feat(admin): add a snowflake reservation system (#34)

This commit is contained in:
hampus-fluxer
2026-01-06 00:17:27 +01:00
committed by GitHub
parent 8658a25f68
commit 9c665413ac
19 changed files with 1100 additions and 244 deletions

View File

@@ -23,4 +23,5 @@ export * from './constants/Channel';
export * from './constants/Core';
export * from './constants/Gateway';
export * from './constants/Guild';
export * from './constants/InstanceConfig';
export * from './constants/User';

View File

@@ -34,6 +34,7 @@ import type {PendingJoinInviteStore} from '~/infrastructure/PendingJoinInviteSto
import type {RedisBulkMessageDeletionQueueService} from '~/infrastructure/RedisBulkMessageDeletionQueueService';
import type {SnowflakeService} from '~/infrastructure/SnowflakeService';
import type {UserCacheService} from '~/infrastructure/UserCacheService';
import {SnowflakeReservationRepository} from '~/instance/SnowflakeReservationRepository';
import type {InviteRepository} from '~/invite/InviteRepository';
import type {InviteService} from '~/invite/InviteService';
import type {RequestCache} from '~/middleware/RequestCacheMiddleware';
@@ -107,6 +108,7 @@ import {AdminMessageService} from './services/AdminMessageService';
import {AdminMessageShredService} from './services/AdminMessageShredService';
import {AdminReportService} from './services/AdminReportService';
import {AdminSearchService} from './services/AdminSearchService';
import {AdminSnowflakeReservationService} from './services/AdminSnowflakeReservationService';
import {AdminUserService} from './services/AdminUserService';
import {AdminVoiceService} from './services/AdminVoiceService';
@@ -133,6 +135,7 @@ export class AdminService {
private readonly searchService: AdminSearchService;
private readonly codeGenerationService: AdminCodeGenerationService;
private readonly assetPurgeService: AdminAssetPurgeService;
private readonly snowflakeReservationService: AdminSnowflakeReservationService;
constructor(
private readonly userRepository: IUserRepository,
@@ -235,6 +238,12 @@ export class AdminService {
snowflakeService: this.snowflakeService,
auditService: this.auditService,
});
this.snowflakeReservationService = new AdminSnowflakeReservationService({
repository: new SnowflakeReservationRepository(),
cacheService: this.cacheService,
auditService: this.auditService,
});
this.codeGenerationService = new AdminCodeGenerationService(this.userRepository);
}
@@ -242,6 +251,22 @@ export class AdminService {
return this.userService.lookupUser(data);
}
async listSnowflakeReservations() {
return this.snowflakeReservationService.listReservations();
}
async setSnowflakeReservation(
data: {email: string; snowflake: string},
adminUserId: UserID,
auditLogReason: string | null,
) {
return this.snowflakeReservationService.setReservation(data, adminUserId, auditLogReason);
}
async deleteSnowflakeReservation(data: {email: string}, adminUserId: UserID, auditLogReason: string | null) {
return this.snowflakeReservationService.deleteReservation(data, adminUserId, auditLogReason);
}
async updateUserFlags(args: {
userId: UserID;
data: {addFlags: Array<bigint>; removeFlags: Array<bigint>};

View File

@@ -0,0 +1,85 @@
/*
* Copyright (C) 2026 Fluxer Contributors
*
* This file is part of Fluxer.
*
* Fluxer is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Fluxer is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
*/
import type {HonoApp} from '~/App';
import type {
AddSnowflakeReservationRequest,
DeleteSnowflakeReservationRequest,
ListSnowflakeReservationsResponse,
} from '~/admin/models/SnowflakeReservationTypes';
import {AdminACLs} from '~/Constants';
import {requireAdminACL} from '~/middleware/AdminMiddleware';
import {RateLimitMiddleware} from '~/middleware/RateLimitMiddleware';
import {RateLimitConfigs} from '~/RateLimitConfig';
import {EmailType, Int64Type, z} from '~/Schema';
import {Validator} from '~/Validator';
export const SnowflakeReservationAdminController = (app: HonoApp) => {
app.post(
'/admin/snowflake-reservations/list',
RateLimitMiddleware(RateLimitConfigs.ADMIN_LOOKUP),
requireAdminACL(AdminACLs.INSTANCE_SNOWFLAKE_RESERVATION_VIEW),
async (ctx) => {
const adminService = ctx.get('adminService');
const reservations = await adminService.listSnowflakeReservations();
return ctx.json<ListSnowflakeReservationsResponse>({
reservations,
});
},
);
app.post(
'/admin/snowflake-reservations/add',
RateLimitMiddleware(RateLimitConfigs.ADMIN_USER_MODIFY),
requireAdminACL(AdminACLs.INSTANCE_SNOWFLAKE_RESERVATION_MANAGE),
Validator(
'json',
z.object({
email: EmailType,
snowflake: Int64Type.transform((val) => val.toString()),
}),
),
async (ctx) => {
const adminService = ctx.get('adminService');
const adminUserId = ctx.get('adminUserId');
const auditLogReason = ctx.get('auditLogReason');
const data = ctx.req.valid('json') as AddSnowflakeReservationRequest;
await adminService.setSnowflakeReservation(data, adminUserId, auditLogReason);
return ctx.json({success: true});
},
);
app.post(
'/admin/snowflake-reservations/delete',
RateLimitMiddleware(RateLimitConfigs.ADMIN_USER_MODIFY),
requireAdminACL(AdminACLs.INSTANCE_SNOWFLAKE_RESERVATION_MANAGE),
Validator('json', z.object({email: EmailType})),
async (ctx) => {
const adminService = ctx.get('adminService');
const adminUserId = ctx.get('adminUserId');
const auditLogReason = ctx.get('auditLogReason');
const data = ctx.req.valid('json') as DeleteSnowflakeReservationRequest;
await adminService.deleteSnowflakeReservation(data, adminUserId, auditLogReason);
return ctx.json({success: true});
},
);
};

View File

@@ -31,6 +31,7 @@ import {InstanceConfigAdminController} from './InstanceConfigAdminController';
import {MessageAdminController} from './MessageAdminController';
import {ReportAdminController} from './ReportAdminController';
import {SearchAdminController} from './SearchAdminController';
import {SnowflakeReservationAdminController} from './SnowflakeReservationAdminController';
import {UserAdminController} from './UserAdminController';
import {VerificationAdminController} from './VerificationAdminController';
import {VoiceAdminController} from './VoiceAdminController';
@@ -42,6 +43,7 @@ export const registerAdminControllers = (app: HonoApp) => {
AssetAdminController(app);
BanAdminController(app);
InstanceConfigAdminController(app);
SnowflakeReservationAdminController(app);
MessageAdminController(app);
BulkAdminController(app);
AuditLogAdminController(app);

View File

@@ -0,0 +1,37 @@
/*
* Copyright (C) 2026 Fluxer Contributors
*
* This file is part of Fluxer.
*
* Fluxer is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Fluxer is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
*/
export interface SnowflakeReservationEntry {
email: string;
snowflake: string;
updated_at: string | null;
}
export interface ListSnowflakeReservationsResponse {
reservations: Array<SnowflakeReservationEntry>;
}
export interface AddSnowflakeReservationRequest {
email: string;
snowflake: string;
}
export interface DeleteSnowflakeReservationRequest {
email: string;
}

View File

@@ -25,6 +25,7 @@ export * from './CodeRequestTypes';
export * from './GuildRequestTypes';
export * from './GuildTypes';
export * from './MessageTypes';
export * from './SnowflakeReservationTypes';
export * from './UserRequestTypes';
export * from './UserTypes';
export * from './VoiceTypes';

View File

@@ -0,0 +1,97 @@
/*
* Copyright (C) 2026 Fluxer Contributors
*
* This file is part of Fluxer.
*
* Fluxer is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Fluxer is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
*/
import type {UserID} from '~/BrandedTypes';
import {SNOWFLAKE_RESERVATION_REFRESH_CHANNEL} from '~/constants/InstanceConfig';
import {InputValidationError} from '~/Errors';
import type {ICacheService} from '~/infrastructure/ICacheService';
import type {SnowflakeReservationRepository} from '~/instance/SnowflakeReservationRepository';
import type {AdminAuditService} from './AdminAuditService';
interface AdminSnowflakeReservationServiceDeps {
repository: SnowflakeReservationRepository;
cacheService: ICacheService;
auditService: AdminAuditService;
}
export class AdminSnowflakeReservationService {
constructor(private readonly deps: AdminSnowflakeReservationServiceDeps) {}
async listReservations() {
const {repository} = this.deps;
const entries = await repository.listReservations();
return entries.map((entry) => ({
email: entry.emailKey,
snowflake: entry.snowflake.toString(),
updated_at: entry.updatedAt ? entry.updatedAt.toISOString() : null,
}));
}
async setReservation(data: {email: string; snowflake: string}, adminUserId: UserID, auditLogReason: string | null) {
const {repository, cacheService, auditService} = this.deps;
const emailLower = data.email.toLowerCase();
if (!emailLower) {
throw InputValidationError.create('email', 'Invalid email address');
}
let snowflakeValue: bigint;
try {
snowflakeValue = BigInt(data.snowflake);
} catch {
throw InputValidationError.create('snowflake', 'Invalid snowflake');
}
await repository.setReservation(emailLower, snowflakeValue);
await cacheService.publish(SNOWFLAKE_RESERVATION_REFRESH_CHANNEL, 'refresh');
await auditService.createAuditLog({
adminUserId,
targetType: 'snowflake_reservation',
targetId: BigInt(0),
action: 'set_snowflake_reservation',
auditLogReason,
metadata: new Map([
['email', emailLower],
['snowflake', snowflakeValue.toString()],
]),
});
}
async deleteReservation(data: {email: string}, adminUserId: UserID, auditLogReason: string | null) {
const {repository, cacheService, auditService} = this.deps;
const emailLower = data.email.toLowerCase();
if (!emailLower) {
throw InputValidationError.create('email', 'Invalid email address');
}
await repository.deleteReservation(emailLower);
await cacheService.publish(SNOWFLAKE_RESERVATION_REFRESH_CHANNEL, 'refresh');
await auditService.createAuditLog({
adminUserId,
targetType: 'snowflake_reservation',
targetId: BigInt(0),
action: 'delete_snowflake_reservation',
auditLogReason,
metadata: new Map([['email', emailLower]]),
});
}
}

View File

@@ -49,6 +49,7 @@ import type {PendingJoinInviteStore} from '~/infrastructure/PendingJoinInviteSto
import type {RedisAccountDeletionQueueService} from '~/infrastructure/RedisAccountDeletionQueueService';
import type {RedisActivityTracker} from '~/infrastructure/RedisActivityTracker';
import type {SnowflakeService} from '~/infrastructure/SnowflakeService';
import type {SnowflakeReservationService} from '~/instance/SnowflakeReservationService';
import type {InviteService} from '~/invite/InviteService';
import type {AuthSession, User} from '~/Models';
import type {RequestCache} from '~/middleware/RequestCacheMiddleware';
@@ -157,6 +158,7 @@ export class AuthService implements IAuthService {
emailServiceDep: IEmailService,
smsService: ISMSService,
snowflakeService: SnowflakeService,
snowflakeReservationService: SnowflakeReservationService,
discriminatorService: IDiscriminatorService,
redisAccountDeletionQueue: RedisAccountDeletionQueueService,
redisActivityTracker: RedisActivityTracker,
@@ -200,6 +202,7 @@ export class AuthService implements IAuthService {
rateLimitService,
emailServiceDep,
snowflakeService,
snowflakeReservationService,
discriminatorService,
redisActivityTracker,
pendingJoinInviteStore,

View File

@@ -17,7 +17,6 @@
* along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
*/
import crypto from 'node:crypto';
import Bowser from 'bowser';
import {types} from 'cassandra-driver';
import type {RegisterRequest} from '~/auth/AuthModel';
@@ -34,6 +33,7 @@ import type {PendingJoinInviteStore} from '~/infrastructure/PendingJoinInviteSto
import type {RedisActivityTracker} from '~/infrastructure/RedisActivityTracker';
import type {SnowflakeService} from '~/infrastructure/SnowflakeService';
import {InstanceConfigRepository} from '~/instance/InstanceConfigRepository';
import type {SnowflakeReservationService} from '~/instance/SnowflakeReservationService';
import type {InviteService} from '~/invite/InviteService';
import {Logger} from '~/Logger';
import {getUserSearchService} from '~/Meilisearch';
@@ -134,15 +134,6 @@ function parseDobLocalDate(dateOfBirth: string): types.LocalDate {
}
}
function safeJsonParse<T>(value: string): T | null {
try {
return JSON.parse(value) as T;
} catch (error) {
Logger.warn({error}, 'Failed to parse JSON from environment variable');
return null;
}
}
interface RegisterParams {
data: RegisterRequest;
request: Request;
@@ -158,6 +149,7 @@ export class AuthRegistrationService {
private rateLimitService: IRateLimitService,
private emailService: IEmailService,
private snowflakeService: SnowflakeService,
private snowflakeReservationService: SnowflakeReservationService,
private discriminatorService: IDiscriminatorService,
private redisActivityTracker: RedisActivityTracker,
private pendingJoinInviteStore: PendingJoinInviteStore,
@@ -457,23 +449,12 @@ export class AuthRegistrationService {
}
private generateUserId(emailKey: string | null): UserID {
const mappingJson = process.env.EARLY_TESTER_EMAIL_HASH_TO_SNOWFLAKE;
if (emailKey && mappingJson) {
const mapping = safeJsonParse<Record<string, string>>(mappingJson);
if (mapping) {
const emailHash = crypto.createHash('sha256').update(emailKey).digest('hex');
const mapped = mapping[emailHash];
if (mapped) {
try {
return createUserID(BigInt(mapped));
} catch (error) {
Logger.warn({error}, 'Invalid snowflake mapping value; falling back to generated ID');
}
}
if (emailKey) {
const reserved = this.snowflakeReservationService.getReservedSnowflake(emailKey);
if (reserved) {
return createUserID(reserved);
}
}
return createUserID(this.snowflakeService.generate());
}

View File

@@ -279,6 +279,8 @@ export const AdminACLs = {
INSTANCE_CONFIG_VIEW: 'instance:config:view',
INSTANCE_CONFIG_UPDATE: 'instance:config:update',
INSTANCE_SNOWFLAKE_RESERVATION_VIEW: 'instance:snowflake_reservation:view',
INSTANCE_SNOWFLAKE_RESERVATION_MANAGE: 'instance:snowflake_reservation:manage',
METRICS_VIEW: 'metrics:view',

View File

@@ -0,0 +1,21 @@
/*
* Copyright (C) 2026 Fluxer Contributors
*
* This file is part of Fluxer.
*
* Fluxer is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Fluxer is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
*/
export const SNOWFLAKE_RESERVATION_KEY_PREFIX = 'snowflake_reservation:';
export const SNOWFLAKE_RESERVATION_REFRESH_CHANNEL = 'snowflake_reservation:refresh';

View File

@@ -0,0 +1,81 @@
/*
* Copyright (C) 2026 Fluxer Contributors
*
* This file is part of Fluxer.
*
* Fluxer is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Fluxer is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
*/
import {SNOWFLAKE_RESERVATION_KEY_PREFIX} from '~/constants/InstanceConfig';
import {deleteOneOrMany, fetchMany, upsertOne} from '~/database/Cassandra';
import type {InstanceConfigurationRow} from '~/database/CassandraTypes';
import {Logger} from '~/Logger';
import {InstanceConfiguration} from '~/Tables';
const FETCH_ALL_CONFIG_QUERY = InstanceConfiguration.selectCql();
export interface SnowflakeReservationConfig {
emailKey: string;
snowflake: bigint;
updatedAt: Date | null;
}
export class SnowflakeReservationRepository {
async listReservations(): Promise<Array<SnowflakeReservationConfig>> {
const rows = await fetchMany<InstanceConfigurationRow>(FETCH_ALL_CONFIG_QUERY, {});
const reservations: Array<SnowflakeReservationConfig> = [];
for (const row of rows) {
if (!row.key.startsWith(SNOWFLAKE_RESERVATION_KEY_PREFIX) || row.value == null || row.value.trim().length === 0) {
continue;
}
const emailKey = row.key.slice(SNOWFLAKE_RESERVATION_KEY_PREFIX.length);
if (!emailKey) continue;
const snowflakeString = row.value.trim();
try {
const snowflake = BigInt(snowflakeString);
reservations.push({
emailKey,
snowflake,
updatedAt: row.updated_at ?? null,
});
} catch (error) {
Logger.warn({key: row.key, value: row.value, error}, 'Skipping invalid snowflake reservation value');
}
}
return reservations;
}
async setReservation(emailKey: string, snowflake: bigint): Promise<void> {
await upsertOne(
InstanceConfiguration.upsertAll({
key: `${SNOWFLAKE_RESERVATION_KEY_PREFIX}${emailKey}`,
value: snowflake.toString(),
updated_at: new Date(),
}),
);
}
async deleteReservation(emailKey: string): Promise<void> {
await deleteOneOrMany(
InstanceConfiguration.deleteCql({
where: InstanceConfiguration.where.eq('key'),
}),
{key: `${SNOWFLAKE_RESERVATION_KEY_PREFIX}${emailKey}`},
);
}
}

View File

@@ -0,0 +1,93 @@
/*
* Copyright (C) 2026 Fluxer Contributors
*
* This file is part of Fluxer.
*
* Fluxer is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Fluxer is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
*/
import type {Redis} from 'ioredis';
import {SNOWFLAKE_RESERVATION_REFRESH_CHANNEL} from '~/constants/InstanceConfig';
import {Logger} from '~/Logger';
import type {SnowflakeReservationConfig, SnowflakeReservationRepository} from './SnowflakeReservationRepository';
export class SnowflakeReservationService {
private reservations = new Map<string, bigint>();
private initialized = false;
private reloadPromise: Promise<void> | null = null;
constructor(
private repository: SnowflakeReservationRepository,
private redisSubscriber: Redis | null,
) {}
async initialize(): Promise<void> {
if (this.initialized) {
return;
}
await this.reload();
this.initialized = true;
if (this.redisSubscriber) {
try {
await this.redisSubscriber.subscribe(SNOWFLAKE_RESERVATION_REFRESH_CHANNEL);
this.redisSubscriber.on('message', (channel) => {
if (channel === SNOWFLAKE_RESERVATION_REFRESH_CHANNEL) {
this.reload().catch((error) => {
Logger.error({error}, 'Failed to reload snowflake reservations');
});
}
});
} catch (error) {
Logger.error({error}, 'Failed to subscribe to snowflake reservation refresh channel');
}
}
}
async reload(): Promise<void> {
if (this.reloadPromise) {
return this.reloadPromise;
}
this.reloadPromise = (async () => {
const entries = await this.repository.listReservations();
this.reservations = this.buildLookup(entries);
})()
.catch((error) => {
Logger.error({error}, 'Failed to reload snowflake reservations from the database');
throw error;
})
.finally(() => {
this.reloadPromise = null;
});
return this.reloadPromise;
}
getReservedSnowflake(emailKey: string | null): bigint | null {
if (!emailKey) {
return null;
}
return this.reservations.get(emailKey) ?? null;
}
private buildLookup(entries: Array<SnowflakeReservationConfig>): Map<string, bigint> {
const lookup = new Map<string, bigint>();
for (const entry of entries) {
lookup.set(entry.emailKey, entry.snowflake);
}
return lookup;
}
}

View File

@@ -77,6 +77,8 @@ import {UnfurlerService as ProdUnfurlerService} from '~/infrastructure/UnfurlerS
import {UserCacheService} from '~/infrastructure/UserCacheService';
import {VirusScanService as ProdVirusScanService} from '~/infrastructure/VirusScanService';
import {VoiceRoomStore} from '~/infrastructure/VoiceRoomStore';
import {SnowflakeReservationRepository} from '~/instance/SnowflakeReservationRepository';
import {SnowflakeReservationService} from '~/instance/SnowflakeReservationService';
import {InviteRepository as ProdInviteRepository} from '~/invite/InviteRepository';
import {InviteService} from '~/invite/InviteService';
import {getReportSearchService} from '~/Meilisearch';
@@ -145,6 +147,13 @@ const assetDeletionQueue: IAssetDeletionQueue = new AssetDeletionQueue(redis);
const featureFlagRepository = new FeatureFlagRepository();
const featureFlagService = new FeatureFlagService(featureFlagRepository, cacheService);
let featureFlagServiceInitialized = false;
const snowflakeReservationRepository = new SnowflakeReservationRepository();
const snowflakeReservationSubscriber = new Redis(Config.redis.url);
const snowflakeReservationService = new SnowflakeReservationService(
snowflakeReservationRepository,
snowflakeReservationSubscriber,
);
let snowflakeReservationServiceInitialized = false;
let voiceTopology: VoiceTopology | null = null;
let voiceAvailabilityService: VoiceAvailabilityService | null = null;
@@ -198,6 +207,11 @@ export const ServiceMiddleware = createMiddleware<HonoEnv>(async (ctx, next) =>
featureFlagServiceInitialized = true;
}
if (!snowflakeReservationServiceInitialized) {
await snowflakeReservationService.initialize();
snowflakeReservationServiceInitialized = true;
}
const userRepository = new UserRepository();
const guildRepository = new GuildRepository();
const channelRepository = new ChannelRepository();
@@ -377,6 +391,7 @@ export const ServiceMiddleware = createMiddleware<HonoEnv>(async (ctx, next) =>
emailService,
smsService,
snowflakeService,
snowflakeReservationService,
discriminatorService,
redisAccountDeletionQueue,
redisActivityTracker,