Apply suggestion from @dschmidt

fix(search): print delete by query failures as json
fix(search): report rejected documents when indexing to OpenSearch
2026-09-11 13:19:07 -04:00 · 2026-08-29 08:49:59 +02:00 · 2026-08-29 08:49:59 +02:00 · 2026-08-29 08:49:05 +02:00
748 changed files with 25795 additions and 41312 deletions
@@ -65,12 +65,6 @@ $(GOVULNCHECK): $(BINGO_DIR)/govulncheck.mod
 	@echo "(re)installing $(GOBIN)/govulncheck-v1.1.4"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=govulncheck.mod -o=$(GOBIN)/govulncheck-v1.1.4 "golang.org/x/vuln/cmd/govulncheck"

-GOWRAP := $(GOBIN)/gowrap-v1.4.3
-$(GOWRAP): $(BINGO_DIR)/gowrap.mod
-	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/gowrap-v1.4.3"
-	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gowrap.mod -o=$(GOBIN)/gowrap-v1.4.3 "github.com/hexdigest/gowrap/cmd/gowrap"
-
 MOCKERY := $(GOBIN)/mockery-v3.4.0
 $(MOCKERY): $(BINGO_DIR)/mockery.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
@@ -1,5 +0,0 @@
-module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
-
-go 1.25.8
-
-require github.com/hexdigest/gowrap v1.4.3 // cmd/gowrap
@@ -1,55 +0,0 @@
-github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
-github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.1.1 h1:hLg3sBzpNErnxhQtUy/mmLR2I9foDujNK030IGemrRc=
-github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
-github.com/Masterminds/sprig/v3 v3.2.2 h1:17jRggJu518dr3QaafizSXOjKYp94wKfABxUmyxvxX8=
-github.com/Masterminds/sprig/v3 v3.2.2/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hexdigest/gowrap v1.4.3 h1:m+t8aj1pUiFQbEiE8QJg2xdYVH5DAMluLgZ9P/qEF0k=
-github.com/hexdigest/gowrap v1.4.3/go.mod h1:XWL8oQW2H3fX5ll8oT3Fduh4mt2H3cUAGQHQLMUbmG4=
-github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/huandu/xstrings v1.3.2 h1:L18LIDzqlW6xN2rEkpdV8+oL/IXWJ1APd+vsdYy4Wdw=
-github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/imdario/mergo v0.3.12 h1:b6R2BslTbIEToALKP7LxUvijTsNI9TAe80pLWN2g/HU=
-github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
-github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
-github.com/mitchellh/copystructure v1.1.2 h1:Th2TIvG1+6ma3e/0/bopBKohOTY7s4dA8V2q4EUcBJ0=
-github.com/mitchellh/copystructure v1.1.2/go.mod h1:EBArHfARyrSWO/+Wyr9zwEkc6XMFB9XyNgFNmRkZZU4=
-github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY70sEEpE=
-github.com/mitchellh/reflectwalk v1.0.1/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
-github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA=
-github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
-golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
-golang.org/x/mod v0.27.0 h1:kb+q2PyFnEADO2IEF935ehFUXlWiNjJWtRNgBLSfbxQ=
-golang.org/x/mod v0.27.0/go.mod h1:rWI627Fq0DEoudcK+MBkNkCe0EetEaDSwJJkCcjpazc=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -24,8 +24,6 @@ GOLANGCI_LINT="${GOBIN}/golangci-lint-v1.64.6"

 GOVULNCHECK="${GOBIN}/govulncheck-v1.1.4"

-GOWRAP="${GOBIN}/gowrap-v1.4.3"
-
 MOCKERY="${GOBIN}/mockery-v3.4.0"

 MUTAGEN="${GOBIN}/mutagen-v0.18.1"
@@ -18,8 +18,6 @@ exclude_paths:
  - 'deployments/**'
  - "release-config.ts"
  - 'tests/acceptance/expected-failures-*.md'
-  # written by the search engine parity suite, table rows are as wide as they are
-  - 'services/search/pkg/parity/README.md'
  - 'tests/acceptance/bootstrap/**'
  - 'tests/acceptance/TestHelpers/**'
  - 'tests/acceptance/scripts/run.sh'
@@ -1,21 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-# Purpose of this script is to parse the go.mod file to retrieve the version of
-# Go that we are using, either from a "toolchain" directive (preferred), or from
-# a "go" directive as a fallback.
-#
-# The script then outputs that version, where it will be picked up as an environment
-# variable in mise.
-
-F="./go.mod"
-
-AWK=awk
-# prefer 'gawk' over 'awk' to make sure we get GNU awk
-command -v gawk &>/dev/null && AWK=gawk
-
-[[ -e $F ]] || { echo "ERROR: failed to find $F" >&2; exit 1;}
-
-GO_VERSION=$("$AWK" '/^toolchain/ {print $2; exit} /^go / {print $2}' "$F")
-GO_VERSION=${GO_VERSION#go} # strip the potential 'go' prefix:
-echo "${GO_VERSION}"
@@ -8,7 +8,7 @@ docker_repo_slug = "opencloudeu/opencloud"

 # images
 ALPINE_GIT = "alpine/git:latest"
-APACHE_TIKA = "apache/tika:4.0.0-full"
+APACHE_TIKA = "apache/tika:3.2.3.0-full"
 CHKO_DOCKER_PUSHRM = "chko/docker-pushrm:1"
 CODACY_COVERAGE_REPORTER = "codacy/codacy-coverage-reporter:14.1.3"
 COLLABORA_CODE = "collabora/code:24.04.5.1.1"
@@ -202,14 +202,14 @@ config = {
                "apiSearch1",
            ],
            "skip": False,
-            "openSearch": True,
+            "nightlyOpenSearch": True,
        },
        "search2": {
            "suites": [
                "apiSearch2",
            ],
            "skip": False,
-            "openSearch": True,
+            "nightlyOpenSearch": True,
        },
        "sharingNg": {
            "suites": [
@@ -273,7 +273,7 @@ config = {
            ],
            "skip": False,
            "tikaNeeded": True,
-            "openSearch": True,
+            "nightlyOpenSearch": True,
        },
        "ocm": {
            "suites": [
@@ -331,8 +331,6 @@ config = {
                "ANTIVIRUS_CLAMAV_SOCKET": "tcp://clamav:3310",
                "OC_ASYNC_UPLOADS": True,
                "OC_ADD_RUN_SERVICES": "antivirus",
-                "OC_SERVICE_ACCOUNT_ID": "service-account-id",
-                "OC_SERVICE_ACCOUNT_SECRET": "service-account-secret",
            },
        },
        "multiTenancy": {
@@ -408,16 +406,6 @@ config = {
                "embed",
            ],
        },
-        # Runs the search-related e2e-tests against an OpenSearch search-engine.
-        "search": {
-            "skip": False,
-            "suites": [
-                "search/",
-                "file-action/favorites.feature",
-            ],
-            "tikaNeeded": True,
-            "openSearch": True,
-        },
    },
    "e2eMultiService": {
        "testSuites": {
@@ -1265,8 +1253,10 @@ def build_api_test_workflow_matrix(ctx, storage, suite_cfg, default_cfg):
        if matrix not in workflow_metrices and base in matrices:
            workflow_metrices.append(matrix)

-    # Add an OpenSearch search-engine variant for the search test suites.
-    if storage == "posix" and suite_cfg.get("openSearch", False):
+    # Add an OpenSearch search-engine variant for nightly running search tests,
+    # or on demand when "opensearch" is specified in the PR title
+    run_open_search = ctx.build.event == "cron" or "opensearch" in ctx.build.title.lower()
+    if run_open_search and storage == "posix" and suite_cfg.get("nightlyOpenSearch", False):
        os_matrix = {
            "withRemotePhp": False,
            "enableWatchFs": False,
@@ -1294,7 +1284,7 @@ def localApiTestPipeline(ctx):
        "withRemotePhp": False,
        "enableWatchFs": False,
        "ldapNeeded": False,
-        "openSearch": False,
+        "nightlyOpenSearch": False,
    }

    if "localApiTests" in config:
@@ -1540,7 +1530,6 @@ def e2eTestPipeline(ctx):
        "reportTracing": False,
        "enableWatchFs": [False],
        "storages": ["posix"],
-        "openSearch": False,
    }

    extra_server_environment = {
@@ -1584,30 +1573,14 @@ def e2eTestPipeline(ctx):
        if "[decomposed]" in ctx.build.title.lower():
            params["storages"] = ["decomposed"]

+        e2e_args = " ".join(params["suites"]) if params["suites"] else ""
+
        if "with-tracing" in ctx.build.title.lower():
            params["reportTracing"] = True

-        e2e_args = " ".join(params["suites"]) if params["suites"] else ""
-
-        # OpenSearch search-engine suites run posix-only without the watchfs matrix.
-        run_with_open_search = params["openSearch"]
-        if run_with_open_search:
-            params["storages"] = ["posix"]
-            params["enableWatchFs"] = [False]
-
        for storage in params["storages"]:
            for watch_fs_enabled in params["enableWatchFs"]:
-                pipeline_name = "test-e2e-%s-%s%s%s" % (
-                    name,
-                    storage,
-                    "-watchfs" if watch_fs_enabled else "",
-                    "-opensearch" if run_with_open_search else "",
-                )
-
-                server_environment = dict(extra_server_environment)
-                if run_with_open_search:
-                    server_environment["SEARCH_ENGINE_TYPE"] = "open-search"
-                    server_environment["SEARCH_ENGINE_OPEN_SEARCH_CLIENT_ADDRESSES"] = "http://open-search:9200"
+                pipeline_name = "test-e2e-%s-%s%s" % (name, storage, "-watchfs" if watch_fs_enabled else "")

                steps = \
                    evaluateWorkflowStep() + \
@@ -1616,10 +1589,9 @@ def e2eTestPipeline(ctx):
                    restoreWebPnpmCache() + \
                    restoreBrowsersCache() + \
                    (tikaService() if params["tikaNeeded"] else []) + \
-                    (waitForOpenSearch() if run_with_open_search else []) + \
                    opencloudServer(
                        storage,
-                        extra_server_environment = server_environment,
+                        extra_server_environment = extra_server_environment,
                        tika_enabled = params["tikaNeeded"],
                        watch_fs_enabled = watch_fs_enabled,
                    ) + \
@@ -1646,7 +1618,6 @@ def e2eTestPipeline(ctx):
                pipeline = {
                    "name": pipeline_name,
                    "steps": steps,
-                    "services": openSearchService() if run_with_open_search else [],
                    "depends_on": getPipelineNames(buildOpencloudBinaryForTesting(ctx) + buildWebCache(ctx)),
                    "when": e2e_trigger,
                }
@@ -3444,9 +3415,6 @@ def tikaService():
    return [{
        "name": "tika",
        "image": APACHE_TIKA,
-        # tika 4 discovers its plugins relative to the image working directory,
-        # the workspace default would leave the pipes fetchers empty
-        "directory": "/opt/tika-server",
        "detach": True,
    }, {
        "name": "wait-for-tika-service",
@@ -1,226 +0,0 @@
---
-title: "5. Unified Search Index Mapping"
---
-
-* Status: accepted
-* Deciders: @aduffeck, @butonic, @dschmidt, @fschade
-* Date: 2026-04-23, accepted and updated to the implemented state 2026-08-31
-
-Reference: implemented by https://github.com/opencloud-eu/opencloud/pull/3345 (reflection-based mapping, search siblings, shared query lowering) and https://github.com/opencloud-eu/opencloud/pull/3197 (schema versioning and startup checks). https://github.com/opencloud-eu/opencloud/pull/2659 was the original proof-of-concept.
-
-## Context and Problem Statement
-
-This section describes the state at decision time (April 2026); the implementation has since resolved the problems listed here.
-
-The search service supports two backends, bleve (embedded) and
-OpenSearch (external). Each backend currently carries its own,
-independently maintained description of the index layout:
-
- The bleve backend hand-builds a document mapping that explicitly
-  declares only Name, Tags, Favorites and Content. Everything else,
-  including the entire facet block (audio, image, photo, location),
-  is left to bleve's dynamic mapping.
- The OpenSearch backend ships a static JSON template that covers a
-  similar but not identical subset, plus a few OpenSearch-specific
-  primitives (path_hierarchy analyzer, wildcard MimeType). It does
-  not list the facet sub-fields either; they are produced by
-  OpenSearch's dynamic templating at first write.
- The graph DriveItem assembly path keeps its own private copy of a
-  reflection-based walker to turn CS3 ArbitraryMetadata back into
-  typed libregraph facets, parallel to the search service's
-  reflection helpers but maintained separately.
- The bleve KQL compiler keeps a hand-maintained set of field names
-  whose query values need to be pre-lowercased, with a comment that
-  literally says "Keep in sync with index.go".
-
-The current implementation has three concrete problems:
-
-1. **The two backends do not behave the same.** Both rely on their
-   own implicit defaults for fields that are not explicitly
-   declared. The inferred shapes differ: bleve produces keyword-
-   analyzed text, OpenSearch produces a `text + keyword` multi-field
-   with auto-detected dates. Nobody has written down which behavior
-   is the intended one. Two concrete instances surfaced while building
-   #2659:
-   - **mtime** is stored as an RFC3339 string. OpenSearch's dynamic
-     mapping auto-detects it as `date`; bleve leaves it `keyword`. So
-     `mtime:>...` is a chronological range on OpenSearch but a
-     lexicographic string compare on bleve.
-   - **name/tags**: bleve indexes a single lowercase token (exact or
-     wildcard match only); OpenSearch word-tokenizes, so a bare
-     `name:report` matches "My Report.txt" on OpenSearch but not on
-     bleve.
-2. **Drift risk.** The OpenSearch JSON template is a subset of what
-   actually gets indexed. Even where it overlaps with the bleve
-   mapping it diverges on analyzer choices. Because the facet
-   fields were not reachable from user queries at the time (no dot
-   syntax in the KQL compilers, no facet exposure on the hit and
-   REPORT paths), the divergence has been invisible, but it would
-   surface the moment the first working cross-backend facet query
-   landed.
-3. **Per-facet cost.** Adding a new facet (motionPhoto, etc.)
-   requires coordinated edits across the proto message, both backend
-   mappings, the bleve hit converters, the OpenSearch convert
-   closures, the search service's metadata persistence, the graph
-   DriveItem assembly, and the KQL compiler's lowercasing set. Most
-   of those edits are boilerplate following a copy-paste pattern.
-   Adding a genuinely new index capability (geopoint, wildcard,
-   ...) means wiring it in at every one of those sites, and there
-   is no single place to hook a type-specific adapter.
-
-### A note on backwards compatibility
-
-That the facet fields were unreachable at decision time has a
-useful corollary for this ADR: **changing the indexed shape of the
-facet fields cannot break any existing client of the search
-service**, because no client could successfully read them. The behavior changes
-discussed below are therefore additive in a literal sense; nothing
-that works today stops working as a result.
-
-## Decision Drivers
-
-* **Predictable OpenCloud API behavior independent of backend.**
-  Consumers of the search service should be able to rely on the
-  documented behavior of the API, not on which backend happens to
-  be configured. Today the same query can give different results
-  depending on whether bleve or OpenSearch is wired in (bleve's
-  dynamic default is `keyword`, exact match; OpenSearch's dynamic
-  default is `text + keyword`, also matches sub-tokens of a
-  string). That is backend-implementation leakage, and trying to
-  keep the two implicit defaults synchronized has not worked.
-* Single source of truth for the indexed schema, so the two backends
-  cannot drift silently again.
-* Reduce the per-facet cost so future facets (motionPhoto and
-  whatever comes next) can be added with minimal boilerplate.
-* Establish a single place to hook index-type-specific behavior, so
-  a new capability needs to be implemented at most once per backend
-  and then becomes available for any field uniformly.
-* A one-time reindex is an acceptable upgrade path. Both bleve and
-  OpenSearch store their mapping alongside the data; existing
-  indexes keep serving queries against their stored shape without
-  any automatic reshaping. Benefiting from the new behavior is done
-  by creating a fresh index and re-ingesting, which is the normal
-  reindex flow, rather than by inventing migration tooling.
-
-## Considered Options
-
-### Option 1: Do nothing, keep relying on implicit backend defaults
-
-Accept that bleve and OpenSearch each fall back to their own
-dynamic-mapping defaults for whatever is not explicitly declared,
-and treat the observable search behavior of OpenCloud as "whatever
-the configured backend happens to do". Adding a facet stays a
-copy-paste coordination across half a dozen sites; the existing
-divergence between bleve (keyword) and OpenSearch (`text + keyword`
-multi-field plus auto-date detection) stays silently in place
-until a working query actually reaches the diverging field and
-returns different answers on the two backends.
-
-Low upfront work, but it makes the OpenCloud API behavior a
-function of the backend rather than a contract, and it keeps the
-per-facet boilerplate cost for every new field.
-
-### Option 2: Generate one backend's mapping from the other
-
-Treat one backend as canonical (likely bleve, because Go types) and
-derive the other. Partial answer; it still does not help the reader
-path or the graph walker, and still leaves per-facet boilerplate in
-non-mapping code.
-
-### Option 3: A struct-driven mapping (chosen)
-
-Let the Go struct that represents an indexed document, together
-with a small overrides map, be the single source of truth. A
-reflection-based helper walks the struct via json tags and emits
-each backend's index mapping. The same definition drives the
-write-time path, the hit-decoding path, and the query compiler's
-case-folding rules. Any future field follows one declaration in
-one place and falls through the whole pipeline consistently.
-
-## Decision Outcome
-
-Adopt Option 3. The Go struct that represents an indexed document,
-together with a small overrides map, becomes the single source of
-truth for the search index. The bleve and OpenSearch index
-mappings, the write-time conversion, the hit-decoding path, and
-the query compiler's case-folding rules are all derived from that
-same definition. Drift between backends is prevented by
-construction, because there is no second place to edit.
-
-The overrides surface stays small. Each entry declares one of a
-handful of things per field: a semantic type for fields whose
-intent cannot be inferred from the Go type (for example a path-
-analyzed field, a fulltext field, a geopoint field), or search-
-behavior flags (case-insensitivity, word breaking, inclusion in
-the catch-all field). Any field that needs something beyond the
-inferred defaults gets one line in the overrides map and that one
-line flows through every derived piece. Overrides are validated at
-startup so a typo fails loudly instead of silently disabling a
-setting.
-
-A practical consequence of having one place to hook things: when a
-new capability is needed (a geopoint representation, a sibling
-field for a different aggregation behavior, a different analyzer
-for a class of fields, ...) it can be implemented once per backend
-in the central pipeline. After that, turning the capability on for
-a specific field is a single override entry, and both backends
-adopt it the same way. This ADR does not decide which capabilities
-to add, only that they will land in this uniform shape rather than
-through coordinated per-site edits.
-
-### Facet values are indexed as case-preserving keywords
-
-All facet sub-fields, meaning any leaf inside `audio`, `photo`, `image`, `location` and the facets that followed (`video`, `motionPhoto`, `livePhoto`), keep a case-preserving keyword as their stored base field on both backends. The raw value the extractor saw, or the CS3 ArbitraryMetadata string, is what lands in the index, and it is what returning, sorting and aggregations read.
-
-This is the single intended semantic for facets across bleve and
-OpenSearch, and it is driven by what aggregations need.
-Aggregation buckets ("group all files by `audio.artist`", "list
-distinct `photo.cameraMake`") return bucket keys drawn from the
-indexed terms. If the indexing analyzer lowercases (OpenSearch's
-default `text + keyword` multi-field against the text leg, or a
-`lowercaseKeyword`-style analyzer), the buckets come back lower-
-cased: a distinct-artists query would answer `motörhead` and
-`queen` instead of the original display casings, and two tag
-writers using `Motörhead` versus `MOTÖRHEAD` would collapse into a
-single bucket labelled `motörhead`. For a metadata display use
-case (thumbnails, facet filters in the UI, distinct lists) that
-behavior is not what we want.
-
-Searching is layered on top as exactly the strict superset the proposal reserved for later, and it shipped with the implementation: every keyword field additionally gets search-only sibling fields derived from the same definition, a `_lowercase` keyword sibling (doc values disabled; serves wildcards and `=` whole-value matches) and a `_words` text sibling (`words` analyzer: dots to spaces, unicode tokenization, lowercasing, no stemming; serves token and phrase matches). Case-insensitive, word-broken search is the default for every keyword field including facets; fields opt out per override where that is wrong: opaque ids (`ID`, `RootID`, `ParentID`, `Favorites`, `livePhoto.contentId`), the POSIX `Path`, the normalized `MimeType`, and `Content`, which is a fulltext field of its own. Aggregation buckets keep their display casing because they read the base field, never the siblings.
-
-The query side derives from the same source: the shared lowering pass resolves field names case-insensitively, folds values and routes each match to the right sibling (wildcards to `_lowercase`, tokens and phrases to `_words`, `=` as a whole-value term on `_lowercase`), and both backend compilers consume that one decision. The engine parity suite pins the resulting behavior against bleve and OpenSearch, so a divergence fails CI instead of surfacing in production. The case-sensitivity alignment started in #2633 is completed by deriving both sides from the same source.
-
-### Schema versioning and upgrades
-
-Index names carry a schema version derived from the single `search.SchemaVersion` constant (`opencloud-resource-v4`, `bleve-v4`). On startup the service classifies the stored mapping against the code: additive changes (new fields, unchanged analyzers) are reconciled in place without a version bump, breaking changes make the service refuse to start and name the reindex steps. The upgrade path is a plain reindex (`opencloud search index --all-spaces`) into the new versioned index; older indexes stay untouched and can be deleted afterwards (services/search/MIGRATION.md). Golden mapping tests on both backends pin the rendered mappings and reuse the same classifier to tell a contributor whether a change needs only a golden regeneration or a version bump.
-
-### Known trade-off
-
-The write-time pipeline produces the document as a generic map via
-a json round-trip. The OpenSearch write path already does the
-equivalent today via the same json-based conversion helper, so
-that path is unchanged. The bleve write path, which previously
-handed the struct directly to bleve's reflective indexer, now goes
-through the same map-producing step and pays roughly the same
-cost. On hot paths (initial indexing of a large space) this is
-measurable but not significant; if it ever matters, a direct
-reflection walker can replace the json round-trip without changing
-any call site.
-
-### Follow-ups out of scope for this ADR
-
- **WebDAV REPORT facet exposure.** The current webdav search
-  endpoint renders none of the facet fields back to the client.
-  This is a missing feature, not a regression of the proposal;
-  its natural resolution is to let the graph-search endpoint
-  (proposed in #3211) take over once graph search lands.
- **Graph search hit conversion.** Graph search (#3211) translates
-  proto hits back into libregraph DriveItems with the same
-  facet-copy helper the search service uses internally.
- **reva's PROPFIND facet listing** uses its own hand-maintained
-  per-facet key lists. reva deliberately does not depend on the
-  libregraph Go types, so unifying those key sets is a reva-side
-  decision tracked separately.
- **Write-path performance.** The json round-trip in the bleve
-  write path is an optional optimisation target with no call-site
-  impact when it lands.
@@ -11,7 +11,7 @@ require (
 	github.com/Nerzal/gocloak/v13 v13.9.0
 	github.com/bbalet/stopwords v1.0.0
 	github.com/beevik/etree v1.7.1
-	github.com/blevesearch/bleve/v2 v2.6.1
+	github.com/blevesearch/bleve/v2 v2.6.0
 	github.com/cenkalti/backoff v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.20.0
 	github.com/cs3org/go-cs3apis v0.0.0-20260424072047-8d9ef7076ae9
@@ -22,6 +22,7 @@ require (
 	github.com/ggwhite/go-masker v1.1.0
 	github.com/go-chi/chi/v5 v5.3.2
 	github.com/go-chi/render v1.0.3
+	github.com/go-jose/go-jose/v3 v3.0.5
 	github.com/go-ldap/ldap/v3 v3.4.14
 	github.com/go-ldap/ldif v0.0.0-20200320164324-fd88d9b715b3
 	github.com/go-micro/plugins/v4/client/grpc v1.2.1
@@ -62,21 +63,20 @@ require (
 	github.com/onsi/gomega v1.42.1
 	github.com/open-policy-agent/opa v1.19.1
 	github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89
-	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260902170011-45af3945a067
-	github.com/opencloud-eu/reva/v2 v2.49.1-0.20260903122659-26f34ec05774
+	github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260818063016-69f82a7dde55
+	github.com/opencloud-eu/reva/v2 v2.49.0
 	github.com/opensearch-project/opensearch-go/v4 v4.7.3
 	github.com/orcaman/concurrent-map v1.0.0
 	github.com/pkg/errors v0.9.1
 	github.com/pkg/xattr v0.4.12
 	github.com/prometheus/client_golang v1.24.1
-	github.com/prometheus/client_model v0.6.2
 	github.com/r3labs/sse/v2 v2.10.0
 	github.com/riandyrn/otelchi v0.12.3
 	github.com/rogpeppe/go-internal v1.16.0
 	github.com/rs/cors v1.11.1
 	github.com/rs/zerolog v1.35.1
 	github.com/shamaton/msgpack/v2 v2.4.1
-	github.com/sirupsen/logrus v1.10.1
+	github.com/sirupsen/logrus v1.10.0
 	github.com/spf13/afero v1.15.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
@@ -95,13 +95,13 @@ require (
 	go-micro.dev/v4 v4.11.0
 	go.etcd.io/bbolt v1.5.0
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0
-	go.opentelemetry.io/contrib/zpages v0.71.0
-	go.opentelemetry.io/otel v1.46.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0
+	go.opentelemetry.io/contrib/zpages v0.70.0
+	go.opentelemetry.io/otel v1.45.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
 	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0
-	go.opentelemetry.io/otel/sdk v1.46.0
-	go.opentelemetry.io/otel/trace v1.46.0
+	go.opentelemetry.io/otel/sdk v1.45.0
+	go.opentelemetry.io/otel/trace v1.45.0
 	golang.org/x/crypto v0.55.0
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
 	golang.org/x/image v0.45.0
@@ -111,7 +111,7 @@ require (
 	golang.org/x/term v0.45.0
 	golang.org/x/text v0.41.0
 	google.golang.org/genproto/googleapis/api v0.0.0-20260803160001-6ac0973c030d
-	google.golang.org/grpc v1.83.2
+	google.golang.org/grpc v1.83.1
 	google.golang.org/protobuf v1.36.12
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -141,13 +141,13 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bitly/go-simplejson v0.5.0 // indirect
 	github.com/bits-and-blooms/bitset v1.24.2 // indirect
-	github.com/blevesearch/bleve_index_api v1.4.1 // indirect
-	github.com/blevesearch/geo v0.2.6 // indirect
-	github.com/blevesearch/go-faiss v1.1.5 // indirect
+	github.com/blevesearch/bleve_index_api v1.3.11 // indirect
+	github.com/blevesearch/geo v0.2.5 // indirect
+	github.com/blevesearch/go-faiss v1.1.0 // indirect
 	github.com/blevesearch/go-porterstemmer v1.0.3 // indirect
 	github.com/blevesearch/gtreap v0.1.1 // indirect
 	github.com/blevesearch/mmap-go v1.2.0 // indirect
-	github.com/blevesearch/scorch_segment_api/v2 v2.4.10 // indirect
+	github.com/blevesearch/scorch_segment_api/v2 v2.4.7 // indirect
 	github.com/blevesearch/segment v0.9.1 // indirect
 	github.com/blevesearch/snowballstem v0.9.0 // indirect
 	github.com/blevesearch/upsidedown_store_api v1.0.2 // indirect
@@ -158,7 +158,7 @@ require (
 	github.com/blevesearch/zapx/v14 v14.4.3 // indirect
 	github.com/blevesearch/zapx/v15 v15.4.3 // indirect
 	github.com/blevesearch/zapx/v16 v16.3.4 // indirect
-	github.com/blevesearch/zapx/v17 v17.2.3 // indirect
+	github.com/blevesearch/zapx/v17 v17.1.2 // indirect
 	github.com/bluele/gcache v0.0.2 // indirect
 	github.com/bombsimon/logrusr/v3 v3.1.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
@@ -207,7 +207,6 @@ require (
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.9.0 // indirect
 	github.com/go-git/go-git/v5 v5.19.2 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
@@ -324,6 +323,8 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/pquerna/cachecontrol v0.2.0 // indirect
+	github.com/prometheus/alertmanager v0.33.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.70.1 // indirect
 	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/prometheus/statsd_exporter v0.22.8 // indirect
@@ -377,7 +378,7 @@ require (
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect
-	go.opentelemetry.io/otel/metric v1.46.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
@@ -146,22 +146,22 @@ github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngE
 github.com/bits-and-blooms/bitset v1.24.2 h1:M7/NzVbsytmtfHbumG+K2bremQPMJuqv1JD3vOaFxp0=
 github.com/bits-and-blooms/bitset v1.24.2/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
-github.com/blevesearch/bleve/v2 v2.6.1 h1:47vLskRTqxvQEtxVPYHjf5KpOgzD2msslXFjvUQCgWQ=
-github.com/blevesearch/bleve/v2 v2.6.1/go.mod h1:Dvvx6ZoEBTOj6RSzfk0lEz0wce/qhe2yOUubXeuzd2c=
-github.com/blevesearch/bleve_index_api v1.4.1 h1:CYIyecFlI+/RYjzUm+NmDjYbSvk870Bb7f+Vl4b12q8=
-github.com/blevesearch/bleve_index_api v1.4.1/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
-github.com/blevesearch/geo v0.2.6 h1:7K1oyQKYlauC+mJuo2AfNPyjN/4mihEoJMfyClVH1Mo=
-github.com/blevesearch/geo v0.2.6/go.mod h1:6qzVUiB4BK47QkSZcRqiXEP2W3EeXuzM5XFTF8AdZ8A=
-github.com/blevesearch/go-faiss v1.1.5 h1:/IU5lkOahH9Ghfk9n3F6N0XD7PYVXZJWmNDc9TtXuco=
-github.com/blevesearch/go-faiss v1.1.5/go.mod h1:w3W9AiWsFRGVaMG+/cmJi7iHEAuGyC6blsgO1EzCK/M=
+github.com/blevesearch/bleve/v2 v2.6.0 h1:Cyd3dd4q5tCbOV8MnKUVRUDYMHOir9xn12NZzXVSEd4=
+github.com/blevesearch/bleve/v2 v2.6.0/go.mod h1:gLmI8lWgHgrIYf7UpUX7JISI1CaqC6VScu46mHThuAY=
+github.com/blevesearch/bleve_index_api v1.3.11 h1:x29vbV8OjWfLcrDVd7Lr1q+BkLNS0JWNEig0MCVnKH4=
+github.com/blevesearch/bleve_index_api v1.3.11/go.mod h1:xvd48t5XMeeioWQ5/jZvgLrV98flT2rdvEJ3l/ki4Ko=
+github.com/blevesearch/geo v0.2.5 h1:yJg9FX1oRwLnjXSXF+ECHfXFTF4diF02Ca/qUGVjJhE=
+github.com/blevesearch/geo v0.2.5/go.mod h1:Jhq7WE2K6mJTx1xS44M2pUO6Io+wjCSHh1+co3YOgH4=
+github.com/blevesearch/go-faiss v1.1.0 h1:xM7Jc0ZUCv5lssG9Ohj3Jv0SdTpxcUABU1dDt9XVsc4=
+github.com/blevesearch/go-faiss v1.1.0/go.mod h1:OMGQwOaRRYxrmeNdMrXJPvVx8gBnvE5RYrr0BahNnkk=
 github.com/blevesearch/go-porterstemmer v1.0.3 h1:GtmsqID0aZdCSNiY8SkuPJ12pD4jI+DdXTAn4YRcHCo=
 github.com/blevesearch/go-porterstemmer v1.0.3/go.mod h1:angGc5Ht+k2xhJdZi511LtmxuEf0OVpvUUNrwmM1P7M=
 github.com/blevesearch/gtreap v0.1.1 h1:2JWigFrzDMR+42WGIN/V2p0cUvn4UP3C4Q5nmaZGW8Y=
 github.com/blevesearch/gtreap v0.1.1/go.mod h1:QaQyDRAT51sotthUWAH4Sj08awFSSWzgYICSZ3w0tYk=
 github.com/blevesearch/mmap-go v1.2.0 h1:l33nNKPFcBjJUMwem6sAYJPUzhUCABoK9FxZDGiFNBI=
 github.com/blevesearch/mmap-go v1.2.0/go.mod h1:Vd6+20GBhEdwJnU1Xohgt88XCD/CTWcqbCNxkZpyBo0=
-github.com/blevesearch/scorch_segment_api/v2 v2.4.10 h1:C3873+iWZ0YJM2ijaSHhJJzSvD4x1k+5UaQdGygZVhM=
-github.com/blevesearch/scorch_segment_api/v2 v2.4.10/go.mod h1:WUUkAocbkDlNK/kgAE13NvS9oxe+u618mYZ8sOvcCc4=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.7 h1:GlMzW08hcsM3DnLUxhyF/1PcDal1qtvvIuytuph5djw=
+github.com/blevesearch/scorch_segment_api/v2 v2.4.7/go.mod h1://IJ7tG3QCf0cWW/aVSXqy77tc1AvLu3fcJLYEvOAFs=
 github.com/blevesearch/segment v0.9.1 h1:+dThDy+Lvgj5JMxhmOVlgFfkUtZV2kw49xax4+jTfSU=
 github.com/blevesearch/segment v0.9.1/go.mod h1:zN21iLm7+GnBHWTao9I+Au/7MBiL8pPFtJBJTsk6kQw=
 github.com/blevesearch/snowballstem v0.9.0 h1:lMQ189YspGP6sXvZQ4WZ+MLawfV8wOmPoD/iWeNXm8s=
@@ -182,8 +182,8 @@ github.com/blevesearch/zapx/v15 v15.4.3 h1:iJiMJOHrz216jyO6lS0m9RTCEkprUnzvqAI2l
 github.com/blevesearch/zapx/v15 v15.4.3/go.mod h1:1pssev/59FsuWcgSnTa0OeEpOzmhtmr/0/11H0Z8+Nw=
 github.com/blevesearch/zapx/v16 v16.3.4 h1:hDAqA8qusZTNbPEL7//w5P65UZ2de6yhSeUaTbp0Po0=
 github.com/blevesearch/zapx/v16 v16.3.4/go.mod h1:zqkPPqs9GS9FzVWzCO3Wf1X044yWAV17+4zb+FTiEHg=
-github.com/blevesearch/zapx/v17 v17.2.3 h1:UYYJPAt5b2tVxldx5h0jmv23RMsg8/UZKFVya7v92po=
-github.com/blevesearch/zapx/v17 v17.2.3/go.mod h1:r7mb4QWbDQSkbAnOjCb9iCfkcrzajB4yBdJpuBIo/fE=
+github.com/blevesearch/zapx/v17 v17.1.2 h1:avbOk2igaASNoiy0BE/jPgcxAnRI2PGeydeP4hg7Ikk=
+github.com/blevesearch/zapx/v17 v17.1.2/go.mod h1:WQObxKrqUX7cd0G1GMvDfc/bmZzQvoy7APOPimx7DiI=
 github.com/bluele/gcache v0.0.2 h1:WcbfdXICg7G/DGBh1PFfcirkWOQV+v077yF1pSy3DGw=
 github.com/bluele/gcache v0.0.2/go.mod h1:m15KV+ECjptwSPxKhOhQoAFQVtUFjTVkc3H8o0t/fp0=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
@@ -940,10 +940,10 @@ github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-202505121527
 github.com/opencloud-eu/go-micro-plugins/v4/store/nats-js-kv v0.0.0-20250512152754-23325793059a/go.mod h1:pjcozWijkNPbEtX5SIQaxEW/h8VAVZYTLx+70bmB3LY=
 github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89 h1:W1ms+lP5lUUIzjRGDg93WrQfZJZCaV1ZP3KeyXi8bzY=
 github.com/opencloud-eu/icap-client v0.0.0-20250930132611-28a2afe62d89/go.mod h1:vigJkNss1N2QEceCuNw/ullDehncuJNFB6mEnzfq9UI=
-github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260902170011-45af3945a067 h1:UkNMKauyJAzY6RE6mmthz9bQZLYkbvBuApm7ZDCparE=
-github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260902170011-45af3945a067/go.mod h1:lTM8JeGblNpoMySTW7Lui2+c5TTLI95mwxtdUIHHrhU=
-github.com/opencloud-eu/reva/v2 v2.49.1-0.20260903122659-26f34ec05774 h1:8N42Pwzyafdxq66zYP6kJ1CH/QBRpxovQXq/0Kt6bJY=
-github.com/opencloud-eu/reva/v2 v2.49.1-0.20260903122659-26f34ec05774/go.mod h1:Frg+UWnVcSy+412UB3l2LcD0KY8ZNu1samimwkNywbg=
+github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260818063016-69f82a7dde55 h1:dzYZ5iA6i0QoFUap9l6sZ4Ts2HXiXVfsOoiRYToYgm8=
+github.com/opencloud-eu/libre-graph-api-go v1.0.8-0.20260818063016-69f82a7dde55/go.mod h1:lTM8JeGblNpoMySTW7Lui2+c5TTLI95mwxtdUIHHrhU=
+github.com/opencloud-eu/reva/v2 v2.49.0 h1:AwECMDDth3NUaihZRf9bI9HNpWutvaRijOCvQyQfTT4=
+github.com/opencloud-eu/reva/v2 v2.49.0/go.mod h1:Frg+UWnVcSy+412UB3l2LcD0KY8ZNu1samimwkNywbg=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4 h1:l2oB/RctH+t8r7QBj5p8thfEHCM/jF35aAY3WQ3hADI=
 github.com/opencloud-eu/secure v0.0.0-20260312082735-b6f5cb2244e4/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -1001,6 +1001,8 @@ github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:Om
 github.com/pquerna/cachecontrol v0.2.0 h1:vBXSNuE5MYP9IJ5kjsdo8uq+w41jSPgvba2DEnkRx9k=
 github.com/pquerna/cachecontrol v0.2.0/go.mod h1:NrUG3Z7Rdu85UNR3vm7SOsl1nFIeSiQnrHV5K9mBcUI=
 github.com/pquerna/otp v1.3.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/prometheus/alertmanager v0.33.1 h1:PJHGvTdb8Q0ZEpJnWff120WxB2kxIScLa707AaIudTo=
+github.com/prometheus/alertmanager v0.33.1/go.mod h1:V06Uc8EZ5X5wLOJRGhtXx+EE2LgrinFIADbKWMVm1RY=
 github.com/prometheus/client_golang v0.8.0/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
@@ -1113,8 +1115,8 @@ github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPx
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/sirupsen/logrus v1.10.1 h1:xi4336Zh11WpU14fXR6I67V3yaTPQYwRx2WEtHbRg4Q=
-github.com/sirupsen/logrus v1.10.1/go.mod h1:vsQHnG7xzNsxk3NrwboUiWPnIC3dmbjcGPykD7+tiHk=
+github.com/sirupsen/logrus v1.10.0 h1:T8MxJJXVZkfcC5zSRMRAg2F8+lxjmUCGGWPzFxO+Msc=
+github.com/sirupsen/logrus v1.10.0/go.mod h1:FXZFonkDAnFozmO+5hGAFvB0Yg9/j2SIhA/QuIkP180=
 github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/skratchdot/open-golang v0.0.0-20160302144031-75fb7ed4208c/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
@@ -1293,26 +1295,26 @@ go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0 h1:oECp5f+hN7nkwjU/8BxQ/q23bGPb8FIrD839owX222E=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.70.0/go.mod h1:DqEFwLumhzMBDQv9PcWbyoDxHI/4lAk6CM4nJBH39sc=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 h1:3g7B90UzBltIDKq1/5mrTGxTnOFDV0ICOhLoxiZ8jlg=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU=
-go.opentelemetry.io/contrib/zpages v0.71.0 h1:OrQSEmdlfknIusEyGj/t30uBR7MnbmGcCRBt5ov8/rA=
-go.opentelemetry.io/contrib/zpages v0.71.0/go.mod h1:C3IIpqkQbjswcSREqxQLyEapF0SI9bqwJpxpjwtzFrE=
-go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc=
-go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=
+go.opentelemetry.io/contrib/zpages v0.70.0 h1:uBcclHekIrCRLO4KZfXiebDcWB52QQXaHGgvhUJ1K5I=
+go.opentelemetry.io/contrib/zpages v0.70.0/go.mod h1:Nz9A1+68HVoJrk+cg92zJbcbHFAa+Jbl1uINwAlcK94=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0 h1:lsA/S1bxgdbyFGkTj+3meEdJ6ADVU7QoFstV6MXgE68=
 go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.45.0/go.mod h1:L7u+MirGoB1bjeLH66+xDykF4RC8C3RN7lIFpBiewUo=
-go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8=
-go.opentelemetry.io/otel/metric v1.46.0/go.mod h1:iPmdWqifKUdzziPkvvzIJXITl56fQx2mGM/DHLB3/2o=
-go.opentelemetry.io/otel/sdk v1.46.0 h1:h5CNQQjEbuQXY/JfZtgt3i7HVFV3aHPO2OAwO2eTYPI=
-go.opentelemetry.io/otel/sdk v1.46.0/go.mod h1:GAERFXFt5SYCEB+YiKUbMBeza6UaDH7GmGOZEfh2gSM=
-go.opentelemetry.io/otel/sdk/metric v1.46.0 h1:0piZ26EG4RBfebb2jhDH6ERCYHoVWduc3kLgPCwSnSE=
-go.opentelemetry.io/otel/sdk/metric v1.46.0/go.mod h1:I1PbKrdVc8Qu8HYVDNtqVIwLwjNrhsV/uFuxfwg8mO4=
-go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c=
-go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
 go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
@@ -1721,8 +1723,8 @@ google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3Iji
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=
-google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8=
+google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
+google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
 google.golang.org/grpc/examples v0.0.0-20211102180624-670c133e568e h1:m7aQHHqd0q89mRwhwS9Bx2rjyl/hsFAeta+uGrHsQaU=
 google.golang.org/grpc/examples v0.0.0-20211102180624-670c133e568e/go.mod h1:gID3PKrg7pWKntu9Ss6zTLJ0ttC0X9IHgREOCZwbCVU=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
@@ -1,44 +0,0 @@
-package eventstest
-
-import (
-	"encoding/json"
-	"reflect"
-
-	"github.com/google/uuid"
-
-	rev "github.com/opencloud-eu/reva/v2/pkg/events"
-	microevents "go-micro.dev/v4/events"
-)
-
-func NewTestBus() TestBus {
-	return TestBus(make(chan rev.Event))
-}
-
-type TestBus chan rev.Event
-
-func (tb TestBus) Consume(_ string, _ ...microevents.ConsumeOption) (<-chan microevents.Event, error) {
-	ch := make(chan microevents.Event)
-	go func() {
-		for ev := range tb {
-			b, _ := json.Marshal(ev.Event)
-			ch <- microevents.Event{
-				Payload: b,
-				Metadata: map[string]string{
-					rev.MetadatakeyEventID:   ev.ID,
-					rev.MetadatakeyEventType: ev.Type,
-				},
-			}
-		}
-	}()
-	return ch, nil
-}
-
-func (tb TestBus) Publish(e any) string {
-	ev := rev.Event{
-		ID:    uuid.New().String(),
-		Type:  reflect.TypeOf(e).String(),
-		Event: e,
-	}
-	tb <- ev
-	return ev.ID
-}
@@ -1,143 +0,0 @@
-package metricstest
-
-import (
-	"fmt"
-
-	"github.com/prometheus/client_golang/prometheus"
-	dto "github.com/prometheus/client_model/go"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// copied and adapted from Prometheus testutil.ToFloat64(), since we don't import that package
-func collect(c prometheus.Collector) []prometheus.Metric {
-	result := []prometheus.Metric{}
-	ch := make(chan prometheus.Metric)
-	done := make(chan struct{})
-	go func() {
-		for m := range ch {
-			result = append(result, m)
-		}
-		close(done)
-	}()
-	c.Collect(ch)
-	close(ch)
-	<-done
-	return result
-}
-
-func RequireIsNotSet(t require.TestingT, c prometheus.Collector, msgAndArgs ...any) {
-	if h, ok := t.(interface{ Helper() }); ok {
-		h.Helper()
-	}
-	if !IsNotSet(t, c, msgAndArgs) {
-		t.FailNow()
-	}
-}
-
-func IsNotSet(t assert.TestingT, c prometheus.Collector, msgAndArgs ...any) bool {
-	if h, ok := t.(interface{ Helper() }); ok {
-		h.Helper()
-	}
-
-	m := collect(c)
-	if len(m) > 0 {
-		return assert.Fail(t, "Metric exists while expected to not exist", msgAndArgs)
-	} else {
-		return true
-	}
-}
-
-func RequireEqual(t require.TestingT, expected float64, c prometheus.Collector, msgAndArgs ...any) {
-	if h, ok := t.(interface{ Helper() }); ok {
-		h.Helper()
-	}
-	if !Equal(t, expected, c, msgAndArgs) {
-		t.FailNow()
-	}
-}
-
-// copied and adapted from Prometheus testutil.ToFloat64(), since we don't import that package
-func Equal(t assert.TestingT, expected float64, c prometheus.Collector, msgAndArgs ...any) bool {
-	if h, ok := t.(interface{ Helper() }); ok {
-		h.Helper()
-	}
-
-	m := collect(c)
-	if !assert.Len(t, m, 1, msgAndArgs...) {
-		return false
-	}
-	pb := &dto.Metric{}
-	err := m[0].Write(pb)
-	if !assert.NoError(t, err, msgAndArgs...) {
-		return false
-	}
-	if pb.Gauge != nil {
-		return assert.Equal(t, expected, pb.Gauge.GetValue(), msgAndArgs...)
-	} else if pb.Counter != nil {
-		return assert.Equal(t, expected, pb.Counter.GetValue(), msgAndArgs...)
-	} else if pb.Untyped != nil {
-		return assert.Equal(t, expected, pb.Untyped.GetValue(), msgAndArgs...)
-	} else {
-		return assert.Fail(t, fmt.Sprintf("collected a non-gauge/counter/untyped metric: %s", pb), msgAndArgs...)
-	}
-}
-
-func RequireEqualWithLabels(t require.TestingT, expectedValue float64, expectedLabels map[string]string, c prometheus.Collector, msgAndArgs ...any) {
-	if h, ok := t.(interface{ Helper() }); ok {
-		h.Helper()
-	}
-	if !EqualWithLabels(t, expectedValue, expectedLabels, c, msgAndArgs) {
-		t.FailNow()
-	}
-}
-
-func EqualWithLabels(t assert.TestingT, expectedValue float64, expectedLabels map[string]string, c prometheus.Collector, msgAndArgs ...any) bool {
-	if h, ok := t.(interface{ Helper() }); ok {
-		h.Helper()
-	}
-
-	m := collect(c)
-	if !assert.Len(t, m, 1, "collected %d metrics instead of exactly 1", len(m)) {
-		return false
-	}
-	pb := &dto.Metric{}
-	err := m[0].Write(pb)
-	if !assert.NoError(t, err) {
-		return false
-	}
-	if pb.Gauge != nil {
-		if !assert.Equal(t, expectedValue, pb.Gauge.GetValue()) {
-			return false
-		}
-	} else if pb.Counter != nil {
-		if !assert.Equal(t, expectedValue, pb.Counter.GetValue()) {
-			return false
-		}
-	} else if pb.Untyped != nil {
-		if !assert.Equal(t, expectedValue, pb.Untyped.GetValue()) {
-			return false
-		}
-	} else {
-		return assert.Fail(t, "collected a non-gauge/counter/untyped metric: %s", pb)
-	}
-
-	if !assert.NotNil(t, pb.Label) {
-		return false
-	}
-	actualLabels := map[string]string{}
-	for _, label := range pb.Label {
-		if !assert.NotNil(t, label) {
-			return false
-		}
-		if !assert.NotNil(t, label.Name) {
-			return false
-		}
-		if !assert.NotNil(t, label.Value) {
-			return false
-		}
-		actualLabels[*label.Name] = *label.Value
-	}
-	return assert.Equal(t, expectedLabels, actualLabels, msgAndArgs)
-}
@@ -1,14 +1,9 @@
-[env]
-GO_VERSION = "{{ exec(command='./.mise-go-version.sh') }}"
-
 [tools]
-go = "{{ env.GO_VERSION }}"
+go = "1.25"
 node = "24"
 pnpm = "11.1.3"
-"go:github.com/go-delve/delve/cmd/dlv" = "1.27.1"
+"go:github.com/go-delve/delve/cmd/dlv" = "1.27.0"
 "aqua:nats-io/natscli" = "0.4.0"
-k6 = "2.2.0"
-ginkgo = "latest"

 [tasks.build]
 description = "build"
@@ -25,8 +25,6 @@ var (
 	_nodesGlobPattern = "spaces/*/*/nodes/"
 )

-const posixDriver = "posix"
-
 // RevisionsCommand is the entrypoint for the revisions command.
 func RevisionsCommand(cfg *config.Config) *cobra.Command {
 	revCmd := &cobra.Command{
@@ -88,28 +86,23 @@ func PurgeRevisionsCommand(cfg *config.Config) *cobra.Command {
 				mechanism = "glob"
 			}

-			var posix = cfg.StorageUsers.Driver == posixDriver
-
 			var ch <-chan string
 			switch mechanism {
 			default:
 				fallthrough
 			case "glob":
-				p := generatePath(basePath, rid, posix)
+				p := generatePath(basePath, rid)
 				if rid.GetOpaqueId() == "" {
 					p = filepath.Join(p, "*/*/*/*/*")
 				}
 				ch = revisions.Glob(p)
 			case "workers":
-				p := generatePath(basePath, rid, posix)
+				p := generatePath(basePath, rid)
 				ch = revisions.GlobWorkers(p, "/*", "/*/*/*/*")
 			case "list":
-				p := basePath
-				if !posix {
-					p = filepath.Join(basePath, "spaces")
-				}
+				p := filepath.Join(basePath, "spaces")
 				if rid != nil {
-					p = generatePath(basePath, rid, posix)
+					p = generatePath(basePath, rid)
 				}
 				ch = revisions.List(p, 10)
 			}
@@ -151,44 +144,22 @@ func printResults(countFiles, countBlobs, countRevisions int, dryRun bool) {
 	}
 }

-func generatePath(basePath string, rid *provider.ResourceId, posix bool) string {
-	// decomposedfs and posix store the revisions of a node at different
-	// locations on disk, so the path has to be built per driver:
-	//   - decomposedfs: <basePath>/spaces/<pathified spaceID>/nodes/<pathified nodeID>.REV.<ts>
-	//   - posix:        <basePath>/<users|projects>/<spaceID>/.oc-nodes/<pathified nodeID>.REV.<ts>
-	if posix {
-		if rid == nil {
-			return filepath.Join(basePath, "*", "*", ".oc-nodes")
-		}
-
-		nid := lookup.Pathify(rid.GetOpaqueId(), 4, 2)
-		if nid != "" {
-			return filepath.Join(basePath, "*", "*", ".oc-nodes", nid+"*")
-		}
-
-		if rid.GetSpaceId() == "" {
-			return ""
-		}
-		return filepath.Join(basePath, "*", rid.GetSpaceId(), ".oc-nodes")
-	} else {
-		// decomposedfs
-		if rid == nil {
-
-			return filepath.Join(basePath, _nodesGlobPattern)
-		}
-
-		sid := lookup.Pathify(rid.GetSpaceId(), 1, 2)
-		if sid == "" {
-			return ""
-		}
-
-		nid := lookup.Pathify(rid.GetOpaqueId(), 4, 2)
-		if nid == "" {
-			return filepath.Join(basePath, "spaces", sid, "nodes")
-		}
-
-		return filepath.Join(basePath, "spaces", sid, "nodes", nid+"*")
+func generatePath(basePath string, rid *provider.ResourceId) string {
+	if rid == nil {
+		return filepath.Join(basePath, _nodesGlobPattern)
 	}
+
+	sid := lookup.Pathify(rid.GetSpaceId(), 1, 2)
+	if sid == "" {
+		return ""
+	}
+
+	nid := lookup.Pathify(rid.GetOpaqueId(), 4, 2)
+	if nid == "" {
+		return filepath.Join(basePath, "spaces", sid, "nodes")
+	}
+
+	return filepath.Join(basePath, "spaces", sid, "nodes", nid+"*")
 }

 func init() {
@@ -1,9 +1,7 @@
 package command

 import (
-	"context"
 	"errors"
-	"time"

 	"github.com/spf13/viper"

@@ -23,14 +21,6 @@ import (
 	"github.com/spf13/cobra"
 )

-// need to be discussed, for now I will let it here
-//
-// Problem:
-// in reva on CleanupStaleShares call there is migrations invokation, which at leat in tests takes some time,
-// reva code was modified to wait until migrations are done, to prevent cases when migrations are stuck and the
-// this executions is not returned this timeout is needed
-const cleanupTimeout = 1 * time.Minute
-
 // SharesCommand is the entrypoint for the groups command.
 func SharesCommand(cfg *config.Config) *cobra.Command {
 	sharesCmd := &cobra.Command{
@@ -130,11 +120,7 @@ func cleanup(_ *cobra.Command, cfg *config.Config) error {
 	}
 	serviceUserCtx = l.WithContext(serviceUserCtx)

-	cleanupCtx, cancel := context.WithTimeout(serviceUserCtx, cleanupTimeout)
-	defer cancel()
-	if err := mgr.(*jsoncs3.Manager).CleanupStaleShares(cleanupCtx); err != nil {
-		return configlog.ReturnError(err)
-	}
+	mgr.(*jsoncs3.Manager).CleanupStaleShares(serviceUserCtx)

 	return nil
 }
@@ -172,13 +158,11 @@ func revaShareConfig(cfg *sharing.Config) map[string]any {
 			"machine_auth_apikey": cfg.UserSharingDrivers.CS3.SystemUserAPIKey,
 		},
 		"jsoncs3": map[string]any{
-			"gateway_addr":           cfg.Reva.Address,
-			"provider_addr":          cfg.UserSharingDrivers.JSONCS3.ProviderAddr,
-			"system_user_id":         cfg.UserSharingDrivers.JSONCS3.SystemUserID,
-			"system_user_idp":        cfg.UserSharingDrivers.JSONCS3.SystemUserIDP,
-			"machine_auth_apikey":    cfg.UserSharingDrivers.JSONCS3.SystemUserAPIKey,
-			"service_account_id":     cfg.ServiceAccount.ServiceAccountID,
-			"service_account_secret": cfg.ServiceAccount.ServiceAccountSecret,
+			"gateway_addr":        cfg.Reva.Address,
+			"provider_addr":       cfg.UserSharingDrivers.JSONCS3.ProviderAddr,
+			"service_user_id":     cfg.UserSharingDrivers.JSONCS3.SystemUserID,
+			"service_user_idp":    cfg.UserSharingDrivers.JSONCS3.SystemUserIDP,
+			"machine_auth_apikey": cfg.UserSharingDrivers.JSONCS3.SystemUserAPIKey,
 		},
 	}
 }
@@ -36,8 +36,7 @@ func TrashPurgeEmptyDirsCommand(cfg *config.Config) *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			basePath, _ := cmd.Flags().GetString("basepath")
 			dryRun, _ := cmd.Flags().GetBool("dry-run")
-			posix := cfg.StorageUsers.Driver == posixDriver
-			if err := trash.PurgeTrashEmptyPaths(basePath, dryRun, posix); err != nil {
+			if err := trash.PurgeTrashEmptyPaths(basePath, dryRun); err != nil {
 				fmt.Println(err)
 				return err
 			}
@@ -68,7 +68,7 @@ func CreateConfig(insecure, forceOverwrite, diff bool, configPath, adminPassword
 		systemUserID, adminUserID, graphApplicationID, storageUsersMountID, serviceAccountID string
 		idmServicePassword, idpServicePassword, ocAdminServicePassword, revaServicePassword  string
 		tokenManagerJwtSecret, collaborationWOPISecret, machineAuthAPIKey, systemUserAPIKey  string
-		revaTransferSecret, serviceAccountSecret, urlSigningSecret string
+		revaTransferSecret, thumbnailsTransferSecret, serviceAccountSecret, urlSigningSecret string
 		adminPasswdwordGenerated                                                             bool
 	)

@@ -94,6 +94,7 @@ func CreateConfig(insecure, forceOverwrite, diff bool, configPath, adminPassword
 		machineAuthAPIKey = oldCfg.MachineAuthAPIKey
 		systemUserAPIKey = oldCfg.SystemUserAPIKey
 		revaTransferSecret = oldCfg.TransferSecret
+		thumbnailsTransferSecret = oldCfg.Thumbnails.Thumbnail.TransferSecret
 		serviceAccountSecret = oldCfg.Graph.ServiceAccount.ServiceAccountSecret
 		urlSigningSecret = oldCfg.URLSigningSecret
 		if urlSigningSecret == "" {
@@ -154,6 +155,10 @@ func CreateConfig(insecure, forceOverwrite, diff bool, configPath, adminPassword
 		if err != nil {
 			return fmt.Errorf("could not generate random secret for urlSigningSecret: %s", err)
 		}
+		thumbnailsTransferSecret, err = generators.GenerateRandomPassword(passwordLength)
+		if err != nil {
+			return fmt.Errorf("could not generate random password for thumbnailsTransferSecret: %s", err)
+		}
 		serviceAccountSecret, err = generators.GenerateRandomPassword(passwordLength)
 		if err != nil {
 			return fmt.Errorf("could not generate random secret for serviceAccountSecret: %s", err)
@@ -225,6 +230,11 @@ func CreateConfig(insecure, forceOverwrite, diff bool, configPath, adminPassword
 			},
 			ServiceAccount: serviceAccount,
 		},
+		Thumbnails: ThumbnailService{
+			Thumbnail: ThumbnailSettings{
+				TransferSecret: thumbnailsTransferSecret,
+			},
+		},
 		Gateway: Gateway{
 			StorageRegistry: StorageRegistry{
 				StorageUsersMountID: storageUsersMountID,
@@ -292,6 +302,9 @@ func CreateConfig(insecure, forceOverwrite, diff bool, configPath, adminPassword
 			},
 			ServiceAccount: serviceAccount,
 		}
+
+		cfg.Thumbnails.Thumbnail.WebdavAllowInsecure = true
+		cfg.Thumbnails.Thumbnail.Cs3AllowInsecure = true
 	}
 	yamlOutput, err := yaml.Marshal(cfg)
 	if err != nil {
@@ -33,6 +33,7 @@ type OpenCloudConfig struct {
 	Users             UsersAndGroupsService `yaml:"users"`
 	Groups            UsersAndGroupsService `yaml:"groups"`
 	Ocm               OcmService            `yaml:"ocm"`
+	Thumbnails        ThumbnailService      `yaml:"thumbnails"`
 	Search            Search                `yaml:"search"`
 	Audit             Audit                 `yaml:"audit"`
 	Settings          SettingsService       `yaml:"settings"`
@@ -219,6 +220,18 @@ type StorageUsers struct {
 	ServiceAccount ServiceAccount `yaml:"service_account"`
 }

+// ThumbnailSettings is the configuration for the thumbnail settings
+type ThumbnailSettings struct {
+	TransferSecret      string `yaml:"transfer_secret"`
+	WebdavAllowInsecure bool   `yaml:"webdav_allow_insecure"`
+	Cs3AllowInsecure    bool   `yaml:"cs3_allow_insecure"`
+}
+
+// ThumbnailService is the configuration for the thumbnail service
+type ThumbnailService struct {
+	Thumbnail ThumbnailSettings
+}
+
 // TokenManager is the configuration for the token manager
 type TokenManager struct {
 	JWTSecret string `yaml:"jwt_secret"`
@@ -10,23 +10,12 @@ import (
 const (
 	// _trashGlobPattern is the glob pattern to find all trash items
 	_trashGlobPattern = "spaces/*/*/trash/*/*/*/*"
-	// _trashRootPattern is the glob pattern of the trash container root
-	_trashRootPattern = "spaces/*/*/trash"
-	// _posixTrashGlobPattern is the glob pattern to find all trash items on posix
-	_posixTrashGlobPattern = "*/*/.Trash/files/*"
-	// _posixTrashRootPattern is the glob pattern of the trash container root on posix
-	_posixTrashRootPattern = "*/*/.Trash/files"
 )

 // PurgeTrashEmptyPaths purges empty paths in the trash
-func PurgeTrashEmptyPaths(p string, dryRun bool, posix bool) error {
-	pattern := _trashGlobPattern
-	if posix {
-		pattern = _posixTrashGlobPattern
-	}
-
+func PurgeTrashEmptyPaths(p string, dryRun bool) error {
 	// we have all trash nodes in all spaces now
-	dirs, err := filepath.Glob(filepath.Join(p, pattern))
+	dirs, err := filepath.Glob(filepath.Join(p, _trashGlobPattern))
 	if err != nil {
 		return err
 	}
@@ -36,26 +25,15 @@ func PurgeTrashEmptyPaths(p string, dryRun bool, posix bool) error {
 	}

 	for _, d := range dirs {
-		if err := removeEmptyFolder(d, dryRun, posix, p); err != nil {
+		if err := removeEmptyFolder(d, dryRun); err != nil {
 			return err
 		}
 	}
 	return nil
 }

-func removeEmptyFolder(path string, dryRun bool, posix bool, basePath string) error {
-
+func removeEmptyFolder(path string, dryRun bool) error {
 	if dryRun {
-		if posix {
-			// on posix the ".trashitem" entries are the actual data and can be
-			// files, which are skipped, so we need to check here if the path
-			// is the actual dir, the same check for real removal part
-			fi, err := os.Stat(path)
-			if err != nil || !fi.IsDir() {
-				return nil
-			}
-		}
-
 		f, err := os.ReadDir(path)
 		if err != nil {
 			return err
@@ -65,14 +43,6 @@ func removeEmptyFolder(path string, dryRun bool, posix bool, basePath string) er
 		}
 		return nil
 	}
-
-	if posix {
-		fi, err := os.Stat(path)
-		if err != nil || !fi.IsDir() {
-			return nil
-		}
-	}
-
 	if err := os.Remove(path); err != nil {
 		// we do not really care about the error here
 		// if the folder is not empty we will get an error,
@@ -80,17 +50,8 @@ func removeEmptyFolder(path string, dryRun bool, posix bool, basePath string) er
 		return nil
 	}
 	nd := filepath.Dir(path)
-	if isTrashRoot(nd, basePath, posix) {
+	if filepath.Base(nd) == "trash" {
 		return nil
 	}
-	return removeEmptyFolder(nd, dryRun, posix, basePath)
-}
-
-func isTrashRoot(path, basePath string, posix bool) bool {
-	rootPattern := _trashRootPattern
-	if posix {
-		rootPattern = _posixTrashRootPattern
-	}
-	matched, _ := filepath.Match(filepath.Join(basePath, rootPattern), path)
-	return matched
+	return removeEmptyFolder(nd, dryRun)
 }
@@ -1,109 +0,0 @@
-package trash
-
-import (
-	"os"
-	"testing"
-
-	"github.com/test-go/testify/require"
-)
-
-func TestIsTrashRootDecomposed(t *testing.T) {
-	storageRoot := "test_temp_" + t.Name()
-	defer os.RemoveAll(storageRoot)
-
-	require.True(t, isTrashRoot(storageRoot+"/spaces/id/id/trash", storageRoot, false))
-	require.False(t, isTrashRoot(storageRoot+"/spaces/id/id/trash/s1/s2/s3/node", storageRoot, false))
-	require.False(t, isTrashRoot(storageRoot+"/spaces/id/id/trash/s1/s2/trash/node", storageRoot, false))
-}
-
-func TestIsTrashRootPosix(t *testing.T) {
-	storageRoot := "test_temp_" + t.Name()
-	defer os.RemoveAll(storageRoot)
-
-	require.True(t, isTrashRoot(storageRoot+"/users/alice/.Trash/files", storageRoot, true))
-	require.False(t, isTrashRoot(storageRoot+"/users/alice/.Trash/files/item.trashitem", storageRoot, true))
-	require.False(t, isTrashRoot(storageRoot+"/users/alice/.Trash/files/item.trashitem/files", storageRoot, true))
-}
-
-func TestRemoveEmptyFolderPosix(t *testing.T) {
-	storageRoot := "test_temp_" + t.Name()
-	base := storageRoot + "/users/alice/.Trash/files"
-	defer os.RemoveAll(storageRoot)
-
-	emptyChain := base + "/empty.trashitem/sub/subsub"
-	require.NoError(t, os.MkdirAll(emptyChain, os.ModePerm))
-
-	nonEmpty := base + "/keep.trashitem"
-	require.NoError(t, os.MkdirAll(nonEmpty, os.ModePerm))
-	require.NoError(t, os.WriteFile(nonEmpty+"/file.txt", []byte("some text"), os.ModePerm))
-
-	require.NoError(t, removeEmptyFolder(emptyChain, false, true, storageRoot))
-
-	assertNoDirExists(t, emptyChain)
-	assertNoDirExists(t, base+"/empty.trashitem")
-	assertDirExists(t, base)
-	assertDirExists(t, nonEmpty)
-}
-
-func TestRemoveEmptyFolderPosixUserDirNamedFiles(t *testing.T) {
-	storageRoot := "test_temp_" + t.Name()
-	base := storageRoot + "/users/alice/.Trash/files"
-	defer os.RemoveAll(storageRoot)
-
-	nestedFilesDir := base + "/folder.trashitem/files/files"
-	require.NoError(t, os.MkdirAll(nestedFilesDir, os.ModePerm))
-
-	require.NoError(t, removeEmptyFolder(nestedFilesDir, false, true, storageRoot))
-
-	assertNoDirExists(t, nestedFilesDir)
-	assertNoDirExists(t, base+"/folder.trashitem/files")
-	assertNoDirExists(t, base+"/folder.trashitem")
-	assertDirExists(t, base)
-}
-
-func TestRemoveEmptyFolderDecomposed(t *testing.T) {
-	storageRoot := "test_temp_" + t.Name()
-	base := storageRoot + "/spaces/id/id/trash"
-	defer os.RemoveAll(storageRoot)
-
-	emptyChain := base + "/s1/s2/s3/node"
-	require.NoError(t, os.MkdirAll(emptyChain, os.ModePerm))
-
-	require.NoError(t, removeEmptyFolder(emptyChain, false, false, storageRoot))
-
-	assertNoDirExists(t, emptyChain)
-	assertNoDirExists(t, base+"/s1/s2/s3")
-	assertNoDirExists(t, base+"/s1/s2")
-	assertNoDirExists(t, base+"/s1")
-	assertDirExists(t, base)
-}
-
-func TestRemoveEmptyFolderDecomposedUserDirNamedTrash(t *testing.T) {
-	storageRoot := "test_temp_" + t.Name()
-	base := storageRoot + "/spaces/id/id/trash"
-	defer os.RemoveAll(storageRoot)
-
-	nestedTrashDir := base + "/s1/trash/s2/node"
-	require.NoError(t, os.MkdirAll(nestedTrashDir, os.ModePerm))
-
-	require.NoError(t, removeEmptyFolder(nestedTrashDir, false, false, storageRoot))
-
-	assertNoDirExists(t, nestedTrashDir)
-	assertNoDirExists(t, base+"/s1/trash/s2")
-	assertNoDirExists(t, base+"/s1/trash")
-	assertNoDirExists(t, base+"/s1")
-	assertDirExists(t, base)
-}
-
-func assertNoDirExists(t *testing.T, path string) {
-	t.Helper()
-	_, err := os.Stat(path)
-	require.True(t, os.IsNotExist(err))
-}
-
-func assertDirExists(t *testing.T, path string) {
-	t.Helper()
-	fi, err := os.Stat(path)
-	require.NoError(t, err)
-	require.True(t, fi.IsDir())
-}
@@ -43,10 +43,6 @@ type StringNode struct {
 	*Base
 	Key   string
 	Value string
-	Exact bool
-	// CaseInsensitive marks a case-insensitive restriction; set by the search
-	// lowering pass, a backend routes it to the field's lowercased form.
-	CaseInsensitive bool
 }

 // BooleanNode represents a bool value
@@ -64,14 +60,6 @@ type DateTimeNode struct {
 	Value    time.Time
 }

-// NumberNode represents a numeric value
-type NumberNode struct {
-	*Base
-	Key      string
-	Operator *OperatorNode
-	Value    float64
-}
-
 // OperatorNode represents an operator value like
 // AND, OR, NOT, =, <= ... and so on
 type OperatorNode struct {
@@ -21,7 +21,6 @@ func DiffAst(x, y any, opts ...cmp.Option) string {
 			cmpopts.IgnoreFields(ast.GroupNode{}, "Base"),
 			cmpopts.IgnoreFields(ast.BooleanNode{}, "Base"),
 			cmpopts.IgnoreFields(ast.DateTimeNode{}, "Base"),
-			cmpopts.IgnoreFields(ast.NumberNode{}, "Base"),
 		)...,
 	)
 }
@@ -2,11 +2,11 @@ package kql

 import (
 	"fmt"
-	"strconv"
 	"time"

 	"github.com/jinzhu/now"
 	"github.com/opencloud-eu/opencloud/pkg/ast"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/query"
 )

 func toNode[T ast.Node](in any) (T, error) {
@@ -84,7 +84,7 @@ func toTimeRange(in any) (*time.Time, *time.Time, error) {

 	value, err := toString(in)
 	if err != nil {
-		return &from, &to, &UnsupportedTimeRangeError{}
+		return &from, &to, &query.UnsupportedTimeRangeError{}
 	}

 	c := &now.Config{
@@ -131,17 +131,8 @@ func toTimeRange(in any) (*time.Time, *time.Time, error) {
 	}

 	if from.IsZero() || to.IsZero() {
-		return nil, nil, &UnsupportedTimeRangeError{}
+		return nil, nil, &query.UnsupportedTimeRangeError{}
 	}

 	return &from, &to, nil
 }
-
-func toFloat(v any) (float64, error) {
-	value, err := toString(v)
-	if err != nil {
-		return 0, err
-	}
-
-	return strconv.ParseFloat(value, 64)
-}
@@ -40,7 +40,6 @@ GroupNode <-
 PropertyRestrictionNodes <-
    YesNoPropertyRestrictionNode /
    DateTimeRestrictionNode /
-    NumberRestrictionNode /
    TextPropertyRestrictionNode

 YesNoPropertyRestrictionNode <-
@@ -70,22 +69,9 @@ DateTimeRestrictionNode <-
        return buildNaturalLanguageDateTimeNodes(k, v, c.text, c.pos)
    }

-NumberRestrictionNode <-
-    k:Key o:(
-        OperatorGreaterOrEqualNode /
-        OperatorLessOrEqualNode /
-        OperatorGreaterNode /
-        OperatorLessNode
-    ) '"'? v:Number '"'? {
-        return buildNumberNode(k, o, v, c.text, c.pos)
-    }
-
 TextPropertyRestrictionNode <-
-    k:Key OperatorEqualNode v:(String / [^ ()]+) {
-        return buildStringNode(k, v, true, c.text, c.pos)
-    } /
-    k:Key OperatorColonNode v:(String / [^ ()]+) {
-        return buildStringNode(k, v, false, c.text, c.pos)
+    k:Key (OperatorColonNode / OperatorEqualNode) v:(String / [^ ()]+){
+        return buildStringNode(k, v, c.text, c.pos)
    }

 ////////////////////////////////////////////////////////
@@ -98,12 +84,12 @@ FreeTextKeywordNodes <-

 PhraseNode <-
     OperatorColonNode? _ v:String _ OperatorColonNode? {
-        return buildStringNode("", v, false, c.text, c.pos)
+        return buildStringNode("", v, c.text, c.pos)
    }

 WordNode <-
     OperatorColonNode? _ v:[^ :()]+ _ OperatorColonNode? {
-        return buildStringNode("", v, false, c.text, c.pos)
+        return buildStringNode("", v, c.text, c.pos)
    }

 ////////////////////////////////////////////////////////
@@ -243,11 +229,6 @@ String <-
        return v, nil
    }

-Number <-
-    [0-9]+ ("." [0-9]+)? {
-        return string(c.text), nil
-    }
-
 Digit <-
    [0-9] {
        return c.text, nil
@@ -9,6 +9,7 @@ import (
 	"github.com/opencloud-eu/opencloud/pkg/ast"
 	"github.com/opencloud-eu/opencloud/pkg/ast/test"
 	"github.com/opencloud-eu/opencloud/pkg/kql"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/query"
 	tAssert "github.com/stretchr/testify/assert"
 )

@@ -33,13 +34,13 @@ func TestParse_Spec(t *testing.T) {
 		},
 		{
 			name: `AND`,
-			error: kql.StartsWithBinaryOperatorError{
+			error: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
 		{
 			name: `AND cat AND dog`,
-			error: kql.StartsWithBinaryOperatorError{
+			error: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
@@ -79,13 +80,13 @@ func TestParse_Spec(t *testing.T) {
 		},
 		{
 			name: `OR`,
-			error: kql.StartsWithBinaryOperatorError{
+			error: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolOR},
 			},
 		},
 		{
 			name: `OR cat AND dog`,
-			error: kql.StartsWithBinaryOperatorError{
+			error: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolOR},
 			},
 		},
@@ -144,22 +145,6 @@ func TestParse_Spec(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: `author="John Smith"`,
-			ast: &ast.Ast{
-				Nodes: []ast.Node{
-					&ast.StringNode{Key: "author", Value: "John Smith", Exact: true},
-				},
-			},
-		},
-		{
-			name: `filename=budget.xlsx`,
-			ast: &ast.Ast{
-				Nodes: []ast.Node{
-					&ast.StringNode{Key: "filename", Value: "budget.xlsx", Exact: true},
-				},
-			},
-		},
 		// 3.2.3 Implicit Operator for Property Restriction
 		{
 			name: `author:"John Smith" filetype:docx`,
@@ -438,60 +423,6 @@ func TestParse_Spec(t *testing.T) {
 	}
 }

-func TestParse_NumberRestrictionNode(t *testing.T) {
-	tests := []testCase{
-		{
-			name: "format",
-			query: join([]string{
-				`size>100`,
-				`size>"100"`,
-				`size>=15.5`,
-				`size<100`,
-				`size<=100`,
-			}),
-			ast: &ast.Ast{
-				Nodes: []ast.Node{
-					&ast.NumberNode{
-						Key:      "size",
-						Operator: &ast.OperatorNode{Value: ">"},
-						Value:    100,
-					},
-					&ast.OperatorNode{Value: kql.BoolAND},
-					&ast.NumberNode{
-						Key:      "size",
-						Operator: &ast.OperatorNode{Value: ">"},
-						Value:    100,
-					},
-					&ast.OperatorNode{Value: kql.BoolAND},
-					&ast.NumberNode{
-						Key:      "size",
-						Operator: &ast.OperatorNode{Value: ">="},
-						Value:    15.5,
-					},
-					&ast.OperatorNode{Value: kql.BoolAND},
-					&ast.NumberNode{
-						Key:      "size",
-						Operator: &ast.OperatorNode{Value: "<"},
-						Value:    100,
-					},
-					&ast.OperatorNode{Value: kql.BoolAND},
-					&ast.NumberNode{
-						Key:      "size",
-						Operator: &ast.OperatorNode{Value: "<="},
-						Value:    100,
-					},
-				},
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			testKQL(t, tc)
-		})
-	}
-}
-
 func TestParse_DateTimeRestrictionNode(t *testing.T) {
 	tests := []testCase{
 		{
@@ -929,37 +860,37 @@ func TestParse_Errors(t *testing.T) {
 	tests := []testCase{
 		{
 			query: "animal:(mammal:cat mammal:dog reptile:turtle)",
-			error: kql.NamedGroupInvalidNodesError{
+			error: query.NamedGroupInvalidNodesError{
 				Node: &ast.StringNode{Key: "mammal", Value: "cat"},
 			},
 		},
 		{
 			query: "animal:(cat mammal:dog turtle)",
-			error: kql.NamedGroupInvalidNodesError{
+			error: query.NamedGroupInvalidNodesError{
 				Node: &ast.StringNode{Key: "mammal", Value: "dog"},
 			},
 		},
 		{
 			query: "animal:(AND cat)",
-			error: kql.StartsWithBinaryOperatorError{
+			error: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
 		{
 			query: "animal:(OR cat)",
-			error: kql.StartsWithBinaryOperatorError{
+			error: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolOR},
 			},
 		},
 		{
 			query: "(AND cat)",
-			error: kql.StartsWithBinaryOperatorError{
+			error: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
 		{
 			query: "(OR cat)",
-			error: kql.StartsWithBinaryOperatorError{
+			error: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolOR},
 			},
 		},
@@ -0,0 +1,11 @@
+package kql
+
+import (
+	"time"
+)
+
+// PatchTimeNow is here to patch the package time now func,
+// which is used in the test suite
+func PatchTimeNow(t func() time.Time) {
+	timeNow = t
+}
@@ -50,7 +50,7 @@ func buildAST(n any, text []byte, pos position) (*ast.Ast, error) {
 	return a, nil
 }

-func buildStringNode(k, v any, exact bool, text []byte, pos position) (*ast.StringNode, error) {
+func buildStringNode(k, v any, text []byte, pos position) (*ast.StringNode, error) {
 	b, err := base(text, pos)
 	if err != nil {
 		return nil, err
@@ -70,7 +70,6 @@ func buildStringNode(k, v any, exact bool, text []byte, pos position) (*ast.Stri
 		Base:  b,
 		Key:   key,
 		Value: value,
-		Exact: exact,
 	}, nil
 }

@@ -102,36 +101,6 @@ func buildDateTimeNode(k, o, v any, text []byte, pos position) (*ast.DateTimeNod
 		Value:    value,
 	}, nil
 }
-
-func buildNumberNode(k, o, v any, text []byte, pos position) (*ast.NumberNode, error) {
-	b, err := base(text, pos)
-	if err != nil {
-		return nil, err
-	}
-
-	operator, err := toNode[*ast.OperatorNode](o)
-	if err != nil {
-		return nil, err
-	}
-
-	key, err := toString(k)
-	if err != nil {
-		return nil, err
-	}
-
-	value, err := toFloat(v)
-	if err != nil {
-		return nil, err
-	}
-
-	return &ast.NumberNode{
-		Base:     b,
-		Key:      key,
-		Operator: operator,
-		Value:    value,
-	}, nil
-}
-
 func buildNaturalLanguageDateTimeNodes(k, v any, text []byte, pos position) ([]ast.Node, error) {
 	b, err := base(text, pos)
 	if err != nil {
@@ -47,9 +47,3 @@ func (b Builder) Build(q string) (*ast.Ast, error) {
 // timeNow mirrors time.Now by default, the only reason why this exists
 // is to monkey patch it from the tests. See PatchTimeNow
 var timeNow = time.Now
-
-// PatchTimeNow pins the clock the natural language dates resolve against,
-// so a test can hold "today" still while it runs
-func PatchTimeNow(t func() time.Time) {
-	timeNow = t
-}
@@ -5,6 +5,7 @@ import (

 	"github.com/opencloud-eu/opencloud/pkg/ast"
 	"github.com/opencloud-eu/opencloud/pkg/kql"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/query"
 	tAssert "github.com/stretchr/testify/assert"
 )

@@ -21,7 +22,7 @@ func TestNewAST(t *testing.T) {
 		{
 			name:       "error",
 			givenQuery: kql.BoolAND,
-			expectedError: kql.StartsWithBinaryOperatorError{
+			expectedError: query.StartsWithBinaryOperatorError{
 				Node: &ast.OperatorNode{Value: kql.BoolAND},
 			},
 		},
@@ -2,6 +2,7 @@ package kql

 import (
 	"github.com/opencloud-eu/opencloud/pkg/ast"
+	"github.com/opencloud-eu/opencloud/services/search/pkg/query"
 )

 func validateAst(a *ast.Ast) error {
@@ -9,7 +10,7 @@ func validateAst(a *ast.Ast) error {
 	case *ast.OperatorNode:
 		switch node.Value {
 		case BoolAND, BoolOR:
-			return &StartsWithBinaryOperatorError{Node: node}
+			return &query.StartsWithBinaryOperatorError{Node: node}
 		}
 	}
 	return nil
@@ -20,14 +21,14 @@ func validateGroupNode(n *ast.GroupNode) error {
 	case *ast.OperatorNode:
 		switch node.Value {
 		case BoolAND, BoolOR:
-			return &StartsWithBinaryOperatorError{Node: node}
+			return &query.StartsWithBinaryOperatorError{Node: node}
 		}
 	}

 	if n.Key != "" {
 		for _, node := range n.Nodes {
 			if ast.NodeKey(node) != "" {
-				return &NamedGroupInvalidNodesError{Node: node}
+				return &query.NamedGroupInvalidNodesError{Node: node}
 			}
 		}
 	}
@@ -1,189 +0,0 @@
-package metrics
-
-import (
-	"fmt"
-	"reflect"
-	"strings"
-
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	"github.com/opencloud-eu/opencloud/pkg/version"
-	"github.com/prometheus/client_golang/prometheus"
-)
-
-type BuildInfoMetric = *prometheus.GaugeVec
-
-// Create a BuildInfo metric for the specified namespace and subsystem.
-func BuildInfo(namespace, subsystem string) BuildInfoMetric {
-	return prometheus.NewGaugeVec(prometheus.GaugeOpts{
-		Namespace: namespace,
-		Subsystem: subsystem,
-		Name:      "build_info",
-		Help:      "Build information",
-	}, []string{"version"})
-}
-
-// Determine the fully qualified name of a metric.
-//
-// Beware that this requires storing a value into the metric in order to make it
-// visible in a temporary registry.
-// If the metric is a MetricVec, it will be Reset().
-func describe(metric prometheus.Collector, initialize func() error) (string, error) {
-	reg := prometheus.NewRegistry()
-	if err := reg.Register(metric); err != nil {
-		return "", err
-	}
-	if err := initialize(); err != nil {
-		return "", err
-	}
-	if resettable, ok := metric.(*prometheus.MetricVec); ok {
-		defer resettable.Reset()
-	}
-	fams, err := reg.Gather()
-	if err != nil {
-		return "", err
-	}
-	if len(fams) == 0 {
-		return "", fmt.Errorf("no metric families gathered")
-	}
-	return fams[0].GetName(), nil
-}
-
-// Take a struct that contains metrics as attributes and register all of them
-// with the specified Registerer.
-func RegisterAll(registerer prometheus.Registerer, m any, logger *log.Logger) error {
-	// we go over all of them, use this to keep track of succeesses and failures
-	total := 0
-	succeeded := []string{}
-	failed := map[string]error{}
-
-	// we need to use reflection here to iterate over the public metric attributes
-	// that are contained in it
-	r := reflect.ValueOf(m)
-	if r.Kind() == reflect.Pointer {
-		r = r.Elem()
-	}
-
-	for i := 0; i < r.NumField(); i++ {
-		t := r.Type().Field(i)
-		n := t.Name // the name of the attribute (not the name of the metric)
-		f := r.Field(i)
-		if !f.CanInterface() {
-			continue // we won't be able to process that one, most probably because it's not exported
-		}
-		v := f.Interface()
-		switch c := v.(type) {
-		case prometheus.Collector:
-			total++
-			if err := registerer.Register(c); err != nil {
-				switch err.(type) {
-				case prometheus.AlreadyRegisteredError:
-					// silently ignore this error, as this case can happen when the suture service decides to restart
-					err = nil
-					succeeded = append(succeeded, n)
-				default:
-					failed[n] = err
-				}
-			} else {
-				succeeded = append(succeeded, n)
-
-				// special post-treatment for the BuildInfo metric, as we have that one pretty much
-				// everywhere: set its value with the current version so we don't need to do that every time
-				switch buildInfo := c.(type) {
-				case BuildInfoMetric:
-					if name, err := describe(buildInfo, func() error { buildInfo.WithLabelValues("0").Set(0.0); return nil }); err != nil {
-						failed[n] = err
-					} else if strings.HasSuffix(name, "_build_info") {
-						buildInfo.Reset()
-						buildInfo.WithLabelValues(version.GetString()).Set(1)
-					}
-				}
-			}
-		case *prometheus.Desc,
-			prometheus.GaugeOpts,
-			prometheus.CounterOpts,
-			prometheus.HistogramOpts,
-			prometheus.SummaryOpts,
-			prometheus.UntypedOpts:
-			// skip these
-		default:
-			failed[n] = fmt.Errorf("unsupported metric '%s' of type %T", n, c)
-		}
-	}
-	if len(failed) > 0 {
-		failedMsgs := []string{}
-		for name, err := range failed {
-			failedMsgs = append(failedMsgs, fmt.Sprintf("'%s' (%v)", name, err))
-		}
-		msg := strings.Join(failedMsgs, ", ")
-		if logger != nil {
-			logger.Warn().Msgf("registered %d/%d metrics successfully (%d failed): %s", len(succeeded), total, len(failed), msg)
-		}
-		return fmt.Errorf("failed to register metrics: %s", msg)
-	} else {
-		if logger != nil {
-			logger.Debug().Msgf("registered %d/%d metrics successfully (%d failed)", len(succeeded), total, len(failed))
-		}
-		return nil
-	}
-}
-
-// Register all the metrics that are contained as public attributes in the struct,
-// and log any errors that might occur while doing so.
-func Register[M any](reg prometheus.Registerer, m M, logger *log.Logger) (M, error) {
-	lr := NewLoggingPrometheusRegisterer(reg, logger)
-	err := RegisterAll(lr, m, logger)
-	return m, err
-}
-
-// Register a single metric.
-func RegisterMetric[M prometheus.Collector](reg prometheus.Registerer, m M, logger *log.Logger) error {
-	return NewLoggingPrometheusRegisterer(reg, logger).Register(m)
-}
-
-// Prometheus Registerer wrapper that logs every error that occurs when registering
-// a metric, and delegates to an actual Registerer.
-type LoggingPrometheusRegisterer struct {
-	delegate prometheus.Registerer
-	logger   *log.Logger
-}
-
-// Instantiate a Prometheus Registerer wrapper that logs every error that occurs when registering
-// a metric, and that delegates to an actual Registerer specified here.
-func NewLoggingPrometheusRegisterer(delegate prometheus.Registerer, logger *log.Logger) *LoggingPrometheusRegisterer {
-	return &LoggingPrometheusRegisterer{
-		delegate: delegate,
-		logger:   logger,
-	}
-}
-
-func (r *LoggingPrometheusRegisterer) Register(c prometheus.Collector) error {
-	err := r.delegate.Register(c)
-	if err != nil {
-		switch err.(type) {
-		case prometheus.AlreadyRegisteredError:
-			// silently ignore this error, as this case can happen when the suture service decides to restart
-			err = nil
-		default:
-			if r.logger != nil {
-				r.logger.Warn().Err(err).Msgf("failed to register metric")
-			}
-		}
-	}
-	return err
-}
-
-func (r *LoggingPrometheusRegisterer) MustRegister(collectors ...prometheus.Collector) {
-	for _, c := range collectors {
-		if err := r.Register(c); err != nil {
-			if r.logger != nil {
-				r.logger.Error().Err(err).Msg("failed to register metrics collector")
-			}
-		}
-	}
-}
-
-func (r *LoggingPrometheusRegisterer) Unregister(c prometheus.Collector) bool {
-	return r.delegate.Unregister(c)
-}
-
-var _ prometheus.Registerer = &LoggingPrometheusRegisterer{}
@@ -1,153 +0,0 @@
-package metrics
-
-import (
-	"fmt"
-	"math/rand/v2"
-	"testing"
-
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	"github.com/opencloud-eu/opencloud/pkg/version"
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/stretchr/testify/require"
-)
-
-func randName() string {
-	const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
-	n := 8 + rand.IntN(33)
-	b := make([]byte, n)
-	for i := range b {
-		b[i] = letterBytes[rand.IntN(len(letterBytes))]
-	}
-	return string(b)
-}
-
-func TestBuildInfo(t *testing.T) {
-	require := require.New(t)
-
-	namespace := "name-" + randName()
-	subsystem := "sub-" + randName()
-	expectedName := fmt.Sprintf("%s_%s_build_info", namespace, subsystem)
-	version := fmt.Sprintf("%d.%d.%d", rand.IntN(10), rand.IntN(10), rand.IntN(10))
-
-	g := BuildInfo(namespace, subsystem)
-	reg := prometheus.NewRegistry()
-	require.NoError(reg.Register(g))
-
-	{
-		mfs, err := reg.Gather()
-		require.NoError(err)
-		require.Len(mfs, 0)
-	}
-
-	g.WithLabelValues(version).Set(1)
-	{
-		mfs, err := reg.Gather()
-		require.NoError(err)
-		found := false
-		for _, mf := range mfs {
-			if mf.GetName() == expectedName {
-				found = true
-				ms := mf.GetMetric()
-				require.Len(ms, 1)
-				labels := ms[0].GetLabel()
-				require.Len(labels, 1)
-				require.NotNil(labels[0].Name)
-				require.Equal("version", *labels[0].Name)
-				require.NotNil(labels[0].Value)
-				require.Equal(version, *labels[0].Value)
-				require.Equal(1.0, ms[0].GetGauge().GetValue())
-			} else {
-				t.Fatalf("unexpected metric family %q", mf.GetName())
-			}
-		}
-		require.True(found, "failed to find metric %q", expectedName)
-	}
-}
-
-func TestRegisterAll(t *testing.T) {
-	require := require.New(t)
-
-	reg := prometheus.NewRegistry()
-	logger := log.NewLogger()
-	namespace := "name-" + randName()
-	subsystem := "sub-" + randName()
-
-	m := struct {
-		BuildInfo *prometheus.GaugeVec
-		Foo       *prometheus.GaugeVec
-		Bar       prometheus.Counter
-	}{
-		BuildInfo: BuildInfo(namespace, subsystem),
-		Foo: prometheus.NewGaugeVec(prometheus.GaugeOpts{
-			Namespace: namespace,
-			Subsystem: subsystem,
-			Name:      "foo",
-			ConstLabels: prometheus.Labels{
-				"f":  "oo",
-				"fo": "o",
-			},
-		}, []string{"oof"}),
-		Bar: prometheus.NewCounter(prometheus.CounterOpts{
-			Namespace: namespace,
-			Subsystem: subsystem,
-			Name:      "bar",
-		}),
-	}
-
-	expectedNameForBuildInfo := namespace + "_" + subsystem + "_build_info"
-	expectedNameForFoo := namespace + "_" + subsystem + "_foo"
-	expectedNameForBar := namespace + "_" + subsystem + "_bar"
-
-	{
-		mfs, err := reg.Gather()
-		require.NoError(err)
-		require.Len(mfs, 0)
-	}
-	require.NoError(RegisterAll(reg, m, &logger))
-	{
-		mfs, err := reg.Gather()
-		require.NoError(err)
-		require.Len(mfs, 3)
-		found := 0
-		for _, mf := range mfs {
-			switch mf.GetName() {
-			case expectedNameForBuildInfo:
-				found++
-				ms := mf.GetMetric()
-				require.Len(ms, 1)
-				labels := ms[0].GetLabel()
-				require.Len(labels, 1)
-				require.NotNil(labels[0].Name)
-				require.Equal("version", *labels[0].Name)
-				require.NotNil(labels[0].Value)
-				require.Equal(version.GetString(), *labels[0].Value)
-				require.Equal(1.0, ms[0].GetGauge().GetValue())
-			case expectedNameForFoo:
-				found++
-				ms := mf.GetMetric()
-				require.Len(ms, 1)
-				labels := ms[0].GetLabel()
-				require.Len(labels, 3)
-				require.NotNil(labels[0].Name)
-				require.Equal("f", *labels[0].Name)
-				require.NotNil(labels[0].Value)
-				require.Equal("oo", *labels[0].Value)
-				require.NotNil(labels[1].Name)
-				require.Equal("fo", *labels[1].Name)
-				require.NotNil(labels[1].Value)
-				require.Equal("o", *labels[1].Value)
-				require.Equal(0.0, ms[0].GetGauge().GetValue())
-			case expectedNameForBar:
-				found++
-				ms := mf.GetMetric()
-				require.Len(ms, 1)
-				labels := ms[0].GetLabel()
-				require.Len(labels, 0)
-				require.Equal(0.0, ms[0].GetGauge().GetValue())
-			default:
-				t.Fatalf("unexpected metric family %q", mf.GetName())
-			}
-		}
-		require.Equal(3, found, "failed to find expected metrics")
-	}
-}
@@ -2,7 +2,6 @@ package middleware

 import (
 	"context"
-	"errors"
 	"net/http"
 	"strings"
 	"sync"
@@ -62,10 +61,7 @@ func OidcAuth(opts ...Option) func(http.Handler) http.Handler {
 						provider, err = providerFunc()
 					}
 					initializeProviderLock.Unlock()
-					if err != nil || provider == nil {
-						if err == nil {
-							err = errors.New("OIDC provider initialization returned nil")
-						}
+					if err != nil {
 						opt.Logger.Error().Err(err).Msg("could not initialize OIDC provider")
 						w.WriteHeader(http.StatusInternalServerError)
 						return
@@ -86,12 +82,6 @@ func OidcAuth(opts ...Option) func(http.Handler) http.Handler {
 					w.WriteHeader(http.StatusUnauthorized)
 					return
 				}
-				if userInfo == nil {
-					opt.Logger.Error().Msg("OIDC provider returned empty user info")
-					w.Header().Add("WWW-Authenticate", `Bearer`)
-					w.WriteHeader(http.StatusUnauthorized)
-					return
-				}
 				claims := map[string]any{}
 				err = userInfo.Claims(&claims)
 				if err != nil {
@@ -535,267 +535,6 @@ func (x *Photo) GetTakenDateTime() *timestamppb.Timestamp {
 	return nil
 }

-type Video struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AudioBitsPerSample    *int32   `protobuf:"varint,1,opt,name=audioBitsPerSample,proto3,oneof" json:"audioBitsPerSample,omitempty"`
-	AudioChannels         *int32   `protobuf:"varint,2,opt,name=audioChannels,proto3,oneof" json:"audioChannels,omitempty"`
-	AudioFormat           *string  `protobuf:"bytes,3,opt,name=audioFormat,proto3,oneof" json:"audioFormat,omitempty"`
-	AudioSamplesPerSecond *int32   `protobuf:"varint,4,opt,name=audioSamplesPerSecond,proto3,oneof" json:"audioSamplesPerSecond,omitempty"`
-	Bitrate               *int32   `protobuf:"varint,5,opt,name=bitrate,proto3,oneof" json:"bitrate,omitempty"`
-	Duration              *int64   `protobuf:"varint,6,opt,name=duration,proto3,oneof" json:"duration,omitempty"`
-	FourCC                *string  `protobuf:"bytes,7,opt,name=fourCC,proto3,oneof" json:"fourCC,omitempty"`
-	FrameRate             *float64 `protobuf:"fixed64,8,opt,name=frameRate,proto3,oneof" json:"frameRate,omitempty"`
-	Height                *int32   `protobuf:"varint,9,opt,name=height,proto3,oneof" json:"height,omitempty"`
-	Width                 *int32   `protobuf:"varint,10,opt,name=width,proto3,oneof" json:"width,omitempty"`
-}
-
-func (x *Video) Reset() {
-	*x = Video{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Video) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Video) ProtoMessage() {}
-
-func (x *Video) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Video.ProtoReflect.Descriptor instead.
-func (*Video) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *Video) GetAudioBitsPerSample() int32 {
-	if x != nil && x.AudioBitsPerSample != nil {
-		return *x.AudioBitsPerSample
-	}
-	return 0
-}
-
-func (x *Video) GetAudioChannels() int32 {
-	if x != nil && x.AudioChannels != nil {
-		return *x.AudioChannels
-	}
-	return 0
-}
-
-func (x *Video) GetAudioFormat() string {
-	if x != nil && x.AudioFormat != nil {
-		return *x.AudioFormat
-	}
-	return ""
-}
-
-func (x *Video) GetAudioSamplesPerSecond() int32 {
-	if x != nil && x.AudioSamplesPerSecond != nil {
-		return *x.AudioSamplesPerSecond
-	}
-	return 0
-}
-
-func (x *Video) GetBitrate() int32 {
-	if x != nil && x.Bitrate != nil {
-		return *x.Bitrate
-	}
-	return 0
-}
-
-func (x *Video) GetDuration() int64 {
-	if x != nil && x.Duration != nil {
-		return *x.Duration
-	}
-	return 0
-}
-
-func (x *Video) GetFourCC() string {
-	if x != nil && x.FourCC != nil {
-		return *x.FourCC
-	}
-	return ""
-}
-
-func (x *Video) GetFrameRate() float64 {
-	if x != nil && x.FrameRate != nil {
-		return *x.FrameRate
-	}
-	return 0
-}
-
-func (x *Video) GetHeight() int32 {
-	if x != nil && x.Height != nil {
-		return *x.Height
-	}
-	return 0
-}
-
-func (x *Video) GetWidth() int32 {
-	if x != nil && x.Width != nil {
-		return *x.Width
-	}
-	return 0
-}
-
-type MotionPhoto struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Version                 *int32 `protobuf:"varint,1,opt,name=version,proto3,oneof" json:"version,omitempty"`
-	PresentationTimestampUs *int64 `protobuf:"varint,2,opt,name=presentationTimestampUs,proto3,oneof" json:"presentationTimestampUs,omitempty"`
-	VideoSize               *int64 `protobuf:"varint,3,opt,name=videoSize,proto3,oneof" json:"videoSize,omitempty"`
-}
-
-func (x *MotionPhoto) Reset() {
-	*x = MotionPhoto{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *MotionPhoto) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*MotionPhoto) ProtoMessage() {}
-
-func (x *MotionPhoto) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use MotionPhoto.ProtoReflect.Descriptor instead.
-func (*MotionPhoto) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *MotionPhoto) GetVersion() int32 {
-	if x != nil && x.Version != nil {
-		return *x.Version
-	}
-	return 0
-}
-
-func (x *MotionPhoto) GetPresentationTimestampUs() int64 {
-	if x != nil && x.PresentationTimestampUs != nil {
-		return *x.PresentationTimestampUs
-	}
-	return 0
-}
-
-func (x *MotionPhoto) GetVideoSize() int64 {
-	if x != nil && x.VideoSize != nil {
-		return *x.VideoSize
-	}
-	return 0
-}
-
-type LivePhoto struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ContentId              *string  `protobuf:"bytes,1,opt,name=contentId,proto3,oneof" json:"contentId,omitempty"`
-	StillImageTimeUs       *int64   `protobuf:"varint,2,opt,name=stillImageTimeUs,proto3,oneof" json:"stillImageTimeUs,omitempty"`
-	Auto                   *bool    `protobuf:"varint,3,opt,name=auto,proto3,oneof" json:"auto,omitempty"`
-	VitalityScore          *float64 `protobuf:"fixed64,4,opt,name=vitalityScore,proto3,oneof" json:"vitalityScore,omitempty"`
-	VitalityScoringVersion *int64   `protobuf:"varint,5,opt,name=vitalityScoringVersion,proto3,oneof" json:"vitalityScoringVersion,omitempty"`
-}
-
-func (x *LivePhoto) Reset() {
-	*x = LivePhoto{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *LivePhoto) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LivePhoto) ProtoMessage() {}
-
-func (x *LivePhoto) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LivePhoto.ProtoReflect.Descriptor instead.
-func (*LivePhoto) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{8}
-}
-
-func (x *LivePhoto) GetContentId() string {
-	if x != nil && x.ContentId != nil {
-		return *x.ContentId
-	}
-	return ""
-}
-
-func (x *LivePhoto) GetStillImageTimeUs() int64 {
-	if x != nil && x.StillImageTimeUs != nil {
-		return *x.StillImageTimeUs
-	}
-	return 0
-}
-
-func (x *LivePhoto) GetAuto() bool {
-	if x != nil && x.Auto != nil {
-		return *x.Auto
-	}
-	return false
-}
-
-func (x *LivePhoto) GetVitalityScore() float64 {
-	if x != nil && x.VitalityScore != nil {
-		return *x.VitalityScore
-	}
-	return 0
-}
-
-func (x *LivePhoto) GetVitalityScoringVersion() int64 {
-	if x != nil && x.VitalityScoringVersion != nil {
-		return *x.VitalityScoringVersion
-	}
-	return 0
-}
-
 type Entity struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -821,15 +560,12 @@ type Entity struct {
 	Image            *Image                 `protobuf:"bytes,18,opt,name=image,proto3" json:"image,omitempty"`
 	Photo            *Photo                 `protobuf:"bytes,19,opt,name=photo,proto3" json:"photo,omitempty"`
 	Favorites        []string               `protobuf:"bytes,20,rep,name=favorites,proto3" json:"favorites,omitempty"`
-	MotionPhoto      *MotionPhoto           `protobuf:"bytes,21,opt,name=motionPhoto,proto3" json:"motionPhoto,omitempty"`
-	Video            *Video                 `protobuf:"bytes,22,opt,name=video,proto3" json:"video,omitempty"`
-	LivePhoto        *LivePhoto             `protobuf:"bytes,23,opt,name=livePhoto,proto3" json:"livePhoto,omitempty"`
 }

 func (x *Entity) Reset() {
 	*x = Entity{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[9]
+		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -842,7 +578,7 @@ func (x *Entity) String() string {
 func (*Entity) ProtoMessage() {}

 func (x *Entity) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[9]
+	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -855,7 +591,7 @@ func (x *Entity) ProtoReflect() protoreflect.Message {

 // Deprecated: Use Entity.ProtoReflect.Descriptor instead.
 func (*Entity) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{9}
+	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{6}
 }

 func (x *Entity) GetRef() *Reference {
@@ -998,27 +734,6 @@ func (x *Entity) GetFavorites() []string {
 	return nil
 }

-func (x *Entity) GetMotionPhoto() *MotionPhoto {
-	if x != nil {
-		return x.MotionPhoto
-	}
-	return nil
-}
-
-func (x *Entity) GetVideo() *Video {
-	if x != nil {
-		return x.Video
-	}
-	return nil
-}
-
-func (x *Entity) GetLivePhoto() *LivePhoto {
-	if x != nil {
-		return x.LivePhoto
-	}
-	return nil
-}
-
 type Match struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -1033,7 +748,7 @@ type Match struct {
 func (x *Match) Reset() {
 	*x = Match{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[10]
+		mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1046,7 +761,7 @@ func (x *Match) String() string {
 func (*Match) ProtoMessage() {}

 func (x *Match) ProtoReflect() protoreflect.Message {
-	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[10]
+	mi := &file_opencloud_messages_search_v0_search_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1059,7 +774,7 @@ func (x *Match) ProtoReflect() protoreflect.Message {

 // Deprecated: Use Match.ProtoReflect.Descriptor instead.
 func (*Match) Descriptor() ([]byte, []int) {
-	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{10}
+	return file_opencloud_messages_search_v0_search_proto_rawDescGZIP(), []int{7}
 }

 func (x *Match) GetEntity() *Entity {
@@ -1193,141 +908,62 @@ var file_opencloud_messages_search_v0_search_proto_rawDesc = []byte{
 	0x6c, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x69, 0x73, 0x6f, 0x42,
 	0x0e, 0x0a, 0x0c, 0x5f, 0x6f, 0x72, 0x69, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42,
 	0x10, 0x0a, 0x0e, 0x5f, 0x74, 0x61, 0x6b, 0x65, 0x6e, 0x44, 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d,
-	0x65, 0x22, 0x9b, 0x04, 0x0a, 0x05, 0x56, 0x69, 0x64, 0x65, 0x6f, 0x12, 0x33, 0x0a, 0x12, 0x61,
-	0x75, 0x64, 0x69, 0x6f, 0x42, 0x69, 0x74, 0x73, 0x50, 0x65, 0x72, 0x53, 0x61, 0x6d, 0x70, 0x6c,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x48, 0x00, 0x52, 0x12, 0x61, 0x75, 0x64, 0x69, 0x6f,
-	0x42, 0x69, 0x74, 0x73, 0x50, 0x65, 0x72, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x88, 0x01, 0x01,
-	0x12, 0x29, 0x0a, 0x0d, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x43, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c,
-	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x48, 0x01, 0x52, 0x0d, 0x61, 0x75, 0x64, 0x69, 0x6f,
-	0x43, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x73, 0x88, 0x01, 0x01, 0x12, 0x25, 0x0a, 0x0b, 0x61,
-	0x75, 0x64, 0x69, 0x6f, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x48, 0x02, 0x52, 0x0b, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x88,
-	0x01, 0x01, 0x12, 0x39, 0x0a, 0x15, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x53, 0x61, 0x6d, 0x70, 0x6c,
-	0x65, 0x73, 0x50, 0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x05, 0x48, 0x03, 0x52, 0x15, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65,
-	0x73, 0x50, 0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x88, 0x01, 0x01, 0x12, 0x1d, 0x0a,
-	0x07, 0x62, 0x69, 0x74, 0x72, 0x61, 0x74, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x05, 0x48, 0x04,
-	0x52, 0x07, 0x62, 0x69, 0x74, 0x72, 0x61, 0x74, 0x65, 0x88, 0x01, 0x01, 0x12, 0x1f, 0x0a, 0x08,
-	0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x48, 0x05,
-	0x52, 0x08, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x1b, 0x0a,
-	0x06, 0x66, 0x6f, 0x75, 0x72, 0x43, 0x43, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x06, 0x52,
-	0x06, 0x66, 0x6f, 0x75, 0x72, 0x43, 0x43, 0x88, 0x01, 0x01, 0x12, 0x21, 0x0a, 0x09, 0x66, 0x72,
-	0x61, 0x6d, 0x65, 0x52, 0x61, 0x74, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x01, 0x48, 0x07, 0x52,
-	0x09, 0x66, 0x72, 0x61, 0x6d, 0x65, 0x52, 0x61, 0x74, 0x65, 0x88, 0x01, 0x01, 0x12, 0x1b, 0x0a,
-	0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x48, 0x08, 0x52,
-	0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x88, 0x01, 0x01, 0x12, 0x19, 0x0a, 0x05, 0x77, 0x69,
-	0x64, 0x74, 0x68, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x05, 0x48, 0x09, 0x52, 0x05, 0x77, 0x69, 0x64,
-	0x74, 0x68, 0x88, 0x01, 0x01, 0x42, 0x15, 0x0a, 0x13, 0x5f, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x42,
-	0x69, 0x74, 0x73, 0x50, 0x65, 0x72, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x42, 0x10, 0x0a, 0x0e,
-	0x5f, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x43, 0x68, 0x61, 0x6e, 0x6e, 0x65, 0x6c, 0x73, 0x42, 0x0e,
-	0x0a, 0x0c, 0x5f, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x42, 0x18,
-	0x0a, 0x16, 0x5f, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x73, 0x50,
-	0x65, 0x72, 0x53, 0x65, 0x63, 0x6f, 0x6e, 0x64, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x62, 0x69, 0x74,
-	0x72, 0x61, 0x74, 0x65, 0x42, 0x0b, 0x0a, 0x09, 0x5f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x66, 0x6f, 0x75, 0x72, 0x43, 0x43, 0x42, 0x0c, 0x0a, 0x0a,
-	0x5f, 0x66, 0x72, 0x61, 0x6d, 0x65, 0x52, 0x61, 0x74, 0x65, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x68,
-	0x65, 0x69, 0x67, 0x68, 0x74, 0x42, 0x08, 0x0a, 0x06, 0x5f, 0x77, 0x69, 0x64, 0x74, 0x68, 0x22,
-	0xc4, 0x01, 0x0a, 0x0b, 0x4d, 0x6f, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x12,
-	0x1d, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05,
-	0x48, 0x00, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x3d,
-	0x0a, 0x17, 0x70, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69,
-	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x55, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x48,
-	0x01, 0x52, 0x17, 0x70, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54,
-	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x55, 0x73, 0x88, 0x01, 0x01, 0x12, 0x21, 0x0a,
-	0x09, 0x76, 0x69, 0x64, 0x65, 0x6f, 0x53, 0x69, 0x7a, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
-	0x48, 0x02, 0x52, 0x09, 0x76, 0x69, 0x64, 0x65, 0x6f, 0x53, 0x69, 0x7a, 0x65, 0x88, 0x01, 0x01,
-	0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x42, 0x1a, 0x0a, 0x18,
-	0x5f, 0x70, 0x72, 0x65, 0x73, 0x65, 0x6e, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x55, 0x73, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x76, 0x69, 0x64,
-	0x65, 0x6f, 0x53, 0x69, 0x7a, 0x65, 0x22, 0xb9, 0x02, 0x0a, 0x09, 0x4c, 0x69, 0x76, 0x65, 0x50,
-	0x68, 0x6f, 0x74, 0x6f, 0x12, 0x21, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x49,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x74, 0x65,
-	0x6e, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x2f, 0x0a, 0x10, 0x73, 0x74, 0x69, 0x6c, 0x6c,
-	0x49, 0x6d, 0x61, 0x67, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x55, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x03, 0x48, 0x01, 0x52, 0x10, 0x73, 0x74, 0x69, 0x6c, 0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x54,
-	0x69, 0x6d, 0x65, 0x55, 0x73, 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a, 0x04, 0x61, 0x75, 0x74, 0x6f,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x48, 0x02, 0x52, 0x04, 0x61, 0x75, 0x74, 0x6f, 0x88, 0x01,
-	0x01, 0x12, 0x29, 0x0a, 0x0d, 0x76, 0x69, 0x74, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f,
-	0x72, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x01, 0x48, 0x03, 0x52, 0x0d, 0x76, 0x69, 0x74, 0x61,
-	0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x88, 0x01, 0x01, 0x12, 0x3b, 0x0a, 0x16,
-	0x76, 0x69, 0x74, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x56,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x48, 0x04, 0x52, 0x16,
-	0x76, 0x69, 0x74, 0x61, 0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x56,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x63, 0x6f,
-	0x6e, 0x74, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x73, 0x74, 0x69, 0x6c,
-	0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x55, 0x73, 0x42, 0x07, 0x0a, 0x05,
-	0x5f, 0x61, 0x75, 0x74, 0x6f, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x76, 0x69, 0x74, 0x61, 0x6c, 0x69,
-	0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x42, 0x19, 0x0a, 0x17, 0x5f, 0x76, 0x69, 0x74, 0x61,
-	0x6c, 0x69, 0x74, 0x79, 0x53, 0x63, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x56, 0x65, 0x72, 0x73, 0x69,
-	0x6f, 0x6e, 0x22, 0xc9, 0x08, 0x0a, 0x06, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x39, 0x0a,
-	0x03, 0x72, 0x65, 0x66, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65,
-	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e,
-	0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65,
-	0x6e, 0x63, 0x65, 0x52, 0x03, 0x72, 0x65, 0x66, 0x12, 0x38, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
-	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68,
-	0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x02,
-	0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x65, 0x74, 0x61, 0x67, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x65, 0x74, 0x61, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69,
-	0x7a, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x48,
-	0x0a, 0x12, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f,
-	0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x6c, 0x61, 0x73, 0x74, 0x4d, 0x6f, 0x64, 0x69,
-	0x66, 0x69, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x69, 0x6d, 0x65,
-	0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x69, 0x6d,
-	0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x65, 0x72, 0x6d,
-	0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x09, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x64,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x64, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x64, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x72, 0x65, 0x52, 0x6f,
-	0x6f, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x68,
-	0x61, 0x72, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x45, 0x0a, 0x09, 0x70,
-	0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28,
-	0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x08, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74,
-	0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09,
-	0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x68, 0x69, 0x67, 0x68, 0x6c, 0x69,
-	0x67, 0x68, 0x74, 0x73, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x69, 0x67, 0x68,
-	0x6c, 0x69, 0x67, 0x68, 0x74, 0x73, 0x12, 0x39, 0x0a, 0x05, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x18,
-	0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
-	0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63,
-	0x68, 0x2e, 0x76, 0x30, 0x2e, 0x41, 0x75, 0x64, 0x69, 0x6f, 0x52, 0x05, 0x61, 0x75, 0x64, 0x69,
-	0x6f, 0x12, 0x48, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x10, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
-	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e,
-	0x76, 0x30, 0x2e, 0x47, 0x65, 0x6f, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65,
-	0x73, 0x52, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4e, 0x0a, 0x0e, 0x72,
-	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x69, 0x74, 0x65, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x11, 0x20,
+	0x65, 0x22, 0xfa, 0x06, 0x0a, 0x06, 0x45, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x39, 0x0a, 0x03,
+	0x72, 0x65, 0x66, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65, 0x6e,
+	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73,
+	0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e,
+	0x63, 0x65, 0x52, 0x03, 0x72, 0x65, 0x66, 0x12, 0x38, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20,
 	0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
 	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e,
-	0x76, 0x30, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x0c, 0x72,
-	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x05, 0x69,
-	0x6d, 0x61, 0x67, 0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65,
-	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e,
-	0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52,
-	0x05, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x39, 0x0a, 0x05, 0x70, 0x68, 0x6f, 0x74, 0x6f, 0x18,
-	0x13, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
-	0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63,
-	0x68, 0x2e, 0x76, 0x30, 0x2e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x52, 0x05, 0x70, 0x68, 0x6f, 0x74,
-	0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x66, 0x61, 0x76, 0x6f, 0x72, 0x69, 0x74, 0x65, 0x73, 0x18, 0x14,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x66, 0x61, 0x76, 0x6f, 0x72, 0x69, 0x74, 0x65, 0x73, 0x12,
-	0x4b, 0x0a, 0x0b, 0x6d, 0x6f, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x18, 0x15,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x76, 0x30, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x65, 0x74, 0x61, 0x67, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x65, 0x74, 0x61, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x48, 0x0a,
+	0x12, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x6d, 0x6f, 0x64, 0x69, 0x66, 0x69, 0x65, 0x64, 0x5f, 0x74,
+	0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x6c, 0x61, 0x73, 0x74, 0x4d, 0x6f, 0x64, 0x69, 0x66,
+	0x69, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x69, 0x6d, 0x65, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x69, 0x6d, 0x65,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x65, 0x72, 0x6d, 0x69,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x09,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x64, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x64, 0x12, 0x24, 0x0a, 0x0d, 0x73, 0x68, 0x61, 0x72, 0x65, 0x52, 0x6f, 0x6f,
+	0x74, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x68, 0x61,
+	0x72, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x45, 0x0a, 0x09, 0x70, 0x61,
+	0x72, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e,
+	0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x08, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x49,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x68, 0x69, 0x67, 0x68, 0x6c, 0x69, 0x67,
+	0x68, 0x74, 0x73, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x69, 0x67, 0x68, 0x6c,
+	0x69, 0x67, 0x68, 0x74, 0x73, 0x12, 0x39, 0x0a, 0x05, 0x61, 0x75, 0x64, 0x69, 0x6f, 0x18, 0x0f,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
 	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68,
-	0x2e, 0x76, 0x30, 0x2e, 0x4d, 0x6f, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x52,
-	0x0b, 0x6d, 0x6f, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x12, 0x39, 0x0a, 0x05,
-	0x76, 0x69, 0x64, 0x65, 0x6f, 0x18, 0x16, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70,
-	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73,
-	0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x56, 0x69, 0x64, 0x65, 0x6f,
-	0x52, 0x05, 0x76, 0x69, 0x64, 0x65, 0x6f, 0x12, 0x45, 0x0a, 0x09, 0x6c, 0x69, 0x76, 0x65, 0x50,
-	0x68, 0x6f, 0x74, 0x6f, 0x18, 0x17, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x6f, 0x70, 0x65,
-	0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e,
-	0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x4c, 0x69, 0x76, 0x65, 0x50, 0x68,
-	0x6f, 0x74, 0x6f, 0x52, 0x09, 0x6c, 0x69, 0x76, 0x65, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x22, 0x5b,
+	0x2e, 0x76, 0x30, 0x2e, 0x41, 0x75, 0x64, 0x69, 0x6f, 0x52, 0x05, 0x61, 0x75, 0x64, 0x69, 0x6f,
+	0x12, 0x48, 0x0a, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x10, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76,
+	0x30, 0x2e, 0x47, 0x65, 0x6f, 0x43, 0x6f, 0x6f, 0x72, 0x64, 0x69, 0x6e, 0x61, 0x74, 0x65, 0x73,
+	0x52, 0x08, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4e, 0x0a, 0x0e, 0x72, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x69, 0x74, 0x65, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x11, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x28, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76,
+	0x30, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x44, 0x52, 0x0c, 0x72, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x49, 0x74, 0x65, 0x6d, 0x49, 0x64, 0x12, 0x39, 0x0a, 0x05, 0x69, 0x6d,
+	0x61, 0x67, 0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e,
+	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73,
+	0x65, 0x61, 0x72, 0x63, 0x68, 0x2e, 0x76, 0x30, 0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x52, 0x05,
+	0x69, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x39, 0x0a, 0x05, 0x70, 0x68, 0x6f, 0x74, 0x6f, 0x18, 0x13,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68,
+	0x2e, 0x76, 0x30, 0x2e, 0x50, 0x68, 0x6f, 0x74, 0x6f, 0x52, 0x05, 0x70, 0x68, 0x6f, 0x74, 0x6f,
+	0x12, 0x1c, 0x0a, 0x09, 0x66, 0x61, 0x76, 0x6f, 0x72, 0x69, 0x74, 0x65, 0x73, 0x18, 0x14, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x09, 0x66, 0x61, 0x76, 0x6f, 0x72, 0x69, 0x74, 0x65, 0x73, 0x22, 0x5b,
 	0x0a, 0x05, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x3c, 0x0a, 0x06, 0x65, 0x6e, 0x74, 0x69, 0x74,
 	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c,
 	0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x73, 0x65, 0x61,
@@ -1354,7 +990,7 @@ func file_opencloud_messages_search_v0_search_proto_rawDescGZIP() []byte {
 	return file_opencloud_messages_search_v0_search_proto_rawDescData
 }

-var file_opencloud_messages_search_v0_search_proto_msgTypes = make([]protoimpl.MessageInfo, 11)
+var file_opencloud_messages_search_v0_search_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
 var file_opencloud_messages_search_v0_search_proto_goTypes = []interface{}{
 	(*ResourceID)(nil),            // 0: opencloud.messages.search.v0.ResourceID
 	(*Reference)(nil),             // 1: opencloud.messages.search.v0.Reference
@@ -1362,34 +998,28 @@ var file_opencloud_messages_search_v0_search_proto_goTypes = []interface{}{
 	(*Image)(nil),                 // 3: opencloud.messages.search.v0.Image
 	(*GeoCoordinates)(nil),        // 4: opencloud.messages.search.v0.GeoCoordinates
 	(*Photo)(nil),                 // 5: opencloud.messages.search.v0.Photo
-	(*Video)(nil),                 // 6: opencloud.messages.search.v0.Video
-	(*MotionPhoto)(nil),           // 7: opencloud.messages.search.v0.MotionPhoto
-	(*LivePhoto)(nil),             // 8: opencloud.messages.search.v0.LivePhoto
-	(*Entity)(nil),                // 9: opencloud.messages.search.v0.Entity
-	(*Match)(nil),                 // 10: opencloud.messages.search.v0.Match
-	(*timestamppb.Timestamp)(nil), // 11: google.protobuf.Timestamp
+	(*Entity)(nil),                // 6: opencloud.messages.search.v0.Entity
+	(*Match)(nil),                 // 7: opencloud.messages.search.v0.Match
+	(*timestamppb.Timestamp)(nil), // 8: google.protobuf.Timestamp
 }
 var file_opencloud_messages_search_v0_search_proto_depIdxs = []int32{
 	0,  // 0: opencloud.messages.search.v0.Reference.resource_id:type_name -> opencloud.messages.search.v0.ResourceID
-	11, // 1: opencloud.messages.search.v0.Photo.takenDateTime:type_name -> google.protobuf.Timestamp
+	8,  // 1: opencloud.messages.search.v0.Photo.takenDateTime:type_name -> google.protobuf.Timestamp
 	1,  // 2: opencloud.messages.search.v0.Entity.ref:type_name -> opencloud.messages.search.v0.Reference
 	0,  // 3: opencloud.messages.search.v0.Entity.id:type_name -> opencloud.messages.search.v0.ResourceID
-	11, // 4: opencloud.messages.search.v0.Entity.last_modified_time:type_name -> google.protobuf.Timestamp
+	8,  // 4: opencloud.messages.search.v0.Entity.last_modified_time:type_name -> google.protobuf.Timestamp
 	0,  // 5: opencloud.messages.search.v0.Entity.parent_id:type_name -> opencloud.messages.search.v0.ResourceID
 	2,  // 6: opencloud.messages.search.v0.Entity.audio:type_name -> opencloud.messages.search.v0.Audio
 	4,  // 7: opencloud.messages.search.v0.Entity.location:type_name -> opencloud.messages.search.v0.GeoCoordinates
 	0,  // 8: opencloud.messages.search.v0.Entity.remote_item_id:type_name -> opencloud.messages.search.v0.ResourceID
 	3,  // 9: opencloud.messages.search.v0.Entity.image:type_name -> opencloud.messages.search.v0.Image
 	5,  // 10: opencloud.messages.search.v0.Entity.photo:type_name -> opencloud.messages.search.v0.Photo
-	7,  // 11: opencloud.messages.search.v0.Entity.motionPhoto:type_name -> opencloud.messages.search.v0.MotionPhoto
-	6,  // 12: opencloud.messages.search.v0.Entity.video:type_name -> opencloud.messages.search.v0.Video
-	8,  // 13: opencloud.messages.search.v0.Entity.livePhoto:type_name -> opencloud.messages.search.v0.LivePhoto
-	9,  // 14: opencloud.messages.search.v0.Match.entity:type_name -> opencloud.messages.search.v0.Entity
-	15, // [15:15] is the sub-list for method output_type
-	15, // [15:15] is the sub-list for method input_type
-	15, // [15:15] is the sub-list for extension type_name
-	15, // [15:15] is the sub-list for extension extendee
-	0,  // [0:15] is the sub-list for field type_name
+	6,  // 11: opencloud.messages.search.v0.Match.entity:type_name -> opencloud.messages.search.v0.Entity
+	12, // [12:12] is the sub-list for method output_type
+	12, // [12:12] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }

 func init() { file_opencloud_messages_search_v0_search_proto_init() }
@@ -1471,42 +1101,6 @@ func file_opencloud_messages_search_v0_search_proto_init() {
 			}
 		}
 		file_opencloud_messages_search_v0_search_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Video); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_messages_search_v0_search_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MotionPhoto); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_messages_search_v0_search_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LivePhoto); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_opencloud_messages_search_v0_search_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Entity); i {
 			case 0:
 				return &v.state
@@ -1518,7 +1112,7 @@ func file_opencloud_messages_search_v0_search_proto_init() {
 				return nil
 			}
 		}
-		file_opencloud_messages_search_v0_search_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+		file_opencloud_messages_search_v0_search_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Match); i {
 			case 0:
 				return &v.state
@@ -1535,16 +1129,13 @@ func file_opencloud_messages_search_v0_search_proto_init() {
 	file_opencloud_messages_search_v0_search_proto_msgTypes[3].OneofWrappers = []interface{}{}
 	file_opencloud_messages_search_v0_search_proto_msgTypes[4].OneofWrappers = []interface{}{}
 	file_opencloud_messages_search_v0_search_proto_msgTypes[5].OneofWrappers = []interface{}{}
-	file_opencloud_messages_search_v0_search_proto_msgTypes[6].OneofWrappers = []interface{}{}
-	file_opencloud_messages_search_v0_search_proto_msgTypes[7].OneofWrappers = []interface{}{}
-	file_opencloud_messages_search_v0_search_proto_msgTypes[8].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_opencloud_messages_search_v0_search_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   11,
+			NumMessages:   8,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
@@ -226,42 +226,6 @@ func (m *Photo) UnmarshalJSON(b []byte) error {

 var _ json.Unmarshaler = (*Photo)(nil)

-// VideoJSONMarshaler describes the default jsonpb.Marshaler used by all
-// instances of Video. This struct is safe to replace or modify but
-// should not be done so concurrently.
-var VideoJSONMarshaler = new(jsonpb.Marshaler)
-
-// MarshalJSON satisfies the encoding/json Marshaler interface. This method
-// uses the more correct jsonpb package to correctly marshal the message.
-func (m *Video) MarshalJSON() ([]byte, error) {
-	if m == nil {
-		return json.Marshal(nil)
-	}
-
-	buf := &bytes.Buffer{}
-
-	if err := VideoJSONMarshaler.Marshal(buf, m); err != nil {
-		return nil, err
-	}
-
-	return buf.Bytes(), nil
-}
-
-var _ json.Marshaler = (*Video)(nil)
-
-// VideoJSONUnmarshaler describes the default jsonpb.Unmarshaler used by all
-// instances of Video. This struct is safe to replace or modify but
-// should not be done so concurrently.
-var VideoJSONUnmarshaler = new(jsonpb.Unmarshaler)
-
-// UnmarshalJSON satisfies the encoding/json Unmarshaler interface. This method
-// uses the more correct jsonpb package to correctly unmarshal the message.
-func (m *Video) UnmarshalJSON(b []byte) error {
-	return VideoJSONUnmarshaler.Unmarshal(bytes.NewReader(b), m)
-}
-
-var _ json.Unmarshaler = (*Video)(nil)
-
 // EntityJSONMarshaler describes the default jsonpb.Marshaler used by all
 // instances of Entity. This struct is safe to replace or modify but
 // should not be done so concurrently.
@@ -0,0 +1,326 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: opencloud/messages/thumbnails/v0/thumbnails.proto
+
+package v0
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The file types to which the thumbnail can be encoded to.
+type ThumbnailType int32
+
+const (
+	ThumbnailType_PNG ThumbnailType = 0 // Represents PNG type
+	ThumbnailType_JPG ThumbnailType = 1 // Represents JPG type
+	ThumbnailType_GIF ThumbnailType = 2 // Represents GIF type
+)
+
+// Enum value maps for ThumbnailType.
+var (
+	ThumbnailType_name = map[int32]string{
+		0: "PNG",
+		1: "JPG",
+		2: "GIF",
+	}
+	ThumbnailType_value = map[string]int32{
+		"PNG": 0,
+		"JPG": 1,
+		"GIF": 2,
+	}
+)
+
+func (x ThumbnailType) Enum() *ThumbnailType {
+	p := new(ThumbnailType)
+	*p = x
+	return p
+}
+
+func (x ThumbnailType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ThumbnailType) Descriptor() protoreflect.EnumDescriptor {
+	return file_opencloud_messages_thumbnails_v0_thumbnails_proto_enumTypes[0].Descriptor()
+}
+
+func (ThumbnailType) Type() protoreflect.EnumType {
+	return &file_opencloud_messages_thumbnails_v0_thumbnails_proto_enumTypes[0]
+}
+
+func (x ThumbnailType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ThumbnailType.Descriptor instead.
+func (ThumbnailType) EnumDescriptor() ([]byte, []int) {
+	return file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescGZIP(), []int{0}
+}
+
+type WebdavSource struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// REQUIRED.
+	Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	// REQUIRED.
+	IsPublicLink bool `protobuf:"varint,2,opt,name=is_public_link,json=isPublicLink,proto3" json:"is_public_link,omitempty"`
+	// OPTIONAL.
+	WebdavAuthorization string `protobuf:"bytes,3,opt,name=webdav_authorization,json=webdavAuthorization,proto3" json:"webdav_authorization,omitempty"`
+	// OPTIONAL.
+	RevaAuthorization string `protobuf:"bytes,4,opt,name=reva_authorization,json=revaAuthorization,proto3" json:"reva_authorization,omitempty"`
+	// OPTIONAL.
+	PublicLinkToken string `protobuf:"bytes,5,opt,name=public_link_token,json=publicLinkToken,proto3" json:"public_link_token,omitempty"`
+}
+
+func (x *WebdavSource) Reset() {
+	*x = WebdavSource{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opencloud_messages_thumbnails_v0_thumbnails_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WebdavSource) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WebdavSource) ProtoMessage() {}
+
+func (x *WebdavSource) ProtoReflect() protoreflect.Message {
+	mi := &file_opencloud_messages_thumbnails_v0_thumbnails_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WebdavSource.ProtoReflect.Descriptor instead.
+func (*WebdavSource) Descriptor() ([]byte, []int) {
+	return file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *WebdavSource) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *WebdavSource) GetIsPublicLink() bool {
+	if x != nil {
+		return x.IsPublicLink
+	}
+	return false
+}
+
+func (x *WebdavSource) GetWebdavAuthorization() string {
+	if x != nil {
+		return x.WebdavAuthorization
+	}
+	return ""
+}
+
+func (x *WebdavSource) GetRevaAuthorization() string {
+	if x != nil {
+		return x.RevaAuthorization
+	}
+	return ""
+}
+
+func (x *WebdavSource) GetPublicLinkToken() string {
+	if x != nil {
+		return x.PublicLinkToken
+	}
+	return ""
+}
+
+type CS3Source struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Path          string `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
+	Authorization string `protobuf:"bytes,2,opt,name=authorization,proto3" json:"authorization,omitempty"`
+}
+
+func (x *CS3Source) Reset() {
+	*x = CS3Source{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opencloud_messages_thumbnails_v0_thumbnails_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CS3Source) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CS3Source) ProtoMessage() {}
+
+func (x *CS3Source) ProtoReflect() protoreflect.Message {
+	mi := &file_opencloud_messages_thumbnails_v0_thumbnails_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CS3Source.ProtoReflect.Descriptor instead.
+func (*CS3Source) Descriptor() ([]byte, []int) {
+	return file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CS3Source) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *CS3Source) GetAuthorization() string {
+	if x != nil {
+		return x.Authorization
+	}
+	return ""
+}
+
+var File_opencloud_messages_thumbnails_v0_thumbnails_proto protoreflect.FileDescriptor
+
+var file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDesc = []byte{
+	0x0a, 0x31, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x6d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x73, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x73, 0x2f,
+	0x76, 0x30, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x20, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69,
+	0x6c, 0x73, 0x2e, 0x76, 0x30, 0x22, 0xd4, 0x01, 0x0a, 0x0c, 0x57, 0x65, 0x62, 0x64, 0x61, 0x76,
+	0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x24, 0x0a, 0x0e, 0x69, 0x73, 0x5f, 0x70,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6c, 0x69, 0x6e, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x0c, 0x69, 0x73, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4c, 0x69, 0x6e, 0x6b, 0x12, 0x31,
+	0x0a, 0x14, 0x77, 0x65, 0x62, 0x64, 0x61, 0x76, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x77, 0x65,
+	0x62, 0x64, 0x61, 0x76, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x12, 0x2d, 0x0a, 0x12, 0x72, 0x65, 0x76, 0x61, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x72,
+	0x65, 0x76, 0x61, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x2a, 0x0a, 0x11, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6c, 0x69, 0x6e, 0x6b, 0x5f,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x63, 0x4c, 0x69, 0x6e, 0x6b, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0x45, 0x0a, 0x09,
+	0x43, 0x53, 0x33, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74,
+	0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x24, 0x0a,
+	0x0d, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x2a, 0x2a, 0x0a, 0x0d, 0x54, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x07, 0x0a, 0x03, 0x50, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x07, 0x0a,
+	0x03, 0x4a, 0x50, 0x47, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x47, 0x49, 0x46, 0x10, 0x02, 0x42,
+	0x51, 0x5a, 0x4f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70,
+	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x65, 0x75, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63,
+	0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x67, 0x65, 0x6e, 0x2f, 0x67, 0x65,
+	0x6e, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x6d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x73, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x73, 0x2f,
+	0x76, 0x30, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescOnce sync.Once
+	file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescData = file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDesc
+)
+
+func file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescGZIP() []byte {
+	file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescOnce.Do(func() {
+		file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescData = protoimpl.X.CompressGZIP(file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescData)
+	})
+	return file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDescData
+}
+
+var file_opencloud_messages_thumbnails_v0_thumbnails_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_opencloud_messages_thumbnails_v0_thumbnails_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_opencloud_messages_thumbnails_v0_thumbnails_proto_goTypes = []interface{}{
+	(ThumbnailType)(0),   // 0: opencloud.messages.thumbnails.v0.ThumbnailType
+	(*WebdavSource)(nil), // 1: opencloud.messages.thumbnails.v0.WebdavSource
+	(*CS3Source)(nil),    // 2: opencloud.messages.thumbnails.v0.CS3Source
+}
+var file_opencloud_messages_thumbnails_v0_thumbnails_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_opencloud_messages_thumbnails_v0_thumbnails_proto_init() }
+func file_opencloud_messages_thumbnails_v0_thumbnails_proto_init() {
+	if File_opencloud_messages_thumbnails_v0_thumbnails_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_opencloud_messages_thumbnails_v0_thumbnails_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WebdavSource); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opencloud_messages_thumbnails_v0_thumbnails_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CS3Source); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_opencloud_messages_thumbnails_v0_thumbnails_proto_goTypes,
+		DependencyIndexes: file_opencloud_messages_thumbnails_v0_thumbnails_proto_depIdxs,
+		EnumInfos:         file_opencloud_messages_thumbnails_v0_thumbnails_proto_enumTypes,
+		MessageInfos:      file_opencloud_messages_thumbnails_v0_thumbnails_proto_msgTypes,
+	}.Build()
+	File_opencloud_messages_thumbnails_v0_thumbnails_proto = out.File
+	file_opencloud_messages_thumbnails_v0_thumbnails_proto_rawDesc = nil
+	file_opencloud_messages_thumbnails_v0_thumbnails_proto_goTypes = nil
+	file_opencloud_messages_thumbnails_v0_thumbnails_proto_depIdxs = nil
+}
@@ -0,0 +1,15 @@
+// Code generated by protoc-gen-micro. DO NOT EDIT.
+// source: opencloud/messages/thumbnails/v0/thumbnails.proto
+
+package v0
+
+import (
+	fmt "fmt"
+	proto "google.golang.org/protobuf/proto"
+	math "math"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
@@ -0,0 +1,43 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "opencloud/messages/thumbnails/v0/thumbnails.proto",
+    "version": "version not set"
+  },
+  "consumes": [
+    "application/json"
+  ],
+  "produces": [
+    "application/json"
+  ],
+  "paths": {},
+  "definitions": {
+    "protobufAny": {
+      "type": "object",
+      "properties": {
+        "@type": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": {}
+    },
+    "rpcStatus": {
+      "type": "object",
+      "properties": {
+        "code": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "message": {
+          "type": "string"
+        },
+        "details": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/protobufAny"
+          }
+        }
+      }
+    }
+  }
+}
@@ -298,15 +298,6 @@
          "items": {
            "type": "string"
          }
-        },
-        "motionPhoto": {
-          "$ref": "#/definitions/v0MotionPhoto"
-        },
-        "video": {
-          "$ref": "#/definitions/v0Video"
-        },
-        "livePhoto": {
-          "$ref": "#/definitions/v0LivePhoto"
        }
      }
    },
@@ -385,29 +376,6 @@
        }
      }
    },
-    "v0LivePhoto": {
-      "type": "object",
-      "properties": {
-        "contentId": {
-          "type": "string"
-        },
-        "stillImageTimeUs": {
-          "type": "string",
-          "format": "int64"
-        },
-        "auto": {
-          "type": "boolean"
-        },
-        "vitalityScore": {
-          "type": "number",
-          "format": "double"
-        },
-        "vitalityScoringVersion": {
-          "type": "string",
-          "format": "int64"
-        }
-      }
-    },
    "v0Match": {
      "type": "object",
      "properties": {
@@ -422,23 +390,6 @@
        }
      }
    },
-    "v0MotionPhoto": {
-      "type": "object",
-      "properties": {
-        "version": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "presentationTimestampUs": {
-          "type": "string",
-          "format": "int64"
-        },
-        "videoSize": {
-          "type": "string",
-          "format": "int64"
-        }
-      }
-    },
    "v0Photo": {
      "type": "object",
      "properties": {
@@ -580,49 +531,6 @@
          "format": "int32"
        }
      }
-    },
-    "v0Video": {
-      "type": "object",
-      "properties": {
-        "audioBitsPerSample": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "audioChannels": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "audioFormat": {
-          "type": "string"
-        },
-        "audioSamplesPerSecond": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "bitrate": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "duration": {
-          "type": "string",
-          "format": "int64"
-        },
-        "fourCC": {
-          "type": "string"
-        },
-        "frameRate": {
-          "type": "number",
-          "format": "double"
-        },
-        "height": {
-          "type": "integer",
-          "format": "int32"
-        },
-        "width": {
-          "type": "integer",
-          "format": "int32"
-        }
-      }
    }
  },
  "externalDocs": {
@@ -0,0 +1,123 @@
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package mocks
+
+import (
+	"context"
+
+	"github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/thumbnails/v0"
+	mock "github.com/stretchr/testify/mock"
+	"go-micro.dev/v4/client"
+)
+
+// NewThumbnailService creates a new instance of ThumbnailService. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewThumbnailService(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *ThumbnailService {
+	mock := &ThumbnailService{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// ThumbnailService is an autogenerated mock type for the ThumbnailService type
+type ThumbnailService struct {
+	mock.Mock
+}
+
+type ThumbnailService_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *ThumbnailService) EXPECT() *ThumbnailService_Expecter {
+	return &ThumbnailService_Expecter{mock: &_m.Mock}
+}
+
+// GetThumbnail provides a mock function for the type ThumbnailService
+func (_mock *ThumbnailService) GetThumbnail(ctx context.Context, in *v0.GetThumbnailRequest, opts ...client.CallOption) (*v0.GetThumbnailResponse, error) {
+	var tmpRet mock.Arguments
+	if len(opts) > 0 {
+		tmpRet = _mock.Called(ctx, in, opts)
+	} else {
+		tmpRet = _mock.Called(ctx, in)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetThumbnail")
+	}
+
+	var r0 *v0.GetThumbnailResponse
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *v0.GetThumbnailRequest, ...client.CallOption) (*v0.GetThumbnailResponse, error)); ok {
+		return returnFunc(ctx, in, opts...)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, *v0.GetThumbnailRequest, ...client.CallOption) *v0.GetThumbnailResponse); ok {
+		r0 = returnFunc(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*v0.GetThumbnailResponse)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, *v0.GetThumbnailRequest, ...client.CallOption) error); ok {
+		r1 = returnFunc(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// ThumbnailService_GetThumbnail_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetThumbnail'
+type ThumbnailService_GetThumbnail_Call struct {
+	*mock.Call
+}
+
+// GetThumbnail is a helper method to define mock.On call
+//   - ctx context.Context
+//   - in *v0.GetThumbnailRequest
+//   - opts ...client.CallOption
+func (_e *ThumbnailService_Expecter) GetThumbnail(ctx interface{}, in interface{}, opts ...interface{}) *ThumbnailService_GetThumbnail_Call {
+	return &ThumbnailService_GetThumbnail_Call{Call: _e.mock.On("GetThumbnail",
+		append([]interface{}{ctx, in}, opts...)...)}
+}
+
+func (_c *ThumbnailService_GetThumbnail_Call) Run(run func(ctx context.Context, in *v0.GetThumbnailRequest, opts ...client.CallOption)) *ThumbnailService_GetThumbnail_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 *v0.GetThumbnailRequest
+		if args[1] != nil {
+			arg1 = args[1].(*v0.GetThumbnailRequest)
+		}
+		var arg2 []client.CallOption
+		var variadicArgs []client.CallOption
+		if len(args) > 2 {
+			variadicArgs = args[2].([]client.CallOption)
+		}
+		arg2 = variadicArgs
+		run(
+			arg0,
+			arg1,
+			arg2...,
+		)
+	})
+	return _c
+}
+
+func (_c *ThumbnailService_GetThumbnail_Call) Return(getThumbnailResponse *v0.GetThumbnailResponse, err error) *ThumbnailService_GetThumbnail_Call {
+	_c.Call.Return(getThumbnailResponse, err)
+	return _c
+}
+
+func (_c *ThumbnailService_GetThumbnail_Call) RunAndReturn(run func(ctx context.Context, in *v0.GetThumbnailRequest, opts ...client.CallOption) (*v0.GetThumbnailResponse, error)) *ThumbnailService_GetThumbnail_Call {
+	_c.Call.Return(run)
+	return _c
+}
@@ -0,0 +1,388 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: opencloud/services/thumbnails/v0/thumbnails.proto
+
+package v0
+
+import (
+	_ "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options"
+	v0 "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/thumbnails/v0"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// A request to retrieve a thumbnail
+type GetThumbnailRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The path to the source image
+	Filepath string `protobuf:"bytes,1,opt,name=filepath,proto3" json:"filepath,omitempty"`
+	// The type to which the thumbnail should get encoded to.
+	ThumbnailType v0.ThumbnailType `protobuf:"varint,2,opt,name=thumbnail_type,json=thumbnailType,proto3,enum=opencloud.messages.thumbnails.v0.ThumbnailType" json:"thumbnail_type,omitempty"`
+	// The width of the thumbnail
+	Width int32 `protobuf:"varint,3,opt,name=width,proto3" json:"width,omitempty"`
+	// The height of the thumbnail
+	Height int32 `protobuf:"varint,4,opt,name=height,proto3" json:"height,omitempty"`
+	// Indicates which image processor to use
+	Processor string `protobuf:"bytes,5,opt,name=processor,proto3" json:"processor,omitempty"`
+	// Types that are assignable to Source:
+	//
+	//	*GetThumbnailRequest_WebdavSource
+	//	*GetThumbnailRequest_Cs3Source
+	Source isGetThumbnailRequest_Source `protobuf_oneof:"source"`
+}
+
+func (x *GetThumbnailRequest) Reset() {
+	*x = GetThumbnailRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetThumbnailRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetThumbnailRequest) ProtoMessage() {}
+
+func (x *GetThumbnailRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetThumbnailRequest.ProtoReflect.Descriptor instead.
+func (*GetThumbnailRequest) Descriptor() ([]byte, []int) {
+	return file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GetThumbnailRequest) GetFilepath() string {
+	if x != nil {
+		return x.Filepath
+	}
+	return ""
+}
+
+func (x *GetThumbnailRequest) GetThumbnailType() v0.ThumbnailType {
+	if x != nil {
+		return x.ThumbnailType
+	}
+	return v0.ThumbnailType(0)
+}
+
+func (x *GetThumbnailRequest) GetWidth() int32 {
+	if x != nil {
+		return x.Width
+	}
+	return 0
+}
+
+func (x *GetThumbnailRequest) GetHeight() int32 {
+	if x != nil {
+		return x.Height
+	}
+	return 0
+}
+
+func (x *GetThumbnailRequest) GetProcessor() string {
+	if x != nil {
+		return x.Processor
+	}
+	return ""
+}
+
+func (m *GetThumbnailRequest) GetSource() isGetThumbnailRequest_Source {
+	if m != nil {
+		return m.Source
+	}
+	return nil
+}
+
+func (x *GetThumbnailRequest) GetWebdavSource() *v0.WebdavSource {
+	if x, ok := x.GetSource().(*GetThumbnailRequest_WebdavSource); ok {
+		return x.WebdavSource
+	}
+	return nil
+}
+
+func (x *GetThumbnailRequest) GetCs3Source() *v0.CS3Source {
+	if x, ok := x.GetSource().(*GetThumbnailRequest_Cs3Source); ok {
+		return x.Cs3Source
+	}
+	return nil
+}
+
+type isGetThumbnailRequest_Source interface {
+	isGetThumbnailRequest_Source()
+}
+
+type GetThumbnailRequest_WebdavSource struct {
+	WebdavSource *v0.WebdavSource `protobuf:"bytes,6,opt,name=webdav_source,json=webdavSource,proto3,oneof"`
+}
+
+type GetThumbnailRequest_Cs3Source struct {
+	Cs3Source *v0.CS3Source `protobuf:"bytes,7,opt,name=cs3_source,json=cs3Source,proto3,oneof"`
+}
+
+func (*GetThumbnailRequest_WebdavSource) isGetThumbnailRequest_Source() {}
+
+func (*GetThumbnailRequest_Cs3Source) isGetThumbnailRequest_Source() {}
+
+// The service response
+type GetThumbnailResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The endpoint where the thumbnail can be downloaded.
+	DataEndpoint string `protobuf:"bytes,1,opt,name=data_endpoint,json=dataEndpoint,proto3" json:"data_endpoint,omitempty"`
+	// The transfer token to be able to download the thumbnail.
+	TransferToken string `protobuf:"bytes,2,opt,name=transfer_token,json=transferToken,proto3" json:"transfer_token,omitempty"`
+	// The mimetype of the thumbnail
+	Mimetype string `protobuf:"bytes,3,opt,name=mimetype,proto3" json:"mimetype,omitempty"`
+}
+
+func (x *GetThumbnailResponse) Reset() {
+	*x = GetThumbnailResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetThumbnailResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetThumbnailResponse) ProtoMessage() {}
+
+func (x *GetThumbnailResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetThumbnailResponse.ProtoReflect.Descriptor instead.
+func (*GetThumbnailResponse) Descriptor() ([]byte, []int) {
+	return file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetThumbnailResponse) GetDataEndpoint() string {
+	if x != nil {
+		return x.DataEndpoint
+	}
+	return ""
+}
+
+func (x *GetThumbnailResponse) GetTransferToken() string {
+	if x != nil {
+		return x.TransferToken
+	}
+	return ""
+}
+
+func (x *GetThumbnailResponse) GetMimetype() string {
+	if x != nil {
+		return x.Mimetype
+	}
+	return ""
+}
+
+var File_opencloud_services_thumbnails_v0_thumbnails_proto protoreflect.FileDescriptor
+
+var file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDesc = []byte{
+	0x0a, 0x31, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x73, 0x2f,
+	0x76, 0x30, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x73, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x20, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69,
+	0x6c, 0x73, 0x2e, 0x76, 0x30, 0x1a, 0x31, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e,
+	0x61, 0x69, 0x6c, 0x73, 0x2f, 0x76, 0x30, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69,
+	0x6c, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x2d, 0x67, 0x65, 0x6e, 0x2d, 0x6f, 0x70, 0x65, 0x6e, 0x61, 0x70, 0x69, 0x76, 0x32, 0x2f, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x84, 0x03, 0x0a, 0x13, 0x47, 0x65, 0x74,
+	0x54, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x70, 0x61, 0x74, 0x68, 0x12, 0x56, 0x0a, 0x0e,
+	0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x2f, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e,
+	0x61, 0x69, 0x6c, 0x73, 0x2e, 0x76, 0x30, 0x2e, 0x54, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69,
+	0x6c, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0d, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x77, 0x69, 0x64, 0x74, 0x68, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x05, 0x77, 0x69, 0x64, 0x74, 0x68, 0x12, 0x16, 0x0a, 0x06, 0x68, 0x65,
+	0x69, 0x67, 0x68, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x68, 0x65, 0x69, 0x67,
+	0x68, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72,
+	0x12, 0x55, 0x0a, 0x0d, 0x77, 0x65, 0x62, 0x64, 0x61, 0x76, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c,
+	0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73, 0x2e, 0x74, 0x68, 0x75,
+	0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x73, 0x2e, 0x76, 0x30, 0x2e, 0x57, 0x65, 0x62, 0x64, 0x61,
+	0x76, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x00, 0x52, 0x0c, 0x77, 0x65, 0x62, 0x64, 0x61,
+	0x76, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x4c, 0x0a, 0x0a, 0x63, 0x73, 0x33, 0x5f, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x6f, 0x70,
+	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x73,
+	0x2e, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x73, 0x2e, 0x76, 0x30, 0x2e, 0x43,
+	0x53, 0x33, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x48, 0x00, 0x52, 0x09, 0x63, 0x73, 0x33, 0x53,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x08, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22,
+	0x7e, 0x0a, 0x14, 0x47, 0x65, 0x74, 0x54, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x64, 0x61, 0x74, 0x61, 0x5f,
+	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x25, 0x0a, 0x0e,
+	0x74, 0x72, 0x61, 0x6e, 0x73, 0x66, 0x65, 0x72, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x66, 0x65, 0x72, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x6d, 0x69, 0x6d, 0x65, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d, 0x69, 0x6d, 0x65, 0x74, 0x79, 0x70, 0x65, 0x32,
+	0x91, 0x01, 0x0a, 0x10, 0x54, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x7d, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x54, 0x68, 0x75, 0x6d, 0x62,
+	0x6e, 0x61, 0x69, 0x6c, 0x12, 0x35, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e,
+	0x61, 0x69, 0x6c, 0x73, 0x2e, 0x76, 0x30, 0x2e, 0x47, 0x65, 0x74, 0x54, 0x68, 0x75, 0x6d, 0x62,
+	0x6e, 0x61, 0x69, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x36, 0x2e, 0x6f, 0x70,
+	0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
+	0x2e, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x73, 0x2e, 0x76, 0x30, 0x2e, 0x47,
+	0x65, 0x74, 0x54, 0x68, 0x75, 0x6d, 0x62, 0x6e, 0x61, 0x69, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x42, 0xff, 0x02, 0x5a, 0x4f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x65, 0x75, 0x2f,
+	0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x67,
+	0x65, 0x6e, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e,
+	0x61, 0x69, 0x6c, 0x73, 0x2f, 0x76, 0x30, 0x92, 0x41, 0xaa, 0x02, 0x12, 0xbb, 0x01, 0x0a, 0x14,
+	0x4f, 0x70, 0x65, 0x6e, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x20, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e,
+	0x61, 0x69, 0x6c, 0x73, 0x22, 0x51, 0x0a, 0x0e, 0x4f, 0x70, 0x65, 0x6e, 0x43, 0x6c, 0x6f, 0x75,
+	0x64, 0x20, 0x47, 0x6d, 0x62, 0x48, 0x12, 0x29, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63,
+	0x6c, 0x6f, 0x75, 0x64, 0x2d, 0x65, 0x75, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75,
+	0x64, 0x1a, 0x14, 0x73, 0x75, 0x70, 0x70, 0x6f, 0x72, 0x74, 0x40, 0x6f, 0x70, 0x65, 0x6e, 0x63,
+	0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x65, 0x75, 0x2a, 0x49, 0x0a, 0x0a, 0x41, 0x70, 0x61, 0x63, 0x68,
+	0x65, 0x2d, 0x32, 0x2e, 0x30, 0x12, 0x3b, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c,
+	0x6f, 0x75, 0x64, 0x2d, 0x65, 0x75, 0x2f, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2f, 0x62, 0x6c, 0x6f, 0x62, 0x2f, 0x6d, 0x61, 0x69, 0x6e, 0x2f, 0x4c, 0x49, 0x43, 0x45, 0x4e,
+	0x53, 0x45, 0x32, 0x05, 0x31, 0x2e, 0x30, 0x2e, 0x30, 0x2a, 0x02, 0x01, 0x02, 0x32, 0x10, 0x61,
+	0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x73, 0x6f, 0x6e, 0x3a,
+	0x10, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f, 0x6a, 0x73, 0x6f,
+	0x6e, 0x72, 0x42, 0x0a, 0x10, 0x44, 0x65, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x72, 0x20, 0x4d,
+	0x61, 0x6e, 0x75, 0x61, 0x6c, 0x12, 0x2e, 0x68, 0x74, 0x74, 0x70, 0x73, 0x3a, 0x2f, 0x2f, 0x64,
+	0x6f, 0x63, 0x73, 0x2e, 0x6f, 0x70, 0x65, 0x6e, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x65, 0x75,
+	0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2f, 0x74, 0x68, 0x75, 0x6d, 0x62, 0x6e,
+	0x61, 0x69, 0x6c, 0x73, 0x2f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescOnce sync.Once
+	file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescData = file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDesc
+)
+
+func file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescGZIP() []byte {
+	file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescOnce.Do(func() {
+		file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescData = protoimpl.X.CompressGZIP(file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescData)
+	})
+	return file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDescData
+}
+
+var file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_opencloud_services_thumbnails_v0_thumbnails_proto_goTypes = []interface{}{
+	(*GetThumbnailRequest)(nil),  // 0: opencloud.services.thumbnails.v0.GetThumbnailRequest
+	(*GetThumbnailResponse)(nil), // 1: opencloud.services.thumbnails.v0.GetThumbnailResponse
+	(v0.ThumbnailType)(0),        // 2: opencloud.messages.thumbnails.v0.ThumbnailType
+	(*v0.WebdavSource)(nil),      // 3: opencloud.messages.thumbnails.v0.WebdavSource
+	(*v0.CS3Source)(nil),         // 4: opencloud.messages.thumbnails.v0.CS3Source
+}
+var file_opencloud_services_thumbnails_v0_thumbnails_proto_depIdxs = []int32{
+	2, // 0: opencloud.services.thumbnails.v0.GetThumbnailRequest.thumbnail_type:type_name -> opencloud.messages.thumbnails.v0.ThumbnailType
+	3, // 1: opencloud.services.thumbnails.v0.GetThumbnailRequest.webdav_source:type_name -> opencloud.messages.thumbnails.v0.WebdavSource
+	4, // 2: opencloud.services.thumbnails.v0.GetThumbnailRequest.cs3_source:type_name -> opencloud.messages.thumbnails.v0.CS3Source
+	0, // 3: opencloud.services.thumbnails.v0.ThumbnailService.GetThumbnail:input_type -> opencloud.services.thumbnails.v0.GetThumbnailRequest
+	1, // 4: opencloud.services.thumbnails.v0.ThumbnailService.GetThumbnail:output_type -> opencloud.services.thumbnails.v0.GetThumbnailResponse
+	4, // [4:5] is the sub-list for method output_type
+	3, // [3:4] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_opencloud_services_thumbnails_v0_thumbnails_proto_init() }
+func file_opencloud_services_thumbnails_v0_thumbnails_proto_init() {
+	if File_opencloud_services_thumbnails_v0_thumbnails_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetThumbnailRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetThumbnailResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*GetThumbnailRequest_WebdavSource)(nil),
+		(*GetThumbnailRequest_Cs3Source)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_opencloud_services_thumbnails_v0_thumbnails_proto_goTypes,
+		DependencyIndexes: file_opencloud_services_thumbnails_v0_thumbnails_proto_depIdxs,
+		MessageInfos:      file_opencloud_services_thumbnails_v0_thumbnails_proto_msgTypes,
+	}.Build()
+	File_opencloud_services_thumbnails_v0_thumbnails_proto = out.File
+	file_opencloud_services_thumbnails_v0_thumbnails_proto_rawDesc = nil
+	file_opencloud_services_thumbnails_v0_thumbnails_proto_goTypes = nil
+	file_opencloud_services_thumbnails_v0_thumbnails_proto_depIdxs = nil
+}
@@ -0,0 +1,91 @@
+// Code generated by protoc-gen-micro. DO NOT EDIT.
+// source: opencloud/services/thumbnails/v0/thumbnails.proto
+
+package v0
+
+import (
+	fmt "fmt"
+	_ "github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2/options"
+	_ "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/thumbnails/v0"
+	proto "google.golang.org/protobuf/proto"
+	math "math"
+)
+
+import (
+	context "context"
+	api "go-micro.dev/v4/api"
+	client "go-micro.dev/v4/client"
+	server "go-micro.dev/v4/server"
+)
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ = proto.Marshal
+var _ = fmt.Errorf
+var _ = math.Inf
+
+// Reference imports to suppress errors if they are not otherwise used.
+var _ api.Endpoint
+var _ context.Context
+var _ client.Option
+var _ server.Option
+
+// Api Endpoints for ThumbnailService service
+
+func NewThumbnailServiceEndpoints() []*api.Endpoint {
+	return []*api.Endpoint{}
+}
+
+// Client API for ThumbnailService service
+
+type ThumbnailService interface {
+	// Generates the thumbnail and returns it.
+	GetThumbnail(ctx context.Context, in *GetThumbnailRequest, opts ...client.CallOption) (*GetThumbnailResponse, error)
+}
+
+type thumbnailService struct {
+	c    client.Client
+	name string
+}
+
+func NewThumbnailService(name string, c client.Client) ThumbnailService {
+	return &thumbnailService{
+		c:    c,
+		name: name,
+	}
+}
+
+func (c *thumbnailService) GetThumbnail(ctx context.Context, in *GetThumbnailRequest, opts ...client.CallOption) (*GetThumbnailResponse, error) {
+	req := c.c.NewRequest(c.name, "ThumbnailService.GetThumbnail", in)
+	out := new(GetThumbnailResponse)
+	err := c.c.Call(ctx, req, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// Server API for ThumbnailService service
+
+type ThumbnailServiceHandler interface {
+	// Generates the thumbnail and returns it.
+	GetThumbnail(context.Context, *GetThumbnailRequest, *GetThumbnailResponse) error
+}
+
+func RegisterThumbnailServiceHandler(s server.Server, hdlr ThumbnailServiceHandler, opts ...server.HandlerOption) error {
+	type thumbnailService interface {
+		GetThumbnail(ctx context.Context, in *GetThumbnailRequest, out *GetThumbnailResponse) error
+	}
+	type ThumbnailService struct {
+		thumbnailService
+	}
+	h := &thumbnailServiceHandler{hdlr}
+	return s.Handle(s.NewHandler(&ThumbnailService{h}, opts...))
+}
+
+type thumbnailServiceHandler struct {
+	ThumbnailServiceHandler
+}
+
+func (h *thumbnailServiceHandler) GetThumbnail(ctx context.Context, in *GetThumbnailRequest, out *GetThumbnailResponse) error {
+	return h.ThumbnailServiceHandler.GetThumbnail(ctx, in, out)
+}
@@ -0,0 +1,129 @@
+{
+  "swagger": "2.0",
+  "info": {
+    "title": "OpenCloud thumbnails",
+    "version": "1.0.0",
+    "contact": {
+      "name": "OpenCloud GmbH",
+      "url": "https://github.com/opencloud-eu/opencloud",
+      "email": "support@opencloud.eu"
+    },
+    "license": {
+      "name": "Apache-2.0",
+      "url": "https://github.com/opencloud-eu/opencloud/blob/main/LICENSE"
+    }
+  },
+  "tags": [
+    {
+      "name": "ThumbnailService"
+    }
+  ],
+  "schemes": [
+    "http",
+    "https"
+  ],
+  "consumes": [
+    "application/json"
+  ],
+  "produces": [
+    "application/json"
+  ],
+  "paths": {},
+  "definitions": {
+    "protobufAny": {
+      "type": "object",
+      "properties": {
+        "@type": {
+          "type": "string"
+        }
+      },
+      "additionalProperties": {}
+    },
+    "rpcStatus": {
+      "type": "object",
+      "properties": {
+        "code": {
+          "type": "integer",
+          "format": "int32"
+        },
+        "message": {
+          "type": "string"
+        },
+        "details": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/protobufAny"
+          }
+        }
+      }
+    },
+    "v0CS3Source": {
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "authorization": {
+          "type": "string"
+        }
+      }
+    },
+    "v0GetThumbnailResponse": {
+      "type": "object",
+      "properties": {
+        "dataEndpoint": {
+          "type": "string",
+          "description": "The endpoint where the thumbnail can be downloaded."
+        },
+        "transferToken": {
+          "type": "string",
+          "description": "The transfer token to be able to download the thumbnail."
+        },
+        "mimetype": {
+          "type": "string",
+          "title": "The mimetype of the thumbnail"
+        }
+      },
+      "title": "The service response"
+    },
+    "v0ThumbnailType": {
+      "type": "string",
+      "enum": [
+        "PNG",
+        "JPG",
+        "GIF"
+      ],
+      "default": "PNG",
+      "description": "The file types to which the thumbnail can be encoded to.\n\n - PNG: Represents PNG type\n - JPG: Represents JPG type\n - GIF: Represents GIF type"
+    },
+    "v0WebdavSource": {
+      "type": "object",
+      "properties": {
+        "url": {
+          "type": "string",
+          "description": "REQUIRED."
+        },
+        "isPublicLink": {
+          "type": "boolean",
+          "description": "REQUIRED."
+        },
+        "webdavAuthorization": {
+          "type": "string",
+          "description": "OPTIONAL."
+        },
+        "revaAuthorization": {
+          "type": "string",
+          "description": "OPTIONAL."
+        },
+        "publicLinkToken": {
+          "type": "string",
+          "description": "OPTIONAL."
+        }
+      }
+    }
+  },
+  "externalDocs": {
+    "description": "Developer Manual",
+    "url": "https://docs.opencloud.eu/services/thumbnails/"
+  }
+}
@@ -0,0 +1,127 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             (unknown)
+// source: opencloud/services/thumbnails/v0/thumbnails.proto
+
+package v0
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	ThumbnailService_GetThumbnail_FullMethodName = "/opencloud.services.thumbnails.v0.ThumbnailService/GetThumbnail"
+)
+
+// ThumbnailServiceClient is the client API for ThumbnailService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// A Service for handling thumbnail generation
+type ThumbnailServiceClient interface {
+	// Generates the thumbnail and returns it.
+	GetThumbnail(ctx context.Context, in *GetThumbnailRequest, opts ...grpc.CallOption) (*GetThumbnailResponse, error)
+}
+
+type thumbnailServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewThumbnailServiceClient(cc grpc.ClientConnInterface) ThumbnailServiceClient {
+	return &thumbnailServiceClient{cc}
+}
+
+func (c *thumbnailServiceClient) GetThumbnail(ctx context.Context, in *GetThumbnailRequest, opts ...grpc.CallOption) (*GetThumbnailResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(GetThumbnailResponse)
+	err := c.cc.Invoke(ctx, ThumbnailService_GetThumbnail_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ThumbnailServiceServer is the server API for ThumbnailService service.
+// All implementations must embed UnimplementedThumbnailServiceServer
+// for forward compatibility.
+//
+// A Service for handling thumbnail generation
+type ThumbnailServiceServer interface {
+	// Generates the thumbnail and returns it.
+	GetThumbnail(context.Context, *GetThumbnailRequest) (*GetThumbnailResponse, error)
+	mustEmbedUnimplementedThumbnailServiceServer()
+}
+
+// UnimplementedThumbnailServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedThumbnailServiceServer struct{}
+
+func (UnimplementedThumbnailServiceServer) GetThumbnail(context.Context, *GetThumbnailRequest) (*GetThumbnailResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method GetThumbnail not implemented")
+}
+func (UnimplementedThumbnailServiceServer) mustEmbedUnimplementedThumbnailServiceServer() {}
+func (UnimplementedThumbnailServiceServer) testEmbeddedByValue()                          {}
+
+// UnsafeThumbnailServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ThumbnailServiceServer will
+// result in compilation errors.
+type UnsafeThumbnailServiceServer interface {
+	mustEmbedUnimplementedThumbnailServiceServer()
+}
+
+func RegisterThumbnailServiceServer(s grpc.ServiceRegistrar, srv ThumbnailServiceServer) {
+	// If the following call panics, it indicates UnimplementedThumbnailServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ThumbnailService_ServiceDesc, srv)
+}
+
+func _ThumbnailService_GetThumbnail_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetThumbnailRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ThumbnailServiceServer).GetThumbnail(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ThumbnailService_GetThumbnail_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ThumbnailServiceServer).GetThumbnail(ctx, req.(*GetThumbnailRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ThumbnailService_ServiceDesc is the grpc.ServiceDesc for ThumbnailService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ThumbnailService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "opencloud.services.thumbnails.v0.ThumbnailService",
+	HandlerType: (*ThumbnailServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "GetThumbnail",
+			Handler:    _ThumbnailService_GetThumbnail_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "opencloud/services/thumbnails/v0/thumbnails.proto",
+}
@@ -59,33 +59,6 @@ message Photo {
 	optional google.protobuf.Timestamp takenDateTime = 9;
 }

-message Video {
-	optional int32 audioBitsPerSample = 1;
-	optional int32 audioChannels = 2;
-	optional string audioFormat = 3;
-	optional int32 audioSamplesPerSecond = 4;
-	optional int32 bitrate = 5;
-	optional int64 duration = 6;
-	optional string fourCC = 7;
-	optional double frameRate = 8;
-	optional int32 height = 9;
-	optional int32 width = 10;
-}
-
-message MotionPhoto {
-	optional int32 version = 1;
-	optional int64 presentationTimestampUs = 2;
-	optional int64 videoSize = 3;
-}
-
-message LivePhoto {
-	optional string contentId = 1;
-	optional int64 stillImageTimeUs = 2;
-	optional bool auto = 3;
-	optional double vitalityScore = 4;
-	optional int64 vitalityScoringVersion = 5;
-}
-
 message Entity {
 	Reference ref = 1;
 	ResourceID id = 2;
@@ -107,9 +80,6 @@ message Entity {
 	Image image = 18;
 	Photo photo = 19;
 	repeated string favorites = 20;
-	MotionPhoto motionPhoto = 21;
-	Video video = 22;
-	LivePhoto livePhoto = 23;
 }

 message Match {
@@ -0,0 +1,30 @@
+syntax = "proto3";
+
+package opencloud.messages.thumbnails.v0;
+
+option go_package = "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/thumbnails/v0";
+
+message WebdavSource {
+    // REQUIRED.
+    string url = 1;
+    // REQUIRED.
+    bool is_public_link = 2;
+    // OPTIONAL.
+    string webdav_authorization = 3;
+    // OPTIONAL.
+    string reva_authorization = 4;
+    // OPTIONAL.
+    string public_link_token = 5;
+}
+
+message CS3Source {
+    string path = 1;
+    string authorization = 2;
+}
+
+// The file types to which the thumbnail can be encoded to.
+enum ThumbnailType {
+        PNG = 0; // Represents PNG type
+        JPG = 1; // Represents JPG type
+        GIF = 2; // Represents GIF type
+}
@@ -0,0 +1,66 @@
+syntax = "proto3";
+
+package opencloud.services.thumbnails.v0;
+
+option go_package = "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/thumbnails/v0";
+
+import "opencloud/messages/thumbnails/v0/thumbnails.proto";
+import "protoc-gen-openapiv2/options/annotations.proto";
+
+option (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_swagger) = {
+  info: {
+    title: "OpenCloud thumbnails";
+    version: "1.0.0";
+    contact: {
+      name: "OpenCloud GmbH";
+      url: "https://github.com/opencloud-eu/opencloud";
+      email: "support@opencloud.eu";
+    };
+    license: {
+      name: "Apache-2.0";
+      url: "https://github.com/opencloud-eu/opencloud/blob/main/LICENSE";
+    };
+  };
+  schemes: HTTP;
+  schemes: HTTPS;
+  consumes: "application/json";
+  produces: "application/json";
+  external_docs: {
+    description: "Developer Manual";
+    url: "https://docs.opencloud.eu/services/thumbnails/";
+  };
+};
+
+// A Service for handling thumbnail generation
+service ThumbnailService {
+    // Generates the thumbnail and returns it.
+    rpc GetThumbnail(GetThumbnailRequest) returns (GetThumbnailResponse);
+}
+
+// A request to retrieve a thumbnail
+message GetThumbnailRequest {
+    // The path to the source image
+    string filepath = 1;
+    // The type to which the thumbnail should get encoded to.
+    opencloud.messages.thumbnails.v0.ThumbnailType thumbnail_type = 2;
+    // The width of the thumbnail
+    int32 width = 3;
+    // The height of the thumbnail
+    int32 height = 4;
+    // Indicates which image processor to use
+    string processor = 5;
+    oneof source {
+      opencloud.messages.thumbnails.v0.WebdavSource webdav_source = 6;
+      opencloud.messages.thumbnails.v0.CS3Source cs3_source = 7;
+    }
+}
+
+// The service response
+message GetThumbnailResponse {
+    // The endpoint where the thumbnail can be downloaded.
+    string data_endpoint = 1;
+    // The transfer token to be able to download the thumbnail.
+    string transfer_token = 2;
+    // The mimetype of the thumbnail
+    string mimetype = 3;
+}
@@ -3,18 +3,17 @@ package command
 import (
 	"context"
 	"fmt"
-	"strings"

-	"github.com/nats-io/nats.go"
-	"github.com/olekukonko/errors"
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/pkg/runner"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
 	"github.com/spf13/cobra"

 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
 	"github.com/opencloud-eu/opencloud/pkg/generators"
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	natspkg "github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/registry"
-	"github.com/opencloud-eu/opencloud/pkg/runner"
 	ogrpc "github.com/opencloud-eu/opencloud/pkg/service/grpc"
 	"github.com/opencloud-eu/opencloud/pkg/tracing"
 	"github.com/opencloud-eu/opencloud/pkg/version"
@@ -25,12 +24,6 @@ import (
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/metrics"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/server/debug"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/server/http"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
-	svcEvents "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events"
-	svcHttp "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
 )

 var _registeredEvents = []events.Unmarshaller{
@@ -69,11 +62,19 @@ func Server(cfg *config.Config) *cobra.Command {

 			gr := runner.NewGroup()
 			ctx, cancel := context.WithCancel(cmd.Context())
-			defer cancel()

 			mtrcs := metrics.New()
 			mtrcs.BuildInfo.WithLabelValues(version.GetString()).Set(1)

+			defer cancel()
+
+			connName := generators.GenerateConnectionName(cfg.Service.Name, generators.NTypeBus)
+			evStream, err := stream.NatsFromConfig(connName, false, stream.NatsConfig(cfg.Events))
+			if err != nil {
+				logger.Error().Err(err).Msg("Failed to initialize event stream")
+				return err
+			}
+
 			tm, err := pool.StringToTLSMode(cfg.GRPCClientTLS.Mode)
 			if err != nil {
 				logger.Error().Err(err).Msg("Failed to parse tls mode")
@@ -98,101 +99,28 @@ func Server(cfg *config.Config) *cobra.Command {
 				return err
 			}

-			kv, err := ConnectNatsKV(cfg.Store)
-			if err != nil {
-				return err
-			}
-			activityLog, err := activitylog.New(kv,
-				activitylog.Logger(logger),
-				activitylog.MaxActivities(cfg.MaxActivities),
-				activitylog.WriteBufferDuration(cfg.WriteBufferDuration),
-			)
-			if err != nil {
-				logger.Error().Err(err).Msg("Failed to initialize activity log")
-				return err
-			}
+			hClient := ehsvc.NewEventHistoryService("eu.opencloud.api.eventhistory", grpcClient)
+			vClient := settingssvc.NewValueService("eu.opencloud.api.settings", grpcClient)

-			if !cfg.HTTP.Disabled {
-
-				hClient := ehsvc.NewEventHistoryService("eu.opencloud.api.eventhistory", grpcClient)
-
-				svc, err := svcHttp.New(
-					activityLog,
-					svcHttp.Logger(logger),
-					svcHttp.GatewaySelector(gatewaySelector),
-					svcHttp.RegisteredEvents(_registeredEvents),
-					//svcHttp.TraceProvider(tracerProvider),
-					svcHttp.HistoryClient(hClient),
-				)
-				if err != nil {
-					logger.Error().Err(err).Msg("handler init")
-					return err
-				}
-				// TODO svc = service.NewInstrument(svc, metrics)
-				// TODO svc = service.NewLogging(svc, logger) // this logs service specific data
-				// TODO svc = service.NewTracing(svc, traceProvider)
-				vClient := settingssvc.NewValueService("eu.opencloud.api.settings", grpcClient)
-
-				server, err := http.Server(
-					http.ValueClient(vClient),
+			{
+				svc, err := http.Server(
 					http.Logger(logger),
-					http.Context(ctx),
 					http.Config(cfg),
-					http.Service(svc),
+					http.Context(ctx), // NOTE: not passing this "option" leads to a panic in go-micro
+					http.TraceProvider(tracerProvider),
+					http.Stream(evStream),
+					http.GatewaySelector(gatewaySelector),
+					http.HistoryClient(hClient),
+					http.ValueClient(vClient),
+					http.RegisteredEvents(_registeredEvents),
 				)
-				if err != nil {
-					logger.Info().
-						Err(err).
-						Str("transport", "http").
-						Msg("Failed to initialize server")

+				if err != nil {
+					logger.Error().Err(err).Str("transport", "http").Msg("Failed to initialize server")
 					return err
 				}

-				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", server))
-			} else {
-				logger.Info().Msg("HTTP server disabled, not starting HTTP service")
-			}
-
-			if !cfg.Events.Disabled {
-
-				connName := generators.GenerateConnectionName(cfg.Service.Name, generators.NTypeBus)
-				evStream, err := stream.NatsFromConfig(connName, false, stream.NatsConfig{
-					Endpoint:             cfg.Events.Endpoint,
-					Cluster:              cfg.Events.Cluster,
-					EnableTLS:            cfg.Events.EnableTLS,
-					TLSInsecure:          cfg.Events.TLSInsecure,
-					TLSRootCACertificate: cfg.Events.TLSRootCACertificate,
-					AuthUsername:         cfg.Events.AuthUsername,
-					AuthPassword:         cfg.Events.AuthPassword,
-				})
-				if err != nil {
-					logger.Error().Err(err).Msg("Failed to initialize event stream")
-					return err
-				}
-
-				eventSvc, err := svcEvents.New(
-					activityLog,
-					evStream,
-					svcEvents.Context(ctx),
-					svcEvents.Logger(logger),
-					svcEvents.ServiceAccount(cfg.ServiceAccount),
-					svcEvents.GatewaySelector(gatewaySelector),
-					svcEvents.RegisteredEvents(_registeredEvents),
-					svcEvents.NumConsumers(cfg.NumConsumers),
-				)
-				if err != nil {
-					logger.Error().Err(err).Str("transport", "event").Msg("Failed to initialize server")
-					return err
-				}
-
-				gr.Add(runner.New(cfg.Service.Name+".svc", func() error {
-					return eventSvc.Run()
-				}, func() {
-					eventSvc.Close()
-				}))
-			} else {
-				logger.Info().Msg("event listening disabled, not starting event service")
+				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", svc))
 			}

 			{
@@ -221,33 +149,3 @@ func Server(cfg *config.Config) *cobra.Command {
 		},
 	}
 }
-
-func ConnectNatsKV(cfg config.Store) (nats.KeyValue, error) {
-	// Connect to NATS servers
-	secureOption := natspkg.Secure(cfg.EnableTLS, cfg.TLSInsecure, cfg.TLSRootCACertificate)
-	conn, err := nats.Connect(strings.Join(cfg.Nodes, ","), secureOption, nats.UserInfo(cfg.AuthUsername, cfg.AuthPassword))
-	if err != nil {
-		return nil, err
-	}
-
-	js, err := conn.JetStream()
-	if err != nil {
-		return nil, err
-	}
-
-	kv, err := js.KeyValue(cfg.Database)
-	if err != nil {
-		if !errors.Is(err, nats.ErrBucketNotFound) {
-			return nil, errors.Wrapf(err, "Failed to get bucket (%s)", cfg.Database)
-		}
-
-		kv, err = js.CreateKeyValue(&nats.KeyValueConfig{
-			Bucket: cfg.Database,
-		})
-		if err != nil {
-			return nil, errors.Wrapf(err, "Failed to create bucket (%s)", cfg.Database)
-		}
-	}
-
-	return kv, nil
-}
@@ -35,12 +35,10 @@ type Config struct {

 	WriteBufferDuration time.Duration `yaml:"write_buffer_duration" env:"ACTIVITYLOG_WRITE_BUFFER_DURATION" desc:"The duration to wait before flushing the write buffer. This is used to reduce the number of writes to the store." introductionVersion:"4.0.0"`
 	MaxActivities       int           `yaml:"max_activities" env:"ACTIVITYLOG_MAX_ACTIVITIES" desc:"The maximum number of activities to keep in the store per resource. If the number of activities exceeds this value, the oldest activities will be removed." introductionVersion:"4.0.0"`
-	NumConsumers        int           `yaml:"num_consumers" env:"ACTIVITYLOG_NUM_CONSUMERS" desc:"The amount of concurrent event consumers to start. Event consumers are used for updating the list of activities. Multiple consumers increase parallelisation, but will also increase CPU and memory demands." introductionVersion:"%NEXT%"`
 }

 // Events combines the configuration options for the event bus.
 type Events struct {
-	Disabled             bool   `yaml:"disabled" env:"ACTIVITYLOG_EVENTS_DISABLED" desc:"Disables listening for events. Set this to true if the service should only handle HTTP requests." introductionVersion:"%NEXT%"`
 	Endpoint             string `yaml:"endpoint" env:"OC_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture." introductionVersion:"1.0.0"`
 	Cluster              string `yaml:"cluster" env:"OC_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Mandatory when using NATS as event system." introductionVersion:"1.0.0"`
 	TLSInsecure          bool   `yaml:"tls_insecure" env:"OC_INSECURE;OC_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"1.0.0"`
@@ -79,7 +77,6 @@ type CORS struct {

 // HTTP defines the available http configuration.
 type HTTP struct {
-	Disabled  bool                  `yaml:"disabled" env:"ACTIVITYLOG_HTTP_DISABLED" desc:"Disables the HTTP service. Set this to true if the service should only handle events." introductionVersion:"1.0.0"`
 	Addr      string                `yaml:"addr" env:"ACTIVITYLOG_HTTP_ADDR" desc:"The bind address of the HTTP service." introductionVersion:"1.0.0"`
 	Namespace string                `yaml:"-"`
 	Root      string                `yaml:"root" env:"ACTIVITYLOG_HTTP_ROOT" desc:"Subdirectory that serves as the root for this HTTP service." introductionVersion:"1.0.0"`
@@ -52,9 +52,7 @@ func DefaultConfig() *config.Config {
 			},
 		},
 		WriteBufferDuration: 10 * time.Second,
-		// Nats runs into max payload exceeded errors at around 7k activities. Let's keep a buffer.
-		MaxActivities: 6000,
-		NumConsumers:  1,
+		MaxActivities:       6000,
 	}
 }

@@ -3,12 +3,18 @@ package http
 import (
 	"context"

+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	"github.com/opencloud-eu/opencloud/pkg/log"
+	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
 	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/metrics"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+
 	"github.com/spf13/pflag"
+	"go-micro.dev/v4/store"
 	"go.opentelemetry.io/otel/trace"
-	"go.opentelemetry.io/otel/trace/noop"
 )

 // Option defines a single option function.
@@ -16,15 +22,19 @@ type Option func(o *Options)

 // Options defines the available options for this package.
 type Options struct {
-	Name          string
-	Namespace     string
-	Logger        log.Logger
-	Context       context.Context
-	Config        *config.Config
-	Flags         []pflag.Flag
-	Service       ActivityLogService
-	TraceProvider trace.TracerProvider
-	ValueClient   settingssvc.ValueService
+	Logger           log.Logger
+	Context          context.Context
+	Config           *config.Config
+	Metrics          *metrics.Metrics
+	Flags            []pflag.Flag
+	Namespace        string
+	Store            store.Store
+	Stream           events.Stream
+	GatewaySelector  pool.Selectable[gateway.GatewayAPIClient]
+	TraceProvider    trace.TracerProvider
+	HistoryClient    ehsvc.EventHistoryService
+	ValueClient      settingssvc.ValueService
+	RegisteredEvents []events.Unmarshaller
 }

 // newOptions initializes the available default options.
@@ -59,10 +69,10 @@ func Config(val *config.Config) Option {
 	}
 }

-// Service provides a function to set the service option.
-func Service(val ActivityLogService) Option {
+// Metrics provides a function to set the metrics option.
+func Metrics(val *metrics.Metrics) Option {
 	return func(o *Options) {
-		o.Service = val
+		o.Metrics = val
 	}
 }

@@ -73,20 +83,58 @@ func Flags(flags ...pflag.Flag) Option {
 	}
 }

-// TraceProvider provides a function to configure the trace provider
-func TraceProvider(traceProvider trace.TracerProvider) Option {
+// Namespace provides a function to set the Namespace option.
+func Namespace(val string) Option {
 	return func(o *Options) {
-		if traceProvider != nil {
-			o.TraceProvider = traceProvider
-		} else {
-			o.TraceProvider = noop.NewTracerProvider()
-		}
+		o.Namespace = val
 	}
 }

-// ValueClient adds a grpc client for the value service
-func ValueClient(vs settingssvc.ValueService) Option {
+// Store provides a function to configure the store
+func Store(store store.Store) Option {
 	return func(o *Options) {
-		o.ValueClient = vs
+		o.Store = store
+	}
+}
+
+// Stream provides a function to configure the stream
+func Stream(stream events.Stream) Option {
+	return func(o *Options) {
+		o.Stream = stream
+	}
+}
+
+// GatewaySelector provides a function to configure the gateway client selector
+func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient]) Option {
+	return func(o *Options) {
+		o.GatewaySelector = gatewaySelector
+	}
+}
+
+// HistoryClient provides a function to configure the event history client
+func HistoryClient(h ehsvc.EventHistoryService) Option {
+	return func(o *Options) {
+		o.HistoryClient = h
+	}
+}
+
+// RegisteredEvents provides a function to register events
+func RegisteredEvents(evs []events.Unmarshaller) Option {
+	return func(o *Options) {
+		o.RegisteredEvents = evs
+	}
+}
+
+// TraceProvider provides a function to set the TracerProvider option
+func TraceProvider(val trace.TracerProvider) Option {
+	return func(o *Options) {
+		o.TraceProvider = val
+	}
+}
+
+// ValueClient provides a function to set the ValueClient options
+func ValueClient(val settingssvc.ValueService) Option {
+	return func(o *Options) {
+		o.ValueClient = val
 	}
 }
@@ -1,63 +1,49 @@
 package http

 import (
-	"context"
-	"embed"
-	"encoding/json"
-	"errors"
-	"net/http"
+	"fmt"
+
+	stdhttp "net/http"

 	"github.com/go-chi/chi/v5"
 	chimiddleware "github.com/go-chi/chi/v5/middleware"
-	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/opencloud/pkg/account"
 	"github.com/opencloud-eu/opencloud/pkg/cors"
-	"github.com/opencloud-eu/opencloud/pkg/l10n"
-	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/pkg/middleware"
-	ohttp "github.com/opencloud-eu/opencloud/pkg/service/http"
+	"github.com/opencloud-eu/opencloud/pkg/service/http"
+	"github.com/opencloud-eu/opencloud/pkg/tracing"
 	"github.com/opencloud-eu/opencloud/pkg/version"
-	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
-	activityloghttp "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
-	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+	svc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service"
+	"github.com/riandyrn/otelchi"
 	"go-micro.dev/v4"
-	"google.golang.org/grpc/metadata"
 )

-var (
-	//go:embed l10n/locale
-	_localeFS embed.FS
-
-	// subfolder where the translation files are stored
-	_localeSubPath = "l10n/locale"
-
-	// domain of the activitylog service (transifex)
-	_domain = "activitylog"
-)
+// Service is the service interface
+type Service any

 // Server initializes the http service and server.
-func Server(opts ...Option) (ohttp.Service, error) {
+func Server(opts ...Option) (http.Service, error) {
 	options := newOptions(opts...)
-	service := options.Service

-	newService, err := ohttp.NewService(
-		ohttp.TLSConfig(options.Config.HTTP.TLS),
-		ohttp.Logger(options.Logger),
-		ohttp.Namespace(options.Config.HTTP.Namespace),
-		ohttp.Name(options.Config.Service.Name),
-		ohttp.Version(version.GetString()),
-		ohttp.Address(options.Config.HTTP.Addr),
-		ohttp.Context(options.Context),
-		ohttp.Flags(options.Flags...),
+	service, err := http.NewService(
+		http.TLSConfig(options.Config.HTTP.TLS),
+		http.Logger(options.Logger),
+		http.Namespace(options.Config.HTTP.Namespace),
+		http.Name(options.Config.Service.Name),
+		http.Version(version.GetString()),
+		http.Address(options.Config.HTTP.Addr),
+		http.Context(options.Context),
+		http.Flags(options.Flags...),
+		http.TraceProvider(options.TraceProvider),
 	)
 	if err != nil {
 		options.Logger.Error().
 			Err(err).
 			Msg("Error initializing http service")
-		return ohttp.Service{}, err
+		return http.Service{}, fmt.Errorf("could not initialize http service: %w", err)
 	}

-	middlewares := []func(http.Handler) http.Handler{
+	middlewares := []func(stdhttp.Handler) stdhttp.Handler{
 		chimiddleware.RequestID,
 		middleware.Version(
 			options.Config.Service.Name,
@@ -66,7 +52,6 @@ func Server(opts ...Option) (ohttp.Service, error) {
 		middleware.Logger(
 			options.Logger,
 		),
-		middleware.TraceContext,
 		middleware.ExtractAccountUUID(
 			account.Logger(options.Logger),
 			account.JWTSecret(options.Config.TokenManager.JWTSecret),
@@ -83,75 +68,33 @@ func Server(opts ...Option) (ohttp.Service, error) {
 	mux := chi.NewMux()
 	mux.Use(middlewares...)

-	t := l10n.NewTranslatorFromCommonConfig(options.Config.DefaultLanguage, _domain, options.Config.TranslationPath, _localeFS, _localeSubPath)
-	mux.Route(options.Config.HTTP.Root, func(r chi.Router) {
-		r.Get("/graph/v1beta1/extensions/org.libregraph/activities", GetItemActivitiesHandler(options.Logger, service, options.ValueClient, t))
-	})
+	mux.Use(
+		otelchi.Middleware(
+			"actitivylog",
+			otelchi.WithChiRoutes(mux),
+			otelchi.WithTracerProvider(options.TraceProvider),
+			otelchi.WithPropagators(tracing.GetPropagator()),
+		),
+	)

-	err = micro.RegisterHandler(newService.Server(), mux)
+	handle, err := svc.New(
+		svc.Logger(options.Logger),
+		svc.Stream(options.Stream),
+		svc.Mux(mux),
+		svc.Config(options.Config),
+		svc.GatewaySelector(options.GatewaySelector),
+		svc.TraceProvider(options.TraceProvider),
+		svc.HistoryClient(options.HistoryClient),
+		svc.ValueClient(options.ValueClient),
+		svc.RegisteredEvents(options.RegisteredEvents),
+	)
 	if err != nil {
-		options.Logger.Fatal().Err(err).Msg("failed to register the handler")
+		return http.Service{}, err
 	}

-	newService.Init()
-	return newService, nil
-
-}
-
-// Service defines the business logic implementations need to provide.
-type ActivityLogService interface {
-	GetItemActivities(ctx context.Context, query, loc string, t l10n.Translator) ([]libregraph.Activity, error)
-}
-
-// GetActivitiesResponse is the response on GET activities requests
-type GetActivitiesResponse struct {
-	Activities []libregraph.Activity `json:"value"`
-}
-
-func GetItemActivitiesHandler(log log.Logger, s ActivityLogService, vc settingssvc.ValueService, t l10n.Translator) func(w http.ResponseWriter, r *http.Request) {
-	return func(w http.ResponseWriter, r *http.Request) {
-		ctx := r.Context()
-		ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, r.Header.Get(revactx.TokenHeader))
-
-		activeUser, ok := revactx.ContextGetUser(ctx)
-		if !ok {
-			w.WriteHeader(http.StatusUnauthorized)
-			return
-		}
-
-		loc := l10n.MustGetUserLocale(ctx, activeUser.GetId().GetOpaqueId(), r.Header.Get(l10n.HeaderAcceptLanguage), vc)
-
-		activities, err := s.GetItemActivities(ctx, r.URL.Query().Get("kql"), loc, t)
-		if err != nil {
-			switch {
-			case errors.Is(err, activityloghttp.ErrBadRequest):
-				log.Debug().Str("query", r.URL.Query().Get("kql")).Err(err).Msg("error getting activities")
-				w.WriteHeader(http.StatusBadRequest)
-				return
-			case errors.Is(err, activityloghttp.ErrForbidden):
-				log.Debug().Err(err).Msg("error getting activities")
-				w.WriteHeader(http.StatusForbidden)
-				return
-			default:
-				log.Error().Err(err).Msg("error getting activities")
-				w.WriteHeader(http.StatusInternalServerError)
-				return
-			}
-		}
-		res := GetActivitiesResponse{
-			Activities: activities,
-		}
-
-		w.Header().Set("Content-Type", "application/json; odata.metadata=minimal")
-		w.Header().Set("OData-Version", "4.0")
-		if reqID := chimiddleware.GetReqID(ctx); reqID != "" {
-			w.Header().Set("request-id", reqID)
-		}
-		w.Header().Set("Cache-Control", "no-cache")
-		if err := json.NewEncoder(w).Encode(res); err != nil {
-			log.Error().Err(err).Msg("error encoding activities")
-			w.WriteHeader(http.StatusInternalServerError)
-			return
-		}
+	if err := micro.RegisterHandler(service.Server(), handle); err != nil {
+		return http.Service{}, err
 	}
+
+	return service, nil
 }
@@ -1,366 +0,0 @@
-package activitylog
-
-import (
-	"context"
-	"encoding/base32"
-	"encoding/json"
-	"fmt"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	"github.com/jellydator/ttlcache/v2"
-	"github.com/nats-io/nats.go"
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/vmihailenco/msgpack/v5"
-	"go.opentelemetry.io/otel"
-	"go.opentelemetry.io/otel/trace"
-)
-
-var tracer trace.Tracer
-
-func init() {
-	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog")
-}
-
-var (
-	_maxActivitiesDefault = 6000
-	_writeBufferDuration  = 10 * time.Second
-)
-
-// Activitylog stores and retrieves activities for resources and their parents from a nats kv
-type ActivityLog struct {
-	log log.Logger
-	// FIXME the lock does not protect agains concurrent resource activities on multiple instances
-	// known since https://github.com/owncloud/ocis/pull/9361#pullrequestreview-2135350157
-	// current ocis discussion in https://github.com/owncloud/ocis/issues/12475
-	lock          sync.RWMutex
-	debouncer     *Debouncer
-	parentIdCache *ttlcache.Cache
-	natskv        nats.KeyValue
-
-	maxActivities int
-}
-
-type batchInfo struct {
-	key       string
-	count     int
-	timestamp time.Time
-}
-
-// New creates a new ActivitylogService
-func New(kv nats.KeyValue, opts ...Option) (*ActivityLog, error) {
-	o := &Options{
-		MaxActivities:       _maxActivitiesDefault,
-		WriteBufferDuration: _writeBufferDuration,
-		Logger:              log.NopLogger(),
-	}
-	for _, opt := range opts {
-		opt(o)
-	}
-
-	cache := ttlcache.NewCache()
-	err := cache.SetTTL(30 * time.Second)
-	if err != nil {
-		return nil, err
-	}
-
-	s := &ActivityLog{
-		log:           o.Logger,
-		lock:          sync.RWMutex{},
-		parentIdCache: cache,
-		maxActivities: o.MaxActivities,
-		natskv:        kv,
-	}
-	s.debouncer = NewDebouncer(o.WriteBufferDuration, s.StoreActivity)
-
-	// run migrations
-	err = s.runMigrations(context.Background(), kv)
-	if err != nil {
-		return nil, err
-	}
-
-	return s, nil
-}
-
-// RemoveResource removes the resource from the store
-func (a *ActivityLog) RemoveResource(rid *provider.ResourceId) error {
-	if rid == nil {
-		return fmt.Errorf("resource id is required")
-	}
-
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	err := a.natskv.Delete(storagespace.FormatResourceID(rid))
-	if err != nil {
-		return fmt.Errorf("could not delete resource %s: %w", rid.OpaqueId, err)
-	}
-	return nil
-}
-
-// RawActivity represents an activity as it is stored in the activitylog store
-type RawActivity struct {
-	EventID   string    `json:"event_id"`
-	Depth     int       `json:"depth"`
-	Timestamp time.Time `json:"timestamp"`
-}
-
-func (a *ActivityLog) AddActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time, getResource func(context.Context, *provider.Reference) (*provider.ResourceInfo, error)) error {
-	var (
-		err   error
-		depth int
-		ref   = initRef
-	)
-	ctx, span := tracer.Start(ctx, "AddActivity")
-	defer span.End()
-	for {
-		var info *provider.ResourceInfo
-		id := ref.GetResourceId()
-		if ref.Path != "" {
-			// Path based reference, we need to resolve the resource id
-			ctx, span = tracer.Start(ctx, "AddActivity.getResource")
-			info, err = getResource(ctx, ref)
-			span.End()
-			if err != nil {
-				// TODO If the resource was deleted should we still log an activity in the parent?
-				return fmt.Errorf("could not get resource info for reference %v: %w", ref, err)
-			}
-			id = info.GetId()
-		}
-		if id == nil {
-			return fmt.Errorf("resource id is required")
-		}
-
-		key := storagespace.FormatResourceID(id)
-		a.debouncer.Debounce(key, RawActivity{
-			EventID:   eventID,
-			Depth:     depth,
-			Timestamp: timestamp,
-		})
-
-		if id.OpaqueId == id.SpaceId {
-			// we are at the root of the space, no need to go further
-			break
-		}
-
-		// check if parent id is cached
-		// parent id is cached in the format <storageid>$<spaceid>!<resourceid>
-		// if it is not cached, get the resource info and cache it
-		if parentId == nil {
-			if v, err := a.parentIdCache.Get(key); err != nil {
-				if info == nil {
-					ctx, span := tracer.Start(ctx, "AddActivity.getResource parent")
-					info, err = getResource(ctx, ref)
-					span.End()
-					if err != nil || info.GetParentId() == nil || info.GetParentId().GetOpaqueId() == "" {
-						return fmt.Errorf("could not get parent id: %w", err)
-					}
-				}
-				parentId = info.GetParentId()
-				a.parentIdCache.Set(key, parentId)
-			} else {
-				parentId = v.(*provider.ResourceId)
-			}
-		} else {
-			a.log.Debug().Msg("parent id is cached")
-		}
-
-		depth++
-		ref = &provider.Reference{ResourceId: parentId}
-		parentId = nil // reset parent id so it's not reused in the next iteration
-	}
-
-	return nil
-}
-
-func (a *ActivityLog) StoreActivity(resourceID string, activities []RawActivity) error {
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	ctx, span := tracer.Start(context.Background(), "storeActivity")
-	defer span.End()
-
-	_, subspan := tracer.Start(ctx, "storeActivity.Marshal")
-	b, err := msgpack.Marshal(activities)
-	if err != nil {
-		return err
-	}
-	subspan.End()
-
-	_, subspan = tracer.Start(ctx, "storeActivity.natskv.Put")
-	key := natsKey(resourceID, len(activities))
-	_, err = a.natskv.Put(key, b)
-	if err != nil {
-		return err
-	}
-	subspan.End()
-
-	ctx, subspan = tracer.Start(ctx, "storeActivity.enforceMaxActivities")
-	a.enforceMaxActivities(ctx, resourceID)
-	subspan.End()
-	return nil
-}
-
-func (a *ActivityLog) enforceMaxActivities(ctx context.Context, resourceID string) {
-	if a.maxActivities <= 0 {
-		return
-	}
-
-	key := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
-
-	_, subspan := tracer.Start(ctx, "enforceMaxActivities.watch")
-	watcher, err := a.natskv.Watch(key, nats.IgnoreDeletes())
-	if err != nil {
-		a.log.Error().Err(err).Str("resourceID", resourceID).Msg("could not watch")
-		return
-	}
-	defer watcher.Stop()
-
-	var keys []string
-	for update := range watcher.Updates() {
-		if update == nil {
-			break
-		}
-
-		var batchActivities []RawActivity
-		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
-			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
-		}
-		keys = append(keys, update.Key())
-	}
-	subspan.End()
-
-	_, subspan = tracer.Start(ctx, "enforceMaxActivities.compile")
-	// Parse keys into batches
-	batches := make([]batchInfo, 0)
-	var activitiesCount int
-	for _, k := range keys {
-		parts := strings.SplitN(k, ".", 3)
-		if len(parts) < 3 {
-			a.log.Warn().Str("key", k).Msg("skipping key, not enough parts")
-			continue
-		}
-
-		c, err := strconv.Atoi(parts[1])
-		if err != nil {
-			a.log.Warn().Str("key", k).Msg("skipping key, can not parse count")
-			continue
-		}
-
-		// parse timestamp
-		nano, err := strconv.ParseInt(parts[2], 10, 64)
-		if err != nil {
-			a.log.Warn().Str("key", k).Msg("skipping key, can not parse timestamp")
-			continue
-		}
-
-		batches = append(batches, batchInfo{
-			key:       k,
-			count:     c,
-			timestamp: time.Unix(0, nano),
-		})
-		activitiesCount += c
-	}
-
-	// sort batches by timestamp
-	sort.Slice(batches, func(i, j int) bool {
-		return batches[i].timestamp.Before(batches[j].timestamp)
-	})
-	subspan.End()
-
-	_, subspan = tracer.Start(ctx, "enforceMaxActivities.delete")
-	// remove oldest keys until we are at max activities
-	for _, b := range batches {
-		if activitiesCount-b.count < a.maxActivities {
-			break
-		}
-
-		activitiesCount -= b.count
-		err = a.natskv.Delete(b.key)
-		if err != nil {
-			a.log.Error().Err(err).Str("key", b.key).Msg("could not delete key")
-			break
-		}
-	}
-	subspan.End()
-}
-
-func (a *ActivityLog) InvalidateCachedParentID(purgeId *provider.ResourceId) {
-	// The parent id cache is populated lazily and its entries expire, so a
-	// missing key is the expected case rather than an error.
-	if err := a.parentIdCache.Remove(storagespace.FormatResourceID(purgeId)); err != nil {
-		a.log.Debug().Interface("event", purgeId).Err(err).Msg("could not delete parent id cache")
-	}
-}
-
-func natsKey(resourceID string, activitiesCount int) string {
-	return fmt.Sprintf("%s.%d.%d",
-		base32.StdEncoding.EncodeToString([]byte(resourceID)),
-		activitiesCount,
-		time.Now().UnixNano())
-}
-
-func (a *ActivityLog) Activities(rid *provider.ResourceId) ([]RawActivity, error) {
-	a.lock.RLock()
-	defer a.lock.RUnlock()
-
-	return a.activities(rid)
-}
-
-func (a *ActivityLog) activities(rid *provider.ResourceId) ([]RawActivity, error) {
-	resourceID := storagespace.FormatResourceID(rid)
-
-	glob := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
-
-	watcher, err := a.natskv.Watch(glob, nats.IgnoreDeletes())
-	if err != nil {
-		return nil, err
-	}
-	defer watcher.Stop()
-
-	var activities []RawActivity
-	for update := range watcher.Updates() {
-		if update == nil {
-			break
-		}
-
-		var batchActivities []RawActivity
-		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
-			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack")
-		}
-		activities = append(activities, batchActivities...)
-	}
-
-	return activities, nil
-}
-
-// RemoveActivities removes the activities from the given resource
-func (a *ActivityLog) RemoveActivities(rid *provider.ResourceId, toDelete map[string]struct{}) error {
-	a.lock.Lock()
-	defer a.lock.Unlock()
-
-	curActivities, err := a.activities(rid)
-	if err != nil {
-		return err
-	}
-
-	var acts []RawActivity
-	for _, a := range curActivities {
-		if _, ok := toDelete[a.EventID]; !ok {
-			acts = append(acts, a)
-		}
-	}
-
-	b, err := json.Marshal(acts)
-	if err != nil {
-		return err
-	}
-
-	_, err = a.natskv.Put(storagespace.FormatResourceID(rid), b)
-	return err
-}
@@ -1,13 +0,0 @@
-package activitylog_test
-
-import (
-	"testing"
-
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-)
-
-func TestActivitylog(t *testing.T) {
-	RegisterFailHandler(Fail)
-	RunSpecs(t, "Activitylog Suite")
-}
@@ -1,76 +0,0 @@
-package activitylog
-
-import (
-	"sync"
-	"time"
-)
-
-// Debouncer is used to debounce writes to the activity log store.
-type Debouncer struct {
-	after      time.Duration
-	f          func(id string, ra []RawActivity) error
-	pending    sync.Map
-	inProgress sync.Map
-
-	mutex sync.Mutex
-}
-
-type queueItem struct {
-	activities []RawActivity
-	timer      *time.Timer
-}
-
-// NewDebouncer returns a new Debouncer instance.
-func NewDebouncer(d time.Duration, f func(id string, ra []RawActivity) error) *Debouncer {
-	return &Debouncer{
-		after:      d,
-		f:          f,
-		pending:    sync.Map{},
-		inProgress: sync.Map{},
-	}
-}
-
-// Debounce restarts the debounce timer for the given space.
-func (d *Debouncer) Debounce(id string, ra RawActivity) {
-	if d.after == 0 {
-		d.f(id, []RawActivity{ra})
-		return
-	}
-
-	d.mutex.Lock()
-	defer d.mutex.Unlock()
-
-	item := &queueItem{
-		activities: []RawActivity{ra},
-	}
-
-	if i, ok := d.pending.Load(id); ok {
-		// if the item is already in the queue, append the new activities
-		item, ok = i.(*queueItem)
-		if ok {
-			item.activities = append(item.activities, ra)
-		}
-	}
-
-	if item.timer == nil {
-		item.timer = time.AfterFunc(d.after, func() {
-			if _, ok := d.inProgress.Load(id); ok {
-				// Reschedule this run for when the previous run has finished
-				d.mutex.Lock()
-				if i, ok := d.pending.Load(id); ok {
-					i.(*queueItem).timer.Reset(d.after)
-				}
-
-				d.mutex.Unlock()
-				return
-			}
-
-			d.pending.Delete(id)
-			d.inProgress.Store(id, true)
-			defer d.inProgress.Delete(id)
-			d.f(id, item.activities)
-		})
-	}
-
-	d.pending.Store(id, item)
-}
@@ -1,121 +0,0 @@
-package activitylog_test
-
-import (
-	"sync"
-	"time"
-
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
-)
-
-var _ = Describe("Debouncer", func() {
-	var (
-		mu          sync.Mutex
-		callbacks   []activitylog.RawActivity
-		newCallback func(id string, ra []activitylog.RawActivity) error
-	)
-
-	BeforeEach(func() {
-		mu.Lock()
-		callbacks = nil
-		mu.Unlock()
-		newCallback = func(id string, ra []activitylog.RawActivity) error {
-			mu.Lock()
-			defer mu.Unlock()
-			callbacks = append(callbacks, ra...)
-			return nil
-		}
-	})
-
-	Context("with zero duration", func() {
-		It("calls the callback immediately", func() {
-			d := activitylog.NewDebouncer(0, newCallback)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
-			Expect(callbacks).To(HaveLen(1))
-			Expect(callbacks[0].EventID).To(Equal("activity1"))
-		})
-
-		It("calls the callback immediately for each event", func() {
-			d := activitylog.NewDebouncer(0, newCallback)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
-			d.Debounce("space2", activitylog.RawActivity{EventID: "activity2"})
-			Expect(callbacks).To(HaveLen(2))
-		})
-	})
-
-	Context("with non-zero duration", func() {
-		It("batches activities with the same id", func() {
-			d := activitylog.NewDebouncer(10*time.Millisecond, newCallback)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity3"})
-
-			Eventually(func() int {
-				mu.Lock()
-				defer mu.Unlock()
-				return len(callbacks)
-			}).Should(Equal(3))
-		})
-
-		It("handles different ids independently", func() {
-			d := activitylog.NewDebouncer(10*time.Millisecond, newCallback)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
-			d.Debounce("space2", activitylog.RawActivity{EventID: "activity2"})
-
-			Eventually(func() int {
-				mu.Lock()
-				defer mu.Unlock()
-				return len(callbacks)
-			}).Should(Equal(2))
-		})
-
-		It("batches activities that arrive within the debounce window", func() {
-			d := activitylog.NewDebouncer(100*time.Millisecond, newCallback)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
-			time.Sleep(20 * time.Millisecond)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
-			time.Sleep(20 * time.Millisecond)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity3"})
-
-			Eventually(func() int {
-				mu.Lock()
-				defer mu.Unlock()
-				return len(callbacks)
-			}).Should(Equal(3))
-		})
-
-		It("processes new batch after previous completes", func() {
-			d := activitylog.NewDebouncer(5*time.Millisecond, newCallback)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
-			time.Sleep(20 * time.Millisecond) // let first batch complete
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity2"})
-
-			Eventually(func() int {
-				mu.Lock()
-				defer mu.Unlock()
-				return len(callbacks)
-			}).Should(Equal(2))
-		})
-
-		It("skips duplicate write when timer fires during in-progress callback", func() {
-			slowCallback := func(id string, ra []activitylog.RawActivity) error {
-				time.Sleep(50 * time.Millisecond) // simulate slow write
-				mu.Lock()
-				defer mu.Unlock()
-				callbacks = append(callbacks, ra...)
-				return nil
-			}
-
-			d := activitylog.NewDebouncer(10*time.Millisecond, slowCallback)
-			d.Debounce("space1", activitylog.RawActivity{EventID: "activity1"})
-			time.Sleep(20 * time.Millisecond) // timer fires while callback is running
-
-			Eventually(func() int {
-				mu.Lock()
-				defer mu.Unlock()
-				return len(callbacks)
-			}).Should(Equal(1))
-		})
-	})
-})
@@ -1,35 +0,0 @@
-package activitylog
-
-import (
-	"time"
-
-	"github.com/opencloud-eu/opencloud/pkg/log"
-)
-
-// Option for the activitylog service
-type Option func(*Options)
-
-// Options for the activitylog service
-type Options struct {
-	Logger              log.Logger
-	MaxActivities       int
-	WriteBufferDuration time.Duration
-}
-
-// Logger configures a logger for the activitylog service
-func Logger(log log.Logger) Option {
-	return func(o *Options) {
-		o.Logger = log
-	}
-}
-
-func MaxActivities(max int) Option {
-	return func(o *Options) {
-		o.MaxActivities = max
-	}
-}
-func WriteBufferDuration(d time.Duration) Option {
-	return func(o *Options) {
-		o.WriteBufferDuration = d
-	}
-}
@@ -1,13 +0,0 @@
-package events_test
-
-import (
-	"testing"
-
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-)
-
-func TestEvents(t *testing.T) {
-	RegisterFailHandler(Fail)
-	RunSpecs(t, "Events Suite")
-}
@@ -1,302 +0,0 @@
-package events
-
-import (
-	"context"
-	"fmt"
-	"path/filepath"
-	"sync"
-	"sync/atomic"
-	"time"
-
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	"go.opentelemetry.io/otel"
-	"go.opentelemetry.io/otel/trace"
-)
-
-var tracer trace.Tracer
-
-func init() {
-	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events")
-}
-
-var (
-	_numConsumersDefault = 1
-)
-
-// ActivitylogService logs events per resource
-type ActivitylogService struct {
-	ctx    context.Context
-	sa     config.ServiceAccount
-	log    log.Logger
-	stream events.Stream
-	gws    pool.Selectable[gateway.GatewayAPIClient]
-	al     *activitylog.ActivityLog
-
-	numConsumers int
-
-	events []events.Unmarshaller
-
-	stopCh  chan struct{}
-	stopped *atomic.Bool
-}
-
-// New creates a new ActivitylogService
-func New(al *activitylog.ActivityLog, stream events.Stream, opts ...Option) (*ActivitylogService, error) {
-	o := &Options{
-		NumConsumers: _numConsumersDefault,
-	}
-	for _, opt := range opts {
-		opt(o)
-	}
-
-	s := &ActivitylogService{
-		ctx:          o.Context,
-		log:          o.Logger,
-		sa:           o.ServiceAccount,
-		stream:       stream,
-		gws:          o.GatewaySelector,
-		events:       o.RegisteredEvents,
-		numConsumers: o.NumConsumers,
-		al:           al,
-		stopCh:       make(chan struct{}, 1),
-		stopped:      new(atomic.Bool),
-	}
-
-	return s, nil
-}
-
-// Run to fulfil Runner interface
-func (s *ActivitylogService) Run() error {
-	ch, err := events.Consume(s.stream, "activitylog", s.events...)
-	if err != nil {
-		return err
-	}
-
-	var wg sync.WaitGroup
-	ctx, cancel := context.WithCancel(s.ctx)
-	defer cancel()
-
-	s.log.Debug().Int("worker.count", s.numConsumers).
-		Str("messaging.consumer.group.name", "activitylog").
-		Str("messaging.system", "nats").
-		Str("messaging.operation.name", "receive").
-		Msg("starting event processing workers")
-
-	// start workers
-	for i := 0; i < s.numConsumers; i++ {
-		wg.Add(1)
-		go func(workerID int) {
-			defer wg.Done()
-			for {
-				select {
-				case <-ctx.Done():
-					return
-				case e, ok := <-ch:
-					if !ok {
-						return
-					}
-					if err := s.processEvent(e); err != nil {
-						s.log.Error().Err(err).
-							Int("worker", workerID).
-							Interface("event", e).
-							Msg("failed to process event")
-					}
-				}
-			}
-		}(i)
-	}
-
-	// wait for stop signal
-	<-s.stopCh
-	cancel() // signal workers to stop
-	wg.Wait()
-
-	return nil
-}
-
-// Close will make the service to stop processing, so the `Run`
-// method can finish.
-func (s *ActivitylogService) Close() {
-	if s.stopped.CompareAndSwap(false, true) {
-		close(s.stopCh)
-	}
-}
-
-func (s *ActivitylogService) processEvent(e events.Event) error {
-	ctx := e.GetTraceContext(s.ctx)
-	ctx, span := tracer.Start(ctx, "processEvent")
-	defer span.End()
-
-	s.log.Debug().Interface("event", e).Msg("updating activitylog")
-
-	switch ev := e.Event.(type) {
-	case events.UploadReady:
-		return s.AddActivity(ctx, ev.FileRef, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-	case events.FileTouched:
-		return s.AddActivity(ctx, ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-	// Disabled https://github.com/owncloud/ocis/issues/10293
-	//case events.FileDownloaded:
-	// we are only interested in public link downloads - so no need to store others.
-	//if ev.ImpersonatingUser.GetDisplayName() == "Public" {
-	//	err = a.AddActivity(ev.Ref, e.ID, utils.TSToTime(ev.Timestamp))
-	//}
-	case events.ContainerCreated:
-		return s.AddActivity(ctx, ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
-	case events.ItemTrashed:
-		return s.AddActivityTrashed(ctx, ev.ID, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
-	case events.ItemPurged:
-		return s.al.RemoveResource(ev.ID)
-	case events.ItemMoved:
-		// remove the cached parent id for this resource
-		s.removeCachedParentID(ctx, ev.Ref)
-
-		return s.AddActivity(ctx, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
-	case events.ShareCreated:
-		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
-	case events.ShareUpdated:
-		if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
-			return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
-		}
-	case events.ShareRemoved:
-		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, ev.Timestamp)
-	case events.LinkCreated:
-		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
-	case events.LinkUpdated:
-		if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
-			return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
-		}
-	case events.LinkRemoved:
-		return s.AddActivity(ctx, toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.Timestamp))
-	case events.SpaceShared:
-		return s.AddSpaceActivity(ctx, ev.ID, e.ID, ev.Timestamp)
-	case events.SpaceUnshared:
-		return s.AddSpaceActivity(ctx, ev.ID, e.ID, ev.Timestamp)
-	}
-
-	return nil
-}
-
-// AddActivity adds the activity to the given resource and all its parents
-func (a *ActivitylogService) AddActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
-	ctx, span := tracer.Start(ctx, "AddActivity")
-	defer span.End()
-
-	gwc, err := a.gws.Next()
-	if err != nil {
-		return fmt.Errorf("cant get gateway client: %w", err)
-	}
-
-	ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
-	if err != nil {
-		return fmt.Errorf("cant get service user context: %w", err)
-
-	}
-	return a.al.AddActivity(ctx, initRef, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
-		return utils.GetResource(ctx, ref, gwc)
-	})
-}
-
-// AddActivityTrashed adds the activity to given trashed resource and all its former parents
-func (a *ActivitylogService) AddActivityTrashed(ctx context.Context, resourceID *provider.ResourceId, reference *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
-	ctx, span := tracer.Start(ctx, "AddActivityTrashed")
-	defer span.End()
-
-	gwc, err := a.gws.Next()
-	if err != nil {
-		return fmt.Errorf("cant get gateway client: %w", err)
-	}
-
-	ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
-	if err != nil {
-		return fmt.Errorf("cant get service user context: %w", err)
-	}
-
-	// store activity on trashed item
-	if err := a.al.StoreActivity(storagespace.FormatResourceID(resourceID), []activitylog.RawActivity{
-		{
-			EventID:   eventID,
-			Depth:     0,
-			Timestamp: timestamp,
-		},
-	}); err != nil {
-		return fmt.Errorf("could not store activity: %w", err)
-	}
-
-	// get previous parent
-	ref := &provider.Reference{
-		ResourceId: reference.GetResourceId(),
-		Path:       filepath.Dir(reference.GetPath()),
-	}
-
-	return a.al.AddActivity(ctx, ref, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
-		return utils.GetResource(ctx, ref, gwc)
-	})
-}
-
-// AddSpaceActivity adds the activity to the given spaceroot
-func (a *ActivitylogService) AddSpaceActivity(ctx context.Context, spaceID *provider.StorageSpaceId, eventID string, timestamp time.Time) error {
-	_, span := tracer.Start(ctx, "AddSpaceActivity")
-	defer span.End()
-	// spaceID is in format <providerid>$<spaceid>
-	// activitylog service uses format <providerid>$<spaceid>!<resourceid>
-	// lets do some converting, shall we?
-	rid, err := storagespace.ParseID(spaceID.GetOpaqueId())
-	if err != nil {
-		return fmt.Errorf("could not parse space id: %w", err)
-	}
-	rid.OpaqueId = rid.GetSpaceId()
-	err = a.al.StoreActivity(storagespace.FormatResourceID(&rid), []activitylog.RawActivity{
-		{
-			EventID:   eventID,
-			Depth:     0,
-			Timestamp: timestamp,
-		},
-	})
-	if err != nil {
-		return fmt.Errorf("could not store activity: %w", err)
-	}
-	return nil
-}
-
-func toRef(r *provider.ResourceId) *provider.Reference {
-	return &provider.Reference{
-		ResourceId: r,
-	}
-}
-
-func (a *ActivitylogService) removeCachedParentID(ctx context.Context, ref *provider.Reference) {
-	var span trace.Span
-	ctx, span = tracer.Start(ctx, "removeCachedParentID")
-	defer span.End()
-
-	purgeId := ref.GetResourceId()
-	if ref.GetPath() != "" {
-		gwc, err := a.gws.Next()
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get gateway client")
-			return
-		}
-
-		ctx, err = utils.GetServiceUserContextWithContext(ctx, gwc, a.sa.ServiceAccountID, a.sa.ServiceAccountSecret)
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get service user context")
-			return
-		}
-
-		info, err := utils.GetResource(ctx, ref, gwc)
-		if err != nil {
-			a.log.Error().Err(err).Msg("could not get resource info")
-			return
-		}
-		purgeId = info.GetId()
-	}
-	a.al.InvalidateCachedParentID(purgeId)
-}
@@ -1,123 +0,0 @@
-package events_test
-
-import (
-	"context"
-
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
-	eventssvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/events"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-)
-
-var _ = Describe("ActivitylogService", func() {
-	Describe("New", func() {
-		var (
-			al     *activitylog.ActivityLog
-			stream events.Stream
-		)
-
-		BeforeEach(func() {
-			al = &activitylog.ActivityLog{}
-			stream = nil
-		})
-
-		It("creates a service with minimal options", func() {
-			svc, err := eventssvc.New(al, stream)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with context option", func() {
-			ctx := context.Background()
-			svc, err := eventssvc.New(al, stream, eventssvc.Context(ctx))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with logger option", func() {
-			logger := log.NopLogger()
-			svc, err := eventssvc.New(al, stream, eventssvc.Logger(logger))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with service account option", func() {
-			sa := config.ServiceAccount{
-				ServiceAccountID:     "sa-id",
-				ServiceAccountSecret: "sa-secret",
-			}
-			svc, err := eventssvc.New(al, stream, eventssvc.ServiceAccount(sa))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with registered events", func() {
-			evts := []events.Unmarshaller{&events.UploadReady{}, &events.FileTouched{}}
-			svc, err := eventssvc.New(al, stream, eventssvc.RegisteredEvents(evts))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with gateway selector", func() {
-			var gs pool.Selectable[gateway.GatewayAPIClient]
-			svc, err := eventssvc.New(al, stream, eventssvc.GatewaySelector(gs))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with num consumers option", func() {
-			svc, err := eventssvc.New(al, stream, eventssvc.NumConsumers(5))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with all options", func() {
-			ctx := context.Background()
-			logger := log.NopLogger()
-			sa := config.ServiceAccount{
-				ServiceAccountID:     "sa-id",
-				ServiceAccountSecret: "sa-secret",
-			}
-			evts := []events.Unmarshaller{&events.UploadReady{}, &events.ContainerCreated{}}
-			var gs pool.Selectable[gateway.GatewayAPIClient]
-
-			svc, err := eventssvc.New(
-				al,
-				stream,
-				eventssvc.Context(ctx),
-				eventssvc.Logger(logger),
-				eventssvc.ServiceAccount(sa),
-				eventssvc.RegisteredEvents(evts),
-				eventssvc.GatewaySelector(gs),
-				eventssvc.NumConsumers(3),
-			)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-	})
-
-	Describe("Close", func() {
-		It("can be called without panic on a new service", func() {
-			al := &activitylog.ActivityLog{}
-			svc, err := eventssvc.New(al, nil)
-			Expect(err).ToNot(HaveOccurred())
-
-			Expect(func() { svc.Close() }).ToNot(Panic())
-		})
-
-		It("can be called multiple times without panic", func() {
-			al := &activitylog.ActivityLog{}
-			svc, err := eventssvc.New(al, nil)
-			Expect(err).ToNot(HaveOccurred())
-
-			svc.Close()
-			svc.Close()
-			svc.Close()
-		})
-	})
-})
@@ -1,97 +1,89 @@
-package http
+package service

 import (
-	"context"
+	"embed"
+	"encoding/json"
+	"errors"
+	"net/http"
 	"path/filepath"
-	"reflect"
 	"slices"
 	"strconv"
 	"strings"
 	"time"

-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	"github.com/olekukonko/errors"
+	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"google.golang.org/grpc/metadata"
+
 	libregraph "github.com/opencloud-eu/libre-graph-api-go"
 	"github.com/opencloud-eu/opencloud/pkg/ast"
 	"github.com/opencloud-eu/opencloud/pkg/kql"
 	"github.com/opencloud-eu/opencloud/pkg/l10n"
-	"github.com/opencloud-eu/opencloud/pkg/log"
 	ehmsg "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/messages/eventhistory/v0"
 	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
-	"github.com/opencloud-eu/reva/v2/pkg/utils"
-	"go.opentelemetry.io/otel"
-	"go.opentelemetry.io/otel/trace"
 )

-var tracer trace.Tracer
-
-func init() {
-	tracer = otel.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http")
-}
-
-// New returns a new instance of Service
-func New(al *activitylog.ActivityLog, opts ...Option) (*svc, error) {
-	o := newOptions(opts...)
-
-	registeredEvents := make(map[string]events.Unmarshaller)
-	for _, e := range o.RegisteredEvents {
-		typ := reflect.TypeOf(e)
-		registeredEvents[typ.String()] = e
-	}
-
-	return &svc{
-		log:              o.Logger,
-		evHistory:        o.HistoryClient,
-		al:               al,
-		registeredEvents: registeredEvents,
-		gws:              o.GatewaySelector,
-	}, nil
-}
-
-type svc struct {
-	log              log.Logger
-	evHistory        ehsvc.EventHistoryService
-	gws              pool.Selectable[gateway.GatewayAPIClient]
-	al               *activitylog.ActivityLog
-	registeredEvents map[string]events.Unmarshaller
-}
-
 var (
-	ErrBadRequest = errors.New("bad request")
-	ErrForbidden  = errors.New("forbidden")
+	//go:embed l10n/locale
+	_localeFS embed.FS
+
+	// subfolder where the translation files are stored
+	_localeSubPath = "l10n/locale"
+
+	// domain of the activitylog service (transifex)
+	_domain = "activitylog"
 )

-func (s *svc) GetItemActivities(ctx context.Context, query, loc string, t l10n.Translator) ([]libregraph.Activity, error) {
-	gwc, err := s.gws.Next()
-	if err != nil {
-		return nil, err
+// ServeHTTP implements the http.Handler interface.
+func (s *ActivitylogService) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	s.mux.ServeHTTP(w, r)
+}
+
+// HandleGetItemActivities handles the request to get the activities of an item.
+func (s *ActivitylogService) HandleGetItemActivities(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
+	ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, r.Header.Get(revactx.TokenHeader))
+
+	activeUser, ok := revactx.ContextGetUser(ctx)
+	if !ok {
+		w.WriteHeader(http.StatusUnauthorized)
+		return
 	}

-	rid, limit, rawActivityAccepted, activityAccepted, sort, err := s.getFilters(query)
+	gwc, err := s.gws.Next()
 	if err != nil {
-		s.log.Info().Str("query", query).Err(err).Msg("error getting filters")
-		return nil, ErrBadRequest
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+
+	rid, limit, rawActivityAccepted, activityAccepted, sort, err := s.getFilters(r.URL.Query().Get("kql"))
+	if err != nil {
+		s.log.Info().Str("query", r.URL.Query().Get("kql")).Err(err).Msg("error getting filters")
+		_, _ = w.Write([]byte(err.Error()))
+		w.WriteHeader(http.StatusBadRequest)
+		return
 	}

 	info, err := utils.GetResourceByID(ctx, rid, gwc)
 	if err != nil {
-		return nil, ErrForbidden
+		w.WriteHeader(http.StatusForbidden)
+		return
 	}

 	// you need ListGrants to see activities
 	if !info.GetPermissionSet().GetListGrants() {
-		return nil, ErrForbidden
+		w.WriteHeader(http.StatusForbidden)
+		return
 	}

-	raw, err := s.al.Activities(rid)
+	raw, err := s.Activities(rid)
 	if err != nil {
 		s.log.Error().Err(err).Msg("error getting activities")
-		return nil, err
+		w.WriteHeader(http.StatusInternalServerError)
+		return
 	}

 	ids := make([]string, 0, len(raw))
@@ -104,21 +96,21 @@ func (s *svc) GetItemActivities(ctx context.Context, query, loc string, t l10n.T
 		toDelete[a.EventID] = struct{}{}
 	}

-	evRes, err := s.evHistory.GetEvents(ctx, &ehsvc.GetEventsRequest{Ids: ids})
+	evRes, err := s.evHistory.GetEvents(r.Context(), &ehsvc.GetEventsRequest{Ids: ids})
 	if err != nil {
 		s.log.Error().Err(err).Msg("error getting events")
-		return nil, err
+		w.WriteHeader(http.StatusInternalServerError)
+		return
 	}

 	evs := evRes.GetEvents()
 	sort(evs)

-	// TODO cut the interface here?
-	activities := make([]libregraph.Activity, 0, len(evRes.GetEvents()))
+	resp := GetActivitiesResponse{Activities: make([]libregraph.Activity, 0, len(evRes.GetEvents()))}
 	for _, e := range evs {
 		delete(toDelete, e.GetId())

-		if limit > 0 && limit <= len(activities) {
+		if limit > 0 && limit <= len(resp.Activities) {
 			continue
 		}

@@ -132,6 +124,9 @@ func (s *svc) GetItemActivities(ctx context.Context, query, loc string, t l10n.T
 			vars    map[string]any
 		)

+		loc := l10n.MustGetUserLocale(r.Context(), activeUser.GetId().GetOpaqueId(), r.Header.Get(l10n.HeaderAcceptLanguage), s.valService)
+		t := l10n.NewTranslatorFromCommonConfig(s.cfg.DefaultLanguage, _domain, s.cfg.TranslationPath, _localeFS, _localeSubPath)
+
 		switch ev := s.unwrapEvent(e).(type) {
 		case nil:
 			// error already logged in unwrapEvent
@@ -229,29 +224,35 @@ func (s *svc) GetItemActivities(ctx context.Context, query, loc string, t l10n.T
 			continue
 		}

-		activities = append(activities, NewActivity(t.Translate(message, loc), ts, e.GetId(), vars))
+		resp.Activities = append(resp.Activities, NewActivity(t.Translate(message, loc), ts, e.GetId(), vars))
 	}

 	// delete activities in separate go routine
 	if len(toDelete) > 0 {
 		go func() {
-			err := s.al.RemoveActivities(rid, toDelete)
+			err := s.RemoveActivities(rid, toDelete)
 			if err != nil {
 				s.log.Error().Err(err).Msg("error removing activities")
 			}
 		}()
 	}
-	return activities, nil

-}
-
-func toRef(r *provider.ResourceId) *provider.Reference {
-	return &provider.Reference{
-		ResourceId: r,
+	b, err := json.Marshal(resp)
+	if err != nil {
+		s.log.Error().Err(err).Msg("error marshalling activities")
+		w.WriteHeader(http.StatusInternalServerError)
+		return
 	}
+
+	if _, err := w.Write(b); err != nil {
+		s.log.Error().Err(err).Msg("error writing response")
+		w.WriteHeader(http.StatusInternalServerError)
+		return
+	}
+	w.WriteHeader(http.StatusOK)
 }

-func (s *svc) unwrapEvent(e *ehmsg.Event) any {
+func (s *ActivitylogService) unwrapEvent(e *ehmsg.Event) any {
 	etype, ok := s.registeredEvents[e.GetType()]
 	if !ok {
 		s.log.Error().Str("eventid", e.GetId()).Str("eventtype", e.GetType()).Msg("event not registered")
@@ -267,13 +268,13 @@ func (s *svc) unwrapEvent(e *ehmsg.Event) any {
 	return einterface
 }

-func (s *svc) getFilters(query string) (*provider.ResourceId, int, func(activitylog.RawActivity) bool, func(*ehmsg.Event) bool, func([]*ehmsg.Event), error) {
+func (s *ActivitylogService) getFilters(query string) (*provider.ResourceId, int, func(RawActivity) bool, func(*ehmsg.Event) bool, func([]*ehmsg.Event), error) {
 	qast, err := kql.Builder{}.Build(query)
 	if err != nil {
 		return nil, 0, nil, nil, nil, err
 	}

-	prefilters := make([]func(activitylog.RawActivity) bool, 0)
+	prefilters := make([]func(RawActivity) bool, 0)
 	postfilters := make([]func(*ehmsg.Event) bool, 0)

 	sortby := func(_ []*ehmsg.Event) {}
@@ -298,7 +299,7 @@ func (s *svc) getFilters(query string) (*provider.ResourceId, int, func(activity
 					break
 				}

-				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
+				prefilters = append(prefilters, func(a RawActivity) bool {
 					return a.Depth <= depth
 				})
 			case "limit":
@@ -321,11 +322,11 @@ func (s *svc) getFilters(query string) (*provider.ResourceId, int, func(activity
 		case *ast.DateTimeNode:
 			switch v.Operator.Value {
 			case "<", "<=":
-				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
+				prefilters = append(prefilters, func(a RawActivity) bool {
 					return a.Timestamp.Before(v.Value)
 				})
 			case ">", ">=":
-				prefilters = append(prefilters, func(a activitylog.RawActivity) bool {
+				prefilters = append(prefilters, func(a RawActivity) bool {
 					return a.Timestamp.After(v.Value)
 				})
 			}
@@ -344,7 +345,7 @@ func (s *svc) getFilters(query string) (*provider.ResourceId, int, func(activity
 		// space root requested - fix format
 		rid.OpaqueId = rid.GetSpaceId()
 	}
-	pref := func(a activitylog.RawActivity) bool {
+	pref := func(a RawActivity) bool {
 		for _, f := range prefilters {
 			if !f(a) {
 				return false
@@ -1,13 +0,0 @@
-package http_test
-
-import (
-	"testing"
-
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-)
-
-func TestHTTP(t *testing.T) {
-	RegisterFailHandler(Fail)
-	RunSpecs(t, "HTTP Suite")
-}
@@ -1,59 +0,0 @@
-package http
-
-import (
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-)
-
-// Option defines a single option function.
-type Option func(o *Options)
-
-// Options defines the available options for this package.
-type Options struct {
-	Logger           log.Logger
-	RegisteredEvents []events.Unmarshaller
-	GatewaySelector  pool.Selectable[gateway.GatewayAPIClient]
-	HistoryClient    ehsvc.EventHistoryService
-}
-
-// newOptions initializes the available default options.
-func newOptions(opts ...Option) Options {
-	opt := Options{}
-
-	for _, o := range opts {
-		o(&opt)
-	}
-
-	return opt
-}
-
-// Logger provides a function to set the logger option.
-func Logger(val log.Logger) Option {
-	return func(o *Options) {
-		o.Logger = val
-	}
-}
-
-// RegisteredEvents registers the events the service should listen to
-func RegisteredEvents(e []events.Unmarshaller) Option {
-	return func(o *Options) {
-		o.RegisteredEvents = e
-	}
-}
-
-// GatewaySelector adds a grpc client selector for the gateway service
-func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient]) Option {
-	return func(o *Options) {
-		o.GatewaySelector = gatewaySelector
-	}
-}
-
-// HistoryClient adds a grpc client for the eventhistory service
-func HistoryClient(hc ehsvc.EventHistoryService) Option {
-	return func(o *Options) {
-		o.HistoryClient = hc
-	}
-}
@@ -1,150 +0,0 @@
-package http_test
-
-import (
-	"context"
-	"time"
-
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
-	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-	"github.com/opencloud-eu/opencloud/pkg/l10n"
-	httpsvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
-)
-
-var _ = Describe("Response", func() {
-	Describe("NewActivity", func() {
-		It("creates an activity with the given parameters", func() {
-			ts := time.Date(2024, 1, 15, 10, 30, 0, 0, time.UTC)
-			vars := map[string]any{
-				"user":     "testuser",
-				"resource": "testfile.txt",
-			}
-
-			act := httpsvc.NewActivity("Test message", ts, "event-123", vars)
-
-			Expect(act.Id).To(Equal("event-123"))
-			Expect(act.Times.RecordedTime).To(Equal(ts))
-			Expect(act.Template.Message).To(Equal("Test message"))
-			Expect(act.Template.Variables).To(HaveKeyWithValue("user", "testuser"))
-			Expect(act.Template.Variables).To(HaveKeyWithValue("resource", "testfile.txt"))
-		})
-
-		It("handles empty variables map", func() {
-			act := httpsvc.NewActivity("", time.Time{}, "", map[string]any{})
-
-			Expect(act.Id).To(BeEmpty())
-			Expect(act.Times.RecordedTime).To(Equal(time.Time{}))
-			Expect(act.Template.Message).To(BeEmpty())
-			Expect(act.Template.Variables).To(BeEmpty())
-		})
-	})
-
-	Describe("WithOldResource", func() {
-		It("sets the oldResource variable from reference path", func() {
-			ref := &provider.Reference{
-				Path: "/old/path/oldname.txt",
-			}
-			vars := make(map[string]any)
-
-			opt := httpsvc.WithOldResource(ref)
-			err := opt(context.Background(), nil, vars)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(vars).To(HaveKey("oldResource"))
-		})
-	})
-
-	Describe("WithUser", func() {
-		It("returns error when no user is provided", func() {
-			opt := httpsvc.WithUser(nil, nil, nil)
-			err := opt(context.Background(), nil, make(map[string]any))
-			Expect(err).To(HaveOccurred())
-			Expect(err.Error()).To(ContainSubstring("no user provided"))
-		})
-
-		It("uses impersonator when provided", func() {
-			impersonator := &user.User{
-				Id: &user.UserId{
-					OpaqueId: "imp-user-id",
-				},
-				DisplayName: "Impersonated User",
-			}
-			vars := make(map[string]any)
-
-			opt := httpsvc.WithUser(nil, nil, impersonator)
-			err := opt(context.Background(), nil, vars)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(vars).To(HaveKey("user"))
-		})
-
-		It("uses executing user when no impersonator", func() {
-			execUser := &user.User{
-				Id: &user.UserId{
-					OpaqueId: "exec-user-id",
-				},
-				DisplayName: "Executing User",
-			}
-			vars := make(map[string]any)
-
-			opt := httpsvc.WithUser(nil, execUser, nil)
-			err := opt(context.Background(), nil, vars)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(vars).To(HaveKey("user"))
-		})
-	})
-
-	Describe("WithVar", func() {
-		It("sets a simple key-value variable", func() {
-			vars := make(map[string]any)
-
-			opt := httpsvc.WithVar("token", "id123", "My Token")
-			err := opt(context.Background(), nil, vars)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(vars).To(HaveKey("token"))
-		})
-	})
-
-	Describe("WithTranslation", func() {
-		It("sets translated field variable", func() {
-			var t l10n.Translator
-			vars := make(map[string]any)
-
-			opt := httpsvc.WithTranslation(&t, "en", "field", []string{"permission"})
-			err := opt(context.Background(), nil, vars)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(vars).To(HaveKey("field"))
-		})
-
-		It("handles empty values slice", func() {
-			var t l10n.Translator
-			vars := make(map[string]any)
-
-			opt := httpsvc.WithTranslation(&t, "en", "field", []string{})
-			err := opt(context.Background(), nil, vars)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(vars).To(HaveKey("field"))
-		})
-	})
-
-	Describe("ActivityOption type", func() {
-		It("allows composing multiple options", func() {
-			vars := make(map[string]any)
-			ctx := context.Background()
-			var gwc gateway.GatewayAPIClient
-
-			options := []httpsvc.ActivityOption{
-				httpsvc.WithVar("key1", "id1", "name1"),
-				httpsvc.WithVar("key2", "id2", "name2"),
-			}
-
-			for _, opt := range options {
-				err := opt(ctx, gwc, vars)
-				Expect(err).ToNot(HaveOccurred())
-			}
-
-			Expect(vars).To(HaveKey("key1"))
-			Expect(vars).To(HaveKey("key2"))
-		})
-	})
-})
@@ -1,76 +0,0 @@
-package http_test
-
-import (
-	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
-	. "github.com/onsi/ginkgo/v2"
-	. "github.com/onsi/gomega"
-	"github.com/opencloud-eu/opencloud/pkg/log"
-	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
-	httpsvc "github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/http"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
-)
-
-var _ = Describe("Service", func() {
-	Describe("New", func() {
-		var (
-			al *activitylog.ActivityLog
-		)
-
-		BeforeEach(func() {
-			al = &activitylog.ActivityLog{}
-		})
-
-		It("creates a service with default options", func() {
-			svc, err := httpsvc.New(al)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with logger option", func() {
-			logger := log.NopLogger()
-			svc, err := httpsvc.New(al, httpsvc.Logger(logger))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with registered events", func() {
-			evts := []events.Unmarshaller{&events.UploadReady{}}
-			svc, err := httpsvc.New(al, httpsvc.RegisteredEvents(evts))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with gateway selector", func() {
-			var gs pool.Selectable[gateway.GatewayAPIClient]
-			svc, err := httpsvc.New(al, httpsvc.GatewaySelector(gs))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with history client", func() {
-			var hc ehsvc.EventHistoryService
-			svc, err := httpsvc.New(al, httpsvc.HistoryClient(hc))
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-
-		It("creates a service with all options", func() {
-			logger := log.NopLogger()
-			evts := []events.Unmarshaller{&events.UploadReady{}, &events.FileTouched{}}
-			var gs pool.Selectable[gateway.GatewayAPIClient]
-			var hc ehsvc.EventHistoryService
-
-			svc, err := httpsvc.New(
-				al,
-				httpsvc.Logger(logger),
-				httpsvc.RegisteredEvents(evts),
-				httpsvc.GatewaySelector(gs),
-				httpsvc.HistoryClient(hc),
-			)
-			Expect(err).ToNot(HaveOccurred())
-			Expect(svc).ToNot(BeNil())
-		})
-	})
-})
@@ -1,102 +0,0 @@
-# SOME DESCRIPTIVE TITLE.
-# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
-# This file is distributed under the same license as the PACKAGE package.
-# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
-# 
-# Translators:
-# Roy-Magne Mo, 2026
-# 
-#, fuzzy
-msgid ""
-msgstr ""
-"Project-Id-Version: \n"
-"Report-Msgid-Bugs-To: EMAIL\n"
-"POT-Creation-Date: 2026-09-06 23:15+0000\n"
-"PO-Revision-Date: 2025-01-27 10:17+0000\n"
-"Last-Translator: Roy-Magne Mo, 2026\n"
-"Language-Team: Norwegian (https://app.transifex.com/opencloud-eu/teams/204053/no/)\n"
-"MIME-Version: 1.0\n"
-"Content-Type: text/plain; charset=UTF-8\n"
-"Content-Transfer-Encoding: 8bit\n"
-"Language: no\n"
-"Plural-Forms: nplurals=2; plural=(n != 1);\n"
-
-#: pkg/service/response.go:44
-msgid "description"
-msgstr "beskrivelse"
-
-#: pkg/service/response.go:43
-msgid "display name"
-msgstr "visningsnavn"
-
-#: pkg/service/response.go:42
-msgid "expiration date"
-msgstr "utløpsdato"
-
-#: pkg/service/response.go:41
-msgid "password"
-msgstr "passord"
-
-#: pkg/service/response.go:40
-msgid "permission"
-msgstr "tillatelse"
-
-#: pkg/service/response.go:39
-msgid "some field"
-msgstr "et felt"
-
-#: pkg/service/response.go:26
-msgid "{resource} was downloaded via public link {token}"
-msgstr "{resource} ble lastet ned via offentlig lenke {token}"
-
-#: pkg/service/response.go:24
-msgid "{user} added {resource} to {folder}"
-msgstr "{user} la til {resource} i {folder}"
-
-#: pkg/service/response.go:36
-msgid "{user} added {sharee} as member of {space}"
-msgstr "{user} la til {sharee} som medlem av {space}"
-
-#: pkg/service/response.go:27
-msgid "{user} deleted {resource} from {folder}"
-msgstr "{user} slettet {resource} fra {folder}"
-
-#: pkg/service/response.go:28
-msgid "{user} moved {resource} to {folder}"
-msgstr "{user} flyttet {resource} til {folder}"
-
-#: pkg/service/response.go:35
-msgid "{user} removed link to {resource}"
-msgstr "{user} fjernet lenke til {resource}"
-
-#: pkg/service/response.go:32
-msgid "{user} removed {sharee} from {resource}"
-msgstr "{user} fjernet {sharee} fra {resource}"
-
-#: pkg/service/response.go:37
-msgid "{user} removed {sharee} from {space}"
-msgstr "{user} fjernet {sharee} fra {space}"
-
-#: pkg/service/response.go:29
-msgid "{user} renamed {oldResource} to {resource}"
-msgstr "{user} ga nytt navn til {oldResource} som {resource}"
-
-#: pkg/service/response.go:33
-msgid "{user} shared {resource} via link"
-msgstr "{user} delte {resource} via lenke"
-
-#: pkg/service/response.go:30
-msgid "{user} shared {resource} with {sharee}"
-msgstr "{user} delte {resource} med {sharee}"
-
-#: pkg/service/response.go:34
-msgid "{user} updated {field} for a link {token} on {resource}"
-msgstr "{user} oppdaterte {field} for en lenke {token} på {resource}"
-
-#: pkg/service/response.go:31
-msgid "{user} updated {field} for the {resource}"
-msgstr "{user} oppdaterte {field} for {resource}"
-
-#: pkg/service/response.go:25
-msgid "{user} updated {resource} in {folder}"
-msgstr "{user} oppdaterte {resource} i {folder}"
@@ -1,4 +1,4 @@
-package activitylog
+package service

 import (
 	"context"
@@ -15,7 +15,7 @@ const currentMigrationVersion = "1"

 // RunMigrations checks the activitylog data version and runs migrations if necessary.
 // It should be called during service startup, after the NATS KeyValue store is initialized.
-func (a *ActivityLog) runMigrations(ctx context.Context, kv nats.KeyValue) error {
+func (a *ActivitylogService) runMigrations(ctx context.Context, kv nats.KeyValue) error {
 	entry, err := kv.Get(activitylogVersionKey)
 	if err == nats.ErrKeyNotFound {
 		a.log.Info().Msg("activitylog version key not found. Running migration to V1...")
@@ -40,7 +40,7 @@ func (a *ActivityLog) runMigrations(ctx context.Context, kv nats.KeyValue) error
 // For each such key, it creates a new key in the format "originalKey.count.timestamp"
 // and stores the original list of strings (re-marshalled to messagepack) as its value.
 // Finally, it sets the activitylog.version key to "1".
-func (a *ActivityLog) migrateToV1(_ context.Context, kv nats.KeyValue) error {
+func (a *ActivitylogService) migrateToV1(_ context.Context, kv nats.KeyValue) error {
 	lister, err := kv.ListKeys()
 	if err != nil {
 		return fmt.Errorf("migrateToV1: failed to list keys from NATS KV store: %w", err)
@@ -1,14 +1,17 @@
-package events
+package service

 import (
-	"context"
 	"time"

 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	"github.com/go-chi/chi/v5"
 	"github.com/opencloud-eu/opencloud/pkg/log"
+	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
+	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
 	"github.com/opencloud-eu/reva/v2/pkg/events"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"go.opentelemetry.io/otel/trace"
 )

 // Option for the activitylog service
@@ -16,20 +19,17 @@ type Option func(*Options)

 // Options for the activitylog service
 type Options struct {
-	Context             context.Context
 	Logger              log.Logger
-	ServiceAccount      config.ServiceAccount
+	Config              *config.Config
+	TraceProvider       trace.TracerProvider
 	Stream              events.Stream
 	RegisteredEvents    []events.Unmarshaller
 	GatewaySelector     pool.Selectable[gateway.GatewayAPIClient]
+	Mux                 *chi.Mux
+	HistoryClient       ehsvc.EventHistoryService
+	ValueClient         settingssvc.ValueService
 	WriteBufferDuration time.Duration
-	NumConsumers        int
-}
-
-func Context(ctx context.Context) Option {
-	return func(o *Options) {
-		o.Context = ctx
-	}
+	MaxActivities       int
 }

 // Logger configures a logger for the activitylog service
@@ -39,10 +39,17 @@ func Logger(log log.Logger) Option {
 	}
 }

-// ServiceAccount configures a service account for the activitylog service
-func ServiceAccount(sa config.ServiceAccount) Option {
+// Config adds the config for the activitylog service
+func Config(c *config.Config) Option {
 	return func(o *Options) {
-		o.ServiceAccount = sa
+		o.Config = c
+	}
+}
+
+// TraceProvider adds a tracer provider for the activitylog service
+func TraceProvider(tp trace.TracerProvider) Option {
+	return func(o *Options) {
+		o.TraceProvider = tp
 	}
 }

@@ -67,8 +74,23 @@ func GatewaySelector(gatewaySelector pool.Selectable[gateway.GatewayAPIClient])
 	}
 }

-func NumConsumers(num int) Option {
+// Mux defines the muxer for the service
+func Mux(m *chi.Mux) Option {
 	return func(o *Options) {
-		o.NumConsumers = num
+		o.Mux = m
+	}
+}
+
+// HistoryClient adds a grpc client for the eventhistory service
+func HistoryClient(hc ehsvc.EventHistoryService) Option {
+	return func(o *Options) {
+		o.HistoryClient = hc
+	}
+}
+
+// ValueClient adds a grpc client for the value service
+func ValueClient(vs settingssvc.ValueService) Option {
+	return func(o *Options) {
+		o.ValueClient = vs
 	}
 }
@@ -1,4 +1,4 @@
-package http
+package service

 import (
 	"context"
@@ -44,6 +44,11 @@ var (
 	StrDescription    = l10n.Template("description")
 )

+// GetActivitiesResponse is the response on GET activities requests
+type GetActivitiesResponse struct {
+	Activities []libregraph.Activity `json:"value"`
+}
+
 // Resource represents an item such as a file or folder
 type Resource struct {
 	ID   string `json:"id"`
@@ -306,7 +311,7 @@ func NewActivity(message string, ts time.Time, eventID string, vars map[string]a
 }

 // GetVars calls other service to gather the required data for the activity variables
-func (s *svc) GetVars(ctx context.Context, opts ...ActivityOption) (map[string]any, error) {
+func (s *ActivitylogService) GetVars(ctx context.Context, opts ...ActivityOption) (map[string]any, error) {
 	gwc, err := s.gws.Next()
 	if err != nil {
 		return nil, err
@@ -322,12 +327,6 @@ func (s *svc) GetVars(ctx context.Context, opts ...ActivityOption) (map[string]a
 	return vars, nil
 }

-func toSpace(r *provider.Reference) *provider.StorageSpaceId {
-	return &provider.StorageSpaceId{
-		OpaqueId: storagespace.FormatStorageID(r.GetResourceId().GetStorageId(), r.GetResourceId().GetSpaceId()),
-	}
-}
-
 func getFolderName(ctx context.Context, gwc gateway.GatewayAPIClient, ref *provider.Reference) string {
 	n := filepath.Base(filepath.Dir(ref.GetPath()))
 	if n == "." || n == "/" {
@@ -0,0 +1,676 @@
+package service
+
+import (
+	"context"
+	"crypto/tls"
+	"encoding/base32"
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"reflect"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/go-chi/chi/v5"
+	"github.com/jellydator/ttlcache/v2"
+	"github.com/nats-io/nats.go"
+	"github.com/opencloud-eu/reva/v2/pkg/events"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	"github.com/pkg/errors"
+	"github.com/vmihailenco/msgpack/v5"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/opencloud-eu/opencloud/pkg/log"
+	ehsvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/eventhistory/v0"
+	settingssvc "github.com/opencloud-eu/opencloud/protogen/gen/opencloud/services/settings/v0"
+	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
+)
+
+// Nats runs into max payload exceeded errors at around 7k activities. Let's keep a buffer.
+var _maxActivitiesDefault = 6000
+
+// RawActivity represents an activity as it is stored in the activitylog store
+type RawActivity struct {
+	EventID   string    `json:"event_id"`
+	Depth     int       `json:"depth"`
+	Timestamp time.Time `json:"timestamp"`
+}
+
+// ActivitylogService logs events per resource
+type ActivitylogService struct {
+	cfg           *config.Config
+	log           log.Logger
+	events        <-chan events.Event
+	gws           pool.Selectable[gateway.GatewayAPIClient]
+	mux           *chi.Mux
+	evHistory     ehsvc.EventHistoryService
+	valService    settingssvc.ValueService
+	lock          sync.RWMutex
+	tp            trace.TracerProvider
+	tracer        trace.Tracer
+	debouncer     *Debouncer
+	parentIdCache *ttlcache.Cache
+	natskv        nats.KeyValue
+
+	maxActivities int
+
+	registeredEvents map[string]events.Unmarshaller
+}
+
+type Debouncer struct {
+	after      time.Duration
+	f          func(id string, ra []RawActivity) error
+	pending    sync.Map
+	inProgress sync.Map
+
+	mutex sync.Mutex
+}
+
+type queueItem struct {
+	activities []RawActivity
+	timer      *time.Timer
+}
+
+type batchInfo struct {
+	key       string
+	count     int
+	timestamp time.Time
+}
+
+// NewDebouncer returns a new Debouncer instance
+func NewDebouncer(d time.Duration, f func(id string, ra []RawActivity) error) *Debouncer {
+	return &Debouncer{
+		after:      d,
+		f:          f,
+		pending:    sync.Map{},
+		inProgress: sync.Map{},
+	}
+}
+
+// Debounce restarts the debounce timer for the given space
+func (d *Debouncer) Debounce(id string, ra RawActivity) {
+	if d.after == 0 {
+		d.f(id, []RawActivity{ra})
+		return
+	}
+
+	d.mutex.Lock()
+	defer d.mutex.Unlock()
+
+	activities := []RawActivity{ra}
+	item := &queueItem{
+		activities: activities,
+	}
+	if i, ok := d.pending.Load(id); ok {
+		// if the item is already in the queue, append the new activities
+		item, ok = i.(*queueItem)
+		if ok {
+			item.activities = append(item.activities, ra)
+		}
+	}
+
+	if item.timer == nil {
+		item.timer = time.AfterFunc(d.after, func() {
+			if _, ok := d.inProgress.Load(id); ok {
+				// Reschedule this run for when the previous run has finished
+				d.mutex.Lock()
+				if i, ok := d.pending.Load(id); ok {
+					i.(*queueItem).timer.Reset(d.after)
+				}
+
+				d.mutex.Unlock()
+				return
+			}
+
+			d.pending.Delete(id)
+			d.inProgress.Store(id, true)
+			defer d.inProgress.Delete(id)
+			d.f(id, item.activities)
+		})
+	}
+
+	d.pending.Store(id, item)
+}
+
+// New creates a new ActivitylogService
+func New(opts ...Option) (*ActivitylogService, error) {
+	o := &Options{
+		MaxActivities: _maxActivitiesDefault,
+	}
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	if o.Stream == nil {
+		return nil, errors.New("stream is required")
+	}
+
+	ch, err := events.Consume(o.Stream, o.Config.Service.Name, o.RegisteredEvents...)
+	if err != nil {
+		return nil, err
+	}
+
+	cache := ttlcache.NewCache()
+	err = cache.SetTTL(30 * time.Second)
+	if err != nil {
+		return nil, err
+	}
+
+	// Connect to NATS servers
+	natsOptions := nats.Options{
+		Servers: o.Config.Store.Nodes,
+	}
+	if o.Config.Store.EnableTLS {
+		if o.Config.Store.TLSRootCACertificate != "" {
+			// when root ca is configured use it. an insecure flag is ignored.
+			nats.RootCAs(o.Config.Store.TLSRootCACertificate)(&natsOptions)
+		} else {
+			// enable tls and use insecure flag
+			nats.Secure(&tls.Config{MinVersion: tls.VersionTLS12, InsecureSkipVerify: o.Config.Store.TLSInsecure})(&natsOptions)
+		}
+	}
+	if o.Config.Store.AuthUsername != "" && o.Config.Store.AuthPassword != "" {
+		nats.UserInfo(o.Config.Store.AuthUsername, o.Config.Store.AuthPassword)(&natsOptions)
+	}
+	conn, err := natsOptions.Connect()
+	if err != nil {
+		return nil, err
+	}
+
+	js, err := conn.JetStream()
+	if err != nil {
+		return nil, err
+	}
+
+	kv, err := js.KeyValue(o.Config.Store.Database)
+	if err != nil {
+		if !errors.Is(err, nats.ErrBucketNotFound) {
+			return nil, errors.Wrapf(err, "Failed to get bucket (%s)", o.Config.Store.Database)
+		}
+
+		kv, err = js.CreateKeyValue(&nats.KeyValueConfig{
+			Bucket: o.Config.Store.Database,
+		})
+		if err != nil {
+			return nil, errors.Wrapf(err, "Failed to create bucket (%s)", o.Config.Store.Database)
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	s := &ActivitylogService{
+		log:              o.Logger,
+		cfg:              o.Config,
+		events:           ch,
+		gws:              o.GatewaySelector,
+		mux:              o.Mux,
+		evHistory:        o.HistoryClient,
+		valService:       o.ValueClient,
+		lock:             sync.RWMutex{},
+		registeredEvents: make(map[string]events.Unmarshaller),
+		tp:               o.TraceProvider,
+		tracer:           o.TraceProvider.Tracer("github.com/opencloud-eu/opencloud/services/activitylog/pkg/service"),
+		parentIdCache:    cache,
+		maxActivities:    o.Config.MaxActivities,
+		natskv:           kv,
+	}
+	s.debouncer = NewDebouncer(o.Config.WriteBufferDuration, s.storeActivity)
+
+	// run migrations
+	err = s.runMigrations(context.Background(), kv)
+	if err != nil {
+		return nil, err
+	}
+
+	s.mux.Get("/graph/v1beta1/extensions/org.libregraph/activities", s.HandleGetItemActivities)
+
+	for _, e := range o.RegisteredEvents {
+		typ := reflect.TypeOf(e)
+		s.registeredEvents[typ.String()] = e
+	}
+
+	go s.Run()
+
+	return s, nil
+}
+
+// Run runs the service
+func (a *ActivitylogService) Run() {
+	for e := range a.events {
+		var err error
+		switch ev := e.Event.(type) {
+		case events.UploadReady:
+			err = a.AddActivity(ev.FileRef, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+		case events.FileTouched:
+			err = a.AddActivity(ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+		// Disabled https://github.com/owncloud/ocis/issues/10293
+		//case events.FileDownloaded:
+		// we are only interested in public link downloads - so no need to store others.
+		//if ev.ImpersonatingUser.GetDisplayName() == "Public" {
+		//	err = a.AddActivity(ev.Ref, e.ID, utils.TSToTime(ev.Timestamp))
+		//}
+		case events.ContainerCreated:
+			err = a.AddActivity(ev.Ref, ev.ParentID, e.ID, utils.TSToTime(ev.Timestamp))
+		case events.ItemTrashed:
+			err = a.AddActivityTrashed(ev.ID, ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
+		case events.ItemPurged:
+			err = a.RemoveResource(ev.ID)
+		case events.ItemMoved:
+			// remove the cached parent id for this resource
+			a.removeCachedParentID(ev.Ref)
+
+			err = a.AddActivity(ev.Ref, nil, e.ID, utils.TSToTime(ev.Timestamp))
+		case events.ShareCreated:
+			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
+		case events.ShareUpdated:
+			if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
+				err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
+			}
+		case events.ShareRemoved:
+			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, ev.Timestamp)
+		case events.LinkCreated:
+			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.CTime))
+		case events.LinkUpdated:
+			if ev.Sharer != nil && ev.ItemID != nil && ev.Sharer.GetOpaqueId() != ev.ItemID.GetSpaceId() {
+				err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.MTime))
+			}
+		case events.LinkRemoved:
+			err = a.AddActivity(toRef(ev.ItemID), nil, e.ID, utils.TSToTime(ev.Timestamp))
+		case events.SpaceShared:
+			err = a.AddSpaceActivity(ev.ID, e.ID, ev.Timestamp)
+		case events.SpaceUnshared:
+			err = a.AddSpaceActivity(ev.ID, e.ID, ev.Timestamp)
+		}
+
+		if err != nil {
+			a.log.Error().Err(err).Interface("event", e).Msg("could not process event")
+		}
+	}
+}
+
+// AddActivity adds the activity to the given resource and all its parents
+func (a *ActivitylogService) AddActivity(initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
+	gwc, err := a.gws.Next()
+	if err != nil {
+		return fmt.Errorf("cant get gateway client: %w", err)
+	}
+
+	ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
+	if err != nil {
+		return fmt.Errorf("cant get service user context: %w", err)
+	}
+	var span trace.Span
+	ctx, span = a.tracer.Start(ctx, "AddActivity")
+	defer span.End()
+
+	return a.addActivity(ctx, initRef, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
+		return utils.GetResource(ctx, ref, gwc)
+	})
+}
+
+// AddActivityTrashed adds the activity to given trashed resource and all its former parents
+func (a *ActivitylogService) AddActivityTrashed(resourceID *provider.ResourceId, reference *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time) error {
+	gwc, err := a.gws.Next()
+	if err != nil {
+		return fmt.Errorf("cant get gateway client: %w", err)
+	}
+
+	ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
+	if err != nil {
+		return fmt.Errorf("cant get service user context: %w", err)
+	}
+
+	// store activity on trashed item
+	if err := a.storeActivity(storagespace.FormatResourceID(resourceID), []RawActivity{
+		{
+			EventID:   eventID,
+			Depth:     0,
+			Timestamp: timestamp,
+		},
+	}); err != nil {
+		return fmt.Errorf("could not store activity: %w", err)
+	}
+
+	// get previous parent
+	ref := &provider.Reference{
+		ResourceId: reference.GetResourceId(),
+		Path:       filepath.Dir(reference.GetPath()),
+	}
+
+	var span trace.Span
+	ctx, span = a.tracer.Start(ctx, "AddActivityTrashed")
+	defer span.End()
+
+	return a.addActivity(ctx, ref, parentId, eventID, timestamp, func(ctx context.Context, ref *provider.Reference) (*provider.ResourceInfo, error) {
+		return utils.GetResource(ctx, ref, gwc)
+	})
+}
+
+// AddSpaceActivity adds the activity to the given spaceroot
+func (a *ActivitylogService) AddSpaceActivity(spaceID *provider.StorageSpaceId, eventID string, timestamp time.Time) error {
+	// spaceID is in format <providerid>$<spaceid>
+	// activitylog service uses format <providerid>$<spaceid>!<resourceid>
+	// lets do some converting, shall we?
+	rid, err := storagespace.ParseID(spaceID.GetOpaqueId())
+	if err != nil {
+		return fmt.Errorf("could not parse space id: %w", err)
+	}
+	rid.OpaqueId = rid.GetSpaceId()
+	return a.storeActivity(storagespace.FormatResourceID(&rid), []RawActivity{
+		{
+			EventID:   eventID,
+			Depth:     0,
+			Timestamp: timestamp,
+		},
+	})
+
+}
+
+// Activities returns the activities for the given resource
+func (a *ActivitylogService) Activities(rid *provider.ResourceId) ([]RawActivity, error) {
+	a.lock.RLock()
+	defer a.lock.RUnlock()
+
+	return a.activities(rid)
+}
+
+// RemoveActivities removes the activities from the given resource
+func (a *ActivitylogService) RemoveActivities(rid *provider.ResourceId, toDelete map[string]struct{}) error {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	curActivities, err := a.activities(rid)
+	if err != nil {
+		return err
+	}
+
+	var acts []RawActivity
+	for _, a := range curActivities {
+		if _, ok := toDelete[a.EventID]; !ok {
+			acts = append(acts, a)
+		}
+	}
+
+	b, err := json.Marshal(acts)
+	if err != nil {
+		return err
+	}
+
+	_, err = a.natskv.Put(storagespace.FormatResourceID(rid), b)
+	return err
+}
+
+// RemoveResource removes the resource from the store
+func (a *ActivitylogService) RemoveResource(rid *provider.ResourceId) error {
+	if rid == nil {
+		return fmt.Errorf("resource id is required")
+	}
+
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	return a.natskv.Delete(storagespace.FormatResourceID(rid))
+}
+
+func (a *ActivitylogService) activities(rid *provider.ResourceId) ([]RawActivity, error) {
+	resourceID := storagespace.FormatResourceID(rid)
+
+	glob := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
+
+	watcher, err := a.natskv.Watch(glob, nats.IgnoreDeletes())
+	if err != nil {
+		return nil, err
+	}
+	defer watcher.Stop()
+
+	var activities []RawActivity
+	for update := range watcher.Updates() {
+		if update == nil {
+			break
+		}
+
+		var batchActivities []RawActivity
+		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
+			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
+		}
+		activities = append(activities, batchActivities...)
+	}
+
+	return activities, nil
+}
+
+// note: getResource is abstracted to allow unit testing, in general this will just be utils.GetResource
+func (a *ActivitylogService) addActivity(ctx context.Context, initRef *provider.Reference, parentId *provider.ResourceId, eventID string, timestamp time.Time, getResource func(context.Context, *provider.Reference) (*provider.ResourceInfo, error)) error {
+	var (
+		err   error
+		depth int
+		ref   = initRef
+	)
+	ctx, span := a.tracer.Start(ctx, "addActivity")
+	defer span.End()
+	for {
+		var info *provider.ResourceInfo
+		id := ref.GetResourceId()
+		if ref.Path != "" {
+			// Path based reference, we need to resolve the resource id
+			ctx, span = a.tracer.Start(ctx, "addActivity.getResource")
+			info, err = getResource(ctx, ref)
+			span.End()
+			if err != nil {
+				return fmt.Errorf("could not get resource info: %w", err)
+			}
+			id = info.GetId()
+		}
+		if id == nil {
+			return fmt.Errorf("resource id is required")
+		}
+
+		key := storagespace.FormatResourceID(id)
+		a.debouncer.Debounce(key, RawActivity{
+			EventID:   eventID,
+			Depth:     depth,
+			Timestamp: timestamp,
+		})
+
+		if id.OpaqueId == id.SpaceId {
+			// we are at the root of the space, no need to go further
+			break
+		}
+
+		// check if parent id is cached
+		// parent id is cached in the format <storageid>$<spaceid>!<resourceid>
+		// if it is not cached, get the resource info and cache it
+		if parentId == nil {
+			if v, err := a.parentIdCache.Get(key); err != nil {
+				if info == nil {
+					ctx, span := a.tracer.Start(ctx, "addActivity.getResource parent")
+					info, err = getResource(ctx, ref)
+					span.End()
+					if err != nil || info.GetParentId() == nil || info.GetParentId().GetOpaqueId() == "" {
+						return fmt.Errorf("could not get parent id: %w", err)
+					}
+				}
+				parentId = info.GetParentId()
+				a.parentIdCache.Set(key, parentId)
+			} else {
+				parentId = v.(*provider.ResourceId)
+			}
+		} else {
+			a.log.Debug().Msg("parent id is cached")
+		}
+
+		depth++
+		ref = &provider.Reference{ResourceId: parentId}
+		parentId = nil // reset parent id so it's not reused in the next iteration
+	}
+
+	return nil
+}
+
+func (a *ActivitylogService) storeActivity(resourceID string, activities []RawActivity) error {
+	a.lock.Lock()
+	defer a.lock.Unlock()
+
+	ctx, span := a.tracer.Start(context.Background(), "storeActivity")
+	defer span.End()
+
+	_, subspan := a.tracer.Start(ctx, "storeActivity.Marshal")
+	b, err := msgpack.Marshal(activities)
+	if err != nil {
+		return err
+	}
+	subspan.End()
+
+	_, subspan = a.tracer.Start(ctx, "storeActivity.natskv.Put")
+	key := natsKey(resourceID, len(activities))
+	_, err = a.natskv.Put(key, b)
+	if err != nil {
+		return err
+	}
+	subspan.End()
+
+	ctx, subspan = a.tracer.Start(ctx, "storeActivity.enforceMaxActivities")
+	a.enforceMaxActivities(ctx, resourceID)
+	subspan.End()
+	return nil
+}
+
+func (a *ActivitylogService) enforceMaxActivities(ctx context.Context, resourceID string) {
+	if a.maxActivities <= 0 {
+		return
+	}
+
+	key := fmt.Sprintf("%s.>", base32.StdEncoding.EncodeToString([]byte(resourceID)))
+
+	_, subspan := a.tracer.Start(ctx, "enforceMaxActivities.watch")
+	watcher, err := a.natskv.Watch(key, nats.IgnoreDeletes())
+	if err != nil {
+		a.log.Error().Err(err).Str("resourceID", resourceID).Msg("could not watch")
+		return
+	}
+	defer watcher.Stop()
+
+	var keys []string
+	for update := range watcher.Updates() {
+		if update == nil {
+			break
+		}
+
+		var batchActivities []RawActivity
+		if err := msgpack.Unmarshal(update.Value(), &batchActivities); err != nil {
+			a.log.Debug().Err(err).Str("resourceID", resourceID).Msg("could not unmarshal messagepack, trying json")
+		}
+		keys = append(keys, update.Key())
+	}
+	subspan.End()
+
+	_, subspan = a.tracer.Start(ctx, "enforceMaxActivities.compile")
+	// Parse keys into batches
+	batches := make([]batchInfo, 0)
+	var activitiesCount int
+	for _, k := range keys {
+		parts := strings.SplitN(k, ".", 3)
+		if len(parts) < 3 {
+			a.log.Warn().Str("key", k).Msg("skipping key, not enough parts")
+			continue
+		}
+
+		c, err := strconv.Atoi(parts[1])
+		if err != nil {
+			a.log.Warn().Str("key", k).Msg("skipping key, can not parse count")
+			continue
+		}
+
+		// parse timestamp
+		nano, err := strconv.ParseInt(parts[2], 10, 64)
+		if err != nil {
+			a.log.Warn().Str("key", k).Msg("skipping key, can not parse timestamp")
+			continue
+		}
+
+		batches = append(batches, batchInfo{
+			key:       k,
+			count:     c,
+			timestamp: time.Unix(0, nano),
+		})
+		activitiesCount += c
+	}
+
+	// sort batches by timestamp
+	sort.Slice(batches, func(i, j int) bool {
+		return batches[i].timestamp.Before(batches[j].timestamp)
+	})
+	subspan.End()
+
+	_, subspan = a.tracer.Start(ctx, "enforceMaxActivities.delete")
+	// remove oldest keys until we are at max activities
+	for _, b := range batches {
+		if activitiesCount-b.count < a.maxActivities {
+			break
+		}
+
+		activitiesCount -= b.count
+		err = a.natskv.Delete(b.key)
+		if err != nil {
+			a.log.Error().Err(err).Str("key", b.key).Msg("could not delete key")
+			break
+		}
+	}
+	subspan.End()
+}
+
+func toRef(r *provider.ResourceId) *provider.Reference {
+	return &provider.Reference{
+		ResourceId: r,
+	}
+}
+
+func toSpace(r *provider.Reference) *provider.StorageSpaceId {
+	return &provider.StorageSpaceId{
+		OpaqueId: storagespace.FormatStorageID(r.GetResourceId().GetStorageId(), r.GetResourceId().GetSpaceId()),
+	}
+}
+
+func (a *ActivitylogService) removeCachedParentID(ref *provider.Reference) {
+	purgeId := ref.GetResourceId()
+	if ref.GetPath() != "" {
+		gwc, err := a.gws.Next()
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get gateway client")
+			return
+		}
+
+		ctx, err := utils.GetServiceUserContext(a.cfg.ServiceAccount.ServiceAccountID, gwc, a.cfg.ServiceAccount.ServiceAccountSecret)
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get service user context")
+			return
+		}
+
+		info, err := utils.GetResource(ctx, ref, gwc)
+		if err != nil {
+			a.log.Error().Err(err).Msg("could not get resource info")
+			return
+		}
+		purgeId = info.GetId()
+	}
+	// The parent id cache is populated lazily and its entries expire, so a
+	// missing key is the expected case rather than an error.
+	if err := a.parentIdCache.Remove(storagespace.FormatResourceID(purgeId)); err != nil {
+		a.log.Debug().Interface("event", ref).Err(err).Msg("could not delete parent id cache")
+	}
+}
+
+func natsKey(resourceID string, activitiesCount int) string {
+	return fmt.Sprintf("%s.%d.%d",
+		base32.StdEncoding.EncodeToString([]byte(resourceID)),
+		activitiesCount,
+		time.Now().UnixNano())
+}
@@ -1,4 +1,4 @@
-package mapping
+package service_test

 import (
 	"testing"
@@ -7,7 +7,7 @@ import (
 	. "github.com/onsi/gomega"
 )

-func TestMapping(t *testing.T) {
+func TestService(t *testing.T) {
 	RegisterFailHandler(Fail)
-	RunSpecs(t, "Mapping Suite")
+	RunSpecs(t, "Service Suite")
 }
@@ -1,6 +1,7 @@
-package activitylog_test
+package service

 import (
+	"bytes"
 	"context"
 	"net"
 	"os"
@@ -8,13 +9,17 @@ import (
 	"time"

 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 	nserver "github.com/nats-io/nats-server/v2/server"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/command"
+	"github.com/opencloud-eu/opencloud/pkg/log"
 	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/config"
-	"github.com/opencloud-eu/opencloud/services/activitylog/pkg/service/activitylog"
+	eventsmocks "github.com/opencloud-eu/reva/v2/pkg/events/mocks"
+	"github.com/opencloud-eu/reva/v2/pkg/storagespace"
+	"github.com/test-go/testify/mock"
+	"go.opentelemetry.io/otel/trace/noop"
 )

 var (
@@ -63,25 +68,31 @@ var _ = SynchronizedAfterSuite(func() {

 var _ = Describe("ActivitylogService", func() {
 	var (
-		alog                *activitylog.ActivityLog
+		alog                *ActivitylogService
 		getResource         func(_ context.Context, ref *provider.Reference) (*provider.ResourceInfo, error)
 		writebufferduration = 100 * time.Millisecond
 	)

 	JustBeforeEach(func() {
 		var err error
-		db := "activitylog-test-" + uuid.New().String()
-
-		kv, err := command.ConnectNatsKV(config.Store{
-			Nodes:    []string{server.Addr().String()},
-			Database: db,
-		})
-		Expect(err).ToNot(HaveOccurred())
-
-		alog, err = activitylog.New(
-			kv,
-			activitylog.MaxActivities(4),
-			activitylog.WriteBufferDuration(writebufferduration),
+		stream := &eventsmocks.Stream{}
+		stream.EXPECT().Consume(mock.Anything, mock.Anything).Return(nil, nil)
+		alog, err = New(
+			Config(&config.Config{
+				Service: config.Service{
+					Name: "activitylog-test",
+				},
+				Store: config.Store{
+					Store:    "nats-js-kv",
+					Nodes:    []string{server.Addr().String()},
+					Database: "activitylog-test-" + uuid.New().String(),
+				},
+				MaxActivities:       4,
+				WriteBufferDuration: writebufferduration,
+			}),
+			Stream(stream),
+			TraceProvider(noop.NewTracerProvider()),
+			Mux(chi.NewMux()),
 		)
 		Expect(err).ToNot(HaveOccurred())
 	})
@@ -96,7 +107,7 @@ var _ = Describe("ActivitylogService", func() {
 				Name       string
 				Tree       map[string]*provider.ResourceInfo
 				Activities map[string]string
-				Expected   map[string][]activitylog.RawActivity
+				Expected   map[string][]RawActivity
 			}

 			testCases := []testCase{
@@ -110,7 +121,7 @@ var _ = Describe("ActivitylogService", func() {
 					Activities: map[string]string{
 						"activity": "base",
 					},
-					Expected: map[string][]activitylog.RawActivity{
+					Expected: map[string][]RawActivity{
 						"base":    activitites("activity", 0),
 						"parent":  activitites("activity", 1),
 						"spaceid": activitites("activity", 2),
@@ -127,7 +138,7 @@ var _ = Describe("ActivitylogService", func() {
 						"activity1": "base",
 						"activity2": "base",
 					},
-					Expected: map[string][]activitylog.RawActivity{
+					Expected: map[string][]RawActivity{
 						"base":    activitites("activity1", 0, "activity2", 0),
 						"parent":  activitites("activity1", 1, "activity2", 1),
 						"spaceid": activitites("activity1", 2, "activity2", 2),
@@ -144,7 +155,7 @@ var _ = Describe("ActivitylogService", func() {
 						}

 						for k, v := range tc.Activities {
-							err := alog.AddActivity(context.Background(), reference(v), nil, k, time.Time{}, getResource)
+							err := alog.addActivity(context.Background(), reference(v), nil, k, time.Time{}, getResource)
 							Expect(err).NotTo(HaveOccurred())
 						}
 					})
@@ -183,9 +194,9 @@ var _ = Describe("ActivitylogService", func() {

 			It("debounces activities", func() {

-				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())

 				Eventually(func(g Gomega) {
@@ -196,7 +207,7 @@ var _ = Describe("ActivitylogService", func() {
 			})

 			It("adheres to the MaxActivities setting", func() {
-				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 				Eventually(func(g Gomega) {
 					activities, err := alog.Activities(resourceID("base"))
@@ -204,7 +215,7 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(len(activities)).To(Equal(1))
 				}).Should(Succeed())

-				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
 				Eventually(func(g Gomega) {
 					activities, err := alog.Activities(resourceID("base"))
@@ -212,11 +223,11 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(len(activities)).To(Equal(2))
 				}).Should(Succeed())

-				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
+				err = alog.addActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
+				err = alog.addActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity5", time.Time{}, getResource)
+				err = alog.addActivity(context.Background(), reference("base"), nil, "activity5", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())

 				Eventually(func(g Gomega) {
@@ -233,9 +244,9 @@ var _ = Describe("ActivitylogService", func() {
 					return tree[ref.GetResourceId().GetOpaqueId()], nil
 				}

-				err := alog.AddActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
+				err := alog.addActivity(context.Background(), reference("base"), nil, "activity1", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
+				err = alog.addActivity(context.Background(), reference("base"), nil, "activity2", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())

 				Eventually(func(g Gomega) {
@@ -244,9 +255,9 @@ var _ = Describe("ActivitylogService", func() {
 					g.Expect(activities).To(ConsistOf(activitites("activity1", 0, "activity2", 0)))
 				}).Should(Succeed())

-				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
+				err = alog.addActivity(context.Background(), reference("base"), nil, "activity3", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())
-				err = alog.AddActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
+				err = alog.addActivity(context.Background(), reference("base"), nil, "activity4", time.Time{}, getResource)
 				Expect(err).NotTo(HaveOccurred())

 				Eventually(func(g Gomega) {
@@ -257,11 +268,47 @@ var _ = Describe("ActivitylogService", func() {
 			})
 		})
 	})
+
+	Describe("removeCachedParentID", func() {
+		var logBuffer *bytes.Buffer
+
+		newLoggerAtLevel := func(level string) log.Logger {
+			logBuffer = &bytes.Buffer{}
+			return log.Logger{Logger: log.NewLogger(log.Level(level)).Output(logBuffer)}
+		}
+
+		It("does not log an error when the entry was never cached", func() {
+			alog.log = newLoggerAtLevel("error")
+
+			alog.removeCachedParentID(reference("never-cached"))
+
+			Expect(logBuffer.String()).To(BeEmpty())
+		})
+
+		It("logs a missing entry at debug level", func() {
+			alog.log = newLoggerAtLevel("debug")
+
+			alog.removeCachedParentID(reference("never-cached"))
+
+			Expect(logBuffer.String()).To(ContainSubstring("could not delete parent id cache"))
+			Expect(logBuffer.String()).To(ContainSubstring(`"level":"debug"`))
+		})
+
+		It("does not log at all when the entry was cached", func() {
+			alog.log = newLoggerAtLevel("debug")
+			ref := reference("cached")
+			Expect(alog.parentIdCache.Set(storagespace.FormatResourceID(ref.GetResourceId()), resourceID("parent"))).To(Succeed())
+
+			alog.removeCachedParentID(ref)
+
+			Expect(logBuffer.String()).To(BeEmpty())
+		})
+	})
 })

-func activitites(acts ...any) []activitylog.RawActivity {
-	var activities []activitylog.RawActivity
-	act := activitylog.RawActivity{}
+func activitites(acts ...any) []RawActivity {
+	var activities []RawActivity
+	act := RawActivity{}
 	for _, a := range acts {
 		switch v := a.(type) {
 		case string:
@@ -148,7 +148,6 @@ func DefaultConfig() *config.Config {
 		Groupware: config.Groupware{
 			Enabled: false,
 		},
-		ConfigurableNotifications: true,
 	}
 }

@@ -13,8 +13,7 @@ include ../../.make/release.mk
 include ../../.make/docs.mk

 .PHONY: go-generate
-go-generate: $(MOCKERY) $(GOWRAP)
-	GOWRAP=$(GOWRAP) go generate ./...
+go-generate: $(MOCKERY)
 	$(MOCKERY)

 .PHONY: l10n-pull
@@ -168,7 +168,7 @@ The output of this command includes the following information for each role:
 * `Condition`
 * `Allowed resource actions`

-**Example output (shortened)**
+**Example output (shortned)**

 ```bash
 +--------------------------------------+----------+--------------------------------+--------------------------------+------------------------------------------+
@@ -184,95 +184,3 @@ The output of this command includes the following information for each role:
 +--------------------------------------+----------+--------------------------------+--------------------------------+------------------------------------------+
 ```

-## API Handlers
-
-To specialize `graph` service instances in order to scale them independently, it is possible to disable its API handlers:
-
-* `GRAPH_HTTP_DISABLE`: when set to `true`, the service does not listen on HTTP and only consumes events (defaults to `false`)
-* `GRAPH_EVENTS_DISABLE_CONSUMER`: when set to `true`, the service does not consome events and only listens on HTTP (defaults to `false`)
-
-## Metrics
-
-Metrics are disabled by default, and must be enabled using the following environment variables:
-
-* `GRAPH_LDAP_METRICS_DISABLE`: set to `false` to enable metrics for the duration of outbound LDAP client operations (defaults to `true`)
-* `GRAPH_HTTP_METRICS_DISABLE`: set to `false` to enable metrics for the duration of inbound Graph HTTP API requests (defaults to `true`)
-* `GRAPH_IDENTITY_BACKEND_METRICS_DISABLE`: set to `false` to enable metrics for the duration of Graph identity backend operations (defaults to `true`)
-
-The `graph` service provides the following metrics:
-
-| Name | Description |
-| ---- | ----------- |
-| `opencloud_graph_build_info{version=...}` | Contains a label `version` that is set to the current version of the service, and always has a value of `1` |
-| `opencloud_graph_events_enabled` | Is set to `1` if the Events API handler is enabled, or `0` if not |
-| `opencloud_graph_http_enabled` | Is set to `1` if the HTTP API handler is enabled, or `0` if not |
-| `opencloud_graph_events{event=...,result=...}` | Counts the number of events that have been consumed, with a `event` label that contains the name of the event, and a `result` label that is set to `success` or `failure` |
-| `opencloud_graph_events_invalid` | Counts the number of invalid events that are malformed or are missing required data |
-| `opencloud_graph_events_unsupported` | Counts the numbef of consumed events that cannot be processes by this service, should always be `0` |
-| `opencloud_graph_user_password_changes{result=...,reason=...}` | Counts the number of user password change attempts, including the reason for failure when `result`=`failure` |
-| `opencloud_graph_http_request_duration_seconds{method=...,path=...,version=...,resource=...,code=...,result=...}` | Histogram that measures the duration of Graph HTTP API requests, in buckets |
-| `opencloud_graph_http_requests` | Gauge that counts the number of concurrent inbound HTTP requests to the Graph API |
-| `opencloud_graph_ldap_client_operation_duration_seconds{uri=...,write=...,operation=...,result=...}` | Histogram that measures the duration of outbound LDAP operations |
-| `opencloud_graph_ldap_client_operations{uri=...,write=...}` | Gauge that counts the number of concurrent outbound LDAP operations |
-| `opencloud_graph_identity_backend_api_duration_seconds{type=...,operation=...,result=...}` | Histogram that measures the duration of requests to the Graph identity backend, in buckets |
-
-To create some moderate load on a running `opencloud` instance, one can use the k6 script `load_test.js` as follows:
-
-```bash
-k6 run --vus=10 --duration=3m ./load_test.js
-```
-
-The following environment variables can be used to influence its behavior:
-
- * `BASE_URL`: defaults to `https://localhost:9200`
- * `USERNAME`: defaults to `alan`
- * `PASSWORD`: defaults to `demo`
-
-For example, to use a different user and a different URL:
-
-```bash
-k6 run --vus=10 --duration=3m -e USERNAME=lynn -e BASE_URL=https://localhost:9201 ./load_test.js
-```
-
-It is not meant to be a feature test suite, but merely a small k6 script to generate some read-only load in order to make Grafana displays.
-
-### Graph User Password Change Counter Metric
-
-For `opencloud_graph_user_password_changes`:
-
-* `result` is either
-  * `success`: when the password was changed successfully
-  * `failure`: when the password could not be changed, the reason being tracked in the `reason` label
-* `reason` is either
-  * empty when `result` is `success`
-  * `invalid`: when parameters were invalid, such as the new password being an empty password
-  * `error`: when an error prevented the password change, such as a network failure
-  * `wrong-password`: when the password change was refused because the current password is wrong
-
-### Graph Inbound HTTP Request Duration Metrics
-
-For `opencloud_graph_http_request_duration_seconds`:
-
-* `method` is the HTTP method (`GET`, `PUT`, ...)
-* `path` is the canonical request path with placeholders (e.g. `/v1beta1/drives/{driveID}/root/children`)
-* `version` is the Graph API version (`v1beta` or `v1.0`)
-* `resource` is the top-level resource after the version (`me`, `application`, `drives`, ...)
-* `code` is the resulting HTTP status code (`200`, `404`, `500`, ...)
-* `result` is one of `success`, `client-error`, `server-error`
-
-### Graph Outbound LDAP Operation Duration Metrics
-
-For `opencloud_graph_ldap_client_operation_duration_seconds`:
-
-* `operation` is the name of the LDAP operation (`add`, `delete`, `modify`, `modify-dn`, ...)
-* `result` is either `success`, `failure`, `read-only` (when attempting a write operation on a LDAP server that is configured as read-only in OpenCloud) or `not-found`
-* `uri` contains the LDAP server URI the client is connected to
-* `write` is set to `1` if the LDAP client is allowed to perform write operations, or to `0` if it is configured to be read-only
-
-### Graph Identity Backend API Duration Metrics
-
-* `type` is the type of the identity backend that is being used (`ldap` or `cs3`)
-* `operation` is the name of the API operation (`create-user`, `get-users`, ...)
-* `result` is `success`, `failure` or `not-found`
-
-
@@ -1,80 +0,0 @@
-// Small k6 script to generate some load on read-only endpoints of
-// the Graph API, for showcasing the metrics.
-
-import http from 'k6/http';
-import { check, sleep } from 'k6';
-import encoding from 'k6/encoding';
-
-// Configuration via environment variables with defaults
-const BASE_URL = __ENV.BASE_URL || 'https://localhost:9200';
-const USERNAME = __ENV.USERNAME || 'alan';
-const PASSWORD = __ENV.PASSWORD || 'demo';
-
-export const options = {
-  insecureSkipTLSVerify: true,
-  vus: 10,
-  thresholds: {
-    http_req_failed: ['rate<0.01'],
-    http_req_duration: ['p(95)<500'],
-  },
-};
-
-const credentials = `${USERNAME}:${PASSWORD}`;
-const encodedCredentials = encoding.b64encode(credentials);
-
-const params = {
-  headers: {
-    'Authorization': `Basic ${encodedCredentials}`,
-    'Accept': 'application/json',
-  },
-};
-
-export default function () {
-  // Fetch current user profile, including the list of groups the user is part of
-  let resMe = http.get(`${BASE_URL}/graph/v1.0/me?$expand=memberOf`, params);
-  const meOk = check(resMe, { 'GET /me status is 200': (r) => r.status === 200 });
-  sleep(0.1);
-  // extract the names of the groups the user is part of, because the user is allowed
-  // to retrieve information about those
-  let groupNames = [];
-  if (meOk && resMe.json() && resMe.json().memberOf) {
-    groupNames = (resMe.json().memberOf || []).map((group) => group.displayName);
-  }
-
-  // Fetch oneself using the users search API:
-  let resUsers = http.get(`${BASE_URL}/graph/v1.0/users?$search="${USERNAME}"`, params);
-  check(resUsers, { 'GET /users status is 200': (r) => r.status === 200 });
-  sleep(0.1);
-
-  // Fetch storage drives
-  let resDrives = http.get(`${BASE_URL}/graph/v1.0/drives`, params);
-  const drivesOk = check(resDrives, {
-    'GET /drives status is 200': (r) => r.status === 200,
-  });
-  sleep(0.1);
-
-  // For each of those drives, retrieve deeper information about each
-  if (drivesOk && resDrives.json() && resDrives.json().value) {
-    const drives = resDrives.json().value;
-
-    if (drives.length > 0) {
-      const driveId = drives[0].id;
-      let resDrive = http.get(`${BASE_URL}/graph/v1.0/drives/${driveId}`, params);
-
-      check(resDrive, {
-        'GET /drives/{id} status is 200': (r) => r.status === 200,
-      });
-    }
-  }
-
-  // For each of the groups the user is part of, retrieve information about each of them
-  // using the group searching endpoint
-  for (const group of groupNames) {
-    let resGroups = http.get(`${BASE_URL}/graph/v1.0/groups?$search="${group}"`, params);
-    const groupsOk = check(resGroups, {
-      'GET /groups status is 200': (r) => r.status === 200,
-    });
-  }
-
-  sleep(0.2);
-}
@@ -7,22 +7,16 @@ import (
 	"strings"

 	"github.com/opencloud-eu/opencloud/pkg/config/configlog"
-	"github.com/opencloud-eu/opencloud/pkg/generators"
 	"github.com/opencloud-eu/opencloud/pkg/log"
 	natspkg "github.com/opencloud-eu/opencloud/pkg/nats"
 	"github.com/opencloud-eu/opencloud/pkg/runner"
 	"github.com/opencloud-eu/opencloud/pkg/tracing"
+	"github.com/opencloud-eu/opencloud/pkg/version"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/config/parser"
-	"github.com/opencloud-eu/opencloud/services/graph/pkg/identity"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/metrics"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/server/debug"
 	"github.com/opencloud-eu/opencloud/services/graph/pkg/server/http"
-	evc "github.com/opencloud-eu/opencloud/services/graph/pkg/service/events"
-	svc "github.com/opencloud-eu/opencloud/services/graph/pkg/service/v0"
-	"github.com/opencloud-eu/reva/v2/pkg/events"
-	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
-	"github.com/prometheus/client_golang/prometheus"

 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
@@ -52,17 +46,8 @@ func Server(cfg *config.Config) *cobra.Command {
 			}
 			ctx := cfg.Context

-			prom := prometheus.DefaultRegisterer
-
-			// note that the function we pass here is tasked with decomposing Graph HTTP API
-			// request URL patterns into information that is then used for labels in metrics
-			// to track HTTP request processing durations, and it is located there to be close
-			// to the HTTP API route definitions, to improve chances of adapting it accordingly
-			// whenever those routes should change in the future
-			mtrcs, err := metrics.New(prom, &logger, svc.DecomposeGraphApiRequestPattern)
-			if err != nil {
-				return err
-			}
+			mtrcs := metrics.New()
+			mtrcs.BuildInfo.WithLabelValues(version.GetString()).Set(1)

 			var kv jetstream.KeyValue
 			// Allow to run without a NATS store (e.g. for the standalone Education provisioning service)
@@ -93,45 +78,9 @@ func Server(cfg *config.Config) *cobra.Command {
 				}
 			}

-			identityBackendName := cfg.Identity.Backend // contains the name of the backend implementation to use
-
-			// since the identity backend in use is of prime importance to understand issues through logs, every
-			// log entry should contain a 'backend' entry with the name of the backend in use from here on:
-			logger = log.Logger{Logger: logger.With().Str("backend", identityBackendName).Logger()}
-
-			identityBackend, eduBackend, err := identity.CreateIdentityBackends(
-				identityBackendName,
-				cfg,
-				&logger,
-				prom,
-				traceProvider,
-			)
-
-			if err != nil {
-				logger.Error().Err(err).Msg("Error initializing the identity backend")
-				return fmt.Errorf("could not initialize identity backend: %w", err)
-			}
-
-			var eventsStream events.Stream
-			if cfg.Events.Endpoint != "" {
-				var err error
-				connName := generators.GenerateConnectionName(cfg.Service.Name, generators.NTypeBus)
-				eventsStream, err = stream.NatsFromConfig(connName, false, cfg.Events.ToNatsConfig())
-				if err != nil {
-					logger.Error().Err(err).Msg("Error initializing events publisher")
-					return fmt.Errorf("could not initialize events publisher: %w", err)
-				}
-			}
-
 			gr := runner.NewGroup()
-
-			if !cfg.HTTP.Disabled {
-				mtrcs.HttpEnabled.Set(1)
-
+			{
 				server, err := http.Server(
-					identityBackend,
-					eduBackend,
-					eventsStream,
 					http.Logger(logger),
 					http.Context(ctx),
 					http.Config(cfg),
@@ -143,37 +92,8 @@ func Server(cfg *config.Config) *cobra.Command {
 					logger.Error().Err(err).Str("transport", "http").Msg("Failed to initialize server")
 					return err
 				}
+
 				gr.Add(runner.NewGoMicroHttpServerRunner(cfg.Service.Name+".http", server))
-			} else {
-				mtrcs.HttpEnabled.Set(0)
-				logger.Info().Str("transport", "http").Msg("HTTP server is disabled")
-			}
-
-			if !cfg.Events.DisabledConsumer {
-				mtrcs.EventsEnabled.Set(1)
-
-				// even if events are enabled, we still need to differentiate between whether this process
-				// show be consuming events or not (and even when that is disabled, we still need to be
-				// able to produce events), which is why this is a separate setting;
-				// for context, see https://github.com/opencloud-eu/opencloud/issues/1312
-
-				logger := &log.Logger{Logger: logger.With().Str("transport", "events").Logger()}
-				eventConsumer, err := evc.NewService(cfg.Context, eventsStream, identityBackend, mtrcs, logger)
-				if err != nil {
-					return fmt.Errorf("could not initialize events consumer: %w", err)
-				}
-
-				gr.Add(runner.New(cfg.Service.Name+".svc", func() error {
-					return eventConsumer.Start()
-				}, func() {
-					err := eventConsumer.Close()
-					if err != nil {
-						logger.Error().Err(err).Msg("failed to stop event consumer")
-					}
-				}))
-			} else {
-				mtrcs.EventsEnabled.Set(0)
-				logger.Info().Str("transport", "events").Msg("event consumer is disabled")
 			}

 			{
@@ -5,7 +5,6 @@ import (
 	"time"

 	"github.com/opencloud-eu/opencloud/pkg/shared"
-	"github.com/opencloud-eu/reva/v2/pkg/events/stream"
 )

 // Config combines all available configuration parts.
@@ -60,10 +59,6 @@ type Spaces struct {
 	TranslationPath                 string `yaml:"translation_path" env:"OC_TRANSLATION_PATH;GRAPH_TRANSLATION_PATH" desc:"(optional) Set this to a path with custom translations to overwrite the builtin translations. Note that file and folder naming rules apply, see the documentation for more details." introductionVersion:"1.0.0"`
 }

-type LDAPMetrics struct {
-	Disabled bool `yaml:"disabled" env:"GRAPH_LDAP_METRICS_DISABLE" desc:"Disables the metrics for outbound LDAP operations." introductionVersion:"%%NEXT%%"`
-}
-
 type LDAP struct {
 	URI                string `yaml:"uri" env:"OC_LDAP_URI;GRAPH_LDAP_URI" desc:"URI of the LDAP Server to connect to. Supported URI schemes are 'ldaps://' and 'ldap://'" introductionVersion:"1.0.0"`
 	CACert             string `yaml:"cacert" env:"OC_LDAP_CACERT;GRAPH_LDAP_CACERT" desc:"Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the LDAP service. If not defined, the root directory derives from $OC_BASE_DATA_PATH/idm." introductionVersion:"1.0.0"`
@@ -101,8 +96,6 @@ type LDAP struct {

 	EducationResourcesEnabled bool `yaml:"education_resources_enabled" env:"GRAPH_LDAP_EDUCATION_RESOURCES_ENABLED" desc:"Enable LDAP support for managing education related resources." introductionVersion:"1.0.0"`
 	EducationConfig           LDAPEducationConfig
-
-	Metrics LDAPMetrics `yaml:"metrics"`
 }

 // LDAPEducationConfig represents the LDAP configuration for education related resources
@@ -120,14 +113,9 @@ type LDAPEducationConfig struct {
 	SchoolTerminationGraceDays int `yaml:"school_termination_min_grace_days" env:"GRAPH_LDAP_SCHOOL_TERMINATION_MIN_GRACE_DAYS" desc:"When setting a 'terminationDate' for a school, require the date to be at least this number of days in the future." introductionVersion:"1.0.0"`
 }

-type IdentityMetrics struct {
-	Disabled bool `yaml:"disabled" env:"GRAPH_IDENTITY_BACKEND_METRICS_DISABLE" desc:"Disables the metrics for inbound identity backend operations." introductionVersion:"%%NEXT%%"`
-}
-
 type Identity struct {
-	Backend string          `yaml:"backend" env:"GRAPH_IDENTITY_BACKEND" desc:"The user identity backend to use. Supported backend types are 'ldap' and 'cs3'." introductionVersion:"1.0.0"`
-	LDAP    LDAP            `yaml:"ldap"`
-	Metrics IdentityMetrics `yaml:"metrics"`
+	Backend string `yaml:"backend" env:"GRAPH_IDENTITY_BACKEND" desc:"The user identity backend to use. Supported backend types are 'ldap' and 'cs3'." introductionVersion:"1.0.0"`
+	LDAP    LDAP   `yaml:"ldap"`
 }

 // API represents API configuration parameters.
@@ -141,7 +129,6 @@ type API struct {

 // Events combines the configuration options for the event bus.
 type Events struct {
-	DisabledConsumer     bool   `yaml:"disabled_consumer" env:"GRAPH_EVENTS_DISABLE_CONSUMER" desc:"Disables consuming events. Set this to true if the service should only handle HTTP requests." introductionVersion:"%%NEXT%%"`
 	Endpoint             string `yaml:"endpoint" env:"OC_EVENTS_ENDPOINT;GRAPH_EVENTS_ENDPOINT" desc:"The address of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture. Set to a empty string to disable emitting events." introductionVersion:"1.0.0"`
 	Cluster              string `yaml:"cluster" env:"OC_EVENTS_CLUSTER;GRAPH_EVENTS_CLUSTER" desc:"The clusterID of the event system. The event system is the message queuing service. It is used as message broker for the microservice architecture." introductionVersion:"1.0.0"`
 	TLSInsecure          bool   `yaml:"tls_insecure" env:"OC_INSECURE;OC_EVENTS_TLS_INSECURE;GRAPH_EVENTS_TLS_INSECURE" desc:"Whether to verify the server TLS certificates." introductionVersion:"1.0.0"`
@@ -151,18 +138,6 @@ type Events struct {
 	AuthPassword         string `yaml:"password" env:"OC_EVENTS_AUTH_PASSWORD;GRAPH_EVENTS_AUTH_PASSWORD" desc:"The password to authenticate with the events broker. The events broker is the OpenCloud service which receives and delivers events between the services." introductionVersion:"1.0.0"`
 }

-func (e Events) ToNatsConfig() stream.NatsConfig {
-	return stream.NatsConfig{
-		Endpoint:             e.Endpoint,
-		Cluster:              e.Cluster,
-		TLSInsecure:          e.TLSInsecure,
-		TLSRootCACertificate: e.TLSRootCACertificate,
-		EnableTLS:            e.EnableTLS,
-		AuthUsername:         e.AuthUsername,
-		AuthPassword:         e.AuthPassword,
-	}
-}
-
 // CORS defines the available cors configuration.
 type CORS struct {
 	AllowedOrigins   []string `yaml:"allow_origins" env:"OC_CORS_ALLOW_ORIGINS;GRAPH_CORS_ALLOW_ORIGINS" desc:"A list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin. See the Environment Variable Types description for more details." introductionVersion:"1.0.0"`
@@ -43,7 +43,6 @@ func DefaultConfig() *config.Config {
 			Token: "",
 		},
 		HTTP: config.HTTP{
-			Disabled:  false,
 			Addr:      "127.0.0.1:9120",
 			Namespace: "eu.opencloud.web",
 			Root:      "/graph",
@@ -53,11 +52,6 @@ func DefaultConfig() *config.Config {
 				AllowedHeaders:   []string{"Authorization", "Origin", "Content-Type", "Accept", "X-Requested-With", "X-Request-Id", "Purge", "Restore"},
 				AllowCredentials: true,
 			},
-			Metrics: config.HTTPMetrics{
-				// disabling inbound HTTP metrics collection by default for now, since the runtime performance impact is currently unclear;
-				// it is most likely to be negligible, but has not been measured yet to confirm
-				Disabled: true,
-			},
 		},
 		Service: config.Service{
 			Name: "graph",
@@ -86,12 +80,6 @@ func DefaultConfig() *config.Config {
 		},
 		Identity: config.Identity{
 			Backend: "ldap",
-			Metrics: config.IdentityMetrics{
-				// disabling identity backend opcall metrics collection by default for now, since
-				// the runtime performance impact is currently unclear;
-				// it is most likely to be negligible, but has not been measured yet to confirm
-				Disabled: true,
-			},
 			LDAP: config.LDAP{
 				URI:                      "ldap://localhost:9236",
 				Insecure:                 false,
@@ -121,11 +109,6 @@ func DefaultConfig() *config.Config {
 				GroupMemberAttribute:      "member",
 				GroupIDAttribute:          "openCloudUUID",
 				EducationResourcesEnabled: false,
-				Metrics: config.LDAPMetrics{
-					// disabling inbound HTTP metrics collection by default for now, since the runtime performance impact is currently unclear;
-					// it is most likely to be negligible, but has not been measured yet to confirm
-					Disabled: true,
-				},
 			},
 		},
 		Cache: &config.Cache{
@@ -135,10 +118,9 @@ func DefaultConfig() *config.Config {
 			TTL:      time.Hour * 24,
 		},
 		Events: config.Events{
-			DisabledConsumer: false,
-			Endpoint:         "127.0.0.1:9233",
-			Cluster:          "opencloud-cluster",
-			EnableTLS:        false,
+			Endpoint:  "127.0.0.1:9233",
+			Cluster:   "opencloud-cluster",
+			EnableTLS: false,
 		},
 		MaxConcurrency: 20,
 		UnifiedRoles: config.UnifiedRoles{
@@ -2,18 +2,12 @@ package config

 import "github.com/opencloud-eu/opencloud/pkg/shared"

-type HTTPMetrics struct {
-	Disabled bool `yaml:"disabled" env:"GRAPH_HTTP_METRICS_DISABLE" desc:"Disables the metrics for the HTTP service." introductionVersion:"%%NEXT%%"`
-}
-
 // HTTP defines the available http configuration.
 type HTTP struct {
-	Disabled  bool                  `yaml:"disabled" env:"GRAPH_HTTP_DISABLE" desc:"Disables the HTTP service. Set this to true if the service should only consume events." introductionVersion:"%%NEXT%%"`
 	Addr      string                `yaml:"addr" env:"GRAPH_HTTP_ADDR" desc:"The bind address of the HTTP service." introductionVersion:"1.0.0"`
 	Namespace string                `yaml:"-"`
 	Root      string                `yaml:"root" env:"GRAPH_HTTP_ROOT" desc:"Subdirectory that serves as the root for this HTTP service." introductionVersion:"1.0.0"`
 	TLS       shared.HTTPServiceTLS `yaml:"tls"`
 	APIToken  string                `yaml:"apitoken" env:"GRAPH_HTTP_API_TOKEN" desc:"An optional API bearer token" introductionVersion:"1.0.0"`
 	CORS      CORS                  `yaml:"cors"`
-	Metrics   HTTPMetrics           `yaml:"metrics"`
 }
Author	SHA1	Message	Date
Dominik Schmidt	0cd6e84c47	Apply suggestion from @dschmidt	2026-08-29 08:49:59 +02:00
Dominik Schmidt	3d079b90f0	fix(search): print delete by query failures as json	2026-08-29 08:49:59 +02:00
Dominik Schmidt	d7b8feaa18	fix(search): report rejected documents when indexing to OpenSearch	2026-08-29 08:49:05 +02:00