE_URL}/devices`, { headers: getAuthHeaders(token, true) });
     if (!res.ok) throw new Error("Failed to fetch devices");
     const data = await res.json();
     return data.devices as DeviceInfo[];
 }
 
 export async function revokeDevice(token: string, sessionId: string): Promise<void> {
-    const res = await fetch(`${API_BASE_URL}/devices/${sessionId}`, { method: "DELETE", headers: getAuthHeaders(token) });
+    const res = await fetch(`${API_BASE_URL}/devices/${sessionId}`, { method: "DELETE", headers: getAuthHeaders(token, true) });
     if (!res.ok) throw new Error("Failed to revoke device");
 }
 
 export async function logoutAllOtherDevices(token: string): Promise<void> {
-    const res = await fetch(`${API_BASE_URL}/devices/logout-all`, { method: "POST", headers: getAuthHeaders(token) });
+    const res = await fetch(`${API_BASE_URL}/devices/logout-all`, { method: "POST", headers: getAuthHeaders(token, true) });
     if (!res.ok) throw new Error("Failed to logout all devices");
 }
 
-

frontend/src/core/api/account/index.ts

@@ -1,12 +1,13 @@
-import type { Headers, UploadPublicKeyRequest, BackupBlob } from "@/core/types";
-import { generateX25519KeyPair } from "@/utils/crypto/asymmetric";
-import { encodeBlob, encryptBackupWithPassword, decryptBackupWithPassword, decodeBlob } from "@/utils/crypto/backup";
-import { b64, ub64 } from "@/utils/utils";
 import { API_BASE_URL } from "@/core/config";
-import { hkdfExtractAndExpand } from "@/utils/crypto/kdf";
+import type { LoginRequest, RegisterRequest, LoginResponse } from "@/core/types";
+import { generateX25519KeyPair, hkdfExtractAndExpand, encodeBlob, encryptBackupWithPassword, decryptBackupWithPassword, decodeBlob } from "@fromchat/protocol";
+import { b64, ub64 } from "@/utils/utils";
+import { fetchPublicKey, uploadPublicKey, fetchBackupBlob, uploadBackupBlob } from "../crypto";
+import type { Headers } from "@/core/types";
 
 /**
  * Generates authentication headers for API requests
+ * @param {string | null} token - Authentication token
  * @param {boolean} json - Whether to include JSON content type header
  * @returns {Headers} Headers object with authentication and content type
  */
@@ -23,54 +24,15 @@ export function getAuthHeaders(token: string | null, json: boolean = true): Head
     return headers;
 }
 
-let currentPublicKey: Uint8Array | null = null;
-let currentPrivateKey: Uint8Array | null = null;
-
-async function fetchPublicKey(token: string): Promise<Uint8Array | null> {
-	const headers = getAuthHeaders(token, true);
-	const res = await fetch(`${API_BASE_URL}/crypto/public-key`, { method: "GET", headers });
-	if (!res.ok) return null;
-	const data = await res.json();
-	if (!data?.publicKey) return null;
-	return ub64(data.publicKey);
+export interface CheckAuthResponse {
+    authenticated: boolean;
+    username: string;
+    admin: boolean;
 }
 
-async function uploadPublicKey(publicKey: Uint8Array, token: string): Promise<void> {
-	const payload: UploadPublicKeyRequest = {
-		publicKey: b64(publicKey)
-	}
-
-	const headers = getAuthHeaders(token, true);
-	await fetch(`${API_BASE_URL}/crypto/public-key`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(payload)
-	});
-}
-
-async function fetchBackupBlob(token: string): Promise<string | null> {
-	const headers = getAuthHeaders(token, true);
-	const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
-		method: "GET",
-		headers
-	});
-	if (res.ok) {
-		const response: BackupBlob = await res.json();
-		return response.blob;
-	} else {
-		return null;
-	}
-}
-
-async function uploadBackupBlob(blobJson: string, token: string): Promise<void> {
-	const payload: BackupBlob = { blob: blobJson }
-
-	const headers = getAuthHeaders(token, true);
-	await fetch(`${API_BASE_URL}/crypto/backup`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify(payload)
-	});
+export interface LogoutResponse {
+    status: string;
+    message: string;
 }
 
 export interface UserKeyPairMemory {
@@ -78,6 +40,9 @@ export interface UserKeyPairMemory {
 	privateKey: Uint8Array;
 }
 
+let currentPublicKey: Uint8Array | null = null;
+let currentPrivateKey: Uint8Array | null = null;
+
 export function getCurrentKeys(): UserKeyPairMemory | null {
 	if (currentPublicKey && currentPrivateKey) return { publicKey: currentPublicKey, privateKey: currentPrivateKey };
 	return null;
@@ -94,6 +59,72 @@ function saveKeys(
 	localStorage.setItem("privateKey", encodedPrivateKey);
 }
 
+/**
+ * Checks if the current user is authenticated
+ */
+export async function checkAuth(token: string): Promise<CheckAuthResponse> {
+    const res = await fetch(`${API_BASE_URL}/check_auth`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to check auth");
+    return await res.json();
+}
+
+/**
+ * Logs in a user with username and password
+ */
+export async function login(request: LoginRequest): Promise<LoginResponse> {
+    const res = await fetch(`${API_BASE_URL}/login`, {
+        method: "POST",
+        headers: getAuthHeaders(null, true),
+        body: JSON.stringify(request)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Login failed" }));
+        throw new Error(error.detail || "Login failed");
+    }
+    return await res.json();
+}
+
+/**
+ * Registers a new user
+ */
+export async function register(request: RegisterRequest): Promise<LoginResponse> {
+    const res = await fetch(`${API_BASE_URL}/register`, {
+        method: "POST",
+        headers: getAuthHeaders(null, true),
+        body: JSON.stringify(request)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Registration failed" }));
+        throw new Error(error.detail || "Registration failed");
+    }
+    return await res.json();
+}
+
+/**
+ * Logs out the current user
+ */
+export async function logout(token: string): Promise<LogoutResponse> {
+    const res = await fetch(`${API_BASE_URL}/logout`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to logout");
+    return await res.json();
+}
+
+/**
+ * Derive a client-side authentication secret so the raw password never leaves the client.
+ * Uses PBKDF2 (via WebCrypto) + HKDF to produce a stable 32-byte key, then base64.
+ */
+export async function deriveAuthSecret(username: string, password: string): Promise<string> {
+    // Use per-user salt derived from username; in future we can fetch a server-provided salt
+    const salt = new TextEncoder().encode(`fromchat.user:${username}`);
+    // Derive 32 bytes using HKDF; PBKDF2 already used within importPassword
+    const derived = await hkdfExtractAndExpand(new TextEncoder().encode(password), salt, new TextEncoder().encode("auth-secret"), 32);
+    return b64(derived);
+}
+
 export async function ensureKeysOnLogin(password: string, token: string): Promise<UserKeyPairMemory> {
 	// Try to restore from backup
 	const blobJson = await fetchBackupBlob(token);
@@ -147,13 +178,41 @@ export function getAuthToken(): string | null {
 }
 
 /**
- * Derive a client-side authentication secret so the raw password never leaves the client.
- * Uses PBKDF2 (via WebCrypto) + HKDF to produce a stable 32-byte key, then base64.
+ * Changes the user's password
  */
-export async function deriveAuthSecret(username: string, password: string): Promise<string> {
-    // Use per-user salt derived from username; in future we can fetch a server-provided salt
-    const salt = new TextEncoder().encode(`fromchat.user:${username}`);
-    // Derive 32 bytes using HKDF; PBKDF2 already used within importPassword
-    const derived = await hkdfExtractAndExpand(new TextEncoder().encode(password), salt, new TextEncoder().encode("auth-secret"), 32);
-    return b64(derived);
-}
+export async function changePassword(
+    token: string,
+    username: string,
+    currentPassword: string,
+    newPassword: string,
+    logoutAllExceptCurrent: boolean
+): Promise<void> {
+    const currentDerived = await deriveAuthSecret(username, currentPassword);
+    const newDerived = await deriveAuthSecret(username, newPassword);
+    const res = await fetch(`${API_BASE_URL}/change-password`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({
+            currentPasswordDerived: currentDerived,
+            newPasswordDerived: newDerived,
+            logoutAllExceptCurrent
+        })
+    });
+    if (!res.ok) throw new Error("Failed to change password");
+}
+
+/**
+ * Deletes the current user's account
+ */
+export async function deleteAccount(token: string): Promise<{ status: string; message: string }> {
+    const res = await fetch(`${API_BASE_URL}/account/delete`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Failed to delete account" }));
+        throw new Error(error.detail || "Failed to delete account");
+    }
+    return await res.json();
+}
+

frontend/src/core/api/account/profile.ts

@@ -0,0 +1,275 @@
+import { getAuthHeaders } from ".";
+import { API_BASE_URL } from "@/core/config";
+import type { UserProfile } from "@/core/types";
+
+export interface ProfileData {
+    profile_picture?: string;
+    username?: string;
+    display_name?: string;
+    description?: string;
+}
+
+export interface UploadResponse {
+    profile_picture_url: string;
+}
+
+/**
+ * Loads user profile data from the server
+ */
+export async function loadProfile(token: string): Promise<ProfileData | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/profile`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            const data = await response.json();
+            // Map backend fields to frontend fields
+            return {
+                profile_picture: data.profile_picture,
+                username: data.username,
+                display_name: data.display_name,
+                description: data.bio
+            };
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error loading profile:', error);
+        return null;
+    }
+}
+
+/**
+ * Uploads a profile picture to the server
+ */
+export async function uploadProfilePicture(token: string, file: Blob): Promise<UploadResponse | null> {
+    try {
+        const formData = new FormData();
+        formData.append('profile_picture', file, 'profile_picture.jpg');
+
+        const response = await fetch(`${API_BASE_URL}/upload-profile-picture`, {
+            method: 'POST',
+            body: formData,
+            headers: getAuthHeaders(token, false)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+        return null;
+    } catch (error) {
+        console.error('Upload error:', error);
+        return null;
+    }
+}
+
+/**
+ * Updates user profile information
+ */
+export async function updateProfile(token: string, data: Partial<ProfileData>): Promise<boolean> {
+    try {
+        // Map frontend fields to backend fields
+        const backendData = {
+            username: data.username,
+            display_name: data.display_name,
+            description: data.description
+        };
+
+        const response = await fetch(`${API_BASE_URL}/user/profile`, {
+            method: 'PUT',
+            headers: {
+                ...getAuthHeaders(token, true),
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify(backendData)
+        });
+
+        return response.ok;
+    } catch (error) {
+        console.error('Error updating profile:', error);
+        return false;
+    }
+}
+
+/**
+ * Updates user bio
+ */
+export async function updateBio(token: string, bio: string): Promise<boolean> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/bio`, {
+            method: 'PUT',
+            headers: getAuthHeaders(token, true),
+            body: JSON.stringify({ bio })
+        });
+
+        return response.ok;
+    } catch (error) {
+        console.error('Error updating bio:', error);
+        return false;
+    }
+}
+
+/**
+ * Fetches user profile data by username
+ */
+export async function fetchUserProfile(token: string, username: string): Promise<UserProfile | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${username}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error fetching user profile:', error);
+        return null;
+    }
+}
+
+/**
+ * Fetches user profile data by user ID
+ */
+export async function fetchUserProfileById(token: string, userId: number): Promise<UserProfile | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/id/${userId}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error fetching user profile by ID:', error);
+        return null;
+    }
+}
+
+/**
+ * Toggles verification status for a user (owner only)
+ */
+export async function verifyUser(userId: number, token: string): Promise<{verified: boolean} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/verify`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error verifying user:', error);
+        return null;
+    }
+}
+
+/**
+ * In-memory cache for user similarity results
+ * Key: userId, Value: similarity result
+ */
+const similarityCache = new Map<number, {isSimilar: boolean, similarTo?: string} | null>();
+
+/**
+ * Checks if a user is similar to any verified user
+ * Results are cached in memory to avoid redundant API calls
+ */
+export async function checkUserSimilarity(userId: number, token: string): Promise<{isSimilar: boolean, similarTo?: string} | null> {
+    // Check cache first
+    if (similarityCache.has(userId)) {
+        return similarityCache.get(userId) ?? null;
+    }
+
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/check-similarity/${userId}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        let result: {isSimilar: boolean, similarTo?: string} | null = null;
+        if (response.ok) {
+            result = await response.json();
+        }
+
+        // Cache the result (even if null/error)
+        similarityCache.set(userId, result);
+        return result;
+    } catch (error) {
+        console.error('Error checking user similarity:', error);
+        const result: null = null;
+        // Cache null result to avoid retrying on errors
+        similarityCache.set(userId, result);
+        return result;
+    }
+}
+
+/**
+ * Suspends a user account (admin only)
+ */
+export async function suspendUser(userId: number, reason: string, token: string): Promise<{status: string; message: string; reason: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/suspend`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true),
+            body: JSON.stringify({ reason })
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error suspending user:', error);
+        return null;
+    }
+}
+
+/**
+ * Unsuspends a user account (admin only)
+ */
+export async function unsuspendUser(userId: number, token: string): Promise<{status: string; message: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/unsuspend`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error unsuspending user:', error);
+        return null;
+    }
+}
+
+/**
+ * Deletes a user account (admin only)
+ */
+export async function deleteUser(userId: number, token: string): Promise<{status: string; message: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/delete`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error deleting user:', error);
+        return null;
+    }
+}
+

frontend/src/core/api/calls.ts

@@ -0,0 +1,16 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./user/auth";
+import type { IceServersResponse } from "@/core/types";
+
+/**
+ * Fetches ICE server configuration for WebRTC
+ */
+export async function iceServers(token: string): Promise<IceServersResponse> {
+    const res = await fetch(`${API_BASE_URL}/webrtc/ice`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to fetch ICE servers");
+    return await res.json();
+}
+
+

frontend/src/core/api/chats/dm.ts

@@ -0,0 +1,153 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+import { getCurrentKeys } from "../user/auth";
+import { request } from "@/core/websocket";
+import type { SendDMRequest, DmEnvelope, DMEditRequest, BaseDmEnvelope, User } from "@/core/types";
+import { b64, ub64 } from "@/utils/utils";
+import { fetchUserPublicKey } from "../crypto/identity";
+import { fetchUsers, searchUsers } from "../user/search";
+import { getOrInitProtocol } from "@/utils/crypto/fromchatInit";
+import { ecdhSharedSecret, deriveWrappingKey, importAesGcmKey, aesGcmEncrypt, randomBytes } from "@fromchat/protocol";
+
+export async function decrypt(envelope: DmEnvelope, senderPublicKeyB64: string): Promise<string> {
+    const protocol = getOrInitProtocol();
+    const senderPublicKey = ub64(senderPublicKeyB64);
+    
+    return await protocol.decryptMessage(senderPublicKey, envelope);
+}
+
+export async function fetchMessages(userId: number, token: string, limit: number = 50, beforeId?: number): Promise<{ messages: DmEnvelope[]; has_more: boolean }> {
+    let url = `${API_BASE_URL}/dm/history/${userId}?limit=${limit}`;
+    if (beforeId) {
+        url += `&before_id=${beforeId}`;
+    }
+    const response = await globalThis.fetch(url, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!response.ok) return { messages: [], has_more: false };
+    const data = await response.json();
+    return { messages: data.messages || [], has_more: data.has_more ?? false };
+}
+
+export async function send(recipientId: number, recipientPublicKeyB64: string, plaintext: string, authToken: string, replyToId?: number): Promise<void> {
+    const protocol = getOrInitProtocol();
+    const recipientPublicKey = ub64(recipientPublicKeyB64);
+    
+    const encrypted = await protocol.encryptMessage(recipientPublicKey, plaintext);
+    
+    const payload: SendDMRequest = {
+        recipientId: recipientId,
+        ...encrypted
+    };
+    if (replyToId) payload.replyToId = replyToId;
+
+    await request({
+        type: "dmSend",
+        credentials: {
+            scheme: "Bearer",
+            credentials: authToken
+        },
+        data: payload
+    });
+}
+
+export async function sendWithFiles(recipientId: number, recipientPublicKeyB64: string, plaintextJson: string, files: File[], token: string): Promise<void> {
+    // For files, we need to use the same message key for both the message and files
+    // So we'll do the encryption manually here to reuse the mk
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    const mk = randomBytes(32);
+    const wkSalt = randomBytes(16);
+    const shared = ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+    const wrap = await aesGcmEncrypt(wk, mk);
+
+    const form = new FormData();
+    const names: string[] = [];
+    function sliceBuffer(u8: Uint8Array): ArrayBuffer {
+        return (u8.buffer as ArrayBuffer).slice(u8.byteOffset, u8.byteOffset + u8.byteLength);
+    }
+
+    for (const f of files) {
+        // Encrypt file with same mk
+        const data = new Uint8Array(await f.arrayBuffer());
+        const enc = await aesGcmEncrypt(await importAesGcmKey(mk), data);
+        const blob = new Blob([sliceBuffer(enc.iv), sliceBuffer(enc.ciphertext)], { type: "application/octet-stream" });
+        const serverName = f.name;
+        names.push(serverName);
+        form.append("files", new File([blob], serverName));
+    }
+    form.append("fileNames", JSON.stringify(names));
+
+    // Encrypt the plaintext JSON with the same mk
+    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(plaintextJson));
+    form.append("dm_payload", JSON.stringify({
+        recipientId: recipientId,
+        iv: b64(encMsg.iv),
+        ciphertext: b64(encMsg.ciphertext),
+        salt: b64(wkSalt),
+        iv2: b64(wrap.iv),
+        wrappedMk: b64(wrap.ciphertext)
+    } satisfies BaseDmEnvelope));
+
+    await globalThis.fetch(`${API_BASE_URL}/dm/send`, {
+        method: "POST",
+        headers: getAuthHeaders(token, false),
+        body: form
+    });
+}
+
+export async function edit(id: number, recipientPublicKeyB64: string, newPlaintextJson: string, authToken: string): Promise<void> {
+    const protocol = getOrInitProtocol();
+    const recipientPublicKey = ub64(recipientPublicKeyB64);
+    
+    const encrypted = await protocol.encryptMessage(recipientPublicKey, newPlaintextJson);
+
+    await request({
+        type: "dmEdit",
+        credentials: { scheme: "Bearer", credentials: authToken },
+        data: {
+            id,
+            ...encrypted
+        }
+    } as DMEditRequest);
+}
+
+export async function deleteMessage(id: number, recipientId: number, authToken: string): Promise<void> {
+    await request({
+        type: "dmDelete",
+        credentials: { scheme: "Bearer", credentials: authToken },
+        data: { id, recipientId }
+    });
+}
+
+export interface ConversationResponse {
+    user: User;
+    lastMessage: DmEnvelope;
+    unreadCount: number;
+}
+
+export async function conversations(token: string): Promise<ConversationResponse[]> {
+    const res = await fetch(`${API_BASE_URL}/dm/conversations`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.conversations || [];
+}
+
+/**
+ * Marks a DM as read
+ */
+export async function markRead(id: number, authToken: string): Promise<void> {
+    await request({
+        type: "dmMarkRead",
+        credentials: { scheme: "Bearer", credentials: authToken },
+        data: { id }
+    });
+}
+
+// Re-export user functions for convenience
+export { fetchUsers, searchUsers, fetchUserPublicKey };

frontend/src/core/api/chats/general.ts

@@ -0,0 +1,99 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+import type { Message, Messages, SendMessageRequest } from "@/core/types";
+import { request } from "@/core/websocket";
+
+/**
+ * Fetches public chat messages
+ */
+export async function fetchMessages(token: string, limit: number = 50, beforeId?: number): Promise<{ messages: Message[]; has_more: boolean }> {
+    let url = `${API_BASE_URL}/get_messages?limit=${limit}`;
+    if (beforeId) {
+        url += `&before_id=${beforeId}`;
+    }
+    const response = await globalThis.fetch(url, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!response.ok) return { messages: [], has_more: false };
+    const data: Messages & { has_more?: boolean } = await response.json();
+    return { messages: data.messages || [], has_more: data.has_more ?? false };
+}
+
+/**
+ * Sends a public chat message via WebSocket
+ */
+export async function send(content: string, replyToId: number | null, authToken: string): Promise<void> {
+    await request({
+        data: {
+            content: content.trim(),
+            reply_to_id: replyToId ?? null
+        },
+        credentials: {
+            scheme: "Bearer",
+            credentials: authToken
+        },
+        type: "sendMessage"
+    } satisfies SendMessageRequest);
+}
+
+/**
+ * Sends a public chat message with files via HTTP
+ */
+export async function sendWithFiles(
+    content: string,
+    replyToId: number | null,
+    files: File[],
+    authToken: string
+): Promise<void> {
+    const form = new FormData();
+    form.append("payload", JSON.stringify({
+        content: content.trim(),
+        reply_to_id: replyToId ?? null
+    } satisfies SendMessageRequest["data"]));
+    for (const f of files) form.append("files", f, f.name);
+    const res = await globalThis.fetch(`${API_BASE_URL}/send_message`, {
+        method: "POST",
+        headers: getAuthHeaders(authToken, false),
+        body: form
+    });
+    if (!res.ok) {
+        const error = await res.text();
+        throw new Error(error || "Failed to send message with files");
+    }
+}
+
+/**
+ * Edits a public chat message
+ */
+export async function edit(messageId: number, newContent: string, authToken: string): Promise<void> {
+    const res = await globalThis.fetch(`${API_BASE_URL}/edit_message/${messageId}`, {
+        method: "PUT",
+        headers: getAuthHeaders(authToken, true),
+        body: JSON.stringify({ content: newContent })
+    });
+    if (!res.ok) throw new Error("Failed to edit message");
+}
+
+/**
+ * Deletes a public chat message
+ */
+export async function deleteMessage(messageId: number, authToken: string): Promise<void> {
+    const res = await globalThis.fetch(`${API_BASE_URL}/delete_message/${messageId}`, {
+        method: "DELETE",
+        headers: getAuthHeaders(authToken, true)
+    });
+    if (!res.ok) throw new Error("Failed to delete message");
+}
+
+/**
+ * Marks a message as read
+ */
+export async function markRead(messageId: number, authToken: string): Promise<void> {
+    const res = await globalThis.fetch(`${API_BASE_URL}/messages/mark_read`, {
+        method: "POST",
+        headers: getAuthHeaders(authToken, true),
+        body: JSON.stringify({ message_id: messageId })
+    });
+    if (!res.ok) throw new Error("Failed to mark message as read");
+}
+

frontend/src/core/api/crypto.ts

@@ -0,0 +1,76 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./account";
+import type { UploadPublicKeyRequest, BackupBlob } from "@/core/types";
+import { b64, ub64 } from "@/utils/utils";
+
+/**
+ * Fetches the current user's public key
+ */
+export async function fetchPublicKey(token: string): Promise<Uint8Array | null> {
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key`, { method: "GET", headers });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (!data?.publicKey) return null;
+    return ub64(data.publicKey);
+}
+
+/**
+ * Uploads the current user's public key
+ */
+export async function uploadPublicKey(publicKey: Uint8Array, token: string): Promise<void> {
+    const payload: UploadPublicKeyRequest = {
+        publicKey: b64(publicKey)
+    }
+
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload)
+    });
+    if (!res.ok) throw new Error("Failed to upload public key");
+}
+
+/**
+ * Fetches another user's public key by user ID
+ */
+export async function fetchUserPublicKey(userId: number, token: string): Promise<string | null> {
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key/of/${userId}`, { headers: getAuthHeaders(token, true) });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.publicKey;
+}
+
+/**
+ * Fetches the current user's backup blob
+ */
+export async function fetchBackupBlob(token: string): Promise<string | null> {
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
+        method: "GET",
+        headers
+    });
+    if (res.ok) {
+        const response: BackupBlob = await res.json();
+        return response.blob;
+    } else {
+        return null;
+    }
+}
+
+/**
+ * Uploads the current user's backup blob
+ */
+export async function uploadBackupBlob(blobJson: string, token: string): Promise<void> {
+    const payload: BackupBlob = { blob: blobJson }
+
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload)
+    });
+    if (!res.ok) throw new Error("Failed to upload backup blob");
+}
+

frontend/src/core/api/crypto/backup.ts

@@ -0,0 +1,37 @@
+import { API_BASE_URL } from "@/core/config";
+import type { BackupBlob } from "@/core/types";
+import api from "@/core/api";
+
+/**
+ * Fetches the current user's backup blob
+ */
+export async function fetchBackupBlob(token: string): Promise<string | null> {
+    const headers = api.user.auth.getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
+        method: "GET",
+        headers
+    });
+    if (res.ok) {
+        const response: BackupBlob = await res.json();
+        return response.blob;
+    } else {
+        return null;
+    }
+}
+
+/**
+ * Uploads the current user's backup blob
+ */
+export async function uploadBackupBlob(blobJson: string, token: string): Promise<void> {
+    const payload: BackupBlob = { blob: blobJson }
+
+    const headers = api.user.auth.getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload)
+    });
+    if (!res.ok) throw new Error("Failed to upload backup blob");
+}
+
+

frontend/src/core/api/crypto/identity.ts

@@ -0,0 +1,45 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+import type { UploadPublicKeyRequest } from "@/core/types";
+import { b64, ub64 } from "@/utils/utils";
+
+/**
+ * Fetches the current user's public key
+ */
+export async function fetchPublicKey(token: string): Promise<Uint8Array | null> {
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key`, { method: "GET", headers });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (!data?.publicKey) return null;
+    return ub64(data.publicKey);
+}
+
+/**
+ * Uploads the current user's public key
+ */
+export async function uploadPublicKey(publicKey: Uint8Array, token: string): Promise<void> {
+    const payload: UploadPublicKeyRequest = {
+        publicKey: b64(publicKey)
+    }
+
+    const headers = getAuthHeaders(token, true);
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key`, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(payload)
+    });
+    if (!res.ok) throw new Error("Failed to upload public key");
+}
+
+/**
+ * Fetches another user's public key by user ID
+ */
+export async function fetchUserPublicKey(userId: number, token: string): Promise<string | null> {
+    const res = await fetch(`${API_BASE_URL}/crypto/public-key/of/${userId}`, { headers: getAuthHeaders(token, true) });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.publicKey;
+}
+
+

frontend/src/core/api/crypto/prekeys.ts

@@ -0,0 +1,14 @@
+// Placeholder for Signal Protocol pre-key management
+// Will be implemented when Signal Protocol is added
+
+export async function upload(_bundle: unknown, _token: string): Promise<void> {
+    // TODO: Implement Signal Protocol pre-key upload
+    throw new Error("Not implemented yet");
+}
+
+export async function fetch(_userId: number, _token: string): Promise<unknown> {
+    // TODO: Implement Signal Protocol pre-key fetch
+    throw new Error("Not implemented yet");
+}
+
+

frontend/src/core/api/dm.ts

@@ -0,0 +1,176 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./account";
+import { ecdhSharedSecret, deriveWrappingKey, importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, randomBytes } from "@fromchat/protocol";
+import { getCurrentKeys } from "./account";
+import { request } from "@/core/websocket";
+import type { SendDMRequest, DmEnvelope, DMEditRequest, DmEncryptedJSON, BaseDmEnvelope, User } from "@/core/types";
+import { b64, ub64 } from "@/utils/utils";
+import { fetchUserPublicKey } from "./crypto";
+import { fetchUsers, searchUsers } from "./users";
+
+export async function decryptDm(envelope: DmEnvelope, senderPublicKeyB64: string): Promise<string> {
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    // Obtain the key
+    const shared = ecdhSharedSecret(keys.privateKey, ub64(senderPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, ub64(envelope.salt), new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+    const mk = await aesGcmDecrypt(wk, ub64(envelope.iv2), ub64(envelope.wrappedMk));
+
+    // Decrypt
+    const msg = await aesGcmDecrypt(await importAesGcmKey(mk), ub64(envelope.iv), ub64(envelope.ciphertext));
+    return new TextDecoder().decode(msg);
+}
+
+export async function fetchDMHistory(userId: number, token: string, limit: number = 50): Promise<DmEnvelope[]> {
+    const response = await fetch(`${API_BASE_URL}/dm/history/${userId}?limit=${limit}`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!response.ok) return [];
+    const data = await response.json();
+    return data.messages || [];
+}
+
+// Re-export user functions for convenience
+export { fetchUsers, searchUsers, fetchUserPublicKey };
+
+export async function sendDMViaWebSocket(recipientId: number, recipientPublicKeyB64: string, plaintext: string, authToken: string, replyToId?: number): Promise<void> {
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    // Encryption key
+    const mk = randomBytes(32);
+    const wkSalt = randomBytes(16);
+    const shared = ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+
+    // Encrypt the message
+    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(plaintext));
+    const wrap = await aesGcmEncrypt(wk, mk);
+
+    const payload: SendDMRequest = {
+        recipientId: recipientId,
+        iv: b64(encMsg.iv),
+        ciphertext: b64(encMsg.ciphertext),
+        salt: b64(wkSalt),
+        iv2: b64(wrap.iv),
+        wrappedMk: b64(wrap.ciphertext)
+    };
+    if (replyToId) payload.replyToId = replyToId;
+
+    await request({
+        type: "dmSend",
+        credentials: {
+            scheme: "Bearer",
+            credentials: authToken
+        },
+        data: payload
+    });
+}
+
+export async function sendDmWithFiles(recipientId: number, recipientPublicKeyB64: string, plaintextJson: string, files: File[], token: string): Promise<void> {
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    const mk = randomBytes(32);
+    const wkSalt = randomBytes(16);
+    const shared = await ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+
+    const wrap = await aesGcmEncrypt(wk, mk);
+
+    const form = new FormData();
+    const names: string[] = [];
+    function sliceBuffer(u8: Uint8Array): ArrayBuffer {
+        return (u8.buffer as ArrayBuffer).slice(u8.byteOffset, u8.byteOffset + u8.byteLength);
+    }
+
+    for (const f of files) {
+        // Encrypt file with same mk
+        const data = new Uint8Array(await f.arrayBuffer());
+        const enc = await aesGcmEncrypt(await importAesGcmKey(mk), data);
+        const blob = new Blob([sliceBuffer(enc.iv), sliceBuffer(enc.ciphertext)], { type: "application/octet-stream" });
+        const serverName = f.name; // server uses provided name
+        names.push(serverName);
+        form.append("files", new File([blob], serverName));
+    }
+    form.append("fileNames", JSON.stringify(names));
+
+    // Merge files metadata into plaintext JSON and encrypt
+    let obj: DmEncryptedJSON;
+    try {
+        obj = JSON.parse(plaintextJson);
+    } catch {
+        obj = { type: "text", data: { content: String(plaintextJson) } };
+    }
+
+    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(JSON.stringify(obj)));
+    form.append("dm_payload", JSON.stringify({
+        recipientId: recipientId,
+        iv: b64(encMsg.iv),
+        ciphertext: b64(encMsg.ciphertext),
+        salt: b64(wkSalt),
+        iv2: b64(wrap.iv),
+        wrappedMk: b64(wrap.ciphertext)
+    } satisfies BaseDmEnvelope));
+
+    await fetch(`${API_BASE_URL}/dm/send`, {
+        method: "POST",
+        headers: getAuthHeaders(token, false),
+        body: form
+    });
+}
+
+export async function editDmEnvelope(id: number, recipientPublicKeyB64: string, newPlaintextJson: string, authToken: string): Promise<void> {
+    const keys = getCurrentKeys();
+    if (!keys) throw new Error("Keys not initialized");
+
+    // We cannot reuse the old mk safely without knowing it; generate a fresh mk and wrap
+    const mk = randomBytes(32);
+    const wkSalt = randomBytes(16);
+    const shared = await ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
+    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+    const wk = await importAesGcmKey(wkRaw);
+    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(newPlaintextJson));
+    const wrap = await aesGcmEncrypt(wk, mk);
+
+    await request({
+        type: "dmEdit",
+        credentials: { scheme: "Bearer", credentials: authToken },
+        data: {
+            id,
+            iv: b64(encMsg.iv),
+            ciphertext: b64(encMsg.ciphertext),
+            iv2: b64(wrap.iv),
+            wrappedMk: b64(wrap.ciphertext),
+            salt: b64(wkSalt)
+        }
+    } as DMEditRequest);
+}
+
+export async function deleteDmEnvelope(id: number, recipientId: number, authToken: string): Promise<void> {
+    await request({
+        type: "dmDelete",
+        credentials: { scheme: "Bearer", credentials: authToken },
+        data: { id, recipientId }
+    });
+}
+
+export interface DMConversationResponse {
+    user: User;
+    lastMessage: DmEnvelope;
+    unreadCount: number;
+}
+
+export async function fetchDMConversations(token: string): Promise<DMConversationResponse[]> {
+    const res = await fetch(`${API_BASE_URL}/dm/conversations`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.conversations || [];
+}
+

frontend/src/core/api/dmApi.ts

@@ -1,12 +1,12 @@
 import { API_BASE_URL } from "@/core/config";
-import { getAuthHeaders } from "./authApi";
-import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
-import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "@/utils/crypto/symmetric";
-import { randomBytes } from "@/utils/crypto/kdf";
-import { getCurrentKeys } from "./authApi";
+import { getAuthHeaders } from "./account";
+import { ecdhSharedSecret, deriveWrappingKey, importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, randomBytes } from "@fromchat/protocol";
+import { getCurrentKeys } from "./account";
 import { request } from "@/core/websocket";
-import type { SendDMRequest, DmEnvelope, User, DMEditRequest, DmEncryptedJSON, BaseDmEnvelope } from "@/core/types";
+import type { SendDMRequest, DmEnvelope, DMEditRequest, DmEncryptedJSON, BaseDmEnvelope, User } from "@/core/types";
 import { b64, ub64 } from "@/utils/utils";
+import { fetchUserPublicKey } from "./crypto";
+import { fetchUsers, searchUsers } from "./users";
 
 export async function decryptDm(envelope: DmEnvelope, senderPublicKeyB64: string): Promise<string> {
     const keys = getCurrentKeys();
@@ -23,20 +23,6 @@ export async function decryptDm(envelope: DmEnvelope, senderPublicKeyB64: string
     return new TextDecoder().decode(msg);
 }
 
-export async function fetchUsers(token: string): Promise<User[]> {
-    const res = await fetch(`${API_BASE_URL}/users`, { headers: getAuthHeaders(token, true) });
-    if (!res.ok) return [];
-    const data = await res.json();
-    return data.users || [];
-}
-
-export async function fetchUserPublicKey(userId: number, token: string): Promise<string | null> {
-    const res = await fetch(`${API_BASE_URL}/crypto/public-key/of/${userId}`, { headers: getAuthHeaders(token, true) });
-    if (!res.ok) return null;
-    const data = await res.json();
-    return data.publicKey;
-}
-
 export async function fetchDMHistory(userId: number, token: string, limit: number = 50): Promise<DmEnvelope[]> {
     const response = await fetch(`${API_BASE_URL}/dm/history/${userId}?limit=${limit}`, {
         headers: getAuthHeaders(token, true)
@@ -46,6 +32,9 @@ export async function fetchDMHistory(userId: number, token: string, limit: numbe
     return data.messages || [];
 }
 
+// Re-export user functions for convenience
+export { fetchUsers, searchUsers, fetchUserPublicKey };
+
 export async function sendDMViaWebSocket(recipientId: number, recipientPublicKeyB64: string, plaintext: string, authToken: string, replyToId?: number): Promise<void> {
     const keys = getCurrentKeys();
     if (!keys) throw new Error("Keys not initialized");
@@ -185,13 +174,3 @@ export async function fetchDMConversations(token: string): Promise<DMConversatio
     return data.conversations || [];
 }
 
-export async function searchUsers(query: string, token: string): Promise<User[]> {
-    if (query.length < 2) return [];
-
-    const res = await fetch(`${API_BASE_URL}/users/search?q=${encodeURIComponent(query)}`, {
-        headers: getAuthHeaders(token, true)
-    });
-    if (!res.ok) return [];
-    const data = await res.json();
-    return data.users || [];
-}

frontend/src/core/api/files.ts

@@ -0,0 +1,43 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./user/auth";
+
+export const normal = {
+    /**
+     * Gets the URL for a normal (unencrypted) file
+     */
+    url(filename: string): string {
+        return `${API_BASE_URL}/uploads/files/normal/${filename}`;
+    },
+
+    /**
+     * Fetches a normal file (unencrypted)
+     */
+    async fetch(filename: string, token: string): Promise<Blob> {
+        const res = await fetch(this.url(filename), {
+            headers: getAuthHeaders(token, false)
+        });
+        if (!res.ok) throw new Error("Failed to fetch file");
+        return await res.blob();
+    }
+};
+
+export const encrypted = {
+    /**
+     * Gets the URL for an encrypted file
+     */
+    url(filename: string): string {
+        return `${API_BASE_URL}/uploads/files/encrypted/${filename}`;
+    },
+
+    /**
+     * Fetches an encrypted file
+     */
+    async fetch(filename: string, token: string): Promise<Blob> {
+        const res = await fetch(this.url(filename), {
+            headers: getAuthHeaders(token, false)
+        });
+        if (!res.ok) throw new Error("Failed to fetch encrypted file");
+        return await res.blob();
+    }
+};
+

frontend/src/core/api/index.ts

@@ -0,0 +1,50 @@
+import * as chatsGeneral from "./chats/general";
+import * as chatsDm from "./chats/dm";
+import * as userProfile from "./user/profile";
+import * as userAuth from "./user/auth";
+import * as userDevices from "./user/devices";
+import * as userSearch from "./user/search";
+import * as cryptoPrekeys from "./crypto/prekeys";
+import * as cryptoIdentity from "./crypto/identity";
+import * as cryptoBackup from "./crypto/backup";
+import * as moderationBlocklist from "./moderation/blocklist";
+import * as moderationUsers from "./moderation/users";
+import * as callsModule from "./calls";
+import * as filesModule from "./files";
+import * as pushModule from "./push";
+
+const api = {
+    chats: {
+        general: chatsGeneral,
+        dm: chatsDm
+    },
+    user: {
+        profile: userProfile,
+        auth: userAuth,
+        devices: userDevices,
+        search: userSearch
+    },
+    crypto: {
+        prekeys: cryptoPrekeys,
+        identity: cryptoIdentity,
+        backup: cryptoBackup
+    },
+    moderation: {
+        blocklist: moderationBlocklist,
+        users: moderationUsers
+    },
+    calls: callsModule,
+    files: filesModule,
+    push: pushModule
+};
+
+export default api;
+
+export const chats = api.chats;
+export const user = api.user;
+export const crypto = api.crypto;
+export const moderation = api.moderation;
+export const calls = api.calls;
+export const files = api.files;
+export const push = api.push;
+

frontend/src/core/api/messaging.ts

@@ -0,0 +1,116 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./account";
+import type { Message, Messages, SendMessageRequest } from "@/core/types";
+import { request } from "@/core/websocket";
+
+class HttpError extends Error {
+    status: number;
+    detail: string;
+
+    constructor(message: string, status: number, detail: string) {
+        super(message);
+        this.name = "HttpError";
+        this.status = status;
+        this.detail = detail;
+    }
+}
+
+/**
+ * Fetches public chat messages
+ */
+export async function fetchMessages(token: string, limit: number = 50, beforeId?: number): Promise<Message[]> {
+    let url = `${API_BASE_URL}/get_messages?limit=${limit}`;
+    if (beforeId) {
+        url += `&before_id=${beforeId}`;
+    }
+    const response = await fetch(url, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!response.ok) return [];
+    const data: Messages = await response.json();
+    return data.messages || [];
+}
+
+/**
+ * Sends a public chat message via WebSocket
+ */
+export async function sendMessage(content: string, replyToId: number | null, authToken: string): Promise<void> {
+    await request({
+        data: {
+            content: content.trim(),
+            reply_to_id: replyToId ?? null
+        },
+        credentials: {
+            scheme: "Bearer",
+            credentials: authToken
+        },
+        type: "sendMessage"
+    } satisfies SendMessageRequest);
+}
+
+/**
+ * Sends a public chat message with files via HTTP
+ */
+export async function sendMessageWithFiles(
+    content: string,
+    replyToId: number | null,
+    files: File[],
+    authToken: string
+): Promise<void> {
+    const form = new FormData();
+    form.append("payload", JSON.stringify({
+        content: content.trim(),
+        reply_to_id: replyToId ?? null
+    } satisfies SendMessageRequest["data"]));
+    for (const f of files) form.append("files", f, f.name);
+    const res = await fetch(`${API_BASE_URL}/send_message`, {
+        method: "POST",
+        headers: getAuthHeaders(authToken, false),
+        body: form
+    });
+    if (!res.ok) {
+        let errorDetail = "Failed to send message with files";
+        try {
+            const errorJson = await res.json();
+            errorDetail = errorJson.detail || errorDetail;
+        } catch {
+            const errorText = await res.text();
+            errorDetail = errorText || errorDetail;
+        }
+        throw new HttpError(errorDetail, res.status, errorDetail);
+    }
+}
+
+/**
+ * Edits a public chat message
+ */
+export async function editMessage(messageId: number, newContent: string, authToken: string): Promise<void> {
+    const res = await fetch(`${API_BASE_URL}/edit_message/${messageId}`, {
+        method: "PUT",
+        headers: getAuthHeaders(authToken, true),
+        body: JSON.stringify({ content: newContent })
+    });
+    if (!res.ok) {
+        let errorDetail = "Failed to edit message";
+        try {
+            const errorJson = await res.json();
+            errorDetail = errorJson.detail || errorDetail;
+        } catch {
+            const errorText = await res.text();
+            errorDetail = errorText || errorDetail;
+        }
+        throw new HttpError(errorDetail, res.status, errorDetail);
+    }
+}
+
+/**
+ * Deletes a public chat message
+ */
+export async function deleteMessage(messageId: number, authToken: string): Promise<void> {
+    const res = await fetch(`${API_BASE_URL}/delete_message/${messageId}`, {
+        method: "DELETE",
+        headers: getAuthHeaders(authToken, true)
+    });
+    if (!res.ok) throw new Error("Failed to delete message");
+}
+

frontend/src/core/api/moderation.ts

@@ -0,0 +1,54 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./account";
+
+export interface BlocklistResponse {
+    words: string[];
+}
+
+export interface BlocklistUpdateRequest {
+    words: string[];
+}
+
+export interface BlocklistUpdateResponse {
+    added?: string[];
+    removed?: string[];
+    words: string[];
+}
+
+/**
+ * Fetches the current blocklist (admin only)
+ */
+export async function getBlocklist(token: string): Promise<BlocklistResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to fetch blocklist");
+    return await res.json();
+}
+
+/**
+ * Adds words to the blocklist (admin only)
+ */
+export async function addToBlocklist(words: string[], token: string): Promise<BlocklistUpdateResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({ words })
+    });
+    if (!res.ok) throw new Error("Failed to add to blocklist");
+    return await res.json();
+}
+
+/**
+ * Removes words from the blocklist (admin only)
+ */
+export async function removeFromBlocklist(words: string[], token: string): Promise<BlocklistUpdateResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        method: "DELETE",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({ words })
+    });
+    if (!res.ok) throw new Error("Failed to remove from blocklist");
+    return await res.json();
+}
+

frontend/src/core/api/moderation/blocklist.ts

@@ -0,0 +1,55 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+
+export interface BlocklistResponse {
+    words: string[];
+}
+
+export interface BlocklistUpdateRequest {
+    words: string[];
+}
+
+export interface BlocklistUpdateResponse {
+    added?: string[];
+    removed?: string[];
+    words: string[];
+}
+
+/**
+ * Fetches the current blocklist (admin only)
+ */
+export async function get(token: string): Promise<BlocklistResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to fetch blocklist");
+    return await res.json();
+}
+
+/**
+ * Adds words to the blocklist (admin only)
+ */
+export async function add(words: string[], token: string): Promise<BlocklistUpdateResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({ words })
+    });
+    if (!res.ok) throw new Error("Failed to add to blocklist");
+    return await res.json();
+}
+
+/**
+ * Removes words from the blocklist (admin only)
+ */
+export async function remove(words: string[], token: string): Promise<BlocklistUpdateResponse> {
+    const res = await fetch(`${API_BASE_URL}/moderation/blocklist`, {
+        method: "DELETE",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({ words })
+    });
+    if (!res.ok) throw new Error("Failed to remove from blocklist");
+    return await res.json();
+}
+
+

frontend/src/core/api/moderation/users.ts

@@ -0,0 +1,89 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "../user/auth";
+
+/**
+ * Toggles verification status for a user (owner only)
+ */
+export async function verify(userId: number, token: string): Promise<{verified: boolean} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/verify`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error verifying user:', error);
+        return null;
+    }
+}
+
+/**
+ * Suspends a user account (admin only)
+ */
+export async function suspend(userId: number, reason: string, token: string): Promise<{status: string; message: string; reason: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/suspend`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true),
+            body: JSON.stringify({ reason })
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error suspending user:', error);
+        return null;
+    }
+}
+
+/**
+ * Unsuspends a user account (admin only)
+ */
+export async function unsuspend(userId: number, token: string): Promise<{status: string; message: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/unsuspend`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error unsuspending user:', error);
+        return null;
+    }
+}
+
+/**
+ * Deletes a user account (admin only)
+ */
+export async function deleteUser(userId: number, token: string): Promise<{status: string; message: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/delete`, {
+            method: 'POST',
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error deleting user:', error);
+        return null;
+    }
+}
+
+

frontend/src/core/api/profileApi.ts

@@ -1,4 +1,4 @@
-import { getAuthHeaders } from "./authApi";
+import { getAuthHeaders } from "./account";
 import { API_BASE_URL } from "@/core/config";
 import type { UserProfile } from "@/core/types";
 
@@ -171,22 +171,104 @@ export async function verifyUser(userId: number, token: string): Promise<{verifi
     }
 }
 
+/**
+ * In-memory cache for user similarity results
+ * Key: userId, Value: similarity result
+ */
+const similarityCache = new Map<number, {isSimilar: boolean, similarTo?: string} | null>();
+
 /**
  * Checks if a user is similar to any verified user
+ * Results are cached in memory to avoid redundant API calls
  */
 export async function checkUserSimilarity(userId: number, token: string): Promise<{isSimilar: boolean, similarTo?: string} | null> {
+    // Check cache first
+    if (similarityCache.has(userId)) {
+        return similarityCache.get(userId) ?? null;
+    }
+
     try {
         const response = await fetch(`${API_BASE_URL}/user/check-similarity/${userId}`, {
             headers: getAuthHeaders(token)
         });
 
+        let result: {isSimilar: boolean, similarTo?: string} | null = null;
+        if (response.ok) {
+            result = await response.json();
+        }
+
+        // Cache the result (even if null/error)
+        similarityCache.set(userId, result);
+        return result;
+    } catch (error) {
+        console.error('Error checking user similarity:', error);
+        const result: null = null;
+        // Cache null result to avoid retrying on errors
+        similarityCache.set(userId, result);
+        return result;
+    }
+}
+
+/**
+ * Suspends a user account (admin only)
+ */
+export async function suspendUser(userId: number, reason: string, token: string): Promise<{status: string; message: string; reason: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/suspend`, {
+            method: 'POST',
+            headers: getAuthHeaders(token),
+            body: JSON.stringify({ reason })
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error suspending user:', error);
+        return null;
+    }
+}
+
+/**
+ * Unsuspends a user account (admin only)
+ */
+export async function unsuspendUser(userId: number, token: string): Promise<{status: string; message: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/unsuspend`, {
+            method: 'POST',
+            headers: getAuthHeaders(token)
+        });
+
         if (response.ok) {
             return await response.json();
         }
 
         return null;
     } catch (error) {
-        console.error('Error checking user similarity:', error);
+        console.error('Error unsuspending user:', error);
+        return null;
+    }
+}
+
+/**
+ * Deletes a user account (admin only)
+ */
+export async function deleteUser(userId: number, token: string): Promise<{status: string; message: string} | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${userId}/delete`, {
+            method: 'POST',
+            headers: getAuthHeaders(token)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error deleting user:', error);
         return null;
     }
 }

frontend/src/core/api/push.ts

@@ -0,0 +1,52 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./user/auth";
+
+export interface PushSubscriptionRequest {
+    endpoint: string;
+    keys: {
+        p256dh: string;
+        auth: string;
+    };
+}
+
+export interface PushSubscriptionResponse {
+    status: string;
+    message: string;
+}
+
+export const subscription = {
+    /**
+     * Subscribes the current user to push notifications
+     */
+    async subscribe(
+        subscription: PushSubscriptionRequest,
+        token: string
+    ): Promise<PushSubscriptionResponse> {
+        const res = await fetch(`${API_BASE_URL}/push/subscribe`, {
+            method: "POST",
+            headers: getAuthHeaders(token, true),
+            body: JSON.stringify(subscription)
+        });
+        if (!res.ok) {
+            const error = await res.json().catch(() => ({ detail: "Failed to subscribe to push notifications" }));
+            throw new Error(error.detail || "Failed to subscribe to push notifications");
+        }
+        return await res.json();
+    },
+
+    /**
+     * Unsubscribes the current user from push notifications
+     */
+    async unsubscribe(token: string): Promise<PushSubscriptionResponse> {
+        const res = await fetch(`${API_BASE_URL}/push/unsubscribe`, {
+            method: "DELETE",
+            headers: getAuthHeaders(token, true)
+        });
+        if (!res.ok) {
+            const error = await res.json().catch(() => ({ detail: "Failed to unsubscribe from push notifications" }));
+            throw new Error(error.detail || "Failed to unsubscribe from push notifications");
+        }
+        return await res.json();
+    }
+};
+

frontend/src/core/api/securityApi.ts

@@ -1,36 +0,0 @@
-import { API_BASE_URL } from "@/core/config";
-import { getAuthHeaders, deriveAuthSecret } from "@/core/api/authApi";
-
-export async function changePassword(
-    token: string,
-    username: string,
-    currentPassword: string,
-    newPassword: string,
-    logoutAllExceptCurrent: boolean
-): Promise<void> {
-    const currentDerived = await deriveAuthSecret(username, currentPassword);
-    const newDerived = await deriveAuthSecret(username, newPassword);
-    const res = await fetch(`${API_BASE_URL}/change-password`, {
-        method: "POST",
-        headers: getAuthHeaders(token),
-        body: JSON.stringify({
-            currentPasswordDerived: currentDerived,
-            newPasswordDerived: newDerived,
-            logoutAllExceptCurrent
-        })
-    });
-    if (!res.ok) throw new Error("Failed to change password");
-}
-
-export async function deleteAccount(token: string): Promise<void> {
-    const res = await fetch(`${API_BASE_URL}/account/delete`, {
-        method: "POST",
-        headers: getAuthHeaders(token)
-    });
-    if (!res.ok) {
-        const error = await res.json().catch(() => ({ detail: "Failed to delete account" }));
-        throw new Error(error.detail || "Failed to delete account");
-    }
-}
-
-

frontend/src/core/api/user/auth.ts

@@ -0,0 +1,219 @@
+import { API_BASE_URL } from "@/core/config";
+import type { LoginRequest, RegisterRequest, LoginResponse, Headers } from "@/core/types";
+import { generateX25519KeyPair, hkdfExtractAndExpand, encodeBlob, encryptBackupWithPassword, decryptBackupWithPassword, decodeBlob } from "@fromchat/protocol";
+import { b64, ub64 } from "@/utils/utils";
+import { fetchPublicKey, uploadPublicKey } from "../crypto/identity";
+import { fetchBackupBlob, uploadBackupBlob } from "../crypto/backup";
+
+/**
+ * Generates authentication headers for API requests
+ * @param {string | null} token - Authentication token
+ * @param {boolean} json - Whether to include JSON content type header
+ * @returns {Headers} Headers object with authentication and content type
+ */
+export function getAuthHeaders(token: string | null, json: boolean = true): Headers {
+    const headers: Headers = {};
+
+    if (json) {
+        headers["Content-Type"] = "application/json";
+    }
+
+    if (token) {
+        headers['Authorization'] = `Bearer ${token}`;
+    }
+    return headers;
+}
+
+export interface CheckAuthResponse {
+    authenticated: boolean;
+    username: string;
+    admin: boolean;
+}
+
+export interface LogoutResponse {
+    status: string;
+    message: string;
+}
+
+export interface UserKeyPairMemory {
+	publicKey: Uint8Array;
+	privateKey: Uint8Array;
+}
+
+let currentPublicKey: Uint8Array | null = null;
+let currentPrivateKey: Uint8Array | null = null;
+
+export function getCurrentKeys(): UserKeyPairMemory | null {
+	if (currentPublicKey && currentPrivateKey) return { publicKey: currentPublicKey, privateKey: currentPrivateKey };
+	return null;
+}
+
+function saveKeys(
+	publicKey: Uint8Array<ArrayBufferLike>,
+	privateKey: Uint8Array<ArrayBufferLike>
+) {
+	const encodedPublicKey = b64(publicKey);
+	const encodedPrivateKey = b64(privateKey);
+
+	localStorage.setItem("publicKey", encodedPublicKey);
+	localStorage.setItem("privateKey", encodedPrivateKey);
+}
+
+/**
+ * Checks if the current user is authenticated
+ */
+export async function checkAuth(token: string): Promise<CheckAuthResponse> {
+    const res = await fetch(`${API_BASE_URL}/check_auth`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to check auth");
+    return await res.json();
+}
+
+/**
+ * Logs in a user with username and password
+ */
+export async function login(request: LoginRequest): Promise<LoginResponse> {
+    const res = await fetch(`${API_BASE_URL}/login`, {
+        method: "POST",
+        headers: getAuthHeaders(null, true),
+        body: JSON.stringify(request)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Login failed" }));
+        throw new Error(error.detail || "Login failed");
+    }
+    return await res.json();
+}
+
+/**
+ * Registers a new user
+ */
+export async function register(request: RegisterRequest): Promise<LoginResponse> {
+    const res = await fetch(`${API_BASE_URL}/register`, {
+        method: "POST",
+        headers: getAuthHeaders(null, true),
+        body: JSON.stringify(request)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Registration failed" }));
+        throw new Error(error.detail || "Registration failed");
+    }
+    return await res.json();
+}
+
+/**
+ * Logs out the current user
+ */
+export async function logout(token: string): Promise<LogoutResponse> {
+    const res = await fetch(`${API_BASE_URL}/logout`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to logout");
+    return await res.json();
+}
+
+/**
+ * Derive a client-side authentication secret so the raw password never leaves the client.
+ * Uses PBKDF2 (via WebCrypto) + HKDF to produce a stable 32-byte key, then base64.
+ */
+export async function deriveAuthSecret(username: string, password: string): Promise<string> {
+    // Use per-user salt derived from username; in future we can fetch a server-provided salt
+    const salt = new TextEncoder().encode(`fromchat.user:${username}`);
+    // Derive 32 bytes using HKDF; PBKDF2 already used within importPassword
+    const derived = await hkdfExtractAndExpand(new TextEncoder().encode(password), salt, new TextEncoder().encode("auth-secret"), 32);
+    return b64(derived);
+}
+
+export async function ensureKeysOnLogin(password: string, token: string): Promise<UserKeyPairMemory> {
+	// Try to restore from backup
+	const blobJson = await fetchBackupBlob(token);
+	if (blobJson) {
+		const blob = decodeBlob(blobJson);
+		const bundle = await decryptBackupWithPassword(password, blob);
+		currentPrivateKey = bundle.privateKey;
+		// Ensure public key exists on server; if not, derive from private (not possible via libsafely), so keep previous
+		// In our simple scheme, we rely on server having the public key or we reupload generated one on first setup
+		const serverPub = await fetchPublicKey(token);
+		if (serverPub) {
+			currentPublicKey = serverPub;
+		} else {
+			// We don't have the corresponding public key from server; regenerate pair to resync
+			const pair = generateX25519KeyPair();
+			currentPublicKey = pair.publicKey;
+			currentPrivateKey = pair.privateKey;
+			await uploadPublicKey(currentPublicKey, token);
+			const newBlob = await encryptBackupWithPassword(password, { version: 1, privateKey: currentPrivateKey });
+			await uploadBackupBlob(encodeBlob(newBlob), token);
+		}
+
+		saveKeys(currentPublicKey!, currentPrivateKey!);
+
+		return {
+			publicKey: currentPublicKey!,
+			privateKey: currentPrivateKey!
+		};
+	}
+
+	// First-time setup: generate keys and upload
+	const pair = generateX25519KeyPair();
+	currentPublicKey = pair.publicKey;
+	currentPrivateKey = pair.privateKey;
+	await uploadPublicKey(currentPublicKey, token);
+	const encBlob = await encryptBackupWithPassword(password, { version: 1, privateKey: currentPrivateKey });
+	await uploadBackupBlob(encodeBlob(encBlob), token);
+
+	saveKeys(pair.publicKey, pair.privateKey);
+
+	return pair;
+}
+
+export function restoreKeys() {
+	currentPublicKey = ub64(localStorage.getItem("publicKey")!);
+	currentPrivateKey = ub64(localStorage.getItem("privateKey")!);
+}
+
+export function getAuthToken(): string | null {
+	return localStorage.getItem("authToken");
+}
+
+/**
+ * Changes the user's password
+ */
+export async function changePassword(
+    token: string,
+    username: string,
+    currentPassword: string,
+    newPassword: string,
+    logoutAllExceptCurrent: boolean
+): Promise<void> {
+    const currentDerived = await deriveAuthSecret(username, currentPassword);
+    const newDerived = await deriveAuthSecret(username, newPassword);
+    const res = await fetch(`${API_BASE_URL}/change-password`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true),
+        body: JSON.stringify({
+            currentPasswordDerived: currentDerived,
+            newPasswordDerived: newDerived,
+            logoutAllExceptCurrent
+        })
+    });
+    if (!res.ok) throw new Error("Failed to change password");
+}
+
+/**
+ * Deletes the current user's account
+ */
+export async function deleteAccount(token: string): Promise<{ status: string; message: string }> {
+    const res = await fetch(`${API_BASE_URL}/account/delete`, {
+        method: "POST",
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) {
+        const error = await res.json().catch(() => ({ detail: "Failed to delete account" }));
+        throw new Error(error.detail || "Failed to delete account");
+    }
+    return await res.json();
+}
+
+

frontend/src/core/api/user/devices.ts

@@ -0,0 +1,37 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./auth";
+
+export interface DeviceInfo {
+    session_id: string;
+    device_name?: string;
+    device_type?: string;
+    os_name?: string;
+    os_version?: string;
+    browser_name?: string;
+    browser_version?: string;
+    brand?: string;
+    model?: string;
+    created_at?: string;
+    last_seen?: string;
+    revoked?: boolean;
+    current?: boolean;
+}
+
+export async function list(token: string): Promise<DeviceInfo[]> {
+    const res = await fetch(`${API_BASE_URL}/devices`, { headers: getAuthHeaders(token, true) });
+    if (!res.ok) throw new Error("Failed to fetch devices");
+    const data = await res.json();
+    return data.devices as DeviceInfo[];
+}
+
+export async function revoke(token: string, sessionId: string): Promise<void> {
+    const res = await fetch(`${API_BASE_URL}/devices/${sessionId}`, { method: "DELETE", headers: getAuthHeaders(token, true) });
+    if (!res.ok) throw new Error("Failed to revoke device");
+}
+
+export async function revokeAll(token: string): Promise<void> {
+    const res = await fetch(`${API_BASE_URL}/devices/logout-all`, { method: "POST", headers: getAuthHeaders(token, true) });
+    if (!res.ok) throw new Error("Failed to logout all devices");
+}
+
+

frontend/src/core/api/user/profile.ts

@@ -0,0 +1,191 @@
+import { getAuthHeaders } from "./auth";
+import { API_BASE_URL } from "@/core/config";
+import type { UserProfile } from "@/core/types";
+
+export interface ProfileData {
+    profile_picture?: string;
+    username?: string;
+    display_name?: string;
+    description?: string;
+}
+
+export interface UploadResponse {
+    profile_picture_url: string;
+}
+
+/**
+ * Loads user profile data from the server
+ */
+export async function get(token: string): Promise<ProfileData | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/profile`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            const data = await response.json();
+            // Map backend fields to frontend fields
+            return {
+                profile_picture: data.profile_picture,
+                username: data.username,
+                display_name: data.display_name,
+                description: data.bio
+            };
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error loading profile:', error);
+        return null;
+    }
+}
+
+/**
+ * Uploads a profile picture to the server
+ */
+export async function uploadPicture(token: string, file: Blob): Promise<UploadResponse | null> {
+    try {
+        const formData = new FormData();
+        formData.append('profile_picture', file, 'profile_picture.jpg');
+
+        const response = await fetch(`${API_BASE_URL}/upload-profile-picture`, {
+            method: 'POST',
+            body: formData,
+            headers: getAuthHeaders(token, false)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+        return null;
+    } catch (error) {
+        console.error('Upload error:', error);
+        return null;
+    }
+}
+
+/**
+ * Updates user profile information
+ */
+export async function update(token: string, data: Partial<ProfileData>): Promise<boolean> {
+    try {
+        // Map frontend fields to backend fields
+        const backendData = {
+            username: data.username,
+            display_name: data.display_name,
+            description: data.description
+        };
+
+        const response = await fetch(`${API_BASE_URL}/user/profile`, {
+            method: 'PUT',
+            headers: {
+                ...getAuthHeaders(token, true),
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify(backendData)
+        });
+
+        return response.ok;
+    } catch (error) {
+        console.error('Error updating profile:', error);
+        return false;
+    }
+}
+
+/**
+ * Updates user bio
+ */
+export async function updateBio(token: string, bio: string): Promise<boolean> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/bio`, {
+            method: 'PUT',
+            headers: getAuthHeaders(token, true),
+            body: JSON.stringify({ bio })
+        });
+
+        return response.ok;
+    } catch (error) {
+        console.error('Error updating bio:', error);
+        return false;
+    }
+}
+
+/**
+ * Fetches user profile data by username
+ */
+export async function fetchByUsername(token: string, username: string): Promise<UserProfile | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/${username}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error fetching user profile:', error);
+        return null;
+    }
+}
+
+/**
+ * Fetches user profile data by user ID
+ */
+export async function fetchById(token: string, userId: number): Promise<UserProfile | null> {
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/id/${userId}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        if (response.ok) {
+            return await response.json();
+        }
+
+        return null;
+    } catch (error) {
+        console.error('Error fetching user profile by ID:', error);
+        return null;
+    }
+}
+
+/**
+ * In-memory cache for user similarity results
+ * Key: userId, Value: similarity result
+ */
+const similarityCache = new Map<number, {isSimilar: boolean, similarTo?: string} | null>();
+
+/**
+ * Checks if a user is similar to any verified user
+ * Results are cached in memory to avoid redundant API calls
+ */
+export async function checkSimilarity(userId: number, token: string): Promise<{isSimilar: boolean, similarTo?: string} | null> {
+    // Check cache first
+    if (similarityCache.has(userId)) {
+        return similarityCache.get(userId) ?? null;
+    }
+
+    try {
+        const response = await fetch(`${API_BASE_URL}/user/check-similarity/${userId}`, {
+            headers: getAuthHeaders(token, true)
+        });
+
+        let result: {isSimilar: boolean, similarTo?: string} | null = null;
+        if (response.ok) {
+            result = await response.json();
+        }
+
+        // Cache the result (even if null/error)
+        similarityCache.set(userId, result);
+        return result;
+    } catch (error) {
+        console.error('Error checking user similarity:', error);
+        const result: null = null;
+        // Cache null result to avoid retrying on errors
+        similarityCache.set(userId, result);
+        return result;
+    }
+}
+
+

frontend/src/core/api/user/search.ts

@@ -0,0 +1,40 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./auth";
+import type { User } from "@/core/types";
+
+/**
+ * Fetches a list of all users (excluding current user)
+ */
+export async function fetchUsers(token: string): Promise<User[]> {
+    const res = await fetch(`${API_BASE_URL}/users`, { headers: getAuthHeaders(token, true) });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.users || [];
+}
+
+/**
+ * Searches for users by username query
+ */
+export async function searchUsers(query: string, token: string): Promise<User[]> {
+    if (query.length < 2) return [];
+
+    const res = await fetch(`${API_BASE_URL}/users/search?q=${encodeURIComponent(query)}`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.users || [];
+}
+
+/**
+ * Fetches a user by ID
+ */
+export async function get(userId: number, token: string): Promise<User | null> {
+    const res = await fetch(`${API_BASE_URL}/users/${userId}`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) return null;
+    return await res.json();
+}
+
+

frontend/src/core/api/users.ts

@@ -0,0 +1,28 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./account";
+import type { User } from "@/core/types";
+
+/**
+ * Fetches a list of all users (excluding current user)
+ */
+export async function fetchUsers(token: string): Promise<User[]> {
+    const res = await fetch(`${API_BASE_URL}/users`, { headers: getAuthHeaders(token, true) });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.users || [];
+}
+
+/**
+ * Searches for users by username query
+ */
+export async function searchUsers(query: string, token: string): Promise<User[]> {
+    if (query.length < 2) return [];
+
+    const res = await fetch(`${API_BASE_URL}/users/search?q=${encodeURIComponent(query)}`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    return data.users || [];
+}
+

frontend/src/core/api/webrtc.ts

@@ -0,0 +1,15 @@
+import { API_BASE_URL } from "@/core/config";
+import { getAuthHeaders } from "./account";
+import type { IceServersResponse } from "@/core/types";
+
+/**
+ * Fetches ICE server configuration for WebRTC
+ */
+export async function getIceServers(token: string): Promise<IceServersResponse> {
+    const res = await fetch(`${API_BASE_URL}/webrtc/ice`, {
+        headers: getAuthHeaders(token, true)
+    });
+    if (!res.ok) throw new Error("Failed to fetch ICE servers");
+    return await res.json();
+}
+

frontend/src/core/calls/encryption.ts

@@ -1,8 +1,6 @@
-import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "@/utils/crypto/symmetric";
-import { randomBytes } from "@/utils/crypto/kdf";
+import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, randomBytes, ecdhSharedSecret, deriveWrappingKey } from "@fromchat/protocol";
 import { b64, ub64 } from "@/utils/utils";
-import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
-import { getCurrentKeys } from "@/core/api/authApi";
+import api from "@/core/api";
 import type { WrappedSessionKeyPayload } from "@/core/types";
 
 export interface CallSessionKey {
@@ -186,7 +184,7 @@ const CALL_INFO = new Uint8Array([2]);
  * @returns Promise that resolves to the wrapped session key payload
  */
 export async function wrapCallSessionKeyForRecipient(recipientPublicKeyB64: string, sessionKey: Uint8Array): Promise<WrappedSessionKeyPayload> {
-    const keys = getCurrentKeys();
+    const keys = api.user.auth.getCurrentKeys();
     if (!keys) throw new Error("Keys not initialized");
 
     const salt = randomBytes(16);
@@ -209,7 +207,7 @@ export async function createSharedSecretAndDeriveSessionKey(
     sessionKeyHash: string,
     isInitiator: boolean
 ): Promise<CallSessionKey> {
-    const keys = getCurrentKeys();
+    const keys = api.user.auth.getCurrentKeys();
     if (!keys) throw new Error("Keys not initialized");
 
     // Create shared secret using ECDH
@@ -226,7 +224,7 @@ export async function createSharedSecretAndDeriveSessionKey(
  * @returns Promise that resolves to the unwrapped session key
  */
 export async function unwrapCallSessionKeyFromSender(senderPublicKeyB64: string, payload: WrappedSessionKeyPayload): Promise<Uint8Array> {
-    const keys = getCurrentKeys();
+    const keys = api.user.auth.getCurrentKeys();
     if (!keys) throw new Error("Keys not initialized");
 
     const salt = ub64(payload.salt);

frontend/src/core/calls/webrtc.ts

@@ -1,9 +1,8 @@
-import { getAuthHeaders, getAuthToken } from "@/core/api/authApi";
-import type { CallSignalingMessage, IceServersResponse, WrappedSessionKeyPayload } from "@/core/types";
+import api from "@/core/api";
+import type { CallSignalingMessage, WrappedSessionKeyPayload } from "@/core/types";
 import { request } from "@/core/websocket";
 import { wrapCallSessionKeyForRecipient, unwrapCallSessionKeyFromSender, rotateCallSessionKey } from "./encryption";
-import { fetchUserPublicKey } from "@/core/api/dmApi";
-import { importAesGcmKey } from "@/utils/crypto/symmetric";
+import { importAesGcmKey } from "@fromchat/protocol";
 import E2EEWorker from "./e2eeWorker?worker";
 import { delay } from "@/utils/utils";
 
@@ -99,16 +98,10 @@ export class WebRTCCall {
      */
     private async getIceServers(): Promise<RTCIceServer[]> {
         try {
-            const response = await fetch("/api/webrtc/ice", {
-                headers: getAuthHeaders(getAuthToken()!)
-            });
-
-            if (response.ok) {
-                const data = await response.json() as IceServersResponse;
-                return data.iceServers || [];
-            } else {
-                console.warn("Failed to fetch ICE servers:", response.status, response.statusText);
-            }
+            const token = api.user.auth.getAuthToken();
+            if (!token) throw new Error("No auth token");
+            const data = await api.calls.iceServers(token);
+            return data.iceServers || [];
         } catch (error) {
             console.warn("Failed to fetch ICE servers:", error);
         }
@@ -779,7 +772,7 @@ async function sendSignalingMessage(message: CallSignalingMessage) {
         type: "call_signaling",
         credentials: {
             scheme: "Bearer",
-            credentials: getAuthToken()!
+            credentials: api.user.auth.getAuthToken()!
         },
         data: message
     });
@@ -862,7 +855,7 @@ export async function sendCallSessionKey(userId: number, sessionKeyHash: string)
 
 export async function sendWrappedCallSessionKey(userId: number, sessionKey: Uint8Array, sessionKeyHash: string): Promise<void> {
     try {
-        const recipientPublicKey = await fetchUserPublicKey(userId, getAuthToken()!);
+        const recipientPublicKey = await api.chats.dm.fetchUserPublicKey(userId, api.user.auth.getAuthToken()!);
         if (!recipientPublicKey) {
             console.warn("No recipient public key for", userId);
             return;
@@ -897,7 +890,7 @@ export async function receiveWrappedSessionKey(
     sessionKeyHash?: string
 ): Promise<void> {
     try {
-        const senderPublicKey = await fetchUserPublicKey(fromUserId, getAuthToken()!);
+        const senderPublicKey = await api.chats.dm.fetchUserPublicKey(fromUserId, api.user.auth.getAuthToken()!);
         if (!senderPublicKey) {
             console.error("Failed to get sender public key");
             return;

frontend/src/core/components/AlertDialog.tsx

@@ -0,0 +1,94 @@
+import { useState, useCallback, useEffect } from "react";
+import { StyledDialog } from "./StyledDialog";
+import { MaterialButton } from "@/utils/material";
+import styles from "./css/alert-dialog.module.scss";
+
+interface AlertDialogState {
+    open: boolean;
+    message: string;
+    resolve: (() => void) | null;
+}
+
+let alertState: AlertDialogState = {
+    open: false,
+    message: "",
+    resolve: null
+};
+
+const listeners = new Set<() => void>();
+
+function notifyListeners() {
+    listeners.forEach(listener => listener());
+}
+
+/**
+ * Drop-in replacement for window.alert() using StyledDialog
+ * @param message - The message to display
+ * @returns Promise that resolves when the dialog is closed
+ */
+export function alert(message: string): Promise<void> {
+    return new Promise<void>((resolve) => {
+        alertState = {
+            open: true,
+            message,
+            resolve: () => {
+                alertState.open = false;
+                alertState.message = "";
+                alertState.resolve = null;
+                notifyListeners();
+                resolve();
+            }
+        };
+        notifyListeners();
+    });
+}
+
+/**
+ * Internal component that renders the alert dialog
+ */
+export function AlertDialogProvider() {
+    const [, setUpdateKey] = useState(0);
+    
+    const update = useCallback(() => {
+        setUpdateKey(prev => prev + 1);
+    }, []);
+
+    useEffect(() => {
+        listeners.add(update);
+        return () => {
+            listeners.delete(update);
+        };
+    }, [update]);
+
+    const handleClose = () => {
+        if (alertState.resolve) {
+            alertState.resolve();
+        }
+    };
+
+    return (
+        <StyledDialog
+            open={alertState.open}
+            onOpenChange={(open) => {
+                if (!open) {
+                    handleClose();
+                }
+            }}
+            onBackdropClick={handleClose}
+            className={styles.alertDialog}
+            contentClassName={styles.alertDialogContent}
+        >
+            <div className={styles.alertDialogMessage}>
+                {alertState.message}
+            </div>
+            <div className={styles.alertDialogActions}>
+                <MaterialButton
+                    variant="filled"
+                    onClick={handleClose}
+                >
+                    OK
+                </MaterialButton>
+            </div>
+        </StyledDialog>
+    );
+}

frontend/src/core/components/SearchBar.tsx

@@ -1,6 +1,6 @@
 import { useState, useEffect, useRef } from "react";
 import styles from "./css/searchBar.module.scss";
-import { MaterialIcon } from "@/utils/material";
+import { MaterialIcon, type MDUIBottomAppBar } from "@/utils/material";
 
 interface SearchBarProps {
     placeholder: string;
@@ -11,6 +11,9 @@ interface SearchBarProps {
     onToggleExpanded: () => void;
     leftIcon?: string | React.ReactNode;
     rightIcon?: string | React.ReactNode;
+    containerRef: React.RefObject<HTMLElement | null>;
+    headerRef?: React.RefObject<HTMLElement | null>;
+    bottomAppBarRef?: React.RefObject<MDUIBottomAppBar | null>;
 }
 
 export default function SearchBar({
@@ -21,9 +24,14 @@ export default function SearchBar({
     isExpanded,
     onToggleExpanded,
     leftIcon = "search--outlined",
-    rightIcon = null
+    rightIcon = null,
+    containerRef,
+    headerRef,
+    bottomAppBarRef
 }: SearchBarProps) {
     const [dynamicHeight, setDynamicHeight] = useState<string>("48px");
+    const [isTransitioning, setIsTransitioning] = useState(false);
+    const [showResults, setShowResults] = useState(false);
     const searchContainerRef = useRef<HTMLDivElement>(null);
     const inputRef = useRef<HTMLInputElement>(null);
     const parentContainerRef = useRef<HTMLDivElement>(null);
@@ -33,17 +41,46 @@ export default function SearchBar({
     useEffect(() => {
         if (isExpanded && inputRef.current) {
             inputRef.current.focus();
-            // Set expanded height
-            const leftPanel = document.getElementById('chat-list');
-            if (leftPanel) {
-                const panelHeight = leftPanel.offsetHeight;
-                setDynamicHeight(`${panelHeight}px`);
+            // Set expanded height, subtracting both header and bottom app bar heights
+            if (containerRef.current) {
+                const panelHeight = containerRef.current.offsetHeight;
+                let headerHeight = 0;
+                let bottomBarHeight = 0;
+                
+                // Get header height
+                if (headerRef?.current) {
+                    headerHeight = headerRef.current.offsetHeight;
+                }
+                
+                // Get bottom app bar height
+                if (bottomAppBarRef?.current) {
+                    bottomBarHeight = bottomAppBarRef.current.offsetHeight;
+                }
+                
+                // Calculate height by subtracting both header and bottom bar heights
+                const availableHeight = panelHeight - headerHeight - bottomBarHeight;
+                setDynamicHeight(`${availableHeight}px`);
             }
         } else {
             // Set collapsed height
             setDynamicHeight("48px");
         }
-    }, [isExpanded]);
+        
+        // Show/hide results and disable overflow during transition
+        if (isExpanded) {
+            setShowResults(true);
+        }
+        
+        setIsTransitioning(true);
+        const timeout = setTimeout(() => {
+            setIsTransitioning(false);
+            if (!isExpanded) {
+                setShowResults(false);
+            }
+        }, 400); // Match transition duration (0.4s)
+        
+        return () => clearTimeout(timeout);
+    }, [isExpanded, containerRef, headerRef, bottomAppBarRef]);
 
     function handleToggle() {
         onToggleExpanded();
@@ -107,9 +144,12 @@ export default function SearchBar({
                     </div>
                 </div>
 
-                {/* Results Section - Only visible when expanded */}
-                {isExpanded && (
-                    <div className={styles.searchResults}>
+                {/* Results Section - Visible during expansion and collapse transition */}
+                {showResults && (
+                    <div 
+                        className={styles.searchResults}
+                        style={{ overflowY: isTransitioning ? "hidden" : "auto" }}
+                    >
                         {children}
                     </div>
                 )}

frontend/src/core/components/StatusBadge.tsx

@@ -1,6 +1,6 @@
 import { useState, useEffect } from "react";
-import { checkUserSimilarity } from "@/core/api/profileApi";
-import { useAppState } from "@/pages/chat/state";
+import api from "@/core/api";
+import { useUserStore } from "@/state/user";
 import { MaterialIcon } from "@/utils/material";
 
 interface StatusBadgeProps {
@@ -11,14 +11,14 @@ interface StatusBadgeProps {
 
 export function StatusBadge({ verified, userId, size = "small" }: StatusBadgeProps) {
     const [isSimilarToVerified, setIsSimilarToVerified] = useState(false);
-    const { user } = useAppState();
+    const { user } = useUserStore();
     
     const className = `status-badge ${size}`;
 
     // Check similarity for unverified users
     useEffect(() => {
         if (!verified && userId && user.authToken) {
-            checkUserSimilarity(userId, user.authToken)
+            api.user.profile.checkSimilarity(userId, user.authToken)
                 .then(result => {
                     setIsSimilarToVerified(result?.isSimilar || false);
                 })

frontend/src/core/components/VerifyButton.tsx

@@ -1,6 +1,6 @@
 import { useState } from "react";
-import { verifyUser } from "@/core/api/profileApi";
-import { useAppState } from "@/pages/chat/state";
+import api from "@/core/api";
+import { useUserStore } from "@/state/user";
 import { MaterialButton } from "@/utils/material";
 
 interface VerifyButtonProps {
@@ -11,7 +11,7 @@ interface VerifyButtonProps {
 
 export function VerifyButton({ userId, verified, onVerificationChange }: VerifyButtonProps) {
     const [isVerifying, setIsVerifying] = useState(false);
-    const { user } = useAppState();
+    const { user } = useUserStore();
 
     // Only show for owner
     if (user.currentUser?.id !== 1) {
@@ -23,7 +23,7 @@ export function VerifyButton({ userId, verified, onVerificationChange }: VerifyB
         
         setIsVerifying(true);
         try {
-            const result = await verifyUser(userId, user.authToken);
+            const result = await api.moderation.users.verify(userId, user.authToken);
             if (result) {
                 onVerificationChange?.(result.verified);
             }

frontend/src/core/components/css/alert-dialog.module.scss

@@ -0,0 +1,25 @@
+@use "../../../css/colors" as *;
+@use "../../../css/material" as *;
+
+.alertDialog {
+    .alertDialogContent {
+        padding: 24px;
+        display: flex;
+        flex-direction: column;
+        gap: 20px;
+    }
+
+    .alertDialogMessage {
+        color: $color-dark-on-surface;
+        font-size: 16px;
+        line-height: 1.5;
+        word-wrap: break-word;
+    }
+
+    .alertDialogActions {
+        display: flex;
+        justify-content: flex-end;
+        gap: 12px;
+    }
+}
+

frontend/src/core/components/css/searchBar.module.scss

@@ -42,7 +42,7 @@ $font-size: 16px;
         top: 0;
         left: 0;
         right: 0;
-        bottom: 0;
+        // bottom will be set dynamically by React to account for bottom app bar
         border-radius: 0;
         background-color: $color-dark-surface-container;
         // Height will be set dynamically by React

frontend/src/core/onlineStatusManager.ts

@@ -11,7 +11,7 @@ import type {
     SubscribeStatusWebSocketMessage,
     UnsubscribeStatusWebSocketMessage
 } from "./types";
-import { useAppState } from "@/pages/chat/state";
+import { usePresenceStore } from "@/state/presence";
 
 export interface UserStatus {
     online: boolean;
@@ -96,7 +96,7 @@ export class OnlineStatusManager {
         this.statusCache.set(userId, { online, lastSeen });
 
         // Update the global state
-        const { updateOnlineStatus } = useAppState.getState();
+        const { updateOnlineStatus } = usePresenceStore.getState();
         updateOnlineStatus(userId, online, lastSeen);
     }
 

frontend/src/core/push-notifications/push-notifications.ts

@@ -1,8 +1,9 @@
-import { API_BASE_URL } from "@/core/config";
+import api from "@/core/api";
 import { isElectron } from "@/core/electron/electron";
 import { websocket } from "@/core/websocket";
 import type { NewMessageWebSocketMessage, WebSocketMessage } from "@/core/types";
 import serviceWorker from "./service-worker?worker&url";
+import logo from "@/images/logo.svg";
 
 export interface PushSubscriptionData {
     endpoint: string;
@@ -88,16 +89,8 @@ async function sendSubscriptionToServer(token: string): Promise<boolean> {
     };
 
     try {
-        const response = await fetch(`${API_BASE_URL}/push/subscribe`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "Authorization": `Bearer ${token}`
-            },
-            body: JSON.stringify(subscriptionData)
-        });
-
-        return response.ok;
+        await api.push.subscription.subscribe(subscriptionData, token);
+        return true;
     } catch (error) {
         console.error("Failed to send subscription to server:", error);
         return false;
@@ -111,7 +104,7 @@ async function showMessageNotification(message: any): Promise<void> {
             body: message.content.length > 100
                 ? message.content.substring(0, 100) + "..."
                 : message.content,
-            icon: message.profile_picture || "/logo.png",
+            icon: message.profile_picture || logo,
             tag: `message_${message.id}`,
             data: {
                 type: "public_message",

frontend/src/core/push-notifications/service-worker.ts

@@ -1,5 +1,7 @@
 /// <reference lib="webworker" />
 
+import logo from "@/images/logo.svg";
+
 declare const self: ServiceWorkerGlobalScope;
 
 interface NotificationPayload {
@@ -36,8 +38,8 @@ self.addEventListener("push", function(event: ExtendableEvent) {
 
         const options: NotificationOptions = {
             body: data.body,
-            icon: data.icon || "/logo.png",
-            badge: "/logo.png",
+            icon: data.icon || logo,
+            badge: logo,
             image: data.image,
             tag: data.tag || "message",
             data: data.data,

frontend/src/core/typingManager.ts

@@ -16,7 +16,7 @@ import type {
     DmTypingRequest,
     StopDmTypingRequest
 } from "./types";
-import { useAppState } from "@/pages/chat/state";
+import { usePresenceStore } from "@/state/presence";
 
 /**
  * Manages typing indicators for public chat and DMs
@@ -133,7 +133,7 @@ export class TypingManager {
      * Handle incoming typing indicator from WebSocket
      */
     handleTyping(message: TypingWebSocketMessage): void {
-        const { addTypingUser } = useAppState.getState();
+        const { addTypingUser } = usePresenceStore.getState();
         addTypingUser(message.data.userId, message.data.username);
     }
 
@@ -141,7 +141,7 @@ export class TypingManager {
      * Handle incoming stop typing indicator from WebSocket
      */
     handleStopTyping(message: StopTypingWebSocketMessage): void {
-        const { removeTypingUser } = useAppState.getState();
+        const { removeTypingUser } = usePresenceStore.getState();
         removeTypingUser(message.data.userId);
     }
 
@@ -149,7 +149,7 @@ export class TypingManager {
      * Handle incoming DM typing indicator from WebSocket
      */
     handleDmTyping(message: DmTypingWebSocketMessage): void {
-        const { setDmTypingUser } = useAppState.getState();
+        const { setDmTypingUser } = usePresenceStore.getState();
         setDmTypingUser(message.data.userId, true);
     }
 
@@ -157,7 +157,7 @@ export class TypingManager {
      * Handle incoming stop DM typing indicator from WebSocket
      */
     handleStopDmTyping(message: StopDmTypingWebSocketMessage): void {
-        const { setDmTypingUser } = useAppState.getState();
+        const { setDmTypingUser } = usePresenceStore.getState();
         setDmTypingUser(message.data.userId, false);
     }
 

frontend/src/core/updateManager.ts

@@ -0,0 +1,126 @@
+/**
+ * @fileoverview Update Manager for Telegram-like update system
+ * @description Handles update sequence numbers, batching, and gap detection
+ * @author Cursor
+ * @version 1.0.0
+ */
+
+import { openDB, type IDBPDatabase } from "idb";
+import type { WebSocketCredentials, WebSocketMessage } from "./types";
+
+interface UpdateMessage<T = any> {
+    type: string;
+    data: T;
+}
+
+interface BatchedUpdatesMessage {
+    type: "updates";
+    seq: number;
+    updates: UpdateMessage[];
+}
+
+const DB_NAME = "fromchat-updates";
+const DB_VERSION = 1;
+const STORE_NAME = "lastSequence";
+
+let db: IDBPDatabase | null = null;
+
+/**
+ * Initialize IndexedDB for storing last sequence number
+ */
+async function initDB(): Promise<IDBPDatabase> {
+    if (db) return db;
+    
+    db = await openDB(DB_NAME, DB_VERSION, {
+        upgrade(database) {
+            if (!database.objectStoreNames.contains(STORE_NAME)) {
+                database.createObjectStore(STORE_NAME);
+            }
+        }
+    });
+    
+    return db;
+}
+
+/**
+ * Get the last received sequence number from IndexedDB
+ */
+export async function getLastSequence(): Promise<number> {
+    try {
+        return (await initDB())
+            .transaction(STORE_NAME, "readonly")
+            .objectStore(STORE_NAME)
+            .get("lastSeq") || 0;
+    } catch (error) {
+        console.error("Failed to get last sequence:", error);
+        return 0;
+    }
+}
+
+/**
+ * Store the last received sequence number in IndexedDB
+ */
+export async function setLastSequence(seq: number): Promise<void> {
+    try {
+        (await initDB()).transaction(STORE_NAME, "readwrite").objectStore(STORE_NAME).put(seq, "lastSeq");
+    } catch (error) {
+        console.error("Failed to set last sequence:", error);
+    }
+}
+
+/**
+ * Process a batched updates message
+ * @param message - The batched updates message from the server
+ * @param handler - Function to handle individual updates
+ * @param requestMissedFn - Optional function to request missed updates (for gap detection)
+ */
+export async function processBatchedUpdates(
+    message: BatchedUpdatesMessage,
+    handler: (update: UpdateMessage) => void,
+    requestMissedFn?: (lastSeq: number) => Promise<void>
+): Promise<void> {
+    const { seq, updates } = message;
+    const lastSeq = await getLastSequence();
+    
+    // Check for gap
+    if (seq !== lastSeq + 1 && lastSeq > 0) {
+        console.warn(`Update gap detected: expected ${lastSeq + 1}, got ${seq}`);
+        
+        // Request missing updates if function provided
+        if (requestMissedFn) {
+            try {
+                await requestMissedFn(lastSeq);
+            } catch (error) {
+                console.error("Failed to request missed updates for gap:", error);
+            }
+        }
+    }
+    
+    // Process all updates in the batch
+    for (const update of updates) {
+        handler(update);
+    }
+    
+    // Update last sequence number
+    await setLastSequence(seq);
+}
+
+/**
+ * Request missed updates from the server
+ * @param lastSeq - The last sequence number we received
+ * @param requestFn - Function to send the request to the server
+ * @param credentials - Optional WebSocket credentials for authentication
+ */
+export async function requestMissedUpdates(
+    lastSeq: number,
+    requestFn: (request: WebSocketMessage<{ lastSeq: number }>) => Promise<void>,
+    credentials?: WebSocketCredentials
+): Promise<void> {
+    if (lastSeq > 0) {
+        await requestFn({
+            type: "getUpdates",
+            data: { lastSeq },
+            credentials
+        });
+    }
+}

frontend/src/core/websocket.ts

@@ -11,7 +11,14 @@ import { delay } from "@/utils/utils";
 import { CallSignalingHandler } from "./calls/signaling";
 import { onlineStatusManager } from "./onlineStatusManager";
 import { typingManager } from "./typingManager";
-import { useAppState } from "@/pages/chat/state";
+import { useUserStore } from "@/state/user";
+import { getLastSequence, processBatchedUpdates, requestMissedUpdates } from "./updateManager";
+import { getAuthToken } from "@/core/api/user/auth";
+
+interface HttpError extends Error {
+    status?: number;
+    detail?: string;
+}
 
 /**
  * Creates a new WebSocket connection to the chat server
@@ -44,6 +51,18 @@ let globalMessageHandler: ((response: WebSocketMessage<any>) => void) | null = n
  */
 let callSignalingHandler: CallSignalingHandler | null = null;
 
+/**
+ * Reconnection state
+ */
+let reconnectAttempts = 0;
+const MAX_RECONNECT_DELAY = 30000; // 30 seconds max delay
+const INITIAL_RECONNECT_DELAY = 1000; // Start with 1 second
+let isReconnecting = false;
+let messageHandler: ((e: MessageEvent) => void) | null = null;
+let errorHandler: ((e: Event) => void) | null = null;
+let closeHandler: ((e: CloseEvent) => void) | null = null;
+let openHandler: ((e: Event) => void) | null = null;
+
 /**
  * Set the global WebSocket message handler
  * @param handler - Function to handle WebSocket messages
@@ -60,66 +79,120 @@ export function setCallSignalingHandler(handler: CallSignalingHandler | null): v
     callSignalingHandler = handler;
 }
 
-export function request<Request, Response = any>(payload: WebSocketMessage<Request>): Promise<WebSocketMessage<Response>> {
-    console.log("WebSocket request:", payload);
-    return new Promise((resolve, reject) => {
-        function requestInner() {
-            let listener: ((e: MessageEvent) => void) | null = null;
-            listener = (e) => {
-                resolve(JSON.parse(e.data));
-                websocket.removeEventListener("message", listener!);
+/**
+ * Clean up all event listeners from the current WebSocket instance
+ * @private
+ */
+function cleanupWebSocket(): void {
+    if (websocket) {
+        if (messageHandler) {
+            websocket.removeEventListener("message", messageHandler);
+        }
+        if (errorHandler) {
+            websocket.removeEventListener("error", errorHandler);
+        }
+        if (closeHandler) {
+            websocket.removeEventListener("close", closeHandler);
+        }
+        if (openHandler) {
+            websocket.removeEventListener("open", openHandler);
+        }
+        
+        // Close if still connected
+        if (websocket.readyState === WebSocket.OPEN || websocket.readyState === WebSocket.CONNECTING) {
+            try {
+                websocket.close();
+            } catch (e) {
+                // Ignore errors during cleanup
             }
-            websocket.addEventListener("message", listener);
-            websocket.send(JSON.stringify(payload))
-
-            setTimeout(() => reject("Request timed out"), 10000);
         }
-
-        if (websocket.readyState == 0) {
-            websocket.addEventListener("open", requestInner);
-            setTimeout(() => reject("Request timed out"), 10000);
-        } else {
-            requestInner();
-        }
-    })
+    }
 }
 
 /**
- * This function will wait 3 seconds and them attempts to reconnect the WebSocket.
- * If it fails, tries again in an endless loop until the connection is established
- * again.
- *
+ * Calculate exponential backoff delay
+ * @param attempt - Current reconnection attempt number
+ * @returns Delay in milliseconds
  * @private
  */
-async function onError() {
-    console.warn("WebSocket disconnected, retrying in 3 seconds...");
-    await delay(3000);
-    websocket = create();
-
-    let listener: () => void | null;
-    listener = () => {
-        console.log("WebSocket successfully reconnected!");
-        websocket.removeEventListener("open", listener);
-    }
-
-    websocket.addEventListener("open", listener);
-    websocket.addEventListener("error", onError);
+function getReconnectDelay(attempt: number): number {
+    const delay = INITIAL_RECONNECT_DELAY * Math.pow(2, attempt);
+    return Math.min(delay, MAX_RECONNECT_DELAY);
 }
 
-// --------------
-// Initialization
-// --------------
+/**
+ * Handle WebSocket reconnection with exponential backoff
+ * @private
+ */
+async function reconnect(): Promise<void> {
+    if (isReconnecting) {
+        return;
+    }
+
+    isReconnecting = true;
+    
+    // Clean up old connection
+    cleanupWebSocket();
+
+    const delayMs = getReconnectDelay(reconnectAttempts);
+    reconnectAttempts++;
+
+    await delay(delayMs);
 
-websocket.addEventListener("message", (e) => {
     try {
-        const response: WebSocketMessage<any> = JSON.parse(e.data);
+        websocket = create();
+        setupEventHandlers();
+    } catch (error) {
+        // If creation fails, try again
+        isReconnecting = false;
+        reconnect();
+    }
+}
 
-        // Handle call signaling messages
-        if (callSignalingHandler && response.type === "call_signaling" && response.data) {
-            callSignalingHandler.handleWebSocketMessage(response.data);
+/**
+ * Setup event handlers for the WebSocket connection
+ * @private
+ */
+function setupEventHandlers(): void {
+    // Message handler
+    messageHandler = async (e: MessageEvent) => {
+        try {
+            const response: WebSocketMessage<any> = JSON.parse(e.data);
+
+            // Handle batched updates
+            if (response.type === "updates" && "seq" in response && "updates" in response) {
+                // Create function to request missed updates with credentials
+                const token = getAuthToken();
+                const requestMissedFn = token ? async (lastSeq: number) => {
+                    await requestMissedUpdates(lastSeq, async (req) => {
+                        await request(req);
+                    }, {
+                        scheme: "Bearer",
+                        credentials: token
+                    });
+                } : undefined;
+                
+                await processBatchedUpdates(response as any, (update) => {
+                    // Route individual updates to appropriate handlers
+                    handleUpdate(update);
+                }, requestMissedFn);
+                return;
+            }
+
+            // Handle call signaling messages
+            if (callSignalingHandler && response.type === "call_signaling" && response.data) {
+                callSignalingHandler.handleWebSocketMessage(response.data);
+            }
+
+            // Handle status and typing messages (these may come as immediate messages or in batches)
+            handleUpdate(response);
+        } catch (error) {
+            console.error("Error parsing WebSocket message:", error);
         }
+    };
 
-        // Handle status and typing messages
+    // Helper function to handle individual updates
+    function handleUpdate(response: WebSocketMessage<any>): void {
         if (response.type === "statusUpdate") {
             onlineStatusManager.handleStatusUpdate(response as any);
         } else if (response.type === "typing") {
@@ -132,14 +205,14 @@ websocket.addEventListener("message", (e) => {
             typingManager.handleStopDmTyping(response as any);
         } else if (response.type === "suspended") {
             // Handle account suspension
-            const { setSuspended } = useAppState.getState();
+            const { setSuspended } = useUserStore.getState();
             const reason = response.data?.reason || "No reason provided";
             setSuspended(reason);
             // Close WebSocket connection
             websocket.close();
         } else if (response.type === "account_deleted") {
             // Handle account deletion - silent logout
-            const { logout } = useAppState.getState();
+            const { logout } = useUserStore.getState();
             logout();
             // Close WebSocket connection
             websocket.close();
@@ -149,8 +222,196 @@ websocket.addEventListener("message", (e) => {
         if (globalMessageHandler) {
             globalMessageHandler(response);
         }
-    } catch (error) {
-        console.error("Error parsing WebSocket message:", error);
     }
-});
-websocket.addEventListener("error", onError);
+    websocket.addEventListener("message", messageHandler);
+
+    // Open handler
+    openHandler = async () => {
+        reconnectAttempts = 0; // Reset on successful connection
+        isReconnecting = false;
+        
+        // Authenticate by sending ping with credentials and request missed updates
+        try {
+            const token = getAuthToken();
+            if (token) {
+                const credentials = {
+                    scheme: "Bearer",
+                    credentials: token
+                };
+                
+                // Send ping to authenticate and set user_by_ws on the server
+                try {
+                    await request({
+                        type: "ping",
+                        credentials,
+                        data: {}
+                    });
+                } catch (error) {
+                    console.error("Failed to send ping on reconnect:", error);
+                }
+                
+                // Send last sequence number and request missed updates on reconnect
+                // Wait a bit for ping to complete authentication
+                await delay(100);
+                
+                try {
+                    const lastSeq = await getLastSequence();
+                    if (lastSeq > 0) {
+                        await requestMissedUpdates(lastSeq, async (req) => {
+                            await request(req);
+                        }, credentials);
+                    }
+                } catch (error) {
+                    console.error("Failed to request missed updates:", error);
+                }
+            }
+        } catch (error) {
+            console.error("Failed to authenticate on reconnect:", error);
+        }
+    };
+    websocket.addEventListener("open", openHandler);
+
+    // Error handler
+    errorHandler = () => {
+        // Don't reconnect immediately on error - let close handler handle it
+        // This prevents double reconnection attempts
+    };
+    websocket.addEventListener("error", errorHandler);
+
+    // Close handler
+    closeHandler = (e: CloseEvent) => {
+        // Don't reconnect if it was a clean close (e.g., logout, suspension)
+        if (e.code === 1000 || e.code === 1001) {
+            return;
+        }
+
+        // Reconnect for unexpected closes
+        if (!isReconnecting) {
+            reconnect();
+        }
+    };
+    websocket.addEventListener("close", closeHandler);
+}
+
+export function request<Request, Response = any>(payload: WebSocketMessage<Request>): Promise<WebSocketMessage<Response>> {
+    console.log("WebSocket request:", payload);
+    return new Promise((resolve, reject) => {
+        const timeoutId = setTimeout(() => {
+            reject(new Error("Request timed out"));
+        }, 10000);
+
+        function requestInner() {
+            if (websocket.readyState !== WebSocket.OPEN) {
+                clearTimeout(timeoutId);
+                reject(new Error("WebSocket is not open"));
+                return;
+            }
+
+            const listener = (e: MessageEvent) => {
+                try {
+                    const response = JSON.parse(e.data);
+                    // Only handle responses that match our request type or have an error
+                    if (response.type === payload.type || response.error) {
+                        clearTimeout(timeoutId);
+                        websocket.removeEventListener("message", listener);
+                        
+                        // Check if the response contains an error field
+                        if (response.error) {
+                            const error = new Error(response.error.detail || "WebSocket request failed");
+                            (error as HttpError).status = response.error.code;
+                            (error as HttpError).detail = response.error.detail || "";
+                            reject(error);
+                        } else {
+                            resolve(response);
+                        }
+                    }
+                    // If it doesn't match, let other handlers process it
+                } catch (error) {
+                    clearTimeout(timeoutId);
+                    websocket.removeEventListener("message", listener);
+                    reject(error);
+                }
+            };
+
+            websocket.addEventListener("message", listener);
+            
+            try {
+                websocket.send(JSON.stringify(payload));
+            } catch (error) {
+                clearTimeout(timeoutId);
+                websocket.removeEventListener("message", listener);
+                reject(error);
+            }
+        }
+
+        if (websocket.readyState === WebSocket.CONNECTING) {
+            const openListener = () => {
+                websocket.removeEventListener("open", openListener);
+                requestInner();
+            };
+            websocket.addEventListener("open", openListener);
+        } else if (websocket.readyState === WebSocket.OPEN) {
+            requestInner();
+        } else {
+            clearTimeout(timeoutId);
+            reject(new Error("WebSocket is closed"));
+        }
+    });
+}
+
+// --------------
+// Initialization
+// --------------
+
+/**
+ * Ensure WebSocket is connected and authenticated after login
+ * This should be called after successful authentication
+ */
+export async function ensureAuthenticated(): Promise<void> {
+    const token = getAuthToken();
+    if (!token) {
+        return;
+    }
+
+    // If WebSocket is not connected, wait for it to connect
+    if (websocket.readyState === WebSocket.CONNECTING) {
+        await new Promise<void>((resolve) => {
+            const checkConnection = () => {
+                if (websocket.readyState === WebSocket.OPEN) {
+                    resolve();
+                } else if (websocket.readyState === WebSocket.CLOSED) {
+                    // Connection failed, try to reconnect
+                    reconnect().then(() => {
+                        setTimeout(checkConnection, 100);
+                    });
+                } else {
+                    setTimeout(checkConnection, 100);
+                }
+            };
+            checkConnection();
+        });
+    } else if (websocket.readyState === WebSocket.CLOSED) {
+        // Reconnect if closed
+        await reconnect();
+    }
+
+    // If WebSocket is open, send ping to authenticate
+    if (websocket.readyState === WebSocket.OPEN) {
+        try {
+            const credentials = {
+                scheme: "Bearer",
+                credentials: token
+            };
+            
+            await request({
+                type: "ping",
+                credentials,
+                data: {}
+            });
+        } catch (error) {
+            console.error("Failed to send ping after login:", error);
+        }
+    }
+}
+
+setupEventHandlers();

frontend/src/css/_components.scss

@@ -1,26 +1,6 @@
 @use "material" as *;
 @use "sass:color";
 
-.text-center {
-    text-align: center;
-}
-
-.alert {
-    padding: 0.8rem 1rem;
-    border-radius: 6px;
-    margin-bottom: 1rem;
-
-    &.alert-success {
-        background-color: #C6F6D5;
-        color: #22543D;
-    }
-
-    &.alert-danger {
-        background-color: #FED7D7;
-        color: #742A2A;
-    }
-}
-
 .link {
     color: $color-dark-primary;
     font-weight: 600;
@@ -30,27 +10,6 @@ button, input {
     font: inherit;
 }
 
-// Dialog content styles
-.dialog-content {
-    h3 {
-        margin: 0 0 1rem 0;
-        color: $color-dark-on-surface;
-        font-size: 1.2rem;
-        font-weight: 600;
-    }
-
-    mdui-text-field {
-        width: 100%;
-    }
-
-    .dialog-actions {
-        display: flex;
-        gap: 0.75rem;
-        justify-content: flex-end;
-        margin-top: 1rem;
-    }
-}
-
 .rich-text-area {
     width: 100%;
     resize: none;
@@ -83,33 +42,6 @@ button, input {
     }
 }
 
-// Verified badge styles
-.verified-badge {
-    display: inline-flex;
-    align-items: center;
-    color: $color-dark-primary;
-    vertical-align: middle;
-    user-select: none;
-
-    &.small {
-        font-size: 14px;
-        width: 14px;
-        height: 14px;
-    }
-
-    &.medium {
-        font-size: 18px;
-        width: 18px;
-        height: 18px;
-    }
-
-    &.large {
-        font-size: 24px;
-        width: 24px;
-        height: 24px;
-    }
-}
-
 // Status badge styles (unified for verified and warning)
 .status-badge {
     display: inline-flex;
@@ -121,7 +53,7 @@ button, input {
     }
     
     &.warning {
-        color: #ff9800; // Orange color for warnings
+        color: $color-dark-tertiary; // Purple-themed warning color
     }
     
     &.small mdui-icon {
@@ -143,13 +75,6 @@ button, input {
     }
 }
 
-// Profile dialog specific styles
-.username-with-badge {
-    display: flex;
-    align-items: center;
-    gap: 8px;
-}
-
 .similarity-warning {
     display: flex;
     align-items: center;

frontend/src/css/_material.scss

@@ -1,63 +1,59 @@
 @use "sass:color";
 
 // Dark
-$color-dark-primary: rgb(145 206 244);
-$color-dark-surface-tint: rgb(145 206 244);
-$color-dark-on-primary: rgb(0 52 74);
-$color-dark-primary-container: rgb(0 76 106);
-$color-dark-on-primary-container: rgb(197 231 255);
-$color-dark-secondary: rgb(182 201 216);
-$color-dark-on-secondary: rgb(32 51 62);
-$color-dark-secondary-container: rgb(55 73 85);
-$color-dark-on-secondary-container: rgb(210 229 244);
-$color-dark-tertiary: rgb(203 193 233);
-$color-dark-on-tertiary: rgb(51 44 76);
-$color-dark-tertiary-container: rgb(73 66 99);
-$color-dark-on-tertiary-container: rgb(231 222 255);
+// Generated from base color #9333EA (rgb(147, 51, 234))
+$color-dark-primary: rgb(219 185 249);
+$color-dark-surface-tint: rgb(219 185 249);
+$color-dark-on-primary: rgb(62 36 88);
+$color-dark-primary-container: rgb(86 59 113);
+$color-dark-on-primary-container: rgb(240 219 255);
+$color-dark-secondary: rgb(208 193 218);
+$color-dark-on-secondary: rgb(54 44 63);
+$color-dark-secondary-container: rgb(77 67 86);
+$color-dark-on-secondary-container: rgb(237 221 246);
+$color-dark-tertiary: rgb(243 183 190);
+$color-dark-on-tertiary: rgb(75 37 43);
+$color-dark-tertiary-container: rgb(101 58 64);
+$color-dark-on-tertiary-container: rgb(255 217 221);
 $color-dark-error: rgb(255 180 171);
 $color-dark-on-error: rgb(105 0 5);
 $color-dark-error-container: rgb(147 0 10);
 $color-dark-on-error-container: rgb(255 218 214);
-$color-dark-background: rgb(15 20 23);
-$color-dark-on-background: rgb(223 227 231);
-$color-dark-surface: rgb(15 20 23);
-$color-dark-on-surface: rgb(223 227 231);
-$color-dark-surface-variant: rgb(65 72 77);
-$color-dark-on-surface-variant: rgb(193 199 206);
-$color-dark-outline: rgb(139 146 151);
-$color-dark-outline-variant: rgb(65 72 77);
+$color-dark-background: rgb(21 18 24);
+$color-dark-on-background: rgb(232 224 232);
+$color-dark-surface: rgb(21 18 24);
+$color-dark-on-surface: rgb(232 224 232);
+$color-dark-surface-variant: rgb(74 69 78);
+$color-dark-on-surface-variant: rgb(204 196 206);
+$color-dark-outline: rgb(150 142 152);
+$color-dark-outline-variant: rgb(74 69 78);
 $color-dark-shadow: rgb(0 0 0);
 $color-dark-scrim: rgb(0 0 0);
-$color-dark-inverse-surface: rgb(223 227 231);
-$color-dark-inverse-on-surface: rgb(44 49 52);
-$color-dark-inverse-primary: rgb(31 101 134);
-$color-dark-primary-fixed: rgb(197 231 255);
-$color-dark-on-primary-fixed: rgb(0 30 45);
-$color-dark-primary-fixed-dim: rgb(145 206 244);
-$color-dark-on-primary-fixed-variant: rgb(0 76 106);
-$color-dark-secondary-fixed: rgb(210 229 244);
-$color-dark-on-secondary-fixed: rgb(10 30 40);
-$color-dark-secondary-fixed-dim: rgb(182 201 216);
-$color-dark-on-secondary-fixed-variant: rgb(55 73 85);
-$color-dark-tertiary-fixed: rgb(231 222 255);
-$color-dark-on-tertiary-fixed: rgb(29 23 53);
-$color-dark-tertiary-fixed-dim: rgb(203 193 233);
-$color-dark-on-tertiary-fixed-variant: rgb(73 66 99);
-$color-dark-surface-dim: rgb(15 20 23);
-$color-dark-surface-bright: rgb(53 58 61);
-$color-dark-surface-container-lowest: rgb(10 15 18);
-$color-dark-surface-container-low: rgb(24 28 31);
-$color-dark-surface-container: rgb(28 32 36);
-$color-dark-surface-container-high: rgb(38 43 46);
-$color-dark-surface-container-highest: rgb(49 53 57);
+$color-dark-inverse-surface: rgb(232 224 232);
+$color-dark-inverse-on-surface: rgb(51 47 53);
+$color-dark-inverse-primary: rgb(111 82 138);
+$color-dark-primary-fixed: rgb(240 219 255);
+$color-dark-on-primary-fixed: rgb(40 13 66);
+$color-dark-primary-fixed-dim: rgb(219 185 249);
+$color-dark-on-primary-fixed-variant: rgb(86 59 113);
+$color-dark-secondary-fixed: rgb(237 221 246);
+$color-dark-on-secondary-fixed: rgb(33 24 41);
+$color-dark-secondary-fixed-dim: rgb(208 193 218);
+$color-dark-on-secondary-fixed-variant: rgb(77 67 86);
+$color-dark-tertiary-fixed: rgb(255 217 221);
+$color-dark-on-tertiary-fixed: rgb(50 16 22);
+$color-dark-tertiary-fixed-dim: rgb(243 183 190);
+$color-dark-on-tertiary-fixed-variant: rgb(101 58 64);
+$color-dark-surface-dim: rgb(21 18 24);
+$color-dark-surface-bright: rgb(60 56 62);
+$color-dark-surface-container-lowest: rgb(16 13 18);
+$color-dark-surface-container-low: rgb(30 26 32);
+$color-dark-surface-container: rgb(34 30 36);
+$color-dark-surface-container-high: rgb(44 41 46);
+$color-dark-surface-container-highest: rgb(55 51 57);
 $color-dark-surface-primary-container-lightened: color.adjust($color-dark-primary-container, $lightness: 5%);
 $color-dark-surface-container-lightened: color.adjust($color-dark-surface-container, $lightness: 5%);
 
-// custom colors
-$color-1: rgb(82, 109, 246);
-$color-2: rgb(65, 11, 113);
-$color-4: rgb(95, 26, 198);
-$color-3: rgb(49, 71, 179);
 // Light
 $color-light-primary: rgb(31 101 134);
 $color-light-surface-tint: rgb(31 101 134);