V3 version with backward comp

backend/internal/service/checksum.go

@@ -2,18 +2,9 @@ package service
 
 import (
 	"crypto/sha256"
-	"crypto/subtle"
 )
 
 func CreateSHA256Hash(data []byte) []byte {
-	hasher := sha256.New()
-	hasher.Write(data)
-	return hasher.Sum(nil)
-}
-
-func CompareHash(x, y []byte) bool {
-	if len(x) != len(y) {
-		return false
-	}
-	return subtle.ConstantTimeCompare(x, y) == 1
+	h := sha256.Sum256(data)
+	return h[:]
 }

backend/internal/service/conversion.go

@@ -17,9 +17,9 @@ import (
 )
 
 type ConversionJob struct {
-	FileID   string
-	FilePath string
-	MimeType string
+	ResourceID string
+	FilePath   string
+	MimeType   string
 }
 
 type ConversionService struct {
@@ -46,9 +46,9 @@ func (s *ConversionService) Stop() {
 	log.Println("[Conversion] Worker stopped")
 }
 
-func (s *ConversionService) Enqueue(fileID, filePath, mimeType string) {
-	s.jobs <- ConversionJob{FileID: fileID, FilePath: filePath, MimeType: mimeType}
-	log.Printf("[Conversion] Enqueued file %s", fileID)
+func (s *ConversionService) Enqueue(resourceID, filePath, mimeType string) {
+	s.jobs <- ConversionJob{ResourceID: resourceID, FilePath: filePath, MimeType: mimeType}
+	log.Printf("[Conversion] Enqueued resource %s", resourceID)
 }
 
 func (s *ConversionService) worker() {
@@ -58,7 +58,7 @@ func (s *ConversionService) worker() {
 }
 
 func (s *ConversionService) process(job ConversionJob) {
-	log.Printf("[Conversion] Processing file %s (mime: %s)", job.FileID, job.MimeType)
+	log.Printf("[Conversion] Processing resource %s (mime: %s)", job.ResourceID, job.MimeType)
 
 	pdfPath := job.FilePath
 	tmpDir := ""
@@ -67,18 +67,18 @@ func (s *ConversionService) process(job ConversionJob) {
 		var err error
 		pdfPath, tmpDir, err = s.convertToPDF(job.FilePath)
 		if err != nil {
-			log.Printf("[Conversion] Failed to convert file %s to PDF: %v", job.FileID, err)
+			log.Printf("[Conversion] Failed to convert resource %s to PDF: %v", job.ResourceID, err)
 			return
 		}
 		defer os.RemoveAll(tmpDir)
 	} else if !isPDF(job.MimeType) {
-		log.Printf("[Conversion] Skipping file %s: unsupported mime type %s", job.FileID, job.MimeType)
+		log.Printf("[Conversion] Skipping resource %s: unsupported mime type %s", job.ResourceID, job.MimeType)
 		return
 	}
 
-	thumbDir := filepath.Join(s.cfg.ThumbnailDir, job.FileID)
+	thumbDir := filepath.Join(s.cfg.ThumbnailDir, job.ResourceID)
 	if err := os.MkdirAll(thumbDir, 0o755); err != nil {
-		log.Printf("[Conversion] Failed to create thumbnail dir for %s: %v", job.FileID, err)
+		log.Printf("[Conversion] Failed to create thumbnail dir for %s: %v", job.ResourceID, err)
 		return
 	}
 
@@ -86,14 +86,14 @@ func (s *ConversionService) process(job ConversionJob) {
 		label string
 		dpi   int
 	}{
-		{"thumbnail", 21},
-		{"full", 200},
+		{"thumbnail_small", 21},
+		{"thumbnail_full", 200},
 	}
 
 	for _, res := range resolutions {
 		pages, err := s.convertPDFToImages(pdfPath, thumbDir, res.dpi)
 		if err != nil {
-			log.Printf("[Conversion] Failed to convert file %s to images (res=%s): %v", job.FileID, res.label, err)
+			log.Printf("[Conversion] Failed to convert resource %s to images (res=%s): %v", job.ResourceID, res.label, err)
 			continue
 		}
 
@@ -104,32 +104,33 @@ func (s *ConversionService) process(job ConversionJob) {
 				width, height = 0, 0
 			}
 
-			thumbUUID := uuid.New().String()
-			dstPath := filepath.Join(thumbDir, thumbUUID+".jpg")
+			dstPath := filepath.Join(thumbDir, uuid.New().String()+".jpg")
 			if err := os.Rename(page.path, dstPath); err != nil {
 				log.Printf("[Conversion] Failed to move %s to %s: %v", page.path, dstPath, err)
 				continue
 			}
 
-			_, err = s.queries.CreateThumbnail(context.Background(), db.CreateThumbnailParams{
-				FileID:          job.FileID,
-				PageNumber:      int32(page.number),
-				ResolutionLabel: res.label,
-				Width:           int32(width),
-				Height:          int32(height),
-				StorageKey:      dstPath,
-				MimeType:        "image/jpeg",
+			resourceUUID, _ := uuid.Parse(job.ResourceID)
+			_, err = s.queries.CreateResourceVariant(context.Background(), db.CreateResourceVariantParams{
+				ResourceID:  resourceUUID,
+				VariantType: res.label,
+				PageNumber:  int32(page.number),
+				Width:       int32(width),
+				Height:      int32(height),
+				MimeType:    "image/jpeg",
+				GeneratedBy: "server",
+				StorageKey:  dstPath,
 			})
 			if err != nil {
-				log.Printf("[Conversion] Failed to create thumbnail record for file %s page %d: %v", job.FileID, page.number, err)
+				log.Printf("[Conversion] Failed to create variant record for resource %s page %d: %v", job.ResourceID, page.number, err)
 				continue
 			}
 		}
 
-		log.Printf("[Conversion] Generated %d %s images for file %s", len(pages), res.label, job.FileID)
+		log.Printf("[Conversion] Generated %d %s images for resource %s", len(pages), res.label, job.ResourceID)
 	}
 
-	log.Printf("[Conversion] Completed file %s", job.FileID)
+	log.Printf("[Conversion] Completed resource %s", job.ResourceID)
 }
 
 func (s *ConversionService) convertToPDF(inputPath string) (string, string, error) {

backend/internal/service/file.go

@@ -1,349 +0,0 @@
-package service
-
-import (
-	"context"
-	"database/sql"
-	"encoding/hex"
-	"fmt"
-	"mime/multipart"
-	"os"
-	"path/filepath"
-
-	"github.com/google/uuid"
-	"github.com/vaultdrop/backend/internal/config"
-	"github.com/vaultdrop/backend/internal/db"
-	"github.com/vaultdrop/backend/internal/model"
-)
-
-type FileService struct {
-	queries *db.Queries
-	cfg     *config.Config
-}
-
-func NewFileService(queries *db.Queries, cfg *config.Config) *FileService {
-	return &FileService{queries: queries, cfg: cfg}
-}
-
-func (s *FileService) Upload(file *multipart.FileHeader) (*model.UploadResult, error) {
-	dst := filepath.Join(s.cfg.UploadDir, uuid.New().String()+filepath.Ext(file.Filename))
-
-	if err := os.MkdirAll(s.cfg.UploadDir, 0o755); err != nil {
-		return nil, fmt.Errorf("create upload dir: %w", err)
-	}
-
-	if err := saveUploadedFile(file, dst); err != nil {
-		return nil, fmt.Errorf("save file: %w", err)
-	}
-
-	data, err := os.ReadFile(dst)
-	if err != nil {
-		return nil, fmt.Errorf("read saved file: %w", err)
-	}
-
-	info, err := os.Stat(dst)
-	if err != nil {
-		return nil, fmt.Errorf("stat file: %w", err)
-	}
-
-	checksum := hex.EncodeToString(CreateSHA256Hash(data))
-
-	existing, err := s.queries.FindDuplicateByChecksum(context.Background(), checksum)
-	if err == nil && existing.ID != "" {
-		os.Remove(dst)
-		return &model.UploadResult{
-			ID:       existing.ID,
-			Name:     existing.Name,
-			Path:     existing.StorageKey,
-			MimeType: existing.MimeType,
-		}, nil
-	}
-
-	dbFile, err := s.queries.CreateFile(context.Background(), db.CreateFileParams{
-		Name:       file.Filename,
-		MimeType:   file.Header.Get("Content-Type"),
-		Size:       info.Size(),
-		StorageKey: dst,
-		Checksum:   checksum,
-	})
-	if err != nil {
-		return nil, fmt.Errorf("create file in db: %w", err)
-	}
-
-	return &model.UploadResult{
-		ID:       dbFile.ID,
-		Name:     dbFile.Name,
-		Path:     dst,
-		MimeType: dbFile.MimeType,
-	}, nil
-}
-
-func (s *FileService) List() ([]model.File, error) {
-	dbFiles, err := s.queries.ListFiles(context.Background())
-	if err != nil {
-		return nil, fmt.Errorf("list files: %w", err)
-	}
-
-	files := make([]model.File, len(dbFiles))
-	for i, f := range dbFiles {
-		tags, err := s.queries.GetTagsByFileID(context.Background(), sql.NullString{String: f.ID, Valid: true})
-		if err != nil {
-			return nil, fmt.Errorf("get tags for file %s: %w", f.ID, err)
-		}
-		files[i] = dbToModel(f, tags)
-	}
-	return files, nil
-}
-
-func (s *FileService) Get(id string) (*model.File, error) {
-	f, err := s.queries.GetFile(context.Background(), id)
-	if err != nil {
-		return nil, fmt.Errorf("get file: %w", err)
-	}
-	tags, err := s.queries.GetTagsByFileID(context.Background(), sql.NullString{String: f.ID, Valid: true})
-	if err != nil {
-		return nil, fmt.Errorf("get tags: %w", err)
-	}
-	m := dbToModel(f, tags)
-	return &m, nil
-}
-
-func (s *FileService) Delete(id string) error {
-	return s.queries.DeleteFile(context.Background(), id)
-}
-
-func (s *FileService) GetStoragePath(id string) (string, error) {
-	f, err := s.queries.GetFile(context.Background(), id)
-	if err != nil {
-		return "", fmt.Errorf("get file: %w", err)
-	}
-	return f.StorageKey, nil
-}
-
-func (s *FileService) UpdateOCRText(id, text string) error {
-	f, err := s.queries.GetFile(context.Background(), id)
-	if err != nil {
-		return fmt.Errorf("get file: %w", err)
-	}
-	return s.queries.UpdateFile(context.Background(), db.UpdateFileParams{
-		Name:     f.Name,
-		MimeType: f.MimeType,
-		OcrText:  text,
-		ID:       id,
-	})
-}
-
-func (s *FileService) AddTags(fileID string, tagNames []string, tagType string) error {
-	for _, name := range tagNames {
-		tag, err := s.queries.GetTagByName(context.Background(), name)
-		if err == sql.ErrNoRows {
-			tag, err = s.queries.CreateTag(context.Background(), db.CreateTagParams{
-				TagName: name,
-				TagType: tagType,
-			})
-			if err != nil {
-				return fmt.Errorf("create tag %q: %w", name, err)
-			}
-		} else if err != nil {
-			return fmt.Errorf("get tag %q: %w", name, err)
-		}
-
-		err = s.queries.AddTagToFile(context.Background(), db.AddTagToFileParams{
-			TagID:  sql.NullString{String: tag.ID, Valid: true},
-			FileID: sql.NullString{String: fileID, Valid: true},
-		})
-		if err != nil {
-			return fmt.Errorf("link tag %q to file: %w", name, err)
-		}
-	}
-	return nil
-}
-
-func (s *FileService) GetTagsByFileID(fileID string) ([]model.Tag, error) {
-	dbTags, err := s.queries.GetTagsByFileID(context.Background(), sql.NullString{String: fileID, Valid: true})
-	if err != nil {
-		return nil, fmt.Errorf("get tags: %w", err)
-	}
-	tags := make([]model.Tag, len(dbTags))
-	for i, t := range dbTags {
-		tags[i] = model.Tag{ID: t.ID, Name: t.TagName, TagType: t.TagType}
-	}
-	return tags, nil
-}
-
-func (s *FileService) MoveFiles(fileIDs []string, parentFileID *string) error {
-	var parentID sql.NullString
-	if parentFileID != nil {
-		parentID = sql.NullString{String: *parentFileID, Valid: true}
-	}
-	return s.queries.MoveFiles(context.Background(), db.MoveFilesParams{
-		ParentFileID: parentID,
-		Column2:      fileIDs,
-	})
-}
-
-func (s *FileService) CreateFolder(name string) (*model.File, error) {
-	f, err := s.queries.CreateFolder(context.Background(), name)
-	if err != nil {
-		return nil, fmt.Errorf("create folder: %w", err)
-	}
-	m := dbToModel(f, nil)
-	return &m, nil
-}
-
-func (s *FileService) ListFolders() ([]model.File, error) {
-	dbFiles, err := s.queries.ListFolders(context.Background())
-	if err != nil {
-		return nil, fmt.Errorf("list folders: %w", err)
-	}
-	folders := make([]model.File, len(dbFiles))
-	for i, f := range dbFiles {
-		folders[i] = dbToModel(f, nil)
-	}
-	return folders, nil
-}
-
-func (s *FileService) ListFilesByParentID(parentID string) ([]model.File, error) {
-	dbFiles, err := s.queries.ListFilesByParentID(context.Background(), sql.NullString{String: parentID, Valid: true})
-	if err != nil {
-		return nil, fmt.Errorf("list files by parent: %w", err)
-	}
-	files := make([]model.File, len(dbFiles))
-	for i, f := range dbFiles {
-		tags, err := s.queries.GetTagsByFileID(context.Background(), sql.NullString{String: f.ID, Valid: true})
-		if err != nil {
-			return nil, fmt.Errorf("get tags for file %s: %w", f.ID, err)
-		}
-		files[i] = dbToModel(f, tags)
-	}
-	return files, nil
-}
-
-func (s *FileService) GetThumbnailsByFileID(fileID string) ([]model.Thumbnail, error) {
-	dbThumbnails, err := s.queries.GetThumbnailsByFileID(context.Background(), fileID)
-	if err != nil {
-		return nil, fmt.Errorf("get thumbnails: %w", err)
-	}
-
-	thumbnails := make([]model.Thumbnail, len(dbThumbnails))
-	for i, t := range dbThumbnails {
-		thumbnails[i] = model.Thumbnail{
-			ID:              t.ID,
-			FileID:          t.FileID,
-			PageNumber:      int(t.PageNumber),
-			ResolutionLabel: t.ResolutionLabel,
-			Width:           int(t.Width),
-			Height:          int(t.Height),
-			StorageKey:      t.StorageKey,
-			MimeType:        t.MimeType,
-			CreatedAt:       t.CreatedAt.String(),
-		}
-	}
-	return thumbnails, nil
-}
-
-func (s *FileService) GetThumbnailStoragePath(id string) (string, error) {
-	t, err := s.queries.GetThumbnailByID(context.Background(), id)
-	if err != nil {
-		return "", fmt.Errorf("get thumbnail: %w", err)
-	}
-	return t.StorageKey, nil
-}
-
-func (s *FileService) GetBestThumbnail(fileID, preferredLabel string) *model.Thumbnail {
-	dbThumbnails, err := s.queries.GetThumbnailsByFileID(context.Background(), fileID)
-	if err != nil || len(dbThumbnails) == 0 {
-		return nil
-	}
-
-	var fallback *model.Thumbnail
-	for _, t := range dbThumbnails {
-		if t.PageNumber != 1 {
-			continue
-		}
-		if t.ResolutionLabel == preferredLabel {
-			return &model.Thumbnail{
-				ID:              t.ID,
-				FileID:          t.FileID,
-				PageNumber:      int(t.PageNumber),
-				ResolutionLabel: t.ResolutionLabel,
-				Width:           int(t.Width),
-				Height:          int(t.Height),
-				StorageKey:      t.StorageKey,
-				MimeType:        t.MimeType,
-				CreatedAt:       t.CreatedAt.String(),
-			}
-		}
-		if fallback == nil {
-			fallback = &model.Thumbnail{
-				ID:              t.ID,
-				FileID:          t.FileID,
-				PageNumber:      int(t.PageNumber),
-				ResolutionLabel: t.ResolutionLabel,
-				Width:           int(t.Width),
-				Height:          int(t.Height),
-				StorageKey:      t.StorageKey,
-				MimeType:        t.MimeType,
-				CreatedAt:       t.CreatedAt.String(),
-			}
-		}
-	}
-
-	return fallback
-}
-
-func (s *FileService) FindDuplicatesByNameSize(name string, size int64) ([]db.FindDuplicatesByNameSizeRow, error) {
-	return s.queries.FindDuplicatesByNameSize(context.Background(), db.FindDuplicatesByNameSizeParams{
-		Name: name,
-		Size: size,
-	})
-}
-
-func dbToModel(f db.File, dbTags []db.Tag) model.File {
-	tags := make([]model.Tag, len(dbTags))
-	for i, t := range dbTags {
-		tags[i] = model.Tag{ID: t.ID, Name: t.TagName, TagType: t.TagType}
-	}
-
-	return model.File{
-		ID:           f.ID,
-		Name:         f.Name,
-		MimeType:     f.MimeType,
-		Size:         f.Size,
-		StorageKey:   f.StorageKey,
-		Checksum:     f.Checksum,
-		OcrText:      f.OcrText,
-		IsFolder:     f.IsFolder,
-		ParentFileID: f.ParentFileID.String,
-		Tags:         tags,
-		CreatedAt:    f.CreatedAt.String(),
-		UpdatedAt:    f.UpdatedAt.String(),
-	}
-}
-
-func saveUploadedFile(file *multipart.FileHeader, dst string) error {
-	src, err := file.Open()
-	if err != nil {
-		return err
-	}
-	defer src.Close()
-
-	out, err := os.Create(dst)
-	if err != nil {
-		return err
-	}
-	defer out.Close()
-
-	buf := make([]byte, 32*1024)
-	for {
-		n, readErr := src.Read(buf)
-		if n > 0 {
-			if _, writeErr := out.Write(buf[:n]); writeErr != nil {
-				return writeErr
-			}
-		}
-		if readErr != nil {
-			break
-		}
-	}
-	return nil
-}

backend/internal/service/ocr.go

@@ -10,21 +10,21 @@ import (
 )
 
 type OCRJob struct {
-	FileID   string
-	FilePath string
+	ResourceID string
+	FilePath   string
 }
 
 type OCRService struct {
-	client  *ocr.Client
-	fileSvc *FileService
-	jobs    chan OCRJob
+	client      *ocr.Client
+	resourceSvc *ResourceService
+	jobs        chan OCRJob
 }
 
-func NewOCRService(cfg *config.Config, fileSvc *FileService) *OCRService {
+func NewOCRService(cfg *config.Config, resourceSvc *ResourceService) *OCRService {
 	return &OCRService{
-		client:  ocr.NewClient(cfg.OCREndpoint),
-		fileSvc: fileSvc,
-		jobs:    make(chan OCRJob, 100),
+		client:      ocr.NewClient(cfg.OCREndpoint),
+		resourceSvc: resourceSvc,
+		jobs:        make(chan OCRJob, 100),
 	}
 }
 
@@ -38,9 +38,9 @@ func (s *OCRService) Stop() {
 	log.Println("[OCR] Worker stopped")
 }
 
-func (s *OCRService) Enqueue(fileID, filePath string) {
-	s.jobs <- OCRJob{FileID: fileID, FilePath: filePath}
-	log.Printf("[OCR] Enqueued file %s", fileID)
+func (s *OCRService) Enqueue(resourceID, filePath string) {
+	s.jobs <- OCRJob{ResourceID: resourceID, FilePath: filePath}
+	log.Printf("[OCR] Enqueued resource %s", resourceID)
 }
 
 func (s *OCRService) worker() {
@@ -50,28 +50,28 @@ func (s *OCRService) worker() {
 }
 
 func (s *OCRService) process(job OCRJob) {
-	log.Printf("[OCR] Processing file %s", job.FileID)
+	log.Printf("[OCR] Processing resource %s", job.ResourceID)
 
 	data, err := os.ReadFile(job.FilePath)
 	if err != nil {
-		log.Printf("[OCR] Failed to read file %s: %v", job.FileID, err)
+		log.Printf("[OCR] Failed to read resource %s: %v", job.ResourceID, err)
 		return
 	}
 
 	blocks, err := s.client.Recognize(data)
 	if err != nil {
-		log.Printf("[OCR] Failed to recognize file %s: %v", job.FileID, err)
+		log.Printf("[OCR] Failed to recognize resource %s: %v", job.ResourceID, err)
 		return
 	}
 
 	text := s.FlattenResults(blocks)
 
-	if err := s.fileSvc.UpdateOCRText(job.FileID, text); err != nil {
-		log.Printf("[OCR] Failed to update ocr_text for file %s: %v", job.FileID, err)
+	if err := s.resourceSvc.UpdateOCRText(job.ResourceID, text); err != nil {
+		log.Printf("[OCR] Failed to update ocr_text for resource %s: %v", job.ResourceID, err)
 		return
 	}
 
-	log.Printf("[OCR] Completed file %s (%d chars)", job.FileID, len(text))
+	log.Printf("[OCR] Completed resource %s (%d chars)", job.ResourceID, len(text))
 }
 
 func (s *OCRService) RecognizeFromBytes(data []byte) ([]ocr.TextBlock, error) {

backend/internal/service/placement.go

@@ -0,0 +1,65 @@
+package service
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+	"github.com/vaultdrop/backend/internal/db"
+)
+
+type PlacementService struct {
+	queries *db.Queries
+}
+
+func NewPlacementService(queries *db.Queries) *PlacementService {
+	return &PlacementService{queries: queries}
+}
+
+func (s *PlacementService) GetPlacementsForResource(resourceID string) ([]db.ResourcePlacement, error) {
+	resourceUUID, _ := uuid.Parse(resourceID)
+	return s.queries.ListPlacementsByResource(context.Background(), resourceUUID)
+}
+
+func (s *PlacementService) GetPlacementsForLocation(locationID string) ([]db.ResourcePlacement, error) {
+	locationUUID, _ := uuid.Parse(locationID)
+	return s.queries.ListPlacementsByLocation(context.Background(), locationUUID)
+}
+
+func (s *PlacementService) UpdatePlacementStatus(placementID, status string) error {
+	placementUUID, _ := uuid.Parse(placementID)
+	return s.queries.UpdatePlacementStatus(context.Background(), db.UpdatePlacementStatusParams{
+		Status: status,
+		ID:     placementUUID,
+	})
+}
+
+func (s *PlacementService) DeletePlacement(placementID string) error {
+	placementUUID, _ := uuid.Parse(placementID)
+	return s.queries.DeletePlacement(context.Background(), placementUUID)
+}
+
+func (s *PlacementService) CreateDeviceLocation(userID, deviceName string) (db.StorageLocation, error) {
+	userUUID, _ := uuid.Parse(userID)
+	return s.queries.CreateStorageLocation(context.Background(), db.CreateStorageLocationParams{
+		UserID:     userUUID,
+		DeviceName: deviceName,
+		Role:       "device",
+	})
+}
+
+func (s *PlacementService) ListUserLocations(userID string) ([]db.StorageLocation, error) {
+	userUUID, _ := uuid.Parse(userID)
+	return s.queries.ListStorageLocationsByUser(context.Background(), userUUID)
+}
+
+func (s *PlacementService) ensureServerLocation(userID uuid.UUID) (db.StorageLocation, error) {
+	loc, err := s.queries.GetServerStorageLocation(context.Background(), userID)
+	if err != nil {
+		return s.queries.CreateStorageLocation(context.Background(), db.CreateStorageLocationParams{
+			UserID:     userID,
+			DeviceName: "VaultDrop Server",
+			Role:       "server",
+		})
+	}
+	return loc, nil
+}

backend/internal/service/rebac.go

@@ -0,0 +1,89 @@
+package service
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/google/uuid"
+	"github.com/vaultdrop/backend/internal/db"
+)
+
+type RebacService struct {
+	queries *db.Queries
+}
+
+func NewRebacService(queries *db.Queries) *RebacService {
+	return &RebacService{queries: queries}
+}
+
+func (s *RebacService) ResolveEffectiveRole(userID, resourceID string) (string, error) {
+	userUUID, _ := uuid.Parse(userID)
+	resourceUUID, _ := uuid.Parse(resourceID)
+	role, err := s.queries.ResolveEffectiveRole(context.Background(), db.ResolveEffectiveRoleParams{
+		PUserID:     userUUID,
+		PResourceID: resourceUUID,
+	})
+	if err != nil {
+		return "", fmt.Errorf("resolve effective role: %w", err)
+	}
+	return role, nil
+}
+
+func (s *RebacService) HasRole(userID, resourceID, requiredRole string) (bool, error) {
+	role, err := s.ResolveEffectiveRole(userID, resourceID)
+	if err != nil {
+		return false, err
+	}
+	return role == requiredRole, nil
+}
+
+func (s *RebacService) canGrant(granterRole string) bool {
+	return granterRole == "owner" || granterRole == "admin"
+}
+
+func (s *RebacService) GrantRole(granterID, resourceID, subjectID, role string) error {
+	granterUUID, _ := uuid.Parse(granterID)
+	resourceUUID, _ := uuid.Parse(resourceID)
+	subjectUUID, _ := uuid.Parse(subjectID)
+
+	granterRole, err := s.ResolveEffectiveRole(granterID, resourceID)
+	if err != nil {
+		return fmt.Errorf("resolve granter role: %w", err)
+	}
+	if !s.canGrant(granterRole) {
+		return fmt.Errorf("granter does not have permission to grant roles")
+	}
+
+	_, err = s.queries.CreateRebacRelation(context.Background(), db.CreateRebacRelationParams{
+		ResourceID:    resourceUUID,
+		SubjectUserID: subjectUUID,
+		Role:          role,
+		GrantedBy:     granterUUID,
+	})
+	if err != nil {
+		return fmt.Errorf("create rebac relation: %w", err)
+	}
+	return nil
+}
+
+func (s *RebacService) RevokeRole(granterID, resourceID, subjectID string) error {
+	granterRole, err := s.ResolveEffectiveRole(granterID, resourceID)
+	if err != nil {
+		return fmt.Errorf("resolve granter role: %w", err)
+	}
+	if !s.canGrant(granterRole) {
+		return fmt.Errorf("granter does not have permission to revoke roles")
+	}
+
+	resourceUUID, _ := uuid.Parse(resourceID)
+	subjectUUID, _ := uuid.Parse(subjectID)
+	return s.queries.DeleteRebacRelation(context.Background(), db.DeleteRebacRelationParams{
+		ResourceID:    resourceUUID,
+		SubjectUserID: subjectUUID,
+	})
+}
+
+func (s *RebacService) ListShares(resourceID string) ([]db.RebacRelation, error) {
+	resourceUUID, _ := uuid.Parse(resourceID)
+	return s.queries.ListRebacRelationsByResource(context.Background(), resourceUUID)
+}

backend/internal/service/resource.go

@@ -0,0 +1,423 @@
+package service
+
+import (
+	"context"
+	"database/sql"
+	"encoding/hex"
+	"fmt"
+	"mime/multipart"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/vaultdrop/backend/internal/config"
+	"github.com/vaultdrop/backend/internal/db"
+	"github.com/vaultdrop/backend/internal/model"
+)
+
+type ResourceService struct {
+	queries *db.Queries
+	cfg     *config.Config
+}
+
+func NewResourceService(queries *db.Queries, cfg *config.Config) *ResourceService {
+	return &ResourceService{queries: queries, cfg: cfg}
+}
+
+func (s *ResourceService) Upload(file *multipart.FileHeader, ownerID string) (*model.UploadResult, error) {
+	dst := filepath.Join(s.cfg.UploadDir, uuid.New().String()+filepath.Ext(file.Filename))
+
+	if err := os.MkdirAll(s.cfg.UploadDir, 0o755); err != nil {
+		return nil, fmt.Errorf("create upload dir: %w", err)
+	}
+
+	if err := saveUploadedFile(file, dst); err != nil {
+		return nil, fmt.Errorf("save file: %w", err)
+	}
+
+	data, err := os.ReadFile(dst)
+	if err != nil {
+		return nil, fmt.Errorf("read saved file: %w", err)
+	}
+
+	info, err := os.Stat(dst)
+	if err != nil {
+		return nil, fmt.Errorf("stat file: %w", err)
+	}
+
+	checksum := hex.EncodeToString(CreateSHA256Hash(data))
+
+	ownerUUID, err := uuid.Parse(ownerID)
+	if err != nil {
+		return nil, fmt.Errorf("parse owner id: %w", err)
+	}
+
+	existing, err := s.queries.FindDuplicateByChecksum(context.Background(), db.FindDuplicateByChecksumParams{
+		Checksum: checksum,
+		OwnerID:  ownerUUID,
+	})
+	if err == nil && existing.ID != uuid.Nil {
+		os.Remove(dst)
+		placement, err := s.queries.GetServerPlacementByResource(context.Background(), existing.ID)
+		if err == nil {
+			return &model.UploadResult{
+				ID:       existing.ID.String(),
+				Name:     existing.Name,
+				Path:     placement.StorageKey.String,
+				MimeType: existing.MimeType,
+			}, nil
+		}
+	}
+
+	dbResource, err := s.queries.CreateResource(context.Background(), db.CreateResourceParams{
+		Name:     file.Filename,
+		MimeType: file.Header.Get("Content-Type"),
+		Size:     info.Size(),
+		Checksum: checksum,
+		OwnerID:  ownerUUID,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("create resource in db: %w", err)
+	}
+
+	placement, err := s.ensureServerPlacement(dbResource.ID, dst)
+	if err != nil {
+		return nil, fmt.Errorf("create server placement: %w", err)
+	}
+
+	if err := s.ensureOwnerRebac(dbResource.ID, ownerUUID); err != nil {
+		return nil, fmt.Errorf("create owner rebac: %w", err)
+	}
+
+	return &model.UploadResult{
+		ID:       dbResource.ID.String(),
+		Name:     dbResource.Name,
+		Path:     placement.StorageKey.String,
+		MimeType: dbResource.MimeType,
+	}, nil
+}
+
+func (s *ResourceService) ensureServerPlacement(resourceID uuid.UUID, dst string) (db.ResourcePlacement, error) {
+	serverLoc, err := s.queries.GetServerStorageLocation(context.Background(), uuid.Nil)
+	if err != nil {
+		return db.ResourcePlacement{}, fmt.Errorf("get server location: %w", err)
+	}
+
+	placement, err := s.queries.CreatePlacement(context.Background(), db.CreatePlacementParams{
+		ResourceID:        resourceID,
+		StorageLocationID: serverLoc.ID,
+		Status:            "synced",
+		StorageKey:        sql.NullString{String: dst, Valid: true},
+		SyncedAt:          sql.NullTime{Time: time.Now(), Valid: true},
+	})
+	if err != nil {
+		return db.ResourcePlacement{}, fmt.Errorf("create placement: %w", err)
+	}
+
+	return placement, nil
+}
+
+func (s *ResourceService) ensureOwnerRebac(resourceID, ownerID uuid.UUID) error {
+	_, err := s.queries.CreateRebacRelation(context.Background(), db.CreateRebacRelationParams{
+		ResourceID:    resourceID,
+		SubjectUserID: ownerID,
+		Role:          "owner",
+		GrantedBy:     ownerID,
+	})
+	return err
+}
+
+func (s *ResourceService) List(ownerID string) ([]model.Resource, error) {
+	ownerUUID, _ := uuid.Parse(ownerID)
+	dbResources, err := s.queries.ListResourcesByOwner(context.Background(), ownerUUID)
+	if err != nil {
+		return nil, fmt.Errorf("list resources: %w", err)
+	}
+
+	resources := make([]model.Resource, len(dbResources))
+	for i, r := range dbResources {
+		tags, err := s.queries.GetTagsByResourceID(context.Background(), sql.NullString{String: r.ID.String(), Valid: true})
+		if err != nil {
+			return nil, fmt.Errorf("get tags for resource %s: %w", r.ID, err)
+		}
+		resources[i] = dbResourceToModel(r, tags)
+	}
+	return resources, nil
+}
+
+func (s *ResourceService) Get(id string) (*model.Resource, error) {
+	resourceUUID, _ := uuid.Parse(id)
+	r, err := s.queries.GetResource(context.Background(), resourceUUID)
+	if err != nil {
+		return nil, fmt.Errorf("get resource: %w", err)
+	}
+	tags, err := s.queries.GetTagsByResourceID(context.Background(), sql.NullString{String: r.ID.String(), Valid: true})
+	if err != nil {
+		return nil, fmt.Errorf("get tags: %w", err)
+	}
+	m := dbResourceToModel(r, tags)
+	return &m, nil
+}
+
+func (s *ResourceService) Delete(id string) error {
+	resourceUUID, _ := uuid.Parse(id)
+	return s.queries.DeleteResource(context.Background(), resourceUUID)
+}
+
+func (s *ResourceService) GetStoragePath(id string) (string, error) {
+	resourceUUID, _ := uuid.Parse(id)
+	placement, err := s.queries.GetServerPlacementByResource(context.Background(), resourceUUID)
+	if err != nil {
+		return "", fmt.Errorf("get server placement for resource %s: %w", id, err)
+	}
+	return placement.StorageKey.String, nil
+}
+
+func (s *ResourceService) UpdateOCRText(id, text string) error {
+	resourceUUID, _ := uuid.Parse(id)
+	r, err := s.queries.GetResource(context.Background(), resourceUUID)
+	if err != nil {
+		return fmt.Errorf("get resource: %w", err)
+	}
+	return s.queries.UpdateResource(context.Background(), db.UpdateResourceParams{
+		Name:     r.Name,
+		MimeType: r.MimeType,
+		OcrText:  text,
+		ID:       resourceUUID,
+	})
+}
+
+func (s *ResourceService) AddTags(resourceID string, tagNames []string) error {
+	resourceUUID, _ := uuid.Parse(resourceID)
+	for _, name := range tagNames {
+		tag, err := s.queries.GetTagByName(context.Background(), name)
+		if err == sql.ErrNoRows {
+			tag, err = s.queries.CreateTag(context.Background(), name)
+			if err != nil {
+				return fmt.Errorf("create tag %q: %w", name, err)
+			}
+		} else if err != nil {
+			return fmt.Errorf("get tag %q: %w", name, err)
+		}
+
+		err = s.queries.AddTagToResource(context.Background(), db.AddTagToResourceParams{
+			TagID:      sql.NullString{String: tag.ID, Valid: true},
+			ResourceID: sql.NullString{String: resourceUUID.String(), Valid: true},
+		})
+		if err != nil {
+			return fmt.Errorf("link tag %q to resource: %w", name, err)
+		}
+	}
+	return nil
+}
+
+func (s *ResourceService) GetTagsByResourceID(resourceID string) ([]model.Tag, error) {
+	resourceUUID, _ := uuid.Parse(resourceID)
+	dbTags, err := s.queries.GetTagsByResourceID(context.Background(), sql.NullString{String: resourceUUID.String(), Valid: true})
+	if err != nil {
+		return nil, fmt.Errorf("get tags: %w", err)
+	}
+	tags := make([]model.Tag, len(dbTags))
+	for i, t := range dbTags {
+		tags[i] = model.Tag{ID: t.ID, Name: t.TagName}
+	}
+	return tags, nil
+}
+
+func (s *ResourceService) MoveResources(resourceIDs []string, parentResourceID *string) error {
+	uuids := make([]uuid.UUID, len(resourceIDs))
+	for i, id := range resourceIDs {
+		uuids[i], _ = uuid.Parse(id)
+	}
+	var parentID uuid.NullUUID
+	if parentResourceID != nil {
+		pid, _ := uuid.Parse(*parentResourceID)
+		parentID = uuid.NullUUID{UUID: pid, Valid: true}
+	}
+	return s.queries.MoveResources(context.Background(), db.MoveResourcesParams{
+		ParentResourceID: parentID,
+		Column2:          uuids,
+	})
+}
+
+func (s *ResourceService) CreateFolder(name, ownerID string) (*model.Resource, error) {
+	ownerUUID, _ := uuid.Parse(ownerID)
+	r, err := s.queries.CreateFolder(context.Background(), db.CreateFolderParams{
+		Name:    name,
+		OwnerID: ownerUUID,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("create folder: %w", err)
+	}
+
+	if err := s.ensureOwnerRebac(r.ID, ownerUUID); err != nil {
+		return nil, fmt.Errorf("create owner rebac: %w", err)
+	}
+
+	m := dbResourceToModel(r, nil)
+	return &m, nil
+}
+
+func (s *ResourceService) ListFolders(ownerID string) ([]model.Resource, error) {
+	dbResources, err := s.queries.ListFolders(context.Background())
+	if err != nil {
+		return nil, fmt.Errorf("list folders: %w", err)
+	}
+	folders := make([]model.Resource, len(dbResources))
+	for i, r := range dbResources {
+		folders[i] = dbResourceToModel(r, nil)
+	}
+	return folders, nil
+}
+
+func (s *ResourceService) ListResourcesByParentID(parentID, ownerID string) ([]model.Resource, error) {
+	parentUUID, _ := uuid.Parse(parentID)
+	ownerUUID, _ := uuid.Parse(ownerID)
+	dbResources, err := s.queries.ListResourcesByParentAndOwner(context.Background(), db.ListResourcesByParentAndOwnerParams{
+		ParentResourceID: uuid.NullUUID{UUID: parentUUID, Valid: true},
+		OwnerID:          ownerUUID,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("list resources by parent: %w", err)
+	}
+	resources := make([]model.Resource, len(dbResources))
+	for i, r := range dbResources {
+		tags, err := s.queries.GetTagsByResourceID(context.Background(), sql.NullString{String: r.ID.String(), Valid: true})
+		if err != nil {
+			return nil, fmt.Errorf("get tags for resource %s: %w", r.ID, err)
+		}
+		resources[i] = dbResourceToModel(r, tags)
+	}
+	return resources, nil
+}
+
+func (s *ResourceService) GetVariantsByResourceID(resourceID string) ([]model.Variant, error) {
+	resourceUUID, _ := uuid.Parse(resourceID)
+	dbVariants, err := s.queries.GetVariantsByResourceID(context.Background(), resourceUUID)
+	if err != nil {
+		return nil, fmt.Errorf("get variants: %w", err)
+	}
+
+	variants := make([]model.Variant, len(dbVariants))
+	for i, v := range dbVariants {
+		variants[i] = model.Variant{
+			ID:          v.ID.String(),
+			ResourceID:  v.ResourceID.String(),
+			VariantType: v.VariantType,
+			PageNumber:  int(v.PageNumber),
+			Width:       int(v.Width),
+			Height:      int(v.Height),
+			StorageKey:  v.StorageKey,
+			MimeType:    v.MimeType,
+			GeneratedBy: v.GeneratedBy,
+			CreatedAt:   v.CreatedAt.String(),
+		}
+	}
+	return variants, nil
+}
+
+func (s *ResourceService) GetVariantStoragePath(id string) (string, error) {
+	variantUUID, _ := uuid.Parse(id)
+	v, err := s.queries.GetVariantByID(context.Background(), variantUUID)
+	if err != nil {
+		return "", fmt.Errorf("get variant: %w", err)
+	}
+	return v.StorageKey, nil
+}
+
+func (s *ResourceService) GetBestVariant(resourceID, preferredType string) *model.Variant {
+	resourceUUID, _ := uuid.Parse(resourceID)
+	dbVariants, err := s.queries.GetVariantsByResourceID(context.Background(), resourceUUID)
+	if err != nil || len(dbVariants) == 0 {
+		return nil
+	}
+
+	var fallback *model.Variant
+	for _, v := range dbVariants {
+		if v.PageNumber != 1 {
+			continue
+		}
+		mv := &model.Variant{
+			ID:          v.ID.String(),
+			ResourceID:  v.ResourceID.String(),
+			VariantType: v.VariantType,
+			PageNumber:  int(v.PageNumber),
+			Width:       int(v.Width),
+			Height:      int(v.Height),
+			StorageKey:  v.StorageKey,
+			MimeType:    v.MimeType,
+			GeneratedBy: v.GeneratedBy,
+			CreatedAt:   v.CreatedAt.String(),
+		}
+		if v.VariantType == preferredType {
+			return mv
+		}
+		if fallback == nil {
+			fallback = mv
+		}
+	}
+	return fallback
+}
+
+func (s *ResourceService) FindDuplicatesByNameSize(name string, size int64) ([]db.FindDuplicatesByNameSizeRow, error) {
+	return s.queries.FindDuplicatesByNameSize(context.Background(), db.FindDuplicatesByNameSizeParams{
+		Name: name,
+		Size: size,
+	})
+}
+
+func dbResourceToModel(r db.Resource, dbTags []db.Tag) model.Resource {
+	tags := make([]model.Tag, len(dbTags))
+	for i, t := range dbTags {
+		tags[i] = model.Tag{ID: t.ID, Name: t.TagName}
+	}
+
+	parentID := ""
+	if r.ParentResourceID.Valid {
+		parentID = r.ParentResourceID.UUID.String()
+	}
+
+	return model.Resource{
+		ID:               r.ID.String(),
+		Name:             r.Name,
+		MimeType:         r.MimeType,
+		Size:             r.Size,
+		Checksum:         r.Checksum,
+		OcrText:          r.OcrText,
+		IsFolder:         r.IsFolder,
+		ParentResourceID: parentID,
+		OwnerID:          r.OwnerID.String(),
+		Tags:             tags,
+		CreatedAt:        r.CreatedAt,
+		UpdatedAt:        r.UpdatedAt,
+	}
+}
+
+func saveUploadedFile(file *multipart.FileHeader, dst string) error {
+	src, err := file.Open()
+	if err != nil {
+		return err
+	}
+	defer src.Close()
+
+	out, err := os.Create(dst)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	buf := make([]byte, 32*1024)
+	for {
+		n, readErr := src.Read(buf)
+		if n > 0 {
+			if _, writeErr := out.Write(buf[:n]); writeErr != nil {
+				return writeErr
+			}
+		}
+		if readErr != nil {
+			break
+		}
+	}
+	return nil
+}

backend/internal/service/sync.go

@@ -0,0 +1,74 @@
+package service
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/google/uuid"
+	"github.com/vaultdrop/backend/internal/db"
+)
+
+type SyncService struct {
+	queries *db.Queries
+}
+
+func NewSyncService(queries *db.Queries) *SyncService {
+	return &SyncService{queries: queries}
+}
+
+func (s *SyncService) EnqueueUpload(resourceID, locationID string) error {
+	resourceUUID, _ := uuid.Parse(resourceID)
+	locationUUID, _ := uuid.Parse(locationID)
+	_, err := s.queries.CreateSyncQueueItem(context.Background(), db.CreateSyncQueueItemParams{
+		ResourceID:        resourceUUID,
+		StorageLocationID: locationUUID,
+		Operation:         "upload",
+		Status:            "pending",
+		Attempts:          0,
+	})
+	return err
+}
+
+func (s *SyncService) EnqueueDownload(resourceID, locationID string) error {
+	resourceUUID, _ := uuid.Parse(resourceID)
+	locationUUID, _ := uuid.Parse(locationID)
+	_, err := s.queries.CreateSyncQueueItem(context.Background(), db.CreateSyncQueueItemParams{
+		ResourceID:        resourceUUID,
+		StorageLocationID: locationUUID,
+		Operation:         "download",
+		Status:            "pending",
+		Attempts:          0,
+	})
+	return err
+}
+
+func (s *SyncService) ListPending(locationID string) ([]db.SyncQueue, error) {
+	locationUUID, _ := uuid.Parse(locationID)
+	return s.queries.ListPendingSyncItemsByLocation(context.Background(), locationUUID)
+}
+
+func (s *SyncService) ListAllPending() ([]db.SyncQueue, error) {
+	return s.queries.ListPendingSyncItems(context.Background())
+}
+
+func (s *SyncService) MarkCompleted(queueID string) error {
+	id, _ := uuid.Parse(queueID)
+	return s.queries.UpdateSyncQueueStatus(context.Background(), db.UpdateSyncQueueStatusParams{
+		Status:   "completed",
+		Attempts: 0,
+		ID:       id,
+	})
+}
+
+func (s *SyncService) MarkFailed(queueID string, errMsg string) error {
+	id, _ := uuid.Parse(queueID)
+	item, err := s.queries.GetSyncQueueItem(context.Background(), id)
+	if err != nil {
+		return fmt.Errorf("get sync queue item: %w", err)
+	}
+	return s.queries.UpdateSyncQueueStatus(context.Background(), db.UpdateSyncQueueStatusParams{
+		Status:   "failed",
+		Attempts: int32(item.Attempts + 1),
+		ID:       id,
+	})
+}

backend/internal/service/url.go

@@ -25,43 +25,43 @@ func NewURLService(secret, serverHost string, expiryMinutes int) *URLService {
 	}
 }
 
-func (s *URLService) sign(fileID string, expires int64) string {
-	data := fmt.Sprintf("%s:%d", fileID, expires)
+func (s *URLService) sign(id string, expires int64) string {
+	data := fmt.Sprintf("%s:%d", id, expires)
 	mac := hmac.New(sha256.New, []byte(s.secret))
 	mac.Write([]byte(data))
 	return hex.EncodeToString(mac.Sum(nil))
 }
 
-func (s *URLService) GenerateDownloadURL(fileUUID string) string {
+func (s *URLService) GenerateDownloadURL(resourceUUID string) string {
 	expires := time.Now().Add(s.expiryDuration).Unix()
-	sig := s.sign(fileUUID, expires)
+	sig := s.sign(resourceUUID, expires)
 
 	return fmt.Sprintf(
-		"%s/api/v1/files/download/%s?expires=%d&sig=%s",
+		"%s/api/v1/resources/download/%s?expires=%d&sig=%s",
 		s.serverHost,
-		fileUUID,
+		resourceUUID,
 		expires,
 		sig,
 	)
 }
 
-func (s *URLService) GenerateThumbnailURL(thumbUUID string) string {
+func (s *URLService) GenerateVariantURL(variantUUID string) string {
 	expires := time.Now().Add(s.expiryDuration).Unix()
-	sig := s.sign(thumbUUID, expires)
+	sig := s.sign(variantUUID, expires)
 
 	return fmt.Sprintf(
-		"%s/api/v1/thumbnails/%s?expires=%d&sig=%s",
+		"%s/api/v1/variants/%s?expires=%d&sig=%s",
 		s.serverHost,
-		thumbUUID,
+		variantUUID,
 		expires,
 		sig,
 	)
 }
 
-func (s *URLService) Validate(fileID, sig string, expires int64) bool {
+func (s *URLService) Validate(id, sig string, expires int64) bool {
 	if time.Now().Unix() > expires {
 		return false
 	}
-	expected := s.sign(fileID, expires)
+	expected := s.sign(id, expires)
 	return hmac.Equal([]byte(sig), []byte(expected))
 }