restructure to single project

src/Server.ts

@@ -0,0 +1,101 @@
+process.on("unhandledRejection", console.error);
+process.on("uncaughtException", console.error);
+
+import http from "http";
+import * as Api from "@fosscord/api";
+import * as Gateway from "@fosscord/gateway";
+import { CDNServer } from "@fosscord/cdn";
+import express from "express";
+import { green, bold, yellow } from "picocolors";
+import { Config, getOrInitialiseDatabase } from "@fosscord/util";
+import * as Sentry from "@sentry/node";
+import * as Tracing from "@sentry/tracing";
+// import { PluginLoader } from "@fosscord/util";
+
+const app = express();
+const server = http.createServer();
+const port = Number(process.env.PORT) || 3001;
+const production = process.env.NODE_ENV == "development" ? false : true;
+server.on("request", app);
+
+// @ts-ignore
+const api = new Api.FosscordServer({ server, port, production, app });
+// @ts-ignore
+const cdn = new CDNServer({ server, port, production, app });
+// @ts-ignore
+const gateway = new Gateway.Server({ server, port, production });
+
+//this is what has been added for the /stop API route
+process.on('SIGTERM', () => {
+	setTimeout(()=>process.exit(0), 3000)
+	server.close(() => {
+		console.log("Stop API has been successfully POSTed, SIGTERM sent")
+	})
+})
+//this is what has been added for the /stop API route
+
+async function main() {
+	server.listen(port);
+	await getOrInitialiseDatabase();
+	await Config.init();
+	// only set endpointPublic, if not already set
+	await Config.set({
+		cdn: {
+			endpointClient: "${location.host}",
+			endpointPrivate: `http://localhost:${port}`,
+		},
+		gateway: {
+			endpointClient:
+				'${location.protocol === "https:" ? "wss://" : "ws://"}${location.host}',
+			endpointPrivate: `ws://localhost:${port}`,
+			...(!Config.get().gateway.endpointPublic && {
+				endpointPublic: `ws://localhost:${port}`,
+			}),
+		},
+		// regions: {
+		// 	default: "fosscord",
+		// 	useDefaultAsOptimal: true,
+		// 	available: [
+		// 		{
+		// 			id: "fosscord",
+		// 			name: "Fosscord",
+		// 			endpoint: "127.0.0.1:3001",
+		// 			vip: false,
+		// 			custom: false,
+		// 			deprecated: false,
+		// 		},
+		// 	],
+		// },
+	} as any);
+
+	//Sentry
+	if (Config.get().sentry.enabled) {
+		console.log(
+			`[Bundle] ${yellow("You are using Sentry! This may slightly impact performance on large loads!")}`
+		);
+		Sentry.init({
+			dsn: Config.get().sentry.endpoint,
+			integrations: [
+				new Sentry.Integrations.Http({ tracing: true }),
+				new Tracing.Integrations.Express({ app }),
+			],
+			tracesSampleRate: Config.get().sentry.traceSampleRate,
+			environment: Config.get().sentry.environment
+		});
+
+		app.use(Sentry.Handlers.requestHandler());
+		app.use(Sentry.Handlers.tracingHandler());
+	}
+	await Promise.all([api.start(), cdn.start(), gateway.start()]);
+	if (Config.get().sentry.enabled) {
+		app.use(Sentry.Handlers.errorHandler());
+		app.use(function onError(err: any, req: any, res: any, next: any) {
+			res.statusCode = 500;
+			res.end(res.sentry + "\n");
+		});
+	}
+	console.log(`[Server] ${green(`listening on port ${bold(port)}`)}`);
+	// PluginLoader.loadPlugins();
+}
+
+main().catch(console.error);

src/api/Server.ts

@@ -0,0 +1,92 @@
+import { Server, ServerOptions } from "lambert-server";
+import { Authentication, CORS } from "./middlewares/";
+import { Config, getOrInitialiseDatabase, initEvent, registerRoutes } from "@fosscord/util";
+import { ErrorHandler } from "./middlewares/ErrorHandler";
+import { BodyParser } from "./middlewares/BodyParser";
+import { Router, Request, Response, NextFunction } from "express";
+import path from "path";
+import { initRateLimits } from "./middlewares/RateLimit";
+import TestClient from "./middlewares/TestClient";
+import { initTranslation } from "./middlewares/Translation";
+import morgan from "morgan";
+import { initInstance } from "./util/handlers/Instance";
+import { red } from "picocolors"
+
+export interface FosscordServerOptions extends ServerOptions {}
+
+declare global {
+	namespace Express {
+		interface Request {
+			// @ts-ignore
+			server: FosscordServer;
+		}
+	}
+}
+
+export class FosscordServer extends Server {
+	public declare options: FosscordServerOptions;
+
+	constructor(opts?: Partial<FosscordServerOptions>) {
+		// @ts-ignore
+		super({ ...opts, errorHandler: false, jsonBody: false });
+	}
+
+	async start() {
+		await getOrInitialiseDatabase();
+		await Config.init();
+		await initEvent();
+		await initInstance();
+
+		let logRequests = process.env["LOG_REQUESTS"] != undefined;
+		if (logRequests) {
+			this.app.use(
+				morgan("combined", {
+					skip: (req, res) => {
+						let skip = !(process.env["LOG_REQUESTS"]?.includes(res.statusCode.toString()) ?? false);
+						if (process.env["LOG_REQUESTS"]?.charAt(0) == "-") skip = !skip;
+						return skip;
+					}
+				})
+			);
+		}
+
+		this.app.use(CORS);
+		this.app.use(BodyParser({ inflate: true, limit: "10mb" }));
+
+		const app = this.app;
+		const api = Router(); // @ts-ignore
+		this.app = api;
+
+		api.use(Authentication);
+		await initRateLimits(api);
+		await initTranslation(api);
+
+		this.routes = await registerRoutes(this, path.join(__dirname, "routes", "/"));
+
+		api.use("*", (error: any, req: Request, res: Response, next: NextFunction) => {
+			if (error) return next(error);
+			res.status(404).json({
+				message: "404 endpoint not found",
+				code: 0
+			});
+			next();
+		});
+
+		this.app = app;
+
+		//app.use("/__development", )
+		//app.use("/__internals", )
+		app.use("/api/v6", api);
+		app.use("/api/v7", api);
+		app.use("/api/v8", api);
+		app.use("/api/v9", api);
+		app.use("/api", api); // allow unversioned requests
+
+		this.app.use(ErrorHandler);
+		TestClient(this.app);
+
+		if (logRequests) console.log(red(`Warning: Request logging is enabled! This will spam your console!\nTo disable this, unset the 'LOG_REQUESTS' environment variable!`));
+		
+		return super.start();
+	}
+}

src/api/global.d.ts

@@ -0,0 +1,8 @@
+declare global {
+	namespace Express {
+		interface Request {
+			user_id: any;
+			token: any;
+		}
+	}
+}

src/api/index.ts

@@ -0,0 +1,3 @@
+export * from "./Server";
+export * from "./middlewares/";
+export * from "./util/";

src/api/middlewares/Authentication.ts

@@ -0,0 +1,72 @@
+import { NextFunction, Request, Response } from "express";
+import { HTTPError } from "@fosscord/util";
+import { checkToken, Config, Rights } from "@fosscord/util";
+
+export const NO_AUTHORIZATION_ROUTES = [
+	// Authentication routes
+	"/auth/login",
+	"/auth/register",
+	"/auth/location-metadata",
+	"/auth/mfa/totp",
+	// Routes with a seperate auth system
+	"/webhooks/",
+	// Public information endpoints 
+	"/ping",
+	"/gateway",
+	"/experiments",
+	"/updates",
+	"/downloads/",
+	"/scheduled-maintenances/upcoming.json",
+	// Public kubernetes integration
+	"/-/readyz",
+	"/-/healthz",
+	// Client analytics
+	"/science",
+	"/track",
+	// Public policy pages
+	"/policies/instance",
+	// Asset delivery
+	/\/guilds\/\d+\/widget\.(json|png)/
+];
+
+export const API_PREFIX = /^\/api(\/v\d+)?/;
+export const API_PREFIX_TRAILING_SLASH = /^\/api(\/v\d+)?\//;
+
+declare global {
+	namespace Express {
+		interface Request {
+			user_id: string;
+			user_bot: boolean;
+			token: string;
+			rights: Rights;
+		}
+	}
+}
+
+export async function Authentication(req: Request, res: Response, next: NextFunction) {
+	if (req.method === "OPTIONS") return res.sendStatus(204);
+	const url = req.url.replace(API_PREFIX, "");
+	if (url.startsWith("/invites") && req.method === "GET") return next();
+	if (
+		NO_AUTHORIZATION_ROUTES.some((x) => {
+			if (typeof x === "string") return url.startsWith(x);
+			return x.test(url);
+		})
+	)
+		return next();
+	if (!req.headers.authorization) return next(new HTTPError("Missing Authorization Header", 401));
+
+	try {
+		const { jwtSecret } = Config.get().security;
+
+		const { decoded, user }: any = await checkToken(req.headers.authorization, jwtSecret);
+
+		req.token = decoded;
+		req.user_id = decoded.id;
+		req.user_bot = user.bot;
+		req.rights = new Rights(Number(user.rights));
+		return next();
+	} catch (error: any) {
+		return next(new HTTPError(error?.toString(), 400));
+	}
+}

src/api/middlewares/BodyParser.ts

@@ -0,0 +1,19 @@
+import bodyParser, { OptionsJson } from "body-parser";
+import { NextFunction, Request, Response } from "express";
+import { HTTPError } from "@fosscord/util";
+
+export function BodyParser(opts?: OptionsJson) {
+	const jsonParser = bodyParser.json(opts);
+
+	return (req: Request, res: Response, next: NextFunction) => {
+		if (!req.headers["content-type"]) req.headers["content-type"] = "application/json";
+
+		jsonParser(req, res, (err) => {
+			if (err) {
+				// TODO: different errors for body parser (request size limit, wrong body type, invalid body, ...)
+				return next(new HTTPError("Invalid Body", 400));
+			}
+			next();
+		});
+	};
+}

src/api/middlewares/CORS.ts

@@ -0,0 +1,16 @@
+import { NextFunction, Request, Response } from "express";
+
+// TODO: config settings
+
+export function CORS(req: Request, res: Response, next: NextFunction) {
+	res.set("Access-Control-Allow-Origin", "*");
+	// TODO: use better CSP
+	res.set(
+		"Content-security-policy",
+		"default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: ; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';"
+	);
+	res.set("Access-Control-Allow-Headers", req.header("Access-Control-Request-Headers") || "*");
+	res.set("Access-Control-Allow-Methods", req.header("Access-Control-Request-Methods") || "*");
+
+	next();
+}

src/api/middlewares/ErrorHandler.ts

@@ -0,0 +1,44 @@
+import { NextFunction, Request, Response } from "express";
+import { HTTPError } from "@fosscord/util";
+import { ApiError, FieldError } from "@fosscord/util";
+const EntityNotFoundErrorRegex = /"(\w+)"/;
+
+export function ErrorHandler(error: Error, req: Request, res: Response, next: NextFunction) {
+	if (!error) return next();
+
+	try {
+		let code = 400;
+		let httpcode = code;
+		let message = error?.toString();
+		let errors = undefined;
+
+		if (error instanceof HTTPError && error.code) code = httpcode = error.code;
+		else if (error instanceof ApiError) {
+			code = error.code;
+			message = error.message;
+			httpcode = error.httpStatus;
+		} else if (error.name === "EntityNotFoundError") {
+			message = `${error.message.match(EntityNotFoundErrorRegex)?.[1] || "Item"} could not be found`;
+			code = httpcode = 404;
+		} else if (error instanceof FieldError) {
+			code = Number(error.code);
+			message = error.message;
+			errors = error.errors;
+		} else {
+			console.error(`[Error] ${code} ${req.url}\n`, errors || error, "\nbody:", req.body);
+
+			if (req.server?.options?.production) {
+				// don't expose internal errors to the user, instead human errors should be thrown as HTTPError
+				message = "Internal Server Error";
+			}
+			code = httpcode = 500;
+		}
+
+		if (httpcode > 511) httpcode = 400;
+
+		res.status(httpcode).json({ code: code, message, errors });
+	} catch (error) {
+		console.error(`[Internal Server Error] 500`, error);
+		return res.status(500).json({ code: 500, message: "Internal Server Error" });
+	}
+}

src/api/middlewares/RateLimit.ts

@@ -0,0 +1,215 @@
+import { Config, getRights, listenEvent, Rights } from "@fosscord/util";
+import { NextFunction, Request, Response, Router } from "express";
+import { getIpAdress } from "@fosscord/api";
+import { API_PREFIX_TRAILING_SLASH } from "./Authentication";
+
+// Docs: https://discord.com/developers/docs/topics/rate-limits
+
+// TODO: use better caching (e.g. redis) as else it creates to much pressure on the database
+
+/*
+? bucket limit? Max actions/sec per bucket?
+(ANSWER: a small fosscord instance might not need a complex rate limiting system)
+
+TODO: delay database requests to include multiple queries
+TODO: different for methods (GET/POST)
+
+> IP addresses that make too many invalid HTTP requests are automatically and temporarily restricted from accessing the Discord API. Currently, this limit is 10,000 per 10 minutes. An invalid request is one that results in 401, 403, or 429 statuses.
+
+> All bots can make up to 50 requests per second to our API. This is independent of any individual rate limit on a route. If your bot gets big enough, based on its functionality, it may be impossible to stay below 50 requests per second during normal operations.
+
+*/
+
+type RateLimit = {
+	id: "global" | "error" | string;
+	executor_id: string;
+	hits: number;
+	blocked: boolean;
+	expires_at: Date;
+};
+
+let Cache = new Map<string, RateLimit>();
+const EventRateLimit = "RATELIMIT";
+
+export default function rateLimit(opts: {
+	bucket?: string;
+	window: number;
+	count: number;
+	bot?: number;
+	webhook?: number;
+	oauth?: number;
+	GET?: number;
+	MODIFY?: number;
+	error?: boolean;
+	success?: boolean;
+	onlyIp?: boolean;
+}): any {
+	return async (req: Request, res: Response, next: NextFunction): Promise<any> => {
+		// exempt user? if so, immediately short circuit
+		if (req.user_id) {
+			const rights = await getRights(req.user_id);
+			if (rights.has("BYPASS_RATE_LIMITS")) return;
+		}
+
+		const bucket_id = opts.bucket || req.originalUrl.replace(API_PREFIX_TRAILING_SLASH, "");
+		let executor_id = getIpAdress(req);
+		if (!opts.onlyIp && req.user_id) executor_id = req.user_id;
+
+		let max_hits = opts.count;
+		if (opts.bot && req.user_bot) max_hits = opts.bot;
+		if (opts.GET && ["GET", "OPTIONS", "HEAD"].includes(req.method)) max_hits = opts.GET;
+		else if (opts.MODIFY && ["POST", "DELETE", "PATCH", "PUT"].includes(req.method)) max_hits = opts.MODIFY;
+
+		let offender = Cache.get(executor_id + bucket_id);
+
+		if (offender) {
+			let reset = offender.expires_at.getTime();
+			let resetAfterMs = reset - Date.now();
+			let resetAfterSec = Math.ceil(resetAfterMs / 1000);
+
+			if (resetAfterMs <= 0) {
+				offender.hits = 0;
+				offender.expires_at = new Date(Date.now() + opts.window * 1000);
+				offender.blocked = false;
+
+				Cache.delete(executor_id + bucket_id);
+			}
+
+			if (offender.blocked) {
+				const global = bucket_id === "global";
+				// each block violation pushes the expiry one full window further
+				reset += opts.window * 1000;
+				offender.expires_at = new Date(offender.expires_at.getTime() + opts.window * 1000);
+				resetAfterMs = reset - Date.now();
+				resetAfterSec = Math.ceil(resetAfterMs / 1000);
+
+				console.log("blocked bucket: " + bucket_id, { resetAfterMs });
+				return (
+					res
+						.status(429)
+						.set("X-RateLimit-Limit", `${max_hits}`)
+						.set("X-RateLimit-Remaining", "0")
+						.set("X-RateLimit-Reset", `${reset}`)
+						.set("X-RateLimit-Reset-After", `${resetAfterSec}`)
+						.set("X-RateLimit-Global", `${global}`)
+						.set("Retry-After", `${Math.ceil(resetAfterSec)}`)
+						.set("X-RateLimit-Bucket", `${bucket_id}`)
+						// TODO: error rate limit message translation
+						.send({ message: "You are being rate limited.", retry_after: resetAfterSec, global })
+				);
+			}
+		}
+
+		next();
+		const hitRouteOpts = { bucket_id, executor_id, max_hits, window: opts.window };
+
+		if (opts.error || opts.success) {
+			res.once("finish", () => {
+				// check if error and increment error rate limit
+				if (res.statusCode >= 400 && opts.error) {
+					return hitRoute(hitRouteOpts);
+				} else if (res.statusCode >= 200 && res.statusCode < 300 && opts.success) {
+					return hitRoute(hitRouteOpts);
+				}
+			});
+		} else {
+			return hitRoute(hitRouteOpts);
+		}
+	};
+}
+
+export async function initRateLimits(app: Router) {
+	const { routes, global, ip, error, disabled } = Config.get().limits.rate;
+	if (disabled) return;
+	await listenEvent(EventRateLimit, (event) => {
+		Cache.set(event.channel_id as string, event.data);
+		event.acknowledge?.();
+	});
+	// await RateLimit.delete({ expires_at: LessThan(new Date().toISOString()) }); // cleans up if not already deleted, morethan -> older date
+	// const limits = await RateLimit.find({ blocked: true });
+	// limits.forEach((limit) => {
+	// 	Cache.set(limit.executor_id, limit);
+	// });
+
+	setInterval(() => {
+		Cache.forEach((x, key) => {
+			if (new Date() > x.expires_at) {
+				Cache.delete(key);
+				// RateLimit.delete({ executor_id: key });
+			}
+		});
+	}, 1000 * 60);
+
+	app.use(
+		rateLimit({
+			bucket: "global",
+			onlyIp: true,
+			...ip
+		})
+	);
+	app.use(rateLimit({ bucket: "global", ...global }));
+	app.use(
+		rateLimit({
+			bucket: "error",
+			error: true,
+			onlyIp: true,
+			...error
+		})
+	);
+	app.use("/guilds/:id", rateLimit(routes.guild));
+	app.use("/webhooks/:id", rateLimit(routes.webhook));
+	app.use("/channels/:id", rateLimit(routes.channel));
+	app.use("/auth/login", rateLimit(routes.auth.login));
+	app.use("/auth/register", rateLimit({ onlyIp: true, success: true, ...routes.auth.register }));
+}
+
+async function hitRoute(opts: { executor_id: string; bucket_id: string; max_hits: number; window: number; }) {
+	const id = opts.executor_id + opts.bucket_id;
+	let limit = Cache.get(id);
+	if (!limit) {
+		limit = {
+			id: opts.bucket_id,
+			executor_id: opts.executor_id,
+			expires_at: new Date(Date.now() + opts.window * 1000),
+			hits: 0,
+			blocked: false
+		};
+		Cache.set(id, limit);
+	}
+
+	limit.hits++;
+	if (limit.hits >= opts.max_hits) {
+		limit.blocked = true;
+	}
+
+	/*
+	let ratelimit = await RateLimit.findOne({ where: { id: opts.bucket_id, executor_id: opts.executor_id } });
+	if (!ratelimit) {
+		ratelimit = new RateLimit({
+			id: opts.bucket_id,
+			executor_id: opts.executor_id,
+			expires_at: new Date(Date.now() + opts.window * 1000),
+			hits: 0,
+			blocked: false
+		});
+	}
+
+	ratelimit.hits++;
+
+	const updateBlock = !ratelimit.blocked && ratelimit.hits >= opts.max_hits;
+
+	if (updateBlock) {
+		ratelimit.blocked = true;
+		Cache.set(opts.executor_id + opts.bucket_id, ratelimit);
+		await emitEvent({
+			channel_id: EventRateLimit,
+			event: EventRateLimit,
+			data: ratelimit
+		});
+	} else {
+		Cache.delete(opts.executor_id);
+	}
+
+	await ratelimit.save();
+	*/
+}

src/api/middlewares/TestClient.ts

@@ -0,0 +1,154 @@
+import express, { Request, Response, Application } from "express";
+import fs from "fs";
+import path from "path";
+import fetch, { Response as FetchResponse, Headers } from "node-fetch";
+import ProxyAgent from 'proxy-agent';
+import { Config } from "@fosscord/util";
+import { AssetCacheItem } from "../util/entities/AssetCacheItem"
+import { green } from "picocolors";
+
+const AssetsPath = path.join(__dirname, "..", "..", "..", "assets")
+
+export default function TestClient(app: Application) {
+	const agent = new ProxyAgent();
+	
+	//build client page
+	let html = fs.readFileSync(path.join(AssetsPath, "index.html"), { encoding: "utf8" });
+	html = applyEnv(html);
+	html = applyInlinePlugins(html);
+	html = applyPlugins(html);
+	html = applyPreloadPlugins(html);
+
+	//load asset cache
+	let newAssetCache: Map<string, AssetCacheItem> = new Map<string, AssetCacheItem>();
+	let assetCacheDir = path.join(AssetsPath, "cache");
+	if(process.env.ASSET_CACHE_DIR)
+		assetCacheDir = process.env.ASSET_CACHE_DIR
+
+	console.log(`[TestClient] ${green(`Using asset cache path: ${assetCacheDir}`)}`)
+	if(!fs.existsSync(assetCacheDir)) {
+		fs.mkdirSync(assetCacheDir);
+	}
+	if(fs.existsSync(path.join(assetCacheDir, "index.json"))) {
+		let rawdata = fs.readFileSync(path.join(assetCacheDir, "index.json"));
+		newAssetCache = new Map<string, AssetCacheItem>(Object.entries(JSON.parse(rawdata.toString())));
+	}
+
+	app.use("/assets", express.static(path.join(AssetsPath)));	
+	app.get("/assets/:file", async (req: Request, res: Response) => {
+		delete req.headers.host;
+		let response: FetchResponse;
+		let buffer: Buffer;
+		let assetCacheItem: AssetCacheItem = new AssetCacheItem(req.params.file);
+		if(newAssetCache.has(req.params.file)){
+			assetCacheItem = newAssetCache.get(req.params.file)!;
+			assetCacheItem.Headers.forEach((value: any, name: any) => {
+				res.set(name, value);
+			});
+		}
+		else {
+			console.log(`[TestClient] Downloading file not yet cached! Asset file: ${req.params.file}`);
+			response = await fetch(`https://discord.com/assets/${req.params.file}`, {
+				agent,
+				// @ts-ignore
+				headers: {
+					...req.headers
+				}
+			});
+			
+			//set cache info
+			assetCacheItem.Headers = Object.fromEntries(stripHeaders(response.headers));
+			assetCacheItem.FilePath = path.join(assetCacheDir, req.params.file);
+			assetCacheItem.Key = req.params.file;
+			//add to cache and save
+			newAssetCache.set(req.params.file, assetCacheItem);
+			fs.writeFileSync(path.join(assetCacheDir, "index.json"), JSON.stringify(Object.fromEntries(newAssetCache), null, 4));
+			//download file
+			fs.writeFileSync(assetCacheItem.FilePath, await response.buffer());
+		}
+		
+		assetCacheItem.Headers.forEach((value: string, name: string) => {
+			res.set(name, value);
+		});
+		return res.send(fs.readFileSync(assetCacheItem.FilePath));
+	});
+	app.get("/developers*", (_req: Request, res: Response) => {
+		const { useTestClient } = Config.get().client;
+		res.set("Cache-Control", "public, max-age=" + 60 * 60 * 24);
+		res.set("content-type", "text/html");
+
+		if(!useTestClient) return res.send("Test client is disabled on this instance. Use a stand-alone client to connect this instance.")
+		
+		res.send(fs.readFileSync(path.join(__dirname, "..", "..", "client_test", "developers.html"), { encoding: "utf8" }));
+	});
+	app.get("*", (req: Request, res: Response) => {
+		const { useTestClient } = Config.get().client;
+		res.set("Cache-Control", "public, max-age=" + 60 * 60 * 24);
+		res.set("content-type", "text/html");
+
+		if(req.url.startsWith("/api") || req.url.startsWith("/__development")) return;
+
+		if(!useTestClient) return res.send("Test client is disabled on this instance. Use a stand-alone client to connect this instance.")
+		if (req.url.startsWith("/invite")) return res.send(html.replace("9b2b7f0632acd0c5e781", "9f24f709a3de09b67c49"));
+		
+		res.send(html);
+	});
+
+	
+}
+
+function applyEnv(html: string): string {
+	const CDN_ENDPOINT = (Config.get().cdn.endpointClient || Config.get()?.cdn.endpointPublic || process.env.CDN || "").replace(
+		/(https?)?(:\/\/?)/g,
+		""
+	);
+	const GATEWAY_ENDPOINT = Config.get().gateway.endpointClient || Config.get()?.gateway.endpointPublic || process.env.GATEWAY || "";
+
+	if (CDN_ENDPOINT) {
+		html = html.replace(/CDN_HOST: .+/, `CDN_HOST: \`${CDN_ENDPOINT}\`,`);
+	}
+	if (GATEWAY_ENDPOINT) {
+		html = html.replace(/GATEWAY_ENDPOINT: .+/, `GATEWAY_ENDPOINT: \`${GATEWAY_ENDPOINT}\`,`);
+	}
+	return html;
+}
+
+function applyPlugins(html: string): string {
+	// plugins
+	let files = fs.readdirSync(path.join(AssetsPath, "plugins"));
+	let plugins = "";
+	files.forEach(x =>{if(x.endsWith(".js")) plugins += `<script src='/assets/plugins/${x}'></script>\n`; });
+	return html.replaceAll("<!-- plugin marker -->", plugins);
+}
+
+function applyInlinePlugins(html: string): string{
+	// inline plugins
+	let files = fs.readdirSync(path.join(AssetsPath, "inline-plugins"));
+	let plugins = "";
+	files.forEach(x =>{if(x.endsWith(".js")) plugins += `<script src='/assets/inline-plugins/${x}'></script>\n\n`; });
+	return html.replaceAll("<!-- inline plugin marker -->", plugins);
+}
+
+function applyPreloadPlugins(html: string): string{
+	//preload plugins
+	let files = fs.readdirSync(path.join(AssetsPath, "preload-plugins"));
+	let plugins = "";
+	files.forEach(x =>{if(x.endsWith(".js")) plugins += `<script>${fs.readFileSync(path.join(AssetsPath, "preload-plugins", x))}</script>\n`; });
+	return html.replaceAll("<!-- preload plugin marker -->", plugins);
+}
+
+function stripHeaders(headers: Headers): Headers {
+	[
+		"content-length",
+		"content-security-policy",
+		"strict-transport-security",
+		"set-cookie",
+		"transfer-encoding",
+		"expect-ct",
+		"access-control-allow-origin",
+		"content-encoding"
+	].forEach(headerName => {
+		headers.delete(headerName);
+	});
+	return headers;
+}

src/api/middlewares/Translation.ts

@@ -0,0 +1,28 @@
+import fs from "fs";
+import path from "path";
+import i18next from "i18next";
+import i18nextMiddleware from "i18next-http-middleware";
+import i18nextBackend from "i18next-node-fs-backend";
+import { Router } from "express";
+
+export async function initTranslation(router: Router) {
+	const languages = fs.readdirSync(path.join(__dirname, "..", "..", "..", "assets", "locales"));
+	const namespaces = fs.readdirSync(path.join(__dirname, "..", "..", "..", "assets", "locales", "en"));
+	const ns = namespaces.filter((x) => x.endsWith(".json")).map((x) => x.slice(0, x.length - 5));
+
+	await i18next
+		.use(i18nextBackend)
+		.use(i18nextMiddleware.LanguageDetector)
+		.init({
+			preload: languages,
+			// debug: true,
+			fallbackLng: "en",
+			ns,
+			backend: {
+				loadPath: __dirname + "/../../../assets/locales/{{lng}}/{{ns}}.json"
+			},
+			load: "all"
+		});
+
+	router.use(i18nextMiddleware.handle(i18next, {}));
+}

src/api/middlewares/index.ts

@@ -0,0 +1,5 @@
+export * from "./Authentication";
+export * from "./BodyParser";
+export * from "./CORS";
+export * from "./ErrorHandler";
+export * from "./RateLimit";

src/api/routes/-/healthz.ts

@@ -0,0 +1,17 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+import { getConnection } from "typeorm";
+
+const router = Router();
+
+router.get("/", route({}), (req: Request, res: Response) => {
+	try {
+		// test that the database is alive & responding
+		getConnection();
+		return res.sendStatus(200);
+	} catch (e) {
+		res.sendStatus(503);
+	}
+});
+
+export default router;

src/api/routes/-/readyz.ts

@@ -0,0 +1,17 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+import { getConnection } from "typeorm";
+
+const router = Router();
+
+router.get("/", route({}), (req: Request, res: Response) => {
+	try {
+		// test that the database is alive & responding
+		getConnection();
+		return res.sendStatus(200);
+	} catch (e) {
+		res.sendStatus(503);
+	}
+});
+
+export default router;

src/api/routes/applications/#id/entitlements.ts

@@ -0,0 +1,12 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+
+const router = Router();
+
+router.get("/", route({}), (req: Request, res: Response) => {
+	// TODO:
+	//const { exclude_consumed } = req.query;
+	res.status(200).send([]);
+});
+
+export default router;

src/api/routes/applications/detectable.ts

@@ -0,0 +1,11 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	//TODO
+	res.send([]).status(200);
+});
+
+export default router;

src/api/routes/applications/index.ts

@@ -0,0 +1,34 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+import { Application, OrmUtils, Team, trimSpecial, User } from "@fosscord/util";
+
+const router: Router = Router();
+
+export interface ApplicationCreateSchema {
+	name: string;
+	team_id?: string | number;
+}
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	//TODO
+	let results = await Application.find({where: {owner: {id: req.user_id}}, relations: ["owner", "bot"] });
+	res.json(results).status(200);
+});
+
+router.post("/", route({}), async (req: Request, res: Response) => {
+	const body = req.body as ApplicationCreateSchema;
+	const user = await User.findOne({where: {id: req.user_id}})
+	if(!user) res.status(420);
+	let app = OrmUtils.mergeDeep(new Application(), {
+		name: trimSpecial(body.name),
+		description: "",
+		bot_public: true,
+		owner: user,
+		verify_key: "IMPLEMENTME",
+		flags: 0
+	});
+	await app.save();
+	res.json(app).status(200);
+});
+
+export default router;

src/api/routes/auth/location-metadata.ts

@@ -0,0 +1,13 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+import { getIpAdress, IPAnalysis } from "@fosscord/api";
+const router = Router();
+
+router.get("/",route({}), async (req: Request, res: Response) => {
+    //TODO
+    //Note: It's most likely related to legal. At the moment Discord hasn't finished this too
+    const country_code = (await IPAnalysis(getIpAdress(req))).country_code;
+	res.json({ consent_required: false, country_code: country_code, promotional_email_opt_in: { required: true, pre_checked: false}});
+});
+
+export default router;

src/api/routes/auth/login.ts

@@ -0,0 +1,87 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+import bcrypt from "bcrypt";
+import { Config, User, generateToken, adjustEmail, FieldErrors, LoginSchema } from "@fosscord/util";
+import crypto from "crypto";
+
+const router: Router = Router();
+export default router;
+
+router.post("/", route({ body: "LoginSchema" }), async (req: Request, res: Response) => {
+	const { login, password, captcha_key, undelete } = req.body as LoginSchema;
+	const email = adjustEmail(login);
+
+	const config = Config.get();
+
+	if (config.login.requireCaptcha && config.security.captcha.enabled) {
+		if (!captcha_key) {
+			const { sitekey, service } = config.security.captcha;
+			return res.status(400).json({
+				captcha_key: ["captcha-required"],
+				captcha_sitekey: sitekey,
+				captcha_service: service
+			});
+		}
+
+		// TODO: check captcha
+	}
+
+	const user = await User.findOneOrFail({
+		where: [{ phone: login }, { email: login }],
+		select: ["data", "id", "disabled", "deleted", "settings", "totp_secret", "mfa_enabled"]
+	}).catch((e) => {
+		throw FieldErrors({ login: { message: req.t("auth:login.INVALID_LOGIN"), code: "INVALID_LOGIN" } });
+	});
+
+	if (undelete) {
+		// undelete refers to un'disable' here
+		if (user.disabled) await User.update({ id: user.id }, { disabled: false });
+		if (user.deleted) await User.update({ id: user.id }, { deleted: false });
+	} else {
+		if (user.deleted) return res.status(400).json({ message: "This account is scheduled for deletion.", code: 20011 });
+		if (user.disabled) return res.status(400).json({ message: req.t("auth:login.ACCOUNT_DISABLED"), code: 20013 });
+	}
+
+	// the salt is saved in the password refer to bcrypt docs
+	const same_password = await bcrypt.compare(password, user.data.hash || "");
+	if (!same_password) {
+		throw FieldErrors({ password: { message: req.t("auth:login.INVALID_PASSWORD"), code: "INVALID_PASSWORD" } });
+	}
+
+	if (user.mfa_enabled) {
+		// TODO: This is not a discord.com ticket. I'm not sure what it is but I'm lazy
+		const ticket = crypto.randomBytes(40).toString("hex");
+
+		await User.update({ id: user.id }, { totp_last_ticket: ticket });
+
+		return res.json({
+			ticket: ticket,
+			mfa: true,
+			sms: false,	// TODO
+			token: null,
+		})
+	}
+
+	const token = await generateToken(user.id);
+
+	// Notice this will have a different token structure, than discord
+	// Discord header is just the user id as string, which is not possible with npm-jsonwebtoken package
+	// https://user-images.githubusercontent.com/6506416/81051916-dd8c9900-8ec2-11ea-8794-daf12d6f31f0.png
+
+	res.json({ token, settings: user.settings });
+});
+
+/**
+ * POST /auth/login
+ * @argument { login: "email@gmail.com", password: "cleartextpassword", undelete: false, captcha_key: null, login_source: null, gift_code_sku_id: null, }
+
+ * MFA required:
+ * @returns {"token": null, "mfa": true, "sms": true, "ticket": "SOME TICKET JWT TOKEN"}
+
+ * Captcha required:
+ * @returns {"captcha_key": ["captcha-required"], "captcha_sitekey": null, "captcha_service": "recaptcha"}
+
+ * Sucess:
+ * @returns {"token": "USERTOKEN", "settings": {"locale": "en", "theme": "dark"}}
+
+ */

src/api/routes/auth/mfa/totp.ts

@@ -0,0 +1,42 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+import { BackupCode, FieldErrors, generateToken, TotpSchema, User } from "@fosscord/util";
+import { verifyToken } from "node-2fa";
+import { HTTPError } from "lambert-server";
+const router = Router();
+
+router.post("/", route({ body: "TotpSchema" }), async (req: Request, res: Response) => {
+	const { code, ticket, gift_code_sku_id, login_source } = req.body as TotpSchema;
+
+	const user = await User.findOneOrFail({
+		where: {
+			totp_last_ticket: ticket,
+		},
+		select: [
+			"id",
+			"totp_secret",
+			"settings",
+		],
+	});
+
+	const backup = await BackupCode.findOne({ where: { code: code, expired: false, consumed: false, user: { id: user.id } } });
+
+	if (!backup) {
+		const ret = verifyToken(user.totp_secret!, code);
+		if (!ret || ret.delta != 0)
+			throw new HTTPError(req.t("auth:login.INVALID_TOTP_CODE"), 60008);
+	}
+	else {
+		backup.consumed = true;
+		await backup.save();
+	}
+
+	await User.update({ id: user.id }, { totp_last_ticket: "" });
+
+	return res.json({
+		token: await generateToken(user.id),
+		user_settings: user.settings,
+	});
+});
+
+export default router;

src/api/routes/auth/register.ts

@@ -0,0 +1,157 @@
+import { Request, Response, Router } from "express";
+import { Config, generateToken, Invite, FieldErrors, User, adjustEmail, trimSpecial, RegisterSchema } from "@fosscord/util";
+import { route, getIpAdress, IPAnalysis, isProxy } from "@fosscord/api";
+import bcrypt from "bcrypt";
+import { HTTPError } from "@fosscord/util";
+
+const router: Router = Router();
+
+router.post("/", route({ body: "RegisterSchema" }), async (req: Request, res: Response) => {
+	const body = req.body as RegisterSchema;
+	const { register, security } = Config.get();
+	const ip = getIpAdress(req);
+
+	// email will be slightly modified version of the user supplied email -> e.g. protection against GMail Trick
+	let email = adjustEmail(body.email);
+
+	// check if registration is allowed
+	if (!register.allowNewRegistration) {
+		throw FieldErrors({
+			email: { code: "REGISTRATION_DISABLED", message: req.t("auth:register.REGISTRATION_DISABLED") }
+		});
+	}
+
+	// check if the user agreed to the Terms of Service
+	if (!body.consent) {
+		throw FieldErrors({
+			consent: { code: "CONSENT_REQUIRED", message: req.t("auth:register.CONSENT_REQUIRED") }
+		});
+	}
+
+	if (register.disabled) {
+		throw FieldErrors({
+			email: {
+				code: "DISABLED",
+				message: "registration is disabled on this instance"
+			}
+		});
+	}
+
+	if (register.requireCaptcha && security.captcha.enabled) {
+		if (!body.captcha_key) {
+			const { sitekey, service } = security.captcha;
+			return res?.status(400).json({
+				captcha_key: ["captcha-required"],
+				captcha_sitekey: sitekey,
+				captcha_service: service
+			});
+		}
+
+		// TODO: check captcha
+	}
+
+	if (!register.allowMultipleAccounts) {
+		// TODO: check if fingerprint was eligible generated
+		const exists = await User.findOne({ where: { fingerprints: body.fingerprint }, select: ["id"] });
+
+		if (exists) {
+			throw FieldErrors({
+				email: {
+					code: "EMAIL_ALREADY_REGISTERED",
+					message: req.t("auth:register.EMAIL_ALREADY_REGISTERED")
+				}
+			});
+		}
+	}
+
+	if (register.blockProxies) {
+		if (isProxy(await IPAnalysis(ip))) {
+			console.log(`proxy ${ip} blocked from registration`);
+			throw new HTTPError("Your IP is blocked from registration");
+		}
+	}
+
+	// TODO: gift_code_sku_id?
+	// TODO: check password strength
+
+	if (email) {
+		// replace all dots and chars after +, if its a gmail.com email
+		if (!email) {
+			throw FieldErrors({ email: { code: "INVALID_EMAIL", message: req?.t("auth:register.INVALID_EMAIL") } });
+		}
+
+		// check if there is already an account with this email
+		const exists = await User.findOne({ where: { email: email } });
+
+		if (exists) {
+			throw FieldErrors({
+				email: {
+					code: "EMAIL_ALREADY_REGISTERED",
+					message: req.t("auth:register.EMAIL_ALREADY_REGISTERED")
+				}
+			});
+		}
+	} else if (register.email.required) {
+		throw FieldErrors({
+			email: { code: "BASE_TYPE_REQUIRED", message: req.t("common:field.BASE_TYPE_REQUIRED") }
+		});
+	}
+
+	if (register.dateOfBirth.required && !body.date_of_birth) {
+		throw FieldErrors({
+			date_of_birth: { code: "BASE_TYPE_REQUIRED", message: req.t("common:field.BASE_TYPE_REQUIRED") }
+		});
+	} else if (register.dateOfBirth.required && register.dateOfBirth.minimum) {
+		const minimum = new Date();
+		minimum.setFullYear(minimum.getFullYear() - register.dateOfBirth.minimum);
+		body.date_of_birth = new Date(body.date_of_birth as Date);
+
+		// higher is younger
+		if (body.date_of_birth > minimum) {
+			throw FieldErrors({
+				date_of_birth: {
+					code: "DATE_OF_BIRTH_UNDERAGE",
+					message: req.t("auth:register.DATE_OF_BIRTH_UNDERAGE", { years: register.dateOfBirth.minimum })
+				}
+			});
+		}
+	}
+
+	if (body.password) {
+		// the salt is saved in the password refer to bcrypt docs
+		body.password = await bcrypt.hash(body.password, 12);
+	} else if (register.password.required) {
+		throw FieldErrors({
+			password: { code: "BASE_TYPE_REQUIRED", message: req.t("common:field.BASE_TYPE_REQUIRED") }
+		});
+	}
+
+	if (!body.invite && (register.requireInvite || (register.guestsRequireInvite && !register.email))) {
+		// require invite to register -> e.g. for organizations to send invites to their employees
+		throw FieldErrors({
+			email: { code: "INVITE_ONLY", message: req.t("auth:register.INVITE_ONLY") }
+		});
+	}
+
+	const user = await User.register({ ...body, req });
+
+	if (body.invite) {
+		// await to fail if the invite doesn't exist (necessary for requireInvite to work properly) (username only signups are possible)
+		await Invite.joinGuild(user.id, body.invite);
+	}
+
+	return res.json({ token: await generateToken(user.id) });
+});
+
+export default router;
+
+/**
+ * POST /auth/register
+ * @argument { "fingerprint":"805826570869932034.wR8vi8lGlFBJerErO9LG5NViJFw", "email":"qo8etzvaf@gmail.com", "username":"qp39gr98", "password":"wtp9gep9gw", "invite":null, "consent":true, "date_of_birth":"2000-04-04", "gift_code_sku_id":null, "captcha_key":null}
+ *
+ * Field Error
+ * @returns { "code": 50035, "errors": { "consent": { "_errors": [{ "code": "CONSENT_REQUIRED", "message": "You must agree to Discord's Terms of Service and Privacy Policy." }]}}, "message": "Invalid Form Body"}
+ *
+ * Success 200:
+ * @returns {token: "OMITTED"}
+ */

src/api/routes/channels/#channel_id/followers.ts

@@ -0,0 +1,14 @@
+import { Router, Response, Request } from "express";
+const router: Router = Router();
+// TODO:
+
+export default router;
+
+/**
+ *
+ * @param {"webhook_channel_id":"754001514330062952"}
+ *
+ * Creates a WebHook in the channel and returns the id of it
+ *
+ * @returns {"channel_id": "816382962056560690", "webhook_id": "834910735095037962"}
+ */

src/api/routes/channels/#channel_id/index.ts

@@ -0,0 +1,72 @@
+import {
+	Channel,
+	ChannelDeleteEvent,
+	ChannelPermissionOverwriteType,
+	ChannelType,
+	ChannelUpdateEvent,
+	emitEvent,
+	Recipient,
+	handleFile,
+	ChannelModifySchema
+} from "@fosscord/util";
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router: Router = Router();
+// TODO: delete channel
+// TODO: Get channel
+
+router.get("/", route({ permission: "VIEW_CHANNEL" }), async (req: Request, res: Response) => {
+	const { channel_id } = req.params;
+
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+
+	return res.send(channel);
+});
+
+router.delete("/", route({ permission: "MANAGE_CHANNELS" }), async (req: Request, res: Response) => {
+	const { channel_id } = req.params;
+
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id }, relations: ["recipients"] });
+
+	if (channel.type === ChannelType.DM) {
+		const recipient = await Recipient.findOneOrFail({ where: { channel_id, user_id: req.user_id } });
+		recipient.closed = true;
+		await Promise.all([
+			recipient.save(),
+			emitEvent({ event: "CHANNEL_DELETE", data: channel, user_id: req.user_id } as ChannelDeleteEvent)
+		]);
+	} else if (channel.type === ChannelType.GROUP_DM) {
+		await Channel.removeRecipientFromChannel(channel, req.user_id);
+	} else {
+		await Promise.all([
+			Channel.delete({ id: channel_id }),
+			emitEvent({ event: "CHANNEL_DELETE", data: channel, channel_id } as ChannelDeleteEvent)
+		]);
+	}
+
+	res.send(channel);
+});
+
+router.patch("/", route({ body: "ChannelModifySchema", permission: "MANAGE_CHANNELS" }), async (req: Request, res: Response) => {
+	let payload = req.body as ChannelModifySchema;
+	const { channel_id } = req.params;
+	if (payload.icon) payload.icon = await handleFile(`/channel-icons/${channel_id}`, payload.icon);
+
+	let channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+	channel = OrmUtils.mergeDeep(channel, payload);
+
+	await Promise.all([
+		channel.save(),
+		emitEvent({
+			event: "CHANNEL_UPDATE",
+			data: channel,
+			channel_id
+		} as ChannelUpdateEvent)
+	]);
+
+	res.send(channel);
+});
+
+export default router;

src/api/routes/channels/#channel_id/invites.ts

@@ -0,0 +1,58 @@
+import { Router, Request, Response } from "express";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { random } from "@fosscord/api";
+import { Channel, Invite, InviteCreateEvent, emitEvent, User, Guild, PublicInviteRelation } from "@fosscord/util";
+import { isTextChannel } from "./messages";
+import { OrmUtils } from "@fosscord/util";
+
+const router: Router = Router();
+
+router.post("/", route({ body: "InviteCreateSchema", permission: "CREATE_INSTANT_INVITE", right: "CREATE_INVITES" }),
+			async (req: Request, res: Response) => {
+	const { user_id } = req;
+	const { channel_id } = req.params;
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id }, select: ["id", "name", "type", "guild_id"] });
+	isTextChannel(channel.type);
+
+	if (!channel.guild_id) {
+		throw new HTTPError("This channel doesn't exist", 404);
+	}
+	const { guild_id } = channel;
+
+	const expires_at = new Date(req.body.max_age * 1000 + Date.now());
+
+	const invite = await OrmUtils.mergeDeep(new Invite(),{
+		temporary: req.body.temporary || true,
+		max_uses: req.body.max_uses,
+		max_age: req.body.max_age,
+		expires_at,
+		guild_id,
+		channel_id,
+		inviter_id: user_id
+	}).save();
+	//TODO: check this, removed toJSON call
+	const data = JSON.parse(JSON.stringify(invite));
+	data.inviter = await User.getPublicUser(req.user_id);
+	data.guild = await Guild.findOne({ where: { id: guild_id } });
+	data.channel = channel;
+
+	await emitEvent({ event: "INVITE_CREATE", data, guild_id } as InviteCreateEvent);
+	res.status(201).send(data);
+});
+
+router.get("/", route({ permission: "MANAGE_CHANNELS" }), async (req: Request, res: Response) => {
+	const { channel_id } = req.params;
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+
+	if (!channel.guild_id) {
+		throw new HTTPError("This channel doesn't exist", 404);
+	}
+	const { guild_id } = channel;
+
+	const invites = await Invite.find({ where: { guild_id }, relations: PublicInviteRelation });
+
+	res.status(200).send(invites);
+});
+
+export default router;

src/api/routes/channels/#channel_id/messages/#message_id/ack.ts

@@ -0,0 +1,33 @@
+import { emitEvent, getPermission, MessageAckEvent, ReadState, Snowflake } from "@fosscord/util";
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router = Router();
+
+router.post("/", route({ body: "MessageAcknowledgeSchema" }), async (req: Request, res: Response) => {
+	const { channel_id, message_id } = req.params;
+
+	const permission = await getPermission(req.user_id, undefined, channel_id);
+	permission.hasThrow("VIEW_CHANNEL");
+
+	let read_state = await ReadState.findOne({ where: { user_id: req.user_id, channel_id } });
+	if (!read_state) read_state = OrmUtils.mergeDeep(new ReadState(), { user_id: req.user_id, channel_id }) as ReadState;
+	read_state.last_message_id = message_id;
+
+	await read_state.save();
+
+	await emitEvent({
+		event: "MESSAGE_ACK",
+		user_id: req.user_id,
+		data: {
+			channel_id,
+			message_id,
+			version: 3763
+		}
+	} as MessageAckEvent);
+
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/channels/#channel_id/messages/#message_id/crosspost.ts

@@ -0,0 +1,28 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+
+const router = Router();
+
+router.post("/", route({ permission: "MANAGE_MESSAGES" }), (req: Request, res: Response) => {
+	// TODO:
+	res.json({
+		id: "",
+		type: 0,
+		content: "",
+		channel_id: "",
+		author: { id: "", username: "", avatar: "", discriminator: "", public_flags: 64 },
+		attachments: [],
+		embeds: [],
+		mentions: [],
+		mention_roles: [],
+		pinned: false,
+		mention_everyone: false,
+		tts: false,
+		timestamp: "",
+		edited_timestamp: null,
+		flags: 1,
+		components: []
+	}).status(200);
+});
+
+export default router;

src/api/routes/channels/#channel_id/messages/#message_id/index.ts

@@ -0,0 +1,199 @@
+import {
+	Attachment,
+	Channel,
+	Embed,
+	DiscordApiErrors,
+	emitEvent,
+	FosscordApiErrors,
+	getPermission,
+	getRights,
+ 	Message,
+	MessageCreateEvent,
+	MessageDeleteEvent,
+	MessageUpdateEvent,
+	Snowflake,
+	uploadFile, 
+	MessageCreateSchema
+} from "@fosscord/util";
+import { Router, Response, Request } from "express";
+import multer from "multer";
+import { route } from "@fosscord/api";
+import { handleMessage, postHandleMessage } from "@fosscord/api";
+import { HTTPError } from "@fosscord/util";
+
+const router = Router();
+// TODO: message content/embed string length limit
+
+const messageUpload = multer({
+	limits: {
+		fileSize: 1024 * 1024 * 100,
+		fields: 10,
+		files: 1
+	},
+	storage: multer.memoryStorage()
+}); // max upload 50 mb
+
+router.patch("/", route({ body: "MessageCreateSchema", permission: "SEND_MESSAGES", right: "SEND_MESSAGES" }), async (req: Request, res: Response) => {
+	const { message_id, channel_id } = req.params;
+	let body = req.body as MessageCreateSchema;
+
+	const message = await Message.findOneOrFail({ where: { id: message_id, channel_id }, relations: ["attachments"] });
+
+	const permissions = await getPermission(req.user_id, undefined, channel_id);
+	
+	const rights = await getRights(req.user_id);
+
+	if ((req.user_id !== message.author_id)) {
+		if (!rights.has("MANAGE_MESSAGES")) {
+			permissions.hasThrow("MANAGE_MESSAGES");
+			body = { flags: body.flags };
+// guild admins can only suppress embeds of other messages, no such restriction imposed to instance-wide admins
+		}
+	} else rights.hasThrow("SELF_EDIT_MESSAGES");
+
+	const new_message = await handleMessage({
+		...message,
+		// TODO: should message_reference be overridable?
+		// @ts-ignore
+		message_reference: message.message_reference,
+		...body,
+		author_id: message.author_id,
+		channel_id,
+		id: message_id,
+		edited_timestamp: new Date()
+	});
+
+	await Promise.all([
+		new_message!.save(),
+		await emitEvent({
+			event: "MESSAGE_UPDATE",
+			channel_id,
+			data: { ...new_message, nonce: undefined }
+		} as MessageUpdateEvent)
+	]);
+
+	postHandleMessage(message);
+
+	return res.json(message);
+});
+
+
+// Backfill message with specific timestamp
+router.put(
+	"/",
+	messageUpload.single("file"),
+	async (req, res, next) => {
+		if (req.body.payload_json) {
+			req.body = JSON.parse(req.body.payload_json);
+		}
+
+		next();
+	},
+	route({ body: "MessageCreateSchema", permission: "SEND_MESSAGES", right: "SEND_BACKDATED_EVENTS" }),
+	async (req: Request, res: Response) => {
+		const { channel_id, message_id } = req.params;
+		let body = req.body as MessageCreateSchema;
+		const attachments: Attachment[] = [];
+		
+		const rights = await getRights(req.user_id);
+		rights.hasThrow("SEND_MESSAGES");
+
+		// regex to check if message contains anything other than numerals ( also no decimals )
+		if (!message_id.match(/^\+?\d+$/)) {
+			throw new HTTPError("Message IDs must be positive integers", 400);
+		}
+
+		const snowflake = Snowflake.deconstruct(message_id)
+		if (Date.now() < snowflake.timestamp) {
+			// message is in the future
+			throw FosscordApiErrors.CANNOT_BACKFILL_TO_THE_FUTURE;
+		}
+
+		const exists = await Message.findOne({ where: { id: message_id, channel_id: channel_id }});
+		if (exists) {
+			throw FosscordApiErrors.CANNOT_REPLACE_BY_BACKFILL;
+		}
+
+		if (req.file) {
+			try {
+				const file: any = await uploadFile(`/attachments/${req.params.channel_id}`, req.file);
+				attachments.push({ ...file, proxy_url: file.url });
+			} catch (error) {
+				return res.status(400).json(error);
+			}
+		}
+		const channel = await Channel.findOneOrFail({ where: { id: channel_id }, relations: ["recipients", "recipients.user"] });
+
+		const embeds = body.embeds || [];
+		if (body.embed) embeds.push(body.embed);
+		let message = await handleMessage({
+			...body,
+			type: 0,
+			pinned: false,
+			author_id: req.user_id,
+			id: message_id,
+			embeds,
+			channel_id,
+			attachments,
+			edited_timestamp: undefined,
+			timestamp: new Date(snowflake.timestamp),
+		});
+
+		//Fix for the client bug
+		delete message.member
+		
+		await Promise.all([
+			message.save(),
+			emitEvent({ event: "MESSAGE_CREATE", channel_id: channel_id, data: message } as MessageCreateEvent),
+			channel.save()
+		]);
+
+		postHandleMessage(message).catch((e) => { }); // no await as it shouldnt block the message send function and silently catch error
+
+		return res.json(message);
+	}
+);
+
+router.get("/", route({ permission: "VIEW_CHANNEL" }), async (req: Request, res: Response) => {
+	const { message_id, channel_id } = req.params;
+
+	const message = await Message.findOneOrFail({ where: { id: message_id, channel_id }, relations: ["attachments"] });
+
+	const permissions = await getPermission(req.user_id, undefined, channel_id);
+	
+	if (message.author_id !== req.user_id) permissions.hasThrow("READ_MESSAGE_HISTORY");
+
+	return res.json(message);
+});
+
+router.delete("/", route({}), async (req: Request, res: Response) => {
+	const { message_id, channel_id } = req.params;
+
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+	const message = await Message.findOneOrFail({ where: { id: message_id } });
+	
+	const rights = await getRights(req.user_id);
+
+	if ((message.author_id !== req.user_id)) {
+		if (!rights.has("MANAGE_MESSAGES")) {
+			const permission = await getPermission(req.user_id, channel.guild_id, channel_id);
+			permission.hasThrow("MANAGE_MESSAGES");
+		}
+	} else rights.hasThrow("SELF_DELETE_MESSAGES");
+
+	await Message.delete({ id: message_id });
+
+	await emitEvent({
+		event: "MESSAGE_DELETE",
+		channel_id,
+		data: {
+			id: message_id,
+			channel_id,
+			guild_id: channel.guild_id
+		}
+	} as MessageDeleteEvent);
+
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/channels/#channel_id/messages/#message_id/reactions.ts

@@ -0,0 +1,185 @@
+import {
+	Channel,
+	emitEvent,
+	Emoji,
+	getPermission,
+	Member,
+	Message,
+	MessageReactionAddEvent,
+	MessageReactionRemoveAllEvent,
+	MessageReactionRemoveEmojiEvent,
+	MessageReactionRemoveEvent,
+	PartialEmoji,
+	PublicUserProjection,
+	User
+} from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { Router, Response, Request } from "express";
+import { HTTPError } from "@fosscord/util";
+import { In } from "typeorm";
+
+const router = Router();
+// TODO: check if emoji is really an unicode emoji or a prperly encoded external emoji
+
+function getEmoji(emoji: string): PartialEmoji {
+	emoji = decodeURIComponent(emoji);
+	const parts = emoji.includes(":") && emoji.split(":");
+	if (parts)
+		return {
+			name: parts[0],
+			id: parts[1]
+		};
+
+	return {
+		id: undefined,
+		name: emoji
+	};
+}
+
+router.delete("/", route({ permission: "MANAGE_MESSAGES" }), async (req: Request, res: Response) => {
+	const { message_id, channel_id } = req.params;
+
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+
+	await Message.update({ id: message_id, channel_id }, { reactions: [] });
+
+	await emitEvent({
+		event: "MESSAGE_REACTION_REMOVE_ALL",
+		channel_id,
+		data: {
+			channel_id,
+			message_id,
+			guild_id: channel.guild_id
+		}
+	} as MessageReactionRemoveAllEvent);
+
+	res.sendStatus(204);
+});
+
+router.delete("/:emoji", route({ permission: "MANAGE_MESSAGES" }), async (req: Request, res: Response) => {
+	const { message_id, channel_id } = req.params;
+	const emoji = getEmoji(req.params.emoji);
+
+	const message = await Message.findOneOrFail({ where: { id: message_id, channel_id } });
+
+	const already_added = message.reactions.find((x) => (x.emoji.id === emoji.id && emoji.id) || x.emoji.name === emoji.name);
+	if (!already_added) throw new HTTPError("Reaction not found", 404);
+	message.reactions.remove(already_added);
+
+	await Promise.all([
+		message.save(),
+		emitEvent({
+			event: "MESSAGE_REACTION_REMOVE_EMOJI",
+			channel_id,
+			data: {
+				channel_id,
+				message_id,
+				guild_id: message.guild_id,
+				emoji
+			}
+		} as MessageReactionRemoveEmojiEvent)
+	]);
+
+	res.sendStatus(204);
+});
+
+router.get("/:emoji", route({ permission: "VIEW_CHANNEL" }), async (req: Request, res: Response) => {
+	const { message_id, channel_id } = req.params;
+	const emoji = getEmoji(req.params.emoji);
+
+	const message = await Message.findOneOrFail({ where: { id: message_id, channel_id } });
+	const reaction = message.reactions.find((x) => (x.emoji.id === emoji.id && emoji.id) || x.emoji.name === emoji.name);
+	if (!reaction) throw new HTTPError("Reaction not found", 404);
+
+	const users = await User.find({
+		where: {
+			id: In(reaction.user_ids)
+		},
+		select: PublicUserProjection
+	});
+
+	res.json(users);
+});
+
+router.put("/:emoji/:user_id", route({ permission: "READ_MESSAGE_HISTORY", right: "SELF_ADD_REACTIONS" }), async (req: Request, res: Response) => {
+	const { message_id, channel_id, user_id } = req.params;
+	if (user_id !== "@me") throw new HTTPError("Invalid user");
+	const emoji = getEmoji(req.params.emoji);
+
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+	const message = await Message.findOneOrFail({ where: { id: message_id, channel_id } });
+	const already_added = message.reactions.find((x) => (x.emoji.id === emoji.id && emoji.id) || x.emoji.name === emoji.name);
+
+	if (!already_added) req.permission!.hasThrow("ADD_REACTIONS");
+
+	if (emoji.id) {
+		const external_emoji = await Emoji.findOneOrFail({ where: { id: emoji.id } });
+		if (!already_added) req.permission!.hasThrow("USE_EXTERNAL_EMOJIS");
+		emoji.animated = external_emoji.animated;
+		emoji.name = external_emoji.name;
+	}
+
+	if (already_added) {
+		if (already_added.user_ids.includes(req.user_id)) return res.sendStatus(204); // Do not throw an error ¯\_(ツ)_/¯ as discord also doesn't throw any error
+		already_added.count++;
+	} else message.reactions.push({ count: 1, emoji, user_ids: [req.user_id] });
+
+	await message.save();
+
+	const member = channel.guild_id && (await Member.findOneOrFail({ where: { id: req.user_id } }));
+
+	await emitEvent({
+		event: "MESSAGE_REACTION_ADD",
+		channel_id,
+		data: {
+			user_id: req.user_id,
+			channel_id,
+			message_id,
+			guild_id: channel.guild_id,
+			emoji,
+			member
+		}
+	} as MessageReactionAddEvent);
+
+	res.sendStatus(204);
+});
+
+router.delete("/:emoji/:user_id", route({}), async (req: Request, res: Response) => {
+	let { message_id, channel_id, user_id } = req.params;
+
+	const emoji = getEmoji(req.params.emoji);
+
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+	const message = await Message.findOneOrFail({ where: { id: message_id, channel_id } });
+
+	if (user_id === "@me") user_id = req.user_id;
+	else {
+		const permissions = await getPermission(req.user_id, undefined, channel_id);
+		permissions.hasThrow("MANAGE_MESSAGES");
+	}
+
+	const already_added = message.reactions.find((x) => (x.emoji.id === emoji.id && emoji.id) || x.emoji.name === emoji.name);
+	if (!already_added || !already_added.user_ids.includes(user_id)) throw new HTTPError("Reaction not found", 404);
+
+	already_added.count--;
+
+	if (already_added.count <= 0) message.reactions.remove(already_added);
+
+	await message.save();
+
+	await emitEvent({
+		event: "MESSAGE_REACTION_REMOVE",
+		channel_id,
+		data: {
+			user_id: req.user_id,
+			channel_id,
+			message_id,
+			guild_id: channel.guild_id,
+			emoji
+		}
+	} as MessageReactionRemoveEvent);
+
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/channels/#channel_id/messages/bulk-delete.ts

@@ -0,0 +1,43 @@
+import { Router, Response, Request } from "express";
+import { Channel, Config, emitEvent, getPermission, getRights, MessageDeleteBulkEvent, Message } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { In } from "typeorm";
+
+const router: Router = Router();
+
+export default router;
+
+// should users be able to bulk delete messages or only bots? ANSWER: all users
+// should this request fail, if you provide messages older than 14 days/invalid ids? ANSWER: NO
+// https://discord.com/developers/docs/resources/channel#bulk-delete-messages
+router.post("/", route({ body: "BulkDeleteSchema" }), async (req: Request, res: Response) => {
+	const { channel_id } = req.params;
+	const channel = await Channel.findOneOrFail({where:{ id: channel_id} });
+	if (!channel.guild_id) throw new HTTPError("Can't bulk delete dm channel messages", 400);
+
+	const rights = await getRights(req.user_id);
+	rights.hasThrow("SELF_DELETE_MESSAGES");
+
+	let superuser = rights.has("MANAGE_MESSAGES");
+	const permission = await getPermission(req.user_id, channel?.guild_id, channel_id);
+
+	const { maxBulkDelete } = Config.get().limits.message;
+
+	const { messages } = req.body as { messages: string[] };
+	if (messages.length === 0) throw new HTTPError("You must specify messages to bulk delete");
+	if (!superuser) {
+		permission.hasThrow("MANAGE_MESSAGES");
+		if (messages.length > maxBulkDelete) throw new HTTPError(`You cannot delete more than ${maxBulkDelete} messages`);
+	}
+
+	await Message.delete({ id: In(messages) });
+
+	await emitEvent({
+		event: "MESSAGE_DELETE_BULK",
+		channel_id,
+		data: { ids: messages, channel_id, guild_id: channel.guild_id }
+	} as MessageDeleteBulkEvent);
+
+	res.sendStatus(204);
+});

src/api/routes/channels/#channel_id/messages/index.ts

@@ -0,0 +1,241 @@
+import { Router, Response, Request } from "express";
+import {
+	Attachment,
+	Channel,
+	ChannelType,
+	Config,
+	DmChannelDTO,
+	emitEvent,
+	getPermission,
+	getRights,
+	Message,
+	MessageCreateEvent,
+	Snowflake,
+	uploadFile,
+	Member,
+	MessageCreateSchema
+} from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { handleMessage, postHandleMessage, route } from "@fosscord/api";
+import multer from "multer";
+import { FindManyOptions, LessThan, MoreThan } from "typeorm";
+import { URL } from "url";
+
+const router: Router = Router();
+
+export default router;
+
+export function isTextChannel(type: ChannelType): boolean {
+	switch (type) {
+		case ChannelType.GUILD_STORE:
+		case ChannelType.GUILD_VOICE:
+		case ChannelType.GUILD_STAGE_VOICE:
+		case ChannelType.GUILD_CATEGORY:
+		case ChannelType.GUILD_FORUM:
+		case ChannelType.DIRECTORY:
+			throw new HTTPError("not a text channel", 400);
+		case ChannelType.DM:
+		case ChannelType.GROUP_DM:
+		case ChannelType.GUILD_NEWS:
+		case ChannelType.GUILD_NEWS_THREAD:
+		case ChannelType.GUILD_PUBLIC_THREAD:
+		case ChannelType.GUILD_PRIVATE_THREAD:
+		case ChannelType.GUILD_TEXT:
+		case ChannelType.ENCRYPTED:
+		case ChannelType.ENCRYPTED_THREAD:
+			return true;
+		default:
+			throw new HTTPError("unimplemented", 400);
+	}
+}
+
+// https://discord.com/developers/docs/resources/channel#create-message
+// get messages
+router.get("/", async (req: Request, res: Response) => {
+	const channel_id = req.params.channel_id;
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+	if (!channel) throw new HTTPError("Channel not found", 404);
+
+	isTextChannel(channel.type);
+	const around = req.query.around ? `${req.query.around}` : undefined;
+	const before = req.query.before ? `${req.query.before}` : undefined;
+	const after = req.query.after ? `${req.query.after}` : undefined;
+	const limit = Number(req.query.limit) || 50;
+	if (limit < 1 || limit > 100) throw new HTTPError("limit must be between 1 and 100", 422);
+
+	let halfLimit = Math.floor(limit / 2);
+
+	const permissions = await getPermission(req.user_id, channel.guild_id, channel_id);
+	permissions.hasThrow("VIEW_CHANNEL");
+	if (!permissions.has("READ_MESSAGE_HISTORY")) return res.json([]);
+
+	let query: FindManyOptions<Message> & { where: { id?: any; }; } = {
+		order: { id: "DESC" },
+		take: limit,
+		where: { channel_id },
+		relations: ["author", "webhook", "application", "mentions", "mention_roles", "mention_channels", "sticker_items", "attachments"]
+	};
+	
+
+	if (after) {
+		if (after > new Snowflake()) return res.status(422);
+		query.where.id = MoreThan(after);
+	}
+	else if (before) { 
+		if (before < req.params.channel_id) return res.status(422);
+		query.where.id = LessThan(before);
+	}
+	else if (around) {
+		query.where.id = [
+			MoreThan((BigInt(around) - BigInt(halfLimit)).toString()),
+			LessThan((BigInt(around) + BigInt(halfLimit)).toString())
+		];
+	}
+
+	const messages = await Message.find(query);
+	const endpoint = Config.get().cdn.endpointPublic;
+
+	return res.json(
+		messages.map((x: any) => {
+			(x.reactions || []).forEach((x: any) => {
+				// @ts-ignore
+				if ((x.user_ids || []).includes(req.user_id)) x.me = true;
+				// @ts-ignore
+				delete x.user_ids;
+			});
+			// @ts-ignore
+			if (!x.author) x.author = { id: "4", discriminator: "0000", username: "Fosscord Ghost", public_flags: "0", avatar: null };
+			x.attachments?.forEach((y: any) => {
+				// dynamically set attachment proxy_url in case the endpoint changed
+				const uri = y.proxy_url.startsWith("http") ? y.proxy_url : `https://example.org${y.proxy_url}`;
+				y.proxy_url = `${endpoint == null ? "" : endpoint}${new URL(uri).pathname}`;
+			});
+			
+			/**
+			Some clients ( discord.js ) only check if a property exists within the response,
+			which causes erorrs when, say, the `application` property is `null`.
+			**/
+			
+			for (let curr in x) {
+				if (x[curr] === null)
+					delete x[curr];
+			}
+
+			return x;
+		})
+	);
+});
+
+// TODO: config max upload size
+const messageUpload = multer({
+	limits: {
+		fileSize: 1024 * 1024 * 100,
+		fields: 10,
+		// files: 1
+	},
+	storage: multer.memoryStorage()
+}); // max upload 50 mb
+/**
+ TODO: dynamically change limit of MessageCreateSchema with config
+
+ https://discord.com/developers/docs/resources/channel#create-message
+ TODO: text channel slowdown (per-user and across-users)
+ Q: trim and replace message content and every embed field A: NO, given this cannot be implemented in E2EE channels
+ TODO: only dispatch notifications for mentions denoted in allowed_mentions
+**/
+// Send message
+router.post(
+	"/",
+	messageUpload.any(),
+	async (req, res, next) => {
+		if (req.body.payload_json) {
+			req.body = JSON.parse(req.body.payload_json);
+		}
+
+		next();
+	},
+	route({ body: "MessageCreateSchema", permission: "SEND_MESSAGES", right: "SEND_MESSAGES" }),
+	async (req: Request, res: Response) => {
+		const { channel_id } = req.params;
+		let body = req.body as MessageCreateSchema;
+		const attachments: Attachment[] = [];
+
+		const channel = await Channel.findOneOrFail({ where: { id: channel_id }, relations: ["recipients", "recipients.user"] });
+		if (!channel.isWritable()) {
+			throw new HTTPError(`Cannot send messages to channel of type ${channel.type}`, 400)
+		}
+
+		const files = req.files as Express.Multer.File[] ?? [];
+		for (let currFile of files) {
+			try {
+				const file: any = await uploadFile(`/attachments/${channel.id}`, currFile);
+				attachments.push({ ...file, proxy_url: file.url });
+			}
+			catch (error) {
+				return res.status(400).json(error);
+			}
+		}
+
+		const embeds = body.embeds || [];
+		if (body.embed) embeds.push(body.embed);
+		let message = await handleMessage({
+			...body,
+			type: 0,
+			pinned: false,
+			author_id: req.user_id,
+			embeds,
+			channel_id,
+			attachments,
+			edited_timestamp: undefined,
+			timestamp: new Date()
+		});
+
+		channel.last_message_id = message.id;
+
+		if (channel.isDm()) {
+			const channel_dto = await DmChannelDTO.from(channel);
+
+			// Only one recipients should be closed here, since in group DMs the recipient is deleted not closed
+			Promise.all(
+				channel.recipients!.map((recipient) => {
+					if (recipient.closed) {
+						recipient.closed = false;
+						return Promise.all([
+							recipient.save(),
+							emitEvent({
+								event: "CHANNEL_CREATE",
+								data: channel_dto.excludedRecipients([recipient.user_id]),
+								user_id: recipient.user_id
+							})
+						]);
+					}
+				})
+			);
+		}
+	
+	    //Defining member fields
+		var member = await Member.findOneOrFail({ where: { id: req.user_id }, relations: ["roles"] });
+		// TODO: This doesn't work either
+        // member.roles = member.roles.filter((role) => {
+		// 	return role.id !== role.guild_id;
+		// }).map((role) => {
+		// 	return role.id;
+		// });
+		message.member = member;
+		// TODO: Figure this out
+		// delete message.member.last_message_id;
+		// delete message.member.index;
+		
+		await Promise.all([
+			message.save(),
+			emitEvent({ event: "MESSAGE_CREATE", channel_id: channel_id, data: message } as MessageCreateEvent),
+			message.guild_id ? Member.update({ id: req.user_id, guild_id: message.guild_id }, { last_message_id: message.id }) : null,
+			channel.save()
+		]);
+
+		postHandleMessage(message).catch((e) => { }); // no await as it shouldnt block the message send function and silently catch error
+
+		return res.json(message);
+	}
+);
+

src/api/routes/channels/#channel_id/permissions.ts

@@ -0,0 +1,81 @@
+import {
+	Channel,
+	ChannelPermissionOverwrite,
+	ChannelPermissionOverwriteSchema,
+	ChannelPermissionOverwriteType,
+	ChannelUpdateEvent,
+	emitEvent,
+	getPermission,
+	Member,
+	Role
+} from "@fosscord/util";
+import { Router, Response, Request } from "express";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.put(
+	"/:overwrite_id",
+	route({ body: "ChannelPermissionOverwriteSchema", permission: "MANAGE_ROLES" }),
+	async (req: Request, res: Response) => {
+		const { channel_id, overwrite_id } = req.params;
+		const body = req.body as ChannelPermissionOverwriteSchema;
+
+		let channel = await Channel.findOneOrFail({ where: {id: channel_id} });
+		if (!channel.guild_id) throw new HTTPError("Channel not found", 404);
+
+		if (body.type === 0) {
+			if (!(await Role.count({ where: { id: overwrite_id } }))) throw new HTTPError("role not found", 404);
+		} else if (body.type === 1) {
+			if (!(await Member.count({ where: { id: overwrite_id } }))) throw new HTTPError("user not found", 404);
+		} else throw new HTTPError("type not supported", 501);
+
+		// @ts-ignore
+		let overwrite: ChannelPermissionOverwrite = channel.permission_overwrites.find((x) => x.id === overwrite_id);
+		if (!overwrite) {
+			// @ts-ignore
+			overwrite = {
+				id: overwrite_id,
+				type: body.type
+			};
+			channel.permission_overwrites!.push(overwrite);
+		}
+		overwrite.allow = String(req.permission!.bitfield & (BigInt(body.allow) || BigInt("0")));
+		overwrite.deny = String(req.permission!.bitfield & (BigInt(body.deny) || BigInt("0")));
+
+		await Promise.all([
+			channel.save(),
+			emitEvent({
+				event: "CHANNEL_UPDATE",
+				channel_id,
+				data: channel
+			} as ChannelUpdateEvent)
+		]);
+
+		return res.sendStatus(204);
+	}
+);
+
+// TODO: check permission hierarchy
+router.delete("/:overwrite_id", route({ permission: "MANAGE_ROLES" }), async (req: Request, res: Response) => {
+	const { channel_id, overwrite_id } = req.params;
+
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+	if (!channel.guild_id) throw new HTTPError("Channel not found", 404);
+
+	channel.permission_overwrites = channel.permission_overwrites!.filter((x) => x.id === overwrite_id);
+
+	await Promise.all([
+		channel.save(),
+		emitEvent({
+			event: "CHANNEL_UPDATE",
+			channel_id,
+			data: channel
+		} as ChannelUpdateEvent)
+	]);
+
+	return res.sendStatus(204);
+});
+
+export default router;

src/api/routes/channels/#channel_id/pins.ts

@@ -0,0 +1,90 @@
+import {
+	Channel,
+	ChannelPinsUpdateEvent,
+	Config,
+	emitEvent,
+	getPermission,
+	Message,
+	MessageUpdateEvent,
+	DiscordApiErrors
+} from "@fosscord/util";
+import { Router, Request, Response } from "express";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.put("/:message_id", route({ permission: "VIEW_CHANNEL" }), async (req: Request, res: Response) => {
+	const { channel_id, message_id } = req.params;
+
+	const message = await Message.findOneOrFail({ where: { id: message_id } });
+
+	// * in dm channels anyone can pin messages -> only check for guilds
+	if (message.guild_id) req.permission!.hasThrow("MANAGE_MESSAGES");
+
+	const pinned_count = await Message.count({ where: { channel: { id: channel_id }, pinned: true } });
+	const { maxPins } = Config.get().limits.channel;
+	if (pinned_count >= maxPins) throw DiscordApiErrors.MAXIMUM_PINS.withParams(maxPins);
+
+	await Promise.all([
+		Message.update({ id: message_id }, { pinned: true }),
+		emitEvent({
+			event: "MESSAGE_UPDATE",
+			channel_id,
+			data: message
+		} as MessageUpdateEvent),
+		emitEvent({
+			event: "CHANNEL_PINS_UPDATE",
+			channel_id,
+			data: {
+				channel_id,
+				guild_id: message.guild_id,
+				last_pin_timestamp: undefined
+			}
+		} as ChannelPinsUpdateEvent)
+	]);
+
+	res.sendStatus(204);
+});
+
+router.delete("/:message_id", route({ permission: "VIEW_CHANNEL" }), async (req: Request, res: Response) => {
+	const { channel_id, message_id } = req.params;
+
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+	if (channel.guild_id) req.permission!.hasThrow("MANAGE_MESSAGES");
+
+	const message = await Message.findOneOrFail({ where: { id: message_id } });
+	message.pinned = false;
+
+	await Promise.all([
+		message.save(),
+
+		emitEvent({
+			event: "MESSAGE_UPDATE",
+			channel_id,
+			data: message
+		} as MessageUpdateEvent),
+
+		emitEvent({
+			event: "CHANNEL_PINS_UPDATE",
+			channel_id,
+			data: {
+				channel_id,
+				guild_id: channel.guild_id,
+				last_pin_timestamp: undefined
+			}
+		} as ChannelPinsUpdateEvent)
+	]);
+
+	res.sendStatus(204);
+});
+
+router.get("/", route({ permission: ["READ_MESSAGE_HISTORY"] }), async (req: Request, res: Response) => {
+	const { channel_id } = req.params;
+
+	let pins = await Message.find({ where: { channel_id, pinned: true } });
+
+	res.send(pins);
+});
+
+export default router;

src/api/routes/channels/#channel_id/purge.ts

@@ -0,0 +1,64 @@
+import { HTTPError, PurgeSchema } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { isTextChannel } from "./messages";
+import { FindManyOptions, Between, Not } from "typeorm";
+import { Channel, Config, emitEvent, getPermission, getRights, Message, MessageDeleteBulkEvent } from "@fosscord/util";
+import { Router, Response, Request } from "express";
+import { In } from "typeorm";
+
+const router: Router = Router();
+
+export default router;
+
+/**
+TODO: apply the delete bit by bit to prevent client and database stress
+**/
+router.post("/",route({ /*body: "PurgeSchema",*/ }), async (req: Request, res: Response) => {
+		const { channel_id } = req.params;
+		const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+
+		if (!channel.guild_id) throw new HTTPError("Can't purge dm channels", 400);
+		isTextChannel(channel.type);
+
+		const rights = await getRights(req.user_id);
+		if (!rights.has("MANAGE_MESSAGES")) {
+			const permissions = await getPermission(req.user_id, channel.guild_id, channel_id);
+			permissions.hasThrow("MANAGE_MESSAGES");
+			permissions.hasThrow("MANAGE_CHANNELS");
+		}
+
+		const { before, after } = req.body as PurgeSchema;
+
+		// TODO: send the deletion event bite-by-bite to prevent client stress
+
+		let query: FindManyOptions<Message> & { where: { id?: any } } = {
+			order: { id: "ASC" },
+			// take: limit,
+			where: {
+				channel_id,
+				id: Between(after, before), // the right way around
+				author_id: rights.has("SELF_DELETE_MESSAGES") ? undefined : Not(req.user_id)
+				// if you lack the right of self-deletion, you can't delete your own messages, even in purges
+			},
+			relations: ["author", "webhook", "application", "mentions", "mention_roles", "mention_channels", "sticker_items", "attachments"]
+		};
+
+		const messages = await Message.find(query);
+		const endpoint = Config.get().cdn.endpointPublic;
+
+		if (messages.length == 0) {
+			res.sendStatus(304);
+			return;
+		}
+
+		await Message.delete({ id: In(messages) });
+
+		await emitEvent({
+			event: "MESSAGE_DELETE_BULK",
+			channel_id,
+			data: { ids: messages.map((x) => x.id), channel_id, guild_id: channel.guild_id }
+		} as MessageDeleteBulkEvent);
+
+		res.sendStatus(204);
+	}
+);

src/api/routes/channels/#channel_id/recipients.ts

@@ -0,0 +1,68 @@
+import { Request, Response, Router } from "express";
+import {
+	Channel,
+	ChannelRecipientAddEvent,
+	ChannelType,
+	DiscordApiErrors,
+	DmChannelDTO,
+	emitEvent,
+	PublicUserProjection,
+	Recipient,
+	User
+} from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router: Router = Router();
+
+router.put("/:user_id", route({}), async (req: Request, res: Response) => {
+	const { channel_id, user_id } = req.params;
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id }, relations: ["recipients"] });
+
+	if (channel.type !== ChannelType.GROUP_DM) {
+		const recipients = [...channel.recipients!.map((r) => r.user_id), user_id].unique();
+
+		const new_channel = await Channel.createDMChannel(recipients, req.user_id);
+		return res.status(201).json(new_channel);
+	} else {
+		if (channel.recipients!.map((r) => r.user_id).includes(user_id)) {
+			throw DiscordApiErrors.INVALID_RECIPIENT; //TODO is this the right error?
+		}
+
+		channel.recipients!.push(OrmUtils.mergeDeep(new Recipient(), { channel_id, user_id: user_id }));
+		await channel.save();
+
+		await emitEvent({
+			event: "CHANNEL_CREATE",
+			data: await DmChannelDTO.from(channel, [user_id]),
+			user_id: user_id
+		});
+
+		await emitEvent({
+			event: "CHANNEL_RECIPIENT_ADD",
+			data: {
+				channel_id: channel_id,
+				user: await User.findOneOrFail({ where: { id: user_id }, select: PublicUserProjection })
+			},
+			channel_id: channel_id
+		} as ChannelRecipientAddEvent);
+		return res.sendStatus(204);
+	}
+});
+
+router.delete("/:user_id", route({}), async (req: Request, res: Response) => {
+	const { channel_id, user_id } = req.params;
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id }, relations: ["recipients"] });
+	if (!(channel.type === ChannelType.GROUP_DM && (channel.owner_id === req.user_id || user_id === req.user_id)))
+		throw DiscordApiErrors.MISSING_PERMISSIONS;
+
+	if (!channel.recipients!.map((r) => r.user_id).includes(user_id)) {
+		throw DiscordApiErrors.INVALID_RECIPIENT; //TODO is this the right error?
+	}
+
+	await Channel.removeRecipientFromChannel(channel, user_id);
+
+	return res.sendStatus(204);
+});
+
+export default router;

src/api/routes/channels/#channel_id/typing.ts

@@ -0,0 +1,29 @@
+import { Channel, emitEvent, Member, TypingStartEvent } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { Router, Request, Response } from "express";
+
+const router: Router = Router();
+
+router.post("/", route({ permission: "SEND_MESSAGES" }), async (req: Request, res: Response) => {
+	const { channel_id } = req.params;
+	const user_id = req.user_id;
+	const timestamp = Date.now();
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+	const member = await Member.findOne({ where: { id: user_id, guild_id: channel.guild_id }, relations: ["roles", "user"] });
+
+	await emitEvent({
+		event: "TYPING_START",
+		channel_id: channel_id,
+		data: {
+			...(member ? { member: { ...member, roles: member?.roles?.map((x) => x.id) } } : null),
+			channel_id,
+			timestamp,
+			user_id,
+			guild_id: channel.guild_id
+		}
+	} as TypingStartEvent);
+
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/channels/#channel_id/webhooks.ts

@@ -0,0 +1,34 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+import { Channel, Config, getPermission, trimSpecial, Webhook } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { isTextChannel } from "./messages/index";
+import { DiscordApiErrors } from "@fosscord/util";
+
+const router: Router = Router();
+//TODO: implement webhooks
+router.get("/", route({}), async (req: Request, res: Response) => {
+	res.json([]);
+});
+
+// TODO: use Image Data Type for avatar instead of String
+router.post("/", route({ body: "WebhookCreateSchema", permission: "MANAGE_WEBHOOKS" }), async (req: Request, res: Response) => {
+	const channel_id = req.params.channel_id;
+	const channel = await Channel.findOneOrFail({ where: { id: channel_id } });
+
+	isTextChannel(channel.type);
+	if (!channel.guild_id) throw new HTTPError("Not a guild channel", 400);
+
+	const webhook_count = await Webhook.count({ where: { channel_id } });
+	const { maxWebhooks } = Config.get().limits.channel;
+	if (webhook_count > maxWebhooks) throw DiscordApiErrors.MAXIMUM_WEBHOOKS.withParams(maxWebhooks);
+
+	let { avatar, name } = req.body as { name: string; avatar?: string };
+	name = trimSpecial(name);
+	if (name === "clyde") throw new HTTPError("Invalid name", 400);
+
+	// TODO: save webhook in database and send response
+	res.json(new Webhook());
+});
+
+export default router;

src/api/routes/discoverable-guilds.ts

@@ -0,0 +1,39 @@
+import { Guild, Config } from "@fosscord/util";
+
+import { Router, Request, Response } from "express";
+import { route } from "..";
+import { Like } from "typeorm";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { offset, limit, categories } = req.query;
+	let showAllGuilds = Config.get().guild.discovery.showAllGuilds;
+	let configLimit = Config.get().guild.discovery.limit;
+	// ! this only works using SQL querys
+	// const guilds = await Guild.find({ where: { features: "DISCOVERABLE" } }); //, take: Math.abs(Number(limit)) });
+	let guilds;
+	if (categories == undefined) {
+		guilds = showAllGuilds
+			? await Guild.find({ take: Math.abs(Number(limit || configLimit)) })
+			: await Guild.find({ where: { features: Like("%DISCOVERABLE%") }, take: Math.abs(Number(limit || configLimit)) });
+	} else {
+		guilds = showAllGuilds
+			? await Guild.find({ where: { primary_category_id: Number(categories) }, take: Math.abs(Number(limit || configLimit)) })
+			: await Guild.find({
+					where: { primary_category_id: Number(categories), features: Like("%DISCOVERABLE%") },
+					take: Math.abs(Number(limit || configLimit))
+			  });
+	}
+
+	const total = guilds ? guilds.length : undefined;
+
+	res.send({
+		total: total,
+		guilds: guilds,
+		offset: Number(offset || Config.get().guild.discovery.offset),
+		limit: Number(limit || configLimit)
+	});
+});
+
+export default router;

src/api/routes/discovery.ts

@@ -0,0 +1,18 @@
+import { Categories } from "@fosscord/util";
+import { Router, Response, Request } from "express";
+import { route } from "..";
+
+const router = Router();
+
+router.get("/categories", route({}), async (req: Request, res: Response) => {
+	// TODO:
+	// Get locale instead
+
+	const { locale, primary_only } = req.query;
+
+	const out = primary_only ? await Categories.find() : await Categories.find({ where: {is_primary: true} });
+
+	res.send(out);
+});
+
+export default router;

src/api/routes/downloads.ts

@@ -0,0 +1,20 @@
+import { Router, Response, Request } from "express";
+import { route } from "..";
+import { Release, Config } from "@fosscord/util";
+
+const router = Router();
+
+router.get("/:branch", route({}), async (req: Request, res: Response) => {
+	const { client } = Config.get();
+	const { branch } = req.params;
+	const { platform } = req.query;
+	//TODO
+
+	if(!platform || !["linux", "osx", "win"].includes(platform.toString())) return res.status(404)
+
+	const release = await Release.findOneOrFail({ where: { name: client.releases.upstreamVersion } });
+
+	res.redirect(release[`win_url`]);
+});
+
+export default router;

src/api/routes/experiments.ts

@@ -0,0 +1,11 @@
+import { Router, Response, Request } from "express";
+import { route } from "..";
+
+const router = Router();
+
+router.get("/", route({}), (req: Request, res: Response) => {
+	// TODO:
+	res.send({ fingerprint: "", assignments: [], guild_experiments:[] });
+});
+
+export default router;

src/api/routes/gateway/bot.ts

@@ -0,0 +1,40 @@
+import { Config } from "@fosscord/util";
+import { Router, Response, Request } from "express";
+import { route, RouteOptions } from "@fosscord/api";
+
+const router = Router();
+
+export interface GatewayBotResponse {
+	url: string;
+	shards: number;
+	session_start_limit: {
+		total: number;
+		remaining: number;
+		reset_after: number;
+		max_concurrency: number;
+	};
+}
+
+const options: RouteOptions = {
+	test: {
+		response: {
+			body: "GatewayBotResponse"
+		}
+	}
+};
+
+router.get("/", route(options), (req: Request, res: Response) => {
+	const { endpointPublic } = Config.get().gateway;
+	res.json({
+		url: endpointPublic || process.env.GATEWAY || "ws://localhost:3002",
+		shards: 1,
+		session_start_limit: {
+			total: 1000,
+			remaining: 999,
+			reset_after: 14400000,
+			max_concurrency: 1
+		}
+	});
+});
+
+export default router;

src/api/routes/gateway/index.ts

@@ -0,0 +1,24 @@
+import { Config } from "@fosscord/util";
+import { Router, Response, Request } from "express";
+import { route, RouteOptions } from "@fosscord/api";
+
+const router = Router();
+
+export interface GatewayResponse {
+	url: string;
+}
+
+const options: RouteOptions = {
+	test: {
+		response: {
+			body: "GatewayResponse"
+		}
+	}
+};
+
+router.get("/", route(options), (req: Request, res: Response) => {
+	const { endpointPublic } = Config.get().gateway;
+	res.json({ url: endpointPublic || process.env.GATEWAY || "ws://localhost:3002" });
+});
+
+export default router;

src/api/routes/gifs/search.ts

@@ -0,0 +1,28 @@
+import { Router, Response, Request } from "express";
+import fetch from "node-fetch";
+import ProxyAgent from 'proxy-agent';
+import { route } from "@fosscord/api";
+import { getGifApiKey, parseGifResult } from "./trending";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	// TODO: Custom providers
+	const { q, media_format, locale } = req.query;
+
+	const apiKey = getGifApiKey();
+	
+	const agent = new ProxyAgent();
+
+	const response = await fetch(`https://g.tenor.com/v1/search?q=${q}&media_format=${media_format}&locale=${locale}&key=${apiKey}`, {
+		agent,
+		method: "get",
+		headers: { "Content-Type": "application/json" }
+	});
+
+	const { results } = await response.json() as any;
+
+	res.json(results.map(parseGifResult)).status(200);
+});
+
+export default router;

src/api/routes/gifs/trending-gifs.ts

@@ -0,0 +1,28 @@
+import { Router, Response, Request } from "express";
+import fetch from "node-fetch";
+import ProxyAgent from 'proxy-agent';
+import { route } from "@fosscord/api";
+import { getGifApiKey, parseGifResult } from "./trending";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	// TODO: Custom providers
+	const { media_format, locale } = req.query;
+
+	const apiKey = getGifApiKey();
+	
+	const agent = new ProxyAgent();
+
+	const response = await fetch(`https://g.tenor.com/v1/trending?media_format=${media_format}&locale=${locale}&key=${apiKey}`, {
+		agent,
+		method: "get",
+		headers: { "Content-Type": "application/json" }
+	});
+
+	const { results } = await response.json() as any;
+
+	res.json(results.map(parseGifResult)).status(200);
+});
+
+export default router;

src/api/routes/gifs/trending.ts

@@ -0,0 +1,62 @@
+import { Router, Response, Request } from "express";
+import fetch from "node-fetch";
+import ProxyAgent from 'proxy-agent';
+import { route } from "@fosscord/api";
+import { Config } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+
+const router = Router();
+
+export function parseGifResult(result: any) {
+	return {
+		id: result.id,
+		title: result.title,
+		url: result.itemurl,
+		src: result.media[0].mp4.url,
+		gif_src: result.media[0].gif.url,
+		width: result.media[0].mp4.dims[0],
+		height: result.media[0].mp4.dims[1],
+		preview: result.media[0].mp4.preview
+	};
+}
+
+export function getGifApiKey() {
+	const { enabled, provider, apiKey } = Config.get().gif;
+	if (!enabled) throw new HTTPError(`Gifs are disabled`);
+	if (provider !== "tenor" || !apiKey) throw new HTTPError(`${provider} gif provider not supported`);
+
+	return apiKey;
+}
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	// TODO: Custom providers
+	// TODO: return gifs as mp4
+	const { media_format, locale } = req.query;
+
+	const apiKey = getGifApiKey();
+	
+	const agent = new ProxyAgent();
+
+	const [responseSource, trendGifSource] = await Promise.all([
+		fetch(`https://g.tenor.com/v1/categories?locale=${locale}&key=${apiKey}`, {
+			agent,
+			method: "get",
+			headers: { "Content-Type": "application/json" }
+		}),
+		fetch(`https://g.tenor.com/v1/trending?locale=${locale}&key=${apiKey}`, {
+			agent,
+			method: "get",
+			headers: { "Content-Type": "application/json" }
+		})
+	]);
+
+	const { tags } = await responseSource.json() as any;
+	const { results } = await trendGifSource.json() as any;
+
+	res.json({
+		categories: tags.map((x: any) => ({ name: x.searchterm, src: x.image })),
+		gifs: [parseGifResult(results[0])]
+	}).status(200);
+});
+
+export default router;

src/api/routes/guild-recommendations.ts

@@ -0,0 +1,24 @@
+import { Guild, Config } from "@fosscord/util";
+
+import { Router, Request, Response } from "express";
+import { route } from "..";
+import {Like} from "typeorm"
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { limit, personalization_disabled } = req.query;
+	let showAllGuilds = Config.get().guild.discovery.showAllGuilds;
+	// ! this only works using SQL querys
+	// TODO: implement this with default typeorm query
+	// const guilds = await Guild.find({ where: { features: "DISCOVERABLE" } }); //, take: Math.abs(Number(limit)) });
+
+	const genLoadId = (size: Number) => [...Array(size)].map(() => Math.floor(Math.random() * 16).toString(16)).join('');
+
+	const guilds = showAllGuilds
+		? await Guild.find({ take: Math.abs(Number(limit || 24)) })
+		: await Guild.find({ where: { features: Like('%DISCOVERABLE%') }, take: Math.abs(Number(limit || 24)) });
+	res.send({ recommended_guilds: guilds, load_id: `server_recs/${genLoadId(32)}`}).status(200);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/audit-logs.ts

@@ -0,0 +1,17 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+const router = Router();
+
+//TODO: implement audit logs
+router.get("/", route({}), async (req: Request, res: Response) => {
+	res.json({
+		audit_log_entries: [],
+		users: [],
+		integrations: [],
+		webhooks: [],
+		guild_scheduled_events: [],
+		threads: [],
+		application_commands: []
+	});
+});
+export default router;

src/api/routes/guilds/#guild_id/bans.ts

@@ -0,0 +1,157 @@
+import { Request, Response, Router } from "express";
+import { DiscordApiErrors, emitEvent, getPermission, GuildBanAddEvent, GuildBanRemoveEvent, Guild, Ban, User, Member, BanRegistrySchema, BanModeratorSchema } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { getIpAdress, route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router: Router = Router();
+
+/* TODO: Deleting the secrets is just a temporary go-around. Views should be implemented for both safety and better handling. */
+
+router.get("/", route({ permission: "BAN_MEMBERS" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	let bans = await Ban.find({ where: { guild_id } });
+	let promisesToAwait: object[] = [];
+	const bansObj: object[] = [];
+
+	bans.filter((ban) => ban.user_id !== ban.executor_id); // pretend self-bans don't exist to prevent victim chasing
+
+	bans.forEach((ban) => {
+		promisesToAwait.push(User.getPublicUser(ban.user_id));
+	});
+
+	const bannedUsers: object[] = await Promise.all(promisesToAwait);
+
+	bans.forEach((ban, index) => {
+		const user = bannedUsers[index] as User;
+		bansObj.push({
+			reason: ban.reason,
+			user: {
+				username: user.username,
+				discriminator: user.discriminator,
+				id: user.id,
+				avatar: user.avatar,
+				public_flags: user.public_flags
+			}
+		});
+	});
+
+	return res.json(bansObj);
+});
+
+router.get("/:user", route({ permission: "BAN_MEMBERS" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const user_id = req.params.ban;
+
+	let ban = await Ban.findOneOrFail({ where: { guild_id, user_id } }) as BanRegistrySchema;
+	
+	if (ban.user_id === ban.executor_id) throw DiscordApiErrors.UNKNOWN_BAN;
+	// pretend self-bans don't exist to prevent victim chasing
+	
+	/* Filter secret from registry. */
+	
+	ban = ban as BanModeratorSchema;
+
+	delete ban.ip
+
+	return res.json(ban);
+});
+
+router.put("/:user_id", route({ body: "BanCreateSchema", permission: "BAN_MEMBERS" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const banned_user_id = req.params.user_id;
+
+	if ( (req.user_id === banned_user_id) && (banned_user_id === req.permission!.cache.guild?.owner_id))
+		throw new HTTPError("You are the guild owner, hence can't ban yourself", 403);
+	
+	if (req.permission!.cache.guild?.owner_id === banned_user_id) throw new HTTPError("You can't ban the owner", 400);
+	
+	const banned_user = await User.getPublicUser(banned_user_id);
+
+	const ban = OrmUtils.mergeDeep(new Ban(),{
+		user_id: banned_user_id,
+		guild_id: guild_id,
+		ip: getIpAdress(req),
+		executor_id: req.user_id,
+		reason: req.body.reason // || otherwise empty
+	});
+
+	await Promise.all([
+		Member.removeFromGuild(banned_user_id, guild_id),
+		ban.save(),
+		emitEvent({
+			event: "GUILD_BAN_ADD",
+			data: {
+				guild_id: guild_id,
+				user: banned_user
+			},
+			guild_id: guild_id
+		} as GuildBanAddEvent)
+	]);
+
+	return res.json(ban);
+});
+
+router.put("/@me", route({ body: "BanCreateSchema"}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	const banned_user = await User.getPublicUser(req.params.user_id);
+
+	if (req.permission!.cache.guild?.owner_id === req.params.user_id) 
+		throw new HTTPError("You are the guild owner, hence can't ban yourself", 403);
+	
+	const ban = OrmUtils.mergeDeep(new Ban(), {
+		user_id: req.params.user_id,
+		guild_id: guild_id,
+		ip: getIpAdress(req),
+		executor_id: req.params.user_id,
+		reason: req.body.reason // || otherwise empty
+	});
+
+	await Promise.all([
+		Member.removeFromGuild(req.user_id, guild_id),
+		ban.save(),
+		emitEvent({
+			event: "GUILD_BAN_ADD",
+			data: {
+				guild_id: guild_id,
+				user: banned_user
+			},
+			guild_id: guild_id
+		} as GuildBanAddEvent)
+	]);
+
+	return res.json(ban);
+});
+
+router.delete("/:user_id", route({ permission: "BAN_MEMBERS" }), async (req: Request, res: Response) => {
+	const { guild_id, user_id } = req.params;
+
+	let ban = await Ban.findOneOrFail({ where: { guild_id, user_id } });
+	
+	if (ban.user_id === ban.executor_id) throw DiscordApiErrors.UNKNOWN_BAN;
+	// make self-bans irreversible and hide them from view to avoid victim chasing
+	
+	const banned_user = await User.getPublicUser(user_id);
+	
+	await Promise.all([
+		Ban.delete({
+			user_id: user_id,
+			guild_id
+		}),
+
+		emitEvent({
+			event: "GUILD_BAN_REMOVE",
+			data: {
+				guild_id,
+				user: banned_user
+			},
+			guild_id
+		} as GuildBanRemoveEvent)
+	]);
+
+	return res.status(204).send();
+});
+
+export default router;

src/api/routes/guilds/#guild_id/channels.ts

@@ -0,0 +1,57 @@
+import { Router, Response, Request } from "express";
+import { Channel, ChannelUpdateEvent, getPermission, emitEvent, ChannelModifySchema, ChannelReorderSchema } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const channels = await Channel.find({ where: { guild_id } });
+
+	res.json(channels);
+});
+
+router.post("/", route({ body: "ChannelModifySchema", permission: "MANAGE_CHANNELS" }), async (req: Request, res: Response) => {
+	// creates a new guild channel https://discord.com/developers/docs/resources/guild#create-guild-channel
+	const { guild_id } = req.params;
+	const body = req.body as ChannelModifySchema;
+
+	const channel = await Channel.createChannel({ ...body, guild_id }, req.user_id);
+
+	res.status(201).json(channel);
+});
+
+router.patch("/", route({ body: "ChannelReorderSchema", permission: "MANAGE_CHANNELS" }), async (req: Request, res: Response) => {
+	// changes guild channel position
+	const { guild_id } = req.params;
+	const body = req.body as ChannelReorderSchema;
+
+	await Promise.all([
+		body.map(async (x) => {
+			if (x.position == null && !x.parent_id) throw new HTTPError(`You need to at least specify position or parent_id`, 400);
+
+			const opts: any = {};
+			if (x.position != null) opts.position = x.position;
+
+			if (x.parent_id) {
+				opts.parent_id = x.parent_id;
+				const parent_channel = await Channel.findOneOrFail({
+					where: { id: x.parent_id, guild_id },
+					select: ["permission_overwrites"]
+				});
+				if (x.lock_permissions) {
+					opts.permission_overwrites = parent_channel.permission_overwrites;
+				}
+			}
+
+			await Channel.update({ guild_id, id: x.id }, opts);
+			const channel = await Channel.findOneOrFail({ where: { guild_id, id: x.id } });
+
+			await emitEvent({ event: "CHANNEL_UPDATE", data: channel, channel_id: x.id, guild_id } as ChannelUpdateEvent);
+		})
+	]);
+
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/delete.ts

@@ -0,0 +1,30 @@
+import { Channel, emitEvent, GuildDeleteEvent, Guild, Member, Message, Role, Invite, Emoji } from "@fosscord/util";
+import { Router, Request, Response } from "express";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router = Router();
+
+// discord prefixes this route with /delete instead of using the delete method
+// docs are wrong https://discord.com/developers/docs/resources/guild#delete-guild
+router.post("/", route({}), async (req: Request, res: Response) => {
+	let { guild_id } = req.params;
+
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id }, select: ["owner_id"] });
+	if (guild.owner_id !== req.user_id) throw new HTTPError("You are not the owner of this guild", 401);
+
+	await Promise.all([
+		Guild.delete({ id: guild_id }), // this will also delete all guild related data
+		emitEvent({
+			event: "GUILD_DELETE",
+			data: {
+				id: guild_id
+			},
+			guild_id: guild_id
+		} as GuildDeleteEvent)
+	]);
+
+	return res.sendStatus(204);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/discovery-requirements.ts

@@ -0,0 +1,39 @@
+import { Guild, Config } from "@fosscord/util";
+
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;	
+    // TODO:
+    // Load from database
+    // Admin control, but for now it allows anyone to be discoverable
+
+	res.send({
+		guild_id: guild_id,
+		safe_environment: true,
+        healthy: true,
+        health_score_pending: false,
+        size: true,
+        nsfw_properties: {},
+        protected: true,
+        sufficient: true,
+        sufficient_without_grace_period: true,
+        valid_rules_channel: true,
+        retention_healthy: true,
+        engagement_healthy: true,
+        age: true,
+        minimum_age: 0,
+        health_score: {
+            avg_nonnew_participators: 0,
+            avg_nonnew_communicators: 0,
+            num_intentful_joiners: 0,
+            perc_ret_w1_intentful: 0
+        },
+        minimum_size: 0
+	});
+});
+
+export default router;

src/api/routes/guilds/#guild_id/emojis.ts

@@ -0,0 +1,107 @@
+import { Router, Request, Response } from "express";
+import { Config, DiscordApiErrors, emitEvent, Emoji, EmojiCreateSchema, EmojiModifySchema, GuildEmojisUpdateEvent, handleFile, Member, Snowflake, User } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+	const emojis = await Emoji.find({ where: { guild_id: guild_id }, relations: ["user"] });
+
+	return res.json(emojis);
+});
+
+router.get("/:emoji_id", route({}), async (req: Request, res: Response) => {
+	const { guild_id, emoji_id } = req.params;
+
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+	const emoji = await Emoji.findOneOrFail({ where: { guild_id: guild_id, id: emoji_id }, relations: ["user"] });
+
+	return res.json(emoji);
+});
+
+router.post("/", route({ body: "EmojiCreateSchema", permission: "MANAGE_EMOJIS_AND_STICKERS" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const body = req.body as EmojiCreateSchema;
+
+	const id = Snowflake.generate();
+	const emoji_count = await Emoji.count({ where: { guild_id } });
+	const { maxEmojis } = Config.get().limits.guild;
+
+	if (emoji_count >= maxEmojis) throw DiscordApiErrors.MAXIMUM_NUMBER_OF_EMOJIS_REACHED.withParams(maxEmojis);
+	if (body.require_colons == null) body.require_colons = true;
+
+	const user = await User.findOneOrFail({ where: { id: req.user_id } });
+	body.image = (await handleFile(`/emojis/${id}`, body.image)) as string;
+
+	const emoji = await OrmUtils.mergeDeep(new Emoji(), {
+		id: id,
+		guild_id: guild_id,
+		...body,
+		user: user,
+		managed: false,
+		animated: false, // TODO: Add support animated emojis
+		available: true,
+		roles: []
+	}).save();
+
+	await emitEvent({
+		event: "GUILD_EMOJIS_UPDATE",
+		guild_id: guild_id,
+		data: {
+			guild_id: guild_id,
+			emojis: await Emoji.find({ where: { guild_id } })
+		}
+	} as GuildEmojisUpdateEvent);
+
+	return res.status(201).json(emoji);
+});
+
+router.patch(
+	"/:emoji_id",
+	route({ body: "EmojiModifySchema", permission: "MANAGE_EMOJIS_AND_STICKERS" }),
+	async (req: Request, res: Response) => {
+		const { emoji_id, guild_id } = req.params;
+		const body = req.body as EmojiModifySchema;
+
+		const emoji = await OrmUtils.mergeDeep(new Emoji(), { ...body, id: emoji_id, guild_id: guild_id }).save();
+
+		await emitEvent({
+			event: "GUILD_EMOJIS_UPDATE",
+			guild_id: guild_id,
+			data: {
+				guild_id: guild_id,
+				emojis: await Emoji.find({ where: { guild_id } })
+			}
+		} as GuildEmojisUpdateEvent);
+
+		return res.json(emoji);
+	}
+);
+
+router.delete("/:emoji_id", route({ permission: "MANAGE_EMOJIS_AND_STICKERS" }), async (req: Request, res: Response) => {
+	const { emoji_id, guild_id } = req.params;
+
+	await Emoji.delete({
+		id: emoji_id,
+		guild_id: guild_id
+	});
+
+	await emitEvent({
+		event: "GUILD_EMOJIS_UPDATE",
+		guild_id: guild_id,
+		data: {
+			guild_id: guild_id,
+			emojis: await Emoji.find({ where: { guild_id } })
+		}
+	} as GuildEmojisUpdateEvent);
+
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/index.ts

@@ -0,0 +1,60 @@
+import { Request, Response, Router } from "express";
+import { DiscordApiErrors, emitEvent, getPermission, getRights, Guild, GuildUpdateEvent, GuildUpdateSchema, handleFile, Member } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	const [guild, member] = await Promise.all([
+		Guild.findOneOrFail({ where: { id: guild_id } }),
+		Member.findOne({ where: { guild_id, id: req.user_id } })
+	]);
+	if (!member) throw new HTTPError("You are not a member of the guild you are trying to access", 401);
+
+	// @ts-ignore
+	guild.joined_at = member?.joined_at;
+
+	return res.send(guild);
+});
+
+router.patch("/", route({ body: "GuildUpdateSchema"}), async (req: Request, res: Response) => {
+	const body = req.body as GuildUpdateSchema;
+	const { guild_id } = req.params;
+	
+	
+	const rights = await getRights(req.user_id);
+	const permission = await getPermission(req.user_id, guild_id);
+	
+	if (!rights.has("MANAGE_GUILDS")||!permission.has("MANAGE_GUILD"))
+		throw DiscordApiErrors.MISSING_PERMISSIONS.withParams("MANAGE_GUILD");
+	
+	// TODO: guild update check image
+
+	if (body.icon) body.icon = await handleFile(`/icons/${guild_id}`, body.icon);
+	if (body.banner) body.banner = await handleFile(`/banners/${guild_id}`, body.banner);
+	if (body.splash) body.splash = await handleFile(`/splashes/${guild_id}`, body.splash);
+
+	let guild = await Guild.findOneOrFail({
+		where: { id: guild_id },
+		relations: ["emojis", "roles", "stickers"]
+	});
+	// TODO: check if body ids are valid
+	guild = OrmUtils.mergeDeep(guild, body);
+
+	//TODO: check this, removed toJSON call
+	const data = JSON.parse(JSON.stringify(guild));
+	// TODO: guild hashes
+	// TODO: fix vanity_url_code, template_id
+	delete data.vanity_url_code;
+	delete data.template_id;
+
+	await Promise.all([guild.save(), emitEvent({ event: "GUILD_UPDATE", data, guild_id } as GuildUpdateEvent)]);
+
+	return res.json(data);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/integrations.ts

@@ -0,0 +1,11 @@
+import { Router, Response, Request } from "express";
+import { Channel, ChannelUpdateEvent, getPermission, emitEvent } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+const router = Router();
+
+//TODO: implement integrations list
+router.get("/", route({}), async (req: Request, res: Response) => {
+	res.json([]);
+});
+export default router;

src/api/routes/guilds/#guild_id/invites.ts

@@ -0,0 +1,15 @@
+import { getPermission, Invite, PublicInviteRelation } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { Request, Response, Router } from "express";
+
+const router = Router();
+
+router.get("/", route({ permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	const invites = await Invite.find({ where: { guild_id }, relations: PublicInviteRelation });
+
+	return res.json(invites);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/members/#member_id/index.ts

@@ -0,0 +1,98 @@
+import { Request, Response, Router } from "express";
+import { Member, getPermission, getRights, Role, GuildMemberUpdateEvent, emitEvent, Sticker, Emoji, Rights, Guild, MemberChangeSchema } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id, member_id } = req.params;
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+	const member = await Member.findOneOrFail({ where: { id: member_id, guild_id } });
+
+	return res.json(member);
+});
+
+router.patch("/", route({ body: "MemberChangeSchema" }), async (req: Request, res: Response) => {
+	let { guild_id, member_id } = req.params;
+	if (member_id === "@me") member_id = req.user_id;
+	const body = req.body as MemberChangeSchema;
+
+	const member = await Member.findOneOrFail({ where: { id: member_id, guild_id }, relations: ["roles", "user"] });
+	const permission = await getPermission(req.user_id, guild_id);
+	const everyone = await Role.findOneOrFail({ where: { guild_id: guild_id, name: "@everyone", position: 0 } });
+
+	if (body.roles) {
+		permission.hasThrow("MANAGE_ROLES");
+
+		if (body.roles.indexOf(everyone.id) === -1) body.roles.push(everyone.id);
+		member.roles = body.roles.map((x) => OrmUtils.mergeDeep(new Role(), { id: x })); // foreign key constraint will fail if role doesn't exist
+	}
+
+	await member.save();
+
+	member.roles = member.roles.filter((x) => x.id !== everyone.id);
+
+	// do not use promise.all as we have to first write to db before emitting the event to catch errors
+	await emitEvent({
+		event: "GUILD_MEMBER_UPDATE",
+		guild_id,
+		data: { ...member, roles: member.roles.map((x) => x.id) }
+	} as GuildMemberUpdateEvent);
+
+	res.json(member);
+});
+
+router.put("/", route({}), async (req: Request, res: Response) => {
+
+	// TODO: Lurker mode
+
+	const rights = await getRights(req.user_id);
+
+	let { guild_id, member_id } = req.params;
+	if (member_id === "@me") {
+		member_id = req.user_id;
+		rights.hasThrow("JOIN_GUILDS");
+	} else {
+		// TODO: join others by controller	
+	}
+
+	let guild = await Guild.findOneOrFail({
+		where: { id: guild_id }
+	});
+
+	let emoji = await Emoji.find({
+		where: { guild_id: guild_id }
+	});
+
+	let roles = await Role.find({
+		where: { guild_id: guild_id }
+	});
+
+	let stickers = await Sticker.find({
+		where: { guild_id: guild_id }
+	});
+
+	await Member.addToGuild(member_id, guild_id);
+	res.send({ ...guild, emojis: emoji, roles: roles, stickers: stickers });
+});
+
+router.delete("/", route({}), async (req: Request, res: Response) => {
+	const permission = await getPermission(req.user_id);
+	const rights = await getRights(req.user_id);
+	const { guild_id, member_id } = req.params;
+	if (member_id !== "@me" || member_id === req.user_id) {
+		// TODO: unless force-joined
+		rights.hasThrow("SELF_LEAVE_GROUPS");
+	} else {
+		rights.hasThrow("KICK_BAN_MEMBERS");
+		permission.hasThrow("KICK_MEMBERS");
+	}
+
+	await Member.removeFromGuild(member_id, guild_id);
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/members/#member_id/nick.ts

@@ -0,0 +1,22 @@
+import { getPermission, Member, PermissionResolvable } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { Request, Response, Router } from "express";
+
+const router = Router();
+
+router.patch("/", route({ body: "MemberNickChangeSchema" }), async (req: Request, res: Response) => {
+	let { guild_id, member_id } = req.params;
+	let permissionString: PermissionResolvable = "MANAGE_NICKNAMES";
+	if (member_id === "@me") {
+		member_id = req.user_id;
+		permissionString = "CHANGE_NICKNAME";
+	}
+
+	const perms = await getPermission(req.user_id, guild_id);
+	perms.hasThrow(permissionString);
+
+	await Member.changeNickname(member_id, guild_id, req.body.nick);
+	res.status(200).send();
+});
+
+export default router;

src/api/routes/guilds/#guild_id/members/#member_id/roles/#role_id/index.ts

@@ -0,0 +1,21 @@
+import { getPermission, Member } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { Request, Response, Router } from "express";
+
+const router = Router();
+
+router.delete("/", route({ permission: "MANAGE_ROLES" }), async (req: Request, res: Response) => {
+	const { guild_id, role_id, member_id } = req.params;
+
+	await Member.removeRole(member_id, guild_id, role_id);
+	res.sendStatus(204);
+});
+
+router.put("/", route({ permission: "MANAGE_ROLES" }), async (req: Request, res: Response) => {
+	const { guild_id, role_id, member_id } = req.params;
+
+	await Member.addRole(member_id, guild_id, role_id);
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/members/index.ts

@@ -0,0 +1,31 @@
+import { Request, Response, Router } from "express";
+import { Guild, Member, PublicMemberProjection } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { MoreThan } from "typeorm";
+import { HTTPError } from "@fosscord/util";
+
+const router = Router();
+
+// TODO: send over websocket
+// TODO: check for GUILD_MEMBERS intent
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const limit = Number(req.query.limit) || 1;
+	if (limit > 1000 || limit < 1) throw new HTTPError("Limit must be between 1 and 1000");
+	const after = `${req.query.after}`;
+	const query = after ? { id: MoreThan(after) } : {};
+
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+	const members = await Member.find({
+		where: { guild_id, ...query },
+		select: PublicMemberProjection,
+		take: limit,
+		order: { id: "ASC" }
+	});
+
+	return res.json(members);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/premium.ts

@@ -0,0 +1,10 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+const router = Router();
+
+router.get("/subscriptions", route({}), async (req: Request, res: Response) => {
+	// TODO:
+	res.json([]);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/prune.ts

@@ -0,0 +1,79 @@
+import { Router, Request, Response } from "express";
+import { Guild, Member, Snowflake } from "@fosscord/util";
+import { LessThan, IsNull } from "typeorm";
+import { route } from "@fosscord/api";
+const router = Router();
+
+//Returns all inactive members, respecting role hierarchy
+export const inactiveMembers = async (guild_id: string, user_id: string, days: number, roles: string[] = []) => {
+	let date = new Date();
+	date.setDate(date.getDate() - days);
+	//Snowflake should have `generateFromTime` method? Or similar?
+	let minId = BigInt(date.valueOf() - Snowflake.EPOCH) << BigInt(22);
+
+	/**
+	idea: ability to customise the cutoff variable
+	possible candidates: public read receipt, last presence, last VC leave
+	**/
+	let members = await Member.find({
+		where: [
+			{
+				guild_id,
+				last_message_id: LessThan(minId.toString())
+			},
+			{
+				last_message_id: IsNull()
+			}
+		],
+		relations: ["roles"]
+	});
+	console.log(members);
+	if (!members.length) return [];
+
+	//I'm sure I can do this in the above db query ( and it would probably be better to do so ), but oh well.
+	if (roles.length && members.length) members = members.filter((user) => user.roles?.some((role) => roles.includes(role.id)));
+
+	const me = await Member.findOneOrFail({ where: { id: user_id, guild_id }, relations: ["roles"] });
+	const myHighestRole = Math.max(...(me.roles?.map((x) => x.position) || []));
+
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+
+	members = members.filter(
+		(member) =>
+			member.id !== guild.owner_id && //can't kick owner
+			member.roles?.some(
+				(role) =>
+					role.position < myHighestRole || //roles higher than me can't be kicked
+					me.id === guild.owner_id //owner can kick anyone
+			)
+	);
+
+	return members;
+};
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const days = parseInt(req.query.days as string);
+
+	let roles = req.query.include_roles;
+	if (typeof roles === "string") roles = [roles]; //express will return array otherwise
+
+	const members = await inactiveMembers(req.params.guild_id, req.user_id, days, roles as string[]);
+
+	res.send({ pruned: members.length });
+});
+
+router.post("/", route({ permission: "KICK_MEMBERS", right: "KICK_BAN_MEMBERS" }), async (req: Request, res: Response) => {
+	const days = parseInt(req.body.days);
+
+	let roles = req.query.include_roles;
+	if (typeof roles === "string") roles = [roles];
+
+	const { guild_id } = req.params;
+	const members = await inactiveMembers(guild_id, req.user_id, days, roles as string[]);
+
+	await Promise.all(members.map((x) => Member.removeFromGuild(x.id, guild_id)));
+
+	res.send({ purged: members.length });
+});
+
+export default router;

src/api/routes/guilds/#guild_id/regions.ts

@@ -0,0 +1,15 @@
+import { Config, Guild, Member } from "@fosscord/util";
+import { Request, Response, Router } from "express";
+import { getVoiceRegions, route } from "@fosscord/api";
+import { getIpAdress } from "@fosscord/api";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+	//TODO we should use an enum for guild's features and not hardcoded strings
+	return res.json(await getVoiceRegions(getIpAdress(req), guild.features.includes("VIP_REGIONS")));
+});
+
+export default router;

src/api/routes/guilds/#guild_id/roles/#role_id/index.ts

@@ -0,0 +1,68 @@
+import { Router, Request, Response } from "express";
+import { Role, Member, GuildRoleUpdateEvent, GuildRoleDeleteEvent, emitEvent, handleFile, RoleModifySchema } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { HTTPError } from "@fosscord/util";
+import { OrmUtils } from "@fosscord/util";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id, role_id } = req.params;
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+	const role = await Role.findOneOrFail({ where: { guild_id, id: role_id } });
+	return res.json(role);
+});
+
+router.delete("/", route({ permission: "MANAGE_ROLES" }), async (req: Request, res: Response) => {
+	const { guild_id, role_id } = req.params;
+	if (role_id === guild_id) throw new HTTPError("You can't delete the @everyone role");
+
+	await Promise.all([
+		Role.delete({
+			id: role_id,
+			guild_id: guild_id
+		}),
+		emitEvent({
+			event: "GUILD_ROLE_DELETE",
+			guild_id,
+			data: {
+				guild_id,
+				role_id
+			}
+		} as GuildRoleDeleteEvent)
+	]);
+
+	res.sendStatus(204);
+});
+
+// TODO: check role hierarchy
+
+router.patch("/", route({ body: "RoleModifySchema", permission: "MANAGE_ROLES" }), async (req: Request, res: Response) => {
+	const { role_id, guild_id } = req.params;
+	const body = req.body as RoleModifySchema;
+
+	if (body.icon) body.icon = await handleFile(`/role-icons/${role_id}`, body.icon as string);
+
+	const role = OrmUtils.mergeDeep(new Role(), {
+		...body,
+		id: role_id,
+		guild_id,
+		permissions: String(req.permission!.bitfield & BigInt(body.permissions || "0"))
+	});
+
+	await Promise.all([
+		role.save(),
+		emitEvent({
+			event: "GUILD_ROLE_UPDATE",
+			guild_id,
+			data: {
+				guild_id,
+				role
+			}
+		} as GuildRoleUpdateEvent)
+	]);
+
+	res.json(role);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/roles/index.ts

@@ -0,0 +1,98 @@
+import { Request, Response, Router } from "express";
+import {
+	Role,
+	getPermission,
+	Member,
+	GuildRoleCreateEvent,
+	GuildRoleUpdateEvent,
+	GuildRoleDeleteEvent,
+	emitEvent,
+	Config,
+	DiscordApiErrors,
+	handleFile,
+	RoleModifySchema,
+	RolePositionUpdateSchema
+} from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const guild_id = req.params.guild_id;
+
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+	const roles = await Role.find({ where: { guild_id } });
+
+	return res.json(roles);
+});
+
+router.post("/", route({ body: "RoleModifySchema", permission: "MANAGE_ROLES" }), async (req: Request, res: Response) => {
+	const guild_id = req.params.guild_id;
+	const body = req.body as RoleModifySchema;
+
+	const role_count = await Role.count({ where: { guild_id } });
+	const { maxRoles } = Config.get().limits.guild;
+
+	if (role_count > maxRoles) throw DiscordApiErrors.MAXIMUM_ROLES.withParams(maxRoles);
+
+	let role: Role = OrmUtils.mergeDeep(new Role(),{
+		// values before ...body are default and can be overriden
+		position: 0,
+		hoist: false,
+		color: 0,
+		mentionable: false,
+		...body,
+		guild_id: guild_id,
+		managed: false,
+		permissions: String(req.permission!.bitfield & BigInt(body.permissions || "0")),
+		tags: undefined,
+		icon: null,
+		unicode_emoji: null
+	});
+
+	await Promise.all([
+		role.save(),
+		emitEvent({
+			event: "GUILD_ROLE_CREATE",
+			guild_id,
+			data: {
+				guild_id,
+				role: role
+			}
+		} as GuildRoleCreateEvent)
+	]);
+
+	res.json(role);
+});
+
+router.patch("/", route({ body: "RolePositionUpdateSchema" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const body = req.body as RolePositionUpdateSchema;
+
+	const perms = await getPermission(req.user_id, guild_id);
+	perms.hasThrow("MANAGE_ROLES");
+
+	await Promise.all(body.map(async (x) => Role.update({ guild_id, id: x.id }, { position: x.position })));
+
+	const roles = await Role.find({ where: body.map((x) => ({ id: x.id, guild_id })) });
+
+	await Promise.all(
+		roles.map((x) =>
+			emitEvent({
+				event: "GUILD_ROLE_UPDATE",
+				guild_id,
+				data: {
+					guild_id,
+					role: x
+				}
+			} as GuildRoleUpdateEvent)
+		)
+	);
+
+	res.json(roles);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/stickers.ts

@@ -0,0 +1,121 @@
+import {
+	emitEvent,
+	GuildStickersUpdateEvent,
+	handleFile,
+	Member,
+	ModifyGuildStickerSchema,
+	Snowflake,
+	Sticker,
+	StickerFormatType,
+	StickerType,
+	uploadFile
+} from "@fosscord/util";
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+import multer from "multer";
+import { HTTPError } from "@fosscord/util";
+import { OrmUtils } from "@fosscord/util";
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+	res.json(await Sticker.find({ where: { guild_id } }));
+});
+
+const bodyParser = multer({
+	limits: {
+		fileSize: 1024 * 1024 * 100,
+		fields: 10,
+		files: 1
+	},
+	storage: multer.memoryStorage()
+}).single("file");
+
+router.post(
+	"/",
+	bodyParser,
+	route({ permission: "MANAGE_EMOJIS_AND_STICKERS", body: "ModifyGuildStickerSchema" }),
+	async (req: Request, res: Response) => {
+		if (!req.file) throw new HTTPError("missing file");
+
+		const { guild_id } = req.params;
+		const body = req.body as ModifyGuildStickerSchema;
+		const id = Snowflake.generate();
+
+		const [sticker] = await Promise.all([
+			OrmUtils.mergeDeep(new Sticker(), {
+				...body,
+				guild_id,
+				id,
+				type: StickerType.GUILD,
+				format_type: getStickerFormat(req.file.mimetype),
+				available: true
+			}).save(),
+			uploadFile(`/stickers/${id}`, req.file)
+		]);
+
+		await sendStickerUpdateEvent(guild_id);
+
+		res.json(sticker);
+	}
+);
+
+export function getStickerFormat(mime_type: string) {
+	switch (mime_type) {
+		case "image/apng":
+			return StickerFormatType.APNG;
+		case "application/json":
+			return StickerFormatType.LOTTIE;
+		case "image/png":
+			return StickerFormatType.PNG;
+		case "image/gif":
+			return StickerFormatType.GIF;
+		default:
+			throw new HTTPError("invalid sticker format: must be png, apng or lottie");
+	}
+}
+
+router.get("/:sticker_id", route({}), async (req: Request, res: Response) => {
+	const { guild_id, sticker_id } = req.params;
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+	res.json(await Sticker.findOneOrFail({ where: { guild_id, id: sticker_id } }));
+});
+
+router.patch(
+	"/:sticker_id",
+	route({ body: "ModifyGuildStickerSchema", permission: "MANAGE_EMOJIS_AND_STICKERS" }),
+	async (req: Request, res: Response) => {
+		const { guild_id, sticker_id } = req.params;
+		const body = req.body as ModifyGuildStickerSchema;
+
+		const sticker = await OrmUtils.mergeDeep(new Sticker(), { ...body, guild_id, id: sticker_id }).save();
+		await sendStickerUpdateEvent(guild_id);
+
+		return res.json(sticker);
+	}
+);
+
+async function sendStickerUpdateEvent(guild_id: string) {
+	return emitEvent({
+		event: "GUILD_STICKERS_UPDATE",
+		guild_id: guild_id,
+		data: {
+			guild_id: guild_id,
+			stickers: await Sticker.find({ where: { guild_id } })
+		}
+	} as GuildStickersUpdateEvent);
+}
+
+router.delete("/:sticker_id", route({ permission: "MANAGE_EMOJIS_AND_STICKERS" }), async (req: Request, res: Response) => {
+	const { guild_id, sticker_id } = req.params;
+
+	await Sticker.delete({ guild_id, id: sticker_id });
+	await sendStickerUpdateEvent(guild_id);
+
+	return res.sendStatus(204);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/templates.ts

@@ -0,0 +1,83 @@
+import { Request, Response, Router } from "express";
+import { Guild, Template } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { generateCode } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router: Router = Router();
+
+const TemplateGuildProjection: (keyof Guild)[] = [
+	"name",
+	"description",
+	"region",
+	"verification_level",
+	"default_message_notifications",
+	"explicit_content_filter",
+	"preferred_locale",
+	"afk_timeout",
+	"roles",
+	// "channels",
+	"afk_channel_id",
+	"system_channel_id",
+	"system_channel_flags",
+	"icon"
+];
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	let templates = await Template.find({ where: { source_guild_id: guild_id } });
+
+	return res.json(templates);
+});
+
+router.post("/", route({ body: "TemplateCreateSchema", permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id }, select: TemplateGuildProjection });
+	const exists = await Template.findOneOrFail({ where: { id: guild_id } }).catch((e) => {});
+	if (exists) throw new HTTPError("Template already exists", 400);
+
+	const template = await OrmUtils.mergeDeep(new Template(), {
+		...req.body,
+		code: generateCode(),
+		creator_id: req.user_id,
+		created_at: new Date(),
+		updated_at: new Date(),
+		source_guild_id: guild_id,
+		serialized_source_guild: guild
+	}).save();
+
+	res.json(template);
+});
+
+router.delete("/:code", route({ permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const { code, guild_id } = req.params;
+
+	const template = await Template.delete({
+		code,
+		source_guild_id: guild_id
+	});
+
+	res.json(template);
+});
+
+router.put("/:code", route({ permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const { code, guild_id } = req.params;
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id }, select: TemplateGuildProjection });
+
+	const template = await OrmUtils.mergeDeep(new Template(), { code, serialized_source_guild: guild }).save();
+
+	res.json(template);
+});
+
+router.patch("/:code", route({ body: "TemplateModifySchema", permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const { code, guild_id } = req.params;
+	const { name, description } = req.body;
+
+	const template = await OrmUtils.mergeDeep(new Template(), { code, name: name, description: description, source_guild_id: guild_id }).save();
+
+	res.json(template);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/vanity-url.ts

@@ -0,0 +1,59 @@
+import { Channel, ChannelType, getPermission, Guild, Invite, trimSpecial, VanityUrlSchema } from "@fosscord/util";
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+import { HTTPError } from "@fosscord/util";
+import { OrmUtils } from "@fosscord/util";
+
+const router = Router();
+
+const InviteRegex = /\W/g;
+
+router.get("/", route({ permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+
+	if (!guild.features.includes("ALIASABLE_NAMES")) {
+		const invite = await Invite.findOne({ where: { guild_id: guild_id, vanity_url: true } });
+		if (!invite) return res.json({ code: null });
+
+		return res.json({ code: invite.code, uses: invite.uses });
+	} else {
+		const invite = await Invite.find({ where: { guild_id: guild_id, vanity_url: true } });
+		if (!invite || invite.length == 0) return res.json({ code: null });
+
+		return res.json(invite.map((x) => ({ code: x.code, uses: x.uses })));
+	}
+});
+
+router.patch("/", route({ body: "VanityUrlSchema", permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+	const body = req.body as VanityUrlSchema;
+	const code = body.code?.replace(InviteRegex, "");
+
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+	if (!guild.features.includes("VANITY_URL")) throw new HTTPError("Your guild doesn't support vanity urls");
+
+	if (!code || code.length === 0) throw new HTTPError("Code cannot be null or empty");
+
+	const invite = await Invite.findOne({ where: { code } });
+	if (invite) throw new HTTPError("Invite already exists");
+
+	const { id } = await Channel.findOneOrFail({ where: { guild_id, type: ChannelType.GUILD_TEXT } });
+
+	await OrmUtils.mergeDeep(new Invite(), {
+		vanity_url: true,
+		code: code,
+		temporary: false,
+		uses: 0,
+		max_uses: 0,
+		max_age: 0,
+		created_at: new Date(),
+		expires_at: new Date(),
+		guild_id: guild_id,
+		channel_id: id
+	}).save();
+
+	return res.json({ where: { code } });
+});
+
+export default router;

src/api/routes/guilds/#guild_id/voice-states/#user_id/index.ts

@@ -0,0 +1,51 @@
+import { Channel, ChannelType, DiscordApiErrors, emitEvent, getPermission, VoiceState, VoiceStateUpdateEvent, VoiceStateUpdateSchema } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { Request, Response, Router } from "express";
+import { OrmUtils } from "@fosscord/util";
+
+const router = Router();
+router.patch("/", route({ body: "VoiceStateUpdateSchema" }), async (req: Request, res: Response) => {
+	const body = req.body as VoiceStateUpdateSchema;
+	let { guild_id, user_id } = req.params;
+	if (user_id === "@me") user_id = req.user_id;
+
+	const perms = await getPermission(req.user_id, guild_id, body.channel_id);
+
+	/*
+	From https://discord.com/developers/docs/resources/guild#modify-current-user-voice-state
+	You must have the MUTE_MEMBERS permission to unsuppress others. You can always suppress yourself.
+	You must have the REQUEST_TO_SPEAK permission to request to speak. You can always clear your own request to speak.
+	 */
+	if (body.suppress && user_id !== req.user_id) {
+		perms.hasThrow("MUTE_MEMBERS");
+	}
+	if (!body.suppress) body.request_to_speak_timestamp = new Date();
+	if (body.request_to_speak_timestamp) perms.hasThrow("REQUEST_TO_SPEAK");
+
+	let voice_state = await VoiceState.findOne({
+		where: {
+			guild_id,
+			channel_id: body.channel_id,
+			user_id
+		}
+	});
+	if (!voice_state) throw DiscordApiErrors.UNKNOWN_VOICE_STATE;
+
+	voice_state = OrmUtils.mergeDeep(voice_state, body) as VoiceState;
+	const channel = await Channel.findOneOrFail({ where: { guild_id, id: body.channel_id } });
+	if (channel.type !== ChannelType.GUILD_STAGE_VOICE) {
+		throw DiscordApiErrors.CANNOT_EXECUTE_ON_THIS_CHANNEL_TYPE;
+	}
+
+	await Promise.all([
+		voice_state.save(),
+		emitEvent({
+			event: "VOICE_STATE_UPDATE",
+			data: voice_state,
+			guild_id
+		} as VoiceStateUpdateEvent)
+	]);
+	return res.sendStatus(204);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/webhooks.ts

@@ -0,0 +1,11 @@
+import { Router, Response, Request } from "express";
+import { Channel, ChannelUpdateEvent, getPermission, emitEvent } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+const router = Router();
+
+//TODO: implement webhooks
+router.get("/", route({}), async (req: Request, res: Response) => {
+	res.json([]);
+});
+export default router;

src/api/routes/guilds/#guild_id/welcome_screen.ts

@@ -0,0 +1,31 @@
+import { Request, Response, Router } from "express";
+import { Guild, getPermission, Snowflake, Member, GuildUpdateWelcomeScreenSchema } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const guild_id = req.params.guild_id;
+
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+	await Member.IsInGuildOrFail(req.user_id, guild_id);
+
+	res.json(guild.welcome_screen);
+});
+
+router.patch("/", route({ body: "GuildUpdateWelcomeScreenSchema", permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const guild_id = req.params.guild_id;
+	const body = req.body as GuildUpdateWelcomeScreenSchema;
+
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+
+	if (!guild.welcome_screen.enabled) throw new HTTPError("Welcome screen disabled", 400);
+	if (body.welcome_channels) guild.welcome_screen.welcome_channels = body.welcome_channels; // TODO: check if they exist and are valid
+	if (body.description) guild.welcome_screen.description = body.description;
+	if (body.enabled != null) guild.welcome_screen.enabled = body.enabled;
+
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/widget.json.ts

@@ -0,0 +1,83 @@
+import { Request, Response, Router } from "express";
+import { Config, Permissions, Guild, Invite, Channel, Member } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { random, route } from "@fosscord/api";
+import { OrmUtils } from "@fosscord/util";
+
+const router: Router = Router();
+
+// Undocumented API notes:
+// An invite is created for the widget_channel_id on request (only if an existing one created by the widget doesn't already exist)
+// This invite created doesn't include an inviter object like user created ones and has a default expiry of 24 hours
+// Missing user object information is intentional (https://github.com/discord/discord-api-docs/issues/1287)
+// channels returns voice channel objects where @everyone has the CONNECT permission
+// members (max 100 returned) is a sample of all members, and bots par invisible status, there exists some alphabetical distribution pattern between the members returned
+
+// https://discord.com/developers/docs/resources/guild#get-guild-widget
+// TODO: Cache the response for a guild for 5 minutes regardless of response
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+	if (!guild.widget_enabled) throw new HTTPError("Widget Disabled", 404);
+
+	// Fetch existing widget invite for widget channel
+	let invite = await Invite.findOne({ where: { channel_id: guild.widget_channel_id } });
+
+	if (guild.widget_channel_id && !invite) {
+		// Create invite for channel if none exists
+		// TODO: Refactor invite create code to a shared function
+		const max_age = 86400; // 24 hours
+		const expires_at = new Date(max_age * 1000 + Date.now());
+		const body = {
+			code: random(),
+			temporary: false,
+			uses: 0,
+			max_uses: 0,
+			max_age: max_age,
+			expires_at,
+			created_at: new Date(),
+			guild_id,
+			channel_id: guild.widget_channel_id,
+			inviter_id: null
+		};
+
+		invite = await OrmUtils.mergeDeep(new Invite(), body).save();
+	}
+
+	// Fetch voice channels, and the @everyone permissions object
+	const channels = [] as any[];
+
+	(await Channel.find({ where: { guild_id: guild_id, type: 2 }, order: { position: "ASC" } })).filter((doc) => {
+		// Only return channels where @everyone has the CONNECT permission
+		if (
+			doc.permission_overwrites === undefined ||
+			Permissions.channelPermission(doc.permission_overwrites, Permissions.FLAGS.CONNECT) === Permissions.FLAGS.CONNECT
+		) {
+			channels.push({
+				id: doc.id,
+				name: doc.name,
+				position: doc.position
+			});
+		}
+	});
+
+	// Fetch members
+	// TODO: Understand how Discord's max 100 random member sample works, and apply to here (see top of this file)
+	let members = await Member.find({ where: { guild_id } });
+
+	// Construct object to respond with
+	const data = {
+		id: guild_id,
+		name: guild.name,
+		instant_invite: invite?.code,
+		channels: channels,
+		members: members,
+		presence_count: guild.presence_count
+	};
+
+	res.set("Cache-Control", "public, max-age=300");
+	return res.json(data);
+});
+
+export default router;

src/api/routes/guilds/#guild_id/widget.png.ts

@@ -0,0 +1,111 @@
+import { Request, Response, Router } from "express";
+import { Guild } from "@fosscord/util";
+import { HTTPError } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import fs from "fs";
+import path from "path";
+
+const router: Router = Router();
+
+// TODO: use svg templates instead of node-canvas for improved performance and to change it easily
+
+// https://discord.com/developers/docs/resources/guild#get-guild-widget-image
+// TODO: Cache the response
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+	if (!guild.widget_enabled) throw new HTTPError("Unknown Guild", 404);
+
+	// Fetch guild information
+	const icon = guild.icon;
+	const name = guild.name;
+	const presence = guild.presence_count + " ONLINE";
+
+	// Fetch parameter
+	const style = req.query.style?.toString() || "shield";
+	if (!["shield", "banner1", "banner2", "banner3", "banner4"].includes(style)) {
+		throw new HTTPError("Value must be one of ('shield', 'banner1', 'banner2', 'banner3', 'banner4').", 400);
+	}
+
+	// Setup canvas
+	const { createCanvas } = require("canvas");
+	const { loadImage } = require("canvas");
+	const sizeOf = require("image-size");
+
+	// TODO: Widget style templates need Fosscord branding
+	const source = path.join(__dirname, "..", "..", "..", "..", "..", "assets", "widget", `${style}.png`);
+	if (!fs.existsSync(source)) {
+		throw new HTTPError("Widget template does not exist.", 400);
+	}
+
+	// Create base template image for parameter
+	const { width, height } = await sizeOf(source);
+	const canvas = createCanvas(width, height);
+	const ctx = canvas.getContext("2d");
+	const template = await loadImage(source);
+	ctx.drawImage(template, 0, 0);
+
+	// Add the guild specific information to the template asset image
+	switch (style) {
+		case "shield":
+			ctx.textAlign = "center";
+			await drawText(ctx, 73, 13, "#FFFFFF", "thin 10px Verdana", presence);
+			break;
+		case "banner1":
+			if (icon) await drawIcon(ctx, 20, 27, 50, icon);
+			await drawText(ctx, 83, 51, "#FFFFFF", "12px Verdana", name, 22);
+			await drawText(ctx, 83, 66, "#C9D2F0FF", "thin 11px Verdana", presence);
+			break;
+		case "banner2":
+			if (icon) await drawIcon(ctx, 13, 19, 36, icon);
+			await drawText(ctx, 62, 34, "#FFFFFF", "12px Verdana", name, 15);
+			await drawText(ctx, 62, 49, "#C9D2F0FF", "thin 11px Verdana", presence);
+			break;
+		case "banner3":
+			if (icon) await drawIcon(ctx, 20, 20, 50, icon);
+			await drawText(ctx, 83, 44, "#FFFFFF", "12px Verdana", name, 27);
+			await drawText(ctx, 83, 58, "#C9D2F0FF", "thin 11px Verdana", presence);
+			break;
+		case "banner4":
+			if (icon) await drawIcon(ctx, 21, 136, 50, icon);
+			await drawText(ctx, 84, 156, "#FFFFFF", "13px Verdana", name, 27);
+			await drawText(ctx, 84, 171, "#C9D2F0FF", "thin 12px Verdana", presence);
+			break;
+		default:
+			throw new HTTPError("Value must be one of ('shield', 'banner1', 'banner2', 'banner3', 'banner4').", 400);
+	}
+
+	// Return final image
+	const buffer = canvas.toBuffer("image/png");
+	res.set("Content-Type", "image/png");
+	res.set("Cache-Control", "public, max-age=3600");
+	return res.send(buffer);
+});
+
+async function drawIcon(canvas: any, x: number, y: number, scale: number, icon: string) {
+	// @ts-ignore
+	const img = new require("canvas").Image();
+	img.src = icon;
+
+	// Do some canvas clipping magic!
+	canvas.save();
+	canvas.beginPath();
+
+	const r = scale / 2; // use scale to determine radius
+	canvas.arc(x + r, y + r, r, 0, 2 * Math.PI, false); // start circle at x, and y coords + radius to find center
+
+	canvas.clip();
+	canvas.drawImage(img, x, y, scale, scale);
+
+	canvas.restore();
+}
+
+async function drawText(canvas: any, x: number, y: number, color: string, font: string, text: string, maxcharacters?: number) {
+	canvas.fillStyle = color;
+	canvas.font = font;
+	if (text.length > (maxcharacters || 0) && maxcharacters) text = text.slice(0, maxcharacters) + "...";
+	canvas.fillText(text, x, y);
+}
+
+export default router;

src/api/routes/guilds/#guild_id/widget.ts

@@ -0,0 +1,27 @@
+import { Request, Response, Router } from "express";
+import { Guild, WidgetModifySchema } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+// https://discord.com/developers/docs/resources/guild#get-guild-widget-settings
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;
+
+	const guild = await Guild.findOneOrFail({ where: { id: guild_id } });
+
+	return res.json({ enabled: guild.widget_enabled || false, channel_id: guild.widget_channel_id || null });
+});
+
+// https://discord.com/developers/docs/resources/guild#modify-guild-widget
+router.patch("/", route({ body: "WidgetModifySchema", permission: "MANAGE_GUILD" }), async (req: Request, res: Response) => {
+	const body = req.body as WidgetModifySchema;
+	const { guild_id } = req.params;
+
+	await Guild.update({ id: guild_id }, { widget_enabled: body.enabled, widget_channel_id: body.channel_id });
+	// Widget invite for the widget_channel_id gets created as part of the /guilds/{guild.id}/widget.json request
+
+	return res.json(body);
+});
+
+export default router;

src/api/routes/guilds/index.ts

@@ -0,0 +1,32 @@
+import { Router, Request, Response } from "express";
+import { Role, Guild, Snowflake, Config, getRights, Member, Channel, DiscordApiErrors, handleFile, GuildCreateSchema } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+//TODO: create default channel
+
+router.post("/", route({ body: "GuildCreateSchema", right: "CREATE_GUILDS" }), async (req: Request, res: Response) => {
+	const body = req.body as GuildCreateSchema;
+
+	const { maxGuilds } = Config.get().limits.user;
+	const guild_count = await Member.count({ where: { id: req.user_id } });
+	const rights = await getRights(req.user_id);
+	if ((guild_count >= maxGuilds)&&!rights.has("MANAGE_GUILDS")) {
+		throw DiscordApiErrors.MAXIMUM_GUILDS.withParams(maxGuilds);
+	}
+
+	const guild = await Guild.createGuild({ ...body, owner_id: req.user_id });
+
+	const { autoJoin } = Config.get().guild;
+	if (autoJoin.enabled && !autoJoin.guilds?.length) {
+		// @ts-ignore
+		await Config.set({ guild: { autoJoin: { guilds: [guild.id] } } });
+	}
+
+	await Member.addToGuild(req.user_id, guild.id);
+
+	res.status(201).json({ id: guild.id });
+});
+
+export default router;

src/api/routes/guilds/templates/index.ts

@@ -0,0 +1,79 @@
+import { Request, Response, Router } from "express";
+import { Template, Guild, Role, Snowflake, Config, User, Member, DiscordApiErrors, OrmUtils, GuildTemplateCreateSchema } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import fetch from "node-fetch";
+const router: Router = Router();
+
+router.get("/:code", route({}), async (req: Request, res: Response) => {
+	const { allowDiscordTemplates, allowRaws, enabled } = Config.get().templates;
+	if (!enabled) res.json({ code: 403, message: "Template creation & usage is disabled on this instance." }).sendStatus(403);
+
+	const { code } = req.params;
+	
+	if (code.startsWith("discord:")) {
+		if (!allowDiscordTemplates)	return res.json({ code: 403, message: "Discord templates cannot be used on this instance." }).sendStatus(403);
+		const discordTemplateID = code.split("discord:", 2)[1];
+
+		const discordTemplateData = await fetch(`https://discord.com/api/v9/guilds/templates/${discordTemplateID}`, {
+			method: "get",
+			headers: { "Content-Type": "application/json" }
+		});
+		return res.json(await discordTemplateData.json());
+	}
+
+	if (code.startsWith("external:")) {
+		if (!allowRaws)	return res.json({ code: 403, message: "Importing raws is disabled on this instance." }).sendStatus(403);
+
+		return res.json(code.split("external:", 2)[1]);
+	}
+
+	const template = await Template.findOneOrFail({ where: { code } });
+	res.json(template);
+});
+
+router.post("/:code", route({ body: "GuildTemplateCreateSchema" }), async (req: Request, res: Response) => {
+	const { enabled, allowTemplateCreation, allowDiscordTemplates, allowRaws } = Config.get().templates;
+	if (!enabled) return res.json({ code: 403, message: "Template creation & usage is disabled on this instance." }).sendStatus(403);
+	if (!allowTemplateCreation) return res.json({ code: 403, message: "Template creation is disabled on this instance." }).sendStatus(403);
+
+	const { code } = req.params;
+	const body = req.body as GuildTemplateCreateSchema;
+
+	const { maxGuilds } = Config.get().limits.user;
+
+	const guild_count = await Member.count({ where: { id: req.user_id } });
+	if (guild_count >= maxGuilds) {
+		throw DiscordApiErrors.MAXIMUM_GUILDS.withParams(maxGuilds);
+	}
+
+	const template = await Template.findOneOrFail({ where: { code } });
+
+	const guild_id = Snowflake.generate();
+
+	const [guild, role] = await Promise.all([
+		OrmUtils.mergeDeep(new Guild(), {
+			...body,
+			...template.serialized_source_guild,
+			id: guild_id,
+			owner_id: req.user_id
+		}).save(),
+		(OrmUtils.mergeDeep(new Role(), {
+			id: guild_id,
+			guild_id: guild_id,
+			color: 0,
+			hoist: false,
+			managed: true,
+			mentionable: true,
+			name: "@everyone",
+			permissions: BigInt("2251804225"),
+			position: 0,
+			tags: null
+		}) as Role).save()
+	]);
+
+	await Member.addToGuild(req.user_id, guild_id);
+
+	res.status(201).json({ id: guild.id });
+});
+
+export default router;

src/api/routes/invites/index.ts

@@ -0,0 +1,57 @@
+import { Router, Request, Response } from "express";
+import { emitEvent, getPermission, Guild, Invite, InviteDeleteEvent, User, PublicInviteRelation } from "@fosscord/util";
+import { route } from "@fosscord/api";
+import { HTTPError } from "@fosscord/util";
+
+const router: Router = Router();
+
+router.get("/:code", route({}), async (req: Request, res: Response) => {
+	const { code } = req.params;
+
+	const invite = await Invite.findOneOrFail({ where: { code }, relations: PublicInviteRelation });
+
+	res.status(200).send(invite);
+});
+
+router.post("/:code", route({right: "USE_MASS_INVITES"}), async (req: Request, res: Response) => {
+	const { code } = req.params;
+    const { guild_id } = await Invite.findOneOrFail({ where: { code } })
+	const { features } = await Guild.findOneOrFail({ where: { id: guild_id} });
+	const { public_flags } = await User.findOneOrFail({ where: { id: req.user_id } });
+	
+	if(features.includes("INTERNAL_EMPLOYEE_ONLY") && (public_flags & 1) !== 1) throw new HTTPError("Only intended for the staff of this server.", 401);
+	if(features.includes("INVITES_CLOSED")) throw new HTTPError("Sorry, this guild has joins closed.", 403);
+	
+	const invite = await Invite.joinGuild(req.user_id, code);
+
+	res.json(invite);
+});
+
+// * cant use permission of route() function because path doesn't have guild_id/channel_id
+router.delete("/:code", route({}), async (req: Request, res: Response) => {
+	const { code } = req.params;
+	const invite = await Invite.findOneOrFail({ where: { code } });
+	const { guild_id, channel_id } = invite;
+
+	const permission = await getPermission(req.user_id, guild_id, channel_id);
+
+	if (!permission.has("MANAGE_GUILD") && !permission.has("MANAGE_CHANNELS"))
+		throw new HTTPError("You missing the MANAGE_GUILD or MANAGE_CHANNELS permission", 401);
+
+	await Promise.all([
+		Invite.delete({ code }),
+		emitEvent({
+			event: "INVITE_DELETE",
+			guild_id: guild_id,
+			data: {
+				channel_id: channel_id,
+				guild_id: guild_id,
+				code: code
+			}
+		} as InviteDeleteEvent)
+	]);
+
+	res.json({ invite: invite });
+});
+
+export default router;

src/api/routes/oauth2/tokens.ts

@@ -0,0 +1,10 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	//TODO
+	res.json([]);
+});
+
+export default router;

src/api/routes/outbound-promotions.ts

@@ -0,0 +1,11 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	//TODO
+	res.json([]).status(200);
+});
+
+export default router;

src/api/routes/partners/#guild_id/requirements.ts

@@ -0,0 +1,40 @@
+
+import { Guild, Config } from "@fosscord/util";
+
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { guild_id } = req.params;	
+    // TODO:
+    // Load from database
+    // Admin control, but for now it allows anyone to be discoverable
+
+	res.send({
+		guild_id: guild_id,
+		safe_environment: true,
+        healthy: true,
+        health_score_pending: false,
+        size: true,
+        nsfw_properties: {},
+        protected: true,
+        sufficient: true,
+        sufficient_without_grace_period: true,
+        valid_rules_channel: true,
+        retention_healthy: true,
+        engagement_healthy: true,
+        age: true,
+        minimum_age: 0,
+        health_score: {
+            avg_nonnew_participators: 0,
+            avg_nonnew_communicators: 0,
+            num_intentful_joiners: 0,
+            perc_ret_w1_intentful: 0
+        },
+        minimum_size: 0
+	});
+});
+
+export default router;

src/api/routes/ping.ts

@@ -0,0 +1,26 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+import { Config } from "@fosscord/util";
+
+const router = Router();
+
+router.get("/", route({}), (req: Request, res: Response) => {
+	const { general } = Config.get();
+	res.send({
+		ping: "pong!",
+		instance: {
+			id: general.instanceId,
+			name: general.instanceName,
+			description: general.instanceDescription,
+			image: general.image,
+
+			correspondenceEmail: general.correspondenceEmail,
+			correspondenceUserID: general.correspondenceUserID,
+
+			frontPage: general.frontPage,
+			tosPage: general.tosPage,
+		},
+	});
+});
+
+export default router;

src/api/routes/policies/instance/domains.ts

@@ -0,0 +1,18 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+import { Config } from "@fosscord/util";
+import { config } from "dotenv"
+const router = Router();
+
+router.get("/",route({}), async (req: Request, res: Response) => {
+    const { cdn, gateway } = Config.get();
+    
+    const IdentityForm = {
+        cdn: cdn.endpointPublic || process.env.CDN || "http://localhost:3001",
+        gateway: gateway.endpointPublic || process.env.GATEWAY || "ws://localhost:3002"
+    };
+
+	res.json(IdentityForm);
+});
+
+export default router;

src/api/routes/policies/instance/index.ts

@@ -0,0 +1,12 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+import { Config } from "@fosscord/util";
+const router = Router();
+
+
+router.get("/",route({}), async (req: Request, res: Response) => {
+	const { general } = Config.get();
+	res.json(general);
+});
+
+export default router;

src/api/routes/policies/instance/limits.ts

@@ -0,0 +1,11 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+import { Config } from "@fosscord/util";
+const router = Router();
+
+router.get("/",route({}), async (req: Request, res: Response) => {
+	const { limits } = Config.get();
+	res.json(limits);
+});
+
+export default router;

src/api/routes/scheduled-maintenances/upcoming_json.ts

@@ -0,0 +1,12 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+const router = Router();
+
+router.get("/scheduled-maintenances/upcoming.json",route({}), async (req: Request, res: Response) => {
+	res.json({
+  "page": {},
+  "scheduled_maintenances": {}
+  });
+});
+
+export default router;

src/api/routes/science.ts

@@ -0,0 +1,11 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+
+const router = Router();
+
+router.post("/", route({}), (req: Request, res: Response) => {
+	// TODO:
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/stage-instances.ts

@@ -0,0 +1,11 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	//TODO
+	res.json([]).status(200);
+});
+
+export default router;

src/api/routes/sticker-packs/index.ts

@@ -0,0 +1,13 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+import { StickerPack } from "@fosscord/util";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const sticker_packs = await StickerPack.find({ relations: ["stickers"] });
+
+	res.json({ sticker_packs });
+});
+
+export default router;

src/api/routes/stickers/#sticker_id/index.ts

@@ -0,0 +1,12 @@
+import { Sticker } from "@fosscord/util";
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { sticker_id } = req.params;
+
+	res.json(await Sticker.find({ where: { id: sticker_id } }));
+});
+
+export default router;

src/api/routes/stop.ts

@@ -0,0 +1,26 @@
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+import { User } from "@fosscord/util";
+
+const router: Router = Router();
+
+router.post("/", route({}), async (req: Request, res: Response) => {
+	//EXPERIMENTAL: have an "OPERATOR" platform permission implemented for this API route
+	const user = await User.findOneOrFail({ where: { id: req.user_id }, select: ["rights"] });
+	if((Number(user.rights) << Number(0))%Number(2)==Number(1)) {
+		console.log("user that POSTed to the API was ALLOWED");
+		console.log(user.rights);
+		res.sendStatus(200)
+		process.kill(process.pid, 'SIGTERM')
+	}
+	else {
+		console.log("operation failed");
+		console.log(user.rights);
+		res.sendStatus(403)
+	}
+});
+
+export default router;
+
+//THIS API CAN ONLY BE USED BY USERS WITH THE 'OPERATOR' RIGHT (which is the value of 1) ONLY IF ANY OTHER RIGHTS ARE ADDED OR IF THE USER DOESNT HAVE PERMISSION,
+//THE REQUEST WILL RETURN 403 'FORBIDDEN'

src/api/routes/store/published-listings/applications.ts

@@ -0,0 +1,79 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/:id", route({}), async (req: Request, res: Response) => {
+	//TODO
+	const id = req.params.id;
+	res.json({
+		id: "",
+		summary: "",
+		sku: {
+			id: "",
+			type: 1,
+			dependent_sku_id: null,
+			application_id: "",
+			manifets_labels: [],
+			access_type: 2,
+			name: "",
+			features: [],
+			release_date: "",
+			premium: false,
+			slug: "",
+			flags: 4,
+			genres: [],
+			legal_notice: "",
+			application: {
+				id: "",
+				name: "",
+				icon: "",
+				description: "",
+				summary: "",
+				cover_image: "",
+				primary_sku_id: "",
+				hook: true,
+				slug: "",
+				guild_id: "",
+				bot_public: "",
+				bot_require_code_grant: false,
+				verify_key: "",
+				publishers: [
+					{
+						id: "",
+						name: ""
+					}
+				],
+				developers: [
+					{
+						id: "",
+						name: ""
+					}
+				],
+				system_requirements: {},
+				show_age_gate: false,
+				price: {
+					amount: 0,
+					currency: "EUR"
+				},
+				locales: []
+			},
+			tagline: "",
+			description: "",
+			carousel_items: [
+				{
+					asset_id: ""
+				}
+			],
+			header_logo_dark_theme: {}, //{id: "", size: 4665, mime_type: "image/gif", width 160, height: 160}
+			header_logo_light_theme: {},
+			box_art: {},
+			thumbnail: {},
+			header_background: {},
+			hero_background: {},
+			assets: []
+		}
+	}).status(200);
+});
+
+export default router;

src/api/routes/store/published-listings/applications/#id/subscription-plans.ts

@@ -0,0 +1,25 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	//TODO
+	res.json([
+		{
+			id: "",
+			name: "",
+			interval: 1,
+			interval_count: 1,
+			tax_inclusive: true,
+			sku_id: "",
+			fallback_price: 499,
+			fallback_currency: "eur",
+			currency: "eur",
+			price: 4199,
+			price_tier: null
+		}
+	]).status(200);
+});
+
+export default router;

src/api/routes/store/published-listings/skus.ts

@@ -0,0 +1,79 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/:id", route({}), async (req: Request, res: Response) => {
+	//TODO
+	const id = req.params.id;
+	res.json({
+		id: "",
+		summary: "",
+		sku: {
+			id: "",
+			type: 1,
+			dependent_sku_id: null,
+			application_id: "",
+			manifets_labels: [],
+			access_type: 2,
+			name: "",
+			features: [],
+			release_date: "",
+			premium: false,
+			slug: "",
+			flags: 4,
+			genres: [],
+			legal_notice: "",
+			application: {
+				id: "",
+				name: "",
+				icon: "",
+				description: "",
+				summary: "",
+				cover_image: "",
+				primary_sku_id: "",
+				hook: true,
+				slug: "",
+				guild_id: "",
+				bot_public: "",
+				bot_require_code_grant: false,
+				verify_key: "",
+				publishers: [
+					{
+						id: "",
+						name: ""
+					}
+				],
+				developers: [
+					{
+						id: "",
+						name: ""
+					}
+				],
+				system_requirements: {},
+				show_age_gate: false,
+				price: {
+					amount: 0,
+					currency: "EUR"
+				},
+				locales: []
+			},
+			tagline: "",
+			description: "",
+			carousel_items: [
+				{
+					asset_id: ""
+				}
+			],
+			header_logo_dark_theme: {}, //{id: "", size: 4665, mime_type: "image/gif", width 160, height: 160}
+			header_logo_light_theme: {},
+			box_art: {},
+			thumbnail: {},
+			header_background: {},
+			hero_background: {},
+			assets: []
+		}
+	}).status(200);
+});
+
+export default router;

src/api/routes/store/published-listings/skus/#sku_id/subscription-plans.ts

@@ -0,0 +1,142 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+const skus = new Map([
+	[
+		"521842865731534868",
+		[
+			{
+				id: "511651856145973248",
+				name: "Premium Monthly (Legacy)",
+				interval: 1,
+				interval_count: 1,
+				tax_inclusive: true,
+				sku_id: "521842865731534868",
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			},
+			{
+				id: "511651860671627264",
+				name: "Premium Yearly (Legacy)",
+				interval: 2,
+				interval_count: 1,
+				tax_inclusive: true,
+				sku_id: "521842865731534868",
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			}
+		]
+	],
+	[
+		"521846918637420545",
+		[
+			{
+				id: "511651871736201216",
+				name: "Premium Classic Monthly",
+				interval: 1,
+				interval_count: 1,
+				tax_inclusive: true,
+				sku_id: "521846918637420545",
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			},
+			{
+				id: "511651876987469824",
+				name: "Premium Classic Yearly",
+				interval: 2,
+				interval_count: 1,
+				tax_inclusive: true,
+				sku_id: "521846918637420545",
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			}
+		]
+	],
+	[
+		"521847234246082599",
+		[
+			{
+				id: "642251038925127690",
+				name: "Premium Quarterly",
+				interval: 1,
+				interval_count: 3,
+				tax_inclusive: true,
+				sku_id: "521847234246082599",
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			},
+			{
+				id: "511651880837840896",
+				name: "Premium Monthly",
+				interval: 1,
+				interval_count: 1,
+				tax_inclusive: true,
+				sku_id: "521847234246082599",
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			},
+			{
+				id: "511651885459963904",
+				name: "Premium Yearly",
+				interval: 2,
+				interval_count: 1,
+				tax_inclusive: true,
+				sku_id: "521847234246082599",
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			}
+		]
+	],
+	[
+		"590663762298667008",
+		[
+			{
+				id: "590665532894740483",
+				name: "Server Boost Monthly",
+				interval: 1,
+				interval_count: 1,
+				tax_inclusive: true,
+				sku_id: "590663762298667008",
+				discount_price: 0,
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			},
+			{
+				id: "590665538238152709",
+				name: "Server Boost Yearly",
+				interval: 2,
+				interval_count: 1,
+				tax_inclusive: true,
+				sku_id: "590663762298667008",
+				discount_price: 0,
+				currency: "usd",
+				price: 0,
+				price_tier: null
+			}
+		]
+	]
+]);
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	// TODO: add the ability to add custom
+	const { sku_id } = req.params;
+
+	if (!skus.has(sku_id)) {
+		console.log(`Request for invalid SKU ${sku_id}! Please report this!`);
+		res.sendStatus(404);
+	} else {
+		res.json(skus.get(sku_id)).status(200);
+	}
+});
+
+export default router;

src/api/routes/teams.ts

@@ -0,0 +1,11 @@
+import { Request, Response, Router } from "express";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	//TODO
+	res.send([]);
+});
+
+export default router;

src/api/routes/template.ts.disabled

@@ -0,0 +1,11 @@
+//TODO: this is a template for a generic route
+
+import { Router, Request, Response } from "express";
+import { route } from "@fosscord/api";
+const router = Router();
+
+router.get("/",route({}), async (req: Request, res: Response) => {
+	res.json({});
+});
+
+export default router;

src/api/routes/track.ts

@@ -0,0 +1,11 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+
+const router = Router();
+
+router.post("/", route({}), (req: Request, res: Response) => {
+	// TODO:
+	res.sendStatus(204);
+});
+
+export default router;

src/api/routes/updates.ts

@@ -0,0 +1,20 @@
+import { Router, Response, Request } from "express";
+import { route } from "@fosscord/api";
+import { Config, Release } from "@fosscord/util";
+
+const router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { client } = Config.get();
+
+    const release = await Release.findOneOrFail({ where: { name: client.releases.upstreamVersion } })
+
+	res.json({
+        name: release.name,
+        pub_date: release.pub_date,
+        url: release.url,
+        notes: release.notes
+    });
+});
+
+export default router;

src/api/routes/users/#id/index.ts

@@ -0,0 +1,13 @@
+import { Router, Request, Response } from "express";
+import { User } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+router.get("/", route({}), async (req: Request, res: Response) => {
+	const { id } = req.params;
+
+	res.json(await User.getPublicUser(id));
+});
+
+export default router;

src/api/routes/users/#id/profile.ts

@@ -0,0 +1,58 @@
+import { Router, Request, Response } from "express";
+import { PublicConnectedAccount, PublicUser, User, UserPublic, Member } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+export interface UserProfileResponse {
+	user: UserPublic;
+	connected_accounts: PublicConnectedAccount;
+	premium_guild_since?: Date;
+	premium_since?: Date;
+}
+
+router.get("/", route({ test: { response: { body: "UserProfileResponse" } } }), async (req: Request, res: Response) => {
+	if (req.params.id === "@me") req.params.id = req.user_id;
+	const user = await User.getPublicUser(req.params.id, { relations: ["connected_accounts"] });
+
+	let mutual_guilds: object[] = [];
+	let premium_guild_since;
+	const requested_member = await Member.find( { where: { id: req.params.id, } })
+	const self_member = await Member.find( { where: { id: req.user_id, } })
+
+	for(const rmem of requested_member) {
+		if(rmem.premium_since) {
+			if(premium_guild_since){
+				if(premium_guild_since > rmem.premium_since) {
+					premium_guild_since = rmem.premium_since;
+				}
+			} else {
+				premium_guild_since = rmem.premium_since;
+			}
+		}
+		for(const smem of self_member) {
+			if (smem.guild_id === rmem.guild_id) {
+				mutual_guilds.push({id: rmem.guild_id, nick: rmem.nick})
+			}
+		}
+	}
+	res.json({
+		connected_accounts: user.connected_accounts,
+		premium_guild_since: premium_guild_since, // TODO
+		premium_since: user.premium_since, // TODO
+		mutual_guilds: mutual_guilds, // TODO {id: "", nick: null} when ?with_mutual_guilds=true
+		user: {
+			username: user.username,
+			discriminator: user.discriminator,
+			id: user.id,
+			public_flags: user.public_flags,
+			avatar: user.avatar,
+			accent_color: user.accent_color,
+			banner: user.banner,
+			bio: req.user_bot ? null : user.bio,
+			bot: user.bot
+		}
+	});
+});
+
+export default router;

src/api/routes/users/#id/relationships.ts

@@ -0,0 +1,41 @@
+import { Router, Request, Response } from "express";
+import { User } from "@fosscord/util";
+import { route } from "@fosscord/api";
+
+const router: Router = Router();
+
+export interface UserRelationsResponse {
+	object: {
+		id?: string,
+		username?: string,
+		avatar?: string, 
+		discriminator?: string, 
+		public_flags?: number
+	}
+}
+
+
+router.get("/", route({ test: { response: { body: "UserRelationsResponse" } } }), async (req: Request, res: Response) => {
+	let mutual_relations: object[] = [];
+    const requested_relations = await User.findOneOrFail({
+		where: { id: req.params.id },
+		relations: ["relationships"]
+	});
+    const self_relations = await User.findOneOrFail({
+		where: { id: req.user_id },
+		relations: ["relationships"]
+	});
+	
+    for(const rmem of requested_relations.relationships) {
+		for(const smem of self_relations.relationships)
+		if (rmem.to_id === smem.to_id && rmem.type === 1 && rmem.to_id !== req.user_id) {
+			let relation_user = await User.getPublicUser(rmem.to_id)
+
+			mutual_relations.push({id: relation_user.id, username: relation_user.username, avatar: relation_user.avatar, discriminator: relation_user.discriminator, public_flags: relation_user.public_flags})
+		}
+	}
+
+	res.json(mutual_relations)
+});
+
+export default router;