Try fixing login/register

.dockerignore

@@ -0,0 +1,12 @@
+# Exclude data directory to prevent local database from being copied into production images
+backend/data/
+
+# Exclude logs
+backend/logs/
+
+# Exclude development files
+node_modules/
+.git/
+.gitignore
+README.md
+*.log

.gitignore

@@ -575,4 +575,5 @@ backend/alembic/**
 !backend/alembic/env.py
 !backend/alembic/script.py.mako
 !frontend/src/css/lib
-**/*.module.scss.d.ts
+**/*.module.scss.d.ts
+.cursor/plans

.vscode/settings.json

@@ -6,5 +6,6 @@
         "**/.husky/_": true,
         "**/.venv": true,
         "**/node_modules": true
-    }
+    },
+    "python.terminal.activateEnvironment": false
 }

backend/alembic.ini

@@ -5,7 +5,7 @@
 # this is typically a path given in POSIX (e.g. forward slashes)
 # format, relative to the token %(here)s which refers to the location of this
 # ini file
-script_location = %(here)s/alembic
+script_location = alembic
 
 # template used to generate migration file names; The default value is %%(rev)s_%%(slug)s
 # Uncomment the line below if you want the files to be prepended with date and time
@@ -84,7 +84,7 @@ path_separator = os
 # database URL.  This is consumed by the user-maintained env.py script only.
 # other means of configuring database URLs may be customized within the env.py
 # file.
-sqlalchemy.url = sqlite:///./data/database.db
+# sqlalchemy.url is set dynamically from DATABASE_URL environment variable
 
 
 [post_write_hooks]

backend/alembic/env.py

@@ -17,7 +17,7 @@ if config.config_file_name is not None:
 
 # add your model's MetaData object here
 # for 'autogenerate' support
-from models import Base
+from backend.shared.models import Base
 target_metadata = Base.metadata
 
 # other values from the config, defined by the needs of env.py,

backend/app.py

@@ -1,102 +1,43 @@
 import asyncio
 import time
-from fastapi import FastAPI, Request
+from fastapi import FastAPI, Request, HTTPException
 from fastapi.middleware.cors import CORSMiddleware
 from contextlib import asynccontextmanager
 import subprocess
 import sys
 import os
-from routes import account, messaging, profile, push, webrtc, devices, moderation
+import httpx
 import logging
-from models import User
-from constants import OWNER_USERNAME
-from utils import get_client_ip
+# Gateway doesn't need direct model access - it's a stateless proxy
+# Gateway doesn't need constants - it's a stateless proxy
+from backend.shared.utils import get_client_ip
 
-from db import POOL_CONFIG, SessionLocal
-from logging_config import access_logger  # noqa: F401 - ensure loggers configured
-from security.audit import log_access
-from security.rate_limit import limiter
+# Gateway doesn't need database access - it's a stateless proxy
+from backend.logging_config import access_logger  # noqa: F401 - ensure loggers configured
+from backend.security.audit import log_access
+from backend.security.rate_limit import limiter
 from slowapi.middleware import SlowAPIMiddleware
 
+# Service URL mapping for routing
+SERVICE_URLS = {
+    "account": os.getenv("ACCOUNT_SERVICE_URL", "http://account_service:8302"),
+    "profile": os.getenv("PROFILE_SERVICE_URL", "http://profile_service:8303"),
+    "devices": os.getenv("DEVICE_SERVICE_URL", "http://device_service:8304"),
+    "messaging": os.getenv("MESSAGING_SERVICE_URL", "http://messaging_service:8305"),
+    "push": os.getenv("PUSH_SERVICE_URL", "http://push_service:8306"),
+    "webrtc": os.getenv("WEBRTC_SERVICE_URL", "http://webrtc_service:8307"),
+    "moderation": os.getenv("MODERATION_SERVICE_URL", "http://moderation_service:8308"),
+}
+
 logger = logging.getLogger("uvicorn.error")
 
+
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    # Startup - run migration in separate process to avoid logging interference
-    try:
-        logger.info("Starting database migration check...")
-        # Run migration in a separate process
-        subprocess.run(
-            [
-                sys.executable, 
-                "-c", 
-                "import sys; sys.path.append('.'); from migration import run_migrations; run_migrations()"
-            ], 
-            cwd=os.path.dirname(os.path.abspath(__file__))
-        )
-    except Exception as e:
-        logger.error(f"Failed to run database migrations: {e}")
-        raise
-    
-    try:
-        with SessionLocal() as db:
-            owner = db.query(User).filter(User.username == OWNER_USERNAME).first()
-            if owner and not owner.verified:
-                owner.verified = True
-                db.commit()
-                logger.info(f"Owner user '{OWNER_USERNAME}' has been verified")
-            elif owner and owner.verified:
-                logger.info(f"Owner user '{OWNER_USERNAME}' is already verified")
-            else:
-                logger.warning(f"Owner user '{OWNER_USERNAME}' not found")
-    except Exception as e:
-        logger.error(f"Failed to ensure owner verification: {e}")
-    
-    logger.info(
-        "SQLAlchemy pool configured (size=%s, max_overflow=%s, timeout=%ss, recycle=%ss, pre_ping=%s)",
-        POOL_CONFIG["pool_size"],
-        POOL_CONFIG["max_overflow"],
-        POOL_CONFIG["pool_timeout"],
-        POOL_CONFIG["pool_recycle"],
-        POOL_CONFIG["pool_pre_ping"],
-    )
-
-    # Start the messaging cleanup task
-    try:
-        from routes.messaging import messagingManager
-        messagingManager.start_cleanup_task()
-        logger.info("Messaging cleanup task started")
-    except Exception as e:
-        logger.error(f"Failed to start messaging cleanup task: {e}")
-    
-    # Reset all rate limits on startup to ensure clean state
-    # This prevents rate limits from persisting across restarts
-    try:
-        from security.rate_limit import reset_all_rate_limits
-        cleared = reset_all_rate_limits()
-        if cleared > 0:
-            logger.info(f"Cleared {cleared} rate limit entries on startup")
-    except Exception as e:
-        logger.warning(f"Failed to reset rate limits on startup: {e}")
-    
-    # Start the rate limit cleanup task
-    try:
-        from security.rate_limit import start_rate_limit_cleanup_task
-        cleanup_task = asyncio.create_task(start_rate_limit_cleanup_task())
-        logger.info("Rate limit cleanup task started")
-    except Exception as e:
-        logger.error(f"Failed to start rate limit cleanup task: {e}")
-        cleanup_task = None
-    
+    # Gateway is a stateless proxy - no database operations or background tasks needed
+    logger.info("Gateway proxy service initialized - routing to microservices")
     yield
-    
-    # Shutdown - cancel cleanup task if it exists
-    if cleanup_task:
-        cleanup_task.cancel()
-        try:
-            await cleanup_task
-        except asyncio.CancelledError:
-            pass
+    logger.info("Gateway proxy service shutting down.")
 
 # Инициализация FastAPI
 app = FastAPI(title="FromChat", lifespan=lifespan)
@@ -108,6 +49,16 @@ app.add_middleware(SlowAPIMiddleware)
 
 @app.middleware("http")
 async def access_logging_middleware(request: Request, call_next):
+    # Log incoming request and Authorization header presence for debugging auth issues
+    try:
+        auth_header = request.headers.get("authorization")
+        if auth_header:
+            short = auth_header[:20] + "..." if len(auth_header) > 20 else auth_header
+            logger.info("Incoming request %s %s Authorization=%s", request.method, request.url.path, short)
+        else:
+            logger.info("Incoming request %s %s Authorization=NONE", request.method, request.url.path)
+    except Exception:
+        pass
     start = time.perf_counter()
     try:
         response = await call_next(request)
@@ -157,11 +108,87 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
-# Routes
-app.include_router(account.router)
-app.include_router(messaging.router)
-app.include_router(profile.router)
-app.include_router(push.router, prefix="/push")
-app.include_router(webrtc.router, prefix="/webrtc")
-app.include_router(devices.router, prefix="/devices")
-app.include_router(moderation.router)
+# Common API endpoints - route to appropriate services (defined first for priority)
+@app.api_route("/login", methods=["POST"])
+async def login(request: Request):
+    """Login endpoint - routes to account service."""
+    return await _proxy_to_service("account", "login", request)
+
+@app.api_route("/register", methods=["POST"])
+async def register(request: Request):
+    """Register endpoint - routes to account service."""
+    return await _proxy_to_service("account", "register", request)
+
+
+# API routes - route to appropriate microservices
+@app.api_route("/account/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
+async def proxy_account(path: str, request: Request):
+    """Proxy account service requests."""
+    return await _proxy_to_service("account", path, request)
+
+@app.api_route("/profile/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
+async def proxy_profile(path: str, request: Request):
+    """Proxy profile service requests."""
+    return await _proxy_to_service("profile", path, request)
+
+@app.api_route("/devices/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
+async def proxy_devices(path: str, request: Request):
+    """Proxy device service requests."""
+    return await _proxy_to_service("devices", path, request)
+
+@app.api_route("/messaging/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
+async def proxy_messaging(path: str, request: Request):
+    """Proxy messaging service requests."""
+    return await _proxy_to_service("messaging", path, request)
+
+@app.api_route("/push/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
+async def proxy_push(path: str, request: Request):
+    """Proxy push service requests."""
+    return await _proxy_to_service("push", path, request)
+
+@app.api_route("/webrtc/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
+async def proxy_webrtc(path: str, request: Request):
+    """Proxy WebRTC service requests."""
+    return await _proxy_to_service("webrtc", path, request)
+
+@app.api_route("/moderation/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"])
+async def proxy_moderation(path: str, request: Request):
+    """Proxy moderation service requests."""
+    return await _proxy_to_service("moderation", path, request)
+
+async def _proxy_to_service(service: str, path: str, request: Request):
+    """Helper function to proxy requests to microservices."""
+    from fastapi.responses import Response
+
+    service_url = SERVICE_URLS[service]
+    target_url = f"{service_url}/{service}/{path}"
+
+    # Get request body
+    body = await request.body()
+
+    # Prepare headers (remove host header)
+    headers = dict(request.headers)
+    headers.pop("host", None)
+
+    try:
+        async with httpx.AsyncClient(timeout=30.0) as client:
+            response = await client.request(
+                method=request.method,
+                url=target_url,
+                headers=headers,
+                content=body,
+                params=request.query_params,
+            )
+
+            # Return response with the same status code and content
+            content = response.content
+            return Response(
+                content=content,
+                status_code=response.status_code,
+                headers={"content-type": response.headers.get("content-type", "application/json")}
+            )
+    except httpx.RequestError as exc:
+        logging.error(f"Error communicating with {service} service: {exc}")
+        raise HTTPException(status_code=503, detail=f"Service {service} unavailable")
+
+# Routes are handled by the catch-all proxy above

backend/dependencies.py

@@ -5,8 +5,10 @@ from sqlalchemy.orm import Session
 from utils import verify_token
 from models import User, DeviceSession
 from db import SessionLocal
+import logging
 
 security = HTTPBearer()
+logger = logging.getLogger("uvicorn.error")
 
 # Зависимость для получения сессии БД
 def get_db():
@@ -23,8 +25,17 @@ def get_current_user(
     db: Session = Depends(get_db),
 ) -> User:
     token = credentials.credentials
-    payload = verify_token(token)
+    try:
+        payload = verify_token(token)
+    except Exception as e:
+        logger.warning("get_current_user: token verification error: %s", str(e))
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
     if not payload:
+        logger.info("get_current_user: verify_token returned empty payload")
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid or expired token",
@@ -32,6 +43,7 @@ def get_current_user(
         )
     user = db.query(User).filter(User.id == payload["user_id"]).first()
     if not user:
+        logger.info("get_current_user: user not found for user_id=%s", payload.get("user_id"))
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="User not found",
@@ -60,6 +72,7 @@ def get_current_user(
     )
 
     if not device_session or device_session.revoked:
+        logger.info("get_current_user: session missing/revoked for user_id=%s session_id=%s", user.id, session_id)
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Session revoked or not found",
@@ -73,6 +86,7 @@ def get_current_user(
         # Session expired due to inactivity - revoke it
         device_session.revoked = True
         db.commit()
+        logger.info("get_current_user: session expired due to inactivity for user_id=%s session_id=%s", user.id, session_id)
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Session expired due to inactivity",
@@ -85,6 +99,7 @@ def get_current_user(
 
     # Check if user is suspended
     if user.suspended:
+        logger.info("get_current_user: account suspended for user_id=%s reason=%s", user.id, user.suspension_reason)
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Account suspended",
@@ -93,6 +108,7 @@ def get_current_user(
 
     # Check if user is deleted
     if user.deleted:
+        logger.info("get_current_user: account deleted for user_id=%s", user.id)
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Account deleted",

backend/main.py

@@ -1,7 +1,7 @@
-from constants import *
-from db import *
-from models import *
-from validation import *
-from utils import *
-from dependencies import *
+from backend.shared.constants import *
+from backend.shared.db import *
+from backend.shared.models import *
+from backend.shared.validation import *
+from backend.shared.utils import *
+from backend.shared.dependencies import *
 from app import *

backend/migration.py

@@ -8,7 +8,7 @@ from alembic import command
 from alembic.config import Config
 from alembic.runtime.migration import MigrationContext
 from sqlalchemy import create_engine
-from constants import DATABASE_URL
+from backend.shared.constants import DATABASE_URL
 import logging
 
 logger = logging.getLogger(__name__)
@@ -19,19 +19,36 @@ def run_migrations():
     This function will upgrade the database to the latest migration.
     Fully automated - handles all scenarios automatically.
     """
+    # Get the directory where this script is located
+    current_dir = os.path.dirname(os.path.abspath(__file__))
+
     try:
-        # Get the directory where this script is located
-        current_dir = os.path.dirname(os.path.abspath(__file__))
-        
+        # FIRST: Check if database has any application tables (excluding alembic_version)
+        engine = create_engine(DATABASE_URL)
+        with engine.connect() as connection:
+            from sqlalchemy import inspect
+            inspector = inspect(connection)
+            existing_tables = [table for table in inspector.get_table_names()
+                             if not table.startswith('sqlite_') and table != 'alembic_version']
+
+        # If no application tables exist, create them directly from models
+        if not existing_tables:
+            logger.info("No application tables found. Creating all tables directly from models...")
+            from backend.shared.models import Base
+            Base.metadata.create_all(bind=engine)
+            logger.info("All tables created successfully from models.")
+
+        # Note: Problematic migrations are now cleaned up during Docker build
+
         # Create Alembic configuration
         alembic_cfg = Config(os.path.join(current_dir, "alembic.ini"))
-        
+
         # Disable Alembic's logging configuration to avoid interfering with FastAPI
         alembic_cfg.set_main_option("configure_logging", "false")
-        
+
         # Set the database URL in the config
         alembic_cfg.set_main_option("sqlalchemy.url", DATABASE_URL)
-        
+
         # Check if any migration files exist
         versions_dir = os.path.join(current_dir, "alembic", "versions")
 
@@ -39,6 +56,13 @@ def run_migrations():
             os.makedirs(versions_dir)
 
         migration_files = [f for f in os.listdir(versions_dir) if f.endswith('.py') and not f.startswith('__')]
+
+        # If no migration files exist after cleanup, create initial migration
+        if not migration_files:
+            logger.info("No migration files found after cleanup. Creating initial migration...")
+            command.revision(alembic_cfg, autogenerate=True, message="Initial migration")
+            migration_files = [f for f in os.listdir(versions_dir) if f.endswith('.py') and not f.startswith('__')]
+            logger.info(f"Created {len(migration_files)} initial migration(s)")
         
         if not migration_files:
             logger.info("No migration files found. Creating initial migration...")
@@ -123,7 +147,11 @@ def run_migrations():
             command.upgrade(alembic_cfg, "head")
             logger.info("Database migrations completed successfully.")
         except Exception as upgrade_error:
-            if "Can't locate revision identified by 'direct_creation'" in str(upgrade_error):
+            error_msg = str(upgrade_error)
+            # Handle PostgreSQL "already exists" errors gracefully
+            if "already exists" in error_msg.lower() or "relation" in error_msg.lower() and "exists" in error_msg.lower():
+                pass
+            elif "Can't locate revision identified by 'direct_creation'" in error_msg:
                 logger.info("Found 'direct_creation' revision - resetting migration state...")
                 # Clear the alembic_version table and start fresh
                 engine = create_engine(DATABASE_URL)
@@ -164,10 +192,11 @@ def run_migrations():
                     from sqlalchemy import text
                     connection.execute(text("DELETE FROM alembic_version"))
                     connection.commit()
-                
+
                 # Try upgrade again
                 command.upgrade(alembic_cfg, "head")
                 logger.info("Database migrations completed successfully after reset.")
+            # Note: Index-related errors are now prevented by Docker build cleanup
             else:
                 raise upgrade_error
         
@@ -274,7 +303,7 @@ def _populate_migration_file(migration_path):
 
 def _generate_migration_from_models():
     """Generate migration content dynamically from SQLAlchemy models."""
-    from models import Base
+    from backend.shared.models import Base
     import sqlalchemy as sa
     from datetime import datetime
     
@@ -459,10 +488,12 @@ def _get_column_type(column):
 
 def _create_database_directly():
     """Fallback method: create database directly using SQLAlchemy."""
-    from models import Base
-    from db import engine
+    from backend.shared.models import Base
+    from backend.shared.db import get_engine
     from sqlalchemy import text, inspect
-    
+
+    engine = get_engine()
+
     # Check existing tables and update schema
     with engine.connect() as connection:
         inspector = inspect(connection)
@@ -519,35 +550,38 @@ def _create_database_directly():
                     logger.info(f"Creating table {table_name}")
         
         # Create alembic_version table manually
-        connection.execute(text("""
-            CREATE TABLE IF NOT EXISTS alembic_version (
-                version_num VARCHAR(32) NOT NULL,
-                CONSTRAINT alembic_version_pkc PRIMARY KEY (version_num)
-            )
-        """))
-        
-        # Get the correct revision ID from existing migration files
-        current_dir = os.path.dirname(os.path.abspath(__file__))
-        versions_dir = os.path.join(current_dir, "alembic", "versions")
-        migration_files = [f for f in os.listdir(versions_dir) if f.endswith('.py') and not f.startswith('__')]
-        
-        if migration_files:
-            latest_migration = max(migration_files)
-            migration_path = os.path.join(versions_dir, latest_migration)
-            
-            with open(migration_path, 'r') as f:
-                content = f.read()
-                import re
-                revision_match = re.search(r"revision: str = '([^']+)'", content)
-                if revision_match:
-                    revision_id = revision_match.group(1)
-                    connection.execute(text(f"INSERT OR IGNORE INTO alembic_version (version_num) VALUES ('{revision_id}')"))
-                else:
-                    connection.execute(text("INSERT OR IGNORE INTO alembic_version (version_num) VALUES ('direct_creation')"))
-        else:
-            connection.execute(text("INSERT OR IGNORE INTO alembic_version (version_num) VALUES ('direct_creation')"))
-        
-        connection.commit()
+        engine = get_engine(DATABASE_URL)
+        with engine.connect() as connection:
+            # Create alembic_version table manually
+            connection.execute(text("""
+                CREATE TABLE IF NOT EXISTS alembic_version (
+                    version_num VARCHAR(32) NOT NULL,
+                    CONSTRAINT alembic_version_pkc PRIMARY KEY (version_num)
+                )
+            """))
+
+            # Get the correct revision ID from existing migration files
+            current_dir = os.path.dirname(os.path.abspath(__file__))
+            versions_dir = os.path.join(current_dir, "alembic", "versions")
+            migration_files = [f for f in os.listdir(versions_dir) if f.endswith('.py') and not f.startswith('__')]
+
+            if migration_files:
+                latest_migration = max(migration_files)
+                migration_path = os.path.join(versions_dir, latest_migration)
+
+                with open(migration_path, 'r') as f:
+                    content = f.read()
+                    import re
+                    revision_match = re.search(r"revision: str = '([^']+)'", content)
+                    if revision_match:
+                        revision_id = revision_match.group(1)
+                        connection.execute(text(f"INSERT INTO alembic_version (version_num) VALUES ('{revision_id}') ON CONFLICT DO NOTHING"))
+                    else:
+                        connection.execute(text("INSERT INTO alembic_version (version_num) VALUES ('direct_creation') ON CONFLICT DO NOTHING"))
+            else:
+                connection.execute(text("INSERT OR IGNORE INTO alembic_version (version_num) VALUES ('direct_creation')"))
+
+            connection.commit()
 
 
 def _get_sql_type(column):

backend/models.py

@@ -113,6 +113,16 @@ class PushSubscription(Base):
     updated_at = Column(DateTime, default=datetime.now, onupdate=datetime.now)
 
 
+class FcmToken(Base):
+    __tablename__ = "fcm_token"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(Integer, ForeignKey("user.id"), nullable=False, index=True)
+    token = Column(Text, nullable=False, unique=True)
+    created_at = Column(DateTime, default=datetime.now)
+    updated_at = Column(DateTime, default=datetime.now, onupdate=datetime.now)
+
+
 class Reaction(Base):
     __tablename__ = "reaction"
 

backend/push_service.py

@@ -1,152 +0,0 @@
-import json
-import logging
-import os
-from typing import List, Optional
-from sqlalchemy.orm import Session
-from pywebpush import webpush, WebPushException
-from models import PushSubscription, User, Message, DMEnvelope
-
-logger = logging.getLogger("uvicorn.error")
-
-class PushNotificationService:
-    def __init__(self):
-        self.vapid_private_key = os.getenv("VAPID_PRIVATE_KEY")
-        self.vapid_public_key = os.getenv("VAPID_PUBLIC_KEY")
-
-        if (not self.vapid_public_key) or (not self.vapid_private_key):
-            raise ValueError("VAPID public or private key is None")
-
-        self.vapid_claims = {
-            "sub": "mailto:support@fromchat.ru",
-            "aud": "https://fcm.googleapis.com"
-        }
-
-    async def subscribe_user(self, db: Session, user_id: int, endpoint: str, p256dh_key: str, auth_key: str) -> bool:
-        """Subscribe a user to push notifications"""
-        try:
-            # Check if user already has a subscription
-            existing_sub = db.query(PushSubscription).filter(PushSubscription.user_id == user_id).first()
-            
-            if existing_sub:
-                # Update existing subscription
-                existing_sub.endpoint = endpoint
-                existing_sub.p256dh_key = p256dh_key
-                existing_sub.auth_key = auth_key
-            else:
-                # Create new subscription
-                new_sub = PushSubscription(
-                    user_id=user_id,
-                    endpoint=endpoint,
-                    p256dh_key=p256dh_key,
-                    auth_key=auth_key
-                )
-                db.add(new_sub)
-            
-            db.commit()
-            logger.info(f"Push subscription saved for user {user_id}")
-            return True
-        except Exception as e:
-            logger.error(f"Failed to save push subscription for user {user_id}: {e}")
-            db.rollback()
-            return False
-
-    async def send_public_message_notification(self, db: Session, message: Message, exclude_user_id: Optional[int] = None):
-        """Send push notification for a new public chat message"""
-        try:
-            # Get all users except the sender
-            users = db.query(User).filter(User.id != message.user_id)
-            if exclude_user_id:
-                users = users.filter(User.id != exclude_user_id)
-            
-            for user in users:
-                # Check if user has push subscription before trying to send
-                subscription = db.query(PushSubscription).filter(PushSubscription.user_id == user.id).first()
-                if not subscription:
-                    continue
-                    
-                await self._send_notification_to_user(
-                    db, user.id, 
-                    f"New message from {message.author.username}",
-                    message.content[:100] + ("..." if len(message.content) > 100 else ""),
-                    message.author.profile_picture,
-                    {
-                        "type": "public_message",
-                        "message_id": message.id,
-                        "sender_id": message.user_id,
-                        "sender_username": message.author.username
-                    }
-                )
-        except Exception as e:
-            logger.error(f"Failed to send public message notifications: {e}")
-
-    async def send_dm_notification(self, db: Session, dm_envelope: DMEnvelope, sender: User):
-        """Send push notification for a new DM"""
-        try:
-            await self._send_notification_to_user(
-                db, dm_envelope.recipient_id,
-                f"New message from {sender.username}",
-                "You have a new direct message",
-                sender.profile_picture,
-                {
-                    "type": "dm",
-                    "dm_id": dm_envelope.id,
-                    "sender_id": sender.id,
-                    "sender_username": sender.username
-                }
-            )
-        except Exception as e:
-            logger.error(f"Failed to send DM notification: {e}")
-
-    async def _send_notification_to_user(self, db: Session, user_id: int, title: str, body: str, icon: Optional[str], data: dict):
-        """Send a push notification to a specific user"""
-        try:
-            subscription = db.query(PushSubscription).filter(PushSubscription.user_id == user_id).first()
-            if not subscription:
-                return
-
-            payload = {
-                "title": title,
-                "body": body,
-                "icon": icon or "about:blank",
-                "tag": f"message_{user_id}",
-                "data": data
-            }
-
-            subscription_info = {
-                "endpoint": subscription.endpoint,
-                "keys": {
-                    "p256dh": subscription.p256dh_key,
-                    "auth": subscription.auth_key
-                }
-            }
-
-            webpush(
-                subscription_info=subscription_info,
-                data=json.dumps(payload),
-                vapid_private_key=self.vapid_private_key,
-                vapid_claims=self.vapid_claims
-            )
-            
-        except WebPushException as e:
-            logger.error(f"WebPush error for user {user_id}: {e}")
-            # If the subscription is invalid, remove it
-            if hasattr(e, 'response') and e.response and e.response.status_code in [410, 404]:
-                db.query(PushSubscription).filter(PushSubscription.user_id == user_id).delete()
-                db.commit()
-        except Exception as e:
-            logger.error(f"Failed to send push notification to user {user_id}: {e}")
-
-    async def unsubscribe_user(self, db: Session, user_id: int) -> bool:
-        """Unsubscribe a user from push notifications"""
-        try:
-            db.query(PushSubscription).filter(PushSubscription.user_id == user_id).delete()
-            db.commit()
-            logger.info(f"Push subscription removed for user {user_id}")
-            return True
-        except Exception as e:
-            logger.error(f"Failed to remove push subscription for user {user_id}: {e}")
-            db.rollback()
-            return False
-
-# Global instance
-push_service = PushNotificationService()

backend/requirements.txt

@@ -2,6 +2,7 @@ PyJWT>=2.8.0
 fastapi[standard]>=0.116.1
 pydantic>=2.11.7
 sqlalchemy>=2.0.43
+psycopg2-binary>=2.9.9
 bcrypt>=4.3.0
 websockets>=15.0.1
 Pillow>=10.0.0
@@ -14,3 +15,5 @@ user-agents>=2.2.0
 httpx>=0.27.2
 rich>=13.9.4
 slowapi>=0.1.9
+firebase_admin>=7.1.0
+PyNaCl>=1.5.0

backend/routes/account.py

@@ -8,16 +8,16 @@ import uuid
 from user_agents import parse as parse_ua
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
 
-from constants import OWNER_USERNAME
-from dependencies import get_current_user, get_db
-from models import LoginRequest, RegisterRequest, ChangePasswordRequest, User, CryptoPublicKey, CryptoBackup, DeviceSession
-from utils import create_token, get_password_hash, verify_password, get_client_ip
-from validation import is_valid_password, is_valid_username, is_valid_display_name
+from backend.shared.constants import OWNER_USERNAME
+from backend.shared.dependencies import get_current_user, get_db
+from backend.shared.models import LoginRequest, RegisterRequest, ChangePasswordRequest, User, CryptoPublicKey, CryptoBackup
+from backend.shared.utils import create_token, get_password_hash, verify_password, get_client_ip
+from backend.shared.validation import is_valid_password, is_valid_username, is_valid_display_name
 import os
 
-from security.audit import log_security
-from security.profanity import contains_profanity
-from security.rate_limit import rate_limit_per_ip
+from backend.security.audit import log_security
+from backend.security.profanity import contains_profanity
+from backend.security.rate_limit import rate_limit_per_ip
 router = APIRouter()
 
 _FAILED_ATTEMPT_WINDOW_SECONDS = 300
@@ -39,21 +39,24 @@ def _record_failed_login(identifier: str) -> bool:
 def _reset_failed_logins(identifier: str) -> None:
     _failed_login_attempts.pop(identifier, None)
 
+def _is_admin(user: User) -> bool:
+    return user.id == 1
+
 def convert_user(user: User) -> dict:
     return {
         "id": user.id,
         "created_at": user.created_at.isoformat(),
         "last_seen": user.last_seen.isoformat(),
-        "online": user.online,
+        "online": user.is_online,
         "username": user.username,
         "display_name": user.display_name,
-        "profile_picture": user.profile_picture,
+        "profile_picture": user.avatar_url,
         "bio": user.bio,
-        "admin": user.username == OWNER_USERNAME,
+        "admin": _is_admin(user),
         "verified": user.verified,
-        "suspended": user.suspended or False,
+        "suspended": user.suspended,
         "suspension_reason": user.suspension_reason,
-        "deleted": (user.deleted or user.suspended) or False  # Treat suspended as deleted
+        "deleted": user.deleted
     }
 
 @router.get("/check_auth")
@@ -61,7 +64,7 @@ def check_auth(current_user: User = Depends(get_current_user)):
     return {
         "authenticated": True,
         "username": current_user.username,
-        "admin": current_user.username == OWNER_USERNAME
+        "admin": _is_admin(current_user)
     }
 
 
@@ -74,7 +77,7 @@ def login(request: Request, login_request: LoginRequest, db: Session = Depends(g
 
     user = db.query(User).filter(User.username == username).first()
 
-    if not user or not verify_password(login_request.password.strip(), user.password_hash):
+    if not user or not verify_password(login_request.password.strip(), user.hashed_password):
         log_security(
             "login_failed",
             severity="warning",
@@ -109,30 +112,9 @@ def login(request: Request, login_request: LoginRequest, db: Session = Depends(g
             detail="Неверное имя пользователя или пароль"
         )
 
-    # Create device session and embed into JWT
-    raw_ua = request.headers.get("user-agent")
-    device_name = request.headers.get("x-device-name")
-    ua = parse_ua(raw_ua or "")
+    # Generate session ID for JWT (device session will be created on first device service access)
     session_id = uuid.uuid4().hex
 
-    device = DeviceSession(
-        user_id=user.id,
-        raw_user_agent=raw_ua,
-        device_name=device_name,
-        device_type=("mobile" if ua.is_mobile else "tablet" if ua.is_tablet else "bot" if ua.is_bot else "desktop"),
-        os_name=(ua.os.family or None),
-        os_version=(ua.os.version_string or None),
-        browser_name=(ua.browser.family or None),
-        browser_version=(ua.browser.version_string or None),
-        brand=(ua.device.brand or None),
-        model=(ua.device.model or None),
-        session_id=session_id,
-        created_at=datetime.now(),
-        last_seen=datetime.now(),
-        revoked=False,
-    )
-    db.add(device)
-
     user.online = True
     user.last_seen = datetime.now()
     db.commit()
@@ -145,15 +127,19 @@ def login(request: Request, login_request: LoginRequest, db: Session = Depends(g
     for identifier in identifiers:
         _reset_failed_logins(identifier)
 
+    # Parse user agent for logging
+    ua = parse_ua(raw_ua or "")
+    device_type = "mobile" if ua.is_mobile else "tablet" if ua.is_tablet else "bot" if ua.is_bot else "desktop"
+
     log_security(
         "login_success",
         username=user.username,
         user_id=user.id,
         ip=client_ip,
         session_id=session_id,
-        device=device.device_type,
-        os=device.os_name,
-        browser=device.browser_name,
+        device=device_type,
+        os=ua.os.family,
+        browser=ua.browser.family,
     )
 
     return {
@@ -177,13 +163,6 @@ def register(request: Request, register_request: RegisterRequest, db: Session =
     # Determine if owner already exists
     owner_exists = db.query(User).filter(User.username == OWNER_USERNAME).first() is not None
 
-    # If owner not yet registered, only allow the owner to register
-    if not owner_exists and username != OWNER_USERNAME:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Регистрация временно закрыта до регистрации владельца"
-        )
-
     # Validate input
     if not is_valid_username(username):
         raise HTTPException(
@@ -219,13 +198,6 @@ def register(request: Request, register_request: RegisterRequest, db: Session =
             detail="Пароли не совпадают"
         )
 
-    # After owner exists, disallow registering the reserved owner username via public registration
-    if owner_exists and username == OWNER_USERNAME:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="Это имя пользователя зарезервировано"
-        )
-
     existing_user = db.query(User).filter(User.username == username).first()
     if existing_user:
         raise HTTPException(
@@ -241,8 +213,9 @@ def register(request: Request, register_request: RegisterRequest, db: Session =
     new_user = User(
         username=username,
         display_name=display_name,
-        password_hash=hashed_password,
-        online=True,
+        hashed_password=hashed_password,
+        salt="",  # Not used since bcrypt includes salt in hash
+        is_online=True,
         last_seen=datetime.now(),
         verified=is_owner
     )
@@ -251,32 +224,13 @@ def register(request: Request, register_request: RegisterRequest, db: Session =
     db.commit()
     db.refresh(new_user)
 
-    # Create initial device session
-    raw_ua = request.headers.get("user-agent")
-    device_name = request.headers.get("x-device-name")
-    ua = parse_ua(raw_ua or "")
+    # Generate a temporary session ID for the token (device session will be created on first device service access)
     session_id = uuid.uuid4().hex
-    device = DeviceSession(
-        user_id=new_user.id,
-        raw_user_agent=raw_ua,
-        device_name=device_name,
-        device_type=("mobile" if ua.is_mobile else "tablet" if ua.is_tablet else "bot" if ua.is_bot else "desktop"),
-        os_name=(ua.os.family or None),
-        os_version=(ua.os.version_string or None),
-        browser_name=(ua.browser.family or None),
-        browser_version=(ua.browser.version_string or None),
-        brand=(ua.device.brand or None),
-        model=(ua.device.model or None),
-        session_id=session_id,
-        created_at=datetime.now(),
-        last_seen=datetime.now(),
-        revoked=False,
-    )
-    db.add(device)
-    db.commit()
-
     token = create_token(new_user.id, new_user.username, session_id)
 
+    # Parse user agent for logging
+    raw_ua = request.headers.get("user-agent")
+    ua = parse_ua(raw_ua or "")
     os_name = ua.os.family or "Unknown OS"
     if ua.os.version_string:
         os_name = f"{os_name} {ua.os.version_string}"
@@ -355,7 +309,7 @@ def delete_user_as_owner(
     db: Session = Depends(get_db)
 ):
     # Only owner can delete users
-    if current_user.username != OWNER_USERNAME:
+    if _is_admin(current_user):
         raise HTTPException(status_code=403, detail="Only owner can perform this action")
 
     user = db.query(User).filter(User.id == user_id).first()
@@ -363,11 +317,11 @@ def delete_user_as_owner(
         raise HTTPException(status_code=404, detail="User not found")
 
     # Prevent deleting the owner account via API
-    if user.username == OWNER_USERNAME:
+    if _is_admin(user):
         raise HTTPException(status_code=400, detail="Cannot delete owner account")
 
     # Manually delete user's messages to satisfy FK constraints
-    from models import Message  # local import to avoid circular
+    from backend.shared.models import Message  # local import to avoid circular
     db.query(Message).filter(Message.user_id == user.id).delete()
 
     db.delete(user)
@@ -391,14 +345,14 @@ def logout(
     current_user: User = Depends(get_current_user),
     db: Session = Depends(get_db)
 ):
-    # Revoke current session
-    from utils import verify_token as _verify_token
-    payload = _verify_token(credentials.credentials)
-    if payload and payload.get("session_id"):
-        db.query(DeviceSession).filter(
-            DeviceSession.user_id == current_user.id,
-            DeviceSession.session_id == payload["session_id"],
-        ).update({DeviceSession.revoked: True})
+    # Revoke current session - TODO: Move to device service
+    # from backend.shared.utils import verify_token as _verify_token
+    # payload = _verify_token(credentials.credentials)
+    # if payload and payload.get("session_id"):
+    #     db.query(DeviceSession).filter(
+    #         DeviceSession.user_id == current_user.id,
+    #         DeviceSession.session_id == payload["session_id"],
+    #     ).update({DeviceSession.revoked: True})
 
     current_user.online = False
     current_user.last_seen = datetime.now()
@@ -410,7 +364,7 @@ def logout(
         username=current_user.username,
         user_id=current_user.id,
         ip=client_ip,
-        session_id=payload.get("session_id") if payload else None,
+        session_id=None,  # TODO: Get session_id from device service
     )
 
     return {
@@ -429,25 +383,25 @@ def change_password(
     db: Session = Depends(get_db)
 ):
     # Verify current derived password against stored hash
-    if not verify_password(password_request.currentPasswordDerived.strip(), current_user.password_hash):
+    if not verify_password(password_request.currentPasswordDerived.strip(), current_user.hashed_password):
         raise HTTPException(status_code=401, detail="Текущий пароль неверный")
 
     # Update password hash to hash of new derived password
-    current_user.password_hash = get_password_hash(password_request.newPasswordDerived.strip())
+    current_user.hashed_password = get_password_hash(password_request.newPasswordDerived.strip())
     db.commit()
 
-    # Optionally revoke all other sessions, keeping the current one
-    if password_request.logoutAllExceptCurrent:
-        from utils import verify_token as _verify_token
-        payload = _verify_token(credentials.credentials)
-        if not payload:
-            raise HTTPException(status_code=401, detail="Invalid token")
-        current_session_id = payload.get("session_id")
-        db.query(DeviceSession).filter(
-            DeviceSession.user_id == current_user.id,
-            DeviceSession.session_id != current_session_id,
-        ).update({DeviceSession.revoked: True})
-        db.commit()
+    # Optionally revoke all other sessions, keeping the current one - TODO: Move to device service
+    # if password_request.logoutAllExceptCurrent:
+    #     from backend.shared.utils import verify_token as _verify_token
+    #     payload = _verify_token(credentials.credentials)
+    #     if not payload:
+    #             raise HTTPException(status_code=401, detail="Invalid token")
+    #     current_session_id = payload.get("session_id")
+    #     db.query(DeviceSession).filter(
+    #         DeviceSession.user_id == current_user.id,
+    #         DeviceSession.session_id != current_session_id,
+    #     ).update({DeviceSession.revoked: True})
+    #     db.commit()
 
     client_ip = get_client_ip(request)
     log_security(
@@ -507,7 +461,7 @@ async def _delete_user_data(user: User, db: Session):
     user.deleted = True
     user.display_name = f"Deleted User #{user_id}"
     user.bio = None
-    user.password_hash = ""
+    user.hashed_password = ""
     user.username = f"deleted_{user_id}"
     user.profile_picture = None
     user.last_seen = None  # Clear last seen timestamp
@@ -567,7 +521,7 @@ async def delete_account(
     Delete the current user's own account - preserves messages/DMs/reactions/files
     """
     # Prevent admin/owner account self-deletion
-    if current_user.username == OWNER_USERNAME or current_user.id == 1:
+    if _is_admin(current_user):
         raise HTTPException(status_code=400, detail="Cannot delete admin/owner account")
     
     await _delete_user_data(current_user, db)

backend/routes/devices.py

@@ -2,9 +2,9 @@ from datetime import datetime
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 
-from dependencies import get_current_user, get_db
-from models import User, DeviceSession
-from utils import verify_token
+from backend.shared.dependencies import get_current_user, get_db
+from backend.shared.models import User, DeviceSession
+from backend.shared.utils import verify_token
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 
 router = APIRouter()

backend/routes/messaging.py

@@ -16,26 +16,30 @@ from fastapi import APIRouter, Depends, HTTPException, WebSocket, WebSocketDisco
 from fastapi.responses import FileResponse
 from fastapi.security import HTTPAuthorizationCredentials
 from sqlalchemy.orm import Session
-from dependencies import get_current_user, get_db
-from .account import convert_user
-from constants import OWNER_USERNAME
-from models import Message, SendMessageRequest, EditMessageRequest, User, DMEnvelope, MessageFile, DMFile, Reaction, ReactionRequest, ReactionResponse, DMReaction, DMReactionRequest, DMReactionResponse, UpdateLog
-from push_service import push_service
+from backend.shared.dependencies import get_current_user, get_db
+from backend.shared.utils import convert_user
+from backend.shared.constants import OWNER_USERNAME
+from backend.shared.models import Message, SendMessageRequest, EditMessageRequest, User, DMEnvelope, MessageFile, DMFile, Reaction, ReactionRequest, ReactionResponse, DMReaction, DMReactionRequest, DMReactionResponse, UpdateLog
+import os
+import httpx
 from PIL import Image
 import io
 import json
+from pydantic import BaseModel
 from better_profanity import profanity as _bp
-from security.audit import log_access, log_dm, log_public_chat, log_security
-from security.profanity import contains_profanity
-from security.rate_limit import rate_limit_per_ip
-from websocket.utils import authenticate_user
+from backend.security.audit import log_access, log_dm, log_public_chat, log_security
+from backend.security.profanity import contains_profanity
+from backend.security.rate_limit import rate_limit_per_ip
+from backend.services.messaging.files.websocket.utils import authenticate_user
+
+from backend.shared.models import FcmToken
 
 router = APIRouter()
 logger = logging.getLogger("uvicorn.error")
 
 MAX_TOTAL_SIZE = 4 * 1024 * 1024 * 1024  # 4 GB
 
-FILES_BASE_DIR = Path("data/uploads/files")
+FILES_BASE_DIR = Path(__file__).resolve().parent.parent / "data" / "uploads" / "files"
 FILES_NORMAL_DIR = FILES_BASE_DIR / "normal"
 FILES_ENCRYPTED_DIR = FILES_BASE_DIR / "encrypted"
 
@@ -50,8 +54,8 @@ _BURST_COUNT_THRESHOLD = 20
 _SHORT_MESSAGE_LENGTH = 8
 _SHORT_MESSAGE_REPEAT_LIMIT = 4
 
-_recent_message_cache: dict[int, deque[tuple[str, str, float]]] = defaultdict(deque)
-_message_rate_cache: dict[int, deque[float]] = defaultdict(deque)
+_recent_message_cache: dict[int, deque[tuple[str, str, float, int]]] = defaultdict(deque)  # (normalized, content, timestamp, message_id)
+_message_rate_cache: dict[int, deque[tuple[float, int]]] = defaultdict(deque)  # (timestamp, message_id)
 _burst_last_logged: dict[int, float] = {}
 
 
@@ -62,12 +66,23 @@ def _normalize_for_spam(text: str) -> str:
     return cleaned
 
 
-def _monitor_public_message_activity(user: User, content: str, db: Session) -> None:
+def _monitor_public_message_activity(user: User, content: str, message_id: int, db: Session) -> None:
     now = time.time()
 
-    def suspend(reason: str, event: str, **extra: Any) -> None:
+    def suspend(reason: str, event: str, message_ids_to_delete: list[int] = None, **extra: Any) -> None:
         if user.suspended or user.id == 1:
             return
+        
+        # Delete spam messages that triggered the ban
+        if message_ids_to_delete:
+            try:
+                deleted_count = db.query(Message).filter(Message.id.in_(message_ids_to_delete)).delete(synchronize_session=False)
+                db.commit()
+                logger.info(f"Deleted {deleted_count} spam messages for user {user.id}")
+            except Exception as e:
+                logger.error(f"Failed to delete spam messages: {e}")
+                db.rollback()
+        
         user.suspended = True
         user.suspension_reason = reason
         db.commit()
@@ -77,6 +92,7 @@ def _monitor_public_message_activity(user: User, content: str, db: Session) -> N
             user_id=user.id,
             username=user.username,
             reason=reason,
+            deleted_messages=len(message_ids_to_delete) if message_ids_to_delete else 0,
             **extra,
         )
         try:
@@ -86,8 +102,8 @@ def _monitor_public_message_activity(user: User, content: str, db: Session) -> N
 
     # Rate tracking for burst detection
     rate_bucket = _message_rate_cache[user.id]
-    rate_bucket.append(now)
-    while rate_bucket and now - rate_bucket[0] > _BURST_WINDOW_SECONDS:
+    rate_bucket.append((now, message_id))
+    while rate_bucket and now - rate_bucket[0][0] > _BURST_WINDOW_SECONDS:
         rate_bucket.popleft()
 
     burst_count = len(rate_bucket)
@@ -103,12 +119,17 @@ def _monitor_public_message_activity(user: User, content: str, db: Session) -> N
                 window_seconds=_BURST_WINDOW_SECONDS,
             )
             _burst_last_logged[user.id] = now
+        
+        # Get all message IDs from the burst window
+        burst_message_ids = [msg_id for _, msg_id in rate_bucket]
         suspend(
             "Automatic suspension: excessive message rate",
             "auto_suspension_public_burst",
+            message_ids_to_delete=burst_message_ids,
             count=burst_count,
             window_seconds=_BURST_WINDOW_SECONDS,
         )
+        return
 
     # Similarity-based spam detection
     normalized = _normalize_for_spam(content)
@@ -116,21 +137,25 @@ def _monitor_public_message_activity(user: User, content: str, db: Session) -> N
     while history and now - history[0][2] > _SPAM_WINDOW_SECONDS:
         history.popleft()
 
-    prior_same = sum(1 for prev_norm, _, _ in history if prev_norm == normalized)
+    prior_same = sum(1 for prev_norm, _, _, _ in history if prev_norm == normalized)
     prior_similar = sum(
         1
-        for prev_norm, _, _ in history
+        for prev_norm, _, _, _ in history
         if prev_norm and normalized and prev_norm != normalized and SequenceMatcher(None, normalized, prev_norm).ratio() >= _SPAM_SIMILARITY_THRESHOLD
     )
 
-    history.append((normalized, content, now))
+    history.append((normalized, content, now, message_id))
 
     total_matches = prior_same + prior_similar + 1
 
     if len(normalized) <= _SHORT_MESSAGE_LENGTH and prior_same + 1 >= _SHORT_MESSAGE_REPEAT_LIMIT:
+        # Get message IDs of all matching short messages
+        spam_message_ids = [msg_id for prev_norm, _, _, msg_id in history if prev_norm == normalized]
+        spam_message_ids.append(message_id)  # Include current message
         suspend(
             "Automatic suspension: repeated short messages",
             "auto_suspension_public_spam",
+            message_ids_to_delete=spam_message_ids,
             occurrences=prior_same + 1,
             window_seconds=_SPAM_WINDOW_SECONDS,
             match_type="short",
@@ -138,9 +163,20 @@ def _monitor_public_message_activity(user: User, content: str, db: Session) -> N
         return
 
     if total_matches >= _SPAM_MESSAGE_LIMIT:
+        # Get message IDs of all matching similar messages
+        spam_message_ids = []
+        for prev_norm, _, _, msg_id in history:
+            if prev_norm == normalized:
+                spam_message_ids.append(msg_id)
+            elif prev_norm and normalized and prev_norm != normalized:
+                similarity = SequenceMatcher(None, normalized, prev_norm).ratio()
+                if similarity >= _SPAM_SIMILARITY_THRESHOLD:
+                    spam_message_ids.append(msg_id)
+        spam_message_ids.append(message_id)  # Include current message
         suspend(
             "Automatic suspension: repeated similar public messages",
             "auto_suspension_public_spam",
+            message_ids_to_delete=spam_message_ids,
             similar_messages=total_matches,
             window_seconds=_SPAM_WINDOW_SECONDS,
             match_type="similar",
@@ -358,7 +394,16 @@ async def _send_message_internal(
 
     # Send push notifications for public messages
     try:
-        await push_service.send_public_message_notification(db, new_message, exclude_user_id=current_user.id)
+        push_service_url = os.getenv("PUSH_SERVICE_URL", "http://push_service:8306")
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.post(
+                f"{push_service_url}/push/send-public-notification",
+                json={
+                    "message_id": new_message.id,
+                    "exclude_user_id": current_user.id
+                }
+            )
+            response.raise_for_status()
     except Exception as e:
         logger.error(f"Failed to send push notification for message {new_message.id}: {e}")
 
@@ -371,7 +416,7 @@ async def _send_message_internal(
     except Exception:
         pass
 
-    _monitor_public_message_activity(current_user, raw_content, db)
+    _monitor_public_message_activity(current_user, raw_content, new_message.id, db)
 
     message_payload = convert_message(new_message)
     
@@ -420,6 +465,97 @@ async def send_message(
     return await _send_message_internal(message_request, current_user, db, files)
 
 
+class RegisterFcmRequest(BaseModel):
+    token: str
+
+
+@router.post("/push/register")
+async def register_fcm_token(request: Request, body: RegisterFcmRequest, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+    """
+    Register or update an FCM token for the authenticated user.
+    """
+    token = body.token.strip() if body and body.token else None
+    if not token:
+        raise HTTPException(status_code=400, detail="Missing token")
+
+    try:
+        # If token already exists (from another device), reassign it to this user.
+        token_row = db.query(FcmToken).filter(FcmToken.token == token).first()
+        if token_row:
+            token_row.user_id = current_user.id
+        else:
+            # Create new token record (allow multiple tokens per user)
+            new = FcmToken(user_id=current_user.id, token=token)
+            db.add(new)
+        db.commit()
+        logger.info(f"Registered FCM token for user {current_user.id}: {token}")
+    except Exception as e:
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        raise HTTPException(status_code=500, detail="Failed to save token")
+
+    return {"status": "success"}
+
+
+@router.post("/push/unregister")
+async def unregister_fcm_token(request: Request, body: RegisterFcmRequest | None = None, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+    """
+    Unregister an FCM token. If `body.token` provided, remove only that token for the user.
+    If no token provided, remove all tokens for the user.
+    """
+    try:
+        if body and body.token:
+            db.query(FcmToken).filter(FcmToken.user_id == current_user.id, FcmToken.token == body.token.strip()).delete()
+        else:
+            db.query(FcmToken).filter(FcmToken.user_id == current_user.id).delete()
+        db.commit()
+    except Exception as e:
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        raise HTTPException(status_code=500, detail="Failed to remove token")
+
+    return {"status": "success"}
+
+
+@router.post("/push/test")
+async def push_test(request: Request, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+    """
+    Send a test push to the current user's registered FCM token (for manual testing).
+    """
+    try:
+        fcm_rows = db.query(FcmToken).filter(FcmToken.user_id == current_user.id).all()
+        if not fcm_rows:
+            raise HTTPException(status_code=404, detail="No FCM token registered for user")
+
+        title = "FromChat test"
+        body = "This is a test push from the server"
+        data = {"type": "test", "timestamp": datetime.utcnow().isoformat()}
+
+        # Use push_service which uses Admin SDK internally; attempt to send to all tokens
+        failures = []
+        for fcm in fcm_rows:
+            try:
+                push_service._send_fcm_to_token(fcm.token, title, body, data)
+            except Exception as e:
+                logger.error(f"Failed to send test push to user {current_user.id} token {fcm.token}: {e}")
+                failures.append(str(e))
+
+        if failures and len(failures) == len(fcm_rows):
+            # All failed
+            raise HTTPException(status_code=500, detail=f"Failed to send push to any token: {failures}")
+
+        return {"status": "success", "sent": len(fcm_rows) - len(failures), "failed": len(failures)}
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"push_test error: {e}")
+        raise HTTPException(status_code=500, detail="Internal error")
+
+
 @router.get("/get_messages")
 @rate_limit_per_ip("60/minute")  # Per-IP limit to prevent abuse
 async def get_messages(request: Request, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
@@ -435,6 +571,43 @@ async def get_messages(request: Request, current_user: User = Depends(get_curren
     }
 
 
+class MarkReadRequest(BaseModel):
+    messageIds: list[int]
+
+
+@router.get("/messages/new")
+@rate_limit_per_ip("60/minute")
+async def get_new_messages(request: Request, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+    """
+    Return unread public messages (Message.is_read == False).
+    """
+    new_messages = db.query(Message).filter(Message.is_read == False).order_by(Message.timestamp.asc()).all()
+    messages_data = [convert_message(msg) for msg in new_messages]
+    return {"status": "success", "messages": messages_data}
+
+
+@router.post("/messages/read")
+@rate_limit_per_ip("60/minute")
+async def mark_messages_read(request: Request, read_request: MarkReadRequest, current_user: User = Depends(get_current_user), db: Session = Depends(get_db)):
+    """
+    Mark specified message IDs as read (set Message.is_read = True).
+    """
+    if not read_request or not isinstance(read_request.messageIds, list) or len(read_request.messageIds) == 0:
+        return {"status": "success", "updated": 0}
+
+    try:
+        updated_count = db.query(Message).filter(Message.id.in_(read_request.messageIds)).update({Message.is_read: True}, synchronize_session=False)
+        db.commit()
+    except Exception as e:
+        try:
+            db.rollback()
+        except Exception:
+            pass
+        raise HTTPException(status_code=500, detail="Failed to mark messages as read")
+
+    return {"status": "success", "updated": int(updated_count)}
+
+
 @router.post("/dm/send")
 @rate_limit_per_ip("20/minute")
 async def dm_send(
@@ -678,15 +851,16 @@ async def get_dm_conversations(request: Request, current_user: User = Depends(ge
     }
 
 
-@router.put("/edit_message/{message_id}")
-@rate_limit_per_ip("20/minute")
-async def edit_message(
-    request: Request,
+async def _edit_message_internal(
     message_id: int,
     edit_request: EditMessageRequest,
-    current_user: User = Depends(get_current_user),
-    db: Session = Depends(get_db)
-):
+    current_user: User,
+    db: Session
+) -> dict:
+    """Internal function to edit a message without requiring a Request object.
+
+    This can be called from both HTTP endpoints and WebSocket handlers.
+    """
     message = db.query(Message).filter(Message.id == message_id).first()
 
     if not message:
@@ -735,6 +909,18 @@ async def edit_message(
     return {"status": "success", "message": payload}
 
 
+@router.put("/edit_message/{message_id}")
+@rate_limit_per_ip("20/minute")
+async def edit_message(
+    request: Request,
+    message_id: int,
+    edit_request: EditMessageRequest,
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db)
+):
+    return await _edit_message_internal(message_id, edit_request, current_user, db)
+
+
 @router.delete("/delete_message/{message_id}")
 async def delete_message(
     message_id: int,
@@ -1004,6 +1190,7 @@ class MessaggingSocketManager:
         
         # Skip if this exact update was recently added
         if signature in self.recent_updates[websocket]:
+            logger.warning(f"Update was skipped due to duplicate signature {signature}")
             return
         
         # Add to pending updates and track signature
@@ -1011,10 +1198,8 @@ class MessaggingSocketManager:
         self.recent_updates[websocket].add(signature)
         
         # Limit recent updates cache size (keep last 100 signatures per websocket)
-        if len(self.recent_updates[websocket]) > 100:
-            # Remove oldest entries (simple FIFO by converting to list and keeping last 100)
-            # Actually, we'll just clear and rebuild on next flush - simpler approach
-            pass
+        if len(self.recent_updates[websocket]) > 1:
+            self.recent_updates[websocket] = set(list(self.recent_updates[websocket])[-1])
 
     async def _flush_updates(self, websocket: WebSocket, db: Session | None = None):
         """Flush pending updates for a WebSocket connection"""
@@ -1107,7 +1292,7 @@ class MessaggingSocketManager:
         self.ws_subscriptions[websocket] = set()
         
         # Import here to avoid circular import
-        from websocket.handlers import handler_registry
+        from backend.services.messaging.files.websocket.handlers import handler_registry
 
         while True:
             try:
@@ -1385,4 +1570,22 @@ async def get_file_encrypted(filename: str, current_user: User = Depends(get_cur
     else:
         raise HTTPException(500)
 
-    return FileResponse(str(path))
+    return FileResponse(str(path))
+
+
+class SendSuspensionRequest(BaseModel):
+    user_id: int
+    reason: str
+
+
+@router.post("/send-suspension")
+async def send_suspension_to_user(
+    request: SendSuspensionRequest,
+    db: Session = Depends(get_db)
+):
+    """Send suspension message to user via WebSocket (called by profile service)"""
+    try:
+        await messagingManager.send_suspension_to_user(request.user_id, request.reason)
+        return {"status": "success"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

backend/routes/moderation.py

@@ -2,12 +2,12 @@ from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel, Field
 from typing import List
 
-from constants import OWNER_USERNAME
-from dependencies import get_current_user
-from models import User
-from security.audit import log_security
-from security.profanity import add_to_blocklist, get_blocklist, remove_from_blocklist
-from security.rate_limit import reset_rate_limit_for_ip, clear_all_rate_limits
+from backend.shared.constants import OWNER_USERNAME
+from backend.shared.dependencies import get_current_user
+from backend.shared.models import User
+from backend.security.audit import log_security
+from backend.security.profanity import add_to_blocklist, get_blocklist, remove_from_blocklist
+from backend.security.rate_limit import reset_rate_limit_for_ip, clear_all_rate_limits
 
 
 class BlocklistUpdateRequest(BaseModel):

backend/routes/profile.py

@@ -9,15 +9,16 @@ import uuid
 import io
 from fastapi import Request
 
-from dependencies import get_db, get_current_user
-from models import User, UpdateBioRequest, UserProfileResponse
+from backend.shared.dependencies import get_db, get_current_user
+from backend.shared.models import User, UpdateBioRequest, UserProfileResponse
 from pydantic import BaseModel
-from validation import is_valid_username, is_valid_display_name
-from similarity import is_user_similar_to_verified
-from .messaging import messagingManager
-from security.audit import log_security
-from security.profanity import contains_profanity
-from security.rate_limit import rate_limit_per_ip
+from backend.shared.validation import is_valid_username, is_valid_display_name
+from backend.shared.similarity import is_user_similar_to_verified
+import os
+import httpx
+from backend.security.audit import log_security
+from backend.security.profanity import contains_profanity
+from backend.security.rate_limit import rate_limit_per_ip
 
 router = APIRouter()
 
@@ -36,7 +37,7 @@ class UpdateProfileRequest(BaseModel):
     description: str | None = None
 
 # Create uploads directory if it doesn't exist
-PROFILE_PICTURES_DIR = Path("data/uploads/pfp")
+PROFILE_PICTURES_DIR = Path(__file__).resolve().parent.parent / "data" / "uploads" / "pfp"
 
 os.makedirs(PROFILE_PICTURES_DIR, exist_ok=True)
 
@@ -479,7 +480,16 @@ async def suspend_user(
 
     # Send WebSocket suspension message
     try:
-        await messagingManager.send_suspension_to_user(user_id, request.reason)
+        messaging_service_url = os.getenv("MESSAGING_SERVICE_URL", "http://messaging_service:8305")
+        async with httpx.AsyncClient(timeout=10.0) as client:
+            response = await client.post(
+                f"{messaging_service_url}/messaging/send-suspension",
+                json={
+                    "user_id": user_id,
+                    "reason": request.reason
+                }
+            )
+            response.raise_for_status()
     except Exception as e:
         # Log error but don't fail the request
         pass

backend/routes/push.py

@@ -1,11 +1,16 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
-from dependencies import get_current_user, get_db
-from models import User, PushSubscriptionRequest
-from push_service import push_service
+from pydantic import BaseModel
+from backend.shared.dependencies import get_current_user, get_db
+from backend.shared.models import User, PushSubscriptionRequest
+from backend.services.push.files import push_service
 
 router = APIRouter()
 
+class SendPublicNotificationRequest(BaseModel):
+    message_id: int
+    exclude_user_id: int
+
 @router.post("/subscribe")
 async def subscribe_to_push_notifications(
     request: PushSubscriptionRequest,
@@ -37,10 +42,28 @@ async def unsubscribe_from_push_notifications(
     """Unsubscribe user from push notifications"""
     try:
         success = await push_service.unsubscribe_user(db=db, user_id=current_user.id)
-        
+
         if success:
             return {"status": "success", "message": "Push notifications disabled"}
         else:
             raise HTTPException(status_code=500, detail="Failed to disable push notifications")
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
+
+@router.post("/send-public-notification")
+async def send_public_message_notification(
+    request: SendPublicNotificationRequest,
+    db: Session = Depends(get_db)
+):
+    """Send push notification for public message (called by messaging service)"""
+    try:
+        # Get the message from database
+        from backend.shared.models import Message
+        message = db.query(Message).filter(Message.id == request.message_id).first()
+        if not message:
+            raise HTTPException(status_code=404, detail="Message not found")
+
+        await push_service.send_public_message_notification(db, message, exclude_user_id=request.exclude_user_id)
+        return {"status": "success"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

backend/routes/webrtc.py

@@ -4,7 +4,7 @@ import hmac
 import hashlib
 import time
 from fastapi import APIRouter, Depends
-from dependencies import get_current_user
+from backend.shared.dependencies import get_current_user
 import traceback
 
 router = APIRouter()

backend/run_local.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""
+Local development server that runs all services in a single FastAPI application.
+This provides the same monolithic experience as before, but with microservice separation.
+"""
+
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+import uvicorn
+import os
+
+# Import service routers
+from backend.routes.account import router as account_router
+from backend.routes.profile import router as profile_router
+from backend.routes.devices import router as device_router
+from backend.routes.messaging import router as messaging_router
+from backend.routes.push import router as push_router
+from backend.routes.webrtc import router as webrtc_router
+from backend.routes.moderation import router as moderation_router
+
+# Import security modules
+from security.audit import log_access
+from security.rate_limit import limiter
+from slowapi.middleware import SlowAPIMiddleware
+
+# Create main FastAPI app
+app = FastAPI(title="FromChat Local Development")
+
+# Add rate limiting middleware
+app.state.limiter = limiter
+app.add_middleware(SlowAPIMiddleware)
+
+# CORS middleware
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[
+        "https://fromchat.ru",
+        "https://beta.fromchat.ru",
+        "https://www.fromchat.ru",
+        "http://127.0.0.1:8301",
+        "http://127.0.0.1:8300",
+        "http://localhost:8301",
+        "http://localhost:8300",
+    ],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+# Mount service routers with appropriate prefixes
+app.include_router(account_router, prefix="/account")
+app.include_router(profile_router, prefix="/profile")
+app.include_router(device_router, prefix="/devices")
+app.include_router(messaging_router, prefix="/messaging")
+app.include_router(push_router, prefix="/push")
+app.include_router(webrtc_router, prefix="/webrtc")
+app.include_router(moderation_router, prefix="/moderation")
+
+if __name__ == "__main__":
+    # Run the server
+    port = int(os.getenv("PORT", "8301"))
+    host = os.getenv("HOST", "127.0.0.1")
+
+    print(f"Starting FromChat local development server on {host}:{port}")
+    print("Available services:")
+    print("  - Account: http://127.0.0.1:8301/account/")
+    print("  - Profile: http://127.0.0.1:8301/profile/")
+    print("  - Devices: http://127.0.0.1:8301/devices/")
+    print("  - Messaging: http://127.0.0.1:8301/messaging/")
+    print("  - Push: http://127.0.0.1:8301/push/")
+    print("  - WebRTC: http://127.0.0.1:8301/webrtc/")
+    print("  - Moderation: http://127.0.0.1:8301/moderation/")
+
+    uvicorn.run(
+        "run_local:app",
+        host=host,
+        port=port,
+        reload=True,
+        reload_dirs=["backend"]
+    )

backend/security/audit.py

@@ -4,7 +4,7 @@ import logging
 from html import unescape
 from typing import Any, Callable, Dict, List
 
-from logging_config import access_logger, dm_logger, public_chat_logger, security_logger
+from backend.logging_config import access_logger, dm_logger, public_chat_logger, security_logger
 
 
 def _clean_username(username: Any) -> str:

backend/security/profanity.py

@@ -9,7 +9,7 @@ from typing import Iterable, List, Set, Tuple
 
 from better_profanity import Profanity
 
-BLOCKLIST_PATH = Path("data/profanity/blocklist.json")
+BLOCKLIST_PATH = Path(__file__).resolve().parent.parent / "data" / "profanity" / "blocklist.json"
 BLOCKLIST_PATH.parent.mkdir(parents=True, exist_ok=True)
 
 _CUSTOM_RU_TERMS: Set[str] = {
@@ -17,7 +17,7 @@ _CUSTOM_RU_TERMS: Set[str] = {
     "ебать", "ебёт", "ебет", "ебаная", "ебаная", "уёбок", "уебок", "уебище", "пизда",
     "пиздец", "хуй", "хуя", "хуе", "хуё", "хуйня", "хер", "гондон",
     "долбоёб", "долбоеб", "дебил", "член", "проститутка", "проститутки",
-    "урод", "хуесос", "хуесосы", "хуесосов", "хуесоса", "пидор",
+    "урод", "хуесос", "хуесосы", "хуесосов", "хуесоса", "сос", "пидор",
     "пидоры", "пидорас", "пидорасы", "пидорасов",
 }
 
@@ -46,6 +46,18 @@ _PHRASE_PATTERNS: Tuple[re.Pattern[str], ...] = (
     re.compile(r"\bсамсунг\s+г[ао]вно\b", re.IGNORECASE | re.UNICODE),
 )
 
+# Patterns to check in original text (before normalization) to catch visual bypasses
+# These patterns check for special character combinations that visually form letters
+_ORIGINAL_TEXT_PATTERNS: Tuple[re.Pattern[str], ...] = (
+    # Catch "}{" used to visually form "х" followed by "С0С" or similar patterns
+    # This catches "хуесос" written as "}{¥€С0С" or variations
+    # Matches: }{ + any characters (including special chars) + С/с + 0 + С/с
+    # The pattern allows any characters between to catch special chars like ¥€
+    re.compile(r"}\{.*?[сcСC].*?[0оoОO].*?[сcСC]", re.IGNORECASE | re.UNICODE),
+    # Also catch "}{" followed by "уесос" with 0 instead of о
+    re.compile(r"}\{.*?[уyУY].*?[еeЕE].*?[сcСC].*?[0оoОO].*?[сcСC]", re.IGNORECASE | re.UNICODE),
+)
+
 # Map for normalizing homoglyphs (similar-looking characters)
 # Maps English/Latin characters to their Cyrillic equivalents and vice versa
 # Also includes Greek, full-width, and other Unicode variants
@@ -182,6 +194,8 @@ _LEET_MAP = {
     "н": "н",  # Already mapped, but explicit
     # Special characters
     "@": "а",
+    # Multi-character visual bypasses (handled separately in preprocessing)
+    # "}{" visually forms "х" - handled in _preprocess_visual_bypasses
 }
 
 _RAW_PHRASE_GROUPS: Tuple[Tuple[str, Tuple[str, ...]], ...] = (
@@ -193,6 +207,18 @@ _SENSITIVE_PHRASE_PATH = Path("data/profanity/sensitive_phrases.json")
 _PHRASE_CACHE: dict[str, Tuple[Tuple[str, ...], ...]] = {}
 
 
+def _preprocess_visual_bypasses(text: str) -> str:
+    """
+    Preprocess text to convert multi-character visual bypasses to their intended letters.
+    This handles cases like "}{" visually forming "х".
+    """
+    result = text
+    # Convert "}{" to "х" (visual bypass for Cyrillic х)
+    # The curly braces visually form the letter х when placed together
+    result = result.replace("}{", "х")
+    return result
+
+
 def _normalize_char(ch: str) -> str:
     """Normalize a single character, mapping homoglyphs to canonical form."""
     # First try direct mapping (preserves case for non-mapped chars)
@@ -257,7 +283,10 @@ def _extract_alphanumeric_with_mapping(text: str, preserve_spaces: bool = False)
         (normalized_text, position_map) where position_map[i] is the original
         position of the i-th character in normalized_text
     """
-    # First normalize Unicode (composed vs decomposed)
+    # First preprocess visual bypasses (like "}{" -> "х")
+    text = _preprocess_visual_bypasses(text)
+    
+    # Then normalize Unicode (composed vs decomposed)
     normalized_unicode = unicodedata.normalize('NFKC', text)
     
     # For phrase matching, convert zero-width chars to spaces instead of stripping
@@ -316,45 +345,49 @@ def _check_profanity_substrings(normalized_text: str, profane_words: Set[str]) -
             start = pos + 1
         
         # Also check if profane word appears as a subsequence (allowing extra chars)
-        # This catches cases like "хуй" in "хууй" or "хU★уй" -> "хууй"
-        # Only do subsequence matching for words of length 4 or more to avoid false positives
-        # Use stricter span limits for shorter words to prevent false matches in long legitimate words
-        if len(word_lower) >= 4:
-            word_chars = list(word_lower)
-            text_chars = list(normalized_lower)
-            # Stricter ratio for shorter words, more lenient for longer words
-            if len(word_lower) <= 5:
-                max_span_ratio = 1.5  # Very strict for short words
-            else:
-                max_span_ratio = 2.0  # Slightly more lenient for longer words
-            
-            # Try to find the word as a subsequence
-            i = 0  # position in text
-            j = 0  # position in word
-            seq_start = None
-            
-            while i < len(text_chars) and j < len(word_chars):
-                if text_chars[i] == word_chars[j]:
-                    if seq_start is None:
-                        seq_start = i
-                    j += 1
-                    if j == len(word_chars):
-                        # Found the word as subsequence
-                        seq_end = i + 1
-                        # Check if the span is reasonable (not too long)
-                        span_length = seq_end - seq_start
-                        max_allowed_span = int(len(word_lower) * max_span_ratio)
-                        if span_length <= max_allowed_span:
-                            # Only add if it's not already covered by exact match
-                            if (seq_start, seq_end) not in spans:
-                                spans.append((seq_start, seq_end))
-                        # Reset to find next occurrence - continue from after the end of this match
-                        next_start = seq_start + 1
-                        seq_start = None
-                        j = 0
-                        i = next_start
-                        continue
-                i += 1
+        # This catches cases like "хуй" in "хууй" or "х}{¥€уй" -> "хууй"
+        # Now applies to ALL words, not just length >= 4, to prevent bypasses
+        word_chars = list(word_lower)
+        text_chars = list(normalized_lower)
+        
+        # Stricter span limits based on word length to prevent false positives
+        # Shorter words get much stricter limits
+        if len(word_lower) <= 3:
+            max_span_ratio = 1.3  # Very strict for 3-char words (e.g., "хуй")
+        elif len(word_lower) == 4:
+            max_span_ratio = 1.4  # Strict for 4-char words
+        elif len(word_lower) <= 5:
+            max_span_ratio = 1.5  # Moderate for 5-char words
+        else:
+            max_span_ratio = 1.8  # Slightly more lenient for longer words
+        
+        # Try to find the word as a subsequence
+        i = 0  # position in text
+        j = 0  # position in word
+        seq_start = None
+        
+        while i < len(text_chars) and j < len(word_chars):
+            if text_chars[i] == word_chars[j]:
+                if seq_start is None:
+                    seq_start = i
+                j += 1
+                if j == len(word_chars):
+                    # Found the word as subsequence
+                    seq_end = i + 1
+                    # Check if the span is reasonable (not too long)
+                    span_length = seq_end - seq_start
+                    max_allowed_span = int(len(word_lower) * max_span_ratio)
+                    if span_length <= max_allowed_span:
+                        # Only add if it's not already covered by exact match
+                        if (seq_start, seq_end) not in spans:
+                            spans.append((seq_start, seq_end))
+                    # Reset to find next occurrence - continue from after the end of this match
+                    next_start = seq_start + 1
+                    seq_start = None
+                    j = 0
+                    i = next_start
+                    continue
+            i += 1
     
     return spans
 
@@ -582,7 +615,13 @@ def contains_profanity(text: str) -> bool:
 
     _rebuild_dictionary()
     
-    # Check phrase patterns first
+    # Check original text patterns first (before normalization) to catch visual bypasses
+    # like "}{" used to form "х"
+    for pattern in _ORIGINAL_TEXT_PATTERNS:
+        if pattern.search(text):
+            return True
+    
+    # Check phrase patterns
     if _check_phrase_patterns(text):
         return True
     

backend/security/rate_limit.py

@@ -8,7 +8,7 @@ from fastapi import Request
 from slowapi import Limiter
 from slowapi.util import get_remote_address
 
-from utils import get_client_ip
+from backend.shared.utils import get_client_ip
 
 logger = logging.getLogger("uvicorn.error")
 

backend/services/account/Dockerfile

@@ -0,0 +1,11 @@
+# Account Service Dockerfile
+FROM backend/base:latest
+
+# Copy service-specific files
+COPY backend/routes/account.py /app/backend/routes/account.py
+COPY backend/services/account/main.py /app/backend/services/account/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=account
+
+EXPOSE 8301

backend/services/account/main.py

@@ -0,0 +1,9 @@
+from fastapi import FastAPI
+from backend.routes.account import router as account_router
+
+if __name__ == "__main__":
+    app = FastAPI(title="Account Service")
+    app.include_router(account_router, prefix="/account")
+
+    import os, uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("PORT", 8301)))

backend/services/device/Dockerfile

@@ -0,0 +1,11 @@
+# Device Service Dockerfile
+FROM backend/base:latest
+
+# Copy service-specific files
+COPY backend/routes/devices.py /app/backend/routes/devices.py
+COPY backend/services/device/main.py /app/backend/services/device/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=device
+
+EXPOSE 8301

backend/services/device/main.py

@@ -0,0 +1,9 @@
+from fastapi import FastAPI
+from backend.routes.devices import router as device_router
+
+if __name__ == "__main__":
+    app = FastAPI(title="Device Service")
+    app.include_router(device_router, prefix="/devices")
+
+    import os, uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("PORT", 8301)))

backend/services/gateway/Dockerfile

@@ -0,0 +1,14 @@
+# Gateway Service Dockerfile
+FROM backend/base:latest
+
+# Copy service-specific files
+COPY backend/app.py /app/backend/app.py
+COPY backend/main.py /app/backend/main.py
+COPY backend/dependencies.py /app/backend/dependencies.py
+COPY backend/security /app/backend/security/
+COPY backend/services/gateway/main.py /app/backend/services/gateway/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=gateway
+
+EXPOSE 8301

backend/services/gateway/main.py

@@ -0,0 +1,6 @@
+# Gateway service - runs the main gateway app from backend/app.py
+
+if __name__ == "__main__":
+    from backend.app import app
+    import os, uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("PORT", 8300)))

backend/services/messaging/Dockerfile

@@ -0,0 +1,12 @@
+# Messaging Service Dockerfile
+FROM backend/base:latest
+
+# Copy service-specific files
+COPY backend/routes/messaging.py /app/backend/routes/messaging.py
+COPY backend/websocket /app/backend/websocket/
+COPY backend/services/messaging/main.py /app/backend/services/messaging/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=messaging
+
+EXPOSE 8301

backend/services/messaging/files/websocket/__init__.py

@@ -1,4 +1,4 @@
-from websocket.registry import WebSocketHandlerRegistry
+from .registry import WebSocketHandlerRegistry
 
 # Note: handler_registry and websocket_handler are not imported here to avoid circular dependency
 # Import them directly from websocket.handlers when needed

backend/services/messaging/files/websocket/handlers.py

@@ -3,20 +3,21 @@ import json
 import logging
 import time
 from typing import Any
-from fastapi import HTTPException, WebSocket
+from fastapi import HTTPException, WebSocket, Request
 from sqlalchemy.orm import Session
 
-from websocket.registry import WebSocketHandlerRegistry
-from routes.messaging import (
+from backend.services.messaging.files.websocket.registry import WebSocketHandlerRegistry
+from backend.routes.messaging import (
     MessaggingSocketManager,
     _send_message_internal,
+    _edit_message_internal,
     get_messages,
     edit_message,
     delete_message,
     add_reaction,
     add_dm_reaction,
 )
-from models import (
+from backend.shared.models import (
     User,
     SendMessageRequest,
     EditMessageRequest,
@@ -25,7 +26,7 @@ from models import (
     DMReactionRequest,
     UpdateLog,
 )
-from security.audit import log_access, log_dm
+from backend.security.audit import log_access, log_dm
 
 logger = logging.getLogger("uvicorn.error")
 
@@ -211,14 +212,11 @@ async def dmSend(manager: MessaggingSocketManager, websocket: WebSocket, db: Ses
 @websocket_handler("editMessage", authRequired=True)
 async def editMessage(manager: MessaggingSocketManager, websocket: WebSocket, db: Session, user: User, data: dict) -> dict | None:
     """Edit a public chat message."""
-    from types import SimpleNamespace
     
     message_id = data["message_id"]
-    request: EditMessageRequest = EditMessageRequest.model_validate(data)
+    edit_request: EditMessageRequest = EditMessageRequest.model_validate(data)
     
-    # Create a dummy request object for the HTTP endpoint function
-    dummy_request = SimpleNamespace()
-    response = await edit_message(dummy_request, message_id, request, user, db)
+    response = await _edit_message_internal(message_id, edit_request, user, db)
     await manager.broadcast({
         "type": "messageEdited",
         "data": response["message"]

backend/services/messaging/files/websocket/utils.py

@@ -2,8 +2,8 @@ from fastapi import HTTPException
 from fastapi.security import HTTPAuthorizationCredentials
 from sqlalchemy.orm import Session
 from types import SimpleNamespace
-from dependencies import get_current_user
-from models import User
+from backend.shared.dependencies import get_current_user
+from backend.shared.models import User
 
 
 def extract_token_from_data(data: dict) -> str | None:

backend/services/messaging/main.py

@@ -0,0 +1,9 @@
+from fastapi import FastAPI
+from backend.routes.messaging import router as messaging_router
+
+if __name__ == "__main__":
+    app = FastAPI(title="Messaging Service")
+    app.include_router(messaging_router, prefix="/messaging")
+
+    import os, uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("PORT", 8301)))

backend/services/migration_runner/Dockerfile

@@ -0,0 +1,15 @@
+# Migration Runner Dockerfile
+FROM backend/base:latest
+
+# Copy migration files
+COPY backend/alembic /app/backend/alembic/
+COPY backend/migration.py /app/backend/migration.py
+
+# Copy migration runner
+COPY backend/services/migration_runner/main.py /app/backend/services/migration_runner/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=migration_runner
+
+# Override entrypoint to run migrations
+ENTRYPOINT ["python", "-m", "backend.services.migration_runner.main"]

backend/services/migration_runner/main.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+"""
+Migration runner service - executes database migrations and exits.
+This service runs Alembic migrations against PostgreSQL and terminates.
+"""
+
+import os
+import sys
+from pathlib import Path
+from alembic import command
+from alembic.config import Config
+
+def run_migrations():
+    """Run Alembic migrations."""
+    print("Starting database migrations...")
+
+    # Change to backend directory to run migrations
+    backend_dir = Path(__file__).parent.parent.parent
+    os.chdir(backend_dir)
+
+    # Ensure shared models are imported for alembic
+    import backend.shared.models
+
+    # Set DATABASE_URL from environment if not set
+    db_url = os.getenv("DATABASE_URL")
+    if not db_url:
+        print("ERROR: DATABASE_URL environment variable not set")
+        sys.exit(1)
+
+    # Export DATABASE_URL for alembic
+    os.environ["DATABASE_URL"] = db_url
+
+    try:
+        # Use the robust migration system from migration.py
+        # This handles all edge cases and recovery scenarios automatically
+        print("Starting database migrations...")
+
+        # Import and run the migration function
+        from backend.migration import run_migrations
+        run_migrations()
+
+        print("Database migrations completed successfully!")
+
+    except Exception as e:
+        print(f"ERROR: Failed to run migrations: {e}")
+        import traceback
+        traceback.print_exc()
+        sys.exit(1)
+
+if __name__ == "__main__":
+    run_migrations()

backend/services/moderation/Dockerfile

@@ -0,0 +1,13 @@
+# Moderation Service Dockerfile
+FROM backend/base:latest
+
+# Copy service-specific files
+COPY backend/routes/moderation.py /app/backend/routes/moderation.py
+COPY backend/security/profanity.py /app/backend/security/profanity.py
+COPY backend/similarity.py /app/backend/similarity.py
+COPY backend/services/moderation/main.py /app/backend/services/moderation/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=moderation
+
+EXPOSE 8301

backend/services/moderation/main.py

@@ -0,0 +1,9 @@
+from fastapi import FastAPI
+from backend.routes.moderation import router as moderation_router
+
+if __name__ == "__main__":
+    app = FastAPI(title="Moderation Service")
+    app.include_router(moderation_router, prefix="/moderation")
+
+    import os, uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("PORT", 8301)))

backend/services/profile/Dockerfile

@@ -0,0 +1,11 @@
+# Profile Service Dockerfile
+FROM backend/base:latest
+
+# Copy service-specific files
+COPY backend/routes/profile.py /app/backend/routes/profile.py
+COPY backend/services/profile/main.py /app/backend/services/profile/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=profile
+
+EXPOSE 8301

backend/services/profile/main.py

@@ -0,0 +1,9 @@
+from fastapi import FastAPI
+from backend.routes.profile import router as profile_router
+
+if __name__ == "__main__":
+    app = FastAPI(title="Profile Service")
+    app.include_router(profile_router, prefix="/profile")
+
+    import os, uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("PORT", 8301)))

backend/services/push/Dockerfile

@@ -0,0 +1,12 @@
+# Push Service Dockerfile
+FROM backend/base:latest
+
+# Copy service-specific files
+COPY backend/routes/push.py /app/backend/routes/push.py
+COPY backend/push_service.py /app/backend/push_service.py
+COPY backend/services/push/main.py /app/backend/services/push/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=push
+
+EXPOSE 8301

backend/services/push/files/push_service.py

@@ -0,0 +1,243 @@
+import json
+import logging
+import os
+from typing import List, Optional
+from sqlalchemy.orm import Session
+from pywebpush import webpush, WebPushException
+from backend.shared.models import PushSubscription, User, Message, DMEnvelope, FcmToken
+import firebase_admin
+from firebase_admin import credentials as firebase_credentials
+from firebase_admin import messaging as firebase_messaging
+import base64
+
+logger = logging.getLogger("uvicorn.error")
+
+class PushNotificationService:
+    def __init__(self):
+        self.vapid_private_key = os.getenv("VAPID_PRIVATE_KEY")
+        self.vapid_public_key = os.getenv("VAPID_PUBLIC_KEY")
+        # Firebase Admin initialization (modern API). Only FIREBASE_CERT env is supported.
+        self.firebase_initialized = False
+        try:
+            firebase_cert = os.getenv("FIREBASE_CERT")
+            if not firebase_cert:
+                raise RuntimeError("FIREBASE_CERT env variable is required for Firebase Admin SDK initialization")
+
+            # Support raw JSON or base64-encoded JSON in FIREBASE_CERT
+            decoded = base64.b64decode(firebase_cert).decode("utf-8")
+            sa_dict = json.loads(decoded)
+
+            cred = firebase_credentials.Certificate(sa_dict)
+            firebase_admin.initialize_app(cred)
+            self.firebase_initialized = True
+            logger.info("Firebase Admin SDK initialized for push sending (FIREBASE_CERT)")
+        except Exception as e:
+            logger.error(f"Failed to initialize Firebase Admin SDK from FIREBASE_CERT: {e}")
+            raise
+
+        if (not self.vapid_public_key) or (not self.vapid_private_key):
+            raise ValueError("VAPID public or private key is None")
+
+        self.vapid_claims = {
+            "sub": "mailto:support@fromchat.ru",
+            "aud": "https://fcm.googleapis.com"
+        }
+
+    async def subscribe_user(self, db: Session, user_id: int, endpoint: str, p256dh_key: str, auth_key: str) -> bool:
+        """Subscribe a user to push notifications"""
+        try:
+            # Check if user already has a subscription
+            existing_sub = db.query(PushSubscription).filter(PushSubscription.user_id == user_id).first()
+            
+            if existing_sub:
+                # Update existing subscription
+                existing_sub.endpoint = endpoint
+                existing_sub.p256dh_key = p256dh_key
+                existing_sub.auth_key = auth_key
+            else:
+                # Create new subscription
+                new_sub = PushSubscription(
+                    user_id=user_id,
+                    endpoint=endpoint,
+                    p256dh_key=p256dh_key,
+                    auth_key=auth_key
+                )
+                db.add(new_sub)
+            
+            db.commit()
+            logger.info(f"Push subscription saved for user {user_id}")
+            return True
+        except Exception as e:
+            logger.error(f"Failed to save push subscription for user {user_id}: {e}")
+            db.rollback()
+            return False
+
+    async def send_public_message_notification(self, db: Session, message: Message, exclude_user_id: Optional[int] = None):
+        """Send push notification for a new public chat message"""
+        try:
+            # Get all users except the sender
+            users = db.query(User).filter(User.id != message.user_id)
+            if exclude_user_id:
+                users = users.filter(User.id != exclude_user_id)
+
+            for user in users:
+                # Check if user has push subscription before trying to send
+                # Try all FCM tokens first (Android). If none or all fail, fall back to web push subscription.
+                fcm_rows = db.query(FcmToken).filter(FcmToken.user_id == user.id).all()
+                payload_data = {
+                    "type": "public_message",
+                    "message_id": message.id,
+                    "sender_id": message.user_id,
+                    "sender_username": message.author.username
+                }
+                title = f"{message.author.username}"
+                body = message.content[:100] + ("..." if len(message.content) > 100 else "")
+
+                if fcm_rows and self.firebase_initialized:
+                    for fcm in fcm_rows:
+                        try:
+                            self._send_fcm_to_token(fcm.token, title, body, payload_data)
+                        except Exception as e:
+                            logger.error(f"Failed to send FCM to user {user.id} token {fcm.token}: {e}")
+                            # Check if this is a permanent failure and clean up the token
+                            self._cleanup_failed_fcm_token(db, fcm, str(e))
+
+                subscription = db.query(PushSubscription).filter(PushSubscription.user_id == user.id).first()
+                if subscription:
+                    await self._send_notification_to_user(
+                        db, user.id, title, body, message.author.profile_picture, payload_data
+                    )
+        except Exception as e:
+            logger.error(f"Failed to send public message notifications: {e}")
+
+    async def send_dm_notification(self, db: Session, dm_envelope: DMEnvelope, sender: User):
+        """Send push notification for a new DM"""
+        try:
+            title = f"{sender.username}"
+            body = "New direct message"
+            payload_data = {
+                "type": "dm",
+                "dm_id": dm_envelope.id,
+                "sender_id": sender.id,
+                "sender_username": sender.username
+            }
+
+            fcm_rows = db.query(FcmToken).filter(FcmToken.user_id == dm_envelope.recipient_id).all()
+            if fcm_rows and self.firebase_initialized:
+                for fcm in fcm_rows:
+                    try:
+                        self._send_fcm_to_token(fcm.token, title, body, payload_data)
+                    except Exception as e:
+                        logger.error(f"Failed to send FCM to user {dm_envelope.recipient_id} token {fcm.token}: {e}")
+                        # Check if this is a permanent failure and clean up the token
+                        self._cleanup_failed_fcm_token(db, fcm, str(e))
+
+            await self._send_notification_to_user(
+                db, dm_envelope.recipient_id, title, body, sender.profile_picture, payload_data
+            )
+        except Exception as e:
+            logger.error(f"Failed to send DM notification: {e}")
+
+    async def _send_notification_to_user(self, db: Session, user_id: int, title: str, body: str, icon: Optional[str], data: dict):
+        """Send a push notification to a specific user"""
+        try:
+            subscription = db.query(PushSubscription).filter(PushSubscription.user_id == user_id).first()
+            if not subscription:
+                return
+
+            payload = {
+                "title": title,
+                "body": body,
+                "icon": icon or "about:blank",
+                "tag": f"message_{user_id}",
+                "data": data
+            }
+
+            subscription_info = {
+                "endpoint": subscription.endpoint,
+                "keys": {
+                    "p256dh": subscription.p256dh_key,
+                    "auth": subscription.auth_key
+                }
+            }
+
+            webpush(
+                subscription_info=subscription_info,
+                data=json.dumps(payload),
+                vapid_private_key=self.vapid_private_key,
+                vapid_claims=self.vapid_claims
+            )
+            
+        except WebPushException as e:
+            logger.error(f"WebPush error for user {user_id}: {e}")
+            # If the subscription is invalid, remove it
+            if hasattr(e, 'response') and e.response and e.response.status_code in [410, 404]:
+                db.query(PushSubscription).filter(PushSubscription.user_id == user_id).delete()
+                db.commit()
+        except Exception as e:
+            logger.error(f"Failed to send push notification to user {user_id}: {e}")
+
+    def _send_fcm_to_token(self, token: str, title: str, body: str, data: dict):
+        """Send an FCM data-only push to a single device token using Firebase Admin SDK.
+        Notification display is handled by the app, not FCM."""
+        if not self.firebase_initialized:
+            raise RuntimeError("Firebase Admin SDK not initialized (FIREBASE_CERT required)")
+
+        try:
+            # Send only data payload - let the app handle notification display
+            # This prevents FCM from auto-showing notifications
+            msg = firebase_messaging.Message(
+                token=token,
+                data={
+                    "title": title,
+                    "body": body,
+                    **{k: str(v) for k, v in (data or {}).items()}
+                },
+                android=firebase_messaging.AndroidConfig(priority="high"),
+                apns=firebase_messaging.APNSConfig(headers={"apns-priority": "10"})
+            )
+            resp = firebase_messaging.send(msg)
+            return resp
+        except Exception as e:
+            logger.error(f"Firebase Admin send failed for token {token}: {e}")
+            raise
+
+    def _cleanup_failed_fcm_token(self, db: Session, fcm_token_entry, error_message: str):
+        """Clean up FCM tokens that have permanent failures"""
+        try:
+            # Check for permanent failure indicators in the error message
+            permanent_errors = [
+                "unregistered", "invalidregistration", "notregistered",
+                "sender_id_mismatch", "invalid_argument"
+            ]
+
+            error_lower = error_message.lower()
+            is_permanent = any(permanent_error in error_lower for permanent_error in permanent_errors)
+
+            if is_permanent:
+                logger.info(f"Removing permanently failed FCM token for user {fcm_token_entry.user_id}: {fcm_token_entry.token}")
+                db.query(FcmToken).filter(FcmToken.id == fcm_token_entry.id).delete()
+                db.commit()
+            else:
+                logger.debug(f"Temporary FCM failure for token {fcm_token_entry.token}, keeping token: {error_message}")
+        except Exception as e:
+            logger.error(f"Failed to cleanup FCM token {fcm_token_entry.token}: {e}")
+            try:
+                db.rollback()
+            except Exception:
+                pass
+
+    async def unsubscribe_user(self, db: Session, user_id: int) -> bool:
+        """Unsubscribe a user from push notifications"""
+        try:
+            db.query(PushSubscription).filter(PushSubscription.user_id == user_id).delete()
+            db.commit()
+            logger.info(f"Push subscription removed for user {user_id}")
+            return True
+        except Exception as e:
+            logger.error(f"Failed to remove push subscription for user {user_id}: {e}")
+            db.rollback()
+            return False
+
+# Global instance
+push_service = PushNotificationService()

backend/services/push/main.py

@@ -0,0 +1,9 @@
+from fastapi import FastAPI
+from backend.routes.push import router as push_router
+
+if __name__ == "__main__":
+    app = FastAPI(title="Push Service")
+    app.include_router(push_router, prefix="/push")
+
+    import os, uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("PORT", 8301)))

backend/services/webrtc/Dockerfile

@@ -0,0 +1,11 @@
+# WebRTC Service Dockerfile
+FROM backend/base:latest
+
+# Copy service-specific files
+COPY backend/routes/webrtc.py /app/backend/routes/webrtc.py
+COPY backend/services/webrtc/main.py /app/backend/services/webrtc/main.py
+
+# Set service name for entrypoint
+ENV SERVICE_NAME=webrtc
+
+EXPOSE 8301

backend/services/webrtc/main.py

@@ -0,0 +1,9 @@
+from fastapi import FastAPI
+from backend.routes.webrtc import router as webrtc_router
+
+if __name__ == "__main__":
+    app = FastAPI(title="WebRTC Service")
+    app.include_router(webrtc_router, prefix="/webrtc")
+
+    import os, uvicorn
+    uvicorn.run(app, host="0.0.0.0", port=int(os.getenv("PORT", 8301)))

backend/shared/__init__.py

@@ -0,0 +1 @@
+# Shared modules package

backend/shared/constants.py

@@ -0,0 +1,50 @@
+import os
+
+# Database
+DATABASE_URL = os.getenv("DATABASE_URL", "sqlite:///data/database.db")
+
+# JWT
+JWT_SECRET_KEY = os.getenv("JWT_SECRET", "default-jwt-secret-for-development")
+JWT_ALGORITHM = "HS256"
+# Token inactivity expiration - token expires if not used for this duration
+TOKEN_INACTIVITY_EXPIRE_HOURS = 30 * 24  # 30 days of inactivity
+# Maximum token lifetime (safety net) - tokens expire after this regardless of usage
+MAX_TOKEN_LIFETIME_HOURS = 365 * 24  # 1 year maximum
+
+# Owner user
+OWNER_USERNAME = os.getenv("OWNER_USERNAME", "owner")
+
+# Push notifications
+VAPID_PRIVATE_KEY = os.getenv("VAPID_PRIVATE_KEY", "")
+VAPID_PUBLIC_KEY = os.getenv("VAPID_PUBLIC_KEY", "")
+VAPID_SUBJECT = os.getenv("VAPID_SUBJECT", "mailto:admin@example.com")
+
+# Rate limiting
+RATE_LIMIT_REQUESTS = int(os.getenv("RATE_LIMIT_REQUESTS", "100"))
+RATE_LIMIT_WINDOW = int(os.getenv("RATE_LIMIT_WINDOW", "60"))
+
+# File uploads
+MAX_UPLOAD_SIZE = int(os.getenv("MAX_UPLOAD_SIZE", "10485760"))  # 10MB
+ALLOWED_EXTENSIONS = {".jpg", ".jpeg", ".png", ".gif", ".webp", ".mp4", ".mov", ".avi", ".mp3", ".wav"}
+
+# WebSocket
+WEBSOCKET_PING_INTERVAL = 30
+WEBSOCKET_PING_TIMEOUT = 60
+
+# Encryption
+ENCRYPTION_KEY_LENGTH = 32
+ENCRYPTION_NONCE_LENGTH = 12
+
+# Moderation
+PROFANITY_THRESHOLD = float(os.getenv("PROFANITY_THRESHOLD", "0.8"))
+SIMILARITY_THRESHOLD = float(os.getenv("SIMILARITY_THRESHOLD", "0.85"))
+
+# WebRTC
+WEBRTC_ICE_SERVERS = [
+    {"urls": "stun:stun.l.google.com:19302"},
+    {"urls": "stun:stun1.l.google.com:19302"}
+]
+
+# Logging
+LOG_LEVEL = os.getenv("LOG_LEVEL", "INFO")
+LOG_FORMAT = "%(asctime)s - %(name)s - %(levelname)s - %(message)s"

backend/shared/db.py

@@ -0,0 +1,62 @@
+import os
+from sqlalchemy.orm import sessionmaker, Session
+from sqlalchemy import create_engine
+from .constants import DATABASE_URL
+
+# Database connection settings
+POOL_SIZE = int(os.getenv("DB_POOL_SIZE", "20"))
+MAX_OVERFLOW = int(os.getenv("DB_MAX_OVERFLOW", "40"))
+POOL_RECYCLE = int(os.getenv("DB_POOL_RECYCLE", "1800"))
+POOL_TIMEOUT = int(os.getenv("DB_POOL_TIMEOUT", "30"))
+
+POOL_CONFIG = {
+    "pool_size": POOL_SIZE,
+    "max_overflow": MAX_OVERFLOW,
+    "pool_recycle": POOL_RECYCLE,
+    "pool_timeout": POOL_TIMEOUT,
+    "pool_pre_ping": True,
+}
+
+def create_engine_from_url(database_url: str):
+    """Create SQLAlchemy engine from database URL."""
+    connect_args = {}
+    if database_url.startswith("sqlite"):
+        connect_args["check_same_thread"] = False
+
+    engine_kwargs = {
+        "pool_size": POOL_SIZE,
+        "max_overflow": MAX_OVERFLOW,
+        "pool_recycle": POOL_RECYCLE,
+        "pool_pre_ping": True,
+        "pool_timeout": POOL_TIMEOUT,
+    }
+
+    engine = create_engine(
+        database_url,
+        connect_args=connect_args,
+        **engine_kwargs,
+    )
+
+    return engine
+
+# Create engine - this should be called by each service with its own DATABASE_URL
+def get_engine(database_url: str = None):
+    """Get SQLAlchemy engine for the given database URL."""
+    url = database_url or DATABASE_URL
+    return create_engine_from_url(url)
+
+# Session factory - create per service
+def get_session_factory(database_url: str = None):
+    """Get session factory for the given database URL."""
+    engine = get_engine(database_url)
+    return sessionmaker(autocommit=False, autoflush=False, bind=engine)
+
+# Dependency for FastAPI - create per service
+def get_db(database_url: str = None):
+    """FastAPI dependency to get database session."""
+    SessionLocal = get_session_factory(database_url)
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()

backend/shared/dependencies.py

@@ -0,0 +1,122 @@
+from datetime import datetime, timedelta
+from fastapi import Depends, HTTPException, Request, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from sqlalchemy.orm import Session
+from backend.shared.utils import verify_token
+from backend.shared.models import User, DeviceSession
+from backend.shared.db import get_session_factory
+import logging
+
+security = HTTPBearer()
+logger = logging.getLogger("uvicorn.error")
+
+# Зависимость для получения сессии БД
+SessionLocal = get_session_factory()
+
+def get_db():
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()
+
+# Зависимость для получения текущего пользователя
+def get_current_user(
+    request: Request,
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+    db: Session = Depends(get_db),
+) -> User:
+    token = credentials.credentials
+    try:
+        payload = verify_token(token)
+    except Exception as e:
+        logger.warning("get_current_user: token verification error: %s", str(e))
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    if not payload:
+        logger.info("get_current_user: verify_token returned empty payload")
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid or expired token",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    user = db.query(User).filter(User.id == payload["user_id"]).first()
+    if not user:
+        logger.info("get_current_user: user not found for user_id=%s", payload.get("user_id"))
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="User not found",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    if user.id == 1 and user.suspended:
+        user.suspended = False
+        user.suspension_reason = None
+        db.commit()
+        db.refresh(user)
+
+    # Validate device session from JWT
+    session_id = payload.get("session_id")
+    if not session_id:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid session",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    device_session = (
+        db.query(DeviceSession)
+        .filter(DeviceSession.user_id == user.id, DeviceSession.session_id == session_id)
+        .first()
+    )
+
+    if not device_session or device_session.revoked:
+        logger.info("get_current_user: session missing/revoked for user_id=%s session_id=%s", user.id, session_id)
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Session revoked or not found",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    # Check if session has been inactive for too long (sliding expiration)
+    from backend.shared.constants import TOKEN_INACTIVITY_EXPIRE_HOURS
+    inactivity_threshold = datetime.now() - timedelta(hours=TOKEN_INACTIVITY_EXPIRE_HOURS)
+    if device_session.last_seen < inactivity_threshold:
+        # Session expired due to inactivity - revoke it
+        device_session.revoked = True
+        db.commit()
+        logger.info("get_current_user: session expired due to inactivity for user_id=%s session_id=%s", user.id, session_id)
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Session expired due to inactivity",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+
+    # Touch last_seen on valid session (sliding expiration - extends token life)
+    device_session.last_seen = datetime.now()
+    db.commit()
+
+    # Check if user is suspended
+    if user.suspended:
+        logger.info("get_current_user: account suspended for user_id=%s reason=%s", user.id, user.suspension_reason)
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Account suspended",
+            headers={"suspension_reason": user.suspension_reason or "No reason provided"},
+        )
+
+    # Check if user is deleted
+    if user.deleted:
+        logger.info("get_current_user: account deleted for user_id=%s", user.id)
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Account deleted",
+        )
+
+    request.state.current_user = user
+    request.state.session_id = session_id
+
+    return user

backend/shared/models.py

@@ -0,0 +1,423 @@
+from sqlalchemy import Column, Integer, String, Text, DateTime, Boolean, ForeignKey, Float, JSON, BigInteger, UniqueConstraint
+from sqlalchemy.ext.declarative import declarative_base
+from sqlalchemy.orm import relationship
+from datetime import datetime
+import json
+from pydantic import BaseModel
+
+Base = declarative_base()
+
+class User(Base):
+    __tablename__ = "users"
+    __table_args__ = {"schema": "account_schema"}
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    username = Column(String(50), unique=True, index=True, nullable=False)
+    hashed_password = Column(String(255), nullable=False)
+    salt = Column(String(64), nullable=False)
+    display_name = Column(String(100), nullable=True)
+    bio = Column(Text, nullable=True)
+    avatar_url = Column(String(255), nullable=True)
+    is_online = Column(Boolean, default=False)
+    last_seen = Column(DateTime, default=datetime.utcnow)
+    created_at = Column(DateTime, default=datetime.utcnow)
+    updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
+    verified = Column(Boolean, default=False)
+    verification_token = Column(String(255), nullable=True)
+    reset_token = Column(String(255), nullable=True)
+    reset_token_expires = Column(DateTime, nullable=True)
+    two_factor_enabled = Column(Boolean, default=False)
+    two_factor_secret = Column(String(255), nullable=True)
+    login_attempts = Column(Integer, default=0)
+    locked_until = Column(DateTime, nullable=True)
+    public_key = Column(Text, nullable=True)
+    private_key = Column(Text, nullable=True)
+    encryption_enabled = Column(Boolean, default=False)
+    suspended = Column(Boolean, default=False)
+    suspension_reason = Column(Text, nullable=True)
+    deleted = Column(Boolean, default=False)
+
+    # Relationships
+    messages = relationship("Message", back_populates="sender", cascade="all, delete-orphan")
+    message_recipients = relationship("MessageRecipient", back_populates="recipient", cascade="all, delete-orphan")
+    devices = relationship("Device", back_populates="user", cascade="all, delete-orphan")
+    push_subscriptions = relationship("PushSubscription", back_populates="user", cascade="all, delete-orphan")
+
+class Message(Base):
+    __tablename__ = "messages"
+    __table_args__ = {"schema": "messaging_schema"}
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    sender_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, index=True)
+    content = Column(Text, nullable=False)
+    content_type = Column(String(50), default="text")
+    encrypted_content = Column(Text, nullable=True)
+    signature = Column(Text, nullable=True)
+    timestamp = Column(DateTime, default=datetime.utcnow, index=True)
+    edited_at = Column(DateTime, nullable=True)
+    edited = Column(Boolean, default=False)
+    deleted = Column(Boolean, default=False)
+    reply_to_id = Column(BigInteger, ForeignKey("messaging_schema.messages.id"), nullable=True)
+    thread_id = Column(BigInteger, ForeignKey("messaging_schema.messages.id"), nullable=True)
+    is_public = Column(Boolean, default=False)
+
+    # Relationships
+    sender = relationship("User", back_populates="messages")
+    recipients = relationship("MessageRecipient", back_populates="message", cascade="all, delete-orphan")
+    reply_to = relationship("Message", remote_side=[id], foreign_keys=[reply_to_id])
+    thread = relationship("Message", remote_side=[id], foreign_keys=[thread_id])
+    reactions = relationship("MessageReaction", back_populates="message", cascade="all, delete-orphan")
+    files = relationship("MessageFile", back_populates="message", cascade="all, delete-orphan")
+
+class MessageRecipient(Base):
+    __tablename__ = "message_recipients"
+    __table_args__ = {"schema": "messaging_schema"}
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    message_id = Column(BigInteger, ForeignKey("messaging_schema.messages.id"), nullable=False, index=True)
+    recipient_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, index=True)
+    read_at = Column(DateTime, nullable=True)
+    delivered_at = Column(DateTime, nullable=True)
+    encrypted_key = Column(Text, nullable=True)
+
+    # Relationships
+    message = relationship("Message", back_populates="recipients")
+    recipient = relationship("User", back_populates="message_recipients")
+
+class MessageReaction(Base):
+    __tablename__ = "message_reactions"
+    __table_args__ = {"schema": "messaging_schema"}
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    message_id = Column(BigInteger, ForeignKey("messaging_schema.messages.id"), nullable=False, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, index=True)
+    reaction = Column(String(50), nullable=False)
+    created_at = Column(DateTime, default=datetime.utcnow)
+
+    # Relationships
+    message = relationship("Message", back_populates="reactions")
+
+class Device(Base):
+    __tablename__ = "devices"
+    __table_args__ = {"schema": "device_schema"}
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, index=True)
+    device_id = Column(String(255), unique=True, nullable=False, index=True)
+    device_name = Column(String(255), nullable=True)
+    device_type = Column(String(50), nullable=True)
+    public_key = Column(Text, nullable=True)
+    signed_prekey = Column(Text, nullable=True)
+    one_time_prekeys = Column(JSON, nullable=True)
+    last_active = Column(DateTime, default=datetime.utcnow)
+    created_at = Column(DateTime, default=datetime.utcnow)
+
+    # Relationships
+    user = relationship("User", back_populates="devices")
+    push_subscriptions = relationship("PushSubscription", back_populates="device", cascade="all, delete-orphan")
+
+class PushSubscription(Base):
+    __tablename__ = "push_subscriptions"
+    __table_args__ = {"schema": "push_schema"}
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, index=True)
+    device_id = Column(BigInteger, ForeignKey("device_schema.devices.id"), nullable=True, index=True)
+    endpoint = Column(String(500), nullable=False)
+    p256dh = Column(String(255), nullable=False)
+    auth = Column(String(255), nullable=False)
+    user_agent = Column(String(500), nullable=True)
+    created_at = Column(DateTime, default=datetime.utcnow)
+
+    # Relationships
+    user = relationship("User", back_populates="push_subscriptions")
+    device = relationship("Device", back_populates="push_subscriptions")
+
+class WebRTCSession(Base):
+    __tablename__ = "webrtc_sessions"
+    __table_args__ = {"schema": "webrtc_schema"}
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    session_id = Column(String(255), unique=True, nullable=False, index=True)
+    initiator_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False)
+    participant_ids = Column(JSON, nullable=False)
+    offer = Column(JSON, nullable=True)
+    answer = Column(JSON, nullable=True)
+    ice_candidates = Column(JSON, nullable=True)
+    status = Column(String(50), default="pending")
+    created_at = Column(DateTime, default=datetime.utcnow)
+    updated_at = Column(DateTime, default=datetime.utcnow, onupdate=datetime.utcnow)
+
+class ModerationAction(Base):
+    __tablename__ = "moderation_actions"
+    __table_args__ = {"schema": "moderation_schema"}
+
+    id = Column(BigInteger, primary_key=True, index=True)
+    moderator_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False)
+    target_user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=True)
+    target_message_id = Column(BigInteger, ForeignKey("messaging_schema.messages.id"), nullable=True)
+    action_type = Column(String(50), nullable=False)
+    reason = Column(Text, nullable=True)
+    created_at = Column(DateTime, default=datetime.utcnow)
+    expires_at = Column(DateTime, nullable=True)
+
+
+class MessageFile(Base):
+    __tablename__ = "message_file"
+    __table_args__ = {"schema": "messaging_schema"}
+
+    id = Column(Integer, primary_key=True, index=True)
+    message_id = Column(BigInteger, ForeignKey("messaging_schema.messages.id"), nullable=False, index=True)
+    path = Column(Text, nullable=False)
+    name = Column(Text, nullable=False)
+
+    message = relationship("Message", back_populates="files")
+
+
+class CryptoPublicKey(Base):
+    __tablename__ = "crypto_public_key"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, unique=True)
+    public_key_b64 = Column(Text, nullable=False)
+
+
+class CryptoBackup(Base):
+    __tablename__ = "crypto_backup"
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, unique=True)
+    blob_json = Column(Text, nullable=False)
+
+
+class DMEnvelope(Base):
+    __tablename__ = "dm_envelope"
+    __table_args__ = {"schema": "messaging_schema"}
+
+    id = Column(Integer, primary_key=True, index=True)
+    sender_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False)
+    recipient_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False)
+    iv_b64 = Column(Text, nullable=False)
+    ciphertext_b64 = Column(Text, nullable=False)
+    salt_b64 = Column(Text, nullable=False)
+    iv2_b64 = Column(Text, nullable=False)
+    wrapped_mk_b64 = Column(Text, nullable=False)
+    reply_to_id = Column(Integer, nullable=True)
+    timestamp = Column(DateTime, default=datetime.now)
+    files = relationship("DMFile", back_populates="message", cascade="all, delete-orphan", lazy="select")
+    reactions = relationship("DMReaction", cascade="all, delete-orphan", lazy="select")
+
+
+class DMFile(Base):
+    __tablename__ = "dm_file"
+    __table_args__ = {"schema": "messaging_schema"}
+
+    id = Column(Integer, primary_key=True, index=True)
+    message_id = Column(Integer, ForeignKey("messaging_schema.dm_envelope.id"), nullable=False, index=True)
+    sender_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False)
+    recipient_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False)
+    name = Column(Text, nullable=False)
+    path = Column(Text, nullable=False)
+
+    message = relationship("DMEnvelope", back_populates="files")
+
+
+class FcmToken(Base):
+    __tablename__ = "fcm_token"
+    __table_args__ = {"schema": "push_schema"}
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, index=True)
+    token = Column(Text, nullable=False, unique=True)
+    created_at = Column(DateTime, default=datetime.now)
+    updated_at = Column(DateTime, default=datetime.now, onupdate=datetime.now)
+
+
+class Reaction(Base):
+    __tablename__ = "reaction"
+    __table_args__ = {"schema": "messaging_schema"}
+
+    id = Column(Integer, primary_key=True, index=True)
+    message_id = Column(BigInteger, ForeignKey("messaging_schema.messages.id"), nullable=False, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False)
+    emoji = Column(String(10), nullable=False)  # Store emoji as string
+    timestamp = Column(DateTime, default=datetime.now)
+
+    # Relationships
+    user = relationship("User")
+
+    # Ensure unique combination of message, user, and emoji
+    __table_args__ = (UniqueConstraint('message_id', 'user_id', 'emoji', name='unique_reaction'),)
+
+
+class DMReaction(Base):
+    __tablename__ = "dm_reaction"
+    __table_args__ = {"schema": "messaging_schema"}
+
+    id = Column(Integer, primary_key=True, index=True)
+    dm_envelope_id = Column(Integer, ForeignKey("messaging_schema.dm_envelope.id"), nullable=False, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False)
+    emoji = Column(String(10), nullable=False)  # Store emoji as string
+    timestamp = Column(DateTime, default=datetime.now)
+
+    # Relationships
+    user = relationship("User")
+    dm_envelope = relationship("DMEnvelope", overlaps="reactions")
+
+    # Ensure unique combination of dm_envelope, user, and emoji
+    __table_args__ = (UniqueConstraint('dm_envelope_id', 'user_id', 'emoji', name='unique_dm_reaction'),)
+
+
+# Tracks authenticated device sessions per user
+class DeviceSession(Base):
+    __tablename__ = "device_session"
+    __table_args__ = {"schema": "device_schema"}
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, index=True)
+
+    # Raw User-Agent for reference/debugging
+    raw_user_agent = Column(Text, nullable=True)
+
+    # Parsed fields
+    device_name = Column(String(128), nullable=True)
+    device_type = Column(String(32), nullable=True)  # desktop/mobile/tablet/bot/unknown
+    os_name = Column(String(64), nullable=True)
+    os_version = Column(String(64), nullable=True)
+    browser_name = Column(String(64), nullable=True)
+    browser_version = Column(String(64), nullable=True)
+    brand = Column(String(64), nullable=True)
+    model = Column(String(64), nullable=True)
+
+    # Session identity embedded into JWTs
+    session_id = Column(String(64), unique=True, nullable=False, index=True)
+
+    # Lifecycle
+    created_at = Column(DateTime, default=datetime.now)
+    last_seen = Column(DateTime, default=datetime.now)
+    revoked = Column(Boolean, default=False)
+
+    # Relationship back to user (optional lazy to avoid heavy loads)
+    user = relationship("User", lazy="select")
+
+
+# Pydantic models
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+class RegisterRequest(BaseModel):
+    username: str
+    display_name: str
+    password: str
+    confirm_password: str
+
+
+class ChangePasswordRequest(BaseModel):
+    currentPasswordDerived: str
+    newPasswordDerived: str
+    logoutAllExceptCurrent: bool = False
+
+
+class SendMessageRequest(BaseModel):
+    content: str
+    reply_to_id: int | None = None
+
+
+class EditMessageRequest(BaseModel):
+    content: str
+
+
+class DeleteMessageRequest(BaseModel):
+    message_id: int
+
+
+class UpdateBioRequest(BaseModel):
+    bio: str
+
+
+class PushSubscriptionRequest(BaseModel):
+    endpoint: str
+    keys: dict
+
+
+class UserProfileResponse(BaseModel):
+    id: int
+    username: str
+    display_name: str
+    profile_picture: str | None
+    bio: str | None
+    online: bool
+    last_seen: datetime | None
+    created_at: datetime | None
+    verified: bool
+    suspended: bool
+    suspension_reason: str | None
+    deleted: bool
+
+    class Config:
+        from_attributes = True
+
+
+class MessageResponse(BaseModel):
+    id: int
+    content: str
+    timestamp: datetime
+    is_author: bool
+    is_read: bool
+    username: str
+    profile_picture: str | None
+
+    class Config:
+        from_attributes = True
+
+
+class ReactionRequest(BaseModel):
+    message_id: int
+    emoji: str
+
+
+class ReactionResponse(BaseModel):
+    id: int
+    message_id: int
+    user_id: int
+    emoji: str
+    timestamp: datetime
+    username: str
+
+    class Config:
+        from_attributes = True
+
+
+class DMReactionRequest(BaseModel):
+    dm_envelope_id: int
+    emoji: str
+
+
+class DMReactionResponse(BaseModel):
+    id: int
+    dm_envelope_id: int
+    user_id: int
+    emoji: str
+    timestamp: datetime
+    username: str
+
+    class Config:
+        from_attributes = True
+
+
+class UpdateLog(Base):
+    """Stores update sequence numbers and updates for gap detection"""
+    __tablename__ = "update_log"
+    __table_args__ = {"schema": "public"}
+
+    id = Column(Integer, primary_key=True, index=True)
+    user_id = Column(BigInteger, ForeignKey("account_schema.users.id"), nullable=False, index=True)
+    sequence = Column(Integer, nullable=False, index=True)
+    updates = Column(Text, nullable=False)  # JSON array of updates
+    timestamp = Column(DateTime, default=datetime.now, index=True)
+
+    __table_args__ = (
+        UniqueConstraint("user_id", "sequence", name="uq_user_sequence"),
+    )

backend/shared/utils.py

@@ -0,0 +1,234 @@
+import secrets
+import string
+import hashlib
+import hmac
+import base64
+import json
+from datetime import datetime, timedelta
+from typing import Optional
+import re
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
+from cryptography.hazmat.backends import default_backend
+import nacl.secret
+import nacl.utils
+from fastapi import Request
+import jwt
+import bcrypt
+from backend.shared.constants import JWT_SECRET_KEY, JWT_ALGORITHM, MAX_TOKEN_LIFETIME_HOURS
+import ipaddress
+
+def generate_secure_token(length: int = 32) -> str:
+    """Generate a cryptographically secure random token."""
+    alphabet = string.ascii_letters + string.digits
+    return ''.join(secrets.choice(alphabet) for _ in range(length))
+
+def hash_password(password: str, salt: Optional[bytes] = None) -> tuple[str, bytes]:
+    """Hash a password with PBKDF2 and return (hash, salt)."""
+    if salt is None:
+        salt = secrets.token_bytes(32)
+
+    kdf = PBKDF2HMAC(
+        algorithm=hashes.SHA256(),
+        length=32,
+        salt=salt,
+        iterations=100000,
+        backend=default_backend()
+    )
+
+    key = kdf.derive(password.encode())
+    return base64.b64encode(key).decode(), salt
+
+def verify_password(password: str, hashed: str, salt: bytes) -> bool:
+    """Verify a password against its hash and salt."""
+    try:
+        key = base64.b64decode(hashed)
+        kdf = PBKDF2HMAC(
+            algorithm=hashes.SHA256(),
+            length=32,
+            salt=salt,
+            iterations=100000,
+            backend=default_backend()
+        )
+        kdf.verify(password.encode(), key)
+        return True
+    except:
+        return False
+
+def generate_verification_token() -> str:
+    """Generate a verification token for email verification."""
+    return generate_secure_token(64)
+
+def generate_reset_token() -> str:
+    """Generate a password reset token."""
+    return generate_secure_token(64)
+
+def get_client_ip(request: Request) -> str:
+    """Extract the real client IP from the request."""
+    # Check X-Forwarded-For header first
+    forwarded_for = request.headers.get("X-Forwarded-For")
+    if forwarded_for:
+        # Take the first IP in case of multiple proxies
+        client_ip = forwarded_for.split(",")[0].strip()
+        try:
+            # Validate IP address
+            ipaddress.ip_address(client_ip)
+            return client_ip
+        except ValueError:
+            pass
+
+    # Check X-Real-IP header
+    real_ip = request.headers.get("X-Real-IP")
+    if real_ip:
+        try:
+            ipaddress.ip_address(real_ip)
+            return real_ip
+        except ValueError:
+            pass
+
+    # Fallback to request.client.host
+    client_host = request.client.host if request.client else "unknown"
+    try:
+        ipaddress.ip_address(client_host)
+        return client_host
+    except ValueError:
+        return "unknown"
+
+def validate_email(email: str) -> bool:
+    """Validate email address format."""
+    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
+    return re.match(pattern, email) is not None
+
+def validate_username(username: str) -> bool:
+    """Validate username format."""
+    if not username or len(username) < 3 or len(username) > 50:
+        return False
+
+    # Allow alphanumeric, underscore, and hyphen
+    pattern = r'^[a-zA-Z0-9_-]+$'
+    return re.match(pattern, username) is not None
+
+def sanitize_filename(filename: str) -> str:
+    """Sanitize filename to prevent directory traversal."""
+    return re.sub(r'[^\w\.-]', '_', filename)
+
+def generate_file_hash(content: bytes) -> str:
+    """Generate SHA256 hash of file content."""
+    return hashlib.sha256(content).hexdigest()
+
+def encrypt_data(data: str, key: bytes) -> str:
+    """Encrypt data using NaCl secret box."""
+    box = nacl.secret.SecretBox(key)
+    encrypted = box.encrypt(data.encode())
+    return base64.b64encode(encrypted).decode()
+
+def decrypt_data(encrypted_data: str, key: bytes) -> str:
+    """Decrypt data using NaCl secret box."""
+    box = nacl.secret.SecretBox(key)
+    encrypted = base64.b64decode(encrypted_data)
+    decrypted = box.decrypt(encrypted)
+    return decrypted.decode()
+
+def generate_encryption_key() -> bytes:
+    """Generate a new encryption key."""
+    return nacl.utils.random(nacl.secret.SecretBox.KEY_SIZE)
+
+def format_datetime(dt: datetime) -> str:
+    """Format datetime for API responses."""
+    return dt.isoformat()
+
+def parse_datetime(dt_str: str) -> Optional[datetime]:
+    """Parse datetime from API requests."""
+    try:
+        return datetime.fromisoformat(dt_str.replace('Z', '+00:00'))
+    except:
+        return None
+
+def calculate_age(birth_date: datetime) -> int:
+    """Calculate age from birth date."""
+    today = datetime.now()
+    age = today.year - birth_date.year
+    if today.month < birth_date.month or (today.month == birth_date.month and today.day < birth_date.day):
+        age -= 1
+    return age
+
+def truncate_text(text: str, max_length: int, suffix: str = "...") -> str:
+    """Truncate text to max length with suffix."""
+    if len(text) <= max_length:
+        return text
+    return text[:max_length - len(suffix)] + suffix
+
+def is_valid_url(url: str) -> bool:
+    """Validate URL format."""
+    pattern = r'^https?://[^\s/$.?#].[^\s]*$'
+    return re.match(pattern, url) is not None
+
+def generate_device_id() -> str:
+    """Generate a unique device identifier."""
+    return generate_secure_token(32)
+
+def normalize_phone_number(phone: str) -> str:
+    """Normalize phone number format."""
+    # Remove all non-digit characters except +
+    normalized = re.sub(r'[^\d+]', '', phone)
+
+    # Ensure it starts with +
+    if not normalized.startswith('+'):
+        if normalized.startswith('00'):
+            normalized = '+' + normalized[2:]
+        else:
+            normalized = '+' + normalized
+
+    return normalized
+
+
+def create_token(user_id: int, username: str, session_id: str) -> str:
+    # Set a long expiration as safety net (actual expiration based on inactivity)
+    expire = datetime.now() + timedelta(hours=MAX_TOKEN_LIFETIME_HOURS)
+    payload = {
+        "user_id": user_id,
+        "username": username,
+        "session_id": session_id,
+        "exp": int(expire.timestamp())  # JWT exp must be Unix timestamp (int)
+    }
+    return jwt.encode(payload, JWT_SECRET_KEY, algorithm=JWT_ALGORITHM)
+
+
+def get_password_hash(password: str) -> str:
+    return bcrypt.hashpw(password.encode("utf-8"), bcrypt.gensalt()).decode("utf-8")
+
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return bcrypt.checkpw(plain_password.encode("utf-8"), hashed_password.encode("utf-8"))
+
+
+def verify_token(token: str) -> Optional[dict]:
+    try:
+        payload = jwt.decode(token, JWT_SECRET_KEY, algorithms=[JWT_ALGORITHM])
+        return payload
+    except jwt.ExpiredSignatureError:
+        return None
+    except jwt.InvalidTokenError:
+        return None
+
+
+def _is_admin(user) -> bool:
+    return user.id == 1
+
+
+def convert_user(user) -> dict:
+    return {
+        "id": user.id,
+        "created_at": user.created_at.isoformat(),
+        "last_seen": user.last_seen.isoformat(),
+        "online": user.online,
+        "username": user.username,
+        "display_name": user.display_name,
+        "profile_picture": user.profile_picture,
+        "bio": user.bio,
+        "admin": _is_admin(user),
+        "verified": user.verified,
+        "suspended": user.suspended or False,
+        "suspension_reason": user.suspension_reason,
+        "deleted": (user.deleted or user.suspended) or False  # Treat suspended as deleted
+    }

backend/shared/validation.py

@@ -0,0 +1,132 @@
+from typing import Optional
+from pydantic import BaseModel, EmailStr, Field, validator
+import re
+
+
+def is_valid_username(username: str) -> bool:
+    if len(username) < 3 or len(username) > 20:
+        return False
+    # Only allow English letters, numbers, dashes and underscores
+    if not re.match(r'^[a-zA-Z0-9_-]+$', username):
+        return False
+    return True
+
+
+def is_valid_display_name(display_name: str) -> bool:
+    if len(display_name) < 1 or len(display_name) > 64:
+        return False
+    # Check if not blank (only whitespace)
+    if not display_name.strip():
+        return False
+    return True
+
+
+def is_valid_password(password: str) -> bool:
+    if len(password) < 5 or len(password) > 50:
+        return False
+    if re.search(r'[\s\u180E\u200B-\u200D\u2060\uFEFF]', password):
+        return False
+    return True
+
+class UserCreate(BaseModel):
+    username: str = Field(min_length=3, max_length=50)
+    email: EmailStr
+    password: str = Field(min_length=8, max_length=128)
+    display_name: Optional[str] = Field(None, max_length=100)
+
+    @validator('username')
+    def username_alphanumeric(cls, v):
+        if not re.match(r'^[a-zA-Z0-9_-]+$', v):
+            raise ValueError('Username must be alphanumeric with underscores or hyphens')
+        return v
+
+    @validator('password')
+    def password_strength(cls, v):
+        if not re.search(r'[A-Z]', v):
+            raise ValueError('Password must contain at least one uppercase letter')
+        if not re.search(r'[a-z]', v):
+            raise ValueError('Password must contain at least one lowercase letter')
+        if not re.search(r'\d', v):
+            raise ValueError('Password must contain at least one digit')
+        return v
+
+class UserLogin(BaseModel):
+    username_or_email: str = Field(min_length=1, max_length=100)
+    password: str = Field(min_length=1, max_length=128)
+
+class UserUpdate(BaseModel):
+    display_name: Optional[str] = Field(None, max_length=100)
+    bio: Optional[str] = Field(None, max_length=500)
+    avatar_url: Optional[str] = Field(None, max_length=255)
+
+    @validator('avatar_url')
+    def validate_avatar_url(cls, v):
+        if v and not v.startswith(('http://', 'https://')):
+            raise ValueError('Avatar URL must be a valid HTTP/HTTPS URL')
+        return v
+
+class MessageCreate(BaseModel):
+    content: str = Field(min_length=1, max_length=10000)
+    content_type: str = Field(default="text", pattern=r'^(text|image|video|audio|file)$')
+    reply_to_id: Optional[int] = None
+    recipient_ids: list[int] = Field(min_items=1, max_items=100)
+
+class MessageUpdate(BaseModel):
+    content: str = Field(min_length=1, max_length=10000)
+
+class DeviceRegister(BaseModel):
+    device_id: str = Field(min_length=1, max_length=255)
+    device_name: Optional[str] = Field(None, max_length=255)
+    device_type: Optional[str] = Field(None, max_length=50)
+    public_key: Optional[str] = Field(None, max_length=10000)
+
+class PushSubscriptionCreate(BaseModel):
+    endpoint: str = Field(max_length=500)
+    p256dh: str = Field(max_length=255)
+    auth: str = Field(max_length=255)
+    device_id: Optional[str] = Field(None, max_length=255)
+
+class WebRTCOffer(BaseModel):
+    offer: dict
+    participant_ids: list[int] = Field(min_items=1, max_items=10)
+
+class WebRTCAnswer(BaseModel):
+    answer: dict
+    session_id: str = Field(max_length=255)
+
+class WebRTCIceCandidate(BaseModel):
+    candidate: dict
+    session_id: str = Field(max_length=255)
+
+class ModerationActionCreate(BaseModel):
+    target_user_id: Optional[int] = None
+    target_message_id: Optional[int] = None
+    action_type: str = Field(pattern=r'^(ban|mute|delete|warn)$')
+    reason: Optional[str] = Field(None, max_length=1000)
+    duration_hours: Optional[int] = Field(None, gt=0, le=8760)  # Max 1 year
+
+class PasswordResetRequest(BaseModel):
+    email: EmailStr
+
+class PasswordReset(BaseModel):
+    token: str = Field(min_length=64, max_length=64)
+    new_password: str = Field(..., min_length=8, max_length=128)
+
+    @validator('new_password')
+    def password_strength(cls, v):
+        if not re.search(r'[A-Z]', v):
+            raise ValueError('Password must contain at least one uppercase letter')
+        if not re.search(r'[a-z]', v):
+            raise ValueError('Password must contain at least one lowercase letter')
+        if not re.search(r'\d', v):
+            raise ValueError('Password must contain at least one digit')
+        return v
+
+class TwoFactorSetup(BaseModel):
+    code: str = Field(pattern=r'^\d{6}$')
+
+class TwoFactorVerify(BaseModel):
+    code: str = Field(pattern=r'^\d{6}$')
+
+class EmailVerification(BaseModel):
+    token: str = Field(min_length=64, max_length=64)

deployment/caddy/Caddyfile

@@ -0,0 +1,88 @@
+fromchat.ru {
+	reverse_proxy 172.18.0.1:8301 host.docker.internal:8301 172.17.0.1:8301 {
+		lb_policy first
+        header_up X-Real-IP {remote_host}
+	}
+
+	# Security headers
+	header {
+		X-XSS-Protection "1; mode=block" # Prevent XSS attacks
+		X-Content-Type-Options "nosniff" # Prevent MIME type sniffing
+		X-Frame-Options "DENY" # Prevent clickjacking
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';"
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		Permissions-Policy "geolocation=(), microphone=(self), camera=(self)"
+	}
+
+	rate_limit {
+		zone global {
+			key {remote_ip}
+			window 1m
+			burst 20
+			events 500
+		}
+	}
+
+	handle_errors {
+		@errors {
+			expression {err.status_code} >= 400
+		}
+
+		handle @errors {
+			rewrite * /{err.status_code}
+			reverse_proxy https://http.cat {
+				header_up Host {upstream_hostport}
+				replace_status {err.status_code}
+			}
+		}
+	}
+}
+
+beta.fromchat.ru {
+    reverse_proxy 95.165.0.162:8301 {
+        header_up X-Real-IP {remote_host}
+    }
+
+	# Security headers
+	header {
+		X-XSS-Protection "1; mode=block" # Prevent XSS attacks
+		X-Content-Type-Options "nosniff" # Prevent MIME type sniffing
+		X-Frame-Options "DENY" # Prevent clickjacking
+		Referrer-Policy "strict-origin-when-cross-origin"
+		Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none';"
+		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
+		Permissions-Policy "geolocation=(), microphone=(self), camera=(self)"
+	}
+
+	rate_limit {
+		zone global {
+			key {remote_ip}
+			window 1m
+			burst 20
+			events 1000
+		}
+	}
+
+	handle_errors {
+		@errors {
+			expression {err.status_code} >= 400
+		}
+
+		handle @errors {
+			rewrite * /{err.status_code}
+			reverse_proxy https://http.cat {
+				header_up Host {upstream_hostport}
+				replace_status {err.status_code}
+			}
+		}
+	}
+}
+
+api.getgadgets.toolbox-io.ru {
+    reverse_proxy 95.165.0.162:8400
+}
+
+getgadgets.toolbox-io.ru {
+    reverse_proxy 95.165.0.162:8401
+}

deployment/caddy/Dockerfile

@@ -0,0 +1,13 @@
+#
+# Custom Caddy built with:
+# - Rate limit plugin
+#
+
+FROM caddy:2-builder AS builder
+RUN xcaddy build \
+      --with github.com/mholt/caddy-ratelimit
+
+FROM caddy:2
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy
+COPY Caddyfile /etc/caddy/Caddyfile

deployment/db-init/01-init-roles.sql

@@ -0,0 +1,70 @@
+-- Initialize database roles and schemas for FromChat microservices
+-- This script creates dedicated users with limited privileges for each service
+
+-- Create service-specific database roles with limited privileges
+-- All services use the same password
+CREATE ROLE account_service_user LOGIN PASSWORD 'development';
+CREATE ROLE profile_service_user LOGIN PASSWORD 'development';
+CREATE ROLE device_service_user LOGIN PASSWORD 'development';
+CREATE ROLE messaging_service_user LOGIN PASSWORD 'development';
+CREATE ROLE push_service_user LOGIN PASSWORD 'development';
+CREATE ROLE webrtc_service_user LOGIN PASSWORD 'development';
+CREATE ROLE moderation_service_user LOGIN PASSWORD 'development';
+CREATE ROLE gateway_user LOGIN PASSWORD 'development';
+
+-- Create dedicated schemas for each service
+CREATE SCHEMA IF NOT EXISTS account_schema AUTHORIZATION account_service_user;
+CREATE SCHEMA IF NOT EXISTS profile_schema AUTHORIZATION profile_service_user;
+CREATE SCHEMA IF NOT EXISTS device_schema AUTHORIZATION device_service_user;
+CREATE SCHEMA IF NOT EXISTS messaging_schema AUTHORIZATION messaging_service_user;
+CREATE SCHEMA IF NOT EXISTS push_schema AUTHORIZATION push_service_user;
+CREATE SCHEMA IF NOT EXISTS webrtc_schema AUTHORIZATION webrtc_service_user;
+CREATE SCHEMA IF NOT EXISTS moderation_schema AUTHORIZATION moderation_service_user;
+
+-- Grant basic connection privileges
+GRANT CONNECT ON DATABASE fromchat TO account_service_user, profile_service_user, device_service_user, messaging_service_user, push_service_user, webrtc_service_user, moderation_service_user;
+
+-- Grant schema-level privileges (limited to each service's schema)
+-- Account service
+GRANT USAGE ON SCHEMA account_schema TO account_service_user;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA account_schema TO account_service_user;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA account_schema TO account_service_user;
+
+-- Profile service
+GRANT USAGE ON SCHEMA profile_schema TO profile_service_user;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA profile_schema TO profile_service_user;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA profile_schema TO profile_service_user;
+
+-- Device service
+GRANT USAGE ON SCHEMA device_schema TO device_service_user;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA device_schema TO device_service_user;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA device_schema TO device_service_user;
+
+-- Messaging service
+GRANT USAGE ON SCHEMA messaging_schema TO messaging_service_user;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA messaging_schema TO messaging_service_user;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA messaging_schema TO messaging_service_user;
+
+-- Push service
+GRANT USAGE ON SCHEMA push_schema TO push_service_user;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA push_schema TO push_service_user;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA push_schema TO push_service_user;
+
+-- WebRTC service
+GRANT USAGE ON SCHEMA webrtc_schema TO webrtc_service_user;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA webrtc_schema TO webrtc_service_user;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA webrtc_schema TO webrtc_service_user;
+
+-- Moderation service
+GRANT USAGE ON SCHEMA moderation_schema TO moderation_service_user;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA moderation_schema TO moderation_service_user;
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA moderation_schema TO moderation_service_user;
+
+-- Set default privileges for future objects
+ALTER DEFAULT PRIVILEGES IN SCHEMA account_schema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO account_service_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA profile_schema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO profile_service_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA device_schema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO device_service_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA messaging_schema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO messaging_service_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA push_schema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO push_service_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA webrtc_schema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO webrtc_service_user;
+ALTER DEFAULT PRIVILEGES IN SCHEMA moderation_schema GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO moderation_service_user;

deployment/db-init/02-init-tables.sql

@@ -0,0 +1,158 @@
+-- Create tables for FromChat microservices
+-- This script creates the necessary tables in their respective schemas
+
+-- Note: In production, tables will be created by Alembic migrations
+-- This script provides a fallback or reference for manual setup
+
+-- Account schema tables
+CREATE TABLE IF NOT EXISTS account_schema.users (
+    id BIGSERIAL PRIMARY KEY,
+    username VARCHAR(50) UNIQUE NOT NULL,
+    hashed_password VARCHAR(255) NOT NULL,
+    salt VARCHAR(64) NOT NULL,
+    display_name VARCHAR(100),
+    bio TEXT,
+    avatar_url VARCHAR(255),
+    is_online BOOLEAN DEFAULT FALSE,
+    last_seen TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    verified BOOLEAN DEFAULT FALSE,
+    verification_token VARCHAR(255),
+    reset_token VARCHAR(255),
+    reset_token_expires TIMESTAMP,
+    two_factor_enabled BOOLEAN DEFAULT FALSE,
+    two_factor_secret VARCHAR(255),
+    login_attempts INTEGER DEFAULT 0,
+    locked_until TIMESTAMP,
+    public_key TEXT,
+    private_key TEXT,
+    encryption_enabled BOOLEAN DEFAULT FALSE,
+    suspended BOOLEAN DEFAULT FALSE,
+    suspension_reason TEXT,
+    deleted BOOLEAN DEFAULT FALSE
+);
+
+-- Profile schema tables (references account_schema.users)
+CREATE TABLE IF NOT EXISTS profile_schema.user_profiles (
+    user_id BIGINT PRIMARY KEY REFERENCES account_schema.users(id) ON DELETE CASCADE,
+    display_name VARCHAR(100),
+    bio TEXT,
+    avatar_url VARCHAR(255),
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Device schema tables
+CREATE TABLE IF NOT EXISTS device_schema.devices (
+    id BIGSERIAL PRIMARY KEY,
+    user_id BIGINT REFERENCES account_schema.users(id) ON DELETE CASCADE,
+    device_id VARCHAR(255) UNIQUE NOT NULL,
+    device_name VARCHAR(255),
+    device_type VARCHAR(50),
+    public_key TEXT,
+    signed_prekey TEXT,
+    one_time_prekeys JSONB,
+    last_active TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+);
+
+CREATE TABLE IF NOT EXISTS device_schema.device_session (
+    id SERIAL PRIMARY KEY,
+    user_id BIGINT REFERENCES account_schema.users(id) ON DELETE CASCADE,
+    raw_user_agent TEXT,
+    device_name VARCHAR(128),
+    device_type VARCHAR(32),
+    os_name VARCHAR(64),
+    os_version VARCHAR(64),
+    browser_name VARCHAR(64),
+    browser_version VARCHAR(64),
+    brand VARCHAR(64),
+    model VARCHAR(64),
+    session_id VARCHAR(64) UNIQUE NOT NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    last_seen TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    revoked BOOLEAN DEFAULT FALSE
+);
+
+-- Messaging schema tables
+CREATE TABLE IF NOT EXISTS messaging_schema.messages (
+    id BIGSERIAL PRIMARY KEY,
+    sender_id BIGINT REFERENCES account_schema.users(id) ON DELETE CASCADE,
+    content TEXT NOT NULL,
+    content_type VARCHAR(50) DEFAULT 'text',
+    encrypted_content TEXT,
+    signature TEXT,
+    timestamp TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    edited_at TIMESTAMP,
+    edited BOOLEAN DEFAULT FALSE,
+    deleted BOOLEAN DEFAULT FALSE,
+    reply_to_id BIGINT REFERENCES messaging_schema.messages(id),
+    thread_id BIGINT REFERENCES messaging_schema.messages(id),
+    is_public BOOLEAN DEFAULT FALSE
+);
+
+CREATE TABLE IF NOT EXISTS messaging_schema.message_recipients (
+    id BIGSERIAL PRIMARY KEY,
+    message_id BIGINT REFERENCES messaging_schema.messages(id) ON DELETE CASCADE,
+    recipient_id BIGINT REFERENCES account_schema.users(id) ON DELETE CASCADE,
+    read_at TIMESTAMP,
+    delivered_at TIMESTAMP,
+    encrypted_key TEXT
+);
+
+CREATE TABLE IF NOT EXISTS messaging_schema.message_reactions (
+    id BIGSERIAL PRIMARY KEY,
+    message_id BIGINT REFERENCES messaging_schema.messages(id) ON DELETE CASCADE,
+    user_id BIGINT REFERENCES account_schema.users(id) ON DELETE CASCADE,
+    reaction VARCHAR(50) NOT NULL,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Push schema tables
+CREATE TABLE IF NOT EXISTS push_schema.push_subscriptions (
+    id BIGSERIAL PRIMARY KEY,
+    user_id BIGINT REFERENCES account_schema.users(id) ON DELETE CASCADE,
+    device_id BIGINT REFERENCES device_schema.devices(id),
+    endpoint VARCHAR(500) NOT NULL,
+    p256dh VARCHAR(255) NOT NULL,
+    auth VARCHAR(255) NOT NULL,
+    user_agent VARCHAR(500),
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+);
+
+-- WebRTC schema tables
+CREATE TABLE IF NOT EXISTS webrtc_schema.webrtc_sessions (
+    id BIGSERIAL PRIMARY KEY,
+    session_id VARCHAR(255) UNIQUE NOT NULL,
+    initiator_id BIGINT REFERENCES account_schema.users(id),
+    participant_ids JSONB NOT NULL,
+    offer JSONB,
+    answer JSONB,
+    ice_candidates JSONB,
+    status VARCHAR(50) DEFAULT 'pending',
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+);
+
+-- Moderation schema tables
+CREATE TABLE IF NOT EXISTS moderation_schema.moderation_actions (
+    id BIGSERIAL PRIMARY KEY,
+    moderator_id BIGINT REFERENCES account_schema.users(id),
+    target_user_id BIGINT REFERENCES account_schema.users(id),
+    target_message_id BIGINT REFERENCES messaging_schema.messages(id),
+    action_type VARCHAR(50) NOT NULL,
+    reason TEXT,
+    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    expires_at TIMESTAMP
+);
+
+-- Grant permissions on sequences (after all tables are created)
+GRANT USAGE ON SEQUENCE account_schema.users_id_seq TO account_service_user;
+GRANT USAGE ON SEQUENCE device_schema.devices_id_seq TO device_service_user;
+GRANT USAGE ON SEQUENCE device_schema.device_session_id_seq TO account_service_user;
+GRANT USAGE ON SEQUENCE messaging_schema.messages_id_seq TO messaging_service_user;
+GRANT USAGE ON SEQUENCE messaging_schema.message_recipients_id_seq TO messaging_service_user;
+GRANT USAGE ON SEQUENCE messaging_schema.message_reactions_id_seq TO messaging_service_user;
+GRANT USAGE ON SEQUENCE push_schema.push_subscriptions_id_seq TO push_service_user;
+GRANT USAGE ON SEQUENCE webrtc_schema.webrtc_sessions_id_seq TO webrtc_service_user;
+GRANT USAGE ON SEQUENCE moderation_schema.moderation_actions_id_seq TO moderation_service_user;

deployment/docker-compose.yml

@@ -1,48 +1,368 @@
 services:
-  backend:
-    build: 
-      dockerfile: deployment/Dockerfile.backend
-      context: ..
+  # Database service
+  database:
+    image: postgres:15
     environment:
-      PORT: 8300
-      JWT_SECRET: ${JWT_SECRET}
-      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
-      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
+      POSTGRES_DB: fromchat
+      POSTGRES_USER: fromchat_admin
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
     volumes:
-      - data:/app/data
-      - logs:/app/logs
+      - database:/var/lib/postgresql/data
+      - ./db-init:/docker-entrypoint-initdb.d
+    networks:
+      - fromchat_internal
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U fromchat_admin -d fromchat"]
+      interval: 1s
+      timeout: 5s
+      retries: 5
 
+  # Migration runner - runs once before other services
+  migration_runner:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: migration_runner
+    environment:
+      DATABASE_URL: postgresql://fromchat_admin:${DB_PASSWORD}@database:5432/fromchat
+      JWT_SECRET: ${JWT_SECRET}
+    depends_on:
+      database:
+        condition: service_healthy
+    networks:
+      - fromchat_internal
     develop:
       watch:
+        - action: sync
+          path: backend/alembic.ini
+          target: /app/backend/alembic.ini
+        - action: sync
+          path: backend/alembic
+          target: /app/backend/alembic
+        - action: sync
+          path: backend/migration.py
+          target: /app/backend/migration.py
+        - action: sync
+          path: backend/services/migration_runner
+          target: /app/backend/services/migration_runner
         - action: sync+restart
-          path: ../backend
-          target: /app
-        - action: rebuild
-          path: ../backend/requirements.txt
+          path: backend/shared
+          target: /app/backend/shared
 
-  frontend:
-    build: 
-      dockerfile: deployment/frontend/Dockerfile
+  # Gateway service - handles complex operations
+  gateway:
+    build:
       context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: gateway
+    ports: ["8300:8300"]
     environment:
-      PORT: 8301
-      BACKEND_HOST: http://backend:8300
+      DATABASE_URL: postgresql://gateway_user:${DB_PASSWORD}@database:5432/fromchat
+      PORT: 8300
+      ACCOUNT_SERVICE_URL: http://account_service:8302
+      PROFILE_SERVICE_URL: http://profile_service:8303
+      DEVICE_SERVICE_URL: http://device_service:8304
+      MESSAGING_SERVICE_URL: http://messaging_service:8305
+      PUSH_SERVICE_URL: http://push_service:8306
+      WEBRTC_SERVICE_URL: http://webrtc_service:8307
+      MODERATION_SERVICE_URL: http://moderation_service:8308
+    depends_on:
+      migration_runner:
+        condition: service_completed_successfully
+    networks:
+      - fromchat_internal
+      - fromchat_external
+    restart: unless-stopped
+    develop:
+      watch:
+        - action: sync
+          path: backend/app.py
+          target: /app/backend/app.py
+        - action: sync
+          path: backend/main.py
+          target: /app/backend/main.py
+        - action: sync
+          path: backend/dependencies.py
+          target: /app/backend/dependencies.py
+        - action: sync
+          path: backend/security
+          target: /app/backend/security
+        - action: sync
+          path: backend/services/gateway
+          target: /app/backend/services/gateway
+        - action: sync+restart
+          path: backend/shared
+          target: /app/backend/shared
+
+  # Account service
+  account_service:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: account_service
+    environment:
+      DATABASE_URL: postgresql://account_service_user:${DB_PASSWORD}@database:5432/fromchat
+      JWT_SECRET: ${JWT_SECRET}
+      PORT: 8302
+    depends_on:
+      migration_runner:
+        condition: service_completed_successfully
+    networks:
+      - fromchat_internal
+    restart: unless-stopped
+    develop:
+      watch:
+        - action: sync
+          path: backend/routes/account.py
+          target: /app/backend/routes/account.py
+        - action: sync
+          path: backend/services/account
+          target: /app/backend/services/account
+        - action: sync+restart
+          path: backend/shared
+          target: /app/backend/shared
+
+  # Profile service
+  profile_service:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: profile_service
+    environment:
+      DATABASE_URL: postgresql://profile_service_user:${DB_PASSWORD}@database:5432/fromchat
+      FIREBASE_CERT: ${FIREBASE_CERT}
+      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
+      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
+      VAPID_SUBJECT: ${VAPID_SUBJECT}
+      MESSAGING_SERVICE_URL: http://messaging_service:8305
+      PORT: 8303
+    depends_on:
+      migration_runner:
+        condition: service_completed_successfully
+    networks:
+      - fromchat_internal
+    restart: unless-stopped
+    develop:
+      watch:
+        - action: sync
+          path: backend/routes/profile.py
+          target: /app/backend/routes/profile.py
+        - action: sync
+          path: backend/services/profile
+          target: /app/backend/services/profile
+        - action: sync+restart
+          path: backend/shared
+          target: /app/backend/shared
+
+  # Device service
+  device_service:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: device_service
+    environment:
+      DATABASE_URL: postgresql://device_service_user:${DB_PASSWORD}@database:5432/fromchat
+      PORT: 8304
+    depends_on:
+      migration_runner:
+        condition: service_completed_successfully
+    networks:
+      - fromchat_internal
+    restart: unless-stopped
+    develop:
+      watch:
+        - action: sync
+          path: backend/routes/devices.py
+          target: /app/backend/routes/devices.py
+        - action: sync
+          path: backend/services/device
+          target: /app/backend/services/device
+        - action: sync+restart
+          path: backend/shared
+          target: /app/backend/shared
+
+  # Messaging service
+  messaging_service:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: messaging_service
+    ports:
+      - "8305:8305"
+    environment:
+      DATABASE_URL: postgresql://messaging_service_user:${DB_PASSWORD}@database:5432/fromchat
+      FIREBASE_CERT: ${FIREBASE_CERT}
+      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
+      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
+      VAPID_SUBJECT: ${VAPID_SUBJECT}
+      PUSH_SERVICE_URL: http://push_service:8306
+      PORT: 8305
+    depends_on:
+      migration_runner:
+        condition: service_completed_successfully
+    networks:
+      - fromchat_internal
+    restart: unless-stopped
+    develop:
+      watch:
+        - action: sync
+          path: backend/routes/messaging.py
+          target: /app/backend/routes/messaging.py
+        - action: sync
+          path: backend/websocket
+          target: /app/backend/websocket
+        - action: sync
+          path: backend/services/messaging
+          target: /app/backend/services/messaging
+        - action: sync+restart
+          path: backend/shared
+          target: /app/backend/shared
+
+  # Push service
+  push_service:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: push_service
+    environment:
+      DATABASE_URL: postgresql://push_service_user:${DB_PASSWORD}@database:5432/fromchat
+      FIREBASE_CERT: ${FIREBASE_CERT}
+      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
+      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
+      VAPID_SUBJECT: ${VAPID_SUBJECT}
+      PORT: 8306
+    depends_on:
+      migration_runner:
+        condition: service_completed_successfully
+    networks:
+      - fromchat_internal
+    restart: unless-stopped
+    develop:
+      watch:
+        - action: sync
+          path: backend/routes/push.py
+          target: /app/backend/routes/push.py
+        - action: sync
+          path: backend/push_service.py
+          target: /app/backend/push_service.py
+        - action: sync
+          path: backend/services/push
+          target: /app/backend/services/push
+        - action: sync+restart
+          path: backend/shared
+          target: /app/backend/shared
+
+  # WebRTC service
+  webrtc_service:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: webrtc_service
+    environment:
+      DATABASE_URL: postgresql://webrtc_service_user:${DB_PASSWORD}@database:5432/fromchat
+      PORT: 8307
+    depends_on:
+      migration_runner:
+        condition: service_completed_successfully
+    networks:
+      - fromchat_internal
+    restart: unless-stopped
+    develop:
+      watch:
+        - action: sync
+          path: backend/routes/webrtc.py
+          target: /app/backend/routes/webrtc.py
+        - action: sync
+          path: backend/services/webrtc
+          target: /app/backend/services/webrtc
+        - action: sync+restart
+          path: backend/shared
+          target: /app/backend/shared
+
+  # Moderation service
+  moderation_service:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.multi
+      target: moderation_service
+    environment:
+      DATABASE_URL: postgresql://moderation_service_user:${DB_PASSWORD}@database:5432/fromchat
+      PORT: 8308
+    depends_on:
+      migration_runner:
+        condition: service_completed_successfully
+    networks:
+      - fromchat_internal
+    restart: unless-stopped
+    develop:
+      watch:
+        - action: sync
+          path: backend/routes/moderation.py
+          target: /app/backend/routes/moderation.py
+        - action: sync
+          path: backend/security
+          target: /app/backend/security
+        - action: sync
+          path: backend/similarity.py
+          target: /app/backend/similarity.py
+        - action: sync
+          path: backend/services/moderation
+          target: /app/backend/services/moderation
+        - action: sync+restart
+          path: backend/shared
+          target: /app/backend/shared
+
+  # Caddy reverse proxy
+  caddy:
+    build:
+      context: ./caddy
+      dockerfile: Dockerfile
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - certs:/root/site/certs
+    networks:
+      - fromchat_external
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    environment:
+      - XDG_DATA_HOME=/root/site/certs
+      - XDG_CONFIG_HOME=/root/site/certs
+    restart: unless-stopped
+    depends_on:
+      - gateway
+    profiles: ["prod"]
+
+  # Frontend service - serves the React app
+  frontend:
+    build:
+      context: ..
+      dockerfile: deployment/frontend/Dockerfile
     ports:
       - "8301:8301"
-    depends_on:
-      - backend
-    develop:
-      watch:
-        - action: rebuild
-          path: ../frontend
-        - action: sync+restart
-          path: server.js
-          target: /server/server.js
-        - action: rebuild
-          path: package.json
+    environment:
+      - PORT=8301
+      - BACKEND_HOST=http://gateway:8300
+    restart: unless-stopped
+    networks:
+      - fromchat_external
+      - fromchat_internal
 
 volumes:
+  database:
+    name: fromchat-database
+  certs:
+    name: fromchat-certs
+  logs:
+    name: fromchat-logs
   data:
     name: fromchat-data
-  logs:
-    name: fromchat-logs
+
+networks:
+  fromchat_internal:
+    driver: bridge
+    internal: true
+  fromchat_external:
+    driver: bridge

deployment/frontend/Dockerfile

@@ -3,11 +3,13 @@ FROM node:24 AS frontend
 
 # 1.1. Install npm dependencies
 WORKDIR /app
+# Copy package.json and workspace package directory first (needed for workspace resolution)
 COPY package.json .
+COPY frontend/packages/ frontend/packages/
 RUN --mount=type=cache,target=/root/.npm \
     npm install --ignore-scripts
 
-# 1.2. Build
+# 1.2. Copy remaining frontend code and build
 COPY frontend frontend
 RUN npm run frontend:build
 

deployment/frontend/server.ts

@@ -1,28 +1,44 @@
 import express from 'express';
+import type { Request, Response } from 'express';
 import { createProxyMiddleware } from 'http-proxy-middleware';
 import { resolve } from 'path';
 
 const app = express();
-const port = process.env.PORT || 3000;
+const port = Number(process.env.PORT) || 8301;
 const backendHost = process.env.BACKEND_HOST || "http://localhost:8300";
 const filePath = process.env.STATIC_FILE_PATH || ".";
 
-// API proxy middleware
-app.use('/api', createProxyMiddleware({
-    target: backendHost,
+// Direct WebSocket proxy for chat - bypass gateway (must come before general API proxy)
+app.use('/api/chat/ws', createProxyMiddleware({
+    target: 'http://messaging_service:8305',
     changeOrigin: true,
-    pathRewrite: { '^/api': '' },
+    pathRewrite: { '^/api/chat/ws': '/messaging/chat/ws' },
     ws: true
 }));
 
+// API proxy middleware (exclude WebSocket paths)
+app.use('/api', (req, res, next) => {
+    // Skip WebSocket upgrade requests - let them be handled by specific proxies
+    if (req.headers.upgrade === 'websocket') {
+        return next();
+    }
+    createProxyMiddleware({
+        target: backendHost,
+        changeOrigin: true,
+        pathRewrite: { '^/api': '' },
+        ws: true
+    })(req, res, next);
+});
+
 // Serve static files
 app.use(express.static(resolve(filePath)));
 
 // SPA routing - catch all handler for client-side routing
-app.use((_req, res) => {
+app.use((_req: Request, res: Response) => {
     res.sendFile(resolve(filePath, 'index.html'));
 });
 
-app.listen(port, () => {
-    console.log(`Server launched on http://localhost:${port}`);
+app.listen(port, '0.0.0.0', () => {
+    console.log(`Backend host: ${backendHost}`);
+    console.log(`Server launched on http://0.0.0.0:${port}`);
 });

docker/Dockerfile.multi

@@ -0,0 +1,123 @@
+# Multi-stage Dockerfile for all FromChat microservices
+# This combines the base image and all services in one file
+
+# Base stage - common setup for all services
+FROM python:3.11-slim AS base
+
+# Install system dependencies
+RUN apt-get update && apt-get install -y \
+    libpq5 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create non-root user
+RUN useradd --create-home --shell /bin/bash fromchat
+
+# Set working directory
+WORKDIR /app
+
+# Create logs and data directories with proper permissions
+RUN mkdir -p /app/backend/logs /app/backend/data /app/backend/data/profanity /app/backend/data/uploads /app/backend/data/uploads/pfp && \
+    chown -R fromchat:fromchat /app/backend/logs /app/backend/data && \
+    chmod -R 755 /app/backend/logs /app/backend/data
+
+# Copy requirements first for better caching
+COPY backend/requirements.txt /app/requirements.txt
+
+# Install Python dependencies with cache mounts
+RUN --mount=type=cache,target=/home/fromchat/.cache/pip \
+    pip install --no-cache-dir -r requirements.txt
+
+# Copy shared modules
+COPY backend/shared /app/backend/shared/
+
+# Copy entrypoint script
+COPY docker/entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
+
+# Switch to non-root user
+USER fromchat
+
+# Set entrypoint
+ENTRYPOINT ["/app/entrypoint.sh"]
+
+# Account service - minimal files only
+FROM base AS account_service
+COPY backend/routes/account.py /app/backend/routes/account.py
+COPY backend/security /app/backend/security/
+COPY backend/logging_config.py /app/backend/logging_config.py
+COPY backend/services/account/main.py /app/backend/services/account/main.py
+ENV SERVICE_NAME=account
+
+# Profile service - minimal files only
+FROM base AS profile_service
+COPY backend/routes/profile.py /app/backend/routes/profile.py
+COPY backend/routes/messaging.py /app/backend/routes/messaging.py
+COPY backend/services/push/files/push_service.py /app/backend/services/push/files/push_service.py
+COPY backend/security /app/backend/security/
+COPY backend/logging_config.py /app/backend/logging_config.py
+COPY backend/services/messaging/files/websocket /app/backend/services/messaging/files/websocket/
+COPY backend/shared/similarity.py /app/backend/shared/similarity.py
+COPY backend/services/profile/main.py /app/backend/services/profile/main.py
+ENV SERVICE_NAME=profile
+
+# Device service - minimal files only
+FROM base AS device_service
+COPY backend/routes/devices.py /app/backend/routes/devices.py
+COPY backend/services/device/main.py /app/backend/services/device/main.py
+ENV SERVICE_NAME=device
+
+# Messaging service - minimal files only
+FROM base AS messaging_service
+COPY backend/routes/messaging.py /app/backend/routes/messaging.py
+COPY backend/services/push/files/push_service.py /app/backend/services/push/files/push_service.py
+COPY backend/security /app/backend/security/
+COPY backend/logging_config.py /app/backend/logging_config.py
+COPY backend/services/messaging/files/websocket /app/backend/services/messaging/files/websocket/
+COPY backend/services/messaging/main.py /app/backend/services/messaging/main.py
+ENV SERVICE_NAME=messaging
+
+# Push service - minimal files only
+FROM base AS push_service
+COPY backend/routes/push.py /app/backend/routes/push.py
+COPY backend/services/push/files/push_service.py /app/backend/services/push/files/push_service.py
+COPY backend/services/push/main.py /app/backend/services/push/main.py
+ENV SERVICE_NAME=push
+
+# WebRTC service - minimal files only
+FROM base AS webrtc_service
+COPY backend/routes/webrtc.py /app/backend/routes/webrtc.py
+COPY backend/services/webrtc/main.py /app/backend/services/webrtc/main.py
+ENV SERVICE_NAME=webrtc
+
+# Moderation service - minimal files only
+FROM base AS moderation_service
+COPY backend/routes/moderation.py /app/backend/routes/moderation.py
+COPY backend/security /app/backend/security/
+COPY backend/shared/similarity.py /app/backend/shared/similarity.py
+COPY backend/logging_config.py /app/backend/logging_config.py
+COPY backend/services/moderation/main.py /app/backend/services/moderation/main.py
+ENV SERVICE_NAME=moderation
+
+# Gateway service - minimal files only
+FROM base AS gateway
+COPY backend/app.py /app/backend/app.py
+COPY backend/main.py /app/backend/main.py
+COPY backend/dependencies.py /app/backend/dependencies.py
+COPY backend/logging_config.py /app/backend/logging_config.py
+COPY backend/security /app/backend/security/
+COPY backend/services/gateway/main.py /app/backend/services/gateway/main.py
+ENV SERVICE_NAME=gateway
+
+# Migration runner - needs alembic config and migration files
+FROM base AS migration_runner
+# Temporarily switch back to root to manage file permissions
+USER root
+COPY backend/alembic.ini /app/backend/alembic.ini
+COPY backend/alembic /app/backend/alembic/
+COPY backend/migration.py /app/backend/migration.py
+COPY backend/services/migration_runner/main.py /app/backend/services/migration_runner/main.py
+# Clean up problematic migrations as root
+RUN find /app/backend/alembic/versions -name "*auto_generated_migration_for_schema_*" | xargs rm -f || true
+# Switch back to fromchat user
+USER fromchat
+ENV SERVICE_NAME=migration_runner

docker/entrypoint.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# Entrypoint script for FromChat microservices
+
+# Run the service module
+exec python -m backend.services.${SERVICE_NAME}.main

frontend/packages/fromchat-protocol/.gitignore

@@ -0,0 +1,7 @@
+node_modules/
+dist/
+*.log
+.DS_Store
+package-lock.json
+
+

frontend/packages/fromchat-protocol/.npmignore

@@ -0,0 +1,8 @@
+src/
+tsconfig.json
+node_modules/
+package-lock.json
+*.log
+.DS_Store
+
+

frontend/packages/fromchat-protocol/PUBLISHING.md

@@ -0,0 +1,171 @@
+# Publishing FromChat Protocol
+
+This guide explains how to publish the `@fromchat/protocol` package to npm or GitHub Packages.
+
+## Prerequisites
+
+1. **npm account**: Create one at [npmjs.com](https://www.npmjs.com/signup)
+2. **GitHub account**: For GitHub Packages
+3. **Node.js**: Version 18 or higher
+
+## Publishing to npm
+
+### Important: Scoped Package Setup
+
+The package uses the `@fromchat` scope. You have two options:
+
+**Option A: Create an npm organization (Recommended)**
+1. Go to [npmjs.com/org/create](https://www.npmjs.com/org/create)
+2. Create an organization named `fromchat`
+3. Add yourself as a member
+4. Then proceed with publishing below
+
+**Option B: Use unscoped package name**
+If you prefer not to create an organization, change the package name in `package.json`:
+```json
+{
+  "name": "fromchat-protocol"  // Remove the @fromchat/ scope
+}
+```
+Then update all imports in your codebase from `@fromchat/protocol` to `fromchat-protocol`.
+
+### 1. Build the package
+
+```bash
+cd frontend/packages/fromchat-protocol
+npm run build
+```
+
+This compiles TypeScript to JavaScript in the `dist/` directory.
+
+### 2. Login to npm
+
+```bash
+npm login
+```
+
+Enter your npm username, password, and email.
+
+### 3. Publish
+
+**If using scoped package (`@fromchat/protocol`):**
+```bash
+npm publish --access public
+```
+
+**If using unscoped package (`fromchat-protocol`):**
+```bash
+npm publish
+```
+
+The `--access public` flag is required for scoped packages (packages starting with `@`).
+
+### 4. Verify
+
+Check your package at: `https://www.npmjs.com/package/@fromchat/protocol`
+
+### 5. Update version for future releases
+
+```bash
+# Patch version (1.0.0 -> 1.0.1)
+npm version patch
+
+# Minor version (1.0.0 -> 1.1.0)
+npm version minor
+
+# Major version (1.0.0 -> 2.0.0)
+npm version major
+
+# Then publish
+npm publish --access public
+```
+
+## Publishing to GitHub Packages
+
+### 1. Create a GitHub Personal Access Token
+
+1. Go to GitHub Settings → Developer settings → Personal access tokens → Tokens (classic)
+2. Generate a new token with `write:packages` and `read:packages` permissions
+3. Save the token securely
+
+### 2. Configure npm to use GitHub Packages
+
+Create or edit `~/.npmrc`:
+
+```
+@fromchat:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=YOUR_GITHUB_TOKEN
+```
+
+Or add to `package.json`:
+
+```json
+{
+  "publishConfig": {
+    "registry": "https://npm.pkg.github.com"
+  }
+}
+```
+
+### 3. Update package.json
+
+Update the repository URL to match your GitHub repository:
+
+```json
+{
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/YOUR_USERNAME/YOUR_REPO.git",
+    "directory": "frontend/packages/fromchat-protocol"
+  }
+}
+```
+
+### 4. Build and publish
+
+```bash
+cd frontend/packages/fromchat-protocol
+npm run build
+npm publish
+```
+
+### 5. Install from GitHub Packages
+
+Users can install your package with:
+
+```bash
+npm install @fromchat/protocol@npm:@fromchat/protocol
+```
+
+Or add to `.npmrc`:
+
+```
+@fromchat:registry=https://npm.pkg.github.com
+```
+
+## Using the Published Package
+
+### From npm
+
+```bash
+npm install @fromchat/protocol
+```
+
+```typescript
+import { FromChatProtocol } from "@fromchat/protocol";
+```
+
+### From GitHub Packages
+
+```bash
+npm install @fromchat/protocol@npm:@fromchat/protocol
+```
+
+## Notes
+
+- The package is built to `dist/` directory
+- Source files in `src/` are excluded from the published package
+- Only `dist/` and `README.md` are included in the published package
+- The package uses ES modules (ESM) format
+- TypeScript definitions are included in `dist/`
+

frontend/packages/fromchat-protocol/README.md

@@ -0,0 +1,99 @@
+# FromChat Protocol
+
+Simple ECDH-based encryption protocol for direct messages.
+
+## Overview
+
+The FromChat Protocol provides end-to-end encryption for direct messages using:
+- **X25519** (ECDH) for key exchange
+- **HKDF** for key derivation
+- **AES-GCM** for symmetric encryption
+
+This module is completely independent and can be used in any JavaScript/TypeScript project.
+
+## Protocol Flow
+
+### Encryption
+
+1. Generate a random message key (mk) - 32 bytes
+2. Generate a random salt (wkSalt) - 16 bytes
+3. Derive shared secret from ECDH: `ecdhSharedSecret(myPrivateKey, theirPublicKey)`
+4. Derive wrapping key: `deriveWrappingKey(sharedSecret, wkSalt, info)` using HKDF
+5. Encrypt message with mk using AES-GCM → (iv, ciphertext)
+6. Encrypt (wrap) mk with wrapping key using AES-GCM → (iv2, wrappedMk)
+7. Send: `{ iv, ciphertext, salt, iv2, wrappedMk }`
+
+### Decryption
+
+1. Derive shared secret from ECDH
+2. Derive wrapping key from shared secret using salt from message
+3. Decrypt wrappedMk to get mk
+4. Decrypt ciphertext with mk
+
+## Usage
+
+```typescript
+import { FromChatProtocol } from "@fromchat/protocol";
+
+// Initialize with your private key
+const protocol = new FromChatProtocol(privateKey);
+
+// Encrypt a message
+const encrypted = await protocol.encryptMessage(recipientPublicKey, "Hello!");
+
+// Decrypt a message
+const decrypted = await protocol.decryptMessage(senderPublicKey, encrypted);
+```
+
+## API
+
+### `FromChatProtocol`
+
+#### Constructor
+- `constructor(privateKey: Uint8Array)` - Initialize protocol with your X25519 private key
+
+#### Methods
+- `encryptMessage(recipientPublicKey: Uint8Array, plaintext: string): Promise<EncryptedMessage>` - Encrypt a message
+- `decryptMessage(senderPublicKey: Uint8Array, message: EncryptedMessage): Promise<string>` - Decrypt a message
+
+### Types
+
+```typescript
+interface EncryptedMessage {
+  iv: string;        // Base64 encoded IV for message encryption
+  ciphertext: string; // Base64 encoded encrypted message
+  salt: string;      // Base64 encoded salt for wrapping key derivation
+  iv2: string;       // Base64 encoded IV for message key wrapping
+  wrappedMk: string; // Base64 encoded wrapped message key
+}
+```
+
+## Backup & Key Management
+
+The protocol also includes utilities for backing up and restoring private keys:
+
+```typescript
+import { 
+  encryptBackupWithPassword, 
+  decryptBackupWithPassword,
+  encodeBlob,
+  decodeBlob 
+} from "@fromchat/protocol";
+
+// Create a backup of a private key
+const bundle = { version: 1, privateKey: myPrivateKey };
+const encrypted = await encryptBackupWithPassword("my-password", bundle);
+const backupString = encodeBlob(encrypted); // Store this string
+
+// Restore from backup
+const encryptedBlob = decodeBlob(backupString);
+const restored = await decryptBackupWithPassword("my-password", encryptedBlob);
+```
+
+## Security Notes
+
+- Each message uses a fresh random message key
+- The protocol does not provide forward secrecy
+- Keys are derived using HKDF with SHA-256
+- All encryption uses AES-GCM with 12-byte IVs
+- Backup encryption uses PBKDF2 with 210,000 iterations

frontend/packages/fromchat-protocol/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@fromchat/protocol",
+  "version": "1.0.0",
+  "description": "FromChat Protocol - Simple ECDH-based encryption for direct messages. Independent and reusable encryption module.",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "require": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "encryption",
+    "ecdh",
+    "e2ee",
+    "end-to-end-encryption",
+    "x25519",
+    "aes-gcm",
+    "hkdf"
+  ],
+  "author": "denis0001-dev",
+  "license": "GPL-3.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Toolbox-io/FromChat.git",
+    "directory": "frontend/packages/fromchat-protocol"
+  },
+  "bugs": {
+    "url": "https://github.com/Toolbox-io/FromChat/issues"
+  },
+  "homepage": "https://github.com/Toolbox-io/FromChat#readme",
+  "dependencies": {
+    "tweetnacl": "^1.0.3"
+  },
+  "devDependencies": {
+    "@types/node": "^25.0.2",
+    "typescript": "^5.0.0"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=24.0.0"
+  }
+}

frontend/packages/fromchat-protocol/src/backup/backup.ts

@@ -1,5 +1,4 @@
-import { aesGcmDecrypt, aesGcmEncrypt } from "./symmetric";
-import { importPassword, deriveKEK, randomBytes } from "./kdf";
+import { aesGcmDecrypt, aesGcmEncrypt, importPassword, deriveKEK, randomBytes } from "../crypto/index";
 
 export interface PrivateKeyBundle {
 	version: 1;
@@ -65,4 +64,3 @@ export function decodeBlob(json: string): EncryptedBackupBlob {
 	return { salt: ub64(obj.salt), iv: ub64(obj.iv), ciphertext: ub64(obj.ciphertext) };
 }
 
-

frontend/packages/fromchat-protocol/src/crypto/asymmetric.ts

@@ -6,18 +6,16 @@ export interface X25519KeyPair {
 	privateKey: Uint8Array;
 }
 
-export type KeyPair = X25519KeyPair;
-
 export function generateX25519KeyPair(): X25519KeyPair {
 	const kp = nacl.box.keyPair();
 	return { publicKey: kp.publicKey, privateKey: kp.secretKey };
 }
 
 export function ecdhSharedSecret(myPrivateKey: Uint8Array, theirPublicKey: Uint8Array): Uint8Array {
-	// nacl.box.before returns shared key (Curve25519, XSalsa20-Poly1305 context). We use it as IKM into HKDF.
 	return nacl.box.before(theirPublicKey, myPrivateKey);
 }
 
 export async function deriveWrappingKey(sharedSecret: Uint8Array, salt: Uint8Array, info: Uint8Array): Promise<Uint8Array> {
 	return hkdfExtractAndExpand(sharedSecret.buffer as ArrayBuffer, salt, info, 32);
-}
+}
+

frontend/packages/fromchat-protocol/src/crypto/index.ts

@@ -0,0 +1,7 @@
+// Re-export all crypto functions for convenience
+export { generateX25519KeyPair, ecdhSharedSecret, deriveWrappingKey } from "./asymmetric";
+export type { X25519KeyPair } from "./asymmetric";
+export { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "./symmetric";
+export type { AesGcmCiphertext } from "./symmetric";
+export { hkdfExtractAndExpand, randomBytes, importPassword, deriveKEK } from "./kdf";
+

frontend/packages/fromchat-protocol/src/crypto/kdf.ts

@@ -1,3 +1,19 @@
+export async function hkdfExtractAndExpand(inputKeyMaterial: Uint8Array | ArrayBuffer, salt: Uint8Array | ArrayBuffer, info: Uint8Array | ArrayBuffer, length = 32): Promise<Uint8Array> {
+	const inputBuffer = inputKeyMaterial instanceof Uint8Array ? inputKeyMaterial.buffer as ArrayBuffer : inputKeyMaterial;
+	const saltBuffer = salt instanceof Uint8Array ? salt.buffer as ArrayBuffer : salt;
+	const infoBuffer = info instanceof Uint8Array ? info.buffer as ArrayBuffer : info;
+
+	const ikmKey = await crypto.subtle.importKey("raw", inputBuffer, { name: "HKDF" }, false, ["deriveBits"]);
+	const bits = await crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: saltBuffer, info: infoBuffer }, ikmKey, length * 8);
+	return new Uint8Array(bits);
+}
+
+export function randomBytes(length: number): Uint8Array {
+	const out = new Uint8Array(length);
+	crypto.getRandomValues(out);
+	return out;
+}
+
 export async function importPassword(password: string): Promise<CryptoKey> {
 	const enc = new TextEncoder();
 	return crypto.subtle.importKey("raw", enc.encode(password), "PBKDF2", false, ["deriveKey", "deriveBits"]);
@@ -13,19 +29,3 @@ export async function deriveKEK(passwordKey: CryptoKey, salt: Uint8Array | Array
 		["encrypt", "decrypt"]
 	);
 }
-
-export async function hkdfExtractAndExpand(inputKeyMaterial: Uint8Array | ArrayBuffer, salt: Uint8Array | ArrayBuffer, info: Uint8Array | ArrayBuffer, length = 32): Promise<Uint8Array> {
-	const inputBuffer = inputKeyMaterial instanceof Uint8Array ? inputKeyMaterial.buffer as ArrayBuffer : inputKeyMaterial;
-	const saltBuffer = salt instanceof Uint8Array ? salt.buffer as ArrayBuffer : salt;
-	const infoBuffer = info instanceof Uint8Array ? info.buffer as ArrayBuffer : info;
-
-	const ikmKey = await crypto.subtle.importKey("raw", inputBuffer, { name: "HKDF" }, false, ["deriveBits"]);
-	const bits = await crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: saltBuffer, info: infoBuffer }, ikmKey, length * 8);
-	return new Uint8Array(bits);
-}
-
-export function randomBytes(length: number): Uint8Array {
-	const out = new Uint8Array(length);
-	crypto.getRandomValues(out);
-	return out;
-}

frontend/packages/fromchat-protocol/src/crypto/symmetric.ts

@@ -11,12 +11,10 @@ export async function aesGcmEncrypt(key: CryptoKey, plaintext: Uint8Array | Arra
 }
 
 export async function aesGcmDecrypt(key: CryptoKey, iv: Uint8Array | ArrayBuffer, ciphertext: Uint8Array | ArrayBuffer): Promise<Uint8Array> {
-	// Normalize IV to ArrayBuffer (12 bytes for AES-GCM)
 	const ivBuf: ArrayBuffer = iv instanceof Uint8Array
 		? (iv.buffer as ArrayBuffer).slice(iv.byteOffset, iv.byteOffset + iv.byteLength)
 		: (iv as ArrayBuffer);
 
-	// Normalize ciphertext to a contiguous ArrayBuffer slice
 	const ctBuf: ArrayBuffer = ciphertext instanceof Uint8Array
 		? (ciphertext.buffer as ArrayBuffer).slice(ciphertext.byteOffset, ciphertext.byteOffset + ciphertext.byteLength)
 		: (ciphertext as ArrayBuffer);
@@ -26,9 +24,8 @@ export async function aesGcmDecrypt(key: CryptoKey, iv: Uint8Array | ArrayBuffer
 }
 
 export async function importAesGcmKey(rawKey: Uint8Array | ArrayBuffer): Promise<CryptoKey> {
-	// Normalize to a contiguous ArrayBuffer slice to avoid offset/length issues
 	const keyBuffer = rawKey instanceof Uint8Array
 		? (rawKey.buffer as ArrayBuffer).slice(rawKey.byteOffset, rawKey.byteOffset + rawKey.byteLength)
 		: (rawKey as ArrayBuffer);
 	return crypto.subtle.importKey("raw", keyBuffer, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
-}
+}

frontend/packages/fromchat-protocol/src/index.ts

@@ -0,0 +1,20 @@
+export { FromChatProtocol } from "./protocol/FromChatProtocol";
+export type { EncryptedMessage } from "./protocol/types";
+
+// Export crypto functions
+export { generateX25519KeyPair, ecdhSharedSecret, deriveWrappingKey } from "./crypto/asymmetric";
+export type { X25519KeyPair } from "./crypto/asymmetric";
+export { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "./crypto/symmetric";
+export type { AesGcmCiphertext } from "./crypto/symmetric";
+export { hkdfExtractAndExpand, randomBytes, importPassword, deriveKEK } from "./crypto/kdf";
+
+// Export backup functions
+export {
+	encryptBackupWithPassword,
+	decryptBackupWithPassword,
+	encodeBlob,
+	decodeBlob,
+	serializeBundle,
+	deserializeBundle
+} from "./backup/backup";
+export type { PrivateKeyBundle, EncryptedBackupBlob } from "./backup/backup";

frontend/packages/fromchat-protocol/src/protocol/FromChatProtocol.ts

@@ -0,0 +1,102 @@
+import { ecdhSharedSecret, deriveWrappingKey } from "../crypto/asymmetric";
+import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "../crypto/symmetric";
+import { randomBytes } from "../crypto/kdf";
+import type { EncryptedMessage } from "./types";
+
+/**
+ * FromChat Protocol - Simple ECDH-based encryption
+ * 
+ * Protocol:
+ * 1. Generate random message key (mk) - 32 bytes
+ * 2. Generate random salt (wkSalt) - 16 bytes
+ * 3. Derive shared secret from ECDH (X25519)
+ * 4. Derive wrapping key from shared secret using HKDF with salt
+ * 5. Encrypt message with mk using AES-GCM
+ * 6. Encrypt (wrap) mk with wrapping key using AES-GCM
+ * 7. Send: { iv, ciphertext, salt, iv2, wrappedMk }
+ */
+export class FromChatProtocol {
+	private privateKey: Uint8Array;
+
+	constructor(privateKey: Uint8Array) {
+		this.privateKey = privateKey;
+	}
+
+	/**
+	 * Encrypt a message for a recipient
+	 * @param recipientPublicKey - Recipient's X25519 public key
+	 * @param plaintext - Message to encrypt
+	 * @returns Encrypted message with all necessary fields
+	 */
+	async encryptMessage(recipientPublicKey: Uint8Array, plaintext: string): Promise<EncryptedMessage> {
+		// Generate random message key
+		const mk = randomBytes(32);
+		
+		// Generate random salt for wrapping key derivation
+		const wkSalt = randomBytes(16);
+		
+		// Derive shared secret from ECDH
+		const shared = ecdhSharedSecret(this.privateKey, recipientPublicKey);
+		
+		// Derive wrapping key from shared secret using HKDF
+		const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
+		const wk = await importAesGcmKey(wkRaw);
+		
+		// Encrypt the message with message key
+		const plaintextBytes = new TextEncoder().encode(plaintext);
+		const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), plaintextBytes);
+		
+		// Encrypt (wrap) the message key with wrapping key
+		const wrap = await aesGcmEncrypt(wk, mk);
+		
+		// Convert to base64 for transmission
+		return {
+			iv: btoa(String.fromCharCode(...encMsg.iv)),
+			ciphertext: btoa(String.fromCharCode(...encMsg.ciphertext)),
+			salt: btoa(String.fromCharCode(...wkSalt)),
+			iv2: btoa(String.fromCharCode(...wrap.iv)),
+			wrappedMk: btoa(String.fromCharCode(...wrap.ciphertext))
+		};
+	}
+
+	/**
+	 * Decrypt a message from a sender
+	 * @param senderPublicKey - Sender's X25519 public key
+	 * @param message - Encrypted message
+	 * @returns Decrypted plaintext
+	 */
+	async decryptMessage(senderPublicKey: Uint8Array, message: EncryptedMessage): Promise<string> {
+		// Decode base64 fields
+		const salt = new Uint8Array(
+			atob(message.salt).split("").map(c => c.charCodeAt(0))
+		);
+		const iv2 = new Uint8Array(
+			atob(message.iv2).split("").map(c => c.charCodeAt(0))
+		);
+		const wrappedMk = new Uint8Array(
+			atob(message.wrappedMk).split("").map(c => c.charCodeAt(0))
+		);
+		const iv = new Uint8Array(
+			atob(message.iv).split("").map(c => c.charCodeAt(0))
+		);
+		const ciphertext = new Uint8Array(
+			atob(message.ciphertext).split("").map(c => c.charCodeAt(0))
+		);
+		
+		// Derive shared secret from ECDH
+		const shared = ecdhSharedSecret(this.privateKey, senderPublicKey);
+		
+		// Derive wrapping key from shared secret using salt from message
+		const wkRaw = await deriveWrappingKey(shared, salt, new Uint8Array([1]));
+		const wk = await importAesGcmKey(wkRaw);
+		
+		// Decrypt (unwrap) the message key
+		const mk = await aesGcmDecrypt(wk, iv2, wrappedMk);
+		
+		// Decrypt the message with message key
+		const decrypted = await aesGcmDecrypt(await importAesGcmKey(mk), iv, ciphertext);
+		
+		return new TextDecoder().decode(decrypted);
+	}
+}
+

frontend/packages/fromchat-protocol/src/protocol/types.ts

@@ -0,0 +1,10 @@
+/**
+ * Encrypted message format
+ */
+export interface EncryptedMessage {
+	iv: string; // Base64 encoded IV for message encryption
+	ciphertext: string; // Base64 encoded encrypted message
+	salt: string; // Base64 encoded salt for wrapping key derivation
+	iv2: string; // Base64 encoded IV for message key wrapping
+	wrappedMk: string; // Base64 encoded wrapped message key
+}

frontend/packages/fromchat-protocol/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "ESNext",
+    "lib": ["ES2020", "DOM"],
+    "declaration": true,
+    "declarationMap": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "sourceMap": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

frontend/src/core/api/account/index.ts

@@ -1,9 +1,7 @@
 import { API_BASE_URL } from "@/core/config";
 import type { LoginRequest, RegisterRequest, LoginResponse } from "@/core/types";
-import { generateX25519KeyPair } from "@/utils/crypto/asymmetric";
-import { encodeBlob, encryptBackupWithPassword, decryptBackupWithPassword, decodeBlob } from "@/utils/crypto/backup";
+import { generateX25519KeyPair, hkdfExtractAndExpand, encodeBlob, encryptBackupWithPassword, decryptBackupWithPassword, decodeBlob } from "@fromchat/protocol";
 import { b64, ub64 } from "@/utils/utils";
-import { hkdfExtractAndExpand } from "@/utils/crypto/kdf";
 import { fetchPublicKey, uploadPublicKey, fetchBackupBlob, uploadBackupBlob } from "../crypto";
 import type { Headers } from "@/core/types";
 

frontend/src/core/api/chats/dm.ts

@@ -1,28 +1,19 @@
 import { API_BASE_URL } from "@/core/config";
 import { getAuthHeaders } from "../user/auth";
-import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
-import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "@/utils/crypto/symmetric";
-import { randomBytes } from "@/utils/crypto/kdf";
 import { getCurrentKeys } from "../user/auth";
 import { request } from "@/core/websocket";
-import type { SendDMRequest, DmEnvelope, DMEditRequest, DmEncryptedJSON, BaseDmEnvelope, User } from "@/core/types";
+import type { SendDMRequest, DmEnvelope, DMEditRequest, BaseDmEnvelope, User } from "@/core/types";
 import { b64, ub64 } from "@/utils/utils";
 import { fetchUserPublicKey } from "../crypto/identity";
 import { fetchUsers, searchUsers } from "../user/search";
+import { getOrInitProtocol } from "@/utils/crypto/fromchatInit";
+import { ecdhSharedSecret, deriveWrappingKey, importAesGcmKey, aesGcmEncrypt, randomBytes } from "@fromchat/protocol";
 
 export async function decrypt(envelope: DmEnvelope, senderPublicKeyB64: string): Promise<string> {
-    const keys = getCurrentKeys();
-    if (!keys) throw new Error("Keys not initialized");
-
-    // Obtain the key
-    const shared = ecdhSharedSecret(keys.privateKey, ub64(senderPublicKeyB64));
-    const wkRaw = await deriveWrappingKey(shared, ub64(envelope.salt), new Uint8Array([1]));
-    const wk = await importAesGcmKey(wkRaw);
-    const mk = await aesGcmDecrypt(wk, ub64(envelope.iv2), ub64(envelope.wrappedMk));
-
-    // Decrypt
-    const msg = await aesGcmDecrypt(await importAesGcmKey(mk), ub64(envelope.iv), ub64(envelope.ciphertext));
-    return new TextDecoder().decode(msg);
+    const protocol = getOrInitProtocol();
+    const senderPublicKey = ub64(senderPublicKeyB64);
+    
+    return await protocol.decryptMessage(senderPublicKey, envelope);
 }
 
 export async function fetchMessages(userId: number, token: string, limit: number = 50, beforeId?: number): Promise<{ messages: DmEnvelope[]; has_more: boolean }> {
@@ -39,27 +30,14 @@ export async function fetchMessages(userId: number, token: string, limit: number
 }
 
 export async function send(recipientId: number, recipientPublicKeyB64: string, plaintext: string, authToken: string, replyToId?: number): Promise<void> {
-    const keys = getCurrentKeys();
-    if (!keys) throw new Error("Keys not initialized");
-
-    // Encryption key
-    const mk = randomBytes(32);
-    const wkSalt = randomBytes(16);
-    const shared = ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
-    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
-    const wk = await importAesGcmKey(wkRaw);
-
-    // Encrypt the message
-    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(plaintext));
-    const wrap = await aesGcmEncrypt(wk, mk);
-
+    const protocol = getOrInitProtocol();
+    const recipientPublicKey = ub64(recipientPublicKeyB64);
+    
+    const encrypted = await protocol.encryptMessage(recipientPublicKey, plaintext);
+    
     const payload: SendDMRequest = {
         recipientId: recipientId,
-        iv: b64(encMsg.iv),
-        ciphertext: b64(encMsg.ciphertext),
-        salt: b64(wkSalt),
-        iv2: b64(wrap.iv),
-        wrappedMk: b64(wrap.ciphertext)
+        ...encrypted
     };
     if (replyToId) payload.replyToId = replyToId;
 
@@ -74,15 +52,16 @@ export async function send(recipientId: number, recipientPublicKeyB64: string, p
 }
 
 export async function sendWithFiles(recipientId: number, recipientPublicKeyB64: string, plaintextJson: string, files: File[], token: string): Promise<void> {
+    // For files, we need to use the same message key for both the message and files
+    // So we'll do the encryption manually here to reuse the mk
     const keys = getCurrentKeys();
     if (!keys) throw new Error("Keys not initialized");
 
     const mk = randomBytes(32);
     const wkSalt = randomBytes(16);
-    const shared = await ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
+    const shared = ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
     const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
     const wk = await importAesGcmKey(wkRaw);
-
     const wrap = await aesGcmEncrypt(wk, mk);
 
     const form = new FormData();
@@ -96,21 +75,14 @@ export async function sendWithFiles(recipientId: number, recipientPublicKeyB64:
         const data = new Uint8Array(await f.arrayBuffer());
         const enc = await aesGcmEncrypt(await importAesGcmKey(mk), data);
         const blob = new Blob([sliceBuffer(enc.iv), sliceBuffer(enc.ciphertext)], { type: "application/octet-stream" });
-        const serverName = f.name; // server uses provided name
+        const serverName = f.name;
         names.push(serverName);
         form.append("files", new File([blob], serverName));
     }
     form.append("fileNames", JSON.stringify(names));
 
-    // Merge files metadata into plaintext JSON and encrypt
-    let obj: DmEncryptedJSON;
-    try {
-        obj = JSON.parse(plaintextJson);
-    } catch {
-        obj = { type: "text", data: { content: String(plaintextJson) } };
-    }
-
-    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(JSON.stringify(obj)));
+    // Encrypt the plaintext JSON with the same mk
+    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(plaintextJson));
     form.append("dm_payload", JSON.stringify({
         recipientId: recipientId,
         iv: b64(encMsg.iv),
@@ -128,28 +100,17 @@ export async function sendWithFiles(recipientId: number, recipientPublicKeyB64:
 }
 
 export async function edit(id: number, recipientPublicKeyB64: string, newPlaintextJson: string, authToken: string): Promise<void> {
-    const keys = getCurrentKeys();
-    if (!keys) throw new Error("Keys not initialized");
-
-    // We cannot reuse the old mk safely without knowing it; generate a fresh mk and wrap
-    const mk = randomBytes(32);
-    const wkSalt = randomBytes(16);
-    const shared = await ecdhSharedSecret(keys.privateKey, ub64(recipientPublicKeyB64));
-    const wkRaw = await deriveWrappingKey(shared, wkSalt, new Uint8Array([1]));
-    const wk = await importAesGcmKey(wkRaw);
-    const encMsg = await aesGcmEncrypt(await importAesGcmKey(mk), new TextEncoder().encode(newPlaintextJson));
-    const wrap = await aesGcmEncrypt(wk, mk);
+    const protocol = getOrInitProtocol();
+    const recipientPublicKey = ub64(recipientPublicKeyB64);
+    
+    const encrypted = await protocol.encryptMessage(recipientPublicKey, newPlaintextJson);
 
     await request({
         type: "dmEdit",
         credentials: { scheme: "Bearer", credentials: authToken },
         data: {
             id,
-            iv: b64(encMsg.iv),
-            ciphertext: b64(encMsg.ciphertext),
-            iv2: b64(wrap.iv),
-            wrappedMk: b64(wrap.ciphertext),
-            salt: b64(wkSalt)
+            ...encrypted
         }
     } as DMEditRequest);
 }
@@ -189,6 +150,4 @@ export async function markRead(id: number, authToken: string): Promise<void> {
 }
 
 // Re-export user functions for convenience
-export { fetchUsers, searchUsers, fetchUserPublicKey };
-
-
+export { fetchUsers, searchUsers, fetchUserPublicKey };

frontend/src/core/api/crypto/backup.ts

@@ -1,12 +1,12 @@
 import { API_BASE_URL } from "@/core/config";
-import { getAuthHeaders } from "../user/auth";
 import type { BackupBlob } from "@/core/types";
+import api from "@/core/api";
 
 /**
  * Fetches the current user's backup blob
  */
 export async function fetchBackupBlob(token: string): Promise<string | null> {
-    const headers = getAuthHeaders(token, true);
+    const headers = api.user.auth.getAuthHeaders(token, true);
     const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
         method: "GET",
         headers
@@ -25,7 +25,7 @@ export async function fetchBackupBlob(token: string): Promise<string | null> {
 export async function uploadBackupBlob(blobJson: string, token: string): Promise<void> {
     const payload: BackupBlob = { blob: blobJson }
 
-    const headers = getAuthHeaders(token, true);
+    const headers = api.user.auth.getAuthHeaders(token, true);
     const res = await fetch(`${API_BASE_URL}/crypto/backup`, {
         method: "POST",
         headers,

frontend/src/core/api/dm.ts

@@ -1,8 +1,6 @@
 import { API_BASE_URL } from "@/core/config";
 import { getAuthHeaders } from "./account";
-import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
-import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "@/utils/crypto/symmetric";
-import { randomBytes } from "@/utils/crypto/kdf";
+import { ecdhSharedSecret, deriveWrappingKey, importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, randomBytes } from "@fromchat/protocol";
 import { getCurrentKeys } from "./account";
 import { request } from "@/core/websocket";
 import type { SendDMRequest, DmEnvelope, DMEditRequest, DmEncryptedJSON, BaseDmEnvelope, User } from "@/core/types";

frontend/src/core/api/dmApi.ts

@@ -1,8 +1,6 @@
 import { API_BASE_URL } from "@/core/config";
 import { getAuthHeaders } from "./account";
-import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
-import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "@/utils/crypto/symmetric";
-import { randomBytes } from "@/utils/crypto/kdf";
+import { ecdhSharedSecret, deriveWrappingKey, importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, randomBytes } from "@fromchat/protocol";
 import { getCurrentKeys } from "./account";
 import { request } from "@/core/websocket";
 import type { SendDMRequest, DmEnvelope, DMEditRequest, DmEncryptedJSON, BaseDmEnvelope, User } from "@/core/types";

frontend/src/core/api/user/auth.ts

@@ -1,9 +1,7 @@
 import { API_BASE_URL } from "@/core/config";
 import type { LoginRequest, RegisterRequest, LoginResponse, Headers } from "@/core/types";
-import { generateX25519KeyPair } from "@/utils/crypto/asymmetric";
-import { encodeBlob, encryptBackupWithPassword, decryptBackupWithPassword, decodeBlob } from "@/utils/crypto/backup";
+import { generateX25519KeyPair, hkdfExtractAndExpand, encodeBlob, encryptBackupWithPassword, decryptBackupWithPassword, decodeBlob } from "@fromchat/protocol";
 import { b64, ub64 } from "@/utils/utils";
-import { hkdfExtractAndExpand } from "@/utils/crypto/kdf";
 import { fetchPublicKey, uploadPublicKey } from "../crypto/identity";
 import { fetchBackupBlob, uploadBackupBlob } from "../crypto/backup";
 

frontend/src/core/calls/encryption.ts

@@ -1,7 +1,5 @@
-import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt } from "@/utils/crypto/symmetric";
-import { randomBytes } from "@/utils/crypto/kdf";
+import { importAesGcmKey, aesGcmEncrypt, aesGcmDecrypt, randomBytes, ecdhSharedSecret, deriveWrappingKey } from "@fromchat/protocol";
 import { b64, ub64 } from "@/utils/utils";
-import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
 import api from "@/core/api";
 import type { WrappedSessionKeyPayload } from "@/core/types";
 

frontend/src/core/calls/webrtc.ts

@@ -2,7 +2,7 @@ import api from "@/core/api";
 import type { CallSignalingMessage, WrappedSessionKeyPayload } from "@/core/types";
 import { request } from "@/core/websocket";
 import { wrapCallSessionKeyForRecipient, unwrapCallSessionKeyFromSender, rotateCallSessionKey } from "./encryption";
-import { importAesGcmKey } from "@/utils/crypto/symmetric";
+import { importAesGcmKey } from "@fromchat/protocol";
 import E2EEWorker from "./e2eeWorker?worker";
 import { delay } from "@/utils/utils";
 

frontend/src/pages/chat/ui/right/Message.tsx

@@ -6,8 +6,7 @@ import { parse } from "marked";
 import { escape as escapeHtml } from "he";
 import { useEffect, useState, useRef, useMemo } from "react";
 import api from "@/core/api";
-import { ecdhSharedSecret, deriveWrappingKey } from "@/utils/crypto/asymmetric";
-import { importAesGcmKey, aesGcmDecrypt } from "@/utils/crypto/symmetric";
+import { ecdhSharedSecret, deriveWrappingKey, importAesGcmKey, aesGcmDecrypt } from "@fromchat/protocol";
 import { useUserStore } from "@/state/user";
 import { useProfileStore } from "@/state/profile";
 import { StatusBadge } from "@/core/components/StatusBadge";

frontend/src/utils/crypto/fromchatInit.ts

@@ -0,0 +1,26 @@
+import { FromChatProtocol } from "@fromchat/protocol";
+import { getCurrentKeys } from "@/core/api/user/auth";
+
+let protocolInstance: FromChatProtocol | null = null;
+
+export function getFromChatProtocol(): FromChatProtocol | null {
+	return protocolInstance;
+}
+
+export function initializeFromChatProtocol(privateKey: Uint8Array): FromChatProtocol {
+	protocolInstance = new FromChatProtocol(privateKey);
+	return protocolInstance;
+}
+
+export function getOrInitProtocol(): FromChatProtocol {
+	if (protocolInstance) {
+		return protocolInstance;
+	}
+	
+	const keys = getCurrentKeys();
+	if (!keys) {
+		throw new Error("Keys not initialized");
+	}
+	
+	return initializeFromChatProtocol(keys.privateKey);
+}

frontend/tsconfig.json

@@ -14,10 +14,11 @@
         "noEmit": true,
 
         /* Path mapping */
-        "baseUrl": ".",
-        "paths": {
-            "@/*": ["src/*"]
-        },
+          "baseUrl": ".",
+          "paths": {
+              "@/*": ["src/*"],
+              "@fromchat/protocol": ["./packages/fromchat-protocol/src"]
+          },
 
         /* Linting */
         "strict": true,
@@ -31,6 +32,6 @@
         "jsx": "react-jsx",
         "jsxImportSource": "react"
     },
-    "include": ["src", "electron.d.ts"],
+      "include": ["src", "electron.d.ts", "packages/fromchat-protocol/src"],
     "exclude": ["**/__*/**", "__*"]
 }

frontend/vite.config.ts

@@ -70,7 +70,8 @@ export default defineConfig({
     plugins: plugins,
     resolve: {
         alias: {
-            "@": path.resolve(__dirname, "./src")
+            "@": path.resolve(__dirname, "./src"),
+            "@fromchat/protocol": path.resolve(__dirname, "./packages/fromchat-protocol/src/index.ts")
         }
     },
     server: {
@@ -89,6 +90,7 @@ export default defineConfig({
     },
     appType: "spa",
     optimizeDeps: {
+        exclude: ["@fromchat/protocol"],
         esbuildOptions: {
             target: "es2022"
         }

package.json

@@ -31,7 +31,7 @@
         "install:pussh": "bash ./scripts/install:pussh.sh",
         "prepare": "husky",
         "generate:env": "bash ./scripts/generate:env.sh",
-        "deploy": "bash ./scripts/deploy.sh"
+        "deploy": "dotenv -e deployment/.env -- bash ./scripts/deploy.sh"
     },
     "files": [
         "frontend/build/electron"
@@ -51,9 +51,10 @@
         "@types/react-dom": "^19.1.9",
         "@vitejs/plugin-react": "^5.0.3",
         "autoprefixer": "^10.4.21",
+        "baseline-browser-mapping": "^2.9.11",
         "concurrently": "^9.2.1",
-        "dotenv-cli": "^10.0.0",
-        "electron": "^38.1.2",
+        "dotenv-cli": "^11.0.0",
+        "electron": "^39.2.7",
         "husky": "^9.1.7",
         "postcss": "^8.5.6",
         "rollup-plugin-visualizer": "^6.0.4",
@@ -67,12 +68,16 @@
         "vite-plugin-html": "^3.2.2",
         "vite-plugin-sass-dts": "^1.3.34"
     },
+    "workspaces": [
+        "frontend/packages/fromchat-protocol"
+    ],
     "dependencies": {
+        "@fromchat/protocol": "workspace:*",
         "electron-squirrel-startup": "^1.0.1",
         "escape-string-regexp": "^5.0.0",
         "he": "^1.2.0",
         "idb": "^8.0.3",
-        "marked": "^16.3.0",
+        "marked": "^17.0.1",
         "mdui": "^2.1.4",
         "motion": "^12.23.24",
         "react": "^19.1.1",

scripts/deploy.sh

@@ -113,56 +113,115 @@ fi
 
 step "Authentication"
 SSH_KEY_FILE="$HOME/.ssh/id_rsa"
+SSH_KEY_PUB_FILE="$SSH_KEY_FILE.pub"
 
 # Ensure ssh-agent is running
 if [ -z "$SSH_AUTH_SOCK" ]; then
     eval "$(ssh-agent -s)" > /dev/null 2>&1
 fi
 
-# Add SSH key to agent if not already loaded
-if [ -f "$SSH_KEY_FILE" ]; then
-    # Check if key is already loaded
-    KEY_LOADED=false
-    if ssh-add -l > /dev/null 2>&1; then
-        # Check if this specific key is loaded by trying to match the public key
-        KEY_FINGERPRINT=$(ssh-keygen -lf "$SSH_KEY_FILE" 2>/dev/null | awk '{print $2}')
-        if [ -n "$KEY_FINGERPRINT" ] && ssh-add -l 2>/dev/null | grep -q "$KEY_FINGERPRINT"; then
-            KEY_LOADED=true
-        fi
-    fi
-    
-    if [ "$KEY_LOADED" = false ]; then
-        substep "Adding SSH key to agent..."
-        ssh-add "$SSH_KEY_FILE" 2>/dev/null || true
-    fi
-else
-    warning "SSH key not found at $SSH_KEY_FILE"
+# Check if SSH key exists
+if [ ! -f "$SSH_KEY_FILE" ]; then
+    error "SSH key not found at $SSH_KEY_FILE"
+    echo "   Please generate an SSH key pair first:"
+    echo "   ssh-keygen -t rsa -b 4096 -C 'your_email@example.com'"
+    exit 1
 fi
 
-# Test SSH connection once to cache the key (this will prompt for passphrase if needed)
-ssh -o ConnectTimeout=5 "$SERVER" "echo" > /dev/null 2>&1 || true
+# Add SSH key to agent if not already loaded
+KEY_LOADED=false
+if ssh-add -l > /dev/null 2>&1; then
+    # Check if this specific key is loaded by trying to match the public key
+    KEY_FINGERPRINT=$(ssh-keygen -lf "$SSH_KEY_FILE" 2>/dev/null | awk '{print $2}')
+    if [ -n "$KEY_FINGERPRINT" ] && ssh-add -l 2>/dev/null | grep -q "$KEY_FINGERPRINT"; then
+        KEY_LOADED=true
+    fi
+fi
+
+if [ "$KEY_LOADED" = false ]; then
+    substep "Adding SSH key to agent..."
+    if ! ssh-add "$SSH_KEY_FILE" 2>/dev/null; then
+        error "Failed to add SSH key to agent. Check your key passphrase."
+        exit 1
+    fi
+fi
+
+# Check if SSH key authentication already works
+if ssh -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=no "$SERVER" "echo 'SSH key works'" >/dev/null 2>&1; then
+    # SSH key already works, no need to copy
+    true
+else
+    # Check if our public key is already on the server
+    KEY_CONTENT=$(cat "$SSH_KEY_PUB_FILE")
+    if ssh -o BatchMode=no -o ConnectTimeout=10 -o StrictHostKeyChecking=no "$SERVER" "
+        grep -q '$KEY_CONTENT' ~/.ssh/authorized_keys 2>/dev/null
+    " >/dev/null 2>&1; then
+        # Key exists but authentication failed - might be permissions issue
+        error "SSH key found on server but authentication failed. Check server SSH configuration."
+        exit 1
+    else
+        # Key not on server, need to copy it
+        substep "SSH password: " -n
+        SSH_PASSWORD=$(read_password)
+
+        if [ -z "$SSH_PASSWORD" ]; then
+            error "No SSH password provided"
+            exit 1
+        fi
+
+        substep "Copying SSH key to server..."
+        if command -v expect >/dev/null 2>&1; then
+            expect << EOF >/dev/null 2>&1
+spawn ssh-copy-id -o ConnectTimeout=10 -o StrictHostKeyChecking=no -i "$SSH_KEY_PUB_FILE" "$SERVER"
+expect "password:"
+send "$SSH_PASSWORD\r"
+expect eof
+EOF
+            if [ $? -eq 0 ]; then
+                true
+            else
+                error "Failed to copy SSH key to server"
+                exit 1
+            fi
+        else
+            error "expect not available - cannot copy SSH key"
+            exit 1
+        fi
+    fi
+fi
 
 # ============================================================================
 # SUDO AUTHENTICATION
 # ============================================================================
 
 SUDO_PASSWORD=""
-while true; do
-    substep "Sudo password: " -n
-    SUDO_PASSWORD=$(read_password)
-    
-    if [ -z "$SUDO_PASSWORD" ]; then
-        warning "No password provided - assuming passwordless sudo"
-        break
-    fi
-    
-    if echo "$SUDO_PASSWORD" | ssh "$SERVER" "sudo -S -v" > /dev/null 2>&1; then
+# If SSH password was provided, try using it for sudo first
+if [ -n "$SSH_PASSWORD" ]; then
+    if echo "$SSH_PASSWORD" | ssh "$SERVER" "sudo -S -v" > /dev/null 2>&1; then
+        SUDO_PASSWORD="$SSH_PASSWORD"
         export SUDO_PASSWORD
-        break
-    else
-        echo -n "  " && error "Invalid password, please try again"
     fi
-done
+fi
+
+# If we don't have a working sudo password yet, prompt for it
+if [ -z "$SUDO_PASSWORD" ]; then
+    while true; do
+        substep "Sudo password: " -n
+        SUDO_PASSWORD=$(read_password)
+
+        if [ -z "$SUDO_PASSWORD" ]; then
+            warning "No password provided - assuming passwordless sudo"
+            break
+        fi
+
+        if echo "$SUDO_PASSWORD" | ssh "$SERVER" "sudo -S -v" > /dev/null 2>&1; then
+            export SUDO_PASSWORD
+            break
+        else
+            echo -n "  " && error "Invalid password, please try again"
+        fi
+    done
+fi
 
 # ============================================================================
 # BUILD PHASE
@@ -255,6 +314,8 @@ step "Detecting services"
 cd "$DEPLOYMENT_DIR"
 SERVICES=$(docker compose -f docker-compose.yml config --services 2>/dev/null)
 
+# Note: Using multi-stage Dockerfile - no separate base image build needed
+
 if [ -z "$SERVICES" ]; then
     error "No services found in docker-compose.yml"
 fi
@@ -281,7 +342,11 @@ for SERVICE in $SERVICES; do
     DOCKERFILE_REL=$(echo "$BUILD_OUTPUT" | grep "dockerfile:" | \
         sed 's/.*dockerfile:[[:space:]]*\(.*\)/\1/' | \
         tr -d '"' | tr -d "'" | xargs)
-    
+
+    TARGET=$(echo "$BUILD_OUTPUT" | grep "target:" | \
+        sed 's/.*target:[[:space:]]*\(.*\)/\1/' | \
+        tr -d '"' | tr -d "'" | xargs)
+
     CONTEXT_REL=$(echo "$BUILD_OUTPUT" | grep "context:" | \
         sed 's/.*context:[[:space:]]*\(.*\)/\1/' | \
         tr -d '"' | tr -d "'" | xargs)
@@ -318,17 +383,24 @@ for SERVICE in $SERVICES; do
         fi
     fi
     
-    if docker buildx build \
-        --platform "$PLATFORM" \
-        --file "$DOCKERFILE" \
-        --tag "$IMAGE_TAG" \
-        --load \
-        "$BUILD_CONTEXT"; then
+    # Safety check: ensure no sqlite in DATABASE_URL for Docker services
+    if grep -q "DATABASE_URL.*sqlite" "$DEPLOYMENT_DIR/docker-compose.yml" 2>/dev/null; then
+        error "Found sqlite DATABASE_URL in docker-compose.yml - SQLite not allowed in Docker"
+        exit 1
+    fi
+
+    BUILD_ARGS="--platform \"$PLATFORM\" --file \"$DOCKERFILE\" --tag \"$IMAGE_TAG\" --load"
+    if [ -n "$TARGET" ]; then
+        BUILD_ARGS="$BUILD_ARGS --target \"$TARGET\""
+    fi
+
+    if docker buildx build $BUILD_ARGS "$BUILD_CONTEXT"; then
         echo -e "  ${GREEN}✓${NC} Built ${CYAN}$SERVICE${NC}"
         BUILT_IMAGES+=("$IMAGE_TAG")
         echo ""
     else
         error "Build failed for $SERVICE"
+        exit 1
     fi
 done
 

scripts/generate:env.sh

@@ -5,8 +5,11 @@ echo > deployment/.env
 ./.venv/bin/python3 backend/generate_vapid_keys.py >> deployment/.env
 
 cat >> deployment/.env <<EOF
+VAPID_SUBJECT=mailto:support@fromchat.ru
 JWT_SECRET="$(openssl rand -base64 32)"
 TURN_USERNAME=<set>
 TURN_SECRET=<set>
 DEPLOYMENT_SERVER=<set>
+FIREBASE_CERT=<set>
+DB_PASSWORD=development
 EOF