initial commit

fluxer_api/src/guild/controllers/GuildAuditLogController.ts

@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {HonoApp} from '~/App';
+import {createGuildID, createUserID} from '~/BrandedTypes';
+import {AuditLogActionType} from '~/constants/AuditLogActionType';
+import {InputValidationError} from '~/Errors';
+import {DefaultUserOnly, LoginRequired} from '~/middleware/AuthMiddleware';
+import {RateLimitMiddleware} from '~/middleware/RateLimitMiddleware';
+import {RateLimitConfigs} from '~/RateLimitConfig';
+import {coerceNumberFromString, Int32Type, Int64Type, z} from '~/Schema';
+import {Validator} from '~/Validator';
+
+const actionTypeSchema = coerceNumberFromString(Int32Type).pipe(z.nativeEnum(AuditLogActionType));
+
+export const GuildAuditLogController = (app: HonoApp) => {
+	app.get(
+		'/guilds/:guild_id/audit-logs',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_AUDIT_LOGS),
+		LoginRequired,
+		DefaultUserOnly,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator(
+			'query',
+			z.object({
+				limit: coerceNumberFromString(Int32Type.max(100)).optional(),
+				before: Int64Type.optional(),
+				after: Int64Type.optional(),
+				user_id: Int64Type.optional(),
+				action_type: actionTypeSchema.optional(),
+			}),
+		),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const query = ctx.req.valid('query');
+
+			if (query.before !== undefined && query.after !== undefined) {
+				throw InputValidationError.create('before', 'Cannot specify both before and after');
+			}
+
+			const requestCache = ctx.get('requestCache');
+			const response = await ctx.get('guildService').listGuildAuditLogs({
+				userId,
+				guildId,
+				requestCache,
+				limit: query.limit ?? undefined,
+				beforeLogId: query.before ?? undefined,
+				afterLogId: query.after ?? undefined,
+				filterUserId: query.user_id ? createUserID(query.user_id) : undefined,
+				actionType: query.action_type,
+			});
+
+			return ctx.json(response);
+		},
+	);
+};

fluxer_api/src/guild/controllers/GuildBaseController.ts

@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {HonoApp} from '~/App';
+import {requireSudoMode} from '~/auth/services/SudoVerificationService';
+import {createGuildID} from '~/BrandedTypes';
+import {AccessDeniedError} from '~/Errors';
+import {GuildCreateRequest, GuildUpdateRequest} from '~/guild/GuildModel';
+import {DefaultUserOnly, LoginRequired} from '~/middleware/AuthMiddleware';
+import {RateLimitMiddleware} from '~/middleware/RateLimitMiddleware';
+import {SudoModeMiddleware} from '~/middleware/SudoModeMiddleware';
+import {RateLimitConfigs} from '~/RateLimitConfig';
+import {Int64Type, PasswordType, SudoVerificationSchema, VanityURLCodeType, z} from '~/Schema';
+import {Validator} from '~/Validator';
+
+export const GuildBaseController = (app: HonoApp) => {
+	app.post(
+		'/guilds',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_CREATE),
+		Validator('json', GuildCreateRequest),
+		LoginRequired,
+		async (ctx) => {
+			const user = ctx.get('user');
+			const data = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').createGuild({user, data}, auditLogReason));
+		},
+	);
+
+	app.get('/users/@me/guilds', RateLimitMiddleware(RateLimitConfigs.GUILD_LIST), LoginRequired, async (ctx) => {
+		if (ctx.get('authTokenType') === 'bearer') {
+			const scopes = ctx.get('oauthBearerScopes');
+			if (!scopes || !scopes.has('guilds')) {
+				throw new AccessDeniedError();
+			}
+		}
+		const userId = ctx.get('user').id;
+		return ctx.json(await ctx.get('guildService').getUserGuilds(userId));
+	});
+
+	app.delete(
+		'/users/@me/guilds/:guild_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_LEAVE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').leaveGuild({userId, guildId}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.get(
+		'/guilds/:guild_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_GET),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			return ctx.json(await ctx.get('guildService').getGuild({userId, guildId}));
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', GuildUpdateRequest),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const data = ctx.req.valid('json');
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').updateGuild({userId, guildId, data, requestCache}, auditLogReason));
+		},
+	);
+
+	app.post(
+		'/guilds/:guild_id/delete',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_DELETE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		SudoModeMiddleware,
+		Validator('json', z.object({password: PasswordType.optional()}).merge(SudoVerificationSchema)),
+		async (ctx) => {
+			const user = ctx.get('user');
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const body = ctx.req.valid('json');
+			await requireSudoMode(ctx, user, body, ctx.get('authService'), ctx.get('authMfaService'));
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').deleteGuild({user, guildId}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.get(
+		'/guilds/:guild_id/vanity-url',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_VANITY_URL_GET),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			return ctx.json(await ctx.get('guildService').getVanityURL({userId, guildId}));
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/vanity-url',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_VANITY_URL_PATCH),
+		LoginRequired,
+		DefaultUserOnly,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', z.object({code: VanityURLCodeType.nullish()})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const {code} = ctx.req.valid('json');
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			const {code: newCode} = await ctx
+				.get('guildService')
+				.updateVanityURL({userId, guildId, code: code ?? null, requestCache}, auditLogReason);
+			return ctx.json({code: newCode});
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/text-channel-flexible-names',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', z.object({enabled: z.boolean()})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const {enabled} = ctx.req.valid('json');
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(
+				await ctx
+					.get('guildService')
+					.updateTextChannelFlexibleNamesFeature({userId, guildId, enabled, requestCache}, auditLogReason),
+			);
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/detached-banner',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', z.object({enabled: z.boolean()})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const {enabled} = ctx.req.valid('json');
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(
+				await ctx
+					.get('guildService')
+					.updateDetachedBannerFeature({userId, guildId, enabled, requestCache}, auditLogReason),
+			);
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/disallow-unclaimed-accounts',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', z.object({enabled: z.boolean()})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const {enabled} = ctx.req.valid('json');
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(
+				await ctx
+					.get('guildService')
+					.updateDisallowUnclaimedAccountsFeature({userId, guildId, enabled, requestCache}, auditLogReason),
+			);
+		},
+	);
+};

fluxer_api/src/guild/controllers/GuildChannelController.ts

@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {HonoApp} from '~/App';
+import {createChannelID, createGuildID} from '~/BrandedTypes';
+import {ChannelCreateRequest} from '~/channel/ChannelModel';
+import {LoginRequired} from '~/middleware/AuthMiddleware';
+import {RateLimitMiddleware} from '~/middleware/RateLimitMiddleware';
+import {RateLimitConfigs} from '~/RateLimitConfig';
+import {Int64Type, z} from '~/Schema';
+import {Validator} from '~/Validator';
+
+export const GuildChannelController = (app: HonoApp) => {
+	app.get(
+		'/guilds/:guild_id/channels',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_CHANNELS_LIST),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const requestCache = ctx.get('requestCache');
+			return ctx.json(await ctx.get('guildService').getChannels({userId, guildId, requestCache}));
+		},
+	);
+
+	app.post(
+		'/guilds/:guild_id/channels',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_CHANNEL_CREATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', ChannelCreateRequest),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const data = ctx.req.valid('json');
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(
+				await ctx.get('guildService').createChannel({userId, guildId, data, requestCache}, auditLogReason),
+			);
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/channels',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_CHANNEL_POSITIONS),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator(
+			'json',
+			z.array(
+				z.object({
+					id: Int64Type,
+					position: z.number().int().nonnegative().optional(),
+					parent_id: Int64Type.nullish(),
+					lock_permissions: z.boolean().optional(),
+				}),
+			),
+		),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const payload = ctx.req.valid('json');
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+
+			await ctx.get('guildService').updateChannelPositions(
+				{
+					userId,
+					guildId,
+					updates: payload.map((item) => ({
+						channelId: createChannelID(item.id),
+						position: item.position,
+						parentId: item.parent_id == null ? item.parent_id : createChannelID(item.parent_id),
+						lockPermissions: item.lock_permissions ?? false,
+					})),
+					requestCache,
+				},
+				auditLogReason,
+			);
+			return ctx.body(null, 204);
+		},
+	);
+};

fluxer_api/src/guild/controllers/GuildEmojiController.ts

@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {HonoApp} from '~/App';
+import {createEmojiID, createGuildID} from '~/BrandedTypes';
+import {GuildEmojiBulkCreateRequest, GuildEmojiCreateRequest, GuildEmojiUpdateRequest} from '~/guild/GuildModel';
+import {LoginRequired} from '~/middleware/AuthMiddleware';
+import {RateLimitMiddleware} from '~/middleware/RateLimitMiddleware';
+import {RateLimitConfigs} from '~/RateLimitConfig';
+import {Int64Type, QueryBooleanType, z} from '~/Schema';
+import {Validator} from '~/Validator';
+
+export const GuildEmojiController = (app: HonoApp) => {
+	app.post(
+		'/guilds/:guild_id/emojis',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_EMOJI_CREATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', GuildEmojiCreateRequest),
+		async (ctx) => {
+			const user = ctx.get('user');
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const {name, image} = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').createEmoji({user, guildId, name, image}, auditLogReason));
+		},
+	);
+
+	app.post(
+		'/guilds/:guild_id/emojis/bulk',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_EMOJI_BULK_CREATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', GuildEmojiBulkCreateRequest),
+		async (ctx) => {
+			const user = ctx.get('user');
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const {emojis} = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').bulkCreateEmojis({user, guildId, emojis}, auditLogReason));
+		},
+	);
+
+	app.get(
+		'/guilds/:guild_id/emojis',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_EMOJIS_LIST),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const {guild_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(guild_id);
+			const requestCache = ctx.get('requestCache');
+			return ctx.json(await ctx.get('guildService').getEmojis({userId, guildId, requestCache}));
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/emojis/:emoji_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_EMOJI_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, emoji_id: Int64Type})),
+		Validator('json', GuildEmojiUpdateRequest),
+		async (ctx) => {
+			const {guild_id, emoji_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(guild_id);
+			const emojiId = createEmojiID(emoji_id);
+			const {name} = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').updateEmoji({userId, guildId, emojiId, name}, auditLogReason));
+		},
+	);
+
+	app.delete(
+		'/guilds/:guild_id/emojis/:emoji_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_EMOJI_DELETE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, emoji_id: Int64Type})),
+		Validator('query', z.object({purge: QueryBooleanType.optional()})),
+		async (ctx) => {
+			const {guild_id, emoji_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(guild_id);
+			const emojiId = createEmojiID(emoji_id);
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			const {purge = false} = ctx.req.valid('query');
+			await ctx.get('guildService').deleteEmoji({userId, guildId, emojiId, purge}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+};

fluxer_api/src/guild/controllers/GuildMemberController.ts

@@ -0,0 +1,246 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {HonoApp} from '~/App';
+import {requireSudoMode} from '~/auth/services/SudoVerificationService';
+import {createGuildID, createRoleID, createUserID} from '~/BrandedTypes';
+import {
+	GuildBanCreateRequest,
+	GuildMemberUpdateRequest,
+	GuildTransferOwnershipRequest,
+	MyGuildMemberUpdateRequest,
+} from '~/guild/GuildModel';
+import {LoginRequired} from '~/middleware/AuthMiddleware';
+import {RateLimitMiddleware} from '~/middleware/RateLimitMiddleware';
+import {SudoModeMiddleware} from '~/middleware/SudoModeMiddleware';
+import {RateLimitConfigs} from '~/RateLimitConfig';
+import {Int64Type, SudoVerificationSchema, z} from '~/Schema';
+import {Validator} from '~/Validator';
+
+export const GuildMemberController = (app: HonoApp) => {
+	app.get(
+		'/guilds/:guild_id/members',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBERS),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const requestCache = ctx.get('requestCache');
+			return ctx.json(await ctx.get('guildService').getMembers({userId, guildId, requestCache}));
+		},
+	);
+
+	app.get(
+		'/guilds/:guild_id/members/@me',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBERS),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const requestCache = ctx.get('requestCache');
+			return ctx.json(await ctx.get('guildService').getMember({userId, targetId: userId, guildId, requestCache}));
+		},
+	);
+
+	app.get(
+		'/guilds/:guild_id/members/:user_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBERS),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, user_id: Int64Type})),
+		async (ctx) => {
+			const {guild_id, user_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const targetId = createUserID(user_id);
+			const guildId = createGuildID(guild_id);
+			const requestCache = ctx.get('requestCache');
+			return ctx.json(await ctx.get('guildService').getMember({userId, targetId, guildId, requestCache}));
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/members/@me',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBER_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', MyGuildMemberUpdateRequest),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const requestCache = ctx.get('requestCache');
+			const data = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			const result = await ctx
+				.get('guildService')
+				.updateMember({userId, targetId: userId, guildId, data, requestCache}, auditLogReason);
+			return ctx.json(result);
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/members/:user_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBER_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, user_id: Int64Type})),
+		Validator('json', GuildMemberUpdateRequest),
+		async (ctx) => {
+			const {guild_id, user_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const targetId = createUserID(user_id);
+			const guildId = createGuildID(guild_id);
+			const data = ctx.req.valid('json');
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			const result = await ctx
+				.get('guildService')
+				.updateMember({userId, targetId, guildId, data, requestCache}, auditLogReason);
+			return ctx.json(result);
+		},
+	);
+
+	app.delete(
+		'/guilds/:guild_id/members/:user_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBER_REMOVE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, user_id: Int64Type})),
+		async (ctx) => {
+			const {guild_id, user_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const targetId = createUserID(user_id);
+			const guildId = createGuildID(guild_id);
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').removeMember({userId, targetId, guildId}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.post(
+		'/guilds/:guild_id/transfer-ownership',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		SudoModeMiddleware,
+		Validator('json', GuildTransferOwnershipRequest.merge(SudoVerificationSchema)),
+		async (ctx) => {
+			const user = ctx.get('user');
+			const userId = user.id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const body = ctx.req.valid('json');
+			await requireSudoMode(ctx, user, body, ctx.get('authService'), ctx.get('authMfaService'));
+			const {new_owner_id} = body;
+			const newOwnerId = createUserID(new_owner_id);
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').transferOwnership({userId, guildId, newOwnerId}, auditLogReason));
+		},
+	);
+
+	app.get(
+		'/guilds/:guild_id/bans',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBERS),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const requestCache = ctx.get('requestCache');
+			return ctx.json(await ctx.get('guildService').listBans({userId, guildId, requestCache}));
+		},
+	);
+
+	app.put(
+		'/guilds/:guild_id/bans/:user_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBER_REMOVE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, user_id: Int64Type})),
+		Validator('json', GuildBanCreateRequest),
+		async (ctx) => {
+			const {guild_id, user_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const targetId = createUserID(user_id);
+			const guildId = createGuildID(guild_id);
+			const {delete_message_days, reason, ban_duration_seconds} = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').banMember(
+				{
+					userId,
+					guildId,
+					targetId,
+					deleteMessageDays: delete_message_days,
+					reason: reason ?? undefined,
+					banDurationSeconds: ban_duration_seconds,
+				},
+				auditLogReason,
+			);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.delete(
+		'/guilds/:guild_id/bans/:user_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBER_REMOVE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, user_id: Int64Type})),
+		async (ctx) => {
+			const {guild_id, user_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const targetId = createUserID(user_id);
+			const guildId = createGuildID(guild_id);
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').unbanMember({userId, guildId, targetId}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.put(
+		'/guilds/:guild_id/members/:user_id/roles/:role_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBER_ROLE_ADD),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, user_id: Int64Type, role_id: Int64Type})),
+		async (ctx) => {
+			const {guild_id, user_id, role_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const targetId = createUserID(user_id);
+			const guildId = createGuildID(guild_id);
+			const roleId = createRoleID(role_id);
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').addMemberRole({userId, targetId, guildId, roleId, requestCache}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.delete(
+		'/guilds/:guild_id/members/:user_id/roles/:role_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_MEMBER_ROLE_REMOVE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, user_id: Int64Type, role_id: Int64Type})),
+		async (ctx) => {
+			const {guild_id, user_id, role_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const targetId = createUserID(user_id);
+			const guildId = createGuildID(guild_id);
+			const roleId = createRoleID(role_id);
+			const requestCache = ctx.get('requestCache');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').removeMemberRole({userId, targetId, guildId, roleId, requestCache}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+};

fluxer_api/src/guild/controllers/GuildRoleController.ts

@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {HonoApp} from '~/App';
+import {createGuildID, createRoleID} from '~/BrandedTypes';
+import {GuildRoleCreateRequest, GuildRoleUpdateRequest} from '~/guild/GuildModel';
+import {LoginRequired} from '~/middleware/AuthMiddleware';
+import {RateLimitMiddleware} from '~/middleware/RateLimitMiddleware';
+import {RateLimitConfigs} from '~/RateLimitConfig';
+import {Int64Type, z} from '~/Schema';
+import {Validator} from '~/Validator';
+
+export const GuildRoleController = (app: HonoApp) => {
+	app.get(
+		'/guilds/:guild_id/roles',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_ROLE_LIST),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			return ctx.json(await ctx.get('guildService').listRoles({userId, guildId}));
+		},
+	);
+
+	app.post(
+		'/guilds/:guild_id/roles',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_ROLE_CREATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', GuildRoleCreateRequest),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const data = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').createRole({userId, guildId, data}, auditLogReason));
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/roles/hoist-positions',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_ROLE_HOIST_POSITIONS),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator(
+			'json',
+			z.array(
+				z.object({
+					id: Int64Type,
+					hoist_position: z.number().int(),
+				}),
+			),
+		),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const payload = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').updateHoistPositions(
+				{
+					userId,
+					guildId,
+					updates: payload.map((item) => ({roleId: createRoleID(item.id), hoistPosition: item.hoist_position})),
+				},
+				auditLogReason,
+			);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.delete(
+		'/guilds/:guild_id/roles/hoist-positions',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_ROLE_HOIST_POSITIONS_RESET),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').resetHoistPositions({userId, guildId}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/roles/:role_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_ROLE_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, role_id: Int64Type})),
+		Validator('json', GuildRoleUpdateRequest),
+		async (ctx) => {
+			const {guild_id, role_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(guild_id);
+			const roleId = createRoleID(role_id);
+			const data = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').updateRole({userId, guildId, roleId, data}, auditLogReason));
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/roles',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_ROLE_POSITIONS),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator(
+			'json',
+			z.array(
+				z.object({
+					id: Int64Type,
+					position: z.number().int().optional(),
+				}),
+			),
+		),
+		async (ctx) => {
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const payload = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').updateRolePositions(
+				{
+					userId,
+					guildId,
+					updates: payload.map((item) => ({roleId: createRoleID(item.id), position: item.position})),
+				},
+				auditLogReason,
+			);
+			return ctx.body(null, 204);
+		},
+	);
+
+	app.delete(
+		'/guilds/:guild_id/roles/:role_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_ROLE_DELETE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, role_id: Int64Type})),
+		async (ctx) => {
+			const {guild_id, role_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(guild_id);
+			const roleId = createRoleID(role_id);
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			await ctx.get('guildService').deleteRole({userId, guildId, roleId}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+};

fluxer_api/src/guild/controllers/GuildStickerController.ts

@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {HonoApp} from '~/App';
+import {createGuildID, createStickerID} from '~/BrandedTypes';
+import {GuildStickerBulkCreateRequest, GuildStickerCreateRequest, GuildStickerUpdateRequest} from '~/guild/GuildModel';
+import {LoginRequired} from '~/middleware/AuthMiddleware';
+import {RateLimitMiddleware} from '~/middleware/RateLimitMiddleware';
+import {RateLimitConfigs} from '~/RateLimitConfig';
+import {Int64Type, QueryBooleanType, z} from '~/Schema';
+import {Validator} from '~/Validator';
+
+export const GuildStickerController = (app: HonoApp) => {
+	app.post(
+		'/guilds/:guild_id/stickers',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_STICKER_CREATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', GuildStickerCreateRequest),
+		async (ctx) => {
+			const user = ctx.get('user');
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const {name, description, tags, image} = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(
+				await ctx.get('guildService').createSticker({user, guildId, name, description, tags, image}, auditLogReason),
+			);
+		},
+	);
+
+	app.post(
+		'/guilds/:guild_id/stickers/bulk',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_STICKER_BULK_CREATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		Validator('json', GuildStickerBulkCreateRequest),
+		async (ctx) => {
+			const user = ctx.get('user');
+			const guildId = createGuildID(ctx.req.valid('param').guild_id);
+			const {stickers} = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(await ctx.get('guildService').bulkCreateStickers({user, guildId, stickers}, auditLogReason));
+		},
+	);
+
+	app.get(
+		'/guilds/:guild_id/stickers',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_STICKERS_LIST),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type})),
+		async (ctx) => {
+			const {guild_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(guild_id);
+			const requestCache = ctx.get('requestCache');
+			return ctx.json(await ctx.get('guildService').getStickers({userId, guildId, requestCache}));
+		},
+	);
+
+	app.patch(
+		'/guilds/:guild_id/stickers/:sticker_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_STICKER_UPDATE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, sticker_id: Int64Type})),
+		Validator('json', GuildStickerUpdateRequest),
+		async (ctx) => {
+			const {guild_id, sticker_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(guild_id);
+			const stickerId = createStickerID(sticker_id);
+			const {name, description, tags} = ctx.req.valid('json');
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			return ctx.json(
+				await ctx
+					.get('guildService')
+					.updateSticker({userId, guildId, stickerId, name, description, tags}, auditLogReason),
+			);
+		},
+	);
+
+	app.delete(
+		'/guilds/:guild_id/stickers/:sticker_id',
+		RateLimitMiddleware(RateLimitConfigs.GUILD_STICKER_DELETE),
+		LoginRequired,
+		Validator('param', z.object({guild_id: Int64Type, sticker_id: Int64Type})),
+		Validator('query', z.object({purge: QueryBooleanType.optional()})),
+		async (ctx) => {
+			const {guild_id, sticker_id} = ctx.req.valid('param');
+			const userId = ctx.get('user').id;
+			const guildId = createGuildID(guild_id);
+			const stickerId = createStickerID(sticker_id);
+			const auditLogReason = ctx.get('auditLogReason') ?? null;
+			const {purge = false} = ctx.req.valid('query');
+			await ctx.get('guildService').deleteSticker({userId, guildId, stickerId, purge}, auditLogReason);
+			return ctx.body(null, 204);
+		},
+	);
+};

fluxer_api/src/guild/controllers/index.ts

@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {HonoApp} from '~/App';
+import {GuildAuditLogController} from './GuildAuditLogController';
+import {GuildBaseController} from './GuildBaseController';
+import {GuildChannelController} from './GuildChannelController';
+import {GuildEmojiController} from './GuildEmojiController';
+import {GuildMemberController} from './GuildMemberController';
+import {GuildRoleController} from './GuildRoleController';
+import {GuildStickerController} from './GuildStickerController';
+
+export const registerGuildControllers = (app: HonoApp) => {
+	GuildBaseController(app);
+	GuildMemberController(app);
+	GuildRoleController(app);
+	GuildChannelController(app);
+	GuildEmojiController(app);
+	GuildStickerController(app);
+	GuildAuditLogController(app);
+};