Merge pull request #3241 from opencloud-eu/activitylog-event-handler-split

Activitylog event handler split

services/activitylog/pkg/command/server.go

@@ -3,17 +3,18 @@ package command
 import (
 	"context"
 	"fmt"
+	"strings"
 
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	"github.com/opencloud-eu/opencloud/pkg/runner"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/nats-io/nats.go"
+	"github.com/olekukonko/errors"
 	"github.com/spf13/cobra"
 
 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	"github.com/opencloud-eu/opencloud/pkg/generators"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	natspkg "github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/registry"
+	"github.com/opencloud-eu/opencloud/pkg/runner"
 	ogrpc "github.com/opencloud-eu/opencloud/pkg/service/grpc"
 	"github.com/opencloud-eu/opencloud/pkg/tracing"
 	"github.com/opencloud-eu/opencloud/pkg/version"
@@ -24,6 +25,12 @@ import (
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/metrics"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/server/debug"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/server/http"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	svcEvents "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events"
+	svcHttp "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
 )
 
 var _registeredEvents = []events.Unmarshaller{
@@ -62,19 +69,11 @@ func Server(cfg *config.Config) *cobra.Command {
 
 			gr := runner.NewGroup()
 			ctx, cancel := context.WithCancel(cmd.Context())
+			defer cancel()
 
 			mtrcs := metrics.New()
 			mtrcs.BuildInfo.WithLabelValues(version.GetString()).Set(1)
 
-			defer cancel()
-
-			connName := generators.GenerateConnectionName(cfg.Service.Name, generators.NTypeBus)
-			evStream, err := stream.NatsFromConfig(connName, false, stream.NatsConfig(cfg.Events))
-			if err != nil {
-				logger.Error().Err(err).Msg("Failed to initialize event stream")
-				return err
-			}
-
 			tm, err := pool.StringToTLSMode(cfg.GRPCClientTLS.Mode)
 			if err != nil {
 				logger.Error().Err(err).Msg("Failed to parse tls mode")
@@ -99,28 +98,101 @@ func Server(cfg *config.Config) *cobra.Command {
 				return err
 			}
 
-			hClient := ehsvc.NewEventHistoryService("eu.opencloud.api.eventhistory", grpcClient)
-			vClient := settingssvc.NewValueService("eu.opencloud.api.settings", grpcClient)
+			kv, err := ConnectNatsKV(cfg.Store)
+			if err != nil {
+				return err
+			}
+			activityLog, err := activitylog.New(kv,
+				activitylog.Logger(logger),
+				activitylog.MaxActivities(cfg.MaxActivities),
+				activitylog.WriteBufferDuration(cfg.WriteBufferDuration),
+			)
+			if err != nil {
+				logger.Error().Err(err).Msg("Failed to initialize activity log")
+				return err
+			}
 
-			{
-				svc, err := http.Server(
-					http.Logger(logger),
-					http.Config(cfg),
-					http.Context(ctx), // NOTE: not passing this "option" leads to a panic in go-micro
-					http.TraceProvider(tracerProvider),
-					http.Stream(evStream),
-					http.GatewaySelector(gatewaySelector),
-					http.HistoryClient(hClient),
-					http.ValueClient(vClient),
-					http.RegisteredEvents(_registeredEvents),
+			if !cfg.HTTP.Disabled {
+
+				hClient := ehsvc.NewEventHistoryService("eu.opencloud.api.eventhistory", grpcClient)
+
+				svc, err := svcHttp.New(
+					activityLog,
+					svcHttp.Logger(logger),
+					svcHttp.GatewaySelector(gatewaySelector),
+					svcHttp.RegisteredEvents(_registeredEvents),
+					//svcHttp.TraceProvider(tracerProvider),
+					svcHttp.HistoryClient(hClient),
 				)
-
 				if err != nil {
-					logger.Error().Err(err).Str("transport", "http").Msg("Failed to initialize server")
+					logger.Error().Err(err).Msg("handler init")
+					return err
+				}
+				// TODO svc = service.NewInstrument(svc, metrics)
+				// TODO svc = service.NewLogging(svc, logger) // this logs service specific data
+				// TODO svc = service.NewTracing(svc, traceProvider)
+				vClient := settingssvc.NewValueService("eu.opencloud.api.settings", grpcClient)
+
+				server, err := http.Server(
+					http.ValueClient(vClient),
+					http.Logger(logger),
+					http.Context(ctx),
+					http.Config(cfg),
+					http.Service(svc),
+				)
+				if err != nil {
+					logger.Info().
+						Err(err).
+						Str("transport", "http").
+						Msg("Failed to initialize server")
+
 					return err
 				}
 
-				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", svc))
+				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", server))
+			} else {
+				logger.Info().Msg("HTTP server disabled, not starting HTTP service")
+			}
+
+			if !cfg.Events.Disabled {
+
+				connName := generators.GenerateConnectionName(cfg.Service.Name, generators.NTypeBus)
+				evStream, err := stream.NatsFromConfig(connName, false, stream.NatsConfig{
+					Endpoint:             cfg.Events.Endpoint,
+					Cluster:              cfg.Events.Cluster,
+					EnableTLS:            cfg.Events.EnableTLS,
+					TLSInsecure:          cfg.Events.TLSInsecure,
+					TLSRootCACertificate: cfg.Events.TLSRootCACertificate,
+					AuthUsername:         cfg.Events.AuthUsername,
+					AuthPassword:         cfg.Events.AuthPassword,
+				})
+				if err != nil {
+					logger.Error().Err(err).Msg("Failed to initialize event stream")
+					return err
+				}
+
+				eventSvc, err := svcEvents.New(
+					activityLog,
+					evStream,
+					svcEvents.Context(ctx),
+					svcEvents.Logger(logger),
+					svcEvents.ServiceAccount(cfg.ServiceAccount),
+					svcEvents.GatewaySelector(gatewaySelector),
+					svcEvents.RegisteredEvents(_registeredEvents),
+					svcEvents.NumConsumers(cfg.NumConsumers),
+				)
+				if err != nil {
+					logger.Error().Err(err).Str("transport", "event").Msg("Failed to initialize server")
+					return err
+				}
+
+				gr.Add(runner.New(cfg.Service.Name+".svc", func() error {
+					return eventSvc.Run()
+				}, func() {
+					eventSvc.Close()
+				}))
+			} else {
+				logger.Info().Msg("event listening disabled, not starting event service")
 			}
 
 			{
@@ -149,3 +221,33 @@ func Server(cfg *config.Config) *cobra.Command {
 		},
 	}
 }
+
+func ConnectNatsKV(cfg config.Store) (nats.KeyValue, error) {
+	// Connect to NATS servers
+	secureOption := natspkg.Secure(cfg.EnableTLS, cfg.TLSInsecure, cfg.TLSRootCACertificate)
+	conn, err := nats.Connect(strings.Join(cfg.Nodes, ","), secureOption, nats.UserInfo(cfg.AuthUsername, cfg.AuthPassword))
+	if err != nil {
+		return nil, err
+	}
+
+	js, err := conn.JetStream()
+	if err != nil {
+		return nil, err
+	}
+
+	kv, err := js.KeyValue(cfg.Database)
+	if err != nil {
+		if !errors.Is(err, nats.ErrBucketNotFound) {
+			return nil, errors.Wrapf(err, "Failed to get bucket (%s)", cfg.Database)
+		}
+
+		kv, err = js.CreateKeyValue(&nats.KeyValueConfig{
+			Bucket: cfg.Database,
+		})
+		if err != nil {
+			return nil, errors.Wrapf(err, "Failed to create bucket (%s)", cfg.Database)
+		}
+	}
+
+	return kv, nil
+}

services/activitylog/pkg/config/config.go

@@ -35,10 +35,12 @@ type Config struct {
 
 	WriteBufferDuration time.Duration `yaml:"write_buffer_duration" env:"ACTIVITYLOG_WRITE_BUFFER_DURATION" desc:"The duration to wait before flushing the write buffer. This is used to reduce the number of writes to the store." introductionVersion:"4.0.0"`
 	MaxActivities       int           `yaml:"max_activities" env:"ACTIVITYLOG_MAX_ACTIVITIES" desc:"The maximum number of activities to keep in the store per resource. If the number of activities exceeds this value, the oldest activities will be removed." introductionVersion:"4.0.0"`
+	NumConsumers        int           `yaml:"num_consumers" env:"ACTIVITYLOG_NUM_CONSUMERS" desc:"The amount of concurrent event consumers to start. Event consumers are used for updating the list of activities. Multiple consumers increase parallelisation, but will also increase CPU and memory demands." introductionVersion:"%NEXT%"`
 }
 
 // Events combines the configuration options for the event bus.
 type Events struct {
+	Disabled             bool   `yaml:"disabled" env:"ACTIVITYLOG_EVENTS_DISABLED" desc:"Disables listening for events. Set this to true if the service should only handle HTTP requests." introductionVersion:"%NEXT%"`
 	Endpoint             string `yaml:"endpoint" env:"OC_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture." introductionVersion:"1.0.0"`
 	Cluster              string `yaml:"cluster" env:"OC_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system." introductionVersion:"1.0.0"`
 	TLSInsecure          bool   `yaml:"tls_insecure" env:"OC_INSECURE;OC_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"1.0.0"`
@@ -77,6 +79,7 @@ type CORS struct {
 
 // HTTP defines the available http configuration.
 type HTTP struct {
+	Disabled  bool                  `yaml:"disabled" env:"ACTIVITYLOG_HTTP_DISABLED" desc:"Disables the HTTP service. Set this to true if the service should only handle events." introductionVersion:"1.0.0"`
 	Addr      string                `yaml:"addr" env:"ACTIVITYLOG_HTTP_ADDR" desc:"The bind address of the HTTP service." introductionVersion:"1.0.0"`
 	Namespace string                `yaml:"-"`
 	Root      string                `yaml:"root" env:"ACTIVITYLOG_HTTP_ROOT" desc:"Subdirectory that serves as the root for this HTTP service." introductionVersion:"1.0.0"`

services/activitylog/pkg/config/defaults/defaultconfig.go

@@ -52,7 +52,9 @@ func DefaultConfig() *config.Config {
 			},
 		},
 		WriteBufferDuration: 10 * time.Second,
-		MaxActivities:       6000,
+		// Nats runs into max payload exceeded errors at around 7k activities. Let's keep a buffer.
+		MaxActivities: 6000,
+		NumConsumers:  1,
 	}
 }
 

services/activitylog/pkg/server/http/option.go

@@ -3,18 +3,12 @@ package http
 import (
 	"context"
 
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	"github.com/opencloud-eu/opencloud/pkg/log"
-	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
 	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/metrics"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-
 	"github.com/spf13/pflag"
-	"go-micro.dev/v4/store"
 	"go.opentelemetry.io/otel/trace"
+	"go.opentelemetry.io/otel/trace/noop"
 )
 
 // Option defines a single option function.
@@ -22,19 +16,15 @@ type Option func(o *Options)
 
 // Options defines the available options for this package.
 type Options struct {
-	Logger           log.Logger
-	Context          context.Context
-	Config           *config.Config
-	Metrics          *metrics.Metrics
-	Flags            []pflag.Flag
-	Namespace        string
-	Store            store.Store
-	Stream           events.Stream
-	GatewaySelector  pool.Selectable[gateway.GatewayAPIClient]
-	TraceProvider    trace.TracerProvider
-	HistoryClient    ehsvc.EventHistoryService
-	ValueClient      settingssvc.ValueService
-	RegisteredEvents []events.Unmarshaller
+	Name          string
+	Namespace     string
+	Logger        log.Logger
+	Context       context.Context
+	Config        *config.Config
+	Flags         []pflag.Flag
+	Service       ActivityLogService
+	TraceProvider trace.TracerProvider
+	ValueClient   settingssvc.ValueService
 }
 
 // newOptions initializes the available default options.
@@ -69,10 +59,10 @@ func Config(val *config.Config) Option {
 	}
 }
 
-// Metrics provides a function to set the metrics option.
-func Metrics(val *metrics.Metrics) Option {
+// Service provides a function to set the service option.
+func Service(val ActivityLogService) Option {
 	return func(o *Options) {
-		o.Metrics = val
+		o.Service = val
 	}
 }
 
@@ -83,58 +73,20 @@ func Flags(flags ...pflag.Flag) Option {
 	}
 }
 
-// Namespace provides a function to set the Namespace option.
-func Namespace(val string) Option {
+// TraceProvider provides a function to configure the trace provider
+func TraceProvider(traceProvider trace.TracerProvider) Option {
 	return func(o *Options) {
-		o.Namespace = val
+		if traceProvider != nil {
+			o.TraceProvider = traceProvider
+		} else {
+			o.TraceProvider = noop.NewTracerProvider()
+		}
 	}
 }
 
-// Store provides a function to configure the store
-func Store(store store.Store) Option {
+// ValueClient adds a grpc client for the value service
+func ValueClient(vs settingssvc.ValueService) Option {
 	return func(o *Options) {
-		o.Store = store
-	}
-}
-
-// Stream provides a function to configure the stream
-func Stream(stream events.Stream) Option {
-	return func(o *Options) {
-		o.Stream = stream
-	}
-}
-
-// GatewaySelector provides a function to configure the gateway client selector
-func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient]) Option {
-	return func(o *Options) {
-		o.GatewaySelector = gatewaySelector
-	}
-}
-
-// HistoryClient provides a function to configure the event history client
-func HistoryClient(h ehsvc.EventHistoryService) Option {
-	return func(o *Options) {
-		o.HistoryClient = h
-	}
-}
-
-// RegisteredEvents provides a function to register events
-func RegisteredEvents(evs []events.Unmarshaller) Option {
-	return func(o *Options) {
-		o.RegisteredEvents = evs
-	}
-}
-
-// TraceProvider provides a function to set the TracerProvider option
-func TraceProvider(val trace.TracerProvider) Option {
-	return func(o *Options) {
-		o.TraceProvider = val
-	}
-}
-
-// ValueClient provides a function to set the ValueClient options
-func ValueClient(val settingssvc.ValueService) Option {
-	return func(o *Options) {
-		o.ValueClient = val
+		o.ValueClient = vs
 	}
 }

services/activitylog/pkg/server/http/server.go

@@ -1,49 +1,63 @@
 package http
 
 import (
-	"fmt"
-
-	stdhttp "net/http"
+	"context"
+	"embed"
+	"encoding/json"
+	"errors"
+	"net/http"
 
 	"github.com/go-chi/chi/v5"
 	chimiddleware "github.com/go-chi/chi/v5/middleware"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/opencloud/pkg/account"
 	"github.com/opencloud-eu/opencloud/pkg/cors"
+	"github.com/opencloud-eu/opencloud/pkg/l10n"
+	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/middleware"
-	"github.com/opencloud-eu/opencloud/pkg/service/http"
-	"github.com/opencloud-eu/opencloud/pkg/tracing"
+	ohttp "github.com/opencloud-eu/opencloud/pkg/service/http"
 	"github.com/opencloud-eu/opencloud/pkg/version"
-	svc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service"
-	"github.com/riandyrn/otelchi"
+	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
+	activityloghttp "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"go-micro.dev/v4"
+	"google.golang.org/grpc/metadata"
 )
 
-// Service is the service interface
-type Service any
+var (
+	//go:embed l10n/locale
+	_localeFS embed.FS
+
+	// subfolder where the translation files are stored
+	_localeSubPath = "l10n/locale"
+
+	// domain of the activitylog service (transifex)
+	_domain = "activitylog"
+)
 
 // Server initializes the http service and server.
-func Server(opts ...Option) (http.Service, error) {
+func Server(opts ...Option) (ohttp.Service, error) {
 	options := newOptions(opts...)
+	service := options.Service
 
-	service, err := http.NewService(
-		http.TLSConfig(options.Config.HTTP.TLS),
-		http.Logger(options.Logger),
-		http.Namespace(options.Config.HTTP.Namespace),
-		http.Name(options.Config.Service.Name),
-		http.Version(version.GetString()),
-		http.Address(options.Config.HTTP.Addr),
-		http.Context(options.Context),
-		http.Flags(options.Flags...),
-		http.TraceProvider(options.TraceProvider),
+	newService, err := ohttp.NewService(
+		ohttp.TLSConfig(options.Config.HTTP.TLS),
+		ohttp.Logger(options.Logger),
+		ohttp.Namespace(options.Config.HTTP.Namespace),
+		ohttp.Name(options.Config.Service.Name),
+		ohttp.Version(version.GetString()),
+		ohttp.Address(options.Config.HTTP.Addr),
+		ohttp.Context(options.Context),
+		ohttp.Flags(options.Flags...),
 	)
 	if err != nil {
 		options.Logger.Error().
 			Err(err).
 			Msg("Error initializing http service")
-		return http.Service{}, fmt.Errorf("could not initialize http service: %w", err)
+		return ohttp.Service{}, err
 	}
 
-	middlewares := []func(stdhttp.Handler) stdhttp.Handler{
+	middlewares := []func(http.Handler) http.Handler{
 		chimiddleware.RequestID,
 		middleware.Version(
 			options.Config.Service.Name,
@@ -52,6 +66,7 @@ func Server(opts ...Option) (http.Service, error) {
 		middleware.Logger(
 			options.Logger,
 		),
+		middleware.TraceContext,
 		middleware.ExtractAccountUUID(
 			account.Logger(options.Logger),
 			account.JWTSecret(options.Config.TokenManager.JWTSecret),
@@ -68,33 +83,75 @@ func Server(opts ...Option) (http.Service, error) {
 	mux := chi.NewMux()
 	mux.Use(middlewares...)
 
-	mux.Use(
-		otelchi.Middleware(
-			"actitivylog",
-			otelchi.WithChiRoutes(mux),
-			otelchi.WithTracerProvider(options.TraceProvider),
-			otelchi.WithPropagators(tracing.GetPropagator()),
-		),
-	)
+	t := l10n.NewTranslatorFromCommonConfig(options.Config.DefaultLanguage, _domain, options.Config.TranslationPath, _localeFS, _localeSubPath)
+	mux.Route(options.Config.HTTP.Root, func(r chi.Router) {
+		r.Get("/graph/v1beta1/extensions/org.libregraph/activities", GetItemActivitiesHandler(options.Logger, service, options.ValueClient, t))
+	})
 
-	handle, err := svc.New(
-		svc.Logger(options.Logger),
-		svc.Stream(options.Stream),
-		svc.Mux(mux),
-		svc.Config(options.Config),
-		svc.GatewaySelector(options.GatewaySelector),
-		svc.TraceProvider(options.TraceProvider),
-		svc.HistoryClient(options.HistoryClient),
-		svc.ValueClient(options.ValueClient),
-		svc.RegisteredEvents(options.RegisteredEvents),
-	)
+	err = micro.RegisterHandler(newService.Server(), mux)
 	if err != nil {
-		return http.Service{}, err
+		options.Logger.Fatal().Err(err).Msg("failed to register the handler")
 	}
 
-	if err := micro.RegisterHandler(service.Server(), handle); err != nil {
-		return http.Service{}, err
-	}
+	newService.Init()
+	return newService, nil
 
-	return service, nil
+}
+
+// Service defines the business logic implementations need to provide.
+type ActivityLogService interface {
+	GetItemActivities(ctx context.Context, query, loc string, t l10n.Translator) ([]libregraph.Activity, error)
+}
+
+// GetActivitiesResponse is the response on GET activities requests
+type GetActivitiesResponse struct {
+	Activities []libregraph.Activity `json:"value"`
+}
+
+func GetItemActivitiesHandler(log log.Logger, s ActivityLogService, vc settingssvc.ValueService, t l10n.Translator) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, r.Header.Get(revactx.TokenHeader))
+
+		activeUser, ok := revactx.ContextGetUser(ctx)
+		if !ok {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+
+		loc := l10n.MustGetUserLocale(ctx, activeUser.GetId().GetOpaqueId(), r.Header.Get(l10n.HeaderAcceptLanguage), vc)
+
+		activities, err := s.GetItemActivities(ctx, r.URL.Query().Get("kql"), loc, t)
+		if err != nil {
+			switch {
+			case errors.Is(err, activityloghttp.ErrBadRequest):
+				log.Debug().Str("query", r.URL.Query().Get("kql")).Err(err).Msg("error getting activities")
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			case errors.Is(err, activityloghttp.ErrForbidden):
+				log.Debug().Err(err).Msg("error getting activities")
+				w.WriteHeader(http.StatusForbidden)
+				return
+			default:
+				log.Error().Err(err).Msg("error getting activities")
+				w.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+		}
+		res := GetActivitiesResponse{
+			Activities: activities,
+		}
+
+		w.Header().Set("Content-Type", "application/json; odata.metadata=minimal")
+		w.Header().Set("OData-Version", "4.0")
+		if reqID := chimiddleware.GetReqID(ctx); reqID != "" {
+			w.Header().Set("request-id", reqID)
+		}
+		w.Header().Set("Cache-Control", "no-cache")
+		if err := json.NewEncoder(w).Encode(res); err != nil {
+			log.Error().Err(err).Msg("error encoding activities")
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+	}
 }

services/activitylog/pkg/service/activitylog/activitylog.go

@@ -0,0 +1,366 @@
+package activitylog
+
+import (
+	"context"
+	"encoding/base32"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/jellydator/ttlcache/v2"
+	"github.com/nats-io/nats.go"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/vmihailenco/msgpack/v5"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
+)
+
+var tracer trace.Tracer
+
+func init() {
+	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog")
+}
+
+var (
+	_maxActivitiesDefault = 6000
+	_writeBufferDuration  = 10 * time.Second
+)
+
+// Activitylog stores and retrieves activities for resources and their parents from a nats kv
+type ActivityLog struct {
+	log log.Logger
+	// FIXME the lock does not protect agains concurrent resource activities on multiple instances
+	// known since https://github.com/owncloud/ocis/pull/9361#pullrequestreview-2135350157
+	// current ocis discussion in https://github.com/owncloud/ocis/issues/12475
+	lock          sync.RWMutex
+	debouncer     *Debouncer
+	parentIdCache *ttlcache.Cache
+	natskv        nats.KeyValue
+
+	maxActivities int
+}
+
+type batchInfo struct {
+	key       string
+	count     int
+	timestamp time.Time
+}
+
+// New creates a new ActivitylogService
+func New(kv nats.KeyValue, opts ...Option) (*ActivityLog, error) {
+	o := &Options{
+		MaxActivities:       _maxActivitiesDefault,
+		WriteBufferDuration: _writeBufferDuration,
+		Logger:              log.NopLogger(),
+	}
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	cache := ttlcache.NewCache()
+	err := cache.SetTTL(30 * time.Second)
+	if err != nil {
+		return nil, err
+	}
+
+	s := &ActivityLog{
+		log:           o.Logger,
+		lock:          sync.RWMutex{},
+		parentIdCache: cache,
+		maxActivities: o.MaxActivities,
+		natskv:        kv,
+	}
+	s.debouncer = NewDebouncer(o.WriteBufferDuration, s.StoreActivity)
+
+	// run migrations
+	err = s.runMigrations(context.Background(), kv)
+	if err != nil {
+		return nil, err
+	}
+
+	return s, nil
+}
+
+// RemoveResource removes the resource from the store
+func (a *ActivityLog) RemoveResource(rid *provider.ResourceId) error {
+	if rid == nil {
+		return fmt.Errorf("resource id is required")
+	}
+
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	err := a.natskv.Delete(storagespace.FormatResourceID(rid))
+	if err != nil {
+		return fmt.Errorf("could not delete resource %s: %w", rid.OpaqueId, err)
+	}
+	return nil
+}
+
+// RawActivity represents an activity as it is stored in the activitylog store
+type RawActivity struct {
+	EventID   string    `json:"event_id"`
+	Depth     int       `json:"depth"`
+	Timestamp time.Time `json:"timestamp"`
+}
+
+func (a *ActivityLog) AddActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time, getResource func(context.Context, *provider.Reference) (*provider.ResourceInfo, error)) error {
+	var (
+		err   error
+		depth int
+		ref   = initRef
+	)
+	ctx, span := tracer.Start(ctx, "AddActivity")
+	defer span.End()
+	for {
+		var info *provider.ResourceInfo
+		id := ref.GetResourceId()
+		if ref.Path != "" {
+			// Path based reference, we need to resolve the resource id
+			ctx, span = tracer.Start(ctx, "AddActivity.getResource")
+			info, err = getResource(ctx, ref)
+			span.End()
+			if err != nil {
+				// TODO If the resource was deleted should we still log an activity in the parent?
+				return fmt.Errorf("could not get resource info for reference %v: %w", ref, err)
+			}
+			id = info.GetId()
+		}
+		if id == nil {
+			return fmt.Errorf("resource id is required")
+		}
+
+		key := storagespace.FormatResourceID(id)
+		a.debouncer.Debounce(key, RawActivity{
+			EventID:   eventID,
+			Depth:     depth,
+			Timestamp: timestamp,
+		})
+
+		if id.OpaqueId == id.SpaceId {
+			// we are at the root of the space, no need to go further
+			break
+		}
+
+		// check if parent id is cached
+		// parent id is cached in the format <storageid>$<spaceid>!<resourceid>
+		// if it is not cached, get the resource info and cache it
+		if parentId == nil {
+			if v, err := a.parentIdCache.Get(key); err != nil {
+				if info == nil {
+					ctx, span := tracer.Start(ctx, "AddActivity.getResource parent")
+					info, err = getResource(ctx, ref)
+					span.End()
+					if err != nil || info.GetParentId() == nil || info.GetParentId().GetOpaqueId() == "" {
+						return fmt.Errorf("could not get parent id: %w", err)
+					}
+				}
+				parentId = info.GetParentId()
+				a.parentIdCache.Set(key, parentId)
+			} else {
+				parentId = v.(*provider.ResourceId)
+			}
+		} else {
+			a.log.Debug().Msg("parent id is cached")
+		}
+
+		depth++
+		ref = &provider.Reference{ResourceId: parentId}
+		parentId = nil // reset parent id so it's not reused in the next iteration
+	}
+
+	return nil
+}
+
+func (a *ActivityLog) StoreActivity(resourceID string, activities []RawActivity) error {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	ctx, span := tracer.Start(context.Background(), "storeActivity")
+	defer span.End()
+
+	_, subspan := tracer.Start(ctx, "storeActivity.Marshal")
+	b, err := msgpack.Marshal(activities)
+	if err != nil {
+		return err
+	}
+	subspan.End()
+
+	_, subspan = tracer.Start(ctx, "storeActivity.natskv.Put")
+	key := natsKey(resourceID, len(activities))
+	_, err = a.natskv.Put(key, b)
+	if err != nil {
+		return err
+	}
+	subspan.End()
+
+	ctx, subspan = tracer.Start(ctx, "storeActivity.enforceMaxActivities")
+	a.enforceMaxActivities(ctx, resourceID)
+	subspan.End()
+	return nil
+}
+
+func (a *ActivityLog) enforceMaxActivities(ctx context.Context, resourceID string) {
+	if a.maxActivities <= 0 {
+		return
+	}
+
+	key := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
+
+	_, subspan := tracer.Start(ctx, "enforceMaxActivities.watch")
+	watcher, err := a.natskv.Watch(key, nats.IgnoreDeletes())
+	if err != nil {
+		a.log.Error().Err(err).Str("resourceID", resourceID).Msg("could not watch")
+		return
+	}
+	defer watcher.Stop()
+
+	var keys []string
+	for update := range watcher.Updates() {
+		if update == nil {
+			break
+		}
+
+		var batchActivities []RawActivity
+		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
+			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
+		}
+		keys = append(keys, update.Key())
+	}
+	subspan.End()
+
+	_, subspan = tracer.Start(ctx, "enforceMaxActivities.compile")
+	// Parse keys into batches
+	batches := make([]batchInfo, 0)
+	var activitiesCount int
+	for _, k := range keys {
+		parts := strings.SplitN(k, ".", 3)
+		if len(parts) < 3 {
+			a.log.Warn().Str("key", k).Msg("skipping key, not enough parts")
+			continue
+		}
+
+		c, err := strconv.Atoi(parts[1])
+		if err != nil {
+			a.log.Warn().Str("key", k).Msg("skipping key, can not parse count")
+			continue
+		}
+
+		// parse timestamp
+		nano, err := strconv.ParseInt(parts[2], 10, 64)
+		if err != nil {
+			a.log.Warn().Str("key", k).Msg("skipping key, can not parse timestamp")
+			continue
+		}
+
+		batches = append(batches, batchInfo{
+			key:       k,
+			count:     c,
+			timestamp: time.Unix(0, nano),
+		})
+		activitiesCount += c
+	}
+
+	// sort batches by timestamp
+	sort.Slice(batches, func(i, j int) bool {
+		return batches[i].timestamp.Before(batches[j].timestamp)
+	})
+	subspan.End()
+
+	_, subspan = tracer.Start(ctx, "enforceMaxActivities.delete")
+	// remove oldest keys until we are at max activities
+	for _, b := range batches {
+		if activitiesCount-b.count < a.maxActivities {
+			break
+		}
+
+		activitiesCount -= b.count
+		err = a.natskv.Delete(b.key)
+		if err != nil {
+			a.log.Error().Err(err).Str("key", b.key).Msg("could not delete key")
+			break
+		}
+	}
+	subspan.End()
+}
+
+func (a *ActivityLog) InvalidateCachedParentID(purgeId *provider.ResourceId) {
+	// The parent id cache is populated lazily and its entries expire, so a
+	// missing key is the expected case rather than an error.
+	if err := a.parentIdCache.Remove(storagespace.FormatResourceID(purgeId)); err != nil {
+		a.log.Debug().Interface("event", purgeId).Err(err).Msg("could not delete parent id cache")
+	}
+}
+
+func natsKey(resourceID string, activitiesCount int) string {
+	return fmt.Sprintf("%s.%d.%d",
+		base32.StdEncoding.EncodeToString([]byte(resourceID)),
+		activitiesCount,
+		time.Now().UnixNano())
+}
+
+func (a *ActivityLog) Activities(rid *provider.ResourceId) ([]RawActivity, error) {
+	a.lock.RLock()
+	defer a.lock.RUnlock()
+
+	return a.activities(rid)
+}
+
+func (a *ActivityLog) activities(rid *provider.ResourceId) ([]RawActivity, error) {
+	resourceID := storagespace.FormatResourceID(rid)
+
+	glob := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
+
+	watcher, err := a.natskv.Watch(glob, nats.IgnoreDeletes())
+	if err != nil {
+		return nil, err
+	}
+	defer watcher.Stop()
+
+	var activities []RawActivity
+	for update := range watcher.Updates() {
+		if update == nil {
+			break
+		}
+
+		var batchActivities []RawActivity
+		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
+			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack")
+		}
+		activities = append(activities, batchActivities...)
+	}
+
+	return activities, nil
+}
+
+// RemoveActivities removes the activities from the given resource
+func (a *ActivityLog) RemoveActivities(rid *provider.ResourceId, toDelete map[string]struct{}) error {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	curActivities, err := a.activities(rid)
+	if err != nil {
+		return err
+	}
+
+	var acts []RawActivity
+	for _, a := range curActivities {
+		if _, ok := toDelete[a.EventID]; !ok {
+			acts = append(acts, a)
+		}
+	}
+
+	b, err := json.Marshal(acts)
+	if err != nil {
+		return err
+	}
+
+	_, err = a.natskv.Put(storagespace.FormatResourceID(rid), b)
+	return err
+}

services/activitylog/pkg/service/activitylog/activitylog_suite_test.go

@@ -0,0 +1,13 @@
+package activitylog_test
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestActivitylog(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Activitylog Suite")
+}

services/activitylog/pkg/service/activitylog/activitylog_test.go

@@ -1,7 +1,6 @@
-package service
+package activitylog_test
 
 import (
-	"bytes"
 	"context"
 	"net"
 	"os"
@@ -9,17 +8,13 @@ import (
 	"time"
 
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 	nserver "github.com/nats-io/nats-server/v2/server"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/command"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-	eventsmocks "github.com/opencloud-eu/reva/v2/pkg/events/mocks"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/test-go/testify/mock"
-	"go.opentelemetry.io/otel/trace/noop"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
 )
 
 var (
@@ -68,31 +63,25 @@ var _ = SynchronizedAfterSuite(func() {
 
 var _ = Describe("ActivitylogService", func() {
 	var (
-		alog                *ActivitylogService
+		alog                *activitylog.ActivityLog
 		getResource         func(_ context.Context, ref *provider.Reference) (*provider.ResourceInfo, error)
 		writebufferduration = 100 * time.Millisecond
 	)
 
 	JustBeforeEach(func() {
 		var err error
-		stream := &eventsmocks.Stream{}
-		stream.EXPECT().Consume(mock.Anything, mock.Anything).Return(nil, nil)
-		alog, err = New(
-			Config(&config.Config{
-				Service: config.Service{
-					Name: "activitylog-test",
-				},
-				Store: config.Store{
-					Store:    "nats-js-kv",
-					Nodes:    []string{server.Addr().String()},
-					Database: "activitylog-test-" + uuid.New().String(),
-				},
-				MaxActivities:       4,
-				WriteBufferDuration: writebufferduration,
-			}),
-			Stream(stream),
-			TraceProvider(noop.NewTracerProvider()),
-			Mux(chi.NewMux()),
+		db := "activitylog-test-" + uuid.New().String()
+
+		kv, err := command.ConnectNatsKV(config.Store{
+			Nodes:    []string{server.Addr().String()},
+			Database: db,
+		})
+		Expect(err).ToNot(HaveOccurred())
+
+		alog, err = activitylog.New(
+			kv,
+			activitylog.MaxActivities(4),
+			activitylog.WriteBufferDuration(writebufferduration),
 		)
 		Expect(err).ToNot(HaveOccurred())
 	})
@@ -107,7 +96,7 @@ var _ = Describe("ActivitylogService", func() {
 				Name       string
 				Tree       map[string]*provider.ResourceInfo
 				Activities map[string]string
-				Expected   map[string][]RawActivity
+				Expected   map[string][]activitylog.RawActivity
 			}
 
 			testCases := []testCase{
@@ -121,7 +110,7 @@ var _ = Describe("ActivitylogService", func() {
 					Activities: map[string]string{
 						"activity": "base",
 					},
-					Expected: map[string][]RawActivity{
+					Expected: map[string][]activitylog.RawActivity{
 						"base":    activitites("activity", 0),
 						"parent":  activitites("activity", 1),
 						"spaceid": activitites("activity", 2),
@@ -138,7 +127,7 @@ var _ = Describe("ActivitylogService", func() {
 						"activity1": "base",
 						"activity2": "base",
 					},
-					Expected: map[string][]RawActivity{
+					Expected: map[string][]activitylog.RawActivity{
 						"base":    activitites("activity1", 0, "activity2", 0),
 						"parent":  activitites("activity1", 1, "activity2", 1),
 						"spaceid": activitites("activity1", 2, "activity2", 2),
@@ -155,7 +144,7 @@ var _ = Describe("ActivitylogService", func() {
 						}
 
 						for k, v := range tc.Activities {
-							err := alog.addActivity(context.Background(), reference(v), nil, k, time.Time{}, getResource)
+							err := alog.AddActivity(context.Background(), reference(v), nil, k, time.Time{}, getResource)
 							Expect(err).NotTo(HaveOccurred())
 						}
 					})
@@ -194,9 +183,9 @@ var _ = Describe("ActivitylogService", func() {
 
 			It("debounces activities", func() {
 
-				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 
 				Eventually(func(g Gomega) {
@@ -207,7 +196,7 @@ var _ = Describe("ActivitylogService", func() {
 			})
 
 			It("adheres to the MaxActivities setting", func() {
-				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 				Eventually(func(g Gomega) {
 					activities, err := alog.Activities(resourceID("base"))
@@ -215,7 +204,7 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(len(activities)).To(Equal(1))
 				}).Should(Succeed())
 
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 				Eventually(func(g Gomega) {
 					activities, err := alog.Activities(resourceID("base"))
@@ -223,11 +212,11 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(len(activities)).To(Equal(2))
 				}).Should(Succeed())
 
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity5", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity5", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 
 				Eventually(func(g Gomega) {
@@ -244,9 +233,9 @@ var _ = Describe("ActivitylogService", func() {
 					return tree[ref.GetResourceId().GetOpaqueId()], nil
 				}
 
-				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 
 				Eventually(func(g Gomega) {
@@ -255,9 +244,9 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(activities).To(ConsistOf(activitites("activity1", 0, "activity2", 0)))
 				}).Should(Succeed())
 
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 
 				Eventually(func(g Gomega) {
@@ -268,47 +257,11 @@ var _ = Describe("ActivitylogService", func() {
 			})
 		})
 	})
-
-	Describe("removeCachedParentID", func() {
-		var logBuffer *bytes.Buffer
-
-		newLoggerAtLevel := func(level string) log.Logger {
-			logBuffer = &bytes.Buffer{}
-			return log.Logger{Logger: log.NewLogger(log.Level(level)).Output(logBuffer)}
-		}
-
-		It("does not log an error when the entry was never cached", func() {
-			alog.log = newLoggerAtLevel("error")
-
-			alog.removeCachedParentID(reference("never-cached"))
-
-			Expect(logBuffer.String()).To(BeEmpty())
-		})
-
-		It("logs a missing entry at debug level", func() {
-			alog.log = newLoggerAtLevel("debug")
-
-			alog.removeCachedParentID(reference("never-cached"))
-
-			Expect(logBuffer.String()).To(ContainSubstring("could not delete parent id cache"))
-			Expect(logBuffer.String()).To(ContainSubstring(`"level":"debug"`))
-		})
-
-		It("does not log at all when the entry was cached", func() {
-			alog.log = newLoggerAtLevel("debug")
-			ref := reference("cached")
-			Expect(alog.parentIdCache.Set(storagespace.FormatResourceID(ref.GetResourceId()), resourceID("parent"))).To(Succeed())
-
-			alog.removeCachedParentID(ref)
-
-			Expect(logBuffer.String()).To(BeEmpty())
-		})
-	})
 })
 
-func activitites(acts ...any) []RawActivity {
-	var activities []RawActivity
-	act := RawActivity{}
+func activitites(acts ...any) []activitylog.RawActivity {
+	var activities []activitylog.RawActivity
+	act := activitylog.RawActivity{}
 	for _, a := range acts {
 		switch v := a.(type) {
 		case string:

services/activitylog/pkg/service/activitylog/debouncer.go

@@ -0,0 +1,76 @@
+package activitylog
+
+import (
+	"sync"
+	"time"
+)
+
+// Debouncer is used to debounce writes to the activity log store.
+type Debouncer struct {
+	after      time.Duration
+	f          func(id string, ra []RawActivity) error
+	pending    sync.Map
+	inProgress sync.Map
+
+	mutex sync.Mutex
+}
+
+type queueItem struct {
+	activities []RawActivity
+	timer      *time.Timer
+}
+
+// NewDebouncer returns a new Debouncer instance.
+func NewDebouncer(d time.Duration, f func(id string, ra []RawActivity) error) *Debouncer {
+	return &Debouncer{
+		after:      d,
+		f:          f,
+		pending:    sync.Map{},
+		inProgress: sync.Map{},
+	}
+}
+
+// Debounce restarts the debounce timer for the given space.
+func (d *Debouncer) Debounce(id string, ra RawActivity) {
+	if d.after == 0 {
+		d.f(id, []RawActivity{ra})
+		return
+	}
+
+	d.mutex.Lock()
+	defer d.mutex.Unlock()
+
+	item := &queueItem{
+		activities: []RawActivity{ra},
+	}
+
+	if i, ok := d.pending.Load(id); ok {
+		// if the item is already in the queue, append the new activities
+		item, ok = i.(*queueItem)
+		if ok {
+			item.activities = append(item.activities, ra)
+		}
+	}
+
+	if item.timer == nil {
+		item.timer = time.AfterFunc(d.after, func() {
+			if _, ok := d.inProgress.Load(id); ok {
+				// Reschedule this run for when the previous run has finished
+				d.mutex.Lock()
+				if i, ok := d.pending.Load(id); ok {
+					i.(*queueItem).timer.Reset(d.after)
+				}
+
+				d.mutex.Unlock()
+				return
+			}
+
+			d.pending.Delete(id)
+			d.inProgress.Store(id, true)
+			defer d.inProgress.Delete(id)
+			d.f(id, item.activities)
+		})
+	}
+
+	d.pending.Store(id, item)
+}

services/activitylog/pkg/service/activitylog/debouncer_test.go

@@ -0,0 +1,121 @@
+package activitylog_test
+
+import (
+	"sync"
+	"time"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+)
+
+var _ = Describe("Debouncer", func() {
+	var (
+		mu          sync.Mutex
+		callbacks   []activitylog.RawActivity
+		newCallback func(id string, ra []activitylog.RawActivity) error
+	)
+
+	BeforeEach(func() {
+		mu.Lock()
+		callbacks = nil
+		mu.Unlock()
+		newCallback = func(id string, ra []activitylog.RawActivity) error {
+			mu.Lock()
+			defer mu.Unlock()
+			callbacks = append(callbacks, ra...)
+			return nil
+		}
+	})
+
+	Context("with zero duration", func() {
+		It("calls the callback immediately", func() {
+			d := activitylog.NewDebouncer(0, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			Expect(callbacks).To(HaveLen(1))
+			Expect(callbacks[0].EventID).To(Equal("activity1"))
+		})
+
+		It("calls the callback immediately for each event", func() {
+			d := activitylog.NewDebouncer(0, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			d.Debounce("space2", activitylog.RawActivity{EventID: "activity2"})
+			Expect(callbacks).To(HaveLen(2))
+		})
+	})
+
+	Context("with non-zero duration", func() {
+		It("batches activities with the same id", func() {
+			d := activitylog.NewDebouncer(10*time.Millisecond, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity3"})
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(3))
+		})
+
+		It("handles different ids independently", func() {
+			d := activitylog.NewDebouncer(10*time.Millisecond, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			d.Debounce("space2", activitylog.RawActivity{EventID: "activity2"})
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(2))
+		})
+
+		It("batches activities that arrive within the debounce window", func() {
+			d := activitylog.NewDebouncer(100*time.Millisecond, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			time.Sleep(20 * time.Millisecond)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
+			time.Sleep(20 * time.Millisecond)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity3"})
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(3))
+		})
+
+		It("processes new batch after previous completes", func() {
+			d := activitylog.NewDebouncer(5*time.Millisecond, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			time.Sleep(20 * time.Millisecond) // let first batch complete
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(2))
+		})
+
+		It("skips duplicate write when timer fires during in-progress callback", func() {
+			slowCallback := func(id string, ra []activitylog.RawActivity) error {
+				time.Sleep(50 * time.Millisecond) // simulate slow write
+				mu.Lock()
+				defer mu.Unlock()
+				callbacks = append(callbacks, ra...)
+				return nil
+			}
+
+			d := activitylog.NewDebouncer(10*time.Millisecond, slowCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			time.Sleep(20 * time.Millisecond) // timer fires while callback is running
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(1))
+		})
+	})
+})

services/activitylog/pkg/service/activitylog/migrations.go

@@ -1,4 +1,4 @@
-package service
+package activitylog
 
 import (
 	"context"
@@ -15,7 +15,7 @@ const currentMigrationVersion = "1"
 
 // RunMigrations checks the activitylog data version and runs migrations if necessary.
 // It should be called during service startup, after the NATS KeyValue store is initialized.
-func (a *ActivitylogService) runMigrations(ctx context.Context, kv nats.KeyValue) error {
+func (a *ActivityLog) runMigrations(ctx context.Context, kv nats.KeyValue) error {
 	entry, err := kv.Get(activitylogVersionKey)
 	if err == nats.ErrKeyNotFound {
 		a.log.Info().Msg("activitylog version key not found. Running migration to V1...")
@@ -40,7 +40,7 @@ func (a *ActivitylogService) runMigrations(ctx context.Context, kv nats.KeyValue
 // For each such key, it creates a new key in the format "originalKey.count.timestamp"
 // and stores the original list of strings (re-marshalled to messagepack) as its value.
 // Finally, it sets the activitylog.version key to "1".
-func (a *ActivitylogService) migrateToV1(_ context.Context, kv nats.KeyValue) error {
+func (a *ActivityLog) migrateToV1(_ context.Context, kv nats.KeyValue) error {
 	lister, err := kv.ListKeys()
 	if err != nil {
 		return fmt.Errorf("migrateToV1: failed to list keys from NATS KV store: %w", err)

services/activitylog/pkg/service/activitylog/options.go

@@ -0,0 +1,35 @@
+package activitylog
+
+import (
+	"time"
+
+	"github.com/opencloud-eu/opencloud/pkg/log"
+)
+
+// Option for the activitylog service
+type Option func(*Options)
+
+// Options for the activitylog service
+type Options struct {
+	Logger              log.Logger
+	MaxActivities       int
+	WriteBufferDuration time.Duration
+}
+
+// Logger configures a logger for the activitylog service
+func Logger(log log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = log
+	}
+}
+
+func MaxActivities(max int) Option {
+	return func(o *Options) {
+		o.MaxActivities = max
+	}
+}
+func WriteBufferDuration(d time.Duration) Option {
+	return func(o *Options) {
+		o.WriteBufferDuration = d
+	}
+}

services/activitylog/pkg/service/events/events_suite_test.go

@@ -1,4 +1,4 @@
-package service_test
+package events_test
 
 import (
 	"testing"
@@ -7,7 +7,7 @@ import (
 	. "github.com/onsi/gomega"
 )
 
-func TestService(t *testing.T) {
+func TestEvents(t *testing.T) {
 	RegisterFailHandler(Fail)
-	RunSpecs(t, "Service Suite")
+	RunSpecs(t, "Events Suite")
 }

services/activitylog/pkg/service/events/options.go

@@ -1,17 +1,14 @@
-package service
+package events
 
 import (
+	"context"
 	"time"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	"github.com/go-chi/chi/v5"
 	"github.com/opencloud-eu/opencloud/pkg/log"
-	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
-	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"go.opentelemetry.io/otel/trace"
 )
 
 // Option for the activitylog service
@@ -19,17 +16,20 @@ type Option func(*Options)
 
 // Options for the activitylog service
 type Options struct {
+	Context             context.Context
 	Logger              log.Logger
-	Config              *config.Config
-	TraceProvider       trace.TracerProvider
+	ServiceAccount      config.ServiceAccount
 	Stream              events.Stream
 	RegisteredEvents    []events.Unmarshaller
 	GatewaySelector     pool.Selectable[gateway.GatewayAPIClient]
-	Mux                 *chi.Mux
-	HistoryClient       ehsvc.EventHistoryService
-	ValueClient         settingssvc.ValueService
 	WriteBufferDuration time.Duration
-	MaxActivities       int
+	NumConsumers        int
+}
+
+func Context(ctx context.Context) Option {
+	return func(o *Options) {
+		o.Context = ctx
+	}
 }
 
 // Logger configures a logger for the activitylog service
@@ -39,17 +39,10 @@ func Logger(log log.Logger) Option {
 	}
 }
 
-// Config adds the config for the activitylog service
-func Config(c *config.Config) Option {
+// ServiceAccount configures a service account for the activitylog service
+func ServiceAccount(sa config.ServiceAccount) Option {
 	return func(o *Options) {
-		o.Config = c
-	}
-}
-
-// TraceProvider adds a tracer provider for the activitylog service
-func TraceProvider(tp trace.TracerProvider) Option {
-	return func(o *Options) {
-		o.TraceProvider = tp
+		o.ServiceAccount = sa
 	}
 }
 
@@ -74,23 +67,8 @@ func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient])
 	}
 }
 
-// Mux defines the muxer for the service
-func Mux(m *chi.Mux) Option {
+func NumConsumers(num int) Option {
 	return func(o *Options) {
-		o.Mux = m
-	}
-}
-
-// HistoryClient adds a grpc client for the eventhistory service
-func HistoryClient(hc ehsvc.EventHistoryService) Option {
-	return func(o *Options) {
-		o.HistoryClient = hc
-	}
-}
-
-// ValueClient adds a grpc client for the value service
-func ValueClient(vs settingssvc.ValueService) Option {
-	return func(o *Options) {
-		o.ValueClient = vs
+		o.NumConsumers = num
 	}
 }

services/activitylog/pkg/service/events/service.go

@@ -0,0 +1,302 @@
+package events
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
+)
+
+var tracer trace.Tracer
+
+func init() {
+	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events")
+}
+
+var (
+	_numConsumersDefault = 1
+)
+
+// ActivitylogService logs events per resource
+type ActivitylogService struct {
+	ctx    context.Context
+	sa     config.ServiceAccount
+	log    log.Logger
+	stream events.Stream
+	gws    pool.Selectable[gateway.GatewayAPIClient]
+	al     *activitylog.ActivityLog
+
+	numConsumers int
+
+	events []events.Unmarshaller
+
+	stopCh  chan struct{}
+	stopped *atomic.Bool
+}
+
+// New creates a new ActivitylogService
+func New(al *activitylog.ActivityLog, stream events.Stream, opts ...Option) (*ActivitylogService, error) {
+	o := &Options{
+		NumConsumers: _numConsumersDefault,
+	}
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	s := &ActivitylogService{
+		ctx:          o.Context,
+		log:          o.Logger,
+		sa:           o.ServiceAccount,
+		stream:       stream,
+		gws:          o.GatewaySelector,
+		events:       o.RegisteredEvents,
+		numConsumers: o.NumConsumers,
+		al:           al,
+		stopCh:       make(chan struct{}, 1),
+		stopped:      new(atomic.Bool),
+	}
+
+	return s, nil
+}
+
+// Run to fulfil Runner interface
+func (s *ActivitylogService) Run() error {
+	ch, err := events.Consume(s.stream, "activitylog", s.events...)
+	if err != nil {
+		return err
+	}
+
+	var wg sync.WaitGroup
+	ctx, cancel := context.WithCancel(s.ctx)
+	defer cancel()
+
+	s.log.Debug().Int("worker.count", s.numConsumers).
+		Str("messaging.consumer.group.name", "activitylog").
+		Str("messaging.system", "nats").
+		Str("messaging.operation.name", "receive").
+		Msg("starting event processing workers")
+
+	// start workers
+	for i := 0; i < s.numConsumers; i++ {
+		wg.Add(1)
+		go func(workerID int) {
+			defer wg.Done()
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case e, ok := <-ch:
+					if !ok {
+						return
+					}
+					if err := s.processEvent(e); err != nil {
+						s.log.Error().Err(err).
+							Int("worker", workerID).
+							Interface("event", e).
+							Msg("failed to process event")
+					}
+				}
+			}
+		}(i)
+	}
+
+	// wait for stop signal
+	<-s.stopCh
+	cancel() // signal workers to stop
+	wg.Wait()
+
+	return nil
+}
+
+// Close will make the service to stop processing, so the `Run`
+// method can finish.
+func (s *ActivitylogService) Close() {
+	if s.stopped.CompareAndSwap(false, true) {
+		close(s.stopCh)
+	}
+}
+
+func (s *ActivitylogService) processEvent(e events.Event) error {
+	ctx := e.GetTraceContext(s.ctx)
+	ctx, span := tracer.Start(ctx, "processEvent")
+	defer span.End()
+
+	s.log.Debug().Interface("event", e).Msg("updating activitylog")
+
+	switch ev := e.Event.(type) {
+	case events.UploadReady:
+		return s.AddActivity(ctx, ev.FileRef, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.FileTouched:
+		return s.AddActivity(ctx, ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+	// Disabled https://github.com/owncloud/ocis/issues/10293
+	//case events.FileDownloaded:
+	// we are only interested in public link downloads - so no need to store others.
+	//if ev.ImpersonatingUser.GetDisplayName() == "Public" {
+	//	err = a.AddActivity(ev.Ref, e.ID, utils.TSToTime(ev.Timestamp))
+	//}
+	case events.ContainerCreated:
+		return s.AddActivity(ctx, ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.ItemTrashed:
+		return s.AddActivityTrashed(ctx, ev.ID, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.ItemPurged:
+		return s.al.RemoveResource(ev.ID)
+	case events.ItemMoved:
+		// remove the cached parent id for this resource
+		s.removeCachedParentID(ctx, ev.Ref)
+
+		return s.AddActivity(ctx, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.ShareCreated:
+		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
+	case events.ShareUpdated:
+		if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
+			return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
+		}
+	case events.ShareRemoved:
+		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, ev.Timestamp)
+	case events.LinkCreated:
+		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
+	case events.LinkUpdated:
+		if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
+			return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
+		}
+	case events.LinkRemoved:
+		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.SpaceShared:
+		return s.AddSpaceActivity(ctx, ev.ID, e.ID, ev.Timestamp)
+	case events.SpaceUnshared:
+		return s.AddSpaceActivity(ctx, ev.ID, e.ID, ev.Timestamp)
+	}
+
+	return nil
+}
+
+// AddActivity adds the activity to the given resource and all its parents
+func (a *ActivitylogService) AddActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
+	ctx, span := tracer.Start(ctx, "AddActivity")
+	defer span.End()
+
+	gwc, err := a.gws.Next()
+	if err != nil {
+		return fmt.Errorf("cant get gateway client: %w", err)
+	}
+
+	ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
+	if err != nil {
+		return fmt.Errorf("cant get service user context: %w", err)
+
+	}
+	return a.al.AddActivity(ctx, initRef, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
+		return utils.GetResource(ctx, ref, gwc)
+	})
+}
+
+// AddActivityTrashed adds the activity to given trashed resource and all its former parents
+func (a *ActivitylogService) AddActivityTrashed(ctx context.Context, resourceID *provider.ResourceId, reference *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
+	ctx, span := tracer.Start(ctx, "AddActivityTrashed")
+	defer span.End()
+
+	gwc, err := a.gws.Next()
+	if err != nil {
+		return fmt.Errorf("cant get gateway client: %w", err)
+	}
+
+	ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
+	if err != nil {
+		return fmt.Errorf("cant get service user context: %w", err)
+	}
+
+	// store activity on trashed item
+	if err := a.al.StoreActivity(storagespace.FormatResourceID(resourceID), []activitylog.RawActivity{
+		{
+			EventID:   eventID,
+			Depth:     0,
+			Timestamp: timestamp,
+		},
+	}); err != nil {
+		return fmt.Errorf("could not store activity: %w", err)
+	}
+
+	// get previous parent
+	ref := &provider.Reference{
+		ResourceId: reference.GetResourceId(),
+		Path:       filepath.Dir(reference.GetPath()),
+	}
+
+	return a.al.AddActivity(ctx, ref, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
+		return utils.GetResource(ctx, ref, gwc)
+	})
+}
+
+// AddSpaceActivity adds the activity to the given spaceroot
+func (a *ActivitylogService) AddSpaceActivity(ctx context.Context, spaceID *provider.StorageSpaceId, eventID string, timestamp time.Time) error {
+	_, span := tracer.Start(ctx, "AddSpaceActivity")
+	defer span.End()
+	// spaceID is in format <providerid>$<spaceid>
+	// activitylog service uses format <providerid>$<spaceid>!<resourceid>
+	// lets do some converting, shall we?
+	rid, err := storagespace.ParseID(spaceID.GetOpaqueId())
+	if err != nil {
+		return fmt.Errorf("could not parse space id: %w", err)
+	}
+	rid.OpaqueId = rid.GetSpaceId()
+	err = a.al.StoreActivity(storagespace.FormatResourceID(&rid), []activitylog.RawActivity{
+		{
+			EventID:   eventID,
+			Depth:     0,
+			Timestamp: timestamp,
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("could not store activity: %w", err)
+	}
+	return nil
+}
+
+func toRef(r *provider.ResourceId) *provider.Reference {
+	return &provider.Reference{
+		ResourceId: r,
+	}
+}
+
+func (a *ActivitylogService) removeCachedParentID(ctx context.Context, ref *provider.Reference) {
+	var span trace.Span
+	ctx, span = tracer.Start(ctx, "removeCachedParentID")
+	defer span.End()
+
+	purgeId := ref.GetResourceId()
+	if ref.GetPath() != "" {
+		gwc, err := a.gws.Next()
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get gateway client")
+			return
+		}
+
+		ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get service user context")
+			return
+		}
+
+		info, err := utils.GetResource(ctx, ref, gwc)
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get resource info")
+			return
+		}
+		purgeId = info.GetId()
+	}
+	a.al.InvalidateCachedParentID(purgeId)
+}

services/activitylog/pkg/service/events/service_test.go

@@ -0,0 +1,123 @@
+package events_test
+
+import (
+	"context"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	eventssvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+)
+
+var _ = Describe("ActivitylogService", func() {
+	Describe("New", func() {
+		var (
+			al     *activitylog.ActivityLog
+			stream events.Stream
+		)
+
+		BeforeEach(func() {
+			al = &activitylog.ActivityLog{}
+			stream = nil
+		})
+
+		It("creates a service with minimal options", func() {
+			svc, err := eventssvc.New(al, stream)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with context option", func() {
+			ctx := context.Background()
+			svc, err := eventssvc.New(al, stream, eventssvc.Context(ctx))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with logger option", func() {
+			logger := log.NopLogger()
+			svc, err := eventssvc.New(al, stream, eventssvc.Logger(logger))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with service account option", func() {
+			sa := config.ServiceAccount{
+				ServiceAccountID:     "sa-id",
+				ServiceAccountSecret: "sa-secret",
+			}
+			svc, err := eventssvc.New(al, stream, eventssvc.ServiceAccount(sa))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with registered events", func() {
+			evts := []events.Unmarshaller{&events.UploadReady{}, &events.FileTouched{}}
+			svc, err := eventssvc.New(al, stream, eventssvc.RegisteredEvents(evts))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with gateway selector", func() {
+			var gs pool.Selectable[gateway.GatewayAPIClient]
+			svc, err := eventssvc.New(al, stream, eventssvc.GatewaySelector(gs))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with num consumers option", func() {
+			svc, err := eventssvc.New(al, stream, eventssvc.NumConsumers(5))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with all options", func() {
+			ctx := context.Background()
+			logger := log.NopLogger()
+			sa := config.ServiceAccount{
+				ServiceAccountID:     "sa-id",
+				ServiceAccountSecret: "sa-secret",
+			}
+			evts := []events.Unmarshaller{&events.UploadReady{}, &events.ContainerCreated{}}
+			var gs pool.Selectable[gateway.GatewayAPIClient]
+
+			svc, err := eventssvc.New(
+				al,
+				stream,
+				eventssvc.Context(ctx),
+				eventssvc.Logger(logger),
+				eventssvc.ServiceAccount(sa),
+				eventssvc.RegisteredEvents(evts),
+				eventssvc.GatewaySelector(gs),
+				eventssvc.NumConsumers(3),
+			)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+	})
+
+	Describe("Close", func() {
+		It("can be called without panic on a new service", func() {
+			al := &activitylog.ActivityLog{}
+			svc, err := eventssvc.New(al, nil)
+			Expect(err).ToNot(HaveOccurred())
+
+			Expect(func() { svc.Close() }).ToNot(Panic())
+		})
+
+		It("can be called multiple times without panic", func() {
+			al := &activitylog.ActivityLog{}
+			svc, err := eventssvc.New(al, nil)
+			Expect(err).ToNot(HaveOccurred())
+
+			svc.Close()
+			svc.Close()
+			svc.Close()
+		})
+	})
+})

services/activitylog/pkg/service/http/http_suite_test.go

@@ -0,0 +1,13 @@
+package http_test
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestHTTP(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "HTTP Suite")
+}

services/activitylog/pkg/service/http/option.go

@@ -0,0 +1,59 @@
+package http
+
+import (
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Logger           log.Logger
+	RegisteredEvents []events.Unmarshaller
+	GatewaySelector  pool.Selectable[gateway.GatewayAPIClient]
+	HistoryClient    ehsvc.EventHistoryService
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}
+
+// RegisteredEvents registers the events the service should listen to
+func RegisteredEvents(e []events.Unmarshaller) Option {
+	return func(o *Options) {
+		o.RegisteredEvents = e
+	}
+}
+
+// GatewaySelector adds a grpc client selector for the gateway service
+func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient]) Option {
+	return func(o *Options) {
+		o.GatewaySelector = gatewaySelector
+	}
+}
+
+// HistoryClient adds a grpc client for the eventhistory service
+func HistoryClient(hc ehsvc.EventHistoryService) Option {
+	return func(o *Options) {
+		o.HistoryClient = hc
+	}
+}

services/activitylog/pkg/service/http/response.go

@@ -1,4 +1,4 @@
-package service
+package http
 
 import (
 	"context"
@@ -44,11 +44,6 @@ var (
 	StrDescription    = l10n.Template("description")
 )
 
-// GetActivitiesResponse is the response on GET activities requests
-type GetActivitiesResponse struct {
-	Activities []libregraph.Activity `json:"value"`
-}
-
 // Resource represents an item such as a file or folder
 type Resource struct {
 	ID   string `json:"id"`
@@ -311,7 +306,7 @@ func NewActivity(message string, ts time.Time, eventID string, vars map[string]a
 }
 
 // GetVars calls other service to gather the required data for the activity variables
-func (s *ActivitylogService) GetVars(ctx context.Context, opts ...ActivityOption) (map[string]any, error) {
+func (s *svc) GetVars(ctx context.Context, opts ...ActivityOption) (map[string]any, error) {
 	gwc, err := s.gws.Next()
 	if err != nil {
 		return nil, err
@@ -327,6 +322,12 @@ func (s *ActivitylogService) GetVars(ctx context.Context, opts ...ActivityOption
 	return vars, nil
 }
 
+func toSpace(r *provider.Reference) *provider.StorageSpaceId {
+	return &provider.StorageSpaceId{
+		OpaqueId: storagespace.FormatStorageID(r.GetResourceId().GetStorageId(), r.GetResourceId().GetSpaceId()),
+	}
+}
+
 func getFolderName(ctx context.Context, gwc gateway.GatewayAPIClient, ref *provider.Reference) string {
 	n := filepath.Base(filepath.Dir(ref.GetPath()))
 	if n == "." || n == "/" {

services/activitylog/pkg/service/http/response_test.go

@@ -0,0 +1,150 @@
+package http_test
+
+import (
+	"context"
+	"time"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/pkg/l10n"
+	httpsvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
+)
+
+var _ = Describe("Response", func() {
+	Describe("NewActivity", func() {
+		It("creates an activity with the given parameters", func() {
+			ts := time.Date(2024, 1, 15, 10, 30, 0, 0, time.UTC)
+			vars := map[string]any{
+				"user":     "testuser",
+				"resource": "testfile.txt",
+			}
+
+			act := httpsvc.NewActivity("Test message", ts, "event-123", vars)
+
+			Expect(act.Id).To(Equal("event-123"))
+			Expect(act.Times.RecordedTime).To(Equal(ts))
+			Expect(act.Template.Message).To(Equal("Test message"))
+			Expect(act.Template.Variables).To(HaveKeyWithValue("user", "testuser"))
+			Expect(act.Template.Variables).To(HaveKeyWithValue("resource", "testfile.txt"))
+		})
+
+		It("handles empty variables map", func() {
+			act := httpsvc.NewActivity("", time.Time{}, "", map[string]any{})
+
+			Expect(act.Id).To(BeEmpty())
+			Expect(act.Times.RecordedTime).To(Equal(time.Time{}))
+			Expect(act.Template.Message).To(BeEmpty())
+			Expect(act.Template.Variables).To(BeEmpty())
+		})
+	})
+
+	Describe("WithOldResource", func() {
+		It("sets the oldResource variable from reference path", func() {
+			ref := &provider.Reference{
+				Path: "/old/path/oldname.txt",
+			}
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithOldResource(ref)
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("oldResource"))
+		})
+	})
+
+	Describe("WithUser", func() {
+		It("returns error when no user is provided", func() {
+			opt := httpsvc.WithUser(nil, nil, nil)
+			err := opt(context.Background(), nil, make(map[string]any))
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("no user provided"))
+		})
+
+		It("uses impersonator when provided", func() {
+			impersonator := &user.User{
+				Id: &user.UserId{
+					OpaqueId: "imp-user-id",
+				},
+				DisplayName: "Impersonated User",
+			}
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithUser(nil, nil, impersonator)
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("user"))
+		})
+
+		It("uses executing user when no impersonator", func() {
+			execUser := &user.User{
+				Id: &user.UserId{
+					OpaqueId: "exec-user-id",
+				},
+				DisplayName: "Executing User",
+			}
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithUser(nil, execUser, nil)
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("user"))
+		})
+	})
+
+	Describe("WithVar", func() {
+		It("sets a simple key-value variable", func() {
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithVar("token", "id123", "My Token")
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("token"))
+		})
+	})
+
+	Describe("WithTranslation", func() {
+		It("sets translated field variable", func() {
+			var t l10n.Translator
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithTranslation(&t, "en", "field", []string{"permission"})
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("field"))
+		})
+
+		It("handles empty values slice", func() {
+			var t l10n.Translator
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithTranslation(&t, "en", "field", []string{})
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("field"))
+		})
+	})
+
+	Describe("ActivityOption type", func() {
+		It("allows composing multiple options", func() {
+			vars := make(map[string]any)
+			ctx := context.Background()
+			var gwc gateway.GatewayAPIClient
+
+			options := []httpsvc.ActivityOption{
+				httpsvc.WithVar("key1", "id1", "name1"),
+				httpsvc.WithVar("key2", "id2", "name2"),
+			}
+
+			for _, opt := range options {
+				err := opt(ctx, gwc, vars)
+				Expect(err).ToNot(HaveOccurred())
+			}
+
+			Expect(vars).To(HaveKey("key1"))
+			Expect(vars).To(HaveKey("key2"))
+		})
+	})
+})

services/activitylog/pkg/service/http/service.go

@@ -1,89 +1,97 @@
-package service
+package http
 
 import (
-	"embed"
-	"encoding/json"
-	"errors"
-	"net/http"
+	"context"
 	"path/filepath"
+	"reflect"
 	"slices"
 	"strconv"
 	"strings"
 	"time"
 
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	"google.golang.org/grpc/metadata"
-
+	"github.com/olekukonko/errors"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/opencloud/pkg/ast"
 	"github.com/opencloud-eu/opencloud/pkg/kql"
 	"github.com/opencloud-eu/opencloud/pkg/l10n"
+	"github.com/opencloud-eu/opencloud/pkg/log"
 	ehmsg "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/eventhistory/v0"
 	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
 )
 
-var (
-	//go:embed l10n/locale
-	_localeFS embed.FS
+var tracer trace.Tracer
 
-	// subfolder where the translation files are stored
-	_localeSubPath = "l10n/locale"
-
-	// domain of the activitylog service (transifex)
-	_domain = "activitylog"
-)
-
-// ServeHTTP implements the http.Handler interface.
-func (s *ActivitylogService) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	s.mux.ServeHTTP(w, r)
+func init() {
+	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http")
 }
 
-// HandleGetItemActivities handles the request to get the activities of an item.
-func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, r.Header.Get(revactx.TokenHeader))
+// New returns a new instance of Service
+func New(al *activitylog.ActivityLog, opts ...Option) (*svc, error) {
+	o := newOptions(opts...)
 
-	activeUser, ok := revactx.ContextGetUser(ctx)
-	if !ok {
-		w.WriteHeader(http.StatusUnauthorized)
-		return
+	registeredEvents := make(map[string]events.Unmarshaller)
+	for _, e := range o.RegisteredEvents {
+		typ := reflect.TypeOf(e)
+		registeredEvents[typ.String()] = e
 	}
 
+	return &svc{
+		log:              o.Logger,
+		evHistory:        o.HistoryClient,
+		al:               al,
+		registeredEvents: registeredEvents,
+		gws:              o.GatewaySelector,
+	}, nil
+}
+
+type svc struct {
+	log              log.Logger
+	evHistory        ehsvc.EventHistoryService
+	gws              pool.Selectable[gateway.GatewayAPIClient]
+	al               *activitylog.ActivityLog
+	registeredEvents map[string]events.Unmarshaller
+}
+
+var (
+	ErrBadRequest = errors.New("bad request")
+	ErrForbidden  = errors.New("forbidden")
+)
+
+func (s *svc) GetItemActivities(ctx context.Context, query, loc string, t l10n.Translator) ([]libregraph.Activity, error) {
 	gwc, err := s.gws.Next()
 	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		return
+		return nil, err
 	}
 
-	rid, limit, rawActivityAccepted, activityAccepted, sort, err := s.getFilters(r.URL.Query().Get("kql"))
+	rid, limit, rawActivityAccepted, activityAccepted, sort, err := s.getFilters(query)
 	if err != nil {
-		s.log.Info().Str("query", r.URL.Query().Get("kql")).Err(err).Msg("error getting filters")
-		_, _ = w.Write([]byte(err.Error()))
-		w.WriteHeader(http.StatusBadRequest)
-		return
+		s.log.Info().Str("query", query).Err(err).Msg("error getting filters")
+		return nil, ErrBadRequest
 	}
 
 	info, err := utils.GetResourceByID(ctx, rid, gwc)
 	if err != nil {
-		w.WriteHeader(http.StatusForbidden)
-		return
+		return nil, ErrForbidden
 	}
 
 	// you need ListGrants to see activities
 	if !info.GetPermissionSet().GetListGrants() {
-		w.WriteHeader(http.StatusForbidden)
-		return
+		return nil, ErrForbidden
 	}
 
-	raw, err := s.Activities(rid)
+	raw, err := s.al.Activities(rid)
 	if err != nil {
 		s.log.Error().Err(err).Msg("error getting activities")
-		w.WriteHeader(http.StatusInternalServerError)
-		return
+		return nil, err
 	}
 
 	ids := make([]string, 0, len(raw))
@@ -96,21 +104,21 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
 		toDelete[a.EventID] = struct{}{}
 	}
 
-	evRes, err := s.evHistory.GetEvents(r.Context(), &ehsvc.GetEventsRequest{Ids: ids})
+	evRes, err := s.evHistory.GetEvents(ctx, &ehsvc.GetEventsRequest{Ids: ids})
 	if err != nil {
 		s.log.Error().Err(err).Msg("error getting events")
-		w.WriteHeader(http.StatusInternalServerError)
-		return
+		return nil, err
 	}
 
 	evs := evRes.GetEvents()
 	sort(evs)
 
-	resp := GetActivitiesResponse{Activities: make([]libregraph.Activity, 0, len(evRes.GetEvents()))}
+	// TODO cut the interface here?
+	activities := make([]libregraph.Activity, 0, len(evRes.GetEvents()))
 	for _, e := range evs {
 		delete(toDelete, e.GetId())
 
-		if limit > 0 && limit <= len(resp.Activities) {
+		if limit > 0 && limit <= len(activities) {
 			continue
 		}
 
@@ -124,9 +132,6 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
 			vars    map[string]any
 		)
 
-		loc := l10n.MustGetUserLocale(r.Context(), activeUser.GetId().GetOpaqueId(), r.Header.Get(l10n.HeaderAcceptLanguage), s.valService)
-		t := l10n.NewTranslatorFromCommonConfig(s.cfg.DefaultLanguage, _domain, s.cfg.TranslationPath, _localeFS, _localeSubPath)
-
 		switch ev := s.unwrapEvent(e).(type) {
 		case nil:
 			// error already logged in unwrapEvent
@@ -224,35 +229,29 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
 			continue
 		}
 
-		resp.Activities = append(resp.Activities, NewActivity(t.Translate(message, loc), ts, e.GetId(), vars))
+		activities = append(activities, NewActivity(t.Translate(message, loc), ts, e.GetId(), vars))
 	}
 
 	// delete activities in separate go routine
 	if len(toDelete) > 0 {
 		go func() {
-			err := s.RemoveActivities(rid, toDelete)
+			err := s.al.RemoveActivities(rid, toDelete)
 			if err != nil {
 				s.log.Error().Err(err).Msg("error removing activities")
 			}
 		}()
 	}
+	return activities, nil
 
-	b, err := json.Marshal(resp)
-	if err != nil {
-		s.log.Error().Err(err).Msg("error marshalling activities")
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-
-	if _, err := w.Write(b); err != nil {
-		s.log.Error().Err(err).Msg("error writing response")
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-	w.WriteHeader(http.StatusOK)
 }
 
-func (s *ActivitylogService) unwrapEvent(e *ehmsg.Event) any {
+func toRef(r *provider.ResourceId) *provider.Reference {
+	return &provider.Reference{
+		ResourceId: r,
+	}
+}
+
+func (s *svc) unwrapEvent(e *ehmsg.Event) any {
 	etype, ok := s.registeredEvents[e.GetType()]
 	if !ok {
 		s.log.Error().Str("eventid", e.GetId()).Str("eventtype", e.GetType()).Msg("event not registered")
@@ -268,13 +267,13 @@ func (s *ActivitylogService) unwrapEvent(e *ehmsg.Event) any {
 	return einterface
 }
 
-func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int, func(RawActivity) bool, func(*ehmsg.Event) bool, func([]*ehmsg.Event), error) {
+func (s *svc) getFilters(query string) (*provider.ResourceId, int, func(activitylog.RawActivity) bool, func(*ehmsg.Event) bool, func([]*ehmsg.Event), error) {
 	qast, err := kql.Builder{}.Build(query)
 	if err != nil {
 		return nil, 0, nil, nil, nil, err
 	}
 
-	prefilters := make([]func(RawActivity) bool, 0)
+	prefilters := make([]func(activitylog.RawActivity) bool, 0)
 	postfilters := make([]func(*ehmsg.Event) bool, 0)
 
 	sortby := func(_ []*ehmsg.Event) {}
@@ -299,7 +298,7 @@ func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int
 					break
 				}
 
-				prefilters = append(prefilters, func(a RawActivity) bool {
+				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
 					return a.Depth <= depth
 				})
 			case "limit":
@@ -322,11 +321,11 @@ func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int
 		case *ast.DateTimeNode:
 			switch v.Operator.Value {
 			case "<", "<=":
-				prefilters = append(prefilters, func(a RawActivity) bool {
+				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
 					return a.Timestamp.Before(v.Value)
 				})
 			case ">", ">=":
-				prefilters = append(prefilters, func(a RawActivity) bool {
+				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
 					return a.Timestamp.After(v.Value)
 				})
 			}
@@ -345,7 +344,7 @@ func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int
 		// space root requested - fix format
 		rid.OpaqueId = rid.GetSpaceId()
 	}
-	pref := func(a RawActivity) bool {
+	pref := func(a activitylog.RawActivity) bool {
 		for _, f := range prefilters {
 			if !f(a) {
 				return false

services/activitylog/pkg/service/http/service_test.go

@@ -0,0 +1,76 @@
+package http_test
+
+import (
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	httpsvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+)
+
+var _ = Describe("Service", func() {
+	Describe("New", func() {
+		var (
+			al *activitylog.ActivityLog
+		)
+
+		BeforeEach(func() {
+			al = &activitylog.ActivityLog{}
+		})
+
+		It("creates a service with default options", func() {
+			svc, err := httpsvc.New(al)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with logger option", func() {
+			logger := log.NopLogger()
+			svc, err := httpsvc.New(al, httpsvc.Logger(logger))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with registered events", func() {
+			evts := []events.Unmarshaller{&events.UploadReady{}}
+			svc, err := httpsvc.New(al, httpsvc.RegisteredEvents(evts))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with gateway selector", func() {
+			var gs pool.Selectable[gateway.GatewayAPIClient]
+			svc, err := httpsvc.New(al, httpsvc.GatewaySelector(gs))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with history client", func() {
+			var hc ehsvc.EventHistoryService
+			svc, err := httpsvc.New(al, httpsvc.HistoryClient(hc))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with all options", func() {
+			logger := log.NopLogger()
+			evts := []events.Unmarshaller{&events.UploadReady{}, &events.FileTouched{}}
+			var gs pool.Selectable[gateway.GatewayAPIClient]
+			var hc ehsvc.EventHistoryService
+
+			svc, err := httpsvc.New(
+				al,
+				httpsvc.Logger(logger),
+				httpsvc.RegisteredEvents(evts),
+				httpsvc.GatewaySelector(gs),
+				httpsvc.HistoryClient(hc),
+			)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+	})
+})

services/activitylog/pkg/service/service.go

@@ -1,676 +0,0 @@
-package service
-
-import (
-	"context"
-	"crypto/tls"
-	"encoding/base32"
-	"encoding/json"
-	"fmt"
-	"path/filepath"
-	"reflect"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	"github.com/go-chi/chi/v5"
-	"github.com/jellydator/ttlcache/v2"
-	"github.com/nats-io/nats.go"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	"github.com/pkg/errors"
-	"github.com/vmihailenco/msgpack/v5"
-	"go.opentelemetry.io/otel/trace"
-
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
-	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-)
-
-// Nats runs into max payload exceeded errors at around 7k activities. Let's keep a buffer.
-var _maxActivitiesDefault = 6000
-
-// RawActivity represents an activity as it is stored in the activitylog store
-type RawActivity struct {
-	EventID   string    `json:"event_id"`
-	Depth     int       `json:"depth"`
-	Timestamp time.Time `json:"timestamp"`
-}
-
-// ActivitylogService logs events per resource
-type ActivitylogService struct {
-	cfg           *config.Config
-	log           log.Logger
-	events        <-chan events.Event
-	gws           pool.Selectable[gateway.GatewayAPIClient]
-	mux           *chi.Mux
-	evHistory     ehsvc.EventHistoryService
-	valService    settingssvc.ValueService
-	lock          sync.RWMutex
-	tp            trace.TracerProvider
-	tracer        trace.Tracer
-	debouncer     *Debouncer
-	parentIdCache *ttlcache.Cache
-	natskv        nats.KeyValue
-
-	maxActivities int
-
-	registeredEvents map[string]events.Unmarshaller
-}
-
-type Debouncer struct {
-	after      time.Duration
-	f          func(id string, ra []RawActivity) error
-	pending    sync.Map
-	inProgress sync.Map
-
-	mutex sync.Mutex
-}
-
-type queueItem struct {
-	activities []RawActivity
-	timer      *time.Timer
-}
-
-type batchInfo struct {
-	key       string
-	count     int
-	timestamp time.Time
-}
-
-// NewDebouncer returns a new Debouncer instance
-func NewDebouncer(d time.Duration, f func(id string, ra []RawActivity) error) *Debouncer {
-	return &Debouncer{
-		after:      d,
-		f:          f,
-		pending:    sync.Map{},
-		inProgress: sync.Map{},
-	}
-}
-
-// Debounce restarts the debounce timer for the given space
-func (d *Debouncer) Debounce(id string, ra RawActivity) {
-	if d.after == 0 {
-		d.f(id, []RawActivity{ra})
-		return
-	}
-
-	d.mutex.Lock()
-	defer d.mutex.Unlock()
-
-	activities := []RawActivity{ra}
-	item := &queueItem{
-		activities: activities,
-	}
-	if i, ok := d.pending.Load(id); ok {
-		// if the item is already in the queue, append the new activities
-		item, ok = i.(*queueItem)
-		if ok {
-			item.activities = append(item.activities, ra)
-		}
-	}
-
-	if item.timer == nil {
-		item.timer = time.AfterFunc(d.after, func() {
-			if _, ok := d.inProgress.Load(id); ok {
-				// Reschedule this run for when the previous run has finished
-				d.mutex.Lock()
-				if i, ok := d.pending.Load(id); ok {
-					i.(*queueItem).timer.Reset(d.after)
-				}
-
-				d.mutex.Unlock()
-				return
-			}
-
-			d.pending.Delete(id)
-			d.inProgress.Store(id, true)
-			defer d.inProgress.Delete(id)
-			d.f(id, item.activities)
-		})
-	}
-
-	d.pending.Store(id, item)
-}
-
-// New creates a new ActivitylogService
-func New(opts ...Option) (*ActivitylogService, error) {
-	o := &Options{
-		MaxActivities: _maxActivitiesDefault,
-	}
-	for _, opt := range opts {
-		opt(o)
-	}
-
-	if o.Stream == nil {
-		return nil, errors.New("stream is required")
-	}
-
-	ch, err := events.Consume(o.Stream, o.Config.Service.Name, o.RegisteredEvents...)
-	if err != nil {
-		return nil, err
-	}
-
-	cache := ttlcache.NewCache()
-	err = cache.SetTTL(30 * time.Second)
-	if err != nil {
-		return nil, err
-	}
-
-	// Connect to NATS servers
-	natsOptions := nats.Options{
-		Servers: o.Config.Store.Nodes,
-	}
-	if o.Config.Store.EnableTLS {
-		if o.Config.Store.TLSRootCACertificate != "" {
-			// when root ca is configured use it. an insecure flag is ignored.
-			nats.RootCAs(o.Config.Store.TLSRootCACertificate)(&natsOptions)
-		} else {
-			// enable tls and use insecure flag
-			nats.Secure(&tls.Config{MinVersion: tls.VersionTLS12, InsecureSkipVerify: o.Config.Store.TLSInsecure})(&natsOptions)
-		}
-	}
-	if o.Config.Store.AuthUsername != "" && o.Config.Store.AuthPassword != "" {
-		nats.UserInfo(o.Config.Store.AuthUsername, o.Config.Store.AuthPassword)(&natsOptions)
-	}
-	conn, err := natsOptions.Connect()
-	if err != nil {
-		return nil, err
-	}
-
-	js, err := conn.JetStream()
-	if err != nil {
-		return nil, err
-	}
-
-	kv, err := js.KeyValue(o.Config.Store.Database)
-	if err != nil {
-		if !errors.Is(err, nats.ErrBucketNotFound) {
-			return nil, errors.Wrapf(err, "Failed to get bucket (%s)", o.Config.Store.Database)
-		}
-
-		kv, err = js.CreateKeyValue(&nats.KeyValueConfig{
-			Bucket: o.Config.Store.Database,
-		})
-		if err != nil {
-			return nil, errors.Wrapf(err, "Failed to create bucket (%s)", o.Config.Store.Database)
-		}
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	s := &ActivitylogService{
-		log:              o.Logger,
-		cfg:              o.Config,
-		events:           ch,
-		gws:              o.GatewaySelector,
-		mux:              o.Mux,
-		evHistory:        o.HistoryClient,
-		valService:       o.ValueClient,
-		lock:             sync.RWMutex{},
-		registeredEvents: make(map[string]events.Unmarshaller),
-		tp:               o.TraceProvider,
-		tracer:           o.TraceProvider.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service"),
-		parentIdCache:    cache,
-		maxActivities:    o.Config.MaxActivities,
-		natskv:           kv,
-	}
-	s.debouncer = NewDebouncer(o.Config.WriteBufferDuration, s.storeActivity)
-
-	// run migrations
-	err = s.runMigrations(context.Background(), kv)
-	if err != nil {
-		return nil, err
-	}
-
-	s.mux.Get("/graph/v1beta1/extensions/org.libregraph/activities", s.HandleGetItemActivities)
-
-	for _, e := range o.RegisteredEvents {
-		typ := reflect.TypeOf(e)
-		s.registeredEvents[typ.String()] = e
-	}
-
-	go s.Run()
-
-	return s, nil
-}
-
-// Run runs the service
-func (a *ActivitylogService) Run() {
-	for e := range a.events {
-		var err error
-		switch ev := e.Event.(type) {
-		case events.UploadReady:
-			err = a.AddActivity(ev.FileRef, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.FileTouched:
-			err = a.AddActivity(ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-		// Disabled https://github.com/owncloud/ocis/issues/10293
-		//case events.FileDownloaded:
-		// we are only interested in public link downloads - so no need to store others.
-		//if ev.ImpersonatingUser.GetDisplayName() == "Public" {
-		//	err = a.AddActivity(ev.Ref, e.ID, utils.TSToTime(ev.Timestamp))
-		//}
-		case events.ContainerCreated:
-			err = a.AddActivity(ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.ItemTrashed:
-			err = a.AddActivityTrashed(ev.ID, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.ItemPurged:
-			err = a.RemoveResource(ev.ID)
-		case events.ItemMoved:
-			// remove the cached parent id for this resource
-			a.removeCachedParentID(ev.Ref)
-
-			err = a.AddActivity(ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.ShareCreated:
-			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
-		case events.ShareUpdated:
-			if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
-				err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
-			}
-		case events.ShareRemoved:
-			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, ev.Timestamp)
-		case events.LinkCreated:
-			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
-		case events.LinkUpdated:
-			if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
-				err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
-			}
-		case events.LinkRemoved:
-			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.SpaceShared:
-			err = a.AddSpaceActivity(ev.ID, e.ID, ev.Timestamp)
-		case events.SpaceUnshared:
-			err = a.AddSpaceActivity(ev.ID, e.ID, ev.Timestamp)
-		}
-
-		if err != nil {
-			a.log.Error().Err(err).Interface("event", e).Msg("could not process event")
-		}
-	}
-}
-
-// AddActivity adds the activity to the given resource and all its parents
-func (a *ActivitylogService) AddActivity(initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
-	gwc, err := a.gws.Next()
-	if err != nil {
-		return fmt.Errorf("cant get gateway client: %w", err)
-	}
-
-	ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
-	if err != nil {
-		return fmt.Errorf("cant get service user context: %w", err)
-	}
-	var span trace.Span
-	ctx, span = a.tracer.Start(ctx, "AddActivity")
-	defer span.End()
-
-	return a.addActivity(ctx, initRef, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
-		return utils.GetResource(ctx, ref, gwc)
-	})
-}
-
-// AddActivityTrashed adds the activity to given trashed resource and all its former parents
-func (a *ActivitylogService) AddActivityTrashed(resourceID *provider.ResourceId, reference *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
-	gwc, err := a.gws.Next()
-	if err != nil {
-		return fmt.Errorf("cant get gateway client: %w", err)
-	}
-
-	ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
-	if err != nil {
-		return fmt.Errorf("cant get service user context: %w", err)
-	}
-
-	// store activity on trashed item
-	if err := a.storeActivity(storagespace.FormatResourceID(resourceID), []RawActivity{
-		{
-			EventID:   eventID,
-			Depth:     0,
-			Timestamp: timestamp,
-		},
-	}); err != nil {
-		return fmt.Errorf("could not store activity: %w", err)
-	}
-
-	// get previous parent
-	ref := &provider.Reference{
-		ResourceId: reference.GetResourceId(),
-		Path:       filepath.Dir(reference.GetPath()),
-	}
-
-	var span trace.Span
-	ctx, span = a.tracer.Start(ctx, "AddActivityTrashed")
-	defer span.End()
-
-	return a.addActivity(ctx, ref, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
-		return utils.GetResource(ctx, ref, gwc)
-	})
-}
-
-// AddSpaceActivity adds the activity to the given spaceroot
-func (a *ActivitylogService) AddSpaceActivity(spaceID *provider.StorageSpaceId, eventID string, timestamp time.Time) error {
-	// spaceID is in format <providerid>$<spaceid>
-	// activitylog service uses format <providerid>$<spaceid>!<resourceid>
-	// lets do some converting, shall we?
-	rid, err := storagespace.ParseID(spaceID.GetOpaqueId())
-	if err != nil {
-		return fmt.Errorf("could not parse space id: %w", err)
-	}
-	rid.OpaqueId = rid.GetSpaceId()
-	return a.storeActivity(storagespace.FormatResourceID(&rid), []RawActivity{
-		{
-			EventID:   eventID,
-			Depth:     0,
-			Timestamp: timestamp,
-		},
-	})
-
-}
-
-// Activities returns the activities for the given resource
-func (a *ActivitylogService) Activities(rid *provider.ResourceId) ([]RawActivity, error) {
-	a.lock.RLock()
-	defer a.lock.RUnlock()
-
-	return a.activities(rid)
-}
-
-// RemoveActivities removes the activities from the given resource
-func (a *ActivitylogService) RemoveActivities(rid *provider.ResourceId, toDelete map[string]struct{}) error {
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	curActivities, err := a.activities(rid)
-	if err != nil {
-		return err
-	}
-
-	var acts []RawActivity
-	for _, a := range curActivities {
-		if _, ok := toDelete[a.EventID]; !ok {
-			acts = append(acts, a)
-		}
-	}
-
-	b, err := json.Marshal(acts)
-	if err != nil {
-		return err
-	}
-
-	_, err = a.natskv.Put(storagespace.FormatResourceID(rid), b)
-	return err
-}
-
-// RemoveResource removes the resource from the store
-func (a *ActivitylogService) RemoveResource(rid *provider.ResourceId) error {
-	if rid == nil {
-		return fmt.Errorf("resource id is required")
-	}
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.natskv.Delete(storagespace.FormatResourceID(rid))
-}
-
-func (a *ActivitylogService) activities(rid *provider.ResourceId) ([]RawActivity, error) {
-	resourceID := storagespace.FormatResourceID(rid)
-
-	glob := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
-
-	watcher, err := a.natskv.Watch(glob, nats.IgnoreDeletes())
-	if err != nil {
-		return nil, err
-	}
-	defer watcher.Stop()
-
-	var activities []RawActivity
-	for update := range watcher.Updates() {
-		if update == nil {
-			break
-		}
-
-		var batchActivities []RawActivity
-		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
-			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
-		}
-		activities = append(activities, batchActivities...)
-	}
-
-	return activities, nil
-}
-
-// note: getResource is abstracted to allow unit testing, in general this will just be utils.GetResource
-func (a *ActivitylogService) addActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time, getResource func(context.Context, *provider.Reference) (*provider.ResourceInfo, error)) error {
-	var (
-		err   error
-		depth int
-		ref   = initRef
-	)
-	ctx, span := a.tracer.Start(ctx, "addActivity")
-	defer span.End()
-	for {
-		var info *provider.ResourceInfo
-		id := ref.GetResourceId()
-		if ref.Path != "" {
-			// Path based reference, we need to resolve the resource id
-			ctx, span = a.tracer.Start(ctx, "addActivity.getResource")
-			info, err = getResource(ctx, ref)
-			span.End()
-			if err != nil {
-				return fmt.Errorf("could not get resource info: %w", err)
-			}
-			id = info.GetId()
-		}
-		if id == nil {
-			return fmt.Errorf("resource id is required")
-		}
-
-		key := storagespace.FormatResourceID(id)
-		a.debouncer.Debounce(key, RawActivity{
-			EventID:   eventID,
-			Depth:     depth,
-			Timestamp: timestamp,
-		})
-
-		if id.OpaqueId == id.SpaceId {
-			// we are at the root of the space, no need to go further
-			break
-		}
-
-		// check if parent id is cached
-		// parent id is cached in the format <storageid>$<spaceid>!<resourceid>
-		// if it is not cached, get the resource info and cache it
-		if parentId == nil {
-			if v, err := a.parentIdCache.Get(key); err != nil {
-				if info == nil {
-					ctx, span := a.tracer.Start(ctx, "addActivity.getResource parent")
-					info, err = getResource(ctx, ref)
-					span.End()
-					if err != nil || info.GetParentId() == nil || info.GetParentId().GetOpaqueId() == "" {
-						return fmt.Errorf("could not get parent id: %w", err)
-					}
-				}
-				parentId = info.GetParentId()
-				a.parentIdCache.Set(key, parentId)
-			} else {
-				parentId = v.(*provider.ResourceId)
-			}
-		} else {
-			a.log.Debug().Msg("parent id is cached")
-		}
-
-		depth++
-		ref = &provider.Reference{ResourceId: parentId}
-		parentId = nil // reset parent id so it's not reused in the next iteration
-	}
-
-	return nil
-}
-
-func (a *ActivitylogService) storeActivity(resourceID string, activities []RawActivity) error {
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	ctx, span := a.tracer.Start(context.Background(), "storeActivity")
-	defer span.End()
-
-	_, subspan := a.tracer.Start(ctx, "storeActivity.Marshal")
-	b, err := msgpack.Marshal(activities)
-	if err != nil {
-		return err
-	}
-	subspan.End()
-
-	_, subspan = a.tracer.Start(ctx, "storeActivity.natskv.Put")
-	key := natsKey(resourceID, len(activities))
-	_, err = a.natskv.Put(key, b)
-	if err != nil {
-		return err
-	}
-	subspan.End()
-
-	ctx, subspan = a.tracer.Start(ctx, "storeActivity.enforceMaxActivities")
-	a.enforceMaxActivities(ctx, resourceID)
-	subspan.End()
-	return nil
-}
-
-func (a *ActivitylogService) enforceMaxActivities(ctx context.Context, resourceID string) {
-	if a.maxActivities <= 0 {
-		return
-	}
-
-	key := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
-
-	_, subspan := a.tracer.Start(ctx, "enforceMaxActivities.watch")
-	watcher, err := a.natskv.Watch(key, nats.IgnoreDeletes())
-	if err != nil {
-		a.log.Error().Err(err).Str("resourceID", resourceID).Msg("could not watch")
-		return
-	}
-	defer watcher.Stop()
-
-	var keys []string
-	for update := range watcher.Updates() {
-		if update == nil {
-			break
-		}
-
-		var batchActivities []RawActivity
-		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
-			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
-		}
-		keys = append(keys, update.Key())
-	}
-	subspan.End()
-
-	_, subspan = a.tracer.Start(ctx, "enforceMaxActivities.compile")
-	// Parse keys into batches
-	batches := make([]batchInfo, 0)
-	var activitiesCount int
-	for _, k := range keys {
-		parts := strings.SplitN(k, ".", 3)
-		if len(parts) < 3 {
-			a.log.Warn().Str("key", k).Msg("skipping key, not enough parts")
-			continue
-		}
-
-		c, err := strconv.Atoi(parts[1])
-		if err != nil {
-			a.log.Warn().Str("key", k).Msg("skipping key, can not parse count")
-			continue
-		}
-
-		// parse timestamp
-		nano, err := strconv.ParseInt(parts[2], 10, 64)
-		if err != nil {
-			a.log.Warn().Str("key", k).Msg("skipping key, can not parse timestamp")
-			continue
-		}
-
-		batches = append(batches, batchInfo{
-			key:       k,
-			count:     c,
-			timestamp: time.Unix(0, nano),
-		})
-		activitiesCount += c
-	}
-
-	// sort batches by timestamp
-	sort.Slice(batches, func(i, j int) bool {
-		return batches[i].timestamp.Before(batches[j].timestamp)
-	})
-	subspan.End()
-
-	_, subspan = a.tracer.Start(ctx, "enforceMaxActivities.delete")
-	// remove oldest keys until we are at max activities
-	for _, b := range batches {
-		if activitiesCount-b.count < a.maxActivities {
-			break
-		}
-
-		activitiesCount -= b.count
-		err = a.natskv.Delete(b.key)
-		if err != nil {
-			a.log.Error().Err(err).Str("key", b.key).Msg("could not delete key")
-			break
-		}
-	}
-	subspan.End()
-}
-
-func toRef(r *provider.ResourceId) *provider.Reference {
-	return &provider.Reference{
-		ResourceId: r,
-	}
-}
-
-func toSpace(r *provider.Reference) *provider.StorageSpaceId {
-	return &provider.StorageSpaceId{
-		OpaqueId: storagespace.FormatStorageID(r.GetResourceId().GetStorageId(), r.GetResourceId().GetSpaceId()),
-	}
-}
-
-func (a *ActivitylogService) removeCachedParentID(ref *provider.Reference) {
-	purgeId := ref.GetResourceId()
-	if ref.GetPath() != "" {
-		gwc, err := a.gws.Next()
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get gateway client")
-			return
-		}
-
-		ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get service user context")
-			return
-		}
-
-		info, err := utils.GetResource(ctx, ref, gwc)
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get resource info")
-			return
-		}
-		purgeId = info.GetId()
-	}
-	// The parent id cache is populated lazily and its entries expire, so a
-	// missing key is the expected case rather than an error.
-	if err := a.parentIdCache.Remove(storagespace.FormatResourceID(purgeId)); err != nil {
-		a.log.Debug().Interface("event", ref).Err(err).Msg("could not delete parent id cache")
-	}
-}
-
-func natsKey(resourceID string, activitiesCount int) string {
-	return fmt.Sprintf("%s.%d.%d",
-		base32.StdEncoding.EncodeToString([]byte(resourceID)),
-		activitiesCount,
-		time.Now().UnixNano())
-}