src/routes/servers/permissions_set.rs

+use mongodb::bson::doc;
+use rocket_contrib::json::Json;
+use serde::{Serialize, Deserialize};
+
+use crate::database::*;
+use crate::database::permissions::channel::ChannelPermission;
+use crate::database::permissions::server::ServerPermission;
+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+
+#[derive(Serialize, Deserialize)]
+pub struct Values {
+    server: u32,
+    channel: u32
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct Data {
+    permissions: Values
+}
+
+#[put("/<target>/permissions/<role_id>", data = "<data>", rank = 2)]
+pub async fn req(user: User, target: Ref, role_id: String, data: Json<Data>) -> Result<()> {
+    let target = target.fetch_server().await?;
+
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_server(&target)
+        .for_server()
+        .await?;
+
+    if !perm.get_manage_roles() {
+        return Err(Error::MissingPermission);
+    }
+
+    if !target.roles.contains_key(&role_id) {
+        return Err(Error::NotFound);
+    }
+
+    let server_permissions: u32 = ServerPermission::View as u32 | data.permissions.server;
+    let channel_permissions: u32 = ChannelPermission::View as u32 | data.permissions.channel;
+    
+    get_collection("servers")
+        .update_one(
+            doc! { "_id": &target.id },
+            doc! {
+                "$set": {
+                    "roles.".to_owned() + &role_id + &".permissions": [
+                        server_permissions as i32,
+                        channel_permissions as i32
+                    ]
+                }
+            },
+            None
+        )
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "update_one",
+            with: "server"
+        })?;
+    
+    ClientboundNotification::ServerRoleUpdate {
+        id: target.id.clone(),
+        role_id,
+        data: json!({
+            "permissions": [
+                server_permissions as i32,
+                channel_permissions as i32
+            ]
+        }),
+        clear: None
+    }
+    .publish(target.id);
+
+    Ok(())
+}

src/routes/servers/permissions_set_default.rs

+use mongodb::bson::doc;
+use rocket_contrib::json::Json;
+use serde::{Serialize, Deserialize};
+
+use crate::database::*;
+use crate::database::permissions::channel::ChannelPermission;
+use crate::database::permissions::server::ServerPermission;
+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+
+#[derive(Serialize, Deserialize)]
+pub struct Values {
+    server: u32,
+    channel: u32
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct Data {
+    permissions: Values
+}
+
+#[put("/<target>/permissions/default", data = "<data>", rank = 1)]
+pub async fn req(user: User, target: Ref, data: Json<Data>) -> Result<()> {
+    let target = target.fetch_server().await?;
+
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_server(&target)
+        .for_server()
+        .await?;
+
+    if !perm.get_manage_roles() {
+        return Err(Error::MissingPermission);
+    }
+
+    let server_permissions: u32 = ServerPermission::View as u32 | data.permissions.server;
+    let channel_permissions: u32 = ChannelPermission::View as u32 | data.permissions.channel;
+    
+    get_collection("servers")
+        .update_one(
+            doc! { "_id": &target.id },
+            doc! {
+                "$set": {
+                    "default_permissions": [
+                        server_permissions as i32,
+                        channel_permissions as i32
+                    ]
+                }
+            },
+            None
+        )
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "update_one",
+            with: "server"
+        })?;
+    
+    ClientboundNotification::ServerUpdate {
+        id: target.id.clone(),
+        data: json!({
+            "default_permissions": [
+                server_permissions as i32,
+                channel_permissions as i32
+            ]
+        }),
+        clear: None
+    }
+    .publish(target.id);
+
+    Ok(())
+}

src/routes/servers/roles_create.rs

+use crate::database::*;
+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+
+use ulid::Ulid;
+use mongodb::bson::doc;
+use validator::Validate;
+use serde::{Serialize, Deserialize};
+use rocket_contrib::json::{Json, JsonValue};
+
+#[derive(Validate, Serialize, Deserialize)]
+pub struct Data {
+    #[validate(length(min = 1, max = 32))]
+    name: String
+}
+
+#[post("/<target>/roles", data = "<data>")]
+pub async fn req(user: User, target: Ref, data: Json<Data>) -> Result<JsonValue> {
+    let data = data.into_inner();
+    data.validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+    
+    let target = target.fetch_server().await?;
+
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_server(&target)
+        .for_server()
+        .await?;
+
+    if !perm.get_manage_roles() {
+        Err(Error::MissingPermission)?
+    }
+
+    let id = Ulid::new().to_string();
+    let perm_tuple = (
+        *permissions::server::DEFAULT_PERMISSION as i32,
+        *permissions::channel::DEFAULT_PERMISSION_SERVER as i32
+    );
+
+    get_collection("servers")
+        .update_one(
+            doc! {
+                "_id": &target.id
+            },
+            doc! {
+                "$set": {
+                    "roles.".to_owned() + &id: {
+                        "name": &data.name,
+                        "permissions": [
+                            &perm_tuple.0,
+                            &perm_tuple.1
+                        ]
+                    } 
+                }
+            },
+            None
+        )
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "update_one",
+            with: "servers"
+        })?;
+    
+    ClientboundNotification::ServerRoleUpdate {
+        id: target.id.clone(),
+        role_id: id.clone(),
+        data: json!({
+            "name": data.name,
+            "permissions": &perm_tuple
+        }),
+        clear: None
+    }
+    .publish(target.id);
+
+    Ok(json!({ "id": id, "permissions": perm_tuple }))
+}

src/routes/servers/roles_delete.rs

+use crate::database::*;
+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+
+use mongodb::bson::doc;
+
+#[delete("/<target>/roles/<role_id>")]
+pub async fn req(user: User, target: Ref, role_id: String) -> Result<()> {
+    let target = target.fetch_server().await?;
+
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_server(&target)
+        .for_server()
+        .await?;
+
+    if !perm.get_manage_roles() {
+        Err(Error::MissingPermission)?
+    }
+
+    get_collection("servers")
+        .update_one(
+            doc! {
+                "_id": &target.id
+            },
+            doc! {
+                "$unset": {
+                    "roles.".to_owned() + &role_id: 1
+                }
+            },
+            None
+        )
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "update_one",
+            with: "servers"
+        })?;
+
+    get_collection("channels")
+        .update_one(
+            doc! {
+                "server": &target.id
+            },
+            doc! {
+                "$unset": {
+                    "role_permissions.".to_owned() + &role_id: 1
+                }
+            },
+            None
+        )
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "update_one",
+            with: "channels"
+        })?;
+
+    get_collection("server_members")
+        .update_many(
+            doc! {
+                "_id.server": &target.id
+            },
+            doc! {
+                "$pull": {
+                    "roles": &role_id
+                }
+            },
+            None
+        )
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "update_many",
+            with: "server_members"
+        })?;
+    
+    ClientboundNotification::ServerRoleDelete {
+        id: target.id.clone(),
+        role_id
+    }
+    .publish(target.id);
+
+    Ok(())
+}

src/routes/servers/roles_edit.rs

+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+use crate::{database::*, notifications::events::RemoveRoleField};
+
+use mongodb::bson::doc;
+use rocket_contrib::json::Json;
+use serde::{Deserialize, Serialize};
+use validator::Validate;
+
+#[derive(Validate, Serialize, Deserialize)]
+pub struct Data {
+    #[validate(length(min = 1, max = 32))]
+    name: Option<String>,
+    #[validate(length(min = 1, max = 32))]
+    colour: Option<String>,
+    remove: Option<RemoveRoleField>,
+}
+
+#[patch("/<target>/roles/<role_id>", data = "<data>")]
+pub async fn req(user: User, target: Ref, role_id: String, data: Json<Data>) -> Result<()> {
+    let data = data.into_inner();
+    data.validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
+    if data.name.is_none() && data.colour.is_none() && data.remove.is_none()
+    {
+        return Ok(());
+    }
+
+    let target = target.fetch_server().await?;
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_server(&target)
+        .for_server()
+        .await?;
+
+    if !perm.get_manage_roles() {
+        return Err(Error::MissingPermission)
+    }
+
+    if !target.roles.contains_key(&role_id) {
+        return Err(Error::InvalidRole)
+    }
+
+    let mut set = doc! {};
+    let mut unset = doc! {};
+
+    // ! FIXME: we should probably just require clients to support basic MQL incl. $set / $unset
+    let mut set_update = doc! {};
+
+    let role_key = "roles.".to_owned() + &role_id;
+
+    if let Some(remove) = &data.remove {
+        match remove {
+            RemoveRoleField::Colour => {
+                unset.insert(role_key.clone() + ".colour", 1);
+            }
+        }
+    }
+
+    if let Some(name) = &data.name {
+        set.insert(role_key.clone() + ".name", name);
+        set_update.insert("name", name);
+    }
+
+    if let Some(colour) = &data.colour {
+        set.insert(role_key.clone() + ".colour", colour);
+        set_update.insert("colour", colour);
+    }
+
+    let mut operations = doc! {};
+    if set.len() > 0 {
+        operations.insert("$set", &set);
+    }
+
+    if unset.len() > 0 {
+        operations.insert("$unset", unset);
+    }
+
+    if operations.len() > 0 {
+        get_collection("servers")
+            .update_one(doc! { "_id": &target.id }, operations, None)
+            .await
+            .map_err(|_| Error::DatabaseError {
+                operation: "update_one",
+                with: "server",
+            })?;
+    }
+
+    ClientboundNotification::ServerRoleUpdate {
+        id: target.id.clone(),
+        role_id,
+        data: json!(set_update),
+        clear: data.remove,
+    }
+    .publish(target.id.clone());
+
+    Ok(())
+}

src/routes/servers/server_create.rs

+use std::collections::HashMap;
+
+use crate::database::*;
+use crate::util::result::{Error, Result};
+
+use mongodb::bson::doc;
+use rocket_contrib::json::{Json, JsonValue};
+use serde::{Deserialize, Serialize};
+use ulid::Ulid;
+use validator::Validate;
+
+#[derive(Validate, Serialize, Deserialize)]
+pub struct Data {
+    #[validate(length(min = 1, max = 32))]
+    name: String,
+    #[validate(length(min = 0, max = 1024))]
+    description: Option<String>,
+    // Maximum length of 36 allows both ULIDs and UUIDs.
+    #[validate(length(min = 1, max = 36))]
+    nonce: String,
+}
+
+#[post("/create", data = "<info>")]
+pub async fn req(user: User, info: Json<Data>) -> Result<JsonValue> {
+    let info = info.into_inner();
+    info.validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
+    if get_collection("servers")
+        .find_one(
+            doc! {
+                "nonce": &info.nonce
+            },
+            None,
+        )
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "find_one",
+            with: "server",
+        })?
+        .is_some()
+    {
+        Err(Error::DuplicateNonce)?
+    }
+
+    let id = Ulid::new().to_string();
+    let cid = Ulid::new().to_string();
+
+    let server = Server {
+        id: id.clone(),
+        nonce: Some(info.nonce.clone()),
+        owner: user.id.clone(),
+
+        name: info.name,
+        description: info.description,
+
+        channels: vec![cid.clone()],
+        categories: None,
+        system_messages: Some(SystemMessageChannels {
+            user_joined: Some(cid.clone()),
+            user_left: Some(cid.clone()),
+            user_kicked: Some(cid.clone()),
+            user_banned: Some(cid.clone()),
+        }),
+
+        roles: HashMap::new(),
+        default_permissions: (
+            *permissions::server::DEFAULT_PERMISSION as i32,
+            *permissions::channel::DEFAULT_PERMISSION_SERVER as i32
+        ),
+
+        icon: None,
+        banner: None,
+    };
+
+    Channel::TextChannel {
+        id: cid,
+        server: id,
+        nonce: Some(info.nonce),
+        name: "general".to_string(),
+        description: None,
+
+        icon: None,
+        last_message: None,
+
+        default_permissions: None,
+        role_permissions: HashMap::new()
+    }
+    .publish()
+    .await?;
+
+    server.clone().create().await?;
+    server.join_member(&user.id).await?;
+
+    Ok(json!(server))
+}

src/routes/servers/server_delete.rs

+use crate::database::*;
+use crate::util::result::{Error, Result};
+
+use mongodb::bson::doc;
+
+#[delete("/<target>")]
+pub async fn req(user: User, target: Ref) -> Result<()> {
+    let target = target.fetch_server().await?;
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_server(&target)
+        .for_server()
+        .await?;
+
+    if !perm.get_view() {
+        return Err(Error::MissingPermission);
+    }
+
+    if user.id == target.owner {
+        target.delete().await
+    } else {
+        target.remove_member(&user.id, RemoveMember::Leave).await
+    }
+}

src/routes/servers/server_edit.rs

+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+use crate::{database::*, notifications::events::RemoveServerField};
+
+use mongodb::bson::{doc, to_bson, to_document};
+use rocket_contrib::json::Json;
+use serde::{Deserialize, Serialize};
+use validator::Validate;
+
+#[derive(Validate, Serialize, Deserialize)]
+pub struct Data {
+    #[validate(length(min = 1, max = 32))]
+    name: Option<String>,
+    #[validate(length(min = 0, max = 1024))]
+    description: Option<String>,
+    icon: Option<String>,
+    banner: Option<String>,
+    categories: Option<Vec<Category>>,
+    system_messages: Option<SystemMessageChannels>,
+    remove: Option<RemoveServerField>,
+}
+
+#[patch("/<target>", data = "<data>")]
+pub async fn req(user: User, target: Ref, data: Json<Data>) -> Result<()> {
+    let data = data.into_inner();
+    data.validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
+    if data.name.is_none() && data.description.is_none() && data.icon.is_none() && data.banner.is_none() && data.remove.is_none() && data.categories.is_none() && data.system_messages.is_none()
+    {
+        return Ok(());
+    }
+
+    let target = target.fetch_server().await?;
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_server(&target)
+        .for_server()
+        .await?;
+
+    if !perm.get_manage_server() {
+        Err(Error::MissingPermission)?
+    }
+
+    let mut set = doc! {};
+    let mut unset = doc! {};
+
+    let mut remove_icon = false;
+    let mut remove_banner = false;
+    if let Some(remove) = &data.remove {
+        match remove {
+            RemoveServerField::Icon => {
+                unset.insert("icon", 1);
+                remove_icon = true;
+            }
+            RemoveServerField::Banner => {
+                unset.insert("banner", 1);
+                remove_banner = true;
+            }
+            RemoveServerField::Description => {
+                unset.insert("description", 1);
+            }
+        }
+    }
+
+    if let Some(name) = &data.name {
+        set.insert("name", name);
+    }
+
+    if let Some(description) = &data.description {
+        set.insert("description", description);
+    }
+
+    if let Some(attachment_id) = &data.icon {
+        let attachment = File::find_and_use(&attachment_id, "icons", "object", &target.id).await?;
+        set.insert(
+            "icon",
+            to_document(&attachment).map_err(|_| Error::DatabaseError {
+                operation: "to_document",
+                with: "attachment",
+            })?,
+        );
+
+        remove_icon = true;
+    }
+
+    if let Some(attachment_id) = &data.banner {
+        let attachment =
+            File::find_and_use(&attachment_id, "banners", "server", &target.id).await?;
+        set.insert(
+            "banner",
+            to_document(&attachment).map_err(|_| Error::DatabaseError {
+                operation: "to_document",
+                with: "attachment",
+            })?,
+        );
+
+        remove_banner = true;
+    }
+
+    if let Some(categories) = &data.categories {
+        set.insert("categories", to_bson(&categories).map_err(|_| Error::DatabaseError { operation: "to_document", with: "categories" })?);
+    }
+
+    if let Some(system_messages) = &data.system_messages {
+        set.insert("system_messages", to_bson(&system_messages).map_err(|_| Error::DatabaseError { operation: "to_document", with: "system_messages" })?);
+    }
+
+    let mut operations = doc! {};
+    if set.len() > 0 {
+        operations.insert("$set", &set);
+    }
+
+    if unset.len() > 0 {
+        operations.insert("$unset", unset);
+    }
+
+    if operations.len() > 0 {
+        get_collection("servers")
+            .update_one(doc! { "_id": &target.id }, operations, None)
+            .await
+            .map_err(|_| Error::DatabaseError {
+                operation: "update_one",
+                with: "server",
+            })?;
+    }
+
+    ClientboundNotification::ServerUpdate {
+        id: target.id.clone(),
+        data: json!(set),
+        clear: data.remove,
+    }
+    .publish(target.id.clone());
+
+    let Server { icon, banner, .. } = target;
+
+    if remove_icon {
+        if let Some(old_icon) = icon {
+            old_icon.delete().await?;
+        }
+    }
+
+    if remove_banner {
+        if let Some(old_banner) = banner {
+            old_banner.delete().await?;
+        }
+    }
+
+    Ok(())
+}

src/routes/servers/server_fetch.rs

+use crate::database::*;
+use crate::util::result::{Error, Result};
+
+use rocket_contrib::json::JsonValue;
+
+#[get("/<target>")]
+pub async fn req(user: User, target: Ref) -> Result<JsonValue> {
+    let target = target.fetch_server().await?;
+
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_server(&target)
+        .for_server()
+        .await?;
+
+    if !perm.get_view() {
+        Err(Error::MissingPermission)?
+    }
+
+    Ok(json!(target))
+}

src/routes/sync/get_settings.rs

+use crate::database::*;
+use crate::util::result::{Error, Result};
+
+use mongodb::bson::doc;
+use mongodb::options::FindOneOptions;
+use rocket_contrib::json::{Json, JsonValue};
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize)]
+pub struct Options {
+    keys: Vec<String>,
+}
+
+#[post("/settings/fetch", data = "<options>")]
+pub async fn req(user: User, options: Json<Options>) -> Result<JsonValue> {
+    let options = options.into_inner();
+    let mut projection = doc! {
+        "_id": 0,
+    };
+
+    for key in options.keys {
+        projection.insert(key, 1);
+    }
+
+    if let Some(doc) = get_collection("user_settings")
+        .find_one(
+            doc! {
+                "_id": user.id
+            },
+            FindOneOptions::builder().projection(projection).build(),
+        )
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "find_one",
+            with: "user_settings",
+        })?
+    {
+        Ok(json!(doc))
+    } else {
+        Ok(json!({}))
+    }
+}

src/routes/sync/get_unreads.rs

+use crate::database::*;
+use crate::util::result::Result;
+
+use mongodb::bson::doc;
+use rocket_contrib::json::JsonValue;
+
+#[get("/unreads")]
+pub async fn req(user: User) -> Result<JsonValue> {
+    Ok(json!(User::fetch_unreads(&user.id).await?))
+}

src/routes/sync/mod.rs

+use rocket::Route;
+
+mod get_settings;
+mod get_unreads;
+mod set_settings;
+
+pub fn routes() -> Vec<Route> {
+    routes![get_settings::req, set_settings::req, get_unreads::req]
+}

src/routes/sync/set_settings.rs

+use crate::database::*;
+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+
+use chrono::prelude::*;
+use mongodb::bson::{doc, to_bson};
+use mongodb::options::UpdateOptions;
+use rocket::request::Form;
+use rocket_contrib::json::Json;
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+type Data = HashMap<String, String>;
+
+#[derive(Serialize, Deserialize, FromForm)]
+pub struct Options {
+    timestamp: Option<i64>,
+}
+
+#[post("/settings/set?<options..>", data = "<data>")]
+pub async fn req(user: User, data: Json<Data>, options: Form<Options>) -> Result<()> {
+    let data = data.into_inner();
+    let current_time = Utc::now().timestamp_millis();
+    let timestamp = if let Some(timestamp) = options.timestamp {
+        if timestamp > current_time {
+            current_time
+        } else {
+            timestamp
+        }
+    } else {
+        current_time
+    };
+
+    let mut set = doc! {};
+    for (key, data) in &data {
+        set.insert(
+            key.clone(),
+            vec![
+                to_bson(&timestamp).unwrap(),
+                to_bson(&data.clone()).unwrap(),
+            ],
+        );
+    }
+
+    if set.len() > 0 {
+        get_collection("user_settings")
+            .update_one(
+                doc! {
+                    "_id": &user.id
+                },
+                doc! {
+                    "$set": &set
+                },
+                UpdateOptions::builder().upsert(true).build(),
+            )
+            .await
+            .map_err(|_| Error::DatabaseError {
+                operation: "update_one",
+                with: "user_settings",
+            })?;
+    }
+
+    ClientboundNotification::UserSettingsUpdate {
+        id: user.id.clone(),
+        update: json!(set),
+    }
+    .publish(user.id);
+
+    Ok(())
+}

src/routes/users/add_friend.rs

@@ -31,6 +31,8 @@ pub async fn req(user: User, username: String) -> Result<JsonValue> {
         with: "user",
     })?;
 
+    let target_user = Ref::from(target_id.to_string())?.fetch_user().await?;
+
     match get_relationship(&user, &target_id) {
         RelationshipStatus::User => return Err(Error::NoEffect),
         RelationshipStatus::Friend => return Err(Error::AlreadyFriends),
@@ -65,21 +67,26 @@ pub async fn req(user: User, username: String) -> Result<JsonValue> {
                 )
             ) {
                 Ok(_) => {
-                    try_join!(
-                        ClientboundNotification::UserRelationship {
-                            id: user.id.clone(),
-                            user: target_id.to_string(),
-                            status: RelationshipStatus::Friend
-                        }
-                        .publish(user.id.clone()),
-                        ClientboundNotification::UserRelationship {
-                            id: target_id.to_string(),
-                            user: user.id.clone(),
-                            status: RelationshipStatus::Friend
-                        }
-                        .publish(target_id.to_string())
-                    )
-                    .ok();
+                    let target_user = target_user
+                        .from_override(&user, RelationshipStatus::Friend)
+                        .await?;
+                    let user = user
+                        .from_override(&target_user, RelationshipStatus::Friend)
+                        .await?;
+
+                    ClientboundNotification::UserRelationship {
+                        id: user.id.clone(),
+                        user: target_user,
+                        status: RelationshipStatus::Friend,
+                    }
+                    .publish(user.id.clone());
+
+                    ClientboundNotification::UserRelationship {
+                        id: target_id.to_string(),
+                        user,
+                        status: RelationshipStatus::Friend,
+                    }
+                    .publish(target_id.to_string());
 
                     Ok(json!({ "status": "Friend" }))
                 }
@@ -121,21 +128,26 @@ pub async fn req(user: User, username: String) -> Result<JsonValue> {
                 )
             ) {
                 Ok(_) => {
-                    try_join!(
-                        ClientboundNotification::UserRelationship {
-                            id: user.id.clone(),
-                            user: target_id.to_string(),
-                            status: RelationshipStatus::Outgoing
-                        }
-                        .publish(user.id.clone()),
-                        ClientboundNotification::UserRelationship {
-                            id: target_id.to_string(),
-                            user: user.id.clone(),
-                            status: RelationshipStatus::Incoming
-                        }
-                        .publish(target_id.to_string())
-                    )
-                    .ok();
+                    let target_user = target_user
+                        .from_override(&user, RelationshipStatus::Outgoing)
+                        .await?;
+                    let user = user
+                        .from_override(&target_user, RelationshipStatus::Incoming)
+                        .await?;
+
+                    ClientboundNotification::UserRelationship {
+                        id: user.id.clone(),
+                        user: target_user,
+                        status: RelationshipStatus::Outgoing,
+                    }
+                    .publish(user.id.clone());
+
+                    ClientboundNotification::UserRelationship {
+                        id: target_id.to_string(),
+                        user,
+                        status: RelationshipStatus::Incoming,
+                    }
+                    .publish(target_id.to_string());
 
                     Ok(json!({ "status": "Outgoing" }))
                 }

src/routes/users/block_user.rs

@@ -10,6 +10,8 @@ use rocket_contrib::json::JsonValue;
 pub async fn req(user: User, target: Ref) -> Result<JsonValue> {
     let col = get_collection("users");
 
+    let target = target.fetch_user().await?;
+
     match get_relationship(&user, &target.id) {
         RelationshipStatus::User | RelationshipStatus::Blocked => Err(Error::NoEffect),
         RelationshipStatus::BlockedOther => {
@@ -33,12 +35,10 @@ pub async fn req(user: User, target: Ref) -> Result<JsonValue> {
 
             ClientboundNotification::UserRelationship {
                 id: user.id.clone(),
-                user: target.id.clone(),
+                user: target,
                 status: RelationshipStatus::Blocked,
             }
-            .publish(user.id.clone())
-            .await
-            .ok();
+            .publish(user.id.clone());
 
             Ok(json!({ "status": "Blocked" }))
         }
@@ -74,21 +74,27 @@ pub async fn req(user: User, target: Ref) -> Result<JsonValue> {
                 )
             ) {
                 Ok(_) => {
-                    try_join!(
-                        ClientboundNotification::UserRelationship {
-                            id: user.id.clone(),
-                            user: target.id.clone(),
-                            status: RelationshipStatus::Blocked
-                        }
-                        .publish(user.id.clone()),
-                        ClientboundNotification::UserRelationship {
-                            id: target.id.clone(),
-                            user: user.id.clone(),
-                            status: RelationshipStatus::BlockedOther
-                        }
-                        .publish(target.id.clone())
-                    )
-                    .ok();
+                    let target = target
+                        .from_override(&user, RelationshipStatus::Blocked)
+                        .await?;
+                    let user = user
+                        .from_override(&target, RelationshipStatus::BlockedOther)
+                        .await?;
+                    let target_id = target.id.clone();
+
+                    ClientboundNotification::UserRelationship {
+                        id: user.id.clone(),
+                        user: target,
+                        status: RelationshipStatus::Blocked,
+                    }
+                    .publish(user.id.clone());
+
+                    ClientboundNotification::UserRelationship {
+                        id: target_id.clone(),
+                        user,
+                        status: RelationshipStatus::BlockedOther,
+                    }
+                    .publish(target_id);
 
                     Ok(json!({ "status": "Blocked" }))
                 }
@@ -128,21 +134,27 @@ pub async fn req(user: User, target: Ref) -> Result<JsonValue> {
                 )
             ) {
                 Ok(_) => {
-                    try_join!(
-                        ClientboundNotification::UserRelationship {
-                            id: user.id.clone(),
-                            user: target.id.clone(),
-                            status: RelationshipStatus::Blocked
-                        }
-                        .publish(user.id.clone()),
-                        ClientboundNotification::UserRelationship {
-                            id: target.id.clone(),
-                            user: user.id.clone(),
-                            status: RelationshipStatus::BlockedOther
-                        }
-                        .publish(target.id.clone())
-                    )
-                    .ok();
+                    let target = target
+                        .from_override(&user, RelationshipStatus::Blocked)
+                        .await?;
+                    let user = user
+                        .from_override(&target, RelationshipStatus::BlockedOther)
+                        .await?;
+                    let target_id = target.id.clone();
+
+                    ClientboundNotification::UserRelationship {
+                        id: user.id.clone(),
+                        user: target,
+                        status: RelationshipStatus::Blocked,
+                    }
+                    .publish(user.id.clone());
+
+                    ClientboundNotification::UserRelationship {
+                        id: target_id.clone(),
+                        user,
+                        status: RelationshipStatus::BlockedOther,
+                    }
+                    .publish(target_id);
 
                     Ok(json!({ "status": "Blocked" }))
                 }

src/routes/users/change_username.rs

+use crate::database::*;
+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+
+use mongodb::bson::doc;
+use rauth::auth::{Auth, Session};
+use regex::Regex;
+use rocket::State;
+use rocket_contrib::json::Json;
+use serde::{Deserialize, Serialize};
+use validator::Validate;
+
+// ! FIXME: should be global somewhere; maybe use config(?)
+lazy_static! {
+    static ref RE_USERNAME: Regex = Regex::new(r"^[a-zA-Z0-9_.]+$").unwrap();
+}
+
+#[derive(Validate, Serialize, Deserialize)]
+pub struct Data {
+    #[validate(length(min = 2, max = 32), regex = "RE_USERNAME")]
+    username: Option<String>,
+    #[validate(length(min = 8, max = 72))]
+    password: String,
+}
+
+#[patch("/<_ignore_id>/username", data = "<data>")]
+pub async fn req(
+    auth: State<'_, Auth>,
+    session: Session,
+    user: User,
+    data: Json<Data>,
+    _ignore_id: String,
+) -> Result<()> {
+    data.validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
+    auth.verify_password(&session, data.password.clone())
+        .await
+        .map_err(|_| Error::InvalidCredentials)?;
+
+    let mut set = doc! {};
+    if let Some(username) = &data.username {
+        if User::is_username_taken(&username).await? {
+            return Err(Error::UsernameTaken);
+        }
+
+        set.insert("username", username.clone());
+    }
+
+    get_collection("users")
+        .update_one(doc! { "_id": &user.id }, doc! { "$set": set }, None)
+        .await
+        .map_err(|_| Error::DatabaseError {
+            operation: "update_one",
+            with: "user",
+        })?;
+
+    ClientboundNotification::UserUpdate {
+        id: user.id.clone(),
+        data: json!({
+            "username": data.username
+        }),
+        clear: None,
+    }
+    .publish_as_user(user.id.clone());
+
+    Ok(())
+}

src/routes/users/edit_user.rs

+use crate::notifications::events::ClientboundNotification;
+use crate::util::result::{Error, Result};
+use crate::{database::*, notifications::events::RemoveUserField};
+
+use mongodb::bson::{doc, to_document};
+use rocket_contrib::json::Json;
+use serde::{Deserialize, Serialize};
+use validator::Validate;
+
+#[derive(Validate, Serialize, Deserialize, Debug)]
+pub struct UserProfileData {
+    #[validate(length(min = 0, max = 2000))]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    content: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[validate(length(min = 1, max = 128))]
+    background: Option<String>,
+}
+
+#[derive(Validate, Serialize, Deserialize)]
+pub struct Data {
+    #[validate]
+    status: Option<UserStatus>,
+    #[validate]
+    profile: Option<UserProfileData>,
+    #[validate(length(min = 1, max = 128))]
+    avatar: Option<String>,
+    remove: Option<RemoveUserField>,
+}
+
+#[patch("/<_ignore_id>", data = "<data>")]
+pub async fn req(user: User, data: Json<Data>, _ignore_id: String) -> Result<()> {
+    let mut data = data.into_inner();
+
+    data.validate()
+        .map_err(|error| Error::FailedValidation { error })?;
+
+    if data.status.is_none()
+        && data.profile.is_none()
+        && data.avatar.is_none()
+        && data.remove.is_none()
+    {
+        return Ok(());
+    }
+
+    let mut unset = doc! {};
+    let mut set = doc! {};
+
+    let mut remove_background = false;
+    let mut remove_avatar = false;
+
+    if let Some(remove) = &data.remove {
+        match remove {
+            RemoveUserField::ProfileContent => {
+                unset.insert("profile.content", 1);
+            }
+            RemoveUserField::ProfileBackground => {
+                unset.insert("profile.background", 1);
+                remove_background = true;
+            }
+            RemoveUserField::StatusText => {
+                unset.insert("status.text", 1);
+            }
+            RemoveUserField::Avatar => {
+                unset.insert("avatar", 1);
+                remove_avatar = true;
+            }
+        }
+    }
+
+    if let Some(status) = &data.status {
+        set.insert(
+            "status",
+            to_document(&status).map_err(|_| Error::DatabaseError {
+                operation: "to_document",
+                with: "status",
+            })?,
+        );
+    }
+
+    if let Some(profile) = data.profile {
+        if let Some(content) = profile.content {
+            set.insert("profile.content", content);
+        }
+
+        if let Some(attachment_id) = profile.background {
+            let attachment =
+                File::find_and_use(&attachment_id, "backgrounds", "user", &user.id).await?;
+            set.insert(
+                "profile.background",
+                to_document(&attachment).map_err(|_| Error::DatabaseError {
+                    operation: "to_document",
+                    with: "attachment",
+                })?,
+            );
+
+            remove_background = true;
+        }
+    }
+
+    let avatar = std::mem::replace(&mut data.avatar, None);
+    if let Some(attachment_id) = avatar {
+        let attachment = File::find_and_use(&attachment_id, "avatars", "user", &user.id).await?;
+        set.insert(
+            "avatar",
+            to_document(&attachment).map_err(|_| Error::DatabaseError {
+                operation: "to_document",
+                with: "attachment",
+            })?,
+        );
+
+        remove_avatar = true;
+    }
+
+    let mut operations = doc! {};
+    if set.len() > 0 {
+        operations.insert("$set", &set);
+    }
+
+    if unset.len() > 0 {
+        operations.insert("$unset", unset);
+    }
+
+    if operations.len() > 0 {
+        get_collection("users")
+            .update_one(doc! { "_id": &user.id }, operations, None)
+            .await
+            .map_err(|_| Error::DatabaseError {
+                operation: "update_one",
+                with: "user",
+            })?;
+    }
+
+    ClientboundNotification::UserUpdate {
+        id: user.id.clone(),
+        data: json!(set),
+        clear: data.remove,
+    }
+    .publish_as_user(user.id.clone());
+
+    if remove_avatar {
+        if let Some(old_avatar) = user.avatar {
+            old_avatar.delete().await?;
+        }
+    }
+
+    if remove_background {
+        if let Some(profile) = user.profile {
+            if let Some(old_background) = profile.background {
+                old_background.delete().await?;
+            }
+        }
+    }
+
+    Ok(())
+}

src/routes/users/fetch_dms.rs

@@ -12,11 +12,11 @@ pub async fn req(user: User) -> Result<JsonValue> {
             doc! {
                 "$or": [
                     {
-                        "type": "DirectMessage",
+                        "channel_type": "DirectMessage",
                         "active": true
                     },
                     {
-                        "type": "Group"
+                        "channel_type": "Group"
                     }
                 ],
                 "recipients": user.id

src/routes/users/fetch_profile.rs

+use crate::database::*;
+use crate::util::result::{Error, Result};
+
+use mongodb::bson::doc;
+use rocket_contrib::json::JsonValue;
+
+#[get("/<target>/profile")]
+pub async fn req(user: User, target: Ref) -> Result<JsonValue> {
+    let target = target.fetch_user().await?;
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_user(&target)
+        .for_user_given()
+        .await?;
+
+    if !perm.get_view_profile() {
+        Err(Error::MissingPermission)?
+    }
+
+    if target.profile.is_some() {
+        Ok(json!(target.profile))
+    } else {
+        Ok(json!({}))
+    }
+}

src/routes/users/fetch_user.rs

+use crate::database::*;
 use crate::util::result::{Error, Result};
-use crate::{database::*, notifications::websocket::is_online};
 
 use rocket_contrib::json::JsonValue;
 
 #[get("/<target>")]
 pub async fn req(user: User, target: Ref) -> Result<JsonValue> {
-    let mut target = target.fetch_user().await?;
+    let target = target.fetch_user().await?;
 
-    if user.id != target.id {
-        // Check whether we are allowed to fetch this user.
-        let perm = permissions::user::calculate(&user, &target.id).await;
-        if !perm.get_access() {
-            Err(Error::LabelMe)?
-        }
+    let perm = permissions::PermissionCalculator::new(&user)
+        .with_user(&target)
+        .for_user_given()
+        .await?;
 
-        // Only return user relationships if the target is the caller.
-        target.relations = None;
-
-        // Add relevant relationship
-        if let Some(relationships) = &user.relations {
-            target.relationship = relationships
-                .iter()
-                .find(|x| x.id == user.id)
-                .map(|x| x.status.clone())
-                .or_else(|| Some(RelationshipStatus::None));
-        } else {
-            target.relationship = Some(RelationshipStatus::None);
-        }
-    } else {
-        target.relationship = Some(RelationshipStatus::User);
+    if !perm.get_access() {
+        Err(Error::MissingPermission)?
     }
 
-    target.online = Some(is_online(&target.id));
-
-    Ok(json!(target))
+    Ok(json!(target.from(&user).with(perm)))
 }