align the handler verifier, update docs

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>

.agents/skills/bumping-reva/SKILL.md

@@ -114,16 +114,16 @@ Confirm the reva line in `go.mod` is exactly `github.com/opencloud-eu/reva/v2 RE
 - Stage everything the bump touched: `git add go.mod go.sum vendor pkg/version/version.go`.
 - One commit, conventional-commits format, **empty body**:
   ```
-  chore: reva bump -2.48.0
+  chore: bump reva to 2.48.0
   ```
 - PR base: **`main`** (reva bumps always target main).
-- PR title: `[full-ci] chore: reva bump -2.48.0` (the commit message prefixed with `[full-ci] `).
+- PR title: `[full-ci] chore: bump reva to 2.48.0` (the commit message prefixed with `[full-ci] `).
 - PR body: the file from step 4.
 - Add the label `Type:Maintenance`.
 
 ```bash
 gh pr create --base main \
-  --title "[full-ci] chore: reva bump -$REVA_VERSION_NO_V" \
+  --title "[full-ci] chore: bump reva to $REVA_VERSION_NO_V" \
   --label "Type:Maintenance" \
   --body-file <body-file>
 ```

.bingo/Variables.mk

@@ -65,6 +65,12 @@ $(GOVULNCHECK): $(BINGO_DIR)/govulncheck.mod
 	@echo "(re)installing $(GOBIN)/govulncheck-v1.1.4"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=govulncheck.mod -o=$(GOBIN)/govulncheck-v1.1.4 "golang.org/x/vuln/cmd/govulncheck"
 
+GOWRAP := $(GOBIN)/gowrap-v1.4.3
+$(GOWRAP): $(BINGO_DIR)/gowrap.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/gowrap-v1.4.3"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gowrap.mod -o=$(GOBIN)/gowrap-v1.4.3 "github.com/hexdigest/gowrap/cmd/gowrap"
+
 MOCKERY := $(GOBIN)/mockery-v3.4.0
 $(MOCKERY): $(BINGO_DIR)/mockery.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.

.bingo/gowrap.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.25.8
+
+require github.com/hexdigest/gowrap v1.4.3 // cmd/gowrap

.bingo/gowrap.sum

@@ -0,0 +1,55 @@
+github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
+github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
+github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
+github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
+github.com/Masterminds/sprig/v3 v3.2.2 h1:17jRggJu518dr3QaafizSXOjKYp94wKfABxUmyxvxX8=
+github.com/Masterminds/sprig/v3 v3.2.2/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hexdigest/gowrap v1.4.3 h1:m+t8aj1pUiFQbEiE8QJg2xdYVH5DAMluLgZ9P/qEF0k=
+github.com/hexdigest/gowrap v1.4.3/go.mod h1:XWL8oQW2H3fX5ll8oT3Fduh4mt2H3cUAGQHQLMUbmG4=
+github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.2 h1:L18LIDzqlW6xN2rEkpdV8+oL/IXWJ1APd+vsdYy4Wdw=
+github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
+github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
+github.com/mitchellh/copystructure v1.1.2 h1:Th2TIvG1+6ma3e/0/bopBKohOTY7s4dA8V2q4EUcBJ0=
+github.com/mitchellh/copystructure v1.1.2/go.mod h1:EBArHfARyrSWO/+Wyr9zwEkc6XMFB9XyNgFNmRkZZU4=
+github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY70sEEpE=
+github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
+github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA=
+github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
+golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
+golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
+golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

.bingo/variables.env

@@ -24,6 +24,8 @@ GOLANGCI_LINT="${GOBIN}/golangci-lint-v1.64.6"
 
 GOVULNCHECK="${GOBIN}/govulncheck-v1.1.4"
 
+GOWRAP="${GOBIN}/gowrap-v1.4.3"
+
 MOCKERY="${GOBIN}/mockery-v3.4.0"
 
 MUTAGEN="${GOBIN}/mutagen-v0.18.1"

.codacy.yml

@@ -18,6 +18,8 @@ exclude_paths:
   - 'deployments/**'
   - "release-config.ts"
   - 'tests/acceptance/expected-failures-*.md'
+  # written by the search engine parity suite, table rows are as wide as they are
+  - 'services/search/pkg/parity/README.md'
   - 'tests/acceptance/bootstrap/**'
   - 'tests/acceptance/TestHelpers/**'
   - 'tests/acceptance/scripts/run.sh'

.gitignore

@@ -36,7 +36,6 @@ vendor-bin/**/composer.lock
 vendor-php
 
 # API acceptance tests - auto-generated files
-.php-cs-fixer.cache
 suite-logs
 tests/acceptance/filesForUpload/filesWithVirus/
 

.mise-go-version.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -euo pipefail
+
+# Purpose of this script is to parse the go.mod file to retrieve the version of
+# Go that we are using, either from a "toolchain" directive (preferred), or from
+# a "go" directive as a fallback.
+#
+# The script then outputs that version, where it will be picked up as an environment
+# variable in mise.
+
+F="./go.mod"
+
+AWK=awk
+# prefer 'gawk' over 'awk' to make sure we get GNU awk
+command -v gawk &>/dev/null && AWK=gawk
+
+[[ -e $F ]] || { echo "ERROR: failed to find $F" >&2; exit 1;}
+
+GO_VERSION=$("$AWK" '/^toolchain/ {print $2; exit} /^go / {print $2}' "$F")
+GO_VERSION=${GO_VERSION#go} # strip the potential 'go' prefix:
+echo "${GO_VERSION}"

.php-cs-fixer.dist.php

@@ -1,31 +0,0 @@
-<?php
-
-$dirToParse = 'tests/acceptance/';
-$dirIterator = new DirectoryIterator(__DIR__ . '/' . $dirToParse);
-
-$excludeDirs = [
-    'node_modules',
-    'vendor-php'
-];
-
-$finder = PhpCsFixer\Finder::create()
-    ->exclude($excludeDirs)
-    ->in(__DIR__);
-
-$ocRule = (new OC\CodingStandard\Config())->getRules();
-$config = new PhpCsFixer\Config();
-$config->setFinder($finder)
-    ->setIndent("\t")
-    ->setRules(
-        array_merge(
-            $ocRule,
-            [
-                "return_type_declaration" => [
-                    "space_before" => "none",
-                ],
-                'single_space_around_construct' => true
-            ]
-        )
-    );
-$config->setFinder($finder);
-return $config;

.woodpecker.env

@@ -1,3 +1,3 @@
 # The test runner source for UI tests
-WEB_COMMITID=52b3c79f772feae23b7e77058c89c4151087502e
+WEB_COMMITID=dffb3808702dab198065faa7a8aa16228e048385
 WEB_BRANCH=main

.woodpecker.star

@@ -8,7 +8,7 @@ docker_repo_slug = "opencloudeu/opencloud"
 
 # images
 ALPINE_GIT = "alpine/git:latest"
-APACHE_TIKA = "apache/tika:3.2.3.0-full"
+APACHE_TIKA = "apache/tika:4.0.0-full"
 CHKO_DOCKER_PUSHRM = "chko/docker-pushrm:1"
 CODACY_COVERAGE_REPORTER = "codacy/codacy-coverage-reporter:14.1.3"
 COLLABORA_CODE = "collabora/code:24.04.5.1.1"
@@ -202,14 +202,14 @@ config = {
                 "apiSearch1",
             ],
             "skip": False,
-            "nightlyOpenSearch": True,
+            "openSearch": True,
         },
         "search2": {
             "suites": [
                 "apiSearch2",
             ],
             "skip": False,
-            "nightlyOpenSearch": True,
+            "openSearch": True,
         },
         "sharingNg": {
             "suites": [
@@ -273,7 +273,7 @@ config = {
             ],
             "skip": False,
             "tikaNeeded": True,
-            "nightlyOpenSearch": True,
+            "openSearch": True,
         },
         "ocm": {
             "suites": [
@@ -331,6 +331,8 @@ config = {
                 "ANTIVIRUS_CLAMAV_SOCKET": "tcp://clamav:3310",
                 "OC_ASYNC_UPLOADS": True,
                 "OC_ADD_RUN_SERVICES": "antivirus",
+                "OC_SERVICE_ACCOUNT_ID": "service-account-id",
+                "OC_SERVICE_ACCOUNT_SECRET": "service-account-secret",
             },
         },
         "multiTenancy": {
@@ -401,12 +403,21 @@ config = {
         "4": {
             "skip": False,
             "suites": [
-                # skip user-settings due to failing pagination test. see https://github.com/opencloud-eu/opencloud/pull/3324
-                #"user-settings/",
+                "user-settings/",
                 "fileaction/",
                 "embed",
             ],
         },
+        # Runs the search-related e2e-tests against an OpenSearch search-engine.
+        "search": {
+            "skip": False,
+            "suites": [
+                "search/",
+                "file-action/favorites.feature",
+            ],
+            "tikaNeeded": True,
+            "openSearch": True,
+        },
     },
     "e2eMultiService": {
         "testSuites": {
@@ -920,30 +931,6 @@ def buildOpencloudBinaryForTesting(ctx):
     }
     return [pipeline]
 
-def vendorbinCodestyle(phpVersion):
-    return [{
-        "name": "vendorbin-codestyle",
-        "image": OC_CI_PHP % phpVersion,
-        "environment": {
-            "COMPOSER_HOME": "%s/.cache/composer" % dirs["base"],
-        },
-        "commands": [
-            "make vendor-bin-codestyle",
-        ],
-    }]
-
-def vendorbinCodesniffer(phpVersion):
-    return [{
-        "name": "vendorbin-codesniffer",
-        "image": OC_CI_PHP % phpVersion,
-        "environment": {
-            "COMPOSER_HOME": "%s/.cache/composer" % dirs["base"],
-        },
-        "commands": [
-            "make vendor-bin-codesniffer",
-        ],
-    }]
-
 def checkTestSuitesInExpectedFailures(ctx):
     return [{
         "name": "check-suites-in-expected-failures",
@@ -1031,24 +1018,22 @@ def codestyle(ctx):
 
             result = {
                 "name": name,
-                "steps": vendorbinCodestyle(phpVersion) +
-                         vendorbinCodesniffer(phpVersion) +
-                         [
-                             {
-                                 "name": "php-style",
-                                 "image": OC_CI_PHP % phpVersion,
-                                 "commands": [
-                                     "make test-php-style",
-                                 ],
-                             },
-                             {
-                                 "name": "check-env-var-annotations",
-                                 "image": OC_CI_PHP % phpVersion,
-                                 "commands": [
-                                     "make check-env-var-annotations",
-                                 ],
-                             },
-                         ],
+                "steps": [
+                    {
+                        "name": "php-style",
+                        "image": OC_CI_PHP % phpVersion,
+                        "commands": [
+                            "make test-php-style",
+                        ],
+                    },
+                    {
+                        "name": "check-env-var-annotations",
+                        "image": OC_CI_PHP % phpVersion,
+                        "commands": [
+                            "make check-env-var-annotations",
+                        ],
+                    },
+                ],
                 "depends_on": [],
                 "when": [
                     event["base"],
@@ -1280,10 +1265,8 @@ def build_api_test_workflow_matrix(ctx, storage, suite_cfg, default_cfg):
         if matrix not in workflow_metrices and base in matrices:
             workflow_metrices.append(matrix)
 
-    # Add an OpenSearch search-engine variant for nightly running search tests,
-    # or on demand when "opensearch" is specified in the PR title
-    run_open_search = ctx.build.event == "cron" or "opensearch" in ctx.build.title.lower()
-    if run_open_search and storage == "posix" and suite_cfg.get("nightlyOpenSearch", False):
+    # Add an OpenSearch search-engine variant for the search test suites.
+    if storage == "posix" and suite_cfg.get("openSearch", False):
         os_matrix = {
             "withRemotePhp": False,
             "enableWatchFs": False,
@@ -1311,7 +1294,7 @@ def localApiTestPipeline(ctx):
         "withRemotePhp": False,
         "enableWatchFs": False,
         "ldapNeeded": False,
-        "nightlyOpenSearch": False,
+        "openSearch": False,
     }
 
     if "localApiTests" in config:
@@ -1557,6 +1540,7 @@ def e2eTestPipeline(ctx):
         "reportTracing": False,
         "enableWatchFs": [False],
         "storages": ["posix"],
+        "openSearch": False,
     }
 
     extra_server_environment = {
@@ -1600,14 +1584,30 @@ def e2eTestPipeline(ctx):
         if "[decomposed]" in ctx.build.title.lower():
             params["storages"] = ["decomposed"]
 
-        e2e_args = " ".join(params["suites"]) if params["suites"] else ""
-
         if "with-tracing" in ctx.build.title.lower():
             params["reportTracing"] = True
 
+        e2e_args = " ".join(params["suites"]) if params["suites"] else ""
+
+        # OpenSearch search-engine suites run posix-only without the watchfs matrix.
+        run_with_open_search = params["openSearch"]
+        if run_with_open_search:
+            params["storages"] = ["posix"]
+            params["enableWatchFs"] = [False]
+
         for storage in params["storages"]:
             for watch_fs_enabled in params["enableWatchFs"]:
-                pipeline_name = "test-e2e-%s-%s%s" % (name, storage, "-watchfs" if watch_fs_enabled else "")
+                pipeline_name = "test-e2e-%s-%s%s%s" % (
+                    name,
+                    storage,
+                    "-watchfs" if watch_fs_enabled else "",
+                    "-opensearch" if run_with_open_search else "",
+                )
+
+                server_environment = dict(extra_server_environment)
+                if run_with_open_search:
+                    server_environment["SEARCH_ENGINE_TYPE"] = "open-search"
+                    server_environment["SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ADDRESSES"] = "http://open-search:9200"
 
                 steps = \
                     evaluateWorkflowStep() + \
@@ -1616,9 +1616,10 @@ def e2eTestPipeline(ctx):
                     restoreWebPnpmCache() + \
                     restoreBrowsersCache() + \
                     (tikaService() if params["tikaNeeded"] else []) + \
+                    (waitForOpenSearch() if run_with_open_search else []) + \
                     opencloudServer(
                         storage,
-                        extra_server_environment = extra_server_environment,
+                        extra_server_environment = server_environment,
                         tika_enabled = params["tikaNeeded"],
                         watch_fs_enabled = watch_fs_enabled,
                     ) + \
@@ -1645,6 +1646,7 @@ def e2eTestPipeline(ctx):
                 pipeline = {
                     "name": pipeline_name,
                     "steps": steps,
+                    "services": openSearchService() if run_with_open_search else [],
                     "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx) + buildWebCache(ctx)),
                     "when": e2e_trigger,
                 }
@@ -2473,6 +2475,7 @@ def opencloudServer(storage = "decomposed", depends_on = [], deploy_type = "", e
         "EVENTHISTORY_STORE": "memory",
         "OC_TRANSLATION_PATH": "%s/tests/config/translations" % dirs["base"],
         "ACTIVITYLOG_WRITE_BUFFER_DURATION": "0",  # Disable write buffer so that test expectations are met in time
+        "OC_LDAP_LOOKUP_CACHE_TTL": "0",  # disable ldap lookup cache so that test fixture change are applied right away
         # search grpc port needed for index cli tests
         "SEARCH_GRPC_ADDR": "0.0.0.0:9220",
         # debug addresses required for running services health tests
@@ -2525,10 +2528,14 @@ def opencloudServer(storage = "decomposed", depends_on = [], deploy_type = "", e
 
     if deploy_type == "cs3api_validator":
         environment["GATEWAY_GRPC_ADDR"] = "0.0.0.0:9142"  #  make gateway available to cs3api-validator
+        environment["STORAGE_USERS_HTTP_ADDR"] = "0.0.0.0:9158"  # make dataprovider available to wopi server
+        environment["STORAGE_USERS_DATA_SERVER_URL"] = "http://opencloud-server:9158/data"  # make dataprovider routable by wopi server
         environment["OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD"] = False
 
     if deploy_type == "wopi_validator":
         environment["GATEWAY_GRPC_ADDR"] = "0.0.0.0:9142"  # make gateway available to wopi server
+        environment["STORAGE_USERS_HTTP_ADDR"] = "0.0.0.0:9158"  # make dataprovider available to wopi server
+        environment["STORAGE_USERS_DATA_SERVER_URL"] = "http://opencloud-server:9158/data"  # make dataprovider routable by wopi server
         environment["APP_PROVIDER_EXTERNAL_ADDR"] = "eu.opencloud.api.app-provider"
         environment["APP_PROVIDER_DRIVER"] = "wopi"
         environment["APP_PROVIDER_WOPI_APP_NAME"] = "FakeOffice"
@@ -3437,6 +3444,9 @@ def tikaService():
     return [{
         "name": "tika",
         "image": APACHE_TIKA,
+        # tika 4 discovers its plugins relative to the image working directory,
+        # the workspace default would leave the pipes fetchers empty
+        "directory": "/opt/tika-server",
         "detach": True,
     }, {
         "name": "wait-for-tika-service",

CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## [7.5.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.5.0) - 2026-08-25
+
+### ❤️ Thanks to all contributors! ❤️
+
+@AlexAndBear, @JammingBen, @Svanvith, @aduffeck, @butonic, @fschade, @junkerderprovinz, @kulmann, @maki5, @pbleser-oc, @rhafer, @saw-jan, @schweigisito, @v-scharf
+
+### ✅ Tests
+
+- test(api): update php test dependencies [[#3335](https://github.com/opencloud-eu/opencloud/pull/3335)]
+- fix(acceptance): fix running acceptance tests against host on Linux [[#3358](https://github.com/opencloud-eu/opencloud/pull/3358)]
+- fix(graph): adding the same user as multiple members in a group (#3354) [[#3356](https://github.com/opencloud-eu/opencloud/pull/3356)]
+- test(api): fix share role update test scenario [[#3322](https://github.com/opencloud-eu/opencloud/pull/3322)]
+- test: add api tests for cross-space search index mutation [[#3320](https://github.com/opencloud-eu/opencloud/pull/3320)]
+- ci: run search acceptance tests against OpenSearch in nightly [[#3302](https://github.com/opencloud-eu/opencloud/pull/3302)]
+- api-test: notification settings and getting email notifications [[#3281](https://github.com/opencloud-eu/opencloud/pull/3281)]
+- api-test: add posixfs scan and consistency CLI tests [[#3263](https://github.com/opencloud-eu/opencloud/pull/3263)]
+- api-test: replace sleeps with WaitHelper poll for async state [[#3239](https://github.com/opencloud-eu/opencloud/pull/3239)]
+
+### 📈 Enhancement
+
+- feat(thumbnails): extend list of default resolutions [[#3386](https://github.com/opencloud-eu/opencloud/pull/3386)]
+- ability to disable grpc and/or event consumer for event history service [[#3279](https://github.com/opencloud-eu/opencloud/pull/3279)]
+- feat(graph): add LibreGraphContentType on drive [[#3355](https://github.com/opencloud-eu/opencloud/pull/3355)]
+- feat: update space template image [[#3324](https://github.com/opencloud-eu/opencloud/pull/3324)]
+- feat(web): add rclone-crypt to default apps [[#3313](https://github.com/opencloud-eu/opencloud/pull/3313)]
+- enhance: send events for adding/removing favourite items [[#3229](https://github.com/opencloud-eu/opencloud/pull/3229)]
+- allow tuning the proxies http client [[#3278](https://github.com/opencloud-eu/opencloud/pull/3278)]
+- feat(web): add yjsServerUrl config [[#3259](https://github.com/opencloud-eu/opencloud/pull/3259)]
+- feat(posixfs): #3182 add basepath option in the "posixfs scan" command [[#3235](https://github.com/opencloud-eu/opencloud/pull/3235)]
+
+### 🐛 Bug Fixes
+
+- fix(search): refresh the opensearch index after a write [[#3388](https://github.com/opencloud-eu/opencloud/pull/3388)]
+- fix(thumbnails): respect the requested height in libvips builds [[#3377](https://github.com/opencloud-eu/opencloud/pull/3377)]
+- refactor datagateway into proxy middleware [[#3289](https://github.com/opencloud-eu/opencloud/pull/3289)]
+- Only log a debug message when an item is still in processing state [[#3158](https://github.com/opencloud-eu/opencloud/pull/3158)]
+- fix(postprocessing): retry publishing events instead of killing the server [[#3347](https://github.com/opencloud-eu/opencloud/pull/3347)]
+- actually log error on exit [[#3344](https://github.com/opencloud-eu/opencloud/pull/3344)]
+- fix(activitylog): log missing parent id cache entry at debug level [[#3325](https://github.com/opencloud-eu/opencloud/pull/3325)]
+- fix restore file version for shared resource [[#3268](https://github.com/opencloud-eu/opencloud/pull/3268)]
+- Fix missing favorite flag on opensearch hits [[#3252](https://github.com/opencloud-eu/opencloud/pull/3252)]
+
+### 📚 Documentation
+
+- docs: clarify custom role bootstrap behavior [[#3366](https://github.com/opencloud-eu/opencloud/pull/3366)]
+
+### 📦️ Dependencies
+
+- [full-ci] chore: bump web to v7.4.0 [[#3399](https://github.com/opencloud-eu/opencloud/pull/3399)]
+- build(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 [[#3396](https://github.com/opencloud-eu/opencloud/pull/3396)]
+- build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 [[#3395](https://github.com/opencloud-eu/opencloud/pull/3395)]
+- build(deps): bump github.com/go-chi/chi/v5 from 5.3.1 to 5.3.2 [[#3394](https://github.com/opencloud-eu/opencloud/pull/3394)]
+- build(deps): bump github.com/grpc-ecosystem/grpc-gateway/v2 from 2.29.0 to 2.30.0 [[#3380](https://github.com/opencloud-eu/opencloud/pull/3380)]
+- build(deps): bump golang.org/x/image from 0.44.0 to 0.45.0 [[#3381](https://github.com/opencloud-eu/opencloud/pull/3381)]
+- build(deps): bump github.com/beevik/etree from 1.7.0 to 1.7.1 [[#3382](https://github.com/opencloud-eu/opencloud/pull/3382)]
+- build(deps): bump github.com/nats-io/nats-server/v2 from 2.14.4 to 2.14.5 [[#3357](https://github.com/opencloud-eu/opencloud/pull/3357)]
+- build(deps): bump go.opentelemetry.io/contrib/zpages from 0.69.0 to 0.70.0 [[#3360](https://github.com/opencloud-eu/opencloud/pull/3360)]
+- build(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 [[#3359](https://github.com/opencloud-eu/opencloud/pull/3359)]
+- chore: bump reva to latest main [[#3329](https://github.com/opencloud-eu/opencloud/pull/3329)]
+- build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 [[#3341](https://github.com/opencloud-eu/opencloud/pull/3341)]
+- build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 [[#3342](https://github.com/opencloud-eu/opencloud/pull/3342)]
+- build(deps): bump github.com/onsi/ginkgo/v2 from 2.32.0 to 2.32.1 [[#3340](https://github.com/opencloud-eu/opencloud/pull/3340)]
+- build(deps): bump github.com/testcontainers/testcontainers-go/modules/opensearch from 0.43.0 to 0.44.0 [[#3303](https://github.com/opencloud-eu/opencloud/pull/3303)]
+- build(deps): bump github.com/opencloud-eu/libre-graph-api-go [[#3326](https://github.com/opencloud-eu/opencloud/pull/3326)]
+- build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.44.0 to 1.45.0 [[#3306](https://github.com/opencloud-eu/opencloud/pull/3306)]
+- build(deps): bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp from 0.69.0 to 0.70.0 [[#3305](https://github.com/opencloud-eu/opencloud/pull/3305)]
+- build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 [[#3280](https://github.com/opencloud-eu/opencloud/pull/3280)]
+- build(deps): bump github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0 [[#3250](https://github.com/opencloud-eu/opencloud/pull/3250)]
+- build(deps): bump github.com/kovidgoyal/imaging from 1.8.22 to 1.8.23 [[#3135](https://github.com/opencloud-eu/opencloud/pull/3135)]
+- build(deps): bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.45.0 [[#3266](https://github.com/opencloud-eu/opencloud/pull/3266)]
+
 ## [7.4.0](https://github.com/opencloud-eu/opencloud/releases/tag/v7.4.0) - 2026-08-03
 
 ### ❤️ Thanks to all contributors! ❤️

Makefile

@@ -68,11 +68,8 @@ OC_MODULES = \
 	protogen
 
 # bin file definitions
-PHP_CS_FIXER=php -d zend.enable_gc=0 vendor-bin/opencloud-codestyle/vendor/bin/php-cs-fixer
-PHP_CODESNIFFER=vendor-bin/php_codesniffer/vendor/bin/phpcs
-PHP_CODEBEAUTIFIER=vendor-bin/php_codesniffer/vendor/bin/phpcbf
-PHAN=php -d zend.enable_gc=0 vendor-bin/phan/vendor/bin/phan
-PHPSTAN=php -d zend.enable_gc=0 vendor-bin/phpstan/vendor/bin/phpstan
+PHP_CODESNIFFER=vendor-bin/opencloud-codestyle/vendor/bin/phpcs
+PHP_CODEBEAUTIFIER=vendor-bin/opencloud-codestyle/vendor/bin/phpcbf
 
 ifneq (, $(shell command -v go 2> /dev/null)) # suppress `command not found warnings` for non go targets in CI
 include .bingo/Variables.mk
@@ -319,30 +316,15 @@ ci-format: $(BUILDIFIER)
 	$(BUILDIFIER) --mode=fix .woodpecker.star
 
 .PHONY: test-php-style
-test-php-style: vendor-bin/opencloud-codestyle/vendor vendor-bin/php_codesniffer/vendor
-	$(PHP_CS_FIXER) fix -v --diff --allow-risky yes --dry-run
+test-php-style: vendor-bin/opencloud-codestyle/vendor
 	$(PHP_CODESNIFFER) --cache --runtime-set ignore_warnings_on_exit --standard=phpcs.xml tests/acceptance tests/acceptance/TestHelpers
 
 .PHONY: test-php-style-fix
 test-php-style-fix: vendor-bin/opencloud-codestyle/vendor
-	$(PHP_CS_FIXER) fix -v --diff --allow-risky yes
 	$(PHP_CODEBEAUTIFIER) --cache --runtime-set ignore_warnings_on_exit --standard=phpcs.xml tests/acceptance
 
-.PHONY: vendor-bin-codestyle
-vendor-bin-codestyle: vendor-bin/opencloud-codestyle/vendor
-
-.PHONY: vendor-bin-codesniffer
-vendor-bin-codesniffer: vendor-bin/php_codesniffer/vendor
-
 vendor-bin/opencloud-codestyle/vendor: vendor/bamarni/composer-bin-plugin vendor-bin/opencloud-codestyle/composer.lock
 	composer bin opencloud-codestyle install --no-progress
 
 vendor-bin/opencloud-codestyle/composer.lock: vendor-bin/opencloud-codestyle/composer.json
 	@echo opencloud-codestyle composer.lock is not up to date.
-
-vendor-bin/php_codesniffer/vendor: vendor/bamarni/composer-bin-plugin vendor-bin/php_codesniffer/composer.lock
-	composer bin php_codesniffer install --no-progress
-
-vendor-bin/php_codesniffer/composer.lock: vendor-bin/php_codesniffer/composer.json
-	@echo php_codesniffer composer.lock is not up to date.
-

changelog/CHANGELOG.tmpl

@@ -1,62 +0,0 @@
-# Table of Contents
-
-{{ range . -}}
-  * [Changelog for {{ .Version }}](#changelog-for-{{ .Version | replace "." ""}}-{{ .Date | lower -}})
-{{ end -}}
-{{ $allVersions := . }}
-{{- range $index, $changes := . }}{{ with $changes -}}
-{{ if gt (len $allVersions) 1 }}
-# Changelog for [{{ .Version }}] ({{ .Date }})
-
-The following sections list the changes for {{ .Version}}.
-
-{{/* creating version compare links */ -}}
-{{ $next := add1 $index -}}
-{{ if ne (len $allVersions) $next -}}
-{{ $previousVersion := (index $allVersions $next).Version -}}
-{{ if eq .Version "unreleased" -}}
-[{{ .Version}}]: https://github.com/opencloud-eu/opencloud/compare/v{{ $previousVersion }}...master
-
-{{ else -}}
-[{{ .Version}}]: https://github.com/opencloud-eu/opencloud/compare/v{{ $previousVersion }}...v{{ .Version}}
-
-{{ end -}}
-{{ end -}}
-
-{{- /* last version managed by calens, end of the loop */ -}}
-{{ if eq .Version "0.1.0" -}}
-[{{ .Version }}]: https://github.com/opencloud-eu/opencloud/compare/94f19e653e30cdf16dcf23dbaf36c6d753d37ae9...v{{ .Version }}
-
-{{ end -}}
-{{ else -}}
-# Changes in {{ .Version}}
-
-{{ end -}}
-
-## Summary
-{{ range $entry := .Entries }}{{ with $entry }}
-* {{ .Type }} - {{ .Title }}: [#{{ .PrimaryID }}]({{ .PrimaryURL }})
-{{- end }}{{ end }}
-
-## Details
-{{ range $entry := .Entries }}{{ with $entry }}
-* {{ .Type }} - {{ .Title }}: [#{{ .PrimaryID }}]({{ .PrimaryURL }})
-{{ range $par := .Paragraphs -}}
-{{/* Workaround for keeping lists inside of changelog items well formatted */ -}}
-{{ if hasPrefix "*" $par }}
-  {{ $par | replace " *" "\n  *" }}
-{{- else }}
-   {{ wrapIndent $par 80 3 -}}
-{{ end }}
-{{ end -}}
-{{ range $url := .IssueURLs }}
-   {{ $url -}}
-{{ end -}}
-{{ range $url := .PRURLs }}
-   {{ $url -}}
-{{ end -}}
-{{ range $url := .OtherURLs }}
-   {{ $url -}}
-{{ end }}
-{{ end }}{{ end -}}
-{{ end }}{{ end -}}

changelog/README.md

@@ -1,16 +0,0 @@
-# Changelog
-
-We are using [calens](https://github.com/restic/calens) to properly generate a
-changelog before we are tagging a new release. To get an idea how this could
-look like <https://github.com/restic/restic/tree/master/changelog> would be the
-best reference.
-
-## Create changelog items
-
-Create a file according to the template for each changelog in the unreleased folder. 
-The following change types are possible: 
-- Bugfix (general Bugfix)
-- Enhancement (new feature)
-- Change (breaking change) 
-- Security (security related issues)
-

changelog/TEMPLATE

@@ -1,15 +0,0 @@
-Bugfix: Fix behavior for foobar (in present tense)
-
-We've fixed the behavior for foobar, a long-standing annoyance for users. The
-text should be wrapped at 80 characters length.
-
-The text in the paragraphs is written in past tense. The last section is a list
-of issue URLs, PR URLs and other URLs. The first issue ID (or the first PR ID,
-in case there aren't any issue links) is used as the primary ID.
-
-https://github.com/opencloud-eu/opencloud/pull/55555
-https://github.com/opencloud-eu/opencloud/issues/1234
-
-Note: Possible keywords are Bugfixes (for bug fixes), Enhancement (for new features),
-Change (for breaking changes), Security (for security related topics)
-

changelog/changelog-csv.tmpl

@@ -1,8 +0,0 @@
-## Release, Date, Type, Title, Primary ID, Primary URL
-{{ range . -}}
-{{ $v := .Version -}}
-{{ $d := .Date -}}
-{{ range $entry := .Entries -}}
-{{ $v }},{{ $d }},{{ .Type }},'{{ .Title }}',{{ .PrimaryID }},{{ .PrimaryURL }}
-{{ end -}}
-{{ end -}}

changelog/unreleased/add-ocm-wayf-configuration.md

@@ -1,7 +0,0 @@
-Enhancement: Add WAYF configuration for reva OCM service
-
-Add WAYF configuration support for the Reva OCM service,
-enabling federation discovery functionality for Open Cloud Mesh.
-This includes configuration for federations file storage and invite accept dialog URL.
-
-https://github.com/opencloud-eu/opencloud/pull/1714

changelog/unreleased/fix-notification-email-double-escape.md

@@ -1,9 +0,0 @@
-Bugfix: Don't re-escape notification email vars for each recipient
-
-When a notification went to several recipients in one call (e.g. a group
-invite to a space), each recipient past the first got subjects and bodies
-with one extra layer of HTML escaping. escapeStringMap mutated its input
-map, and the recipient loop reused the same map across iterations. It now
-returns a new map.
-
-https://github.com/opencloud-eu/opencloud/issues/2804

changelog/unreleased/fix-postprocessing-fatal-on-publish-error.md

@@ -0,0 +1,21 @@
+Bugfix: Retry publishing postprocessing events before giving up
+
+A single transient failure while publishing an event to the event system took
+the whole server down. The postprocessing service treated every publish error
+as fatal and called log.Fatal, which exits the process and so also stopped all
+the other services running in the same binary. A burst of uploads was enough to
+run into one nats publish timeout and lose the server with it.
+
+Publishing is now retried using the same exponential backoff that is already
+used for failed postprocessing steps. Between the attempts the source event is
+marked as in progress and the backoff is capped at half the ack wait, so the
+event should not be redelivered to another worker while we are still retrying.
+The number of retries is configurable via POSTPROCESSING_PUBLISH_MAX_RETRIES.
+
+Should all attempts fail, the source event is no longer acknowledged. Before,
+the event was acknowledged even though its successor was never published, so
+the upload was left half processed in the store and did not recover on restart.
+
+https://github.com/opencloud-eu/opencloud/issues/3271
+https://github.com/opencloud-eu/opencloud/issues/2232
+https://github.com/opencloud-eu/opencloud/issues/2422

composer.json

@@ -2,7 +2,7 @@
   "name": "opencloud-eu/opencloud",
   "config": {
     "platform": {
-      "php": "8.3"
+      "php": "8.4"
     },
     "vendor-dir": "./vendor-php",
     "allow-plugins": {
@@ -11,11 +11,12 @@
   },
   "require-dev": {
     "ext-simplexml": "*",
-    "bamarni/composer-bin-plugin": "^1.8"
+    "bamarni/composer-bin-plugin": "^1.9"
   },
   "extra": {
     "bamarni-bin": {
-      "bin-links": false
+      "bin-links": false,
+      "forward-command": false
     }
   }
 }

docs/adr/0005-unified-search-index-mapping.md

@@ -0,0 +1,226 @@
+---
+title: "5. Unified Search Index Mapping"
+---
+
+* Status: accepted
+* Deciders: @aduffeck, @butonic, @dschmidt, @fschade
+* Date: 2026-04-23, accepted and updated to the implemented state 2026-08-31
+
+Reference: implemented by https://github.com/opencloud-eu/opencloud/pull/3345 (reflection-based mapping, search siblings, shared query lowering) and https://github.com/opencloud-eu/opencloud/pull/3197 (schema versioning and startup checks). https://github.com/opencloud-eu/opencloud/pull/2659 was the original proof-of-concept.
+
+## Context and Problem Statement
+
+This section describes the state at decision time (April 2026); the implementation has since resolved the problems listed here.
+
+The search service supports two backends, bleve (embedded) and
+OpenSearch (external). Each backend currently carries its own,
+independently maintained description of the index layout:
+
+- The bleve backend hand-builds a document mapping that explicitly
+  declares only Name, Tags, Favorites and Content. Everything else,
+  including the entire facet block (audio, image, photo, location),
+  is left to bleve's dynamic mapping.
+- The OpenSearch backend ships a static JSON template that covers a
+  similar but not identical subset, plus a few OpenSearch-specific
+  primitives (path_hierarchy analyzer, wildcard MimeType). It does
+  not list the facet sub-fields either; they are produced by
+  OpenSearch's dynamic templating at first write.
+- The graph DriveItem assembly path keeps its own private copy of a
+  reflection-based walker to turn CS3 ArbitraryMetadata back into
+  typed libregraph facets, parallel to the search service's
+  reflection helpers but maintained separately.
+- The bleve KQL compiler keeps a hand-maintained set of field names
+  whose query values need to be pre-lowercased, with a comment that
+  literally says "Keep in sync with index.go".
+
+The current implementation has three concrete problems:
+
+1. **The two backends do not behave the same.** Both rely on their
+   own implicit defaults for fields that are not explicitly
+   declared. The inferred shapes differ: bleve produces keyword-
+   analyzed text, OpenSearch produces a `text + keyword` multi-field
+   with auto-detected dates. Nobody has written down which behavior
+   is the intended one. Two concrete instances surfaced while building
+   #2659:
+   - **mtime** is stored as an RFC3339 string. OpenSearch's dynamic
+     mapping auto-detects it as `date`; bleve leaves it `keyword`. So
+     `mtime:>...` is a chronological range on OpenSearch but a
+     lexicographic string compare on bleve.
+   - **name/tags**: bleve indexes a single lowercase token (exact or
+     wildcard match only); OpenSearch word-tokenizes, so a bare
+     `name:report` matches "My Report.txt" on OpenSearch but not on
+     bleve.
+2. **Drift risk.** The OpenSearch JSON template is a subset of what
+   actually gets indexed. Even where it overlaps with the bleve
+   mapping it diverges on analyzer choices. Because the facet
+   fields were not reachable from user queries at the time (no dot
+   syntax in the KQL compilers, no facet exposure on the hit and
+   REPORT paths), the divergence has been invisible, but it would
+   surface the moment the first working cross-backend facet query
+   landed.
+3. **Per-facet cost.** Adding a new facet (motionPhoto, etc.)
+   requires coordinated edits across the proto message, both backend
+   mappings, the bleve hit converters, the OpenSearch convert
+   closures, the search service's metadata persistence, the graph
+   DriveItem assembly, and the KQL compiler's lowercasing set. Most
+   of those edits are boilerplate following a copy-paste pattern.
+   Adding a genuinely new index capability (geopoint, wildcard,
+   ...) means wiring it in at every one of those sites, and there
+   is no single place to hook a type-specific adapter.
+
+### A note on backwards compatibility
+
+That the facet fields were unreachable at decision time has a
+useful corollary for this ADR: **changing the indexed shape of the
+facet fields cannot break any existing client of the search
+service**, because no client could successfully read them. The behavior changes
+discussed below are therefore additive in a literal sense; nothing
+that works today stops working as a result.
+
+## Decision Drivers
+
+* **Predictable OpenCloud API behavior independent of backend.**
+  Consumers of the search service should be able to rely on the
+  documented behavior of the API, not on which backend happens to
+  be configured. Today the same query can give different results
+  depending on whether bleve or OpenSearch is wired in (bleve's
+  dynamic default is `keyword`, exact match; OpenSearch's dynamic
+  default is `text + keyword`, also matches sub-tokens of a
+  string). That is backend-implementation leakage, and trying to
+  keep the two implicit defaults synchronized has not worked.
+* Single source of truth for the indexed schema, so the two backends
+  cannot drift silently again.
+* Reduce the per-facet cost so future facets (motionPhoto and
+  whatever comes next) can be added with minimal boilerplate.
+* Establish a single place to hook index-type-specific behavior, so
+  a new capability needs to be implemented at most once per backend
+  and then becomes available for any field uniformly.
+* A one-time reindex is an acceptable upgrade path. Both bleve and
+  OpenSearch store their mapping alongside the data; existing
+  indexes keep serving queries against their stored shape without
+  any automatic reshaping. Benefiting from the new behavior is done
+  by creating a fresh index and re-ingesting, which is the normal
+  reindex flow, rather than by inventing migration tooling.
+
+## Considered Options
+
+### Option 1: Do nothing, keep relying on implicit backend defaults
+
+Accept that bleve and OpenSearch each fall back to their own
+dynamic-mapping defaults for whatever is not explicitly declared,
+and treat the observable search behavior of OpenCloud as "whatever
+the configured backend happens to do". Adding a facet stays a
+copy-paste coordination across half a dozen sites; the existing
+divergence between bleve (keyword) and OpenSearch (`text + keyword`
+multi-field plus auto-date detection) stays silently in place
+until a working query actually reaches the diverging field and
+returns different answers on the two backends.
+
+Low upfront work, but it makes the OpenCloud API behavior a
+function of the backend rather than a contract, and it keeps the
+per-facet boilerplate cost for every new field.
+
+### Option 2: Generate one backend's mapping from the other
+
+Treat one backend as canonical (likely bleve, because Go types) and
+derive the other. Partial answer; it still does not help the reader
+path or the graph walker, and still leaves per-facet boilerplate in
+non-mapping code.
+
+### Option 3: A struct-driven mapping (chosen)
+
+Let the Go struct that represents an indexed document, together
+with a small overrides map, be the single source of truth. A
+reflection-based helper walks the struct via json tags and emits
+each backend's index mapping. The same definition drives the
+write-time path, the hit-decoding path, and the query compiler's
+case-folding rules. Any future field follows one declaration in
+one place and falls through the whole pipeline consistently.
+
+## Decision Outcome
+
+Adopt Option 3. The Go struct that represents an indexed document,
+together with a small overrides map, becomes the single source of
+truth for the search index. The bleve and OpenSearch index
+mappings, the write-time conversion, the hit-decoding path, and
+the query compiler's case-folding rules are all derived from that
+same definition. Drift between backends is prevented by
+construction, because there is no second place to edit.
+
+The overrides surface stays small. Each entry declares one of a
+handful of things per field: a semantic type for fields whose
+intent cannot be inferred from the Go type (for example a path-
+analyzed field, a fulltext field, a geopoint field), or search-
+behavior flags (case-insensitivity, word breaking, inclusion in
+the catch-all field). Any field that needs something beyond the
+inferred defaults gets one line in the overrides map and that one
+line flows through every derived piece. Overrides are validated at
+startup so a typo fails loudly instead of silently disabling a
+setting.
+
+A practical consequence of having one place to hook things: when a
+new capability is needed (a geopoint representation, a sibling
+field for a different aggregation behavior, a different analyzer
+for a class of fields, ...) it can be implemented once per backend
+in the central pipeline. After that, turning the capability on for
+a specific field is a single override entry, and both backends
+adopt it the same way. This ADR does not decide which capabilities
+to add, only that they will land in this uniform shape rather than
+through coordinated per-site edits.
+
+### Facet values are indexed as case-preserving keywords
+
+All facet sub-fields, meaning any leaf inside `audio`, `photo`, `image`, `location` and the facets that followed (`video`, `motionPhoto`, `livePhoto`), keep a case-preserving keyword as their stored base field on both backends. The raw value the extractor saw, or the CS3 ArbitraryMetadata string, is what lands in the index, and it is what returning, sorting and aggregations read.
+
+This is the single intended semantic for facets across bleve and
+OpenSearch, and it is driven by what aggregations need.
+Aggregation buckets ("group all files by `audio.artist`", "list
+distinct `photo.cameraMake`") return bucket keys drawn from the
+indexed terms. If the indexing analyzer lowercases (OpenSearch's
+default `text + keyword` multi-field against the text leg, or a
+`lowercaseKeyword`-style analyzer), the buckets come back lower-
+cased: a distinct-artists query would answer `motörhead` and
+`queen` instead of the original display casings, and two tag
+writers using `Motörhead` versus `MOTÖRHEAD` would collapse into a
+single bucket labelled `motörhead`. For a metadata display use
+case (thumbnails, facet filters in the UI, distinct lists) that
+behavior is not what we want.
+
+Searching is layered on top as exactly the strict superset the proposal reserved for later, and it shipped with the implementation: every keyword field additionally gets search-only sibling fields derived from the same definition, a `_lowercase` keyword sibling (doc values disabled; serves wildcards and `=` whole-value matches) and a `_words` text sibling (`words` analyzer: dots to spaces, unicode tokenization, lowercasing, no stemming; serves token and phrase matches). Case-insensitive, word-broken search is the default for every keyword field including facets; fields opt out per override where that is wrong: opaque ids (`ID`, `RootID`, `ParentID`, `Favorites`, `livePhoto.contentId`), the POSIX `Path`, the normalized `MimeType`, and `Content`, which is a fulltext field of its own. Aggregation buckets keep their display casing because they read the base field, never the siblings.
+
+The query side derives from the same source: the shared lowering pass resolves field names case-insensitively, folds values and routes each match to the right sibling (wildcards to `_lowercase`, tokens and phrases to `_words`, `=` as a whole-value term on `_lowercase`), and both backend compilers consume that one decision. The engine parity suite pins the resulting behavior against bleve and OpenSearch, so a divergence fails CI instead of surfacing in production. The case-sensitivity alignment started in #2633 is completed by deriving both sides from the same source.
+
+### Schema versioning and upgrades
+
+Index names carry a schema version derived from the single `search.SchemaVersion` constant (`opencloud-resource-v4`, `bleve-v4`). On startup the service classifies the stored mapping against the code: additive changes (new fields, unchanged analyzers) are reconciled in place without a version bump, breaking changes make the service refuse to start and name the reindex steps. The upgrade path is a plain reindex (`opencloud search index --all-spaces`) into the new versioned index; older indexes stay untouched and can be deleted afterwards (services/search/MIGRATION.md). Golden mapping tests on both backends pin the rendered mappings and reuse the same classifier to tell a contributor whether a change needs only a golden regeneration or a version bump.
+
+### Known trade-off
+
+The write-time pipeline produces the document as a generic map via
+a json round-trip. The OpenSearch write path already does the
+equivalent today via the same json-based conversion helper, so
+that path is unchanged. The bleve write path, which previously
+handed the struct directly to bleve's reflective indexer, now goes
+through the same map-producing step and pays roughly the same
+cost. On hot paths (initial indexing of a large space) this is
+measurable but not significant; if it ever matters, a direct
+reflection walker can replace the json round-trip without changing
+any call site.
+
+### Follow-ups out of scope for this ADR
+
+- **WebDAV REPORT facet exposure.** The current webdav search
+  endpoint renders none of the facet fields back to the client.
+  This is a missing feature, not a regression of the proposal;
+  its natural resolution is to let the graph-search endpoint
+  (proposed in #3211) take over once graph search lands.
+- **Graph search hit conversion.** Graph search (#3211) translates
+  proto hits back into libregraph DriveItems with the same
+  facet-copy helper the search service uses internally.
+- **reva's PROPFIND facet listing** uses its own hand-maintained
+  per-facet key lists. reva deliberately does not depend on the
+  libregraph Go types, so unifying those key sets is a reva-side
+  decision tracked separately.
+- **Write-path performance.** The json round-trip in the bleve
+  write path is an optional optimisation target with no call-site
+  impact when it lands.

go.mod

@@ -1,17 +1,17 @@
 module github.com/opencloud-eu/opencloud
 
-go 1.25.8
+go 1.25.9
 
 require (
 	dario.cat/mergo v1.0.2
 	github.com/CiscoM31/godata v1.0.11
-	github.com/KimMachineGun/automemlimit v0.7.5
+	github.com/KimMachineGun/automemlimit v1.0.0
 	github.com/Masterminds/semver v1.5.0
 	github.com/MicahParks/keyfunc/v2 v2.1.0
 	github.com/Nerzal/gocloak/v13 v13.9.0
 	github.com/bbalet/stopwords v1.0.0
-	github.com/beevik/etree v1.7.0
-	github.com/blevesearch/bleve/v2 v2.6.0
+	github.com/beevik/etree v1.7.1
+	github.com/blevesearch/bleve/v2 v2.6.1
 	github.com/cenkalti/backoff v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.20.0
 	github.com/cs3org/go-cs3apis v0.0.0-20260424072047-8d9ef7076ae9
@@ -20,9 +20,8 @@ require (
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
 	github.com/gabriel-vasile/mimetype v1.4.15
 	github.com/ggwhite/go-masker v1.1.0
-	github.com/go-chi/chi/v5 v5.3.1
+	github.com/go-chi/chi/v5 v5.3.2
 	github.com/go-chi/render v1.0.3
-	github.com/go-jose/go-jose/v3 v3.0.5
 	github.com/go-ldap/ldap/v3 v3.4.14
 	github.com/go-ldap/ldif v0.0.0-20200320164324-fd88d9b715b3
 	github.com/go-micro/plugins/v4/client/grpc v1.2.1
@@ -43,7 +42,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/gookit/config/v2 v2.2.9
 	github.com/gorilla/mux v1.8.1
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0
 	github.com/invopop/validation v0.8.0
 	github.com/jellydator/ttlcache/v2 v2.11.1
 	github.com/jellydator/ttlcache/v3 v3.4.1
@@ -55,33 +54,34 @@ require (
 	github.com/libregraph/lico v0.67.0
 	github.com/mna/pigeon v1.3.0
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
-	github.com/nats-io/nats-server/v2 v2.14.4
-	github.com/nats-io/nats.go v1.52.0
+	github.com/nats-io/nats-server/v2 v2.14.5
+	github.com/nats-io/nats.go v1.53.1
 	github.com/olekukonko/tablewriter v1.1.4
 	github.com/onsi/ginkgo v1.16.5
-	github.com/onsi/ginkgo/v2 v2.32.0
+	github.com/onsi/ginkgo/v2 v2.32.1
 	github.com/onsi/gomega v1.42.1
-	github.com/open-policy-agent/opa v1.19.0
+	github.com/open-policy-agent/opa v1.19.1
 	github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89
-	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260818063016-69f82a7dde55
-	github.com/opencloud-eu/reva/v2 v2.48.1-0.20260811071808-9bf68d2ccd96
-	github.com/opensearch-project/opensearch-go/v4 v4.6.0
+	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260902170011-45af3945a067
+	github.com/opencloud-eu/reva/v2 v2.49.1-0.20260903122659-26f34ec05774
+	github.com/opensearch-project/opensearch-go/v4 v4.7.3
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/xattr v0.4.12
 	github.com/prometheus/client_golang v1.24.1
+	github.com/prometheus/client_model v0.6.2
 	github.com/r3labs/sse/v2 v2.10.0
 	github.com/riandyrn/otelchi v0.12.3
 	github.com/rogpeppe/go-internal v1.16.0
 	github.com/rs/cors v1.11.1
 	github.com/rs/zerolog v1.35.1
 	github.com/shamaton/msgpack/v2 v2.4.1
-	github.com/sirupsen/logrus v1.9.4
+	github.com/sirupsen/logrus v1.10.1
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 	github.com/test-go/testify v1.1.4
 	github.com/testcontainers/testcontainers-go v0.44.0
 	github.com/testcontainers/testcontainers-go/modules/opensearch v0.44.0
@@ -94,25 +94,25 @@ require (
 	github.com/xhit/go-simple-mail/v2 v2.16.0
 	go-micro.dev/v4 v4.11.0
 	go.etcd.io/bbolt v1.5.0
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0
-	go.opentelemetry.io/contrib/zpages v0.69.0
-	go.opentelemetry.io/otel v1.45.0
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0
+	go.opentelemetry.io/contrib/zpages v0.71.0
+	go.opentelemetry.io/otel v1.46.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0
-	go.opentelemetry.io/otel/sdk v1.45.0
-	go.opentelemetry.io/otel/trace v1.45.0
-	golang.org/x/crypto v0.54.0
+	go.opentelemetry.io/otel/sdk v1.46.0
+	go.opentelemetry.io/otel/trace v1.46.0
+	golang.org/x/crypto v0.55.0
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
-	golang.org/x/image v0.44.0
-	golang.org/x/net v0.57.0
+	golang.org/x/image v0.45.0
+	golang.org/x/net v0.58.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/term v0.45.0
-	golang.org/x/text v0.40.0
+	golang.org/x/text v0.41.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d
-	google.golang.org/grpc v1.83.0
-	google.golang.org/protobuf v1.36.11
+	google.golang.org/grpc v1.83.2
+	google.golang.org/protobuf v1.36.12
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
@@ -141,13 +141,13 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bitly/go-simplejson v0.5.0 // indirect
 	github.com/bits-and-blooms/bitset v1.24.2 // indirect
-	github.com/blevesearch/bleve_index_api v1.3.11 // indirect
-	github.com/blevesearch/geo v0.2.5 // indirect
-	github.com/blevesearch/go-faiss v1.1.0 // indirect
+	github.com/blevesearch/bleve_index_api v1.4.1 // indirect
+	github.com/blevesearch/geo v0.2.6 // indirect
+	github.com/blevesearch/go-faiss v1.1.5 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
 	github.com/blevesearch/mmap-go v1.2.0 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.4.7 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.4.10 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
@@ -158,7 +158,7 @@ require (
 	github.com/blevesearch/zapx/v14 v14.4.3 // indirect
 	github.com/blevesearch/zapx/v15 v15.4.3 // indirect
 	github.com/blevesearch/zapx/v16 v16.3.4 // indirect
-	github.com/blevesearch/zapx/v17 v17.1.2 // indirect
+	github.com/blevesearch/zapx/v17 v17.2.3 // indirect
 	github.com/bluele/gcache v0.0.2 // indirect
 	github.com/bombsimon/logrusr/v3 v3.1.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
@@ -207,6 +207,7 @@ require (
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
 	github.com/go-git/go-git/v5 v5.19.2 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
@@ -255,7 +256,7 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/juliangruber/go-intersect v1.1.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.19.1 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/kovidgoyal/go-parallel v1.1.1 // indirect
@@ -323,8 +324,6 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/pquerna/cachecontrol v0.2.0 // indirect
-	github.com/prometheus/alertmanager v0.33.1 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/prometheus/statsd_exporter v0.22.8 // indirect
@@ -378,16 +377,16 @@ require (
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
-	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.46.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.37.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/mod v0.38.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.48.0 // indirect
 	google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260803160001-6ac0973c030d // indirect
 	gopkg.in/cenkalti/backoff.v1 v1.1.0 // indirect

go.sum

@@ -70,8 +70,8 @@ github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/CiscoM31/godata v1.0.11 h1:w7y8twuW02LdH6mak3/GJ5i0GrCv2IoZUJVqa/g5Yeo=
 github.com/CiscoM31/godata v1.0.11/go.mod h1:ZMiT6JuD3Rm83HEtiTx4JEChsd25YCrxchKGag/sdTc=
-github.com/KimMachineGun/automemlimit v0.7.5 h1:RkbaC0MwhjL1ZuBKunGDjE/ggwAX43DwZrJqVwyveTk=
-github.com/KimMachineGun/automemlimit v0.7.5/go.mod h1:QZxpHaGOQoYvFhv/r4u3U0JTC2ZcOwbSr11UZF46UBM=
+github.com/KimMachineGun/automemlimit v1.0.0 h1:+MqlvDE/pkJNjk1rU+O14QsH8k10nJAD0frB0lsxyvw=
+github.com/KimMachineGun/automemlimit v1.0.0/go.mod h1:n+BSXxQWDFS1DKh67Rqo0lgTsowsg6x65ak5uyngML0=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
@@ -132,8 +132,8 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:W
 github.com/aws/aws-sdk-go v1.37.27/go.mod h1:hcU610XS61/+aQV88ixoOzUoG7v3b31pl2zKMmprdro=
 github.com/bbalet/stopwords v1.0.0 h1:0TnGycCtY0zZi4ltKoOGRFIlZHv0WqpoIGUsObjztfo=
 github.com/bbalet/stopwords v1.0.0/go.mod h1:sAWrQoDMfqARGIn4s6dp7OW7ISrshUD8IP2q3KoqPjc=
-github.com/beevik/etree v1.7.0 h1:xjBk9O4p4x7D1YajePjfLzdaFC4/uYUENA7P0pv6gXA=
-github.com/beevik/etree v1.7.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
+github.com/beevik/etree v1.7.1 h1:xBlSFAjlMfZkrCNKCEdZ2MSN9pfQYeRBaISDnAVi4Ek=
+github.com/beevik/etree v1.7.1/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -146,22 +146,22 @@ github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngE
 github.com/bits-and-blooms/bitset v1.24.2 h1:M7/NzVbsytmtfHbumG+K2bremQPMJuqv1JD3vOaFxp0=
 github.com/bits-and-blooms/bitset v1.24.2/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
-github.com/blevesearch/bleve/v2 v2.6.0 h1:Cyd3dd4q5tCbOV8MnKUVRUDYMHOir9xn12NZzXVSEd4=
-github.com/blevesearch/bleve/v2 v2.6.0/go.mod h1:gLmI8lWgHgrIYf7UpUX7JISI1CaqC6VScu46mHThuAY=
-github.com/blevesearch/bleve_index_api v1.3.11 h1:x29vbV8OjWfLcrDVd7Lr1q+BkLNS0JWNEig0MCVnKH4=
-github.com/blevesearch/bleve_index_api v1.3.11/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
-github.com/blevesearch/geo v0.2.5 h1:yJg9FX1oRwLnjXSXF+ECHfXFTF4diF02Ca/qUGVjJhE=
-github.com/blevesearch/geo v0.2.5/go.mod h1:Jhq7WE2K6mJTx1xS44M2pUO6Io+wjCSHh1+co3YOgH4=
-github.com/blevesearch/go-faiss v1.1.0 h1:xM7Jc0ZUCv5lssG9Ohj3Jv0SdTpxcUABU1dDt9XVsc4=
-github.com/blevesearch/go-faiss v1.1.0/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
+github.com/blevesearch/bleve/v2 v2.6.1 h1:47vLskRTqxvQEtxVPYHjf5KpOgzD2msslXFjvUQCgWQ=
+github.com/blevesearch/bleve/v2 v2.6.1/go.mod h1:Dvvx6ZoEBTOj6RSzfk0lEz0wce/qhe2yOUubXeuzd2c=
+github.com/blevesearch/bleve_index_api v1.4.1 h1:CYIyecFlI+/RYjzUm+NmDjYbSvk870Bb7f+Vl4b12q8=
+github.com/blevesearch/bleve_index_api v1.4.1/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
+github.com/blevesearch/geo v0.2.6 h1:7K1oyQKYlauC+mJuo2AfNPyjN/4mihEoJMfyClVH1Mo=
+github.com/blevesearch/geo v0.2.6/go.mod h1:6qzVUiB4BK47QkSZcRqiXEP2W3EeXuzM5XFTF8AdZ8A=
+github.com/blevesearch/go-faiss v1.1.5 h1:/IU5lkOahH9Ghfk9n3F6N0XD7PYVXZJWmNDc9TtXuco=
+github.com/blevesearch/go-faiss v1.1.5/go.mod h1:w3W9AiWsFRGVaMG+/cmJi7iHEAuGyC6blsgO1EzCK/M=
 github.com/blevesearch/go-porterstemmer v1.0.3 h1:GtmsqID0aZdCSNiY8SkuPJ12pD4jI+DdXTAn4YRcHCo=
 github.com/blevesearch/go-porterstemmer v1.0.3/go.mod h1:angGc5Ht+k2xhJdZi511LtmxuEf0OVpvUUNrwmM1P7M=
 github.com/blevesearch/gtreap v0.1.1 h1:2JWigFrzDMR+42WGIN/V2p0cUvn4UP3C4Q5nmaZGW8Y=
 github.com/blevesearch/gtreap v0.1.1/go.mod h1:QaQyDRAT51sotthUWAH4Sj08awFSSWzgYICSZ3w0tYk=
 github.com/blevesearch/mmap-go v1.2.0 h1:l33nNKPFcBjJUMwem6sAYJPUzhUCABoK9FxZDGiFNBI=
 github.com/blevesearch/mmap-go v1.2.0/go.mod h1:Vd6+20GBhEdwJnU1Xohgt88XCD/CTWcqbCNxkZpyBo0=
-github.com/blevesearch/scorch_segment_api/v2 v2.4.7 h1:GlMzW08hcsM3DnLUxhyF/1PcDal1qtvvIuytuph5djw=
-github.com/blevesearch/scorch_segment_api/v2 v2.4.7/go.mod h1://IJ7tG3QCf0cWW/aVSXqy77tc1AvLu3fcJLYEvOAFs=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.10 h1:C3873+iWZ0YJM2ijaSHhJJzSvD4x1k+5UaQdGygZVhM=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.10/go.mod h1:WUUkAocbkDlNK/kgAE13NvS9oxe+u618mYZ8sOvcCc4=
 github.com/blevesearch/segment v0.9.1 h1:+dThDy+Lvgj5JMxhmOVlgFfkUtZV2kw49xax4+jTfSU=
 github.com/blevesearch/segment v0.9.1/go.mod h1:zN21iLm7+GnBHWTao9I+Au/7MBiL8pPFtJBJTsk6kQw=
 github.com/blevesearch/snowballstem v0.9.0 h1:lMQ189YspGP6sXvZQ4WZ+MLawfV8wOmPoD/iWeNXm8s=
@@ -182,8 +182,8 @@ github.com/blevesearch/zapx/v15 v15.4.3 h1:iJiMJOHrz216jyO6lS0m9RTCEkprUnzvqAI2l
 github.com/blevesearch/zapx/v15 v15.4.3/go.mod h1:1pssev/59FsuWcgSnTa0OeEpOzmhtmr/0/11H0Z8+Nw=
 github.com/blevesearch/zapx/v16 v16.3.4 h1:hDAqA8qusZTNbPEL7//w5P65UZ2de6yhSeUaTbp0Po0=
 github.com/blevesearch/zapx/v16 v16.3.4/go.mod h1:zqkPPqs9GS9FzVWzCO3Wf1X044yWAV17+4zb+FTiEHg=
-github.com/blevesearch/zapx/v17 v17.1.2 h1:avbOk2igaASNoiy0BE/jPgcxAnRI2PGeydeP4hg7Ikk=
-github.com/blevesearch/zapx/v17 v17.1.2/go.mod h1:WQObxKrqUX7cd0G1GMvDfc/bmZzQvoy7APOPimx7DiI=
+github.com/blevesearch/zapx/v17 v17.2.3 h1:UYYJPAt5b2tVxldx5h0jmv23RMsg8/UZKFVya7v92po=
+github.com/blevesearch/zapx/v17 v17.2.3/go.mod h1:r7mb4QWbDQSkbAnOjCb9iCfkcrzajB4yBdJpuBIo/fE=
 github.com/bluele/gcache v0.0.2 h1:WcbfdXICg7G/DGBh1PFfcirkWOQV+v077yF1pSy3DGw=
 github.com/bluele/gcache v0.0.2/go.mod h1:m15KV+ECjptwSPxKhOhQoAFQVtUFjTVkc3H8o0t/fp0=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
@@ -371,8 +371,8 @@ github.com/go-asn1-ber/asn1-ber v1.4.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkPro
 github.com/go-asn1-ber/asn1-ber v1.5.8 h1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=
 github.com/go-asn1-ber/asn1-ber v1.5.8/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-chi/chi v4.0.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
-github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8=
-github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-chi/chi/v5 v5.3.2 h1:5YQkICvTCSZ25hoRsyJazN0scjzKGiu4VAUc7H1o1nY=
+github.com/go-chi/chi/v5 v5.3.2/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
 github.com/go-chi/render v1.0.3 h1:AsXqd2a1/INaIfUSKq3G5uA8weYx20FOsM7uSoCyyt4=
 github.com/go-chi/render v1.0.3/go.mod h1:/gr3hVkmYR0YlEy3LxCuVRFzEu9Ruok+gFqbIofjao0=
 github.com/go-cmd/cmd v1.0.5/go.mod h1:y8q8qlK5wQibcw63djSl/ntiHUHXHGdCkPk0j4QeW4s=
@@ -607,8 +607,8 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vb
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.8.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY=
 github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
@@ -713,8 +713,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
-github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
+github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
@@ -892,10 +892,10 @@ github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRW
 github.com/namedotcom/go v0.0.0-20180403034216-08470befbe04/go.mod h1:5sN+Lt1CaY4wsPvgQH/jsuJi4XO2ssZbdsIizr4CVC8=
 github.com/nats-io/jwt/v2 v2.8.2 h1:XXRgB60MSTnqsRwejQurVDs/hcv2dkt+86GjI+I/bMc=
 github.com/nats-io/jwt/v2 v2.8.2/go.mod h1:Ag/56sq9OblL4JgdYufDd16Egb17Kr/8WwwuO/forVc=
-github.com/nats-io/nats-server/v2 v2.14.4 h1:efgjZ8cdExAKRuqSg8UPJFprb+l7NlBtSDPhDlw3rO4=
-github.com/nats-io/nats-server/v2 v2.14.4/go.mod h1:BltdpOYestjbtQSnVO2zGHdg5SGBZjt+GYTgB9LZq/I=
-github.com/nats-io/nats.go v1.52.0 h1:n3avV4VBsCgsdwh71TppsTwtv+QdPs7ntSKM8qJLGsc=
-github.com/nats-io/nats.go v1.52.0/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno=
+github.com/nats-io/nats-server/v2 v2.14.5 h1:M6yeo/Xb7khi97RSEVELof3DForDqmYza3P4tHCPFWw=
+github.com/nats-io/nats-server/v2 v2.14.5/go.mod h1:1D3iocrisKvWaD1B/imqarTqmaGrWMqALMLbEDo3v7Q=
+github.com/nats-io/nats.go v1.53.1 h1:Otsq3uLc/kLdjmkNHkXH0jBqwUquwdKFoe3fq6/3/Xo=
+github.com/nats-io/nats.go v1.53.1/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno=
 github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
 github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
@@ -927,31 +927,31 @@ github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+W
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
 github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
 github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.32.0 h1:Hw7s2pVrQo/8Yz5N77qdnpHaoc+c6cC9WIV1Jce+J6E=
-github.com/onsi/ginkgo/v2 v2.32.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
+github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I=
 github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
-github.com/open-policy-agent/opa v1.19.0 h1:+j2OCsjMezZEML2T1lI9giJdGJS/PL1XFKgkHPGIhpo=
-github.com/open-policy-agent/opa v1.19.0/go.mod h1:pb6Y6klyf7X7X8uXNDflruA9dQC2gMqWROXI5w/kvv0=
+github.com/open-policy-agent/opa v1.19.1 h1:aB1nOncChnTbQurjRQVJnjTJxditt8VqszlbaM3GGKU=
+github.com/open-policy-agent/opa v1.19.1/go.mod h1:pb6Y6klyf7X7X8uXNDflruA9dQC2gMqWROXI5w/kvv0=
 github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a h1:Sakl76blJAaM6NxylVkgSzktjo2dS504iDotEFJsh3M=
 github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a/go.mod h1:pjcozWijkNPbEtX5SIQaxEW/h8VAVZYTLx+70bmB3LY=
 github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89 h1:W1ms+lP5lUUIzjRGDg93WrQfZJZCaV1ZP3KeyXi8bzY=
 github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89/go.mod h1:vigJkNss1N2QEceCuNw/ullDehncuJNFB6mEnzfq9UI=
-github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260818063016-69f82a7dde55 h1:dzYZ5iA6i0QoFUap9l6sZ4Ts2HXiXVfsOoiRYToYgm8=
-github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260818063016-69f82a7dde55/go.mod h1:lTM8JeGblNpoMySTW7Lui2+c5TTLI95mwxtdUIHHrhU=
-github.com/opencloud-eu/reva/v2 v2.48.1-0.20260811071808-9bf68d2ccd96 h1:2yPjf1jhrhEkrHsX8s6gAQVogBmNY6ZTtPNOtLfc1p8=
-github.com/opencloud-eu/reva/v2 v2.48.1-0.20260811071808-9bf68d2ccd96/go.mod h1:+2IJFVwi3yBEBfw0T+jgY7M9LBSPv7ecPYDiG3/bWYg=
+github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260902170011-45af3945a067 h1:UkNMKauyJAzY6RE6mmthz9bQZLYkbvBuApm7ZDCparE=
+github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260902170011-45af3945a067/go.mod h1:lTM8JeGblNpoMySTW7Lui2+c5TTLI95mwxtdUIHHrhU=
+github.com/opencloud-eu/reva/v2 v2.49.1-0.20260903122659-26f34ec05774 h1:8N42Pwzyafdxq66zYP6kJ1CH/QBRpxovQXq/0Kt6bJY=
+github.com/opencloud-eu/reva/v2 v2.49.1-0.20260903122659-26f34ec05774/go.mod h1:Frg+UWnVcSy+412UB3l2LcD0KY8ZNu1samimwkNywbg=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4 h1:l2oB/RctH+t8r7QBj5p8thfEHCM/jF35aAY3WQ3hADI=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/opensearch-project/opensearch-go/v4 v4.6.0 h1:Ac8aLtDSmLEyOmv0r1qhQLw3b4vcUhE42NE9k+Z4cRc=
-github.com/opensearch-project/opensearch-go/v4 v4.6.0/go.mod h1:3iZtb4SNt3IzaxavKq0dURh1AmtVgYW71E4XqmYnIiQ=
+github.com/opensearch-project/opensearch-go/v4 v4.7.3 h1:JzETy7bYnnSDj4gueUh8t4EYBhs9rhKsgeVsoul77rA=
+github.com/opensearch-project/opensearch-go/v4 v4.7.3/go.mod h1:+iikkyLrVC8ZvyfKv2sua1Ze1LbpWL7eZe4IkHqNGtg=
 github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
@@ -1001,8 +1001,6 @@ github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:Om
 github.com/pquerna/cachecontrol v0.2.0 h1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=
 github.com/pquerna/cachecontrol v0.2.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
 github.com/pquerna/otp v1.3.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
-github.com/prometheus/alertmanager v0.33.1 h1:PJHGvTdb8Q0ZEpJnWff120WxB2kxIScLa707AaIudTo=
-github.com/prometheus/alertmanager v0.33.1/go.mod h1:V06Uc8EZ5X5wLOJRGhtXx+EE2LgrinFIADbKWMVm1RY=
 github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
@@ -1115,8 +1113,8 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.10.1 h1:xi4336Zh11WpU14fXR6I67V3yaTPQYwRx2WEtHbRg4Q=
+github.com/sirupsen/logrus v1.10.1/go.mod h1:vsQHnG7xzNsxk3NrwboUiWPnIC3dmbjcGPykD7+tiHk=
 github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/skratchdot/open-golang v0.0.0-20160302144031-75fb7ed4208c/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
@@ -1173,8 +1171,9 @@ github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1F
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/stvp/go-udp-testing v0.0.0-20201019212854-469649b16807/go.mod h1:7jxmlfBCDBXRzr0eAQJ48XC1hBu1np4CS5+cHEYfwpc=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
@@ -1235,8 +1234,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
 github.com/vultr/govultr/v2 v2.0.0/go.mod h1:2PsEeg+gs3p/Fo5Pw8F9mv+DUBEOlrNZ8GmCTGmhOhs=
-github.com/wI2L/jsondiff v0.7.0 h1:1lH1G37GhBPqCfp/lrs91rf/2j3DktX6qYAKZkLuCQQ=
-github.com/wI2L/jsondiff v0.7.0/go.mod h1:KAEIojdQq66oJiHhDyQez2x+sRit0vIzC9KeK0yizxM=
+github.com/wI2L/jsondiff v0.7.1 h1:Fg9+yj+1/x3UtPBJhR91TKEzRkrEEWcAcLbg9dzEaNM=
+github.com/wI2L/jsondiff v0.7.1/go.mod h1:yAt2W7U6Jd4HK0RA8DGSGk0zDtfEtOUUJVnH/xICpjo=
 github.com/wk8/go-ordered-map v1.0.0 h1:BV7z+2PaK8LTSd/mWgY12HyMAo5CEgkHqbkVq2thqr8=
 github.com/wk8/go-ordered-map v1.0.0/go.mod h1:9ZIbRunKbuvfPKyBP1SIKLcXNlv74YCOZ3t3VTS6gRk=
 github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
@@ -1292,28 +1291,28 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0 h1:2yEATaop1/a1I4psnSLgWVPLWwCzkqWakgJy7xTDVy0=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.69.0/go.mod h1:D7J12YRapIekYyPWgGPlA/23pRmpSEZC5xJC/TTLI9U=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=
-go.opentelemetry.io/contrib/zpages v0.69.0 h1:YQC1PumJq6lUGQNrLW14ID9a0dXSBcbC/aC6VRSIARU=
-go.opentelemetry.io/contrib/zpages v0.69.0/go.mod h1:FGvUcMGN5atRzUIgUsqOi+MiMvlQsfbuYATBHPP4cGs=
-go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
-go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 h1:oECp5f+hN7nkwjU/8BxQ/q23bGPb8FIrD839owX222E=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0/go.mod h1:DqEFwLumhzMBDQv9PcWbyoDxHI/4lAk6CM4nJBH39sc=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
+go.opentelemetry.io/contrib/zpages v0.71.0 h1:OrQSEmdlfknIusEyGj/t30uBR7MnbmGcCRBt5ov8/rA=
+go.opentelemetry.io/contrib/zpages v0.71.0/go.mod h1:C3IIpqkQbjswcSREqxQLyEapF0SI9bqwJpxpjwtzFrE=
+go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
+go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0 h1:lsA/S1bxgdbyFGkTj+3meEdJ6ADVU7QoFstV6MXgE68=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0/go.mod h1:L7u+MirGoB1bjeLH66+xDykF4RC8C3RN7lIFpBiewUo=
-go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
-go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
-go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
-go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
-go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
-go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
-go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
-go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
+go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
+go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
+go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
+go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
+go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
+go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
+go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
+go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
 go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
 go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -1333,8 +1332,9 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20180621125126-a49355c7e3f8/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -1354,8 +1354,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1370,8 +1370,8 @@ golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJk
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
-golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
+golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
+golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1393,8 +1393,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
+golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1445,8 +1445,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1577,8 +1577,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1639,8 +1639,8 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210112230658-8b4aab62c064/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
+golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1721,8 +1721,8 @@ google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3Iji
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.83.0 h1:JeNZEKJFbQxArAMl+hiytHauacDNqJUllNfmIMmpqnQ=
-google.golang.org/grpc v1.83.0/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
+google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
+google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
 google.golang.org/grpc/examples v0.0.0-20211102180624-670c133e568e h1:m7aQHHqd0q89mRwhwS9Bx2rjyl/hsFAeta+uGrHsQaU=
 google.golang.org/grpc/examples v0.0.0-20211102180624-670c133e568e/go.mod h1:gID3PKrg7pWKntu9Ss6zTLJ0ttC0X9IHgREOCZwbCVU=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -1739,8 +1739,8 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/cenkalti/backoff.v1 v1.1.0 h1:Arh75ttbsvlpVA7WtVpH4u9h6Zl46xuptxqLxPiSo4Y=
 gopkg.in/cenkalti/backoff.v1 v1.1.0/go.mod h1:J6Vskwqd+OMVJl8C33mmtxTBs2gyzfv7UDAkHu8BrjI=

internal/eventstest/events_test_helpers.go

@@ -0,0 +1,44 @@
+package eventstest
+
+import (
+	"encoding/json"
+	"reflect"
+
+	"github.com/google/uuid"
+
+	rev "github.com/opencloud-eu/reva/v2/pkg/events"
+	microevents "go-micro.dev/v4/events"
+)
+
+func NewTestBus() TestBus {
+	return TestBus(make(chan rev.Event))
+}
+
+type TestBus chan rev.Event
+
+func (tb TestBus) Consume(_ string, _ ...microevents.ConsumeOption) (<-chan microevents.Event, error) {
+	ch := make(chan microevents.Event)
+	go func() {
+		for ev := range tb {
+			b, _ := json.Marshal(ev.Event)
+			ch <- microevents.Event{
+				Payload: b,
+				Metadata: map[string]string{
+					rev.MetadatakeyEventID:   ev.ID,
+					rev.MetadatakeyEventType: ev.Type,
+				},
+			}
+		}
+	}()
+	return ch, nil
+}
+
+func (tb TestBus) Publish(e any) string {
+	ev := rev.Event{
+		ID:    uuid.New().String(),
+		Type:  reflect.TypeOf(e).String(),
+		Event: e,
+	}
+	tb <- ev
+	return ev.ID
+}

internal/metricstest/metrics_test_helpers.go

@@ -0,0 +1,143 @@
+package metricstest
+
+import (
+	"fmt"
+
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// copied and adapted from Prometheus testutil.ToFloat64(), since we don't import that package
+func collect(c prometheus.Collector) []prometheus.Metric {
+	result := []prometheus.Metric{}
+	ch := make(chan prometheus.Metric)
+	done := make(chan struct{})
+	go func() {
+		for m := range ch {
+			result = append(result, m)
+		}
+		close(done)
+	}()
+	c.Collect(ch)
+	close(ch)
+	<-done
+	return result
+}
+
+func RequireIsNotSet(t require.TestingT, c prometheus.Collector, msgAndArgs ...any) {
+	if h, ok := t.(interface{ Helper() }); ok {
+		h.Helper()
+	}
+	if !IsNotSet(t, c, msgAndArgs) {
+		t.FailNow()
+	}
+}
+
+func IsNotSet(t assert.TestingT, c prometheus.Collector, msgAndArgs ...any) bool {
+	if h, ok := t.(interface{ Helper() }); ok {
+		h.Helper()
+	}
+
+	m := collect(c)
+	if len(m) > 0 {
+		return assert.Fail(t, "Metric exists while expected to not exist", msgAndArgs)
+	} else {
+		return true
+	}
+}
+
+func RequireEqual(t require.TestingT, expected float64, c prometheus.Collector, msgAndArgs ...any) {
+	if h, ok := t.(interface{ Helper() }); ok {
+		h.Helper()
+	}
+	if !Equal(t, expected, c, msgAndArgs) {
+		t.FailNow()
+	}
+}
+
+// copied and adapted from Prometheus testutil.ToFloat64(), since we don't import that package
+func Equal(t assert.TestingT, expected float64, c prometheus.Collector, msgAndArgs ...any) bool {
+	if h, ok := t.(interface{ Helper() }); ok {
+		h.Helper()
+	}
+
+	m := collect(c)
+	if !assert.Len(t, m, 1, msgAndArgs...) {
+		return false
+	}
+	pb := &dto.Metric{}
+	err := m[0].Write(pb)
+	if !assert.NoError(t, err, msgAndArgs...) {
+		return false
+	}
+	if pb.Gauge != nil {
+		return assert.Equal(t, expected, pb.Gauge.GetValue(), msgAndArgs...)
+	} else if pb.Counter != nil {
+		return assert.Equal(t, expected, pb.Counter.GetValue(), msgAndArgs...)
+	} else if pb.Untyped != nil {
+		return assert.Equal(t, expected, pb.Untyped.GetValue(), msgAndArgs...)
+	} else {
+		return assert.Fail(t, fmt.Sprintf("collected a non-gauge/counter/untyped metric: %s", pb), msgAndArgs...)
+	}
+}
+
+func RequireEqualWithLabels(t require.TestingT, expectedValue float64, expectedLabels map[string]string, c prometheus.Collector, msgAndArgs ...any) {
+	if h, ok := t.(interface{ Helper() }); ok {
+		h.Helper()
+	}
+	if !EqualWithLabels(t, expectedValue, expectedLabels, c, msgAndArgs) {
+		t.FailNow()
+	}
+}
+
+func EqualWithLabels(t assert.TestingT, expectedValue float64, expectedLabels map[string]string, c prometheus.Collector, msgAndArgs ...any) bool {
+	if h, ok := t.(interface{ Helper() }); ok {
+		h.Helper()
+	}
+
+	m := collect(c)
+	if !assert.Len(t, m, 1, "collected %d metrics instead of exactly 1", len(m)) {
+		return false
+	}
+	pb := &dto.Metric{}
+	err := m[0].Write(pb)
+	if !assert.NoError(t, err) {
+		return false
+	}
+	if pb.Gauge != nil {
+		if !assert.Equal(t, expectedValue, pb.Gauge.GetValue()) {
+			return false
+		}
+	} else if pb.Counter != nil {
+		if !assert.Equal(t, expectedValue, pb.Counter.GetValue()) {
+			return false
+		}
+	} else if pb.Untyped != nil {
+		if !assert.Equal(t, expectedValue, pb.Untyped.GetValue()) {
+			return false
+		}
+	} else {
+		return assert.Fail(t, "collected a non-gauge/counter/untyped metric: %s", pb)
+	}
+
+	if !assert.NotNil(t, pb.Label) {
+		return false
+	}
+	actualLabels := map[string]string{}
+	for _, label := range pb.Label {
+		if !assert.NotNil(t, label) {
+			return false
+		}
+		if !assert.NotNil(t, label.Name) {
+			return false
+		}
+		if !assert.NotNil(t, label.Value) {
+			return false
+		}
+		actualLabels[*label.Name] = *label.Value
+	}
+	return assert.Equal(t, expectedLabels, actualLabels, msgAndArgs)
+}

mise.toml

@@ -1,9 +1,14 @@
+[env]
+GO_VERSION = "{{ exec(command='./.mise-go-version.sh') }}"
+
 [tools]
-go = "1.25"
+go = "{{ env.GO_VERSION }}"
 node = "24"
 pnpm = "11.1.3"
-"go:github.com/go-delve/delve/cmd/dlv" = "1.27.0"
+"go:github.com/go-delve/delve/cmd/dlv" = "1.27.1"
 "aqua:nats-io/natscli" = "0.4.0"
+k6 = "2.2.0"
+ginkgo = "latest"
 
 [tasks.build]
 description = "build"

opencloud/pkg/command/revisions.go

@@ -25,6 +25,8 @@ var (
 	_nodesGlobPattern = "spaces/*/*/nodes/"
 )
 
+const posixDriver = "posix"
+
 // RevisionsCommand is the entrypoint for the revisions command.
 func RevisionsCommand(cfg *config.Config) *cobra.Command {
 	revCmd := &cobra.Command{
@@ -86,23 +88,28 @@ func PurgeRevisionsCommand(cfg *config.Config) *cobra.Command {
 				mechanism = "glob"
 			}
 
+			var posix = cfg.StorageUsers.Driver == posixDriver
+
 			var ch <-chan string
 			switch mechanism {
 			default:
 				fallthrough
 			case "glob":
-				p := generatePath(basePath, rid)
+				p := generatePath(basePath, rid, posix)
 				if rid.GetOpaqueId() == "" {
 					p = filepath.Join(p, "*/*/*/*/*")
 				}
 				ch = revisions.Glob(p)
 			case "workers":
-				p := generatePath(basePath, rid)
+				p := generatePath(basePath, rid, posix)
 				ch = revisions.GlobWorkers(p, "/*", "/*/*/*/*")
 			case "list":
-				p := filepath.Join(basePath, "spaces")
+				p := basePath
+				if !posix {
+					p = filepath.Join(basePath, "spaces")
+				}
 				if rid != nil {
-					p = generatePath(basePath, rid)
+					p = generatePath(basePath, rid, posix)
 				}
 				ch = revisions.List(p, 10)
 			}
@@ -144,22 +151,44 @@ func printResults(countFiles, countBlobs, countRevisions int, dryRun bool) {
 	}
 }
 
-func generatePath(basePath string, rid *provider.ResourceId) string {
-	if rid == nil {
-		return filepath.Join(basePath, _nodesGlobPattern)
-	}
+func generatePath(basePath string, rid *provider.ResourceId, posix bool) string {
+	// decomposedfs and posix store the revisions of a node at different
+	// locations on disk, so the path has to be built per driver:
+	//   - decomposedfs: <basePath>/spaces/<pathified spaceID>/nodes/<pathified nodeID>.REV.<ts>
+	//   - posix:        <basePath>/<users|projects>/<spaceID>/.oc-nodes/<pathified nodeID>.REV.<ts>
+	if posix {
+		if rid == nil {
+			return filepath.Join(basePath, "*", "*", ".oc-nodes")
+		}
 
-	sid := lookup.Pathify(rid.GetSpaceId(), 1, 2)
-	if sid == "" {
-		return ""
-	}
+		nid := lookup.Pathify(rid.GetOpaqueId(), 4, 2)
+		if nid != "" {
+			return filepath.Join(basePath, "*", "*", ".oc-nodes", nid+"*")
+		}
 
-	nid := lookup.Pathify(rid.GetOpaqueId(), 4, 2)
-	if nid == "" {
-		return filepath.Join(basePath, "spaces", sid, "nodes")
-	}
+		if rid.GetSpaceId() == "" {
+			return ""
+		}
+		return filepath.Join(basePath, "*", rid.GetSpaceId(), ".oc-nodes")
+	} else {
+		// decomposedfs
+		if rid == nil {
 
-	return filepath.Join(basePath, "spaces", sid, "nodes", nid+"*")
+			return filepath.Join(basePath, _nodesGlobPattern)
+		}
+
+		sid := lookup.Pathify(rid.GetSpaceId(), 1, 2)
+		if sid == "" {
+			return ""
+		}
+
+		nid := lookup.Pathify(rid.GetOpaqueId(), 4, 2)
+		if nid == "" {
+			return filepath.Join(basePath, "spaces", sid, "nodes")
+		}
+
+		return filepath.Join(basePath, "spaces", sid, "nodes", nid+"*")
+	}
 }
 
 func init() {

opencloud/pkg/command/shares.go

@@ -1,7 +1,9 @@
 package command
 
 import (
+	"context"
 	"errors"
+	"time"
 
 	"github.com/spf13/viper"
 
@@ -21,6 +23,14 @@ import (
 	"github.com/spf13/cobra"
 )
 
+// need to be discussed, for now I will let it here
+//
+// Problem:
+// in reva on CleanupStaleShares call there is migrations invokation, which at leat in tests takes some time,
+// reva code was modified to wait until migrations are done, to prevent cases when migrations are stuck and the
+// this executions is not returned this timeout is needed
+const cleanupTimeout = 1 * time.Minute
+
 // SharesCommand is the entrypoint for the groups command.
 func SharesCommand(cfg *config.Config) *cobra.Command {
 	sharesCmd := &cobra.Command{
@@ -120,7 +130,11 @@ func cleanup(_ *cobra.Command, cfg *config.Config) error {
 	}
 	serviceUserCtx = l.WithContext(serviceUserCtx)
 
-	mgr.(*jsoncs3.Manager).CleanupStaleShares(serviceUserCtx)
+	cleanupCtx, cancel := context.WithTimeout(serviceUserCtx, cleanupTimeout)
+	defer cancel()
+	if err := mgr.(*jsoncs3.Manager).CleanupStaleShares(cleanupCtx); err != nil {
+		return configlog.ReturnError(err)
+	}
 
 	return nil
 }
@@ -158,11 +172,13 @@ func revaShareConfig(cfg *sharing.Config) map[string]any {
 			"machine_auth_apikey": cfg.UserSharingDrivers.CS3.SystemUserAPIKey,
 		},
 		"jsoncs3": map[string]any{
-			"gateway_addr":        cfg.Reva.Address,
-			"provider_addr":       cfg.UserSharingDrivers.JSONCS3.ProviderAddr,
-			"service_user_id":     cfg.UserSharingDrivers.JSONCS3.SystemUserID,
-			"service_user_idp":    cfg.UserSharingDrivers.JSONCS3.SystemUserIDP,
-			"machine_auth_apikey": cfg.UserSharingDrivers.JSONCS3.SystemUserAPIKey,
+			"gateway_addr":           cfg.Reva.Address,
+			"provider_addr":          cfg.UserSharingDrivers.JSONCS3.ProviderAddr,
+			"system_user_id":         cfg.UserSharingDrivers.JSONCS3.SystemUserID,
+			"system_user_idp":        cfg.UserSharingDrivers.JSONCS3.SystemUserIDP,
+			"machine_auth_apikey":    cfg.UserSharingDrivers.JSONCS3.SystemUserAPIKey,
+			"service_account_id":     cfg.ServiceAccount.ServiceAccountID,
+			"service_account_secret": cfg.ServiceAccount.ServiceAccountSecret,
 		},
 	}
 }

opencloud/pkg/command/trash.go

@@ -36,7 +36,8 @@ func TrashPurgeEmptyDirsCommand(cfg *config.Config) *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			basePath, _ := cmd.Flags().GetString("basepath")
 			dryRun, _ := cmd.Flags().GetBool("dry-run")
-			if err := trash.PurgeTrashEmptyPaths(basePath, dryRun); err != nil {
+			posix := cfg.StorageUsers.Driver == posixDriver
+			if err := trash.PurgeTrashEmptyPaths(basePath, dryRun, posix); err != nil {
 				fmt.Println(err)
 				return err
 			}

opencloud/pkg/trash/trash.go

@@ -10,12 +10,23 @@ import (
 const (
 	// _trashGlobPattern is the glob pattern to find all trash items
 	_trashGlobPattern = "spaces/*/*/trash/*/*/*/*"
+	// _trashRootPattern is the glob pattern of the trash container root
+	_trashRootPattern = "spaces/*/*/trash"
+	// _posixTrashGlobPattern is the glob pattern to find all trash items on posix
+	_posixTrashGlobPattern = "*/*/.Trash/files/*"
+	// _posixTrashRootPattern is the glob pattern of the trash container root on posix
+	_posixTrashRootPattern = "*/*/.Trash/files"
 )
 
 // PurgeTrashEmptyPaths purges empty paths in the trash
-func PurgeTrashEmptyPaths(p string, dryRun bool) error {
+func PurgeTrashEmptyPaths(p string, dryRun bool, posix bool) error {
+	pattern := _trashGlobPattern
+	if posix {
+		pattern = _posixTrashGlobPattern
+	}
+
 	// we have all trash nodes in all spaces now
-	dirs, err := filepath.Glob(filepath.Join(p, _trashGlobPattern))
+	dirs, err := filepath.Glob(filepath.Join(p, pattern))
 	if err != nil {
 		return err
 	}
@@ -25,15 +36,26 @@ func PurgeTrashEmptyPaths(p string, dryRun bool) error {
 	}
 
 	for _, d := range dirs {
-		if err := removeEmptyFolder(d, dryRun); err != nil {
+		if err := removeEmptyFolder(d, dryRun, posix, p); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func removeEmptyFolder(path string, dryRun bool) error {
+func removeEmptyFolder(path string, dryRun bool, posix bool, basePath string) error {
+
 	if dryRun {
+		if posix {
+			// on posix the ".trashitem" entries are the actual data and can be
+			// files, which are skipped, so we need to check here if the path
+			// is the actual dir, the same check for real removal part
+			fi, err := os.Stat(path)
+			if err != nil || !fi.IsDir() {
+				return nil
+			}
+		}
+
 		f, err := os.ReadDir(path)
 		if err != nil {
 			return err
@@ -43,6 +65,14 @@ func removeEmptyFolder(path string, dryRun bool) error {
 		}
 		return nil
 	}
+
+	if posix {
+		fi, err := os.Stat(path)
+		if err != nil || !fi.IsDir() {
+			return nil
+		}
+	}
+
 	if err := os.Remove(path); err != nil {
 		// we do not really care about the error here
 		// if the folder is not empty we will get an error,
@@ -50,8 +80,17 @@ func removeEmptyFolder(path string, dryRun bool) error {
 		return nil
 	}
 	nd := filepath.Dir(path)
-	if filepath.Base(nd) == "trash" {
+	if isTrashRoot(nd, basePath, posix) {
 		return nil
 	}
-	return removeEmptyFolder(nd, dryRun)
+	return removeEmptyFolder(nd, dryRun, posix, basePath)
+}
+
+func isTrashRoot(path, basePath string, posix bool) bool {
+	rootPattern := _trashRootPattern
+	if posix {
+		rootPattern = _posixTrashRootPattern
+	}
+	matched, _ := filepath.Match(filepath.Join(basePath, rootPattern), path)
+	return matched
 }

opencloud/pkg/trash/trash_test.go

@@ -0,0 +1,109 @@
+package trash
+
+import (
+	"os"
+	"testing"
+
+	"github.com/test-go/testify/require"
+)
+
+func TestIsTrashRootDecomposed(t *testing.T) {
+	storageRoot := "test_temp_" + t.Name()
+	defer os.RemoveAll(storageRoot)
+
+	require.True(t, isTrashRoot(storageRoot+"/spaces/id/id/trash", storageRoot, false))
+	require.False(t, isTrashRoot(storageRoot+"/spaces/id/id/trash/s1/s2/s3/node", storageRoot, false))
+	require.False(t, isTrashRoot(storageRoot+"/spaces/id/id/trash/s1/s2/trash/node", storageRoot, false))
+}
+
+func TestIsTrashRootPosix(t *testing.T) {
+	storageRoot := "test_temp_" + t.Name()
+	defer os.RemoveAll(storageRoot)
+
+	require.True(t, isTrashRoot(storageRoot+"/users/alice/.Trash/files", storageRoot, true))
+	require.False(t, isTrashRoot(storageRoot+"/users/alice/.Trash/files/item.trashitem", storageRoot, true))
+	require.False(t, isTrashRoot(storageRoot+"/users/alice/.Trash/files/item.trashitem/files", storageRoot, true))
+}
+
+func TestRemoveEmptyFolderPosix(t *testing.T) {
+	storageRoot := "test_temp_" + t.Name()
+	base := storageRoot + "/users/alice/.Trash/files"
+	defer os.RemoveAll(storageRoot)
+
+	emptyChain := base + "/empty.trashitem/sub/subsub"
+	require.NoError(t, os.MkdirAll(emptyChain, os.ModePerm))
+
+	nonEmpty := base + "/keep.trashitem"
+	require.NoError(t, os.MkdirAll(nonEmpty, os.ModePerm))
+	require.NoError(t, os.WriteFile(nonEmpty+"/file.txt", []byte("some text"), os.ModePerm))
+
+	require.NoError(t, removeEmptyFolder(emptyChain, false, true, storageRoot))
+
+	assertNoDirExists(t, emptyChain)
+	assertNoDirExists(t, base+"/empty.trashitem")
+	assertDirExists(t, base)
+	assertDirExists(t, nonEmpty)
+}
+
+func TestRemoveEmptyFolderPosixUserDirNamedFiles(t *testing.T) {
+	storageRoot := "test_temp_" + t.Name()
+	base := storageRoot + "/users/alice/.Trash/files"
+	defer os.RemoveAll(storageRoot)
+
+	nestedFilesDir := base + "/folder.trashitem/files/files"
+	require.NoError(t, os.MkdirAll(nestedFilesDir, os.ModePerm))
+
+	require.NoError(t, removeEmptyFolder(nestedFilesDir, false, true, storageRoot))
+
+	assertNoDirExists(t, nestedFilesDir)
+	assertNoDirExists(t, base+"/folder.trashitem/files")
+	assertNoDirExists(t, base+"/folder.trashitem")
+	assertDirExists(t, base)
+}
+
+func TestRemoveEmptyFolderDecomposed(t *testing.T) {
+	storageRoot := "test_temp_" + t.Name()
+	base := storageRoot + "/spaces/id/id/trash"
+	defer os.RemoveAll(storageRoot)
+
+	emptyChain := base + "/s1/s2/s3/node"
+	require.NoError(t, os.MkdirAll(emptyChain, os.ModePerm))
+
+	require.NoError(t, removeEmptyFolder(emptyChain, false, false, storageRoot))
+
+	assertNoDirExists(t, emptyChain)
+	assertNoDirExists(t, base+"/s1/s2/s3")
+	assertNoDirExists(t, base+"/s1/s2")
+	assertNoDirExists(t, base+"/s1")
+	assertDirExists(t, base)
+}
+
+func TestRemoveEmptyFolderDecomposedUserDirNamedTrash(t *testing.T) {
+	storageRoot := "test_temp_" + t.Name()
+	base := storageRoot + "/spaces/id/id/trash"
+	defer os.RemoveAll(storageRoot)
+
+	nestedTrashDir := base + "/s1/trash/s2/node"
+	require.NoError(t, os.MkdirAll(nestedTrashDir, os.ModePerm))
+
+	require.NoError(t, removeEmptyFolder(nestedTrashDir, false, false, storageRoot))
+
+	assertNoDirExists(t, nestedTrashDir)
+	assertNoDirExists(t, base+"/s1/trash/s2")
+	assertNoDirExists(t, base+"/s1/trash")
+	assertNoDirExists(t, base+"/s1")
+	assertDirExists(t, base)
+}
+
+func assertNoDirExists(t *testing.T, path string) {
+	t.Helper()
+	_, err := os.Stat(path)
+	require.True(t, os.IsNotExist(err))
+}
+
+func assertDirExists(t *testing.T, path string) {
+	t.Helper()
+	fi, err := os.Stat(path)
+	require.NoError(t, err)
+	require.True(t, fi.IsDir())
+}

pkg/ast/ast.go

@@ -43,6 +43,10 @@ type StringNode struct {
 	*Base
 	Key   string
 	Value string
+	Exact bool
+	// CaseInsensitive marks a case-insensitive restriction; set by the search
+	// lowering pass, a backend routes it to the field's lowercased form.
+	CaseInsensitive bool
 }
 
 // BooleanNode represents a bool value
@@ -60,6 +64,14 @@ type DateTimeNode struct {
 	Value    time.Time
 }
 
+// NumberNode represents a numeric value
+type NumberNode struct {
+	*Base
+	Key      string
+	Operator *OperatorNode
+	Value    float64
+}
+
 // OperatorNode represents an operator value like
 // AND, OR, NOT, =, <= ... and so on
 type OperatorNode struct {

pkg/ast/test/test.go

@@ -21,6 +21,7 @@ func DiffAst(x, y any, opts ...cmp.Option) string {
 			cmpopts.IgnoreFields(ast.GroupNode{}, "Base"),
 			cmpopts.IgnoreFields(ast.BooleanNode{}, "Base"),
 			cmpopts.IgnoreFields(ast.DateTimeNode{}, "Base"),
+			cmpopts.IgnoreFields(ast.NumberNode{}, "Base"),
 		)...,
 	)
 }

pkg/kql/cast.go

@@ -2,11 +2,11 @@ package kql
 
 import (
 	"fmt"
+	"strconv"
 	"time"
 
 	"github.com/jinzhu/now"
 	"github.com/opencloud-eu/opencloud/pkg/ast"
-	"github.com/opencloud-eu/opencloud/services/search/pkg/query"
 )
 
 func toNode[T ast.Node](in any) (T, error) {
@@ -84,7 +84,7 @@ func toTimeRange(in any) (*time.Time, *time.Time, error) {
 
 	value, err := toString(in)
 	if err != nil {
-		return &from, &to, &query.UnsupportedTimeRangeError{}
+		return &from, &to, &UnsupportedTimeRangeError{}
 	}
 
 	c := &now.Config{
@@ -131,8 +131,17 @@ func toTimeRange(in any) (*time.Time, *time.Time, error) {
 	}
 
 	if from.IsZero() || to.IsZero() {
-		return nil, nil, &query.UnsupportedTimeRangeError{}
+		return nil, nil, &UnsupportedTimeRangeError{}
 	}
 
 	return &from, &to, nil
 }
+
+func toFloat(v any) (float64, error) {
+	value, err := toString(v)
+	if err != nil {
+		return 0, err
+	}
+
+	return strconv.ParseFloat(value, 64)
+}

pkg/kql/dictionary.peg

@@ -40,6 +40,7 @@ GroupNode <-
 PropertyRestrictionNodes <-
     YesNoPropertyRestrictionNode /
     DateTimeRestrictionNode /
+    NumberRestrictionNode /
     TextPropertyRestrictionNode
 
 YesNoPropertyRestrictionNode <-
@@ -69,9 +70,22 @@ DateTimeRestrictionNode <-
         return buildNaturalLanguageDateTimeNodes(k, v, c.text, c.pos)
     }
 
+NumberRestrictionNode <-
+    k:Key o:(
+        OperatorGreaterOrEqualNode /
+        OperatorLessOrEqualNode /
+        OperatorGreaterNode /
+        OperatorLessNode
+    ) '"'? v:Number '"'? {
+        return buildNumberNode(k, o, v, c.text, c.pos)
+    }
+
 TextPropertyRestrictionNode <-
-    k:Key (OperatorColonNode / OperatorEqualNode) v:(String / [^ ()]+){
-        return buildStringNode(k, v, c.text, c.pos)
+    k:Key OperatorEqualNode v:(String / [^ ()]+) {
+        return buildStringNode(k, v, true, c.text, c.pos)
+    } /
+    k:Key OperatorColonNode v:(String / [^ ()]+) {
+        return buildStringNode(k, v, false, c.text, c.pos)
     }
 
 ////////////////////////////////////////////////////////
@@ -84,12 +98,12 @@ FreeTextKeywordNodes <-
 
 PhraseNode <-
      OperatorColonNode? _ v:String _ OperatorColonNode? {
-        return buildStringNode("", v, c.text, c.pos)
+        return buildStringNode("", v, false, c.text, c.pos)
     }
 
 WordNode <-
      OperatorColonNode? _ v:[^ :()]+ _ OperatorColonNode? {
-        return buildStringNode("", v, c.text, c.pos)
+        return buildStringNode("", v, false, c.text, c.pos)
     }
 
 ////////////////////////////////////////////////////////
@@ -229,6 +243,11 @@ String <-
         return v, nil
     }
 
+Number <-
+    [0-9]+ ("." [0-9]+)? {
+        return string(c.text), nil
+    }
+
 Digit <-
     [0-9] {
         return c.text, nil

pkg/kql/dictionary_test.go

@@ -9,7 +9,6 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/ast"
 	"github.com/opencloud-eu/opencloud/pkg/ast/test"
 	"github.com/opencloud-eu/opencloud/pkg/kql"
-	"github.com/opencloud-eu/opencloud/services/search/pkg/query"
 	tAssert "github.com/stretchr/testify/assert"
 )
 
@@ -34,13 +33,13 @@ func TestParse_Spec(t *testing.T) {
 		},
 		{
 			name: `AND`,
-			error: query.StartsWithBinaryOperatorError{
+			error: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
 		{
 			name: `AND cat AND dog`,
-			error: query.StartsWithBinaryOperatorError{
+			error: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
@@ -80,13 +79,13 @@ func TestParse_Spec(t *testing.T) {
 		},
 		{
 			name: `OR`,
-			error: query.StartsWithBinaryOperatorError{
+			error: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolOR},
 			},
 		},
 		{
 			name: `OR cat AND dog`,
-			error: query.StartsWithBinaryOperatorError{
+			error: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolOR},
 			},
 		},
@@ -145,6 +144,22 @@ func TestParse_Spec(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: `author="John Smith"`,
+			ast: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "author", Value: "John Smith", Exact: true},
+				},
+			},
+		},
+		{
+			name: `filename=budget.xlsx`,
+			ast: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.StringNode{Key: "filename", Value: "budget.xlsx", Exact: true},
+				},
+			},
+		},
 		// 3.2.3 Implicit Operator for Property Restriction
 		{
 			name: `author:"John Smith" filetype:docx`,
@@ -423,6 +438,60 @@ func TestParse_Spec(t *testing.T) {
 	}
 }
 
+func TestParse_NumberRestrictionNode(t *testing.T) {
+	tests := []testCase{
+		{
+			name: "format",
+			query: join([]string{
+				`size>100`,
+				`size>"100"`,
+				`size>=15.5`,
+				`size<100`,
+				`size<=100`,
+			}),
+			ast: &ast.Ast{
+				Nodes: []ast.Node{
+					&ast.NumberNode{
+						Key:      "size",
+						Operator: &ast.OperatorNode{Value: ">"},
+						Value:    100,
+					},
+					&ast.OperatorNode{Value: kql.BoolAND},
+					&ast.NumberNode{
+						Key:      "size",
+						Operator: &ast.OperatorNode{Value: ">"},
+						Value:    100,
+					},
+					&ast.OperatorNode{Value: kql.BoolAND},
+					&ast.NumberNode{
+						Key:      "size",
+						Operator: &ast.OperatorNode{Value: ">="},
+						Value:    15.5,
+					},
+					&ast.OperatorNode{Value: kql.BoolAND},
+					&ast.NumberNode{
+						Key:      "size",
+						Operator: &ast.OperatorNode{Value: "<"},
+						Value:    100,
+					},
+					&ast.OperatorNode{Value: kql.BoolAND},
+					&ast.NumberNode{
+						Key:      "size",
+						Operator: &ast.OperatorNode{Value: "<="},
+						Value:    100,
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			testKQL(t, tc)
+		})
+	}
+}
+
 func TestParse_DateTimeRestrictionNode(t *testing.T) {
 	tests := []testCase{
 		{
@@ -860,37 +929,37 @@ func TestParse_Errors(t *testing.T) {
 	tests := []testCase{
 		{
 			query: "animal:(mammal:cat mammal:dog reptile:turtle)",
-			error: query.NamedGroupInvalidNodesError{
+			error: kql.NamedGroupInvalidNodesError{
 				Node: &ast.StringNode{Key: "mammal", Value: "cat"},
 			},
 		},
 		{
 			query: "animal:(cat mammal:dog turtle)",
-			error: query.NamedGroupInvalidNodesError{
+			error: kql.NamedGroupInvalidNodesError{
 				Node: &ast.StringNode{Key: "mammal", Value: "dog"},
 			},
 		},
 		{
 			query: "animal:(AND cat)",
-			error: query.StartsWithBinaryOperatorError{
+			error: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
 		{
 			query: "animal:(OR cat)",
-			error: query.StartsWithBinaryOperatorError{
+			error: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolOR},
 			},
 		},
 		{
 			query: "(AND cat)",
-			error: query.StartsWithBinaryOperatorError{
+			error: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
 		{
 			query: "(OR cat)",
-			error: query.StartsWithBinaryOperatorError{
+			error: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolOR},
 			},
 		},

pkg/kql/engine_suite_test.go

@@ -1,11 +0,0 @@
-package kql
-
-import (
-	"time"
-)
-
-// PatchTimeNow is here to patch the package time now func,
-// which is used in the test suite
-func PatchTimeNow(t func() time.Time) {
-	timeNow = t
-}

pkg/kql/error.go

@@ -1,6 +1,7 @@
-package query
+package kql
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/opencloud-eu/opencloud/pkg/ast"
@@ -38,10 +39,17 @@ func (e UnsupportedTimeRangeError) Error() string {
 	return fmt.Sprintf("unable to convert '%v' to a time range", e.Value)
 }
 
+// IsValidationError reports whether err is one of the KQL parse/validation
+// errors produced by this package, i.e. the query itself is at fault and the
+// caller should treat it as a bad request.
 func IsValidationError(err error) bool {
-	switch err.(type) {
-	case *StartsWithBinaryOperatorError, *NamedGroupInvalidNodesError, *UnsupportedTimeRangeError:
-		return true
-	}
-	return false
+	var (
+		startsWithBinaryOperator *StartsWithBinaryOperatorError
+		namedGroupInvalidNodes   *NamedGroupInvalidNodesError
+		unsupportedTimeRange     *UnsupportedTimeRangeError
+	)
+
+	return errors.As(err, &startsWithBinaryOperator) ||
+		errors.As(err, &namedGroupInvalidNodes) ||
+		errors.As(err, &unsupportedTimeRange)
 }

pkg/kql/factory.go

@@ -50,7 +50,7 @@ func buildAST(n any, text []byte, pos position) (*ast.Ast, error) {
 	return a, nil
 }
 
-func buildStringNode(k, v any, text []byte, pos position) (*ast.StringNode, error) {
+func buildStringNode(k, v any, exact bool, text []byte, pos position) (*ast.StringNode, error) {
 	b, err := base(text, pos)
 	if err != nil {
 		return nil, err
@@ -70,6 +70,7 @@ func buildStringNode(k, v any, text []byte, pos position) (*ast.StringNode, erro
 		Base:  b,
 		Key:   key,
 		Value: value,
+		Exact: exact,
 	}, nil
 }
 
@@ -101,6 +102,36 @@ func buildDateTimeNode(k, o, v any, text []byte, pos position) (*ast.DateTimeNod
 		Value:    value,
 	}, nil
 }
+
+func buildNumberNode(k, o, v any, text []byte, pos position) (*ast.NumberNode, error) {
+	b, err := base(text, pos)
+	if err != nil {
+		return nil, err
+	}
+
+	operator, err := toNode[*ast.OperatorNode](o)
+	if err != nil {
+		return nil, err
+	}
+
+	key, err := toString(k)
+	if err != nil {
+		return nil, err
+	}
+
+	value, err := toFloat(v)
+	if err != nil {
+		return nil, err
+	}
+
+	return &ast.NumberNode{
+		Base:     b,
+		Key:      key,
+		Operator: operator,
+		Value:    value,
+	}, nil
+}
+
 func buildNaturalLanguageDateTimeNodes(k, v any, text []byte, pos position) ([]ast.Node, error) {
 	b, err := base(text, pos)
 	if err != nil {

pkg/kql/kql.go

@@ -47,3 +47,9 @@ func (b Builder) Build(q string) (*ast.Ast, error) {
 // timeNow mirrors time.Now by default, the only reason why this exists
 // is to monkey patch it from the tests. See PatchTimeNow
 var timeNow = time.Now
+
+// PatchTimeNow pins the clock the natural language dates resolve against,
+// so a test can hold "today" still while it runs
+func PatchTimeNow(t func() time.Time) {
+	timeNow = t
+}

pkg/kql/kql_test.go

@@ -5,7 +5,6 @@ import (
 
 	"github.com/opencloud-eu/opencloud/pkg/ast"
 	"github.com/opencloud-eu/opencloud/pkg/kql"
-	"github.com/opencloud-eu/opencloud/services/search/pkg/query"
 	tAssert "github.com/stretchr/testify/assert"
 )
 
@@ -22,7 +21,7 @@ func TestNewAST(t *testing.T) {
 		{
 			name:       "error",
 			givenQuery: kql.BoolAND,
-			expectedError: query.StartsWithBinaryOperatorError{
+			expectedError: kql.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},

pkg/kql/validate.go

@@ -2,7 +2,6 @@ package kql
 
 import (
 	"github.com/opencloud-eu/opencloud/pkg/ast"
-	"github.com/opencloud-eu/opencloud/services/search/pkg/query"
 )
 
 func validateAst(a *ast.Ast) error {
@@ -10,7 +9,7 @@ func validateAst(a *ast.Ast) error {
 	case *ast.OperatorNode:
 		switch node.Value {
 		case BoolAND, BoolOR:
-			return &query.StartsWithBinaryOperatorError{Node: node}
+			return &StartsWithBinaryOperatorError{Node: node}
 		}
 	}
 	return nil
@@ -21,14 +20,14 @@ func validateGroupNode(n *ast.GroupNode) error {
 	case *ast.OperatorNode:
 		switch node.Value {
 		case BoolAND, BoolOR:
-			return &query.StartsWithBinaryOperatorError{Node: node}
+			return &StartsWithBinaryOperatorError{Node: node}
 		}
 	}
 
 	if n.Key != "" {
 		for _, node := range n.Nodes {
 			if ast.NodeKey(node) != "" {
-				return &query.NamedGroupInvalidNodesError{Node: node}
+				return &NamedGroupInvalidNodesError{Node: node}
 			}
 		}
 	}

pkg/metrics/metrics.go

@@ -0,0 +1,189 @@
+package metrics
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/pkg/version"
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+type BuildInfoMetric = *prometheus.GaugeVec
+
+// Create a BuildInfo metric for the specified namespace and subsystem.
+func BuildInfo(namespace, subsystem string) BuildInfoMetric {
+	return prometheus.NewGaugeVec(prometheus.GaugeOpts{
+		Namespace: namespace,
+		Subsystem: subsystem,
+		Name:      "build_info",
+		Help:      "Build information",
+	}, []string{"version"})
+}
+
+// Determine the fully qualified name of a metric.
+//
+// Beware that this requires storing a value into the metric in order to make it
+// visible in a temporary registry.
+// If the metric is a MetricVec, it will be Reset().
+func describe(metric prometheus.Collector, initialize func() error) (string, error) {
+	reg := prometheus.NewRegistry()
+	if err := reg.Register(metric); err != nil {
+		return "", err
+	}
+	if err := initialize(); err != nil {
+		return "", err
+	}
+	if resettable, ok := metric.(*prometheus.MetricVec); ok {
+		defer resettable.Reset()
+	}
+	fams, err := reg.Gather()
+	if err != nil {
+		return "", err
+	}
+	if len(fams) == 0 {
+		return "", fmt.Errorf("no metric families gathered")
+	}
+	return fams[0].GetName(), nil
+}
+
+// Take a struct that contains metrics as attributes and register all of them
+// with the specified Registerer.
+func RegisterAll(registerer prometheus.Registerer, m any, logger *log.Logger) error {
+	// we go over all of them, use this to keep track of succeesses and failures
+	total := 0
+	succeeded := []string{}
+	failed := map[string]error{}
+
+	// we need to use reflection here to iterate over the public metric attributes
+	// that are contained in it
+	r := reflect.ValueOf(m)
+	if r.Kind() == reflect.Pointer {
+		r = r.Elem()
+	}
+
+	for i := 0; i < r.NumField(); i++ {
+		t := r.Type().Field(i)
+		n := t.Name // the name of the attribute (not the name of the metric)
+		f := r.Field(i)
+		if !f.CanInterface() {
+			continue // we won't be able to process that one, most probably because it's not exported
+		}
+		v := f.Interface()
+		switch c := v.(type) {
+		case prometheus.Collector:
+			total++
+			if err := registerer.Register(c); err != nil {
+				switch err.(type) {
+				case prometheus.AlreadyRegisteredError:
+					// silently ignore this error, as this case can happen when the suture service decides to restart
+					err = nil
+					succeeded = append(succeeded, n)
+				default:
+					failed[n] = err
+				}
+			} else {
+				succeeded = append(succeeded, n)
+
+				// special post-treatment for the BuildInfo metric, as we have that one pretty much
+				// everywhere: set its value with the current version so we don't need to do that every time
+				switch buildInfo := c.(type) {
+				case BuildInfoMetric:
+					if name, err := describe(buildInfo, func() error { buildInfo.WithLabelValues("0").Set(0.0); return nil }); err != nil {
+						failed[n] = err
+					} else if strings.HasSuffix(name, "_build_info") {
+						buildInfo.Reset()
+						buildInfo.WithLabelValues(version.GetString()).Set(1)
+					}
+				}
+			}
+		case *prometheus.Desc,
+			prometheus.GaugeOpts,
+			prometheus.CounterOpts,
+			prometheus.HistogramOpts,
+			prometheus.SummaryOpts,
+			prometheus.UntypedOpts:
+			// skip these
+		default:
+			failed[n] = fmt.Errorf("unsupported metric '%s' of type %T", n, c)
+		}
+	}
+	if len(failed) > 0 {
+		failedMsgs := []string{}
+		for name, err := range failed {
+			failedMsgs = append(failedMsgs, fmt.Sprintf("'%s' (%v)", name, err))
+		}
+		msg := strings.Join(failedMsgs, ", ")
+		if logger != nil {
+			logger.Warn().Msgf("registered %d/%d metrics successfully (%d failed): %s", len(succeeded), total, len(failed), msg)
+		}
+		return fmt.Errorf("failed to register metrics: %s", msg)
+	} else {
+		if logger != nil {
+			logger.Debug().Msgf("registered %d/%d metrics successfully (%d failed)", len(succeeded), total, len(failed))
+		}
+		return nil
+	}
+}
+
+// Register all the metrics that are contained as public attributes in the struct,
+// and log any errors that might occur while doing so.
+func Register[M any](reg prometheus.Registerer, m M, logger *log.Logger) (M, error) {
+	lr := NewLoggingPrometheusRegisterer(reg, logger)
+	err := RegisterAll(lr, m, logger)
+	return m, err
+}
+
+// Register a single metric.
+func RegisterMetric[M prometheus.Collector](reg prometheus.Registerer, m M, logger *log.Logger) error {
+	return NewLoggingPrometheusRegisterer(reg, logger).Register(m)
+}
+
+// Prometheus Registerer wrapper that logs every error that occurs when registering
+// a metric, and delegates to an actual Registerer.
+type LoggingPrometheusRegisterer struct {
+	delegate prometheus.Registerer
+	logger   *log.Logger
+}
+
+// Instantiate a Prometheus Registerer wrapper that logs every error that occurs when registering
+// a metric, and that delegates to an actual Registerer specified here.
+func NewLoggingPrometheusRegisterer(delegate prometheus.Registerer, logger *log.Logger) *LoggingPrometheusRegisterer {
+	return &LoggingPrometheusRegisterer{
+		delegate: delegate,
+		logger:   logger,
+	}
+}
+
+func (r *LoggingPrometheusRegisterer) Register(c prometheus.Collector) error {
+	err := r.delegate.Register(c)
+	if err != nil {
+		switch err.(type) {
+		case prometheus.AlreadyRegisteredError:
+			// silently ignore this error, as this case can happen when the suture service decides to restart
+			err = nil
+		default:
+			if r.logger != nil {
+				r.logger.Warn().Err(err).Msgf("failed to register metric")
+			}
+		}
+	}
+	return err
+}
+
+func (r *LoggingPrometheusRegisterer) MustRegister(collectors ...prometheus.Collector) {
+	for _, c := range collectors {
+		if err := r.Register(c); err != nil {
+			if r.logger != nil {
+				r.logger.Error().Err(err).Msg("failed to register metrics collector")
+			}
+		}
+	}
+}
+
+func (r *LoggingPrometheusRegisterer) Unregister(c prometheus.Collector) bool {
+	return r.delegate.Unregister(c)
+}
+
+var _ prometheus.Registerer = &LoggingPrometheusRegisterer{}

pkg/metrics/metrics_test.go

@@ -0,0 +1,153 @@
+package metrics
+
+import (
+	"fmt"
+	"math/rand/v2"
+	"testing"
+
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/pkg/version"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/require"
+)
+
+func randName() string {
+	const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
+	n := 8 + rand.IntN(33)
+	b := make([]byte, n)
+	for i := range b {
+		b[i] = letterBytes[rand.IntN(len(letterBytes))]
+	}
+	return string(b)
+}
+
+func TestBuildInfo(t *testing.T) {
+	require := require.New(t)
+
+	namespace := "name-" + randName()
+	subsystem := "sub-" + randName()
+	expectedName := fmt.Sprintf("%s_%s_build_info", namespace, subsystem)
+	version := fmt.Sprintf("%d.%d.%d", rand.IntN(10), rand.IntN(10), rand.IntN(10))
+
+	g := BuildInfo(namespace, subsystem)
+	reg := prometheus.NewRegistry()
+	require.NoError(reg.Register(g))
+
+	{
+		mfs, err := reg.Gather()
+		require.NoError(err)
+		require.Len(mfs, 0)
+	}
+
+	g.WithLabelValues(version).Set(1)
+	{
+		mfs, err := reg.Gather()
+		require.NoError(err)
+		found := false
+		for _, mf := range mfs {
+			if mf.GetName() == expectedName {
+				found = true
+				ms := mf.GetMetric()
+				require.Len(ms, 1)
+				labels := ms[0].GetLabel()
+				require.Len(labels, 1)
+				require.NotNil(labels[0].Name)
+				require.Equal("version", *labels[0].Name)
+				require.NotNil(labels[0].Value)
+				require.Equal(version, *labels[0].Value)
+				require.Equal(1.0, ms[0].GetGauge().GetValue())
+			} else {
+				t.Fatalf("unexpected metric family %q", mf.GetName())
+			}
+		}
+		require.True(found, "failed to find metric %q", expectedName)
+	}
+}
+
+func TestRegisterAll(t *testing.T) {
+	require := require.New(t)
+
+	reg := prometheus.NewRegistry()
+	logger := log.NewLogger()
+	namespace := "name-" + randName()
+	subsystem := "sub-" + randName()
+
+	m := struct {
+		BuildInfo *prometheus.GaugeVec
+		Foo       *prometheus.GaugeVec
+		Bar       prometheus.Counter
+	}{
+		BuildInfo: BuildInfo(namespace, subsystem),
+		Foo: prometheus.NewGaugeVec(prometheus.GaugeOpts{
+			Namespace: namespace,
+			Subsystem: subsystem,
+			Name:      "foo",
+			ConstLabels: prometheus.Labels{
+				"f":  "oo",
+				"fo": "o",
+			},
+		}, []string{"oof"}),
+		Bar: prometheus.NewCounter(prometheus.CounterOpts{
+			Namespace: namespace,
+			Subsystem: subsystem,
+			Name:      "bar",
+		}),
+	}
+
+	expectedNameForBuildInfo := namespace + "_" + subsystem + "_build_info"
+	expectedNameForFoo := namespace + "_" + subsystem + "_foo"
+	expectedNameForBar := namespace + "_" + subsystem + "_bar"
+
+	{
+		mfs, err := reg.Gather()
+		require.NoError(err)
+		require.Len(mfs, 0)
+	}
+	require.NoError(RegisterAll(reg, m, &logger))
+	{
+		mfs, err := reg.Gather()
+		require.NoError(err)
+		require.Len(mfs, 3)
+		found := 0
+		for _, mf := range mfs {
+			switch mf.GetName() {
+			case expectedNameForBuildInfo:
+				found++
+				ms := mf.GetMetric()
+				require.Len(ms, 1)
+				labels := ms[0].GetLabel()
+				require.Len(labels, 1)
+				require.NotNil(labels[0].Name)
+				require.Equal("version", *labels[0].Name)
+				require.NotNil(labels[0].Value)
+				require.Equal(version.GetString(), *labels[0].Value)
+				require.Equal(1.0, ms[0].GetGauge().GetValue())
+			case expectedNameForFoo:
+				found++
+				ms := mf.GetMetric()
+				require.Len(ms, 1)
+				labels := ms[0].GetLabel()
+				require.Len(labels, 3)
+				require.NotNil(labels[0].Name)
+				require.Equal("f", *labels[0].Name)
+				require.NotNil(labels[0].Value)
+				require.Equal("oo", *labels[0].Value)
+				require.NotNil(labels[1].Name)
+				require.Equal("fo", *labels[1].Name)
+				require.NotNil(labels[1].Value)
+				require.Equal("o", *labels[1].Value)
+				require.Equal(0.0, ms[0].GetGauge().GetValue())
+			case expectedNameForBar:
+				found++
+				ms := mf.GetMetric()
+				require.Len(ms, 1)
+				labels := ms[0].GetLabel()
+				require.Len(labels, 0)
+				require.Equal(0.0, ms[0].GetGauge().GetValue())
+			default:
+				t.Fatalf("unexpected metric family %q", mf.GetName())
+			}
+		}
+		require.Equal(3, found, "failed to find expected metrics")
+	}
+}

pkg/middleware/oidc.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"strings"
 	"sync"
@@ -61,7 +62,10 @@ func OidcAuth(opts ...Option) func(http.Handler) http.Handler {
 						provider, err = providerFunc()
 					}
 					initializeProviderLock.Unlock()
-					if err != nil {
+					if err != nil || provider == nil {
+						if err == nil {
+							err = errors.New("OIDC provider initialization returned nil")
+						}
 						opt.Logger.Error().Err(err).Msg("could not initialize OIDC provider")
 						w.WriteHeader(http.StatusInternalServerError)
 						return
@@ -82,6 +86,12 @@ func OidcAuth(opts ...Option) func(http.Handler) http.Handler {
 					w.WriteHeader(http.StatusUnauthorized)
 					return
 				}
+				if userInfo == nil {
+					opt.Logger.Error().Msg("OIDC provider returned empty user info")
+					w.Header().Add("WWW-Authenticate", `Bearer`)
+					w.WriteHeader(http.StatusUnauthorized)
+					return
+				}
 				claims := map[string]any{}
 				err = userInfo.Claims(&claims)
 				if err != nil {

pkg/shared/errors.go

@@ -101,3 +101,11 @@ func MissingURLSigningSecret(service string) error {
 		"the config/corresponding environment variable).",
 		service, defaults.BaseConfigPath())
 }
+
+func AllComponentsDisabledError(service string) error {
+	return fmt.Errorf("All request handlers and event consumers are disabled for %s; at least one component must be enabled."+
+		"Make sure your %s config contains the proper values "+
+		"(e.g. by using 'opencloud init --diff' and applying the patch or setting a value manually in "+
+		"the config/corresponding environment variable).", 
+		service, defaults.BaseConfigPath())
+}

pkg/shared/memlimit.go

@@ -9,7 +9,7 @@ import (
 // we init the memlimit here to include it for OpenCloud als well as individual service binaries
 func init() {
 	slog.SetLogLoggerLevel(slog.LevelError)
-	_, _ = memlimit.SetGoMemLimitWithOpts(
+	_, _ = memlimit.Set(
 		memlimit.WithLogger(slog.Default()),
 	)
 }

pkg/version/version.go

@@ -34,7 +34,7 @@ var (
 	// LatestTag is the latest released version plus the dev meta version.
 	// Will be overwritten by the release pipeline
 	// Needs a manual change for every tagged release
-	LatestTag = "7.4.0+dev"
+	LatestTag = "7.5.0+dev"
 
 	// Date indicates the build date.
 	// This has been removed, it looks like you can only replace static strings with recent go versions

protogen/gen/opencloud/messages/search/v0/search.pb.go

@@ -535,6 +535,267 @@ func (x *Photo) GetTakenDateTime() *timestamppb.Timestamp {
 	return nil
 }
 
+type Video struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AudioBitsPerSample    *int32   `protobuf:"varint,1,opt,name=audioBitsPerSample,proto3,oneof" json:"audioBitsPerSample,omitempty"`
+	AudioChannels         *int32   `protobuf:"varint,2,opt,name=audioChannels,proto3,oneof" json:"audioChannels,omitempty"`
+	AudioFormat           *string  `protobuf:"bytes,3,opt,name=audioFormat,proto3,oneof" json:"audioFormat,omitempty"`
+	AudioSamplesPerSecond *int32   `protobuf:"varint,4,opt,name=audioSamplesPerSecond,proto3,oneof" json:"audioSamplesPerSecond,omitempty"`
+	Bitrate               *int32   `protobuf:"varint,5,opt,name=bitrate,proto3,oneof" json:"bitrate,omitempty"`
+	Duration              *int64   `protobuf:"varint,6,opt,name=duration,proto3,oneof" json:"duration,omitempty"`
+	FourCC                *string  `protobuf:"bytes,7,opt,name=fourCC,proto3,oneof" json:"fourCC,omitempty"`
+	FrameRate             *float64 `protobuf:"fixed64,8,opt,name=frameRate,proto3,oneof" json:"frameRate,omitempty"`
+	Height                *int32   `protobuf:"varint,9,opt,name=height,proto3,oneof" json:"height,omitempty"`
+	Width                 *int32   `protobuf:"varint,10,opt,name=width,proto3,oneof" json:"width,omitempty"`
+}
+
+func (x *Video) Reset() {
+	*x = Video{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Video) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Video) ProtoMessage() {}
+
+func (x *Video) ProtoReflect() protoreflect.Message {
+	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Video.ProtoReflect.Descriptor instead.
+func (*Video) Descriptor() ([]byte, []int) {
+	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *Video) GetAudioBitsPerSample() int32 {
+	if x != nil && x.AudioBitsPerSample != nil {
+		return *x.AudioBitsPerSample
+	}
+	return 0
+}
+
+func (x *Video) GetAudioChannels() int32 {
+	if x != nil && x.AudioChannels != nil {
+		return *x.AudioChannels
+	}
+	return 0
+}
+
+func (x *Video) GetAudioFormat() string {
+	if x != nil && x.AudioFormat != nil {
+		return *x.AudioFormat
+	}
+	return ""
+}
+
+func (x *Video) GetAudioSamplesPerSecond() int32 {
+	if x != nil && x.AudioSamplesPerSecond != nil {
+		return *x.AudioSamplesPerSecond
+	}
+	return 0
+}
+
+func (x *Video) GetBitrate() int32 {
+	if x != nil && x.Bitrate != nil {
+		return *x.Bitrate
+	}
+	return 0
+}
+
+func (x *Video) GetDuration() int64 {
+	if x != nil && x.Duration != nil {
+		return *x.Duration
+	}
+	return 0
+}
+
+func (x *Video) GetFourCC() string {
+	if x != nil && x.FourCC != nil {
+		return *x.FourCC
+	}
+	return ""
+}
+
+func (x *Video) GetFrameRate() float64 {
+	if x != nil && x.FrameRate != nil {
+		return *x.FrameRate
+	}
+	return 0
+}
+
+func (x *Video) GetHeight() int32 {
+	if x != nil && x.Height != nil {
+		return *x.Height
+	}
+	return 0
+}
+
+func (x *Video) GetWidth() int32 {
+	if x != nil && x.Width != nil {
+		return *x.Width
+	}
+	return 0
+}
+
+type MotionPhoto struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version                 *int32 `protobuf:"varint,1,opt,name=version,proto3,oneof" json:"version,omitempty"`
+	PresentationTimestampUs *int64 `protobuf:"varint,2,opt,name=presentationTimestampUs,proto3,oneof" json:"presentationTimestampUs,omitempty"`
+	VideoSize               *int64 `protobuf:"varint,3,opt,name=videoSize,proto3,oneof" json:"videoSize,omitempty"`
+}
+
+func (x *MotionPhoto) Reset() {
+	*x = MotionPhoto{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MotionPhoto) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MotionPhoto) ProtoMessage() {}
+
+func (x *MotionPhoto) ProtoReflect() protoreflect.Message {
+	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MotionPhoto.ProtoReflect.Descriptor instead.
+func (*MotionPhoto) Descriptor() ([]byte, []int) {
+	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *MotionPhoto) GetVersion() int32 {
+	if x != nil && x.Version != nil {
+		return *x.Version
+	}
+	return 0
+}
+
+func (x *MotionPhoto) GetPresentationTimestampUs() int64 {
+	if x != nil && x.PresentationTimestampUs != nil {
+		return *x.PresentationTimestampUs
+	}
+	return 0
+}
+
+func (x *MotionPhoto) GetVideoSize() int64 {
+	if x != nil && x.VideoSize != nil {
+		return *x.VideoSize
+	}
+	return 0
+}
+
+type LivePhoto struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ContentId              *string  `protobuf:"bytes,1,opt,name=contentId,proto3,oneof" json:"contentId,omitempty"`
+	StillImageTimeUs       *int64   `protobuf:"varint,2,opt,name=stillImageTimeUs,proto3,oneof" json:"stillImageTimeUs,omitempty"`
+	Auto                   *bool    `protobuf:"varint,3,opt,name=auto,proto3,oneof" json:"auto,omitempty"`
+	VitalityScore          *float64 `protobuf:"fixed64,4,opt,name=vitalityScore,proto3,oneof" json:"vitalityScore,omitempty"`
+	VitalityScoringVersion *int64   `protobuf:"varint,5,opt,name=vitalityScoringVersion,proto3,oneof" json:"vitalityScoringVersion,omitempty"`
+}
+
+func (x *LivePhoto) Reset() {
+	*x = LivePhoto{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LivePhoto) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LivePhoto) ProtoMessage() {}
+
+func (x *LivePhoto) ProtoReflect() protoreflect.Message {
+	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LivePhoto.ProtoReflect.Descriptor instead.
+func (*LivePhoto) Descriptor() ([]byte, []int) {
+	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *LivePhoto) GetContentId() string {
+	if x != nil && x.ContentId != nil {
+		return *x.ContentId
+	}
+	return ""
+}
+
+func (x *LivePhoto) GetStillImageTimeUs() int64 {
+	if x != nil && x.StillImageTimeUs != nil {
+		return *x.StillImageTimeUs
+	}
+	return 0
+}
+
+func (x *LivePhoto) GetAuto() bool {
+	if x != nil && x.Auto != nil {
+		return *x.Auto
+	}
+	return false
+}
+
+func (x *LivePhoto) GetVitalityScore() float64 {
+	if x != nil && x.VitalityScore != nil {
+		return *x.VitalityScore
+	}
+	return 0
+}
+
+func (x *LivePhoto) GetVitalityScoringVersion() int64 {
+	if x != nil && x.VitalityScoringVersion != nil {
+		return *x.VitalityScoringVersion
+	}
+	return 0
+}
+
 type Entity struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -560,12 +821,15 @@ type Entity struct {
 	Image            *Image                 `protobuf:"bytes,18,opt,name=image,proto3" json:"image,omitempty"`
 	Photo            *Photo                 `protobuf:"bytes,19,opt,name=photo,proto3" json:"photo,omitempty"`
 	Favorites        []string               `protobuf:"bytes,20,rep,name=favorites,proto3" json:"favorites,omitempty"`
+	MotionPhoto      *MotionPhoto           `protobuf:"bytes,21,opt,name=motionPhoto,proto3" json:"motionPhoto,omitempty"`
+	Video            *Video                 `protobuf:"bytes,22,opt,name=video,proto3" json:"video,omitempty"`
+	LivePhoto        *LivePhoto             `protobuf:"bytes,23,opt,name=livePhoto,proto3" json:"livePhoto,omitempty"`
 }
 
 func (x *Entity) Reset() {
 	*x = Entity{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[6]
+		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -578,7 +842,7 @@ func (x *Entity) String() string {
 func (*Entity) ProtoMessage() {}
 
 func (x *Entity) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[6]
+	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -591,7 +855,7 @@ func (x *Entity) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Entity.ProtoReflect.Descriptor instead.
 func (*Entity) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{6}
+	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{9}
 }
 
 func (x *Entity) GetRef() *Reference {
@@ -734,6 +998,27 @@ func (x *Entity) GetFavorites() []string {
 	return nil
 }
 
+func (x *Entity) GetMotionPhoto() *MotionPhoto {
+	if x != nil {
+		return x.MotionPhoto
+	}
+	return nil
+}
+
+func (x *Entity) GetVideo() *Video {
+	if x != nil {
+		return x.Video
+	}
+	return nil
+}
+
+func (x *Entity) GetLivePhoto() *LivePhoto {
+	if x != nil {
+		return x.LivePhoto
+	}
+	return nil
+}
+
 type Match struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -748,7 +1033,7 @@ type Match struct {
 func (x *Match) Reset() {
 	*x = Match{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[7]
+		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -761,7 +1046,7 @@ func (x *Match) String() string {
 func (*Match) ProtoMessage() {}
 
 func (x *Match) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[7]
+	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -774,7 +1059,7 @@ func (x *Match) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Match.ProtoReflect.Descriptor instead.
 func (*Match) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{7}
+	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *Match) GetEntity() *Entity {
@@ -908,62 +1193,141 @@ var file_opencloud_messages_search_v0_search_proto_rawDesc = []byte{
 	0x6c, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x69, 0x73, 0x6f, 0x42,
 	0x0e, 0x0a, 0x0c, 0x5f, 0x6f, 0x72, 0x69, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42,
 	0x10, 0x0a, 0x0e, 0x5f, 0x74, 0x61, 0x6b, 0x65, 0x6e, 0x44, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d,
-	0x65, 0x22, 0xfa, 0x06, 0x0a, 0x06, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x39, 0x0a, 0x03,
-	0x72, 0x65, 0x66, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65, 0x6e,
-	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73,
-	0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e,
-	0x63, 0x65, 0x52, 0x03, 0x72, 0x65, 0x66, 0x12, 0x38, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x65, 0x22, 0x9b, 0x04, 0x0a, 0x05, 0x56, 0x69, 0x64, 0x65, 0x6f, 0x12, 0x33, 0x0a, 0x12, 0x61,
+	0x75, 0x64, 0x69, 0x6f, 0x42, 0x69, 0x74, 0x73, 0x50, 0x65, 0x72, 0x53, 0x61, 0x6d, 0x70, 0x6c,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x48, 0x00, 0x52, 0x12, 0x61, 0x75, 0x64, 0x69, 0x6f,
+	0x42, 0x69, 0x74, 0x73, 0x50, 0x65, 0x72, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x88, 0x01, 0x01,
+	0x12, 0x29, 0x0a, 0x0d, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x43, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c,
+	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x48, 0x01, 0x52, 0x0d, 0x61, 0x75, 0x64, 0x69, 0x6f,
+	0x43, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x73, 0x88, 0x01, 0x01, 0x12, 0x25, 0x0a, 0x0b, 0x61,
+	0x75, 0x64, 0x69, 0x6f, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x48, 0x02, 0x52, 0x0b, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x88,
+	0x01, 0x01, 0x12, 0x39, 0x0a, 0x15, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x53, 0x61, 0x6d, 0x70, 0x6c,
+	0x65, 0x73, 0x50, 0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x05, 0x48, 0x03, 0x52, 0x15, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65,
+	0x73, 0x50, 0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x88, 0x01, 0x01, 0x12, 0x1d, 0x0a,
+	0x07, 0x62, 0x69, 0x74, 0x72, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x05, 0x48, 0x04,
+	0x52, 0x07, 0x62, 0x69, 0x74, 0x72, 0x61, 0x74, 0x65, 0x88, 0x01, 0x01, 0x12, 0x1f, 0x0a, 0x08,
+	0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x48, 0x05,
+	0x52, 0x08, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x1b, 0x0a,
+	0x06, 0x66, 0x6f, 0x75, 0x72, 0x43, 0x43, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x06, 0x52,
+	0x06, 0x66, 0x6f, 0x75, 0x72, 0x43, 0x43, 0x88, 0x01, 0x01, 0x12, 0x21, 0x0a, 0x09, 0x66, 0x72,
+	0x61, 0x6d, 0x65, 0x52, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x01, 0x48, 0x07, 0x52,
+	0x09, 0x66, 0x72, 0x61, 0x6d, 0x65, 0x52, 0x61, 0x74, 0x65, 0x88, 0x01, 0x01, 0x12, 0x1b, 0x0a,
+	0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x48, 0x08, 0x52,
+	0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x88, 0x01, 0x01, 0x12, 0x19, 0x0a, 0x05, 0x77, 0x69,
+	0x64, 0x74, 0x68, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x05, 0x48, 0x09, 0x52, 0x05, 0x77, 0x69, 0x64,
+	0x74, 0x68, 0x88, 0x01, 0x01, 0x42, 0x15, 0x0a, 0x13, 0x5f, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x42,
+	0x69, 0x74, 0x73, 0x50, 0x65, 0x72, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x42, 0x10, 0x0a, 0x0e,
+	0x5f, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x43, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x73, 0x42, 0x0e,
+	0x0a, 0x0c, 0x5f, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x42, 0x18,
+	0x0a, 0x16, 0x5f, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x73, 0x50,
+	0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x62, 0x69, 0x74,
+	0x72, 0x61, 0x74, 0x65, 0x42, 0x0b, 0x0a, 0x09, 0x5f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x66, 0x6f, 0x75, 0x72, 0x43, 0x43, 0x42, 0x0c, 0x0a, 0x0a,
+	0x5f, 0x66, 0x72, 0x61, 0x6d, 0x65, 0x52, 0x61, 0x74, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x68,
+	0x65, 0x69, 0x67, 0x68, 0x74, 0x42, 0x08, 0x0a, 0x06, 0x5f, 0x77, 0x69, 0x64, 0x74, 0x68, 0x22,
+	0xc4, 0x01, 0x0a, 0x0b, 0x4d, 0x6f, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x12,
+	0x1d, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05,
+	0x48, 0x00, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x3d,
+	0x0a, 0x17, 0x70, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x55, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x48,
+	0x01, 0x52, 0x17, 0x70, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x55, 0x73, 0x88, 0x01, 0x01, 0x12, 0x21, 0x0a,
+	0x09, 0x76, 0x69, 0x64, 0x65, 0x6f, 0x53, 0x69, 0x7a, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
+	0x48, 0x02, 0x52, 0x09, 0x76, 0x69, 0x64, 0x65, 0x6f, 0x53, 0x69, 0x7a, 0x65, 0x88, 0x01, 0x01,
+	0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x1a, 0x0a, 0x18,
+	0x5f, 0x70, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x55, 0x73, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x76, 0x69, 0x64,
+	0x65, 0x6f, 0x53, 0x69, 0x7a, 0x65, 0x22, 0xb9, 0x02, 0x0a, 0x09, 0x4c, 0x69, 0x76, 0x65, 0x50,
+	0x68, 0x6f, 0x74, 0x6f, 0x12, 0x21, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x49,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x74, 0x65,
+	0x6e, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x2f, 0x0a, 0x10, 0x73, 0x74, 0x69, 0x6c, 0x6c,
+	0x49, 0x6d, 0x61, 0x67, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x55, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x03, 0x48, 0x01, 0x52, 0x10, 0x73, 0x74, 0x69, 0x6c, 0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x54,
+	0x69, 0x6d, 0x65, 0x55, 0x73, 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x6f,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x48, 0x02, 0x52, 0x04, 0x61, 0x75, 0x74, 0x6f, 0x88, 0x01,
+	0x01, 0x12, 0x29, 0x0a, 0x0d, 0x76, 0x69, 0x74, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f,
+	0x72, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x01, 0x48, 0x03, 0x52, 0x0d, 0x76, 0x69, 0x74, 0x61,
+	0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x88, 0x01, 0x01, 0x12, 0x3b, 0x0a, 0x16,
+	0x76, 0x69, 0x74, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x56,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x48, 0x04, 0x52, 0x16,
+	0x76, 0x69, 0x74, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x56,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x63, 0x6f,
+	0x6e, 0x74, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x73, 0x74, 0x69, 0x6c,
+	0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x55, 0x73, 0x42, 0x07, 0x0a, 0x05,
+	0x5f, 0x61, 0x75, 0x74, 0x6f, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x76, 0x69, 0x74, 0x61, 0x6c, 0x69,
+	0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x42, 0x19, 0x0a, 0x17, 0x5f, 0x76, 0x69, 0x74, 0x61,
+	0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x22, 0xc9, 0x08, 0x0a, 0x06, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x39, 0x0a,
+	0x03, 0x72, 0x65, 0x66, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65,
+	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e,
+	0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65,
+	0x6e, 0x63, 0x65, 0x52, 0x03, 0x72, 0x65, 0x66, 0x12, 0x38, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68,
+	0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x65, 0x74, 0x61, 0x67, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x65, 0x74, 0x61, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69,
+	0x7a, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x48,
+	0x0a, 0x12, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f,
+	0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x6c, 0x61, 0x73, 0x74, 0x4d, 0x6f, 0x64, 0x69,
+	0x66, 0x69, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x69, 0x6d, 0x65,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x69, 0x6d,
+	0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x65, 0x72, 0x6d,
+	0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x64,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x64, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x64, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x72, 0x65, 0x52, 0x6f,
+	0x6f, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x68,
+	0x61, 0x72, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x45, 0x0a, 0x09, 0x70,
+	0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28,
+	0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x08, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74,
+	0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x68, 0x69, 0x67, 0x68, 0x6c, 0x69,
+	0x67, 0x68, 0x74, 0x73, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x69, 0x67, 0x68,
+	0x6c, 0x69, 0x67, 0x68, 0x74, 0x73, 0x12, 0x39, 0x0a, 0x05, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x18,
+	0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
+	0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63,
+	0x68, 0x2e, 0x76, 0x30, 0x2e, 0x41, 0x75, 0x64, 0x69, 0x6f, 0x52, 0x05, 0x61, 0x75, 0x64, 0x69,
+	0x6f, 0x12, 0x48, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x10, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
+	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e,
+	0x76, 0x30, 0x2e, 0x47, 0x65, 0x6f, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65,
+	0x73, 0x52, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4e, 0x0a, 0x0e, 0x72,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x69, 0x74, 0x65, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x11, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
 	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e,
-	0x76, 0x30, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x65, 0x74, 0x61, 0x67, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x04, 0x65, 0x74, 0x61, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a,
-	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x48, 0x0a,
-	0x12, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x74,
-	0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
-	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
-	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x6c, 0x61, 0x73, 0x74, 0x4d, 0x6f, 0x64, 0x69, 0x66,
-	0x69, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x69, 0x6d, 0x65, 0x5f,
-	0x74, 0x79, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x69, 0x6d, 0x65,
-	0x54, 0x79, 0x70, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x64, 0x65, 0x6c,
-	0x65, 0x74, 0x65, 0x64, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x72, 0x65, 0x52, 0x6f, 0x6f,
-	0x74, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x68, 0x61,
-	0x72, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x45, 0x0a, 0x09, 0x70, 0x61,
-	0x72, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e,
-	0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x08, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x49,
-	0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x68, 0x69, 0x67, 0x68, 0x6c, 0x69, 0x67,
-	0x68, 0x74, 0x73, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x69, 0x67, 0x68, 0x6c,
-	0x69, 0x67, 0x68, 0x74, 0x73, 0x12, 0x39, 0x0a, 0x05, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x18, 0x0f,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x76, 0x30, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x0c, 0x72,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x05, 0x69,
+	0x6d, 0x61, 0x67, 0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65,
+	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e,
+	0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52,
+	0x05, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x39, 0x0a, 0x05, 0x70, 0x68, 0x6f, 0x74, 0x6f, 0x18,
+	0x13, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
+	0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63,
+	0x68, 0x2e, 0x76, 0x30, 0x2e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x52, 0x05, 0x70, 0x68, 0x6f, 0x74,
+	0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x66, 0x61, 0x76, 0x6f, 0x72, 0x69, 0x74, 0x65, 0x73, 0x18, 0x14,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x66, 0x61, 0x76, 0x6f, 0x72, 0x69, 0x74, 0x65, 0x73, 0x12,
+	0x4b, 0x0a, 0x0b, 0x6d, 0x6f, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x18, 0x15,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
 	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68,
-	0x2e, 0x76, 0x30, 0x2e, 0x41, 0x75, 0x64, 0x69, 0x6f, 0x52, 0x05, 0x61, 0x75, 0x64, 0x69, 0x6f,
-	0x12, 0x48, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x10, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76,
-	0x30, 0x2e, 0x47, 0x65, 0x6f, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x73,
-	0x52, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4e, 0x0a, 0x0e, 0x72, 0x65,
-	0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x69, 0x74, 0x65, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x11, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76,
-	0x30, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x0c, 0x72, 0x65,
-	0x6d, 0x6f, 0x74, 0x65, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x05, 0x69, 0x6d,
-	0x61, 0x67, 0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e,
-	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73,
-	0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x05,
-	0x69, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x39, 0x0a, 0x05, 0x70, 0x68, 0x6f, 0x74, 0x6f, 0x18, 0x13,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
-	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68,
-	0x2e, 0x76, 0x30, 0x2e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x52, 0x05, 0x70, 0x68, 0x6f, 0x74, 0x6f,
-	0x12, 0x1c, 0x0a, 0x09, 0x66, 0x61, 0x76, 0x6f, 0x72, 0x69, 0x74, 0x65, 0x73, 0x18, 0x14, 0x20,
-	0x03, 0x28, 0x09, 0x52, 0x09, 0x66, 0x61, 0x76, 0x6f, 0x72, 0x69, 0x74, 0x65, 0x73, 0x22, 0x5b,
+	0x2e, 0x76, 0x30, 0x2e, 0x4d, 0x6f, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x52,
+	0x0b, 0x6d, 0x6f, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x12, 0x39, 0x0a, 0x05,
+	0x76, 0x69, 0x64, 0x65, 0x6f, 0x18, 0x16, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70,
+	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73,
+	0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x56, 0x69, 0x64, 0x65, 0x6f,
+	0x52, 0x05, 0x76, 0x69, 0x64, 0x65, 0x6f, 0x12, 0x45, 0x0a, 0x09, 0x6c, 0x69, 0x76, 0x65, 0x50,
+	0x68, 0x6f, 0x74, 0x6f, 0x18, 0x17, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65,
+	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e,
+	0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x4c, 0x69, 0x76, 0x65, 0x50, 0x68,
+	0x6f, 0x74, 0x6f, 0x52, 0x09, 0x6c, 0x69, 0x76, 0x65, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x22, 0x5b,
 	0x0a, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x3c, 0x0a, 0x06, 0x65, 0x6e, 0x74, 0x69, 0x74,
 	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c,
 	0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61,
@@ -990,7 +1354,7 @@ func file_opencloud_messages_search_v0_search_proto_rawDescGZIP() []byte {
 	return file_opencloud_messages_search_v0_search_proto_rawDescData
 }
 
-var file_opencloud_messages_search_v0_search_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_opencloud_messages_search_v0_search_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
 var file_opencloud_messages_search_v0_search_proto_goTypes = []interface{}{
 	(*ResourceID)(nil),            // 0: opencloud.messages.search.v0.ResourceID
 	(*Reference)(nil),             // 1: opencloud.messages.search.v0.Reference
@@ -998,28 +1362,34 @@ var file_opencloud_messages_search_v0_search_proto_goTypes = []interface{}{
 	(*Image)(nil),                 // 3: opencloud.messages.search.v0.Image
 	(*GeoCoordinates)(nil),        // 4: opencloud.messages.search.v0.GeoCoordinates
 	(*Photo)(nil),                 // 5: opencloud.messages.search.v0.Photo
-	(*Entity)(nil),                // 6: opencloud.messages.search.v0.Entity
-	(*Match)(nil),                 // 7: opencloud.messages.search.v0.Match
-	(*timestamppb.Timestamp)(nil), // 8: google.protobuf.Timestamp
+	(*Video)(nil),                 // 6: opencloud.messages.search.v0.Video
+	(*MotionPhoto)(nil),           // 7: opencloud.messages.search.v0.MotionPhoto
+	(*LivePhoto)(nil),             // 8: opencloud.messages.search.v0.LivePhoto
+	(*Entity)(nil),                // 9: opencloud.messages.search.v0.Entity
+	(*Match)(nil),                 // 10: opencloud.messages.search.v0.Match
+	(*timestamppb.Timestamp)(nil), // 11: google.protobuf.Timestamp
 }
 var file_opencloud_messages_search_v0_search_proto_depIdxs = []int32{
 	0,  // 0: opencloud.messages.search.v0.Reference.resource_id:type_name -> opencloud.messages.search.v0.ResourceID
-	8,  // 1: opencloud.messages.search.v0.Photo.takenDateTime:type_name -> google.protobuf.Timestamp
+	11, // 1: opencloud.messages.search.v0.Photo.takenDateTime:type_name -> google.protobuf.Timestamp
 	1,  // 2: opencloud.messages.search.v0.Entity.ref:type_name -> opencloud.messages.search.v0.Reference
 	0,  // 3: opencloud.messages.search.v0.Entity.id:type_name -> opencloud.messages.search.v0.ResourceID
-	8,  // 4: opencloud.messages.search.v0.Entity.last_modified_time:type_name -> google.protobuf.Timestamp
+	11, // 4: opencloud.messages.search.v0.Entity.last_modified_time:type_name -> google.protobuf.Timestamp
 	0,  // 5: opencloud.messages.search.v0.Entity.parent_id:type_name -> opencloud.messages.search.v0.ResourceID
 	2,  // 6: opencloud.messages.search.v0.Entity.audio:type_name -> opencloud.messages.search.v0.Audio
 	4,  // 7: opencloud.messages.search.v0.Entity.location:type_name -> opencloud.messages.search.v0.GeoCoordinates
 	0,  // 8: opencloud.messages.search.v0.Entity.remote_item_id:type_name -> opencloud.messages.search.v0.ResourceID
 	3,  // 9: opencloud.messages.search.v0.Entity.image:type_name -> opencloud.messages.search.v0.Image
 	5,  // 10: opencloud.messages.search.v0.Entity.photo:type_name -> opencloud.messages.search.v0.Photo
-	6,  // 11: opencloud.messages.search.v0.Match.entity:type_name -> opencloud.messages.search.v0.Entity
-	12, // [12:12] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	7,  // 11: opencloud.messages.search.v0.Entity.motionPhoto:type_name -> opencloud.messages.search.v0.MotionPhoto
+	6,  // 12: opencloud.messages.search.v0.Entity.video:type_name -> opencloud.messages.search.v0.Video
+	8,  // 13: opencloud.messages.search.v0.Entity.livePhoto:type_name -> opencloud.messages.search.v0.LivePhoto
+	9,  // 14: opencloud.messages.search.v0.Match.entity:type_name -> opencloud.messages.search.v0.Entity
+	15, // [15:15] is the sub-list for method output_type
+	15, // [15:15] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	15, // [15:15] is the sub-list for extension extendee
+	0,  // [0:15] is the sub-list for field type_name
 }
 
 func init() { file_opencloud_messages_search_v0_search_proto_init() }
@@ -1101,7 +1471,7 @@ func file_opencloud_messages_search_v0_search_proto_init() {
 			}
 		}
 		file_opencloud_messages_search_v0_search_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Entity); i {
+			switch v := v.(*Video); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1113,6 +1483,42 @@ func file_opencloud_messages_search_v0_search_proto_init() {
 			}
 		}
 		file_opencloud_messages_search_v0_search_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MotionPhoto); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opencloud_messages_search_v0_search_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LivePhoto); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opencloud_messages_search_v0_search_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Entity); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opencloud_messages_search_v0_search_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Match); i {
 			case 0:
 				return &v.state
@@ -1129,13 +1535,16 @@ func file_opencloud_messages_search_v0_search_proto_init() {
 	file_opencloud_messages_search_v0_search_proto_msgTypes[3].OneofWrappers = []interface{}{}
 	file_opencloud_messages_search_v0_search_proto_msgTypes[4].OneofWrappers = []interface{}{}
 	file_opencloud_messages_search_v0_search_proto_msgTypes[5].OneofWrappers = []interface{}{}
+	file_opencloud_messages_search_v0_search_proto_msgTypes[6].OneofWrappers = []interface{}{}
+	file_opencloud_messages_search_v0_search_proto_msgTypes[7].OneofWrappers = []interface{}{}
+	file_opencloud_messages_search_v0_search_proto_msgTypes[8].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_opencloud_messages_search_v0_search_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   8,
+			NumMessages:   11,
 			NumExtensions: 0,
 			NumServices:   0,
 		},

protogen/gen/opencloud/messages/search/v0/search.pb.web.go

@@ -226,6 +226,42 @@ func (m *Photo) UnmarshalJSON(b []byte) error {
 
 var _ json.Unmarshaler = (*Photo)(nil)
 
+// VideoJSONMarshaler describes the default jsonpb.Marshaler used by all
+// instances of Video. This struct is safe to replace or modify but
+// should not be done so concurrently.
+var VideoJSONMarshaler = new(jsonpb.Marshaler)
+
+// MarshalJSON satisfies the encoding/json Marshaler interface. This method
+// uses the more correct jsonpb package to correctly marshal the message.
+func (m *Video) MarshalJSON() ([]byte, error) {
+	if m == nil {
+		return json.Marshal(nil)
+	}
+
+	buf := &bytes.Buffer{}
+
+	if err := VideoJSONMarshaler.Marshal(buf, m); err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+var _ json.Marshaler = (*Video)(nil)
+
+// VideoJSONUnmarshaler describes the default jsonpb.Unmarshaler used by all
+// instances of Video. This struct is safe to replace or modify but
+// should not be done so concurrently.
+var VideoJSONUnmarshaler = new(jsonpb.Unmarshaler)
+
+// UnmarshalJSON satisfies the encoding/json Unmarshaler interface. This method
+// uses the more correct jsonpb package to correctly unmarshal the message.
+func (m *Video) UnmarshalJSON(b []byte) error {
+	return VideoJSONUnmarshaler.Unmarshal(bytes.NewReader(b), m)
+}
+
+var _ json.Unmarshaler = (*Video)(nil)
+
 // EntityJSONMarshaler describes the default jsonpb.Marshaler used by all
 // instances of Entity. This struct is safe to replace or modify but
 // should not be done so concurrently.

protogen/gen/opencloud/services/search/v0/search.swagger.json

@@ -298,6 +298,15 @@
           "items": {
             "type": "string"
           }
+        },
+        "motionPhoto": {
+          "$ref": "#/definitions/v0MotionPhoto"
+        },
+        "video": {
+          "$ref": "#/definitions/v0Video"
+        },
+        "livePhoto": {
+          "$ref": "#/definitions/v0LivePhoto"
         }
       }
     },
@@ -376,6 +385,29 @@
         }
       }
     },
+    "v0LivePhoto": {
+      "type": "object",
+      "properties": {
+        "contentId": {
+          "type": "string"
+        },
+        "stillImageTimeUs": {
+          "type": "string",
+          "format": "int64"
+        },
+        "auto": {
+          "type": "boolean"
+        },
+        "vitalityScore": {
+          "type": "number",
+          "format": "double"
+        },
+        "vitalityScoringVersion": {
+          "type": "string",
+          "format": "int64"
+        }
+      }
+    },
     "v0Match": {
       "type": "object",
       "properties": {
@@ -390,6 +422,23 @@
         }
       }
     },
+    "v0MotionPhoto": {
+      "type": "object",
+      "properties": {
+        "version": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "presentationTimestampUs": {
+          "type": "string",
+          "format": "int64"
+        },
+        "videoSize": {
+          "type": "string",
+          "format": "int64"
+        }
+      }
+    },
     "v0Photo": {
       "type": "object",
       "properties": {
@@ -531,6 +580,49 @@
           "format": "int32"
         }
       }
+    },
+    "v0Video": {
+      "type": "object",
+      "properties": {
+        "audioBitsPerSample": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "audioChannels": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "audioFormat": {
+          "type": "string"
+        },
+        "audioSamplesPerSecond": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "bitrate": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "duration": {
+          "type": "string",
+          "format": "int64"
+        },
+        "fourCC": {
+          "type": "string"
+        },
+        "frameRate": {
+          "type": "number",
+          "format": "double"
+        },
+        "height": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "width": {
+          "type": "integer",
+          "format": "int32"
+        }
+      }
     }
   },
   "externalDocs": {

protogen/proto/opencloud/messages/search/v0/search.proto

@@ -59,6 +59,33 @@ message Photo {
 	optional google.protobuf.Timestamp takenDateTime = 9;
 }
 
+message Video {
+	optional int32 audioBitsPerSample = 1;
+	optional int32 audioChannels = 2;
+	optional string audioFormat = 3;
+	optional int32 audioSamplesPerSecond = 4;
+	optional int32 bitrate = 5;
+	optional int64 duration = 6;
+	optional string fourCC = 7;
+	optional double frameRate = 8;
+	optional int32 height = 9;
+	optional int32 width = 10;
+}
+
+message MotionPhoto {
+	optional int32 version = 1;
+	optional int64 presentationTimestampUs = 2;
+	optional int64 videoSize = 3;
+}
+
+message LivePhoto {
+	optional string contentId = 1;
+	optional int64 stillImageTimeUs = 2;
+	optional bool auto = 3;
+	optional double vitalityScore = 4;
+	optional int64 vitalityScoringVersion = 5;
+}
+
 message Entity {
 	Reference ref = 1;
 	ResourceID id = 2;
@@ -80,6 +107,9 @@ message Entity {
 	Image image = 18;
 	Photo photo = 19;
 	repeated string favorites = 20;
+	MotionPhoto motionPhoto = 21;
+	Video video = 22;
+	LivePhoto livePhoto = 23;
 }
 
 message Match {

services/activitylog/pkg/command/server.go

@@ -3,17 +3,18 @@ package command
 import (
 	"context"
 	"fmt"
+	"strings"
 
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	"github.com/opencloud-eu/opencloud/pkg/runner"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/nats-io/nats.go"
+	"github.com/olekukonko/errors"
 	"github.com/spf13/cobra"
 
 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	"github.com/opencloud-eu/opencloud/pkg/generators"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	natspkg "github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/registry"
+	"github.com/opencloud-eu/opencloud/pkg/runner"
 	ogrpc "github.com/opencloud-eu/opencloud/pkg/service/grpc"
 	"github.com/opencloud-eu/opencloud/pkg/tracing"
 	"github.com/opencloud-eu/opencloud/pkg/version"
@@ -24,6 +25,12 @@ import (
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/metrics"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/server/debug"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/server/http"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	svcEvents "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events"
+	svcHttp "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
 )
 
 var _registeredEvents = []events.Unmarshaller{
@@ -62,19 +69,11 @@ func Server(cfg *config.Config) *cobra.Command {
 
 			gr := runner.NewGroup()
 			ctx, cancel := context.WithCancel(cmd.Context())
+			defer cancel()
 
 			mtrcs := metrics.New()
 			mtrcs.BuildInfo.WithLabelValues(version.GetString()).Set(1)
 
-			defer cancel()
-
-			connName := generators.GenerateConnectionName(cfg.Service.Name, generators.NTypeBus)
-			evStream, err := stream.NatsFromConfig(connName, false, stream.NatsConfig(cfg.Events))
-			if err != nil {
-				logger.Error().Err(err).Msg("Failed to initialize event stream")
-				return err
-			}
-
 			tm, err := pool.StringToTLSMode(cfg.GRPCClientTLS.Mode)
 			if err != nil {
 				logger.Error().Err(err).Msg("Failed to parse tls mode")
@@ -99,28 +98,101 @@ func Server(cfg *config.Config) *cobra.Command {
 				return err
 			}
 
-			hClient := ehsvc.NewEventHistoryService("eu.opencloud.api.eventhistory", grpcClient)
-			vClient := settingssvc.NewValueService("eu.opencloud.api.settings", grpcClient)
+			kv, err := ConnectNatsKV(cfg.Store)
+			if err != nil {
+				return err
+			}
+			activityLog, err := activitylog.New(kv,
+				activitylog.Logger(logger),
+				activitylog.MaxActivities(cfg.MaxActivities),
+				activitylog.WriteBufferDuration(cfg.WriteBufferDuration),
+			)
+			if err != nil {
+				logger.Error().Err(err).Msg("Failed to initialize activity log")
+				return err
+			}
 
-			{
-				svc, err := http.Server(
-					http.Logger(logger),
-					http.Config(cfg),
-					http.Context(ctx), // NOTE: not passing this "option" leads to a panic in go-micro
-					http.TraceProvider(tracerProvider),
-					http.Stream(evStream),
-					http.GatewaySelector(gatewaySelector),
-					http.HistoryClient(hClient),
-					http.ValueClient(vClient),
-					http.RegisteredEvents(_registeredEvents),
+			if !cfg.HTTP.Disabled {
+
+				hClient := ehsvc.NewEventHistoryService("eu.opencloud.api.eventhistory", grpcClient)
+
+				svc, err := svcHttp.New(
+					activityLog,
+					svcHttp.Logger(logger),
+					svcHttp.GatewaySelector(gatewaySelector),
+					svcHttp.RegisteredEvents(_registeredEvents),
+					//svcHttp.TraceProvider(tracerProvider),
+					svcHttp.HistoryClient(hClient),
 				)
-
 				if err != nil {
-					logger.Error().Err(err).Str("transport", "http").Msg("Failed to initialize server")
+					logger.Error().Err(err).Msg("handler init")
+					return err
+				}
+				// TODO svc = service.NewInstrument(svc, metrics)
+				// TODO svc = service.NewLogging(svc, logger) // this logs service specific data
+				// TODO svc = service.NewTracing(svc, traceProvider)
+				vClient := settingssvc.NewValueService("eu.opencloud.api.settings", grpcClient)
+
+				server, err := http.Server(
+					http.ValueClient(vClient),
+					http.Logger(logger),
+					http.Context(ctx),
+					http.Config(cfg),
+					http.Service(svc),
+				)
+				if err != nil {
+					logger.Info().
+						Err(err).
+						Str("transport", "http").
+						Msg("Failed to initialize server")
+
 					return err
 				}
 
-				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", svc))
+				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", server))
+			} else {
+				logger.Info().Msg("HTTP server disabled, not starting HTTP service")
+			}
+
+			if !cfg.Events.Disabled {
+
+				connName := generators.GenerateConnectionName(cfg.Service.Name, generators.NTypeBus)
+				evStream, err := stream.NatsFromConfig(connName, false, stream.NatsConfig{
+					Endpoint:             cfg.Events.Endpoint,
+					Cluster:              cfg.Events.Cluster,
+					EnableTLS:            cfg.Events.EnableTLS,
+					TLSInsecure:          cfg.Events.TLSInsecure,
+					TLSRootCACertificate: cfg.Events.TLSRootCACertificate,
+					AuthUsername:         cfg.Events.AuthUsername,
+					AuthPassword:         cfg.Events.AuthPassword,
+				})
+				if err != nil {
+					logger.Error().Err(err).Msg("Failed to initialize event stream")
+					return err
+				}
+
+				eventSvc, err := svcEvents.New(
+					activityLog,
+					evStream,
+					svcEvents.Context(ctx),
+					svcEvents.Logger(logger),
+					svcEvents.ServiceAccount(cfg.ServiceAccount),
+					svcEvents.GatewaySelector(gatewaySelector),
+					svcEvents.RegisteredEvents(_registeredEvents),
+					svcEvents.NumConsumers(cfg.NumConsumers),
+				)
+				if err != nil {
+					logger.Error().Err(err).Str("transport", "event").Msg("Failed to initialize server")
+					return err
+				}
+
+				gr.Add(runner.New(cfg.Service.Name+".svc", func() error {
+					return eventSvc.Run()
+				}, func() {
+					eventSvc.Close()
+				}))
+			} else {
+				logger.Info().Msg("event listening disabled, not starting event service")
 			}
 
 			{
@@ -149,3 +221,33 @@ func Server(cfg *config.Config) *cobra.Command {
 		},
 	}
 }
+
+func ConnectNatsKV(cfg config.Store) (nats.KeyValue, error) {
+	// Connect to NATS servers
+	secureOption := natspkg.Secure(cfg.EnableTLS, cfg.TLSInsecure, cfg.TLSRootCACertificate)
+	conn, err := nats.Connect(strings.Join(cfg.Nodes, ","), secureOption, nats.UserInfo(cfg.AuthUsername, cfg.AuthPassword))
+	if err != nil {
+		return nil, err
+	}
+
+	js, err := conn.JetStream()
+	if err != nil {
+		return nil, err
+	}
+
+	kv, err := js.KeyValue(cfg.Database)
+	if err != nil {
+		if !errors.Is(err, nats.ErrBucketNotFound) {
+			return nil, errors.Wrapf(err, "Failed to get bucket (%s)", cfg.Database)
+		}
+
+		kv, err = js.CreateKeyValue(&nats.KeyValueConfig{
+			Bucket: cfg.Database,
+		})
+		if err != nil {
+			return nil, errors.Wrapf(err, "Failed to create bucket (%s)", cfg.Database)
+		}
+	}
+
+	return kv, nil
+}

services/activitylog/pkg/config/config.go

@@ -35,10 +35,12 @@ type Config struct {
 
 	WriteBufferDuration time.Duration `yaml:"write_buffer_duration" env:"ACTIVITYLOG_WRITE_BUFFER_DURATION" desc:"The duration to wait before flushing the write buffer. This is used to reduce the number of writes to the store." introductionVersion:"4.0.0"`
 	MaxActivities       int           `yaml:"max_activities" env:"ACTIVITYLOG_MAX_ACTIVITIES" desc:"The maximum number of activities to keep in the store per resource. If the number of activities exceeds this value, the oldest activities will be removed." introductionVersion:"4.0.0"`
+	NumConsumers        int           `yaml:"num_consumers" env:"ACTIVITYLOG_NUM_CONSUMERS" desc:"The amount of concurrent event consumers to start. Event consumers are used for updating the list of activities. Multiple consumers increase parallelisation, but will also increase CPU and memory demands." introductionVersion:"%NEXT%"`
 }
 
 // Events combines the configuration options for the event bus.
 type Events struct {
+	Disabled             bool   `yaml:"disabled" env:"ACTIVITYLOG_EVENTS_DISABLED" desc:"Disables listening for events. Set this to true if the service should only handle HTTP requests." introductionVersion:"%NEXT%"`
 	Endpoint             string `yaml:"endpoint" env:"OC_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture." introductionVersion:"1.0.0"`
 	Cluster              string `yaml:"cluster" env:"OC_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system." introductionVersion:"1.0.0"`
 	TLSInsecure          bool   `yaml:"tls_insecure" env:"OC_INSECURE;OC_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"1.0.0"`
@@ -77,6 +79,7 @@ type CORS struct {
 
 // HTTP defines the available http configuration.
 type HTTP struct {
+	Disabled  bool                  `yaml:"disabled" env:"ACTIVITYLOG_HTTP_DISABLED" desc:"Disables the HTTP service. Set this to true if the service should only handle events." introductionVersion:"1.0.0"`
 	Addr      string                `yaml:"addr" env:"ACTIVITYLOG_HTTP_ADDR" desc:"The bind address of the HTTP service." introductionVersion:"1.0.0"`
 	Namespace string                `yaml:"-"`
 	Root      string                `yaml:"root" env:"ACTIVITYLOG_HTTP_ROOT" desc:"Subdirectory that serves as the root for this HTTP service." introductionVersion:"1.0.0"`

services/activitylog/pkg/config/defaults/defaultconfig.go

@@ -52,7 +52,9 @@ func DefaultConfig() *config.Config {
 			},
 		},
 		WriteBufferDuration: 10 * time.Second,
-		MaxActivities:       6000,
+		// Nats runs into max payload exceeded errors at around 7k activities. Let's keep a buffer.
+		MaxActivities: 6000,
+		NumConsumers:  1,
 	}
 }
 

services/activitylog/pkg/config/parser/parse.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 
 	occfg "github.com/opencloud-eu/opencloud/pkg/config"
+	"github.com/opencloud-eu/opencloud/pkg/shared"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config/defaults"
 
@@ -34,5 +35,8 @@ func ParseConfig(cfg *config.Config) error {
 
 // Validate validates the config
 func Validate(cfg *config.Config) error {
+	if cfg.Events.Disabled && cfg.HTTP.Disabled {
+		return shared.AllComponentsDisabledError(cfg.Service.Name)
+	}
 	return nil
 }

services/activitylog/pkg/server/http/l10n/locale/ca/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Ivan Fustero, 2025\n"
 "Language-Team: Catalan (https://app.transifex.com/opencloud-eu/teams/204053/ca/)\n"

services/activitylog/pkg/server/http/l10n/locale/de/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Jörn Friedrich Dreyer <jfd@butonic.de>, 2025\n"
 "Language-Team: German (https://app.transifex.com/opencloud-eu/teams/204053/de/)\n"

services/activitylog/pkg/server/http/l10n/locale/el/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Efstathios Iosifidis <eiosifidis@gmail.com>, 2026\n"
 "Language-Team: Greek (https://app.transifex.com/opencloud-eu/teams/204053/el/)\n"

services/activitylog/pkg/server/http/l10n/locale/es/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Elías Martín, 2025\n"
 "Language-Team: Spanish (https://app.transifex.com/opencloud-eu/teams/204053/es/)\n"

services/activitylog/pkg/server/http/l10n/locale/fi/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Jiri Grönroos <jiri.gronroos@iki.fi>, 2025\n"
 "Language-Team: Finnish (https://app.transifex.com/opencloud-eu/teams/204053/fi/)\n"

services/activitylog/pkg/server/http/l10n/locale/fr/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: eric_G <junk.eg@free.fr>, 2025\n"
 "Language-Team: French (https://app.transifex.com/opencloud-eu/teams/204053/fr/)\n"

services/activitylog/pkg/server/http/l10n/locale/hu/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: mitibor, 2026\n"
 "Language-Team: Hungarian (https://app.transifex.com/opencloud-eu/teams/204053/hu/)\n"

services/activitylog/pkg/server/http/l10n/locale/it/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Simone Broglia, 2025\n"
 "Language-Team: Italian (https://app.transifex.com/opencloud-eu/teams/204053/it/)\n"

services/activitylog/pkg/server/http/l10n/locale/ja/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: iikaka88, 2025\n"
 "Language-Team: Japanese (https://app.transifex.com/opencloud-eu/teams/204053/ja/)\n"

services/activitylog/pkg/server/http/l10n/locale/ko/LC_MESSAGES/activitylog.po

@@ -12,7 +12,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: 4580f07cef35810b72f8a1e8fd521c9a_6684a19 <07c3e3571dc5eebd81f2c3a10488f503_1171750>, 2025\n"
 "Language-Team: Korean (https://app.transifex.com/opencloud-eu/teams/204053/ko/)\n"

services/activitylog/pkg/server/http/l10n/locale/lo/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: BoneNI, 2026\n"
 "Language-Team: Lao (https://app.transifex.com/opencloud-eu/teams/204053/lo/)\n"

services/activitylog/pkg/server/http/l10n/locale/nl/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Stephan Paternotte <stephan@paternottes.net>, 2025\n"
 "Language-Team: Dutch (https://app.transifex.com/opencloud-eu/teams/204053/nl/)\n"

services/activitylog/pkg/server/http/l10n/locale/pl/LC_MESSAGES/activitylog.po

@@ -13,7 +13,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Matt, 2026\n"
 "Language-Team: Polish (https://app.transifex.com/opencloud-eu/teams/204053/pl/)\n"

services/activitylog/pkg/server/http/l10n/locale/pt/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Mário Machado, 2025\n"
 "Language-Team: Portuguese (https://app.transifex.com/opencloud-eu/teams/204053/pt/)\n"

services/activitylog/pkg/server/http/l10n/locale/ru/LC_MESSAGES/activitylog.po

@@ -12,7 +12,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Lulufox, 2025\n"
 "Language-Team: Russian (https://app.transifex.com/opencloud-eu/teams/204053/ru/)\n"

services/activitylog/pkg/server/http/l10n/locale/sv/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Daniel Nylander <po@danielnylander.se>, 2025\n"
 "Language-Team: Swedish (https://app.transifex.com/opencloud-eu/teams/204053/sv/)\n"

services/activitylog/pkg/server/http/l10n/locale/vi/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: Quan Tran, 2025\n"
 "Language-Team: Vietnamese (https://app.transifex.com/opencloud-eu/teams/204053/vi/)\n"

services/activitylog/pkg/server/http/l10n/locale/zh/LC_MESSAGES/activitylog.po

@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-08-08 23:16+0000\n"
+"POT-Creation-Date: 2026-08-28 23:16+0000\n"
 "PO-Revision-Date: 2025-01-27 10:17+0000\n"
 "Last-Translator: YQS Yang, 2025\n"
 "Language-Team: Chinese (https://app.transifex.com/opencloud-eu/teams/204053/zh/)\n"

services/activitylog/pkg/server/http/option.go

@@ -3,18 +3,12 @@ package http
 import (
 	"context"
 
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	"github.com/opencloud-eu/opencloud/pkg/log"
-	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
 	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/metrics"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-
 	"github.com/spf13/pflag"
-	"go-micro.dev/v4/store"
 	"go.opentelemetry.io/otel/trace"
+	"go.opentelemetry.io/otel/trace/noop"
 )
 
 // Option defines a single option function.
@@ -22,19 +16,15 @@ type Option func(o *Options)
 
 // Options defines the available options for this package.
 type Options struct {
-	Logger           log.Logger
-	Context          context.Context
-	Config           *config.Config
-	Metrics          *metrics.Metrics
-	Flags            []pflag.Flag
-	Namespace        string
-	Store            store.Store
-	Stream           events.Stream
-	GatewaySelector  pool.Selectable[gateway.GatewayAPIClient]
-	TraceProvider    trace.TracerProvider
-	HistoryClient    ehsvc.EventHistoryService
-	ValueClient      settingssvc.ValueService
-	RegisteredEvents []events.Unmarshaller
+	Name          string
+	Namespace     string
+	Logger        log.Logger
+	Context       context.Context
+	Config        *config.Config
+	Flags         []pflag.Flag
+	Service       ActivityLogService
+	TraceProvider trace.TracerProvider
+	ValueClient   settingssvc.ValueService
 }
 
 // newOptions initializes the available default options.
@@ -69,10 +59,10 @@ func Config(val *config.Config) Option {
 	}
 }
 
-// Metrics provides a function to set the metrics option.
-func Metrics(val *metrics.Metrics) Option {
+// Service provides a function to set the service option.
+func Service(val ActivityLogService) Option {
 	return func(o *Options) {
-		o.Metrics = val
+		o.Service = val
 	}
 }
 
@@ -83,58 +73,20 @@ func Flags(flags ...pflag.Flag) Option {
 	}
 }
 
-// Namespace provides a function to set the Namespace option.
-func Namespace(val string) Option {
+// TraceProvider provides a function to configure the trace provider
+func TraceProvider(traceProvider trace.TracerProvider) Option {
 	return func(o *Options) {
-		o.Namespace = val
+		if traceProvider != nil {
+			o.TraceProvider = traceProvider
+		} else {
+			o.TraceProvider = noop.NewTracerProvider()
+		}
 	}
 }
 
-// Store provides a function to configure the store
-func Store(store store.Store) Option {
+// ValueClient adds a grpc client for the value service
+func ValueClient(vs settingssvc.ValueService) Option {
 	return func(o *Options) {
-		o.Store = store
-	}
-}
-
-// Stream provides a function to configure the stream
-func Stream(stream events.Stream) Option {
-	return func(o *Options) {
-		o.Stream = stream
-	}
-}
-
-// GatewaySelector provides a function to configure the gateway client selector
-func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient]) Option {
-	return func(o *Options) {
-		o.GatewaySelector = gatewaySelector
-	}
-}
-
-// HistoryClient provides a function to configure the event history client
-func HistoryClient(h ehsvc.EventHistoryService) Option {
-	return func(o *Options) {
-		o.HistoryClient = h
-	}
-}
-
-// RegisteredEvents provides a function to register events
-func RegisteredEvents(evs []events.Unmarshaller) Option {
-	return func(o *Options) {
-		o.RegisteredEvents = evs
-	}
-}
-
-// TraceProvider provides a function to set the TracerProvider option
-func TraceProvider(val trace.TracerProvider) Option {
-	return func(o *Options) {
-		o.TraceProvider = val
-	}
-}
-
-// ValueClient provides a function to set the ValueClient options
-func ValueClient(val settingssvc.ValueService) Option {
-	return func(o *Options) {
-		o.ValueClient = val
+		o.ValueClient = vs
 	}
 }

services/activitylog/pkg/server/http/server.go

@@ -1,49 +1,63 @@
 package http
 
 import (
-	"fmt"
-
-	stdhttp "net/http"
+	"context"
+	"embed"
+	"encoding/json"
+	"errors"
+	"net/http"
 
 	"github.com/go-chi/chi/v5"
 	chimiddleware "github.com/go-chi/chi/v5/middleware"
+	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/opencloud/pkg/account"
 	"github.com/opencloud-eu/opencloud/pkg/cors"
+	"github.com/opencloud-eu/opencloud/pkg/l10n"
+	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/middleware"
-	"github.com/opencloud-eu/opencloud/pkg/service/http"
-	"github.com/opencloud-eu/opencloud/pkg/tracing"
+	ohttp "github.com/opencloud-eu/opencloud/pkg/service/http"
 	"github.com/opencloud-eu/opencloud/pkg/version"
-	svc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service"
-	"github.com/riandyrn/otelchi"
+	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
+	activityloghttp "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"go-micro.dev/v4"
+	"google.golang.org/grpc/metadata"
 )
 
-// Service is the service interface
-type Service any
+var (
+	//go:embed l10n/locale
+	_localeFS embed.FS
+
+	// subfolder where the translation files are stored
+	_localeSubPath = "l10n/locale"
+
+	// domain of the activitylog service (transifex)
+	_domain = "activitylog"
+)
 
 // Server initializes the http service and server.
-func Server(opts ...Option) (http.Service, error) {
+func Server(opts ...Option) (ohttp.Service, error) {
 	options := newOptions(opts...)
+	service := options.Service
 
-	service, err := http.NewService(
-		http.TLSConfig(options.Config.HTTP.TLS),
-		http.Logger(options.Logger),
-		http.Namespace(options.Config.HTTP.Namespace),
-		http.Name(options.Config.Service.Name),
-		http.Version(version.GetString()),
-		http.Address(options.Config.HTTP.Addr),
-		http.Context(options.Context),
-		http.Flags(options.Flags...),
-		http.TraceProvider(options.TraceProvider),
+	newService, err := ohttp.NewService(
+		ohttp.TLSConfig(options.Config.HTTP.TLS),
+		ohttp.Logger(options.Logger),
+		ohttp.Namespace(options.Config.HTTP.Namespace),
+		ohttp.Name(options.Config.Service.Name),
+		ohttp.Version(version.GetString()),
+		ohttp.Address(options.Config.HTTP.Addr),
+		ohttp.Context(options.Context),
+		ohttp.Flags(options.Flags...),
 	)
 	if err != nil {
 		options.Logger.Error().
 			Err(err).
 			Msg("Error initializing http service")
-		return http.Service{}, fmt.Errorf("could not initialize http service: %w", err)
+		return ohttp.Service{}, err
 	}
 
-	middlewares := []func(stdhttp.Handler) stdhttp.Handler{
+	middlewares := []func(http.Handler) http.Handler{
 		chimiddleware.RequestID,
 		middleware.Version(
 			options.Config.Service.Name,
@@ -52,6 +66,7 @@ func Server(opts ...Option) (http.Service, error) {
 		middleware.Logger(
 			options.Logger,
 		),
+		middleware.TraceContext,
 		middleware.ExtractAccountUUID(
 			account.Logger(options.Logger),
 			account.JWTSecret(options.Config.TokenManager.JWTSecret),
@@ -68,33 +83,75 @@ func Server(opts ...Option) (http.Service, error) {
 	mux := chi.NewMux()
 	mux.Use(middlewares...)
 
-	mux.Use(
-		otelchi.Middleware(
-			"actitivylog",
-			otelchi.WithChiRoutes(mux),
-			otelchi.WithTracerProvider(options.TraceProvider),
-			otelchi.WithPropagators(tracing.GetPropagator()),
-		),
-	)
+	t := l10n.NewTranslatorFromCommonConfig(options.Config.DefaultLanguage, _domain, options.Config.TranslationPath, _localeFS, _localeSubPath)
+	mux.Route(options.Config.HTTP.Root, func(r chi.Router) {
+		r.Get("/graph/v1beta1/extensions/org.libregraph/activities", GetItemActivitiesHandler(options.Logger, service, options.ValueClient, t))
+	})
 
-	handle, err := svc.New(
-		svc.Logger(options.Logger),
-		svc.Stream(options.Stream),
-		svc.Mux(mux),
-		svc.Config(options.Config),
-		svc.GatewaySelector(options.GatewaySelector),
-		svc.TraceProvider(options.TraceProvider),
-		svc.HistoryClient(options.HistoryClient),
-		svc.ValueClient(options.ValueClient),
-		svc.RegisteredEvents(options.RegisteredEvents),
-	)
+	err = micro.RegisterHandler(newService.Server(), mux)
 	if err != nil {
-		return http.Service{}, err
+		options.Logger.Fatal().Err(err).Msg("failed to register the handler")
 	}
 
-	if err := micro.RegisterHandler(service.Server(), handle); err != nil {
-		return http.Service{}, err
-	}
+	newService.Init()
+	return newService, nil
 
-	return service, nil
+}
+
+// Service defines the business logic implementations need to provide.
+type ActivityLogService interface {
+	GetItemActivities(ctx context.Context, query, loc string, t l10n.Translator) ([]libregraph.Activity, error)
+}
+
+// GetActivitiesResponse is the response on GET activities requests
+type GetActivitiesResponse struct {
+	Activities []libregraph.Activity `json:"value"`
+}
+
+func GetItemActivitiesHandler(log log.Logger, s ActivityLogService, vc settingssvc.ValueService, t l10n.Translator) func(w http.ResponseWriter, r *http.Request) {
+	return func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, r.Header.Get(revactx.TokenHeader))
+
+		activeUser, ok := revactx.ContextGetUser(ctx)
+		if !ok {
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+
+		loc := l10n.MustGetUserLocale(ctx, activeUser.GetId().GetOpaqueId(), r.Header.Get(l10n.HeaderAcceptLanguage), vc)
+
+		activities, err := s.GetItemActivities(ctx, r.URL.Query().Get("kql"), loc, t)
+		if err != nil {
+			switch {
+			case errors.Is(err, activityloghttp.ErrBadRequest):
+				log.Debug().Str("query", r.URL.Query().Get("kql")).Err(err).Msg("error getting activities")
+				w.WriteHeader(http.StatusBadRequest)
+				return
+			case errors.Is(err, activityloghttp.ErrForbidden):
+				log.Debug().Err(err).Msg("error getting activities")
+				w.WriteHeader(http.StatusForbidden)
+				return
+			default:
+				log.Error().Err(err).Msg("error getting activities")
+				w.WriteHeader(http.StatusInternalServerError)
+				return
+			}
+		}
+		res := GetActivitiesResponse{
+			Activities: activities,
+		}
+
+		w.Header().Set("Content-Type", "application/json; odata.metadata=minimal")
+		w.Header().Set("OData-Version", "4.0")
+		if reqID := chimiddleware.GetReqID(ctx); reqID != "" {
+			w.Header().Set("request-id", reqID)
+		}
+		w.Header().Set("Cache-Control", "no-cache")
+		if err := json.NewEncoder(w).Encode(res); err != nil {
+			log.Error().Err(err).Msg("error encoding activities")
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+	}
 }

services/activitylog/pkg/service/activitylog/activitylog.go

@@ -0,0 +1,366 @@
+package activitylog
+
+import (
+	"context"
+	"encoding/base32"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/jellydator/ttlcache/v2"
+	"github.com/nats-io/nats.go"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/vmihailenco/msgpack/v5"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
+)
+
+var tracer trace.Tracer
+
+func init() {
+	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog")
+}
+
+var (
+	_maxActivitiesDefault = 6000
+	_writeBufferDuration  = 10 * time.Second
+)
+
+// Activitylog stores and retrieves activities for resources and their parents from a nats kv
+type ActivityLog struct {
+	log log.Logger
+	// FIXME the lock does not protect agains concurrent resource activities on multiple instances
+	// known since https://github.com/owncloud/ocis/pull/9361#pullrequestreview-2135350157
+	// current ocis discussion in https://github.com/owncloud/ocis/issues/12475
+	lock          sync.RWMutex
+	debouncer     *Debouncer
+	parentIdCache *ttlcache.Cache
+	natskv        nats.KeyValue
+
+	maxActivities int
+}
+
+type batchInfo struct {
+	key       string
+	count     int
+	timestamp time.Time
+}
+
+// New creates a new ActivitylogService
+func New(kv nats.KeyValue, opts ...Option) (*ActivityLog, error) {
+	o := &Options{
+		MaxActivities:       _maxActivitiesDefault,
+		WriteBufferDuration: _writeBufferDuration,
+		Logger:              log.NopLogger(),
+	}
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	cache := ttlcache.NewCache()
+	err := cache.SetTTL(30 * time.Second)
+	if err != nil {
+		return nil, err
+	}
+
+	s := &ActivityLog{
+		log:           o.Logger,
+		lock:          sync.RWMutex{},
+		parentIdCache: cache,
+		maxActivities: o.MaxActivities,
+		natskv:        kv,
+	}
+	s.debouncer = NewDebouncer(o.WriteBufferDuration, s.StoreActivity)
+
+	// run migrations
+	err = s.runMigrations(context.Background(), kv)
+	if err != nil {
+		return nil, err
+	}
+
+	return s, nil
+}
+
+// RemoveResource removes the resource from the store
+func (a *ActivityLog) RemoveResource(rid *provider.ResourceId) error {
+	if rid == nil {
+		return fmt.Errorf("resource id is required")
+	}
+
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	err := a.natskv.Delete(storagespace.FormatResourceID(rid))
+	if err != nil {
+		return fmt.Errorf("could not delete resource %s: %w", rid.OpaqueId, err)
+	}
+	return nil
+}
+
+// RawActivity represents an activity as it is stored in the activitylog store
+type RawActivity struct {
+	EventID   string    `json:"event_id"`
+	Depth     int       `json:"depth"`
+	Timestamp time.Time `json:"timestamp"`
+}
+
+func (a *ActivityLog) AddActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time, getResource func(context.Context, *provider.Reference) (*provider.ResourceInfo, error)) error {
+	var (
+		err   error
+		depth int
+		ref   = initRef
+	)
+	ctx, span := tracer.Start(ctx, "AddActivity")
+	defer span.End()
+	for {
+		var info *provider.ResourceInfo
+		id := ref.GetResourceId()
+		if ref.Path != "" {
+			// Path based reference, we need to resolve the resource id
+			ctx, span = tracer.Start(ctx, "AddActivity.getResource")
+			info, err = getResource(ctx, ref)
+			span.End()
+			if err != nil {
+				// TODO If the resource was deleted should we still log an activity in the parent?
+				return fmt.Errorf("could not get resource info for reference %v: %w", ref, err)
+			}
+			id = info.GetId()
+		}
+		if id == nil {
+			return fmt.Errorf("resource id is required")
+		}
+
+		key := storagespace.FormatResourceID(id)
+		a.debouncer.Debounce(key, RawActivity{
+			EventID:   eventID,
+			Depth:     depth,
+			Timestamp: timestamp,
+		})
+
+		if id.OpaqueId == id.SpaceId {
+			// we are at the root of the space, no need to go further
+			break
+		}
+
+		// check if parent id is cached
+		// parent id is cached in the format <storageid>$<spaceid>!<resourceid>
+		// if it is not cached, get the resource info and cache it
+		if parentId == nil {
+			if v, err := a.parentIdCache.Get(key); err != nil {
+				if info == nil {
+					ctx, span := tracer.Start(ctx, "AddActivity.getResource parent")
+					info, err = getResource(ctx, ref)
+					span.End()
+					if err != nil || info.GetParentId() == nil || info.GetParentId().GetOpaqueId() == "" {
+						return fmt.Errorf("could not get parent id: %w", err)
+					}
+				}
+				parentId = info.GetParentId()
+				a.parentIdCache.Set(key, parentId)
+			} else {
+				parentId = v.(*provider.ResourceId)
+			}
+		} else {
+			a.log.Debug().Msg("parent id is cached")
+		}
+
+		depth++
+		ref = &provider.Reference{ResourceId: parentId}
+		parentId = nil // reset parent id so it's not reused in the next iteration
+	}
+
+	return nil
+}
+
+func (a *ActivityLog) StoreActivity(resourceID string, activities []RawActivity) error {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	ctx, span := tracer.Start(context.Background(), "storeActivity")
+	defer span.End()
+
+	_, subspan := tracer.Start(ctx, "storeActivity.Marshal")
+	b, err := msgpack.Marshal(activities)
+	if err != nil {
+		return err
+	}
+	subspan.End()
+
+	_, subspan = tracer.Start(ctx, "storeActivity.natskv.Put")
+	key := natsKey(resourceID, len(activities))
+	_, err = a.natskv.Put(key, b)
+	if err != nil {
+		return err
+	}
+	subspan.End()
+
+	ctx, subspan = tracer.Start(ctx, "storeActivity.enforceMaxActivities")
+	a.enforceMaxActivities(ctx, resourceID)
+	subspan.End()
+	return nil
+}
+
+func (a *ActivityLog) enforceMaxActivities(ctx context.Context, resourceID string) {
+	if a.maxActivities <= 0 {
+		return
+	}
+
+	key := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
+
+	_, subspan := tracer.Start(ctx, "enforceMaxActivities.watch")
+	watcher, err := a.natskv.Watch(key, nats.IgnoreDeletes())
+	if err != nil {
+		a.log.Error().Err(err).Str("resourceID", resourceID).Msg("could not watch")
+		return
+	}
+	defer watcher.Stop()
+
+	var keys []string
+	for update := range watcher.Updates() {
+		if update == nil {
+			break
+		}
+
+		var batchActivities []RawActivity
+		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
+			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
+		}
+		keys = append(keys, update.Key())
+	}
+	subspan.End()
+
+	_, subspan = tracer.Start(ctx, "enforceMaxActivities.compile")
+	// Parse keys into batches
+	batches := make([]batchInfo, 0)
+	var activitiesCount int
+	for _, k := range keys {
+		parts := strings.SplitN(k, ".", 3)
+		if len(parts) < 3 {
+			a.log.Warn().Str("key", k).Msg("skipping key, not enough parts")
+			continue
+		}
+
+		c, err := strconv.Atoi(parts[1])
+		if err != nil {
+			a.log.Warn().Str("key", k).Msg("skipping key, can not parse count")
+			continue
+		}
+
+		// parse timestamp
+		nano, err := strconv.ParseInt(parts[2], 10, 64)
+		if err != nil {
+			a.log.Warn().Str("key", k).Msg("skipping key, can not parse timestamp")
+			continue
+		}
+
+		batches = append(batches, batchInfo{
+			key:       k,
+			count:     c,
+			timestamp: time.Unix(0, nano),
+		})
+		activitiesCount += c
+	}
+
+	// sort batches by timestamp
+	sort.Slice(batches, func(i, j int) bool {
+		return batches[i].timestamp.Before(batches[j].timestamp)
+	})
+	subspan.End()
+
+	_, subspan = tracer.Start(ctx, "enforceMaxActivities.delete")
+	// remove oldest keys until we are at max activities
+	for _, b := range batches {
+		if activitiesCount-b.count < a.maxActivities {
+			break
+		}
+
+		activitiesCount -= b.count
+		err = a.natskv.Delete(b.key)
+		if err != nil {
+			a.log.Error().Err(err).Str("key", b.key).Msg("could not delete key")
+			break
+		}
+	}
+	subspan.End()
+}
+
+func (a *ActivityLog) InvalidateCachedParentID(purgeId *provider.ResourceId) {
+	// The parent id cache is populated lazily and its entries expire, so a
+	// missing key is the expected case rather than an error.
+	if err := a.parentIdCache.Remove(storagespace.FormatResourceID(purgeId)); err != nil {
+		a.log.Debug().Interface("event", purgeId).Err(err).Msg("could not delete parent id cache")
+	}
+}
+
+func natsKey(resourceID string, activitiesCount int) string {
+	return fmt.Sprintf("%s.%d.%d",
+		base32.StdEncoding.EncodeToString([]byte(resourceID)),
+		activitiesCount,
+		time.Now().UnixNano())
+}
+
+func (a *ActivityLog) Activities(rid *provider.ResourceId) ([]RawActivity, error) {
+	a.lock.RLock()
+	defer a.lock.RUnlock()
+
+	return a.activities(rid)
+}
+
+func (a *ActivityLog) activities(rid *provider.ResourceId) ([]RawActivity, error) {
+	resourceID := storagespace.FormatResourceID(rid)
+
+	glob := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
+
+	watcher, err := a.natskv.Watch(glob, nats.IgnoreDeletes())
+	if err != nil {
+		return nil, err
+	}
+	defer watcher.Stop()
+
+	var activities []RawActivity
+	for update := range watcher.Updates() {
+		if update == nil {
+			break
+		}
+
+		var batchActivities []RawActivity
+		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
+			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack")
+		}
+		activities = append(activities, batchActivities...)
+	}
+
+	return activities, nil
+}
+
+// RemoveActivities removes the activities from the given resource
+func (a *ActivityLog) RemoveActivities(rid *provider.ResourceId, toDelete map[string]struct{}) error {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	curActivities, err := a.activities(rid)
+	if err != nil {
+		return err
+	}
+
+	var acts []RawActivity
+	for _, a := range curActivities {
+		if _, ok := toDelete[a.EventID]; !ok {
+			acts = append(acts, a)
+		}
+	}
+
+	b, err := json.Marshal(acts)
+	if err != nil {
+		return err
+	}
+
+	_, err = a.natskv.Put(storagespace.FormatResourceID(rid), b)
+	return err
+}

services/activitylog/pkg/service/activitylog/activitylog_suite_test.go

@@ -0,0 +1,13 @@
+package activitylog_test
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestActivitylog(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Activitylog Suite")
+}

services/activitylog/pkg/service/activitylog/activitylog_test.go

@@ -1,4 +1,4 @@
-package service
+package activitylog_test
 
 import (
 	"context"
@@ -8,15 +8,13 @@ import (
 	"time"
 
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 	nserver "github.com/nats-io/nats-server/v2/server"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/command"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-	eventsmocks "github.com/opencloud-eu/reva/v2/pkg/events/mocks"
-	"github.com/test-go/testify/mock"
-	"go.opentelemetry.io/otel/trace/noop"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
 )
 
 var (
@@ -65,31 +63,25 @@ var _ = SynchronizedAfterSuite(func() {
 
 var _ = Describe("ActivitylogService", func() {
 	var (
-		alog                *ActivitylogService
+		alog                *activitylog.ActivityLog
 		getResource         func(_ context.Context, ref *provider.Reference) (*provider.ResourceInfo, error)
 		writebufferduration = 100 * time.Millisecond
 	)
 
 	JustBeforeEach(func() {
 		var err error
-		stream := &eventsmocks.Stream{}
-		stream.EXPECT().Consume(mock.Anything, mock.Anything).Return(nil, nil)
-		alog, err = New(
-			Config(&config.Config{
-				Service: config.Service{
-					Name: "activitylog-test",
-				},
-				Store: config.Store{
-					Store:    "nats-js-kv",
-					Nodes:    []string{server.Addr().String()},
-					Database: "activitylog-test-" + uuid.New().String(),
-				},
-				MaxActivities:       4,
-				WriteBufferDuration: writebufferduration,
-			}),
-			Stream(stream),
-			TraceProvider(noop.NewTracerProvider()),
-			Mux(chi.NewMux()),
+		db := "activitylog-test-" + uuid.New().String()
+
+		kv, err := command.ConnectNatsKV(config.Store{
+			Nodes:    []string{server.Addr().String()},
+			Database: db,
+		})
+		Expect(err).ToNot(HaveOccurred())
+
+		alog, err = activitylog.New(
+			kv,
+			activitylog.MaxActivities(4),
+			activitylog.WriteBufferDuration(writebufferduration),
 		)
 		Expect(err).ToNot(HaveOccurred())
 	})
@@ -104,7 +96,7 @@ var _ = Describe("ActivitylogService", func() {
 				Name       string
 				Tree       map[string]*provider.ResourceInfo
 				Activities map[string]string
-				Expected   map[string][]RawActivity
+				Expected   map[string][]activitylog.RawActivity
 			}
 
 			testCases := []testCase{
@@ -118,7 +110,7 @@ var _ = Describe("ActivitylogService", func() {
 					Activities: map[string]string{
 						"activity": "base",
 					},
-					Expected: map[string][]RawActivity{
+					Expected: map[string][]activitylog.RawActivity{
 						"base":    activitites("activity", 0),
 						"parent":  activitites("activity", 1),
 						"spaceid": activitites("activity", 2),
@@ -135,7 +127,7 @@ var _ = Describe("ActivitylogService", func() {
 						"activity1": "base",
 						"activity2": "base",
 					},
-					Expected: map[string][]RawActivity{
+					Expected: map[string][]activitylog.RawActivity{
 						"base":    activitites("activity1", 0, "activity2", 0),
 						"parent":  activitites("activity1", 1, "activity2", 1),
 						"spaceid": activitites("activity1", 2, "activity2", 2),
@@ -152,7 +144,7 @@ var _ = Describe("ActivitylogService", func() {
 						}
 
 						for k, v := range tc.Activities {
-							err := alog.addActivity(context.Background(), reference(v), nil, k, time.Time{}, getResource)
+							err := alog.AddActivity(context.Background(), reference(v), nil, k, time.Time{}, getResource)
 							Expect(err).NotTo(HaveOccurred())
 						}
 					})
@@ -191,9 +183,9 @@ var _ = Describe("ActivitylogService", func() {
 
 			It("debounces activities", func() {
 
-				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 
 				Eventually(func(g Gomega) {
@@ -204,7 +196,7 @@ var _ = Describe("ActivitylogService", func() {
 			})
 
 			It("adheres to the MaxActivities setting", func() {
-				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 				Eventually(func(g Gomega) {
 					activities, err := alog.Activities(resourceID("base"))
@@ -212,7 +204,7 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(len(activities)).To(Equal(1))
 				}).Should(Succeed())
 
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 				Eventually(func(g Gomega) {
 					activities, err := alog.Activities(resourceID("base"))
@@ -220,11 +212,11 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(len(activities)).To(Equal(2))
 				}).Should(Succeed())
 
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity5", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity5", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 
 				Eventually(func(g Gomega) {
@@ -241,9 +233,9 @@ var _ = Describe("ActivitylogService", func() {
 					return tree[ref.GetResourceId().GetOpaqueId()], nil
 				}
 
-				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 
 				Eventually(func(g Gomega) {
@@ -252,9 +244,9 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(activities).To(ConsistOf(activitites("activity1", 0, "activity2", 0)))
 				}).Should(Succeed())
 
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.addActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
+				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 
 				Eventually(func(g Gomega) {
@@ -267,9 +259,9 @@ var _ = Describe("ActivitylogService", func() {
 	})
 })
 
-func activitites(acts ...any) []RawActivity {
-	var activities []RawActivity
-	act := RawActivity{}
+func activitites(acts ...any) []activitylog.RawActivity {
+	var activities []activitylog.RawActivity
+	act := activitylog.RawActivity{}
 	for _, a := range acts {
 		switch v := a.(type) {
 		case string:

services/activitylog/pkg/service/activitylog/debouncer.go

@@ -0,0 +1,76 @@
+package activitylog
+
+import (
+	"sync"
+	"time"
+)
+
+// Debouncer is used to debounce writes to the activity log store.
+type Debouncer struct {
+	after      time.Duration
+	f          func(id string, ra []RawActivity) error
+	pending    sync.Map
+	inProgress sync.Map
+
+	mutex sync.Mutex
+}
+
+type queueItem struct {
+	activities []RawActivity
+	timer      *time.Timer
+}
+
+// NewDebouncer returns a new Debouncer instance.
+func NewDebouncer(d time.Duration, f func(id string, ra []RawActivity) error) *Debouncer {
+	return &Debouncer{
+		after:      d,
+		f:          f,
+		pending:    sync.Map{},
+		inProgress: sync.Map{},
+	}
+}
+
+// Debounce restarts the debounce timer for the given space.
+func (d *Debouncer) Debounce(id string, ra RawActivity) {
+	if d.after == 0 {
+		d.f(id, []RawActivity{ra})
+		return
+	}
+
+	d.mutex.Lock()
+	defer d.mutex.Unlock()
+
+	item := &queueItem{
+		activities: []RawActivity{ra},
+	}
+
+	if i, ok := d.pending.Load(id); ok {
+		// if the item is already in the queue, append the new activities
+		item, ok = i.(*queueItem)
+		if ok {
+			item.activities = append(item.activities, ra)
+		}
+	}
+
+	if item.timer == nil {
+		item.timer = time.AfterFunc(d.after, func() {
+			if _, ok := d.inProgress.Load(id); ok {
+				// Reschedule this run for when the previous run has finished
+				d.mutex.Lock()
+				if i, ok := d.pending.Load(id); ok {
+					i.(*queueItem).timer.Reset(d.after)
+				}
+
+				d.mutex.Unlock()
+				return
+			}
+
+			d.pending.Delete(id)
+			d.inProgress.Store(id, true)
+			defer d.inProgress.Delete(id)
+			d.f(id, item.activities)
+		})
+	}
+
+	d.pending.Store(id, item)
+}

services/activitylog/pkg/service/activitylog/debouncer_test.go

@@ -0,0 +1,121 @@
+package activitylog_test
+
+import (
+	"sync"
+	"time"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+)
+
+var _ = Describe("Debouncer", func() {
+	var (
+		mu          sync.Mutex
+		callbacks   []activitylog.RawActivity
+		newCallback func(id string, ra []activitylog.RawActivity) error
+	)
+
+	BeforeEach(func() {
+		mu.Lock()
+		callbacks = nil
+		mu.Unlock()
+		newCallback = func(id string, ra []activitylog.RawActivity) error {
+			mu.Lock()
+			defer mu.Unlock()
+			callbacks = append(callbacks, ra...)
+			return nil
+		}
+	})
+
+	Context("with zero duration", func() {
+		It("calls the callback immediately", func() {
+			d := activitylog.NewDebouncer(0, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			Expect(callbacks).To(HaveLen(1))
+			Expect(callbacks[0].EventID).To(Equal("activity1"))
+		})
+
+		It("calls the callback immediately for each event", func() {
+			d := activitylog.NewDebouncer(0, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			d.Debounce("space2", activitylog.RawActivity{EventID: "activity2"})
+			Expect(callbacks).To(HaveLen(2))
+		})
+	})
+
+	Context("with non-zero duration", func() {
+		It("batches activities with the same id", func() {
+			d := activitylog.NewDebouncer(10*time.Millisecond, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity3"})
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(3))
+		})
+
+		It("handles different ids independently", func() {
+			d := activitylog.NewDebouncer(10*time.Millisecond, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			d.Debounce("space2", activitylog.RawActivity{EventID: "activity2"})
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(2))
+		})
+
+		It("batches activities that arrive within the debounce window", func() {
+			d := activitylog.NewDebouncer(100*time.Millisecond, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			time.Sleep(20 * time.Millisecond)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
+			time.Sleep(20 * time.Millisecond)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity3"})
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(3))
+		})
+
+		It("processes new batch after previous completes", func() {
+			d := activitylog.NewDebouncer(5*time.Millisecond, newCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			time.Sleep(20 * time.Millisecond) // let first batch complete
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(2))
+		})
+
+		It("skips duplicate write when timer fires during in-progress callback", func() {
+			slowCallback := func(id string, ra []activitylog.RawActivity) error {
+				time.Sleep(50 * time.Millisecond) // simulate slow write
+				mu.Lock()
+				defer mu.Unlock()
+				callbacks = append(callbacks, ra...)
+				return nil
+			}
+
+			d := activitylog.NewDebouncer(10*time.Millisecond, slowCallback)
+			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
+			time.Sleep(20 * time.Millisecond) // timer fires while callback is running
+
+			Eventually(func() int {
+				mu.Lock()
+				defer mu.Unlock()
+				return len(callbacks)
+			}).Should(Equal(1))
+		})
+	})
+})

services/activitylog/pkg/service/activitylog/migrations.go

@@ -1,4 +1,4 @@
-package service
+package activitylog
 
 import (
 	"context"
@@ -15,7 +15,7 @@ const currentMigrationVersion = "1"
 
 // RunMigrations checks the activitylog data version and runs migrations if necessary.
 // It should be called during service startup, after the NATS KeyValue store is initialized.
-func (a *ActivitylogService) runMigrations(ctx context.Context, kv nats.KeyValue) error {
+func (a *ActivityLog) runMigrations(ctx context.Context, kv nats.KeyValue) error {
 	entry, err := kv.Get(activitylogVersionKey)
 	if err == nats.ErrKeyNotFound {
 		a.log.Info().Msg("activitylog version key not found. Running migration to V1...")
@@ -40,7 +40,7 @@ func (a *ActivitylogService) runMigrations(ctx context.Context, kv nats.KeyValue
 // For each such key, it creates a new key in the format "originalKey.count.timestamp"
 // and stores the original list of strings (re-marshalled to messagepack) as its value.
 // Finally, it sets the activitylog.version key to "1".
-func (a *ActivitylogService) migrateToV1(_ context.Context, kv nats.KeyValue) error {
+func (a *ActivityLog) migrateToV1(_ context.Context, kv nats.KeyValue) error {
 	lister, err := kv.ListKeys()
 	if err != nil {
 		return fmt.Errorf("migrateToV1: failed to list keys from NATS KV store: %w", err)

services/activitylog/pkg/service/activitylog/options.go

@@ -0,0 +1,35 @@
+package activitylog
+
+import (
+	"time"
+
+	"github.com/opencloud-eu/opencloud/pkg/log"
+)
+
+// Option for the activitylog service
+type Option func(*Options)
+
+// Options for the activitylog service
+type Options struct {
+	Logger              log.Logger
+	MaxActivities       int
+	WriteBufferDuration time.Duration
+}
+
+// Logger configures a logger for the activitylog service
+func Logger(log log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = log
+	}
+}
+
+func MaxActivities(max int) Option {
+	return func(o *Options) {
+		o.MaxActivities = max
+	}
+}
+func WriteBufferDuration(d time.Duration) Option {
+	return func(o *Options) {
+		o.WriteBufferDuration = d
+	}
+}

services/activitylog/pkg/service/events/events_suite_test.go

@@ -0,0 +1,13 @@
+package events_test
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestEvents(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "Events Suite")
+}

services/activitylog/pkg/service/events/options.go

@@ -1,17 +1,14 @@
-package service
+package events
 
 import (
+	"context"
 	"time"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	"github.com/go-chi/chi/v5"
 	"github.com/opencloud-eu/opencloud/pkg/log"
-	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
-	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"go.opentelemetry.io/otel/trace"
 )
 
 // Option for the activitylog service
@@ -19,17 +16,20 @@ type Option func(*Options)
 
 // Options for the activitylog service
 type Options struct {
+	Context             context.Context
 	Logger              log.Logger
-	Config              *config.Config
-	TraceProvider       trace.TracerProvider
+	ServiceAccount      config.ServiceAccount
 	Stream              events.Stream
 	RegisteredEvents    []events.Unmarshaller
 	GatewaySelector     pool.Selectable[gateway.GatewayAPIClient]
-	Mux                 *chi.Mux
-	HistoryClient       ehsvc.EventHistoryService
-	ValueClient         settingssvc.ValueService
 	WriteBufferDuration time.Duration
-	MaxActivities       int
+	NumConsumers        int
+}
+
+func Context(ctx context.Context) Option {
+	return func(o *Options) {
+		o.Context = ctx
+	}
 }
 
 // Logger configures a logger for the activitylog service
@@ -39,17 +39,10 @@ func Logger(log log.Logger) Option {
 	}
 }
 
-// Config adds the config for the activitylog service
-func Config(c *config.Config) Option {
+// ServiceAccount configures a service account for the activitylog service
+func ServiceAccount(sa config.ServiceAccount) Option {
 	return func(o *Options) {
-		o.Config = c
-	}
-}
-
-// TraceProvider adds a tracer provider for the activitylog service
-func TraceProvider(tp trace.TracerProvider) Option {
-	return func(o *Options) {
-		o.TraceProvider = tp
+		o.ServiceAccount = sa
 	}
 }
 
@@ -74,23 +67,8 @@ func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient])
 	}
 }
 
-// Mux defines the muxer for the service
-func Mux(m *chi.Mux) Option {
+func NumConsumers(num int) Option {
 	return func(o *Options) {
-		o.Mux = m
-	}
-}
-
-// HistoryClient adds a grpc client for the eventhistory service
-func HistoryClient(hc ehsvc.EventHistoryService) Option {
-	return func(o *Options) {
-		o.HistoryClient = hc
-	}
-}
-
-// ValueClient adds a grpc client for the value service
-func ValueClient(vs settingssvc.ValueService) Option {
-	return func(o *Options) {
-		o.ValueClient = vs
+		o.NumConsumers = num
 	}
 }

services/activitylog/pkg/service/events/service.go

@@ -0,0 +1,302 @@
+package events
+
+import (
+	"context"
+	"fmt"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
+)
+
+var tracer trace.Tracer
+
+func init() {
+	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events")
+}
+
+var (
+	_numConsumersDefault = 1
+)
+
+// ActivitylogService logs events per resource
+type ActivitylogService struct {
+	ctx    context.Context
+	sa     config.ServiceAccount
+	log    log.Logger
+	stream events.Stream
+	gws    pool.Selectable[gateway.GatewayAPIClient]
+	al     *activitylog.ActivityLog
+
+	numConsumers int
+
+	events []events.Unmarshaller
+
+	stopCh  chan struct{}
+	stopped *atomic.Bool
+}
+
+// New creates a new ActivitylogService
+func New(al *activitylog.ActivityLog, stream events.Stream, opts ...Option) (*ActivitylogService, error) {
+	o := &Options{
+		NumConsumers: _numConsumersDefault,
+	}
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	s := &ActivitylogService{
+		ctx:          o.Context,
+		log:          o.Logger,
+		sa:           o.ServiceAccount,
+		stream:       stream,
+		gws:          o.GatewaySelector,
+		events:       o.RegisteredEvents,
+		numConsumers: o.NumConsumers,
+		al:           al,
+		stopCh:       make(chan struct{}, 1),
+		stopped:      new(atomic.Bool),
+	}
+
+	return s, nil
+}
+
+// Run to fulfil Runner interface
+func (s *ActivitylogService) Run() error {
+	ch, err := events.Consume(s.stream, "activitylog", s.events...)
+	if err != nil {
+		return err
+	}
+
+	var wg sync.WaitGroup
+	ctx, cancel := context.WithCancel(s.ctx)
+	defer cancel()
+
+	s.log.Debug().Int("worker.count", s.numConsumers).
+		Str("messaging.consumer.group.name", "activitylog").
+		Str("messaging.system", "nats").
+		Str("messaging.operation.name", "receive").
+		Msg("starting event processing workers")
+
+	// start workers
+	for i := 0; i < s.numConsumers; i++ {
+		wg.Add(1)
+		go func(workerID int) {
+			defer wg.Done()
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case e, ok := <-ch:
+					if !ok {
+						return
+					}
+					if err := s.processEvent(e); err != nil {
+						s.log.Error().Err(err).
+							Int("worker", workerID).
+							Interface("event", e).
+							Msg("failed to process event")
+					}
+				}
+			}
+		}(i)
+	}
+
+	// wait for stop signal
+	<-s.stopCh
+	cancel() // signal workers to stop
+	wg.Wait()
+
+	return nil
+}
+
+// Close will make the service to stop processing, so the `Run`
+// method can finish.
+func (s *ActivitylogService) Close() {
+	if s.stopped.CompareAndSwap(false, true) {
+		close(s.stopCh)
+	}
+}
+
+func (s *ActivitylogService) processEvent(e events.Event) error {
+	ctx := e.GetTraceContext(s.ctx)
+	ctx, span := tracer.Start(ctx, "processEvent")
+	defer span.End()
+
+	s.log.Debug().Interface("event", e).Msg("updating activitylog")
+
+	switch ev := e.Event.(type) {
+	case events.UploadReady:
+		return s.AddActivity(ctx, ev.FileRef, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.FileTouched:
+		return s.AddActivity(ctx, ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+	// Disabled https://github.com/owncloud/ocis/issues/10293
+	//case events.FileDownloaded:
+	// we are only interested in public link downloads - so no need to store others.
+	//if ev.ImpersonatingUser.GetDisplayName() == "Public" {
+	//	err = a.AddActivity(ev.Ref, e.ID, utils.TSToTime(ev.Timestamp))
+	//}
+	case events.ContainerCreated:
+		return s.AddActivity(ctx, ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.ItemTrashed:
+		return s.AddActivityTrashed(ctx, ev.ID, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.ItemPurged:
+		return s.al.RemoveResource(ev.ID)
+	case events.ItemMoved:
+		// remove the cached parent id for this resource
+		s.removeCachedParentID(ctx, ev.Ref)
+
+		return s.AddActivity(ctx, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.ShareCreated:
+		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
+	case events.ShareUpdated:
+		if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
+			return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
+		}
+	case events.ShareRemoved:
+		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, ev.Timestamp)
+	case events.LinkCreated:
+		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
+	case events.LinkUpdated:
+		if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
+			return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
+		}
+	case events.LinkRemoved:
+		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.Timestamp))
+	case events.SpaceShared:
+		return s.AddSpaceActivity(ctx, ev.ID, e.ID, ev.Timestamp)
+	case events.SpaceUnshared:
+		return s.AddSpaceActivity(ctx, ev.ID, e.ID, ev.Timestamp)
+	}
+
+	return nil
+}
+
+// AddActivity adds the activity to the given resource and all its parents
+func (a *ActivitylogService) AddActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
+	ctx, span := tracer.Start(ctx, "AddActivity")
+	defer span.End()
+
+	gwc, err := a.gws.Next()
+	if err != nil {
+		return fmt.Errorf("cant get gateway client: %w", err)
+	}
+
+	ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
+	if err != nil {
+		return fmt.Errorf("cant get service user context: %w", err)
+
+	}
+	return a.al.AddActivity(ctx, initRef, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
+		return utils.GetResource(ctx, ref, gwc)
+	})
+}
+
+// AddActivityTrashed adds the activity to given trashed resource and all its former parents
+func (a *ActivitylogService) AddActivityTrashed(ctx context.Context, resourceID *provider.ResourceId, reference *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
+	ctx, span := tracer.Start(ctx, "AddActivityTrashed")
+	defer span.End()
+
+	gwc, err := a.gws.Next()
+	if err != nil {
+		return fmt.Errorf("cant get gateway client: %w", err)
+	}
+
+	ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
+	if err != nil {
+		return fmt.Errorf("cant get service user context: %w", err)
+	}
+
+	// store activity on trashed item
+	if err := a.al.StoreActivity(storagespace.FormatResourceID(resourceID), []activitylog.RawActivity{
+		{
+			EventID:   eventID,
+			Depth:     0,
+			Timestamp: timestamp,
+		},
+	}); err != nil {
+		return fmt.Errorf("could not store activity: %w", err)
+	}
+
+	// get previous parent
+	ref := &provider.Reference{
+		ResourceId: reference.GetResourceId(),
+		Path:       filepath.Dir(reference.GetPath()),
+	}
+
+	return a.al.AddActivity(ctx, ref, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
+		return utils.GetResource(ctx, ref, gwc)
+	})
+}
+
+// AddSpaceActivity adds the activity to the given spaceroot
+func (a *ActivitylogService) AddSpaceActivity(ctx context.Context, spaceID *provider.StorageSpaceId, eventID string, timestamp time.Time) error {
+	_, span := tracer.Start(ctx, "AddSpaceActivity")
+	defer span.End()
+	// spaceID is in format <providerid>$<spaceid>
+	// activitylog service uses format <providerid>$<spaceid>!<resourceid>
+	// lets do some converting, shall we?
+	rid, err := storagespace.ParseID(spaceID.GetOpaqueId())
+	if err != nil {
+		return fmt.Errorf("could not parse space id: %w", err)
+	}
+	rid.OpaqueId = rid.GetSpaceId()
+	err = a.al.StoreActivity(storagespace.FormatResourceID(&rid), []activitylog.RawActivity{
+		{
+			EventID:   eventID,
+			Depth:     0,
+			Timestamp: timestamp,
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("could not store activity: %w", err)
+	}
+	return nil
+}
+
+func toRef(r *provider.ResourceId) *provider.Reference {
+	return &provider.Reference{
+		ResourceId: r,
+	}
+}
+
+func (a *ActivitylogService) removeCachedParentID(ctx context.Context, ref *provider.Reference) {
+	var span trace.Span
+	ctx, span = tracer.Start(ctx, "removeCachedParentID")
+	defer span.End()
+
+	purgeId := ref.GetResourceId()
+	if ref.GetPath() != "" {
+		gwc, err := a.gws.Next()
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get gateway client")
+			return
+		}
+
+		ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get service user context")
+			return
+		}
+
+		info, err := utils.GetResource(ctx, ref, gwc)
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get resource info")
+			return
+		}
+		purgeId = info.GetId()
+	}
+	a.al.InvalidateCachedParentID(purgeId)
+}

services/activitylog/pkg/service/events/service_test.go

@@ -0,0 +1,123 @@
+package events_test
+
+import (
+	"context"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	eventssvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+)
+
+var _ = Describe("ActivitylogService", func() {
+	Describe("New", func() {
+		var (
+			al     *activitylog.ActivityLog
+			stream events.Stream
+		)
+
+		BeforeEach(func() {
+			al = &activitylog.ActivityLog{}
+			stream = nil
+		})
+
+		It("creates a service with minimal options", func() {
+			svc, err := eventssvc.New(al, stream)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with context option", func() {
+			ctx := context.Background()
+			svc, err := eventssvc.New(al, stream, eventssvc.Context(ctx))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with logger option", func() {
+			logger := log.NopLogger()
+			svc, err := eventssvc.New(al, stream, eventssvc.Logger(logger))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with service account option", func() {
+			sa := config.ServiceAccount{
+				ServiceAccountID:     "sa-id",
+				ServiceAccountSecret: "sa-secret",
+			}
+			svc, err := eventssvc.New(al, stream, eventssvc.ServiceAccount(sa))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with registered events", func() {
+			evts := []events.Unmarshaller{&events.UploadReady{}, &events.FileTouched{}}
+			svc, err := eventssvc.New(al, stream, eventssvc.RegisteredEvents(evts))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with gateway selector", func() {
+			var gs pool.Selectable[gateway.GatewayAPIClient]
+			svc, err := eventssvc.New(al, stream, eventssvc.GatewaySelector(gs))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with num consumers option", func() {
+			svc, err := eventssvc.New(al, stream, eventssvc.NumConsumers(5))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with all options", func() {
+			ctx := context.Background()
+			logger := log.NopLogger()
+			sa := config.ServiceAccount{
+				ServiceAccountID:     "sa-id",
+				ServiceAccountSecret: "sa-secret",
+			}
+			evts := []events.Unmarshaller{&events.UploadReady{}, &events.ContainerCreated{}}
+			var gs pool.Selectable[gateway.GatewayAPIClient]
+
+			svc, err := eventssvc.New(
+				al,
+				stream,
+				eventssvc.Context(ctx),
+				eventssvc.Logger(logger),
+				eventssvc.ServiceAccount(sa),
+				eventssvc.RegisteredEvents(evts),
+				eventssvc.GatewaySelector(gs),
+				eventssvc.NumConsumers(3),
+			)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+	})
+
+	Describe("Close", func() {
+		It("can be called without panic on a new service", func() {
+			al := &activitylog.ActivityLog{}
+			svc, err := eventssvc.New(al, nil)
+			Expect(err).ToNot(HaveOccurred())
+
+			Expect(func() { svc.Close() }).ToNot(Panic())
+		})
+
+		It("can be called multiple times without panic", func() {
+			al := &activitylog.ActivityLog{}
+			svc, err := eventssvc.New(al, nil)
+			Expect(err).ToNot(HaveOccurred())
+
+			svc.Close()
+			svc.Close()
+			svc.Close()
+		})
+	})
+})

services/activitylog/pkg/service/http/http_suite_test.go

@@ -0,0 +1,13 @@
+package http_test
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+)
+
+func TestHTTP(t *testing.T) {
+	RegisterFailHandler(Fail)
+	RunSpecs(t, "HTTP Suite")
+}

services/activitylog/pkg/service/http/option.go

@@ -0,0 +1,59 @@
+package http
+
+import (
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+)
+
+// Option defines a single option function.
+type Option func(o *Options)
+
+// Options defines the available options for this package.
+type Options struct {
+	Logger           log.Logger
+	RegisteredEvents []events.Unmarshaller
+	GatewaySelector  pool.Selectable[gateway.GatewayAPIClient]
+	HistoryClient    ehsvc.EventHistoryService
+}
+
+// newOptions initializes the available default options.
+func newOptions(opts ...Option) Options {
+	opt := Options{}
+
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	return opt
+}
+
+// Logger provides a function to set the logger option.
+func Logger(val log.Logger) Option {
+	return func(o *Options) {
+		o.Logger = val
+	}
+}
+
+// RegisteredEvents registers the events the service should listen to
+func RegisteredEvents(e []events.Unmarshaller) Option {
+	return func(o *Options) {
+		o.RegisteredEvents = e
+	}
+}
+
+// GatewaySelector adds a grpc client selector for the gateway service
+func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient]) Option {
+	return func(o *Options) {
+		o.GatewaySelector = gatewaySelector
+	}
+}
+
+// HistoryClient adds a grpc client for the eventhistory service
+func HistoryClient(hc ehsvc.EventHistoryService) Option {
+	return func(o *Options) {
+		o.HistoryClient = hc
+	}
+}

services/activitylog/pkg/service/http/response.go

@@ -1,4 +1,4 @@
-package service
+package http
 
 import (
 	"context"
@@ -44,11 +44,6 @@ var (
 	StrDescription    = l10n.Template("description")
 )
 
-// GetActivitiesResponse is the response on GET activities requests
-type GetActivitiesResponse struct {
-	Activities []libregraph.Activity `json:"value"`
-}
-
 // Resource represents an item such as a file or folder
 type Resource struct {
 	ID   string `json:"id"`
@@ -311,7 +306,7 @@ func NewActivity(message string, ts time.Time, eventID string, vars map[string]a
 }
 
 // GetVars calls other service to gather the required data for the activity variables
-func (s *ActivitylogService) GetVars(ctx context.Context, opts ...ActivityOption) (map[string]any, error) {
+func (s *svc) GetVars(ctx context.Context, opts ...ActivityOption) (map[string]any, error) {
 	gwc, err := s.gws.Next()
 	if err != nil {
 		return nil, err
@@ -327,6 +322,12 @@ func (s *ActivitylogService) GetVars(ctx context.Context, opts ...ActivityOption
 	return vars, nil
 }
 
+func toSpace(r *provider.Reference) *provider.StorageSpaceId {
+	return &provider.StorageSpaceId{
+		OpaqueId: storagespace.FormatStorageID(r.GetResourceId().GetStorageId(), r.GetResourceId().GetSpaceId()),
+	}
+}
+
 func getFolderName(ctx context.Context, gwc gateway.GatewayAPIClient, ref *provider.Reference) string {
 	n := filepath.Base(filepath.Dir(ref.GetPath()))
 	if n == "." || n == "/" {

services/activitylog/pkg/service/http/response_test.go

@@ -0,0 +1,150 @@
+package http_test
+
+import (
+	"context"
+	"time"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/pkg/l10n"
+	httpsvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
+)
+
+var _ = Describe("Response", func() {
+	Describe("NewActivity", func() {
+		It("creates an activity with the given parameters", func() {
+			ts := time.Date(2024, 1, 15, 10, 30, 0, 0, time.UTC)
+			vars := map[string]any{
+				"user":     "testuser",
+				"resource": "testfile.txt",
+			}
+
+			act := httpsvc.NewActivity("Test message", ts, "event-123", vars)
+
+			Expect(act.Id).To(Equal("event-123"))
+			Expect(act.Times.RecordedTime).To(Equal(ts))
+			Expect(act.Template.Message).To(Equal("Test message"))
+			Expect(act.Template.Variables).To(HaveKeyWithValue("user", "testuser"))
+			Expect(act.Template.Variables).To(HaveKeyWithValue("resource", "testfile.txt"))
+		})
+
+		It("handles empty variables map", func() {
+			act := httpsvc.NewActivity("", time.Time{}, "", map[string]any{})
+
+			Expect(act.Id).To(BeEmpty())
+			Expect(act.Times.RecordedTime).To(Equal(time.Time{}))
+			Expect(act.Template.Message).To(BeEmpty())
+			Expect(act.Template.Variables).To(BeEmpty())
+		})
+	})
+
+	Describe("WithOldResource", func() {
+		It("sets the oldResource variable from reference path", func() {
+			ref := &provider.Reference{
+				Path: "/old/path/oldname.txt",
+			}
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithOldResource(ref)
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("oldResource"))
+		})
+	})
+
+	Describe("WithUser", func() {
+		It("returns error when no user is provided", func() {
+			opt := httpsvc.WithUser(nil, nil, nil)
+			err := opt(context.Background(), nil, make(map[string]any))
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(ContainSubstring("no user provided"))
+		})
+
+		It("uses impersonator when provided", func() {
+			impersonator := &user.User{
+				Id: &user.UserId{
+					OpaqueId: "imp-user-id",
+				},
+				DisplayName: "Impersonated User",
+			}
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithUser(nil, nil, impersonator)
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("user"))
+		})
+
+		It("uses executing user when no impersonator", func() {
+			execUser := &user.User{
+				Id: &user.UserId{
+					OpaqueId: "exec-user-id",
+				},
+				DisplayName: "Executing User",
+			}
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithUser(nil, execUser, nil)
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("user"))
+		})
+	})
+
+	Describe("WithVar", func() {
+		It("sets a simple key-value variable", func() {
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithVar("token", "id123", "My Token")
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("token"))
+		})
+	})
+
+	Describe("WithTranslation", func() {
+		It("sets translated field variable", func() {
+			var t l10n.Translator
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithTranslation(&t, "en", "field", []string{"permission"})
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("field"))
+		})
+
+		It("handles empty values slice", func() {
+			var t l10n.Translator
+			vars := make(map[string]any)
+
+			opt := httpsvc.WithTranslation(&t, "en", "field", []string{})
+			err := opt(context.Background(), nil, vars)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(vars).To(HaveKey("field"))
+		})
+	})
+
+	Describe("ActivityOption type", func() {
+		It("allows composing multiple options", func() {
+			vars := make(map[string]any)
+			ctx := context.Background()
+			var gwc gateway.GatewayAPIClient
+
+			options := []httpsvc.ActivityOption{
+				httpsvc.WithVar("key1", "id1", "name1"),
+				httpsvc.WithVar("key2", "id2", "name2"),
+			}
+
+			for _, opt := range options {
+				err := opt(ctx, gwc, vars)
+				Expect(err).ToNot(HaveOccurred())
+			}
+
+			Expect(vars).To(HaveKey("key1"))
+			Expect(vars).To(HaveKey("key2"))
+		})
+	})
+})

services/activitylog/pkg/service/http/service.go

@@ -1,89 +1,97 @@
-package service
+package http
 
 import (
-	"embed"
-	"encoding/json"
-	"errors"
-	"net/http"
+	"context"
 	"path/filepath"
+	"reflect"
 	"slices"
 	"strconv"
 	"strings"
 	"time"
 
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	"google.golang.org/grpc/metadata"
-
+	"github.com/olekukonko/errors"
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/opencloud/pkg/ast"
 	"github.com/opencloud-eu/opencloud/pkg/kql"
 	"github.com/opencloud-eu/opencloud/pkg/l10n"
+	"github.com/opencloud-eu/opencloud/pkg/log"
 	ehmsg "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/eventhistory/v0"
 	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/trace"
 )
 
-var (
-	//go:embed l10n/locale
-	_localeFS embed.FS
+var tracer trace.Tracer
 
-	// subfolder where the translation files are stored
-	_localeSubPath = "l10n/locale"
-
-	// domain of the activitylog service (transifex)
-	_domain = "activitylog"
-)
-
-// ServeHTTP implements the http.Handler interface.
-func (s *ActivitylogService) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	s.mux.ServeHTTP(w, r)
+func init() {
+	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http")
 }
 
-// HandleGetItemActivities handles the request to get the activities of an item.
-func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, r.Header.Get(revactx.TokenHeader))
+// New returns a new instance of Service
+func New(al *activitylog.ActivityLog, opts ...Option) (*svc, error) {
+	o := newOptions(opts...)
 
-	activeUser, ok := revactx.ContextGetUser(ctx)
-	if !ok {
-		w.WriteHeader(http.StatusUnauthorized)
-		return
+	registeredEvents := make(map[string]events.Unmarshaller)
+	for _, e := range o.RegisteredEvents {
+		typ := reflect.TypeOf(e)
+		registeredEvents[typ.String()] = e
 	}
 
+	return &svc{
+		log:              o.Logger,
+		evHistory:        o.HistoryClient,
+		al:               al,
+		registeredEvents: registeredEvents,
+		gws:              o.GatewaySelector,
+	}, nil
+}
+
+type svc struct {
+	log              log.Logger
+	evHistory        ehsvc.EventHistoryService
+	gws              pool.Selectable[gateway.GatewayAPIClient]
+	al               *activitylog.ActivityLog
+	registeredEvents map[string]events.Unmarshaller
+}
+
+var (
+	ErrBadRequest = errors.New("bad request")
+	ErrForbidden  = errors.New("forbidden")
+)
+
+func (s *svc) GetItemActivities(ctx context.Context, query, loc string, t l10n.Translator) ([]libregraph.Activity, error) {
 	gwc, err := s.gws.Next()
 	if err != nil {
-		w.WriteHeader(http.StatusInternalServerError)
-		return
+		return nil, err
 	}
 
-	rid, limit, rawActivityAccepted, activityAccepted, sort, err := s.getFilters(r.URL.Query().Get("kql"))
+	rid, limit, rawActivityAccepted, activityAccepted, sort, err := s.getFilters(query)
 	if err != nil {
-		s.log.Info().Str("query", r.URL.Query().Get("kql")).Err(err).Msg("error getting filters")
-		_, _ = w.Write([]byte(err.Error()))
-		w.WriteHeader(http.StatusBadRequest)
-		return
+		s.log.Info().Str("query", query).Err(err).Msg("error getting filters")
+		return nil, ErrBadRequest
 	}
 
 	info, err := utils.GetResourceByID(ctx, rid, gwc)
 	if err != nil {
-		w.WriteHeader(http.StatusForbidden)
-		return
+		return nil, ErrForbidden
 	}
 
 	// you need ListGrants to see activities
 	if !info.GetPermissionSet().GetListGrants() {
-		w.WriteHeader(http.StatusForbidden)
-		return
+		return nil, ErrForbidden
 	}
 
-	raw, err := s.Activities(rid)
+	raw, err := s.al.Activities(rid)
 	if err != nil {
 		s.log.Error().Err(err).Msg("error getting activities")
-		w.WriteHeader(http.StatusInternalServerError)
-		return
+		return nil, err
 	}
 
 	ids := make([]string, 0, len(raw))
@@ -96,21 +104,21 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
 		toDelete[a.EventID] = struct{}{}
 	}
 
-	evRes, err := s.evHistory.GetEvents(r.Context(), &ehsvc.GetEventsRequest{Ids: ids})
+	evRes, err := s.evHistory.GetEvents(ctx, &ehsvc.GetEventsRequest{Ids: ids})
 	if err != nil {
 		s.log.Error().Err(err).Msg("error getting events")
-		w.WriteHeader(http.StatusInternalServerError)
-		return
+		return nil, err
 	}
 
 	evs := evRes.GetEvents()
 	sort(evs)
 
-	resp := GetActivitiesResponse{Activities: make([]libregraph.Activity, 0, len(evRes.GetEvents()))}
+	// TODO cut the interface here?
+	activities := make([]libregraph.Activity, 0, len(evRes.GetEvents()))
 	for _, e := range evs {
 		delete(toDelete, e.GetId())
 
-		if limit > 0 && limit <= len(resp.Activities) {
+		if limit > 0 && limit <= len(activities) {
 			continue
 		}
 
@@ -124,9 +132,6 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
 			vars    map[string]any
 		)
 
-		loc := l10n.MustGetUserLocale(r.Context(), activeUser.GetId().GetOpaqueId(), r.Header.Get(l10n.HeaderAcceptLanguage), s.valService)
-		t := l10n.NewTranslatorFromCommonConfig(s.cfg.DefaultLanguage, _domain, s.cfg.TranslationPath, _localeFS, _localeSubPath)
-
 		switch ev := s.unwrapEvent(e).(type) {
 		case nil:
 			// error already logged in unwrapEvent
@@ -224,35 +229,29 @@ func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *h
 			continue
 		}
 
-		resp.Activities = append(resp.Activities, NewActivity(t.Translate(message, loc), ts, e.GetId(), vars))
+		activities = append(activities, NewActivity(t.Translate(message, loc), ts, e.GetId(), vars))
 	}
 
 	// delete activities in separate go routine
 	if len(toDelete) > 0 {
 		go func() {
-			err := s.RemoveActivities(rid, toDelete)
+			err := s.al.RemoveActivities(rid, toDelete)
 			if err != nil {
 				s.log.Error().Err(err).Msg("error removing activities")
 			}
 		}()
 	}
+	return activities, nil
 
-	b, err := json.Marshal(resp)
-	if err != nil {
-		s.log.Error().Err(err).Msg("error marshalling activities")
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-
-	if _, err := w.Write(b); err != nil {
-		s.log.Error().Err(err).Msg("error writing response")
-		w.WriteHeader(http.StatusInternalServerError)
-		return
-	}
-	w.WriteHeader(http.StatusOK)
 }
 
-func (s *ActivitylogService) unwrapEvent(e *ehmsg.Event) any {
+func toRef(r *provider.ResourceId) *provider.Reference {
+	return &provider.Reference{
+		ResourceId: r,
+	}
+}
+
+func (s *svc) unwrapEvent(e *ehmsg.Event) any {
 	etype, ok := s.registeredEvents[e.GetType()]
 	if !ok {
 		s.log.Error().Str("eventid", e.GetId()).Str("eventtype", e.GetType()).Msg("event not registered")
@@ -268,13 +267,13 @@ func (s *ActivitylogService) unwrapEvent(e *ehmsg.Event) any {
 	return einterface
 }
 
-func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int, func(RawActivity) bool, func(*ehmsg.Event) bool, func([]*ehmsg.Event), error) {
+func (s *svc) getFilters(query string) (*provider.ResourceId, int, func(activitylog.RawActivity) bool, func(*ehmsg.Event) bool, func([]*ehmsg.Event), error) {
 	qast, err := kql.Builder{}.Build(query)
 	if err != nil {
 		return nil, 0, nil, nil, nil, err
 	}
 
-	prefilters := make([]func(RawActivity) bool, 0)
+	prefilters := make([]func(activitylog.RawActivity) bool, 0)
 	postfilters := make([]func(*ehmsg.Event) bool, 0)
 
 	sortby := func(_ []*ehmsg.Event) {}
@@ -299,7 +298,7 @@ func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int
 					break
 				}
 
-				prefilters = append(prefilters, func(a RawActivity) bool {
+				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
 					return a.Depth <= depth
 				})
 			case "limit":
@@ -322,11 +321,11 @@ func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int
 		case *ast.DateTimeNode:
 			switch v.Operator.Value {
 			case "<", "<=":
-				prefilters = append(prefilters, func(a RawActivity) bool {
+				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
 					return a.Timestamp.Before(v.Value)
 				})
 			case ">", ">=":
-				prefilters = append(prefilters, func(a RawActivity) bool {
+				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
 					return a.Timestamp.After(v.Value)
 				})
 			}
@@ -345,7 +344,7 @@ func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int
 		// space root requested - fix format
 		rid.OpaqueId = rid.GetSpaceId()
 	}
-	pref := func(a RawActivity) bool {
+	pref := func(a activitylog.RawActivity) bool {
 		for _, f := range prefilters {
 			if !f(a) {
 				return false

services/activitylog/pkg/service/http/service_test.go

@@ -0,0 +1,76 @@
+package http_test
+
+import (
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	. "github.com/onsi/ginkgo/v2"
+	. "github.com/onsi/gomega"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	httpsvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+)
+
+var _ = Describe("Service", func() {
+	Describe("New", func() {
+		var (
+			al *activitylog.ActivityLog
+		)
+
+		BeforeEach(func() {
+			al = &activitylog.ActivityLog{}
+		})
+
+		It("creates a service with default options", func() {
+			svc, err := httpsvc.New(al)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with logger option", func() {
+			logger := log.NopLogger()
+			svc, err := httpsvc.New(al, httpsvc.Logger(logger))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with registered events", func() {
+			evts := []events.Unmarshaller{&events.UploadReady{}}
+			svc, err := httpsvc.New(al, httpsvc.RegisteredEvents(evts))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with gateway selector", func() {
+			var gs pool.Selectable[gateway.GatewayAPIClient]
+			svc, err := httpsvc.New(al, httpsvc.GatewaySelector(gs))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with history client", func() {
+			var hc ehsvc.EventHistoryService
+			svc, err := httpsvc.New(al, httpsvc.HistoryClient(hc))
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+
+		It("creates a service with all options", func() {
+			logger := log.NopLogger()
+			evts := []events.Unmarshaller{&events.UploadReady{}, &events.FileTouched{}}
+			var gs pool.Selectable[gateway.GatewayAPIClient]
+			var hc ehsvc.EventHistoryService
+
+			svc, err := httpsvc.New(
+				al,
+				httpsvc.Logger(logger),
+				httpsvc.RegisteredEvents(evts),
+				httpsvc.GatewaySelector(gs),
+				httpsvc.HistoryClient(hc),
+			)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(svc).ToNot(BeNil())
+		})
+	})
+})

services/activitylog/pkg/service/l10n/locale/no/LC_MESSAGES/activitylog.po

@@ -0,0 +1,102 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+# 
+# Translators:
+# Roy-Magne Mo, 2026
+# 
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: \n"
+"Report-Msgid-Bugs-To: EMAIL\n"
+"POT-Creation-Date: 2026-09-06 23:15+0000\n"
+"PO-Revision-Date: 2025-01-27 10:17+0000\n"
+"Last-Translator: Roy-Magne Mo, 2026\n"
+"Language-Team: Norwegian (https://app.transifex.com/opencloud-eu/teams/204053/no/)\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: no\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+
+#: pkg/service/response.go:44
+msgid "description"
+msgstr "beskrivelse"
+
+#: pkg/service/response.go:43
+msgid "display name"
+msgstr "visningsnavn"
+
+#: pkg/service/response.go:42
+msgid "expiration date"
+msgstr "utløpsdato"
+
+#: pkg/service/response.go:41
+msgid "password"
+msgstr "passord"
+
+#: pkg/service/response.go:40
+msgid "permission"
+msgstr "tillatelse"
+
+#: pkg/service/response.go:39
+msgid "some field"
+msgstr "et felt"
+
+#: pkg/service/response.go:26
+msgid "{resource} was downloaded via public link {token}"
+msgstr "{resource} ble lastet ned via offentlig lenke {token}"
+
+#: pkg/service/response.go:24
+msgid "{user} added {resource} to {folder}"
+msgstr "{user} la til {resource} i {folder}"
+
+#: pkg/service/response.go:36
+msgid "{user} added {sharee} as member of {space}"
+msgstr "{user} la til {sharee} som medlem av {space}"
+
+#: pkg/service/response.go:27
+msgid "{user} deleted {resource} from {folder}"
+msgstr "{user} slettet {resource} fra {folder}"
+
+#: pkg/service/response.go:28
+msgid "{user} moved {resource} to {folder}"
+msgstr "{user} flyttet {resource} til {folder}"
+
+#: pkg/service/response.go:35
+msgid "{user} removed link to {resource}"
+msgstr "{user} fjernet lenke til {resource}"
+
+#: pkg/service/response.go:32
+msgid "{user} removed {sharee} from {resource}"
+msgstr "{user} fjernet {sharee} fra {resource}"
+
+#: pkg/service/response.go:37
+msgid "{user} removed {sharee} from {space}"
+msgstr "{user} fjernet {sharee} fra {space}"
+
+#: pkg/service/response.go:29
+msgid "{user} renamed {oldResource} to {resource}"
+msgstr "{user} ga nytt navn til {oldResource} som {resource}"
+
+#: pkg/service/response.go:33
+msgid "{user} shared {resource} via link"
+msgstr "{user} delte {resource} via lenke"
+
+#: pkg/service/response.go:30
+msgid "{user} shared {resource} with {sharee}"
+msgstr "{user} delte {resource} med {sharee}"
+
+#: pkg/service/response.go:34
+msgid "{user} updated {field} for a link {token} on {resource}"
+msgstr "{user} oppdaterte {field} for en lenke {token} på {resource}"
+
+#: pkg/service/response.go:31
+msgid "{user} updated {field} for the {resource}"
+msgstr "{user} oppdaterte {field} for {resource}"
+
+#: pkg/service/response.go:25
+msgid "{user} updated {resource} in {folder}"
+msgstr "{user} oppdaterte {resource} i {folder}"

services/activitylog/pkg/service/service.go

@@ -1,674 +0,0 @@
-package service
-
-import (
-	"context"
-	"crypto/tls"
-	"encoding/base32"
-	"encoding/json"
-	"fmt"
-	"path/filepath"
-	"reflect"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	"github.com/go-chi/chi/v5"
-	"github.com/jellydator/ttlcache/v2"
-	"github.com/nats-io/nats.go"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	"github.com/pkg/errors"
-	"github.com/vmihailenco/msgpack/v5"
-	"go.opentelemetry.io/otel/trace"
-
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
-	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-)
-
-// Nats runs into max payload exceeded errors at around 7k activities. Let's keep a buffer.
-var _maxActivitiesDefault = 6000
-
-// RawActivity represents an activity as it is stored in the activitylog store
-type RawActivity struct {
-	EventID   string    `json:"event_id"`
-	Depth     int       `json:"depth"`
-	Timestamp time.Time `json:"timestamp"`
-}
-
-// ActivitylogService logs events per resource
-type ActivitylogService struct {
-	cfg           *config.Config
-	log           log.Logger
-	events        <-chan events.Event
-	gws           pool.Selectable[gateway.GatewayAPIClient]
-	mux           *chi.Mux
-	evHistory     ehsvc.EventHistoryService
-	valService    settingssvc.ValueService
-	lock          sync.RWMutex
-	tp            trace.TracerProvider
-	tracer        trace.Tracer
-	debouncer     *Debouncer
-	parentIdCache *ttlcache.Cache
-	natskv        nats.KeyValue
-
-	maxActivities int
-
-	registeredEvents map[string]events.Unmarshaller
-}
-
-type Debouncer struct {
-	after      time.Duration
-	f          func(id string, ra []RawActivity) error
-	pending    sync.Map
-	inProgress sync.Map
-
-	mutex sync.Mutex
-}
-
-type queueItem struct {
-	activities []RawActivity
-	timer      *time.Timer
-}
-
-type batchInfo struct {
-	key       string
-	count     int
-	timestamp time.Time
-}
-
-// NewDebouncer returns a new Debouncer instance
-func NewDebouncer(d time.Duration, f func(id string, ra []RawActivity) error) *Debouncer {
-	return &Debouncer{
-		after:      d,
-		f:          f,
-		pending:    sync.Map{},
-		inProgress: sync.Map{},
-	}
-}
-
-// Debounce restarts the debounce timer for the given space
-func (d *Debouncer) Debounce(id string, ra RawActivity) {
-	if d.after == 0 {
-		d.f(id, []RawActivity{ra})
-		return
-	}
-
-	d.mutex.Lock()
-	defer d.mutex.Unlock()
-
-	activities := []RawActivity{ra}
-	item := &queueItem{
-		activities: activities,
-	}
-	if i, ok := d.pending.Load(id); ok {
-		// if the item is already in the queue, append the new activities
-		item, ok = i.(*queueItem)
-		if ok {
-			item.activities = append(item.activities, ra)
-		}
-	}
-
-	if item.timer == nil {
-		item.timer = time.AfterFunc(d.after, func() {
-			if _, ok := d.inProgress.Load(id); ok {
-				// Reschedule this run for when the previous run has finished
-				d.mutex.Lock()
-				if i, ok := d.pending.Load(id); ok {
-					i.(*queueItem).timer.Reset(d.after)
-				}
-
-				d.mutex.Unlock()
-				return
-			}
-
-			d.pending.Delete(id)
-			d.inProgress.Store(id, true)
-			defer d.inProgress.Delete(id)
-			d.f(id, item.activities)
-		})
-	}
-
-	d.pending.Store(id, item)
-}
-
-// New creates a new ActivitylogService
-func New(opts ...Option) (*ActivitylogService, error) {
-	o := &Options{
-		MaxActivities: _maxActivitiesDefault,
-	}
-	for _, opt := range opts {
-		opt(o)
-	}
-
-	if o.Stream == nil {
-		return nil, errors.New("stream is required")
-	}
-
-	ch, err := events.Consume(o.Stream, o.Config.Service.Name, o.RegisteredEvents...)
-	if err != nil {
-		return nil, err
-	}
-
-	cache := ttlcache.NewCache()
-	err = cache.SetTTL(30 * time.Second)
-	if err != nil {
-		return nil, err
-	}
-
-	// Connect to NATS servers
-	natsOptions := nats.Options{
-		Servers: o.Config.Store.Nodes,
-	}
-	if o.Config.Store.EnableTLS {
-		if o.Config.Store.TLSRootCACertificate != "" {
-			// when root ca is configured use it. an insecure flag is ignored.
-			nats.RootCAs(o.Config.Store.TLSRootCACertificate)(&natsOptions)
-		} else {
-			// enable tls and use insecure flag
-			nats.Secure(&tls.Config{MinVersion: tls.VersionTLS12, InsecureSkipVerify: o.Config.Store.TLSInsecure})(&natsOptions)
-		}
-	}
-	if o.Config.Store.AuthUsername != "" && o.Config.Store.AuthPassword != "" {
-		nats.UserInfo(o.Config.Store.AuthUsername, o.Config.Store.AuthPassword)(&natsOptions)
-	}
-	conn, err := natsOptions.Connect()
-	if err != nil {
-		return nil, err
-	}
-
-	js, err := conn.JetStream()
-	if err != nil {
-		return nil, err
-	}
-
-	kv, err := js.KeyValue(o.Config.Store.Database)
-	if err != nil {
-		if !errors.Is(err, nats.ErrBucketNotFound) {
-			return nil, errors.Wrapf(err, "Failed to get bucket (%s)", o.Config.Store.Database)
-		}
-
-		kv, err = js.CreateKeyValue(&nats.KeyValueConfig{
-			Bucket: o.Config.Store.Database,
-		})
-		if err != nil {
-			return nil, errors.Wrapf(err, "Failed to create bucket (%s)", o.Config.Store.Database)
-		}
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	s := &ActivitylogService{
-		log:              o.Logger,
-		cfg:              o.Config,
-		events:           ch,
-		gws:              o.GatewaySelector,
-		mux:              o.Mux,
-		evHistory:        o.HistoryClient,
-		valService:       o.ValueClient,
-		lock:             sync.RWMutex{},
-		registeredEvents: make(map[string]events.Unmarshaller),
-		tp:               o.TraceProvider,
-		tracer:           o.TraceProvider.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service"),
-		parentIdCache:    cache,
-		maxActivities:    o.Config.MaxActivities,
-		natskv:           kv,
-	}
-	s.debouncer = NewDebouncer(o.Config.WriteBufferDuration, s.storeActivity)
-
-	// run migrations
-	err = s.runMigrations(context.Background(), kv)
-	if err != nil {
-		return nil, err
-	}
-
-	s.mux.Get("/graph/v1beta1/extensions/org.libregraph/activities", s.HandleGetItemActivities)
-
-	for _, e := range o.RegisteredEvents {
-		typ := reflect.TypeOf(e)
-		s.registeredEvents[typ.String()] = e
-	}
-
-	go s.Run()
-
-	return s, nil
-}
-
-// Run runs the service
-func (a *ActivitylogService) Run() {
-	for e := range a.events {
-		var err error
-		switch ev := e.Event.(type) {
-		case events.UploadReady:
-			err = a.AddActivity(ev.FileRef, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.FileTouched:
-			err = a.AddActivity(ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-		// Disabled https://github.com/owncloud/ocis/issues/10293
-		//case events.FileDownloaded:
-		// we are only interested in public link downloads - so no need to store others.
-		//if ev.ImpersonatingUser.GetDisplayName() == "Public" {
-		//	err = a.AddActivity(ev.Ref, e.ID, utils.TSToTime(ev.Timestamp))
-		//}
-		case events.ContainerCreated:
-			err = a.AddActivity(ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.ItemTrashed:
-			err = a.AddActivityTrashed(ev.ID, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.ItemPurged:
-			err = a.RemoveResource(ev.ID)
-		case events.ItemMoved:
-			// remove the cached parent id for this resource
-			a.removeCachedParentID(ev.Ref)
-
-			err = a.AddActivity(ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.ShareCreated:
-			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
-		case events.ShareUpdated:
-			if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
-				err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
-			}
-		case events.ShareRemoved:
-			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, ev.Timestamp)
-		case events.LinkCreated:
-			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
-		case events.LinkUpdated:
-			if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
-				err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
-			}
-		case events.LinkRemoved:
-			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.Timestamp))
-		case events.SpaceShared:
-			err = a.AddSpaceActivity(ev.ID, e.ID, ev.Timestamp)
-		case events.SpaceUnshared:
-			err = a.AddSpaceActivity(ev.ID, e.ID, ev.Timestamp)
-		}
-
-		if err != nil {
-			a.log.Error().Err(err).Interface("event", e).Msg("could not process event")
-		}
-	}
-}
-
-// AddActivity adds the activity to the given resource and all its parents
-func (a *ActivitylogService) AddActivity(initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
-	gwc, err := a.gws.Next()
-	if err != nil {
-		return fmt.Errorf("cant get gateway client: %w", err)
-	}
-
-	ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
-	if err != nil {
-		return fmt.Errorf("cant get service user context: %w", err)
-	}
-	var span trace.Span
-	ctx, span = a.tracer.Start(ctx, "AddActivity")
-	defer span.End()
-
-	return a.addActivity(ctx, initRef, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
-		return utils.GetResource(ctx, ref, gwc)
-	})
-}
-
-// AddActivityTrashed adds the activity to given trashed resource and all its former parents
-func (a *ActivitylogService) AddActivityTrashed(resourceID *provider.ResourceId, reference *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
-	gwc, err := a.gws.Next()
-	if err != nil {
-		return fmt.Errorf("cant get gateway client: %w", err)
-	}
-
-	ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
-	if err != nil {
-		return fmt.Errorf("cant get service user context: %w", err)
-	}
-
-	// store activity on trashed item
-	if err := a.storeActivity(storagespace.FormatResourceID(resourceID), []RawActivity{
-		{
-			EventID:   eventID,
-			Depth:     0,
-			Timestamp: timestamp,
-		},
-	}); err != nil {
-		return fmt.Errorf("could not store activity: %w", err)
-	}
-
-	// get previous parent
-	ref := &provider.Reference{
-		ResourceId: reference.GetResourceId(),
-		Path:       filepath.Dir(reference.GetPath()),
-	}
-
-	var span trace.Span
-	ctx, span = a.tracer.Start(ctx, "AddActivityTrashed")
-	defer span.End()
-
-	return a.addActivity(ctx, ref, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
-		return utils.GetResource(ctx, ref, gwc)
-	})
-}
-
-// AddSpaceActivity adds the activity to the given spaceroot
-func (a *ActivitylogService) AddSpaceActivity(spaceID *provider.StorageSpaceId, eventID string, timestamp time.Time) error {
-	// spaceID is in format <providerid>$<spaceid>
-	// activitylog service uses format <providerid>$<spaceid>!<resourceid>
-	// lets do some converting, shall we?
-	rid, err := storagespace.ParseID(spaceID.GetOpaqueId())
-	if err != nil {
-		return fmt.Errorf("could not parse space id: %w", err)
-	}
-	rid.OpaqueId = rid.GetSpaceId()
-	return a.storeActivity(storagespace.FormatResourceID(&rid), []RawActivity{
-		{
-			EventID:   eventID,
-			Depth:     0,
-			Timestamp: timestamp,
-		},
-	})
-
-}
-
-// Activities returns the activities for the given resource
-func (a *ActivitylogService) Activities(rid *provider.ResourceId) ([]RawActivity, error) {
-	a.lock.RLock()
-	defer a.lock.RUnlock()
-
-	return a.activities(rid)
-}
-
-// RemoveActivities removes the activities from the given resource
-func (a *ActivitylogService) RemoveActivities(rid *provider.ResourceId, toDelete map[string]struct{}) error {
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	curActivities, err := a.activities(rid)
-	if err != nil {
-		return err
-	}
-
-	var acts []RawActivity
-	for _, a := range curActivities {
-		if _, ok := toDelete[a.EventID]; !ok {
-			acts = append(acts, a)
-		}
-	}
-
-	b, err := json.Marshal(acts)
-	if err != nil {
-		return err
-	}
-
-	_, err = a.natskv.Put(storagespace.FormatResourceID(rid), b)
-	return err
-}
-
-// RemoveResource removes the resource from the store
-func (a *ActivitylogService) RemoveResource(rid *provider.ResourceId) error {
-	if rid == nil {
-		return fmt.Errorf("resource id is required")
-	}
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	return a.natskv.Delete(storagespace.FormatResourceID(rid))
-}
-
-func (a *ActivitylogService) activities(rid *provider.ResourceId) ([]RawActivity, error) {
-	resourceID := storagespace.FormatResourceID(rid)
-
-	glob := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
-
-	watcher, err := a.natskv.Watch(glob, nats.IgnoreDeletes())
-	if err != nil {
-		return nil, err
-	}
-	defer watcher.Stop()
-
-	var activities []RawActivity
-	for update := range watcher.Updates() {
-		if update == nil {
-			break
-		}
-
-		var batchActivities []RawActivity
-		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
-			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
-		}
-		activities = append(activities, batchActivities...)
-	}
-
-	return activities, nil
-}
-
-// note: getResource is abstracted to allow unit testing, in general this will just be utils.GetResource
-func (a *ActivitylogService) addActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time, getResource func(context.Context, *provider.Reference) (*provider.ResourceInfo, error)) error {
-	var (
-		err   error
-		depth int
-		ref   = initRef
-	)
-	ctx, span := a.tracer.Start(ctx, "addActivity")
-	defer span.End()
-	for {
-		var info *provider.ResourceInfo
-		id := ref.GetResourceId()
-		if ref.Path != "" {
-			// Path based reference, we need to resolve the resource id
-			ctx, span = a.tracer.Start(ctx, "addActivity.getResource")
-			info, err = getResource(ctx, ref)
-			span.End()
-			if err != nil {
-				return fmt.Errorf("could not get resource info: %w", err)
-			}
-			id = info.GetId()
-		}
-		if id == nil {
-			return fmt.Errorf("resource id is required")
-		}
-
-		key := storagespace.FormatResourceID(id)
-		a.debouncer.Debounce(key, RawActivity{
-			EventID:   eventID,
-			Depth:     depth,
-			Timestamp: timestamp,
-		})
-
-		if id.OpaqueId == id.SpaceId {
-			// we are at the root of the space, no need to go further
-			break
-		}
-
-		// check if parent id is cached
-		// parent id is cached in the format <storageid>$<spaceid>!<resourceid>
-		// if it is not cached, get the resource info and cache it
-		if parentId == nil {
-			if v, err := a.parentIdCache.Get(key); err != nil {
-				if info == nil {
-					ctx, span := a.tracer.Start(ctx, "addActivity.getResource parent")
-					info, err = getResource(ctx, ref)
-					span.End()
-					if err != nil || info.GetParentId() == nil || info.GetParentId().GetOpaqueId() == "" {
-						return fmt.Errorf("could not get parent id: %w", err)
-					}
-				}
-				parentId = info.GetParentId()
-				a.parentIdCache.Set(key, parentId)
-			} else {
-				parentId = v.(*provider.ResourceId)
-			}
-		} else {
-			a.log.Debug().Msg("parent id is cached")
-		}
-
-		depth++
-		ref = &provider.Reference{ResourceId: parentId}
-		parentId = nil // reset parent id so it's not reused in the next iteration
-	}
-
-	return nil
-}
-
-func (a *ActivitylogService) storeActivity(resourceID string, activities []RawActivity) error {
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	ctx, span := a.tracer.Start(context.Background(), "storeActivity")
-	defer span.End()
-
-	_, subspan := a.tracer.Start(ctx, "storeActivity.Marshal")
-	b, err := msgpack.Marshal(activities)
-	if err != nil {
-		return err
-	}
-	subspan.End()
-
-	_, subspan = a.tracer.Start(ctx, "storeActivity.natskv.Put")
-	key := natsKey(resourceID, len(activities))
-	_, err = a.natskv.Put(key, b)
-	if err != nil {
-		return err
-	}
-	subspan.End()
-
-	ctx, subspan = a.tracer.Start(ctx, "storeActivity.enforceMaxActivities")
-	a.enforceMaxActivities(ctx, resourceID)
-	subspan.End()
-	return nil
-}
-
-func (a *ActivitylogService) enforceMaxActivities(ctx context.Context, resourceID string) {
-	if a.maxActivities <= 0 {
-		return
-	}
-
-	key := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
-
-	_, subspan := a.tracer.Start(ctx, "enforceMaxActivities.watch")
-	watcher, err := a.natskv.Watch(key, nats.IgnoreDeletes())
-	if err != nil {
-		a.log.Error().Err(err).Str("resourceID", resourceID).Msg("could not watch")
-		return
-	}
-	defer watcher.Stop()
-
-	var keys []string
-	for update := range watcher.Updates() {
-		if update == nil {
-			break
-		}
-
-		var batchActivities []RawActivity
-		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
-			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
-		}
-		keys = append(keys, update.Key())
-	}
-	subspan.End()
-
-	_, subspan = a.tracer.Start(ctx, "enforceMaxActivities.compile")
-	// Parse keys into batches
-	batches := make([]batchInfo, 0)
-	var activitiesCount int
-	for _, k := range keys {
-		parts := strings.SplitN(k, ".", 3)
-		if len(parts) < 3 {
-			a.log.Warn().Str("key", k).Msg("skipping key, not enough parts")
-			continue
-		}
-
-		c, err := strconv.Atoi(parts[1])
-		if err != nil {
-			a.log.Warn().Str("key", k).Msg("skipping key, can not parse count")
-			continue
-		}
-
-		// parse timestamp
-		nano, err := strconv.ParseInt(parts[2], 10, 64)
-		if err != nil {
-			a.log.Warn().Str("key", k).Msg("skipping key, can not parse timestamp")
-			continue
-		}
-
-		batches = append(batches, batchInfo{
-			key:       k,
-			count:     c,
-			timestamp: time.Unix(0, nano),
-		})
-		activitiesCount += c
-	}
-
-	// sort batches by timestamp
-	sort.Slice(batches, func(i, j int) bool {
-		return batches[i].timestamp.Before(batches[j].timestamp)
-	})
-	subspan.End()
-
-	_, subspan = a.tracer.Start(ctx, "enforceMaxActivities.delete")
-	// remove oldest keys until we are at max activities
-	for _, b := range batches {
-		if activitiesCount-b.count < a.maxActivities {
-			break
-		}
-
-		activitiesCount -= b.count
-		err = a.natskv.Delete(b.key)
-		if err != nil {
-			a.log.Error().Err(err).Str("key", b.key).Msg("could not delete key")
-			break
-		}
-	}
-	subspan.End()
-}
-
-func toRef(r *provider.ResourceId) *provider.Reference {
-	return &provider.Reference{
-		ResourceId: r,
-	}
-}
-
-func toSpace(r *provider.Reference) *provider.StorageSpaceId {
-	return &provider.StorageSpaceId{
-		OpaqueId: storagespace.FormatStorageID(r.GetResourceId().GetStorageId(), r.GetResourceId().GetSpaceId()),
-	}
-}
-
-func (a *ActivitylogService) removeCachedParentID(ref *provider.Reference) {
-	purgeId := ref.GetResourceId()
-	if ref.GetPath() != "" {
-		gwc, err := a.gws.Next()
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get gateway client")
-			return
-		}
-
-		ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get service user context")
-			return
-		}
-
-		info, err := utils.GetResource(ctx, ref, gwc)
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get resource info")
-			return
-		}
-		purgeId = info.GetId()
-	}
-	if err := a.parentIdCache.Remove(storagespace.FormatResourceID(purgeId)); err != nil {
-		a.log.Error().Interface("event", ref).Err(err).Msg("could not delete parent id cache")
-	}
-}
-
-func natsKey(resourceID string, activitiesCount int) string {
-	return fmt.Sprintf("%s.%d.%d",
-		base32.StdEncoding.EncodeToString([]byte(resourceID)),
-		activitiesCount,
-		time.Now().UnixNano())
-}

services/antivirus/pkg/command/server.go

@@ -43,7 +43,7 @@ func Server(cfg *config.Config) *cobra.Command {
 			{
 				svc, err := service.NewAntivirus(cfg, logger, traceProvider)
 				if err != nil {
-					fmt.Errorf("failed to initialize antivirus service: %v", err)
+					logger.Error().Err(err).Str("server", "antivirus").Msg("Failed to initialize antivirus service")
 					os.Exit(1)
 				}