commit 4f14fe0d59703c3cf85a31c01582c508190bfc2f
Author: suhan1996 <hs2657@nyu.edu>
Date:   Fri Mar 3 12:03:14 2023 -0500

    remove fcm official

diff --git a/.env b/.env
new file mode 100644
index 0000000..7e6d674
--- /dev/null
+++ b/.env
@@ -0,0 +1 @@
+DATABASE_URL=sqlite:./data/db/db.sqlite
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..60165f0
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,193 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+    branches-ignore:
+      - "main"
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - build: linux
+            os: ubuntu-latest
+            rust: stable
+            target: x86_64-unknown-linux-musl
+            pre_install: sudo apt-get install -y rsync
+          - build: macos
+            os: macos-latest
+            rust: stable
+            target: x86_64-apple-darwin
+            pre_install: brew install rsync
+          #          - build: macos-arm
+          #            os: macos-latest
+          #            rust: stable
+          #            target: aarch64-apple-darwin
+          #            cross: true
+          #            pre_install: brew install rsync
+          - build: arm-v7
+            os: ubuntu-latest
+            rust: stable
+            target: armv7-unknown-linux-musleabihf
+            cross: true
+            pre_install: sudo apt-get install -y rsync
+          - build: aarch64
+            os: ubuntu-latest
+            rust: stable
+            target: aarch64-unknown-linux-musl
+            cross: true
+            pre_install: sudo apt-get install -y rsync
+    steps:
+      - name: Install SSH Key
+        uses: shimataro/ssh-key-action@v2
+        with:
+          key: ${{ secrets.NEW_GEN_ACTIONS_PRIVATE_KEY }}
+          known_hosts: ${{ secrets.VOCECHAT_COM_HOST }}
+      - name: Adding Known Hosts
+        run: ssh-keyscan -H "${{ secrets.VOCECHAT_COM_HOST }}" >> ~/.ssh/known_hosts
+      - name: Install rsync
+        run: ${{ matrix.pre_install }}
+      - uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+      - uses: actions/checkout@v3
+      - uses: actions-rs/cargo@v1
+        with:
+          use-cross: true
+          command: build
+          args: --release --target ${{ matrix.target }}
+      - run: |
+          cp target/${{ matrix.target }}/release/vocechat-server ./vocechat-server
+          zip -r ./vocechat-server-${{ github.ref_name}}-${{ matrix.target }}.zip ./vocechat-server config
+      - name: Set AWS credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ secrets.AWS_REGION }}
+      - if: matrix.target == 'x86_64-unknown-linux-musl'
+        run: |
+          docker -v
+          cp -rf target/${{ matrix.target }}/release/vocechat-server build/docker/
+          cd build/docker
+          cp -rf ../../config ./
+          docker login -u privoce -p ${{ secrets.DOCKER_PASSWORD }}
+          
+          # build latest
+          docker build -t vocechat-server:latest .
+          docker tag vocechat-server:latest privoce/vocechat-server:latest
+          docker push privoce/vocechat-server:latest
+          
+          # build version
+          docker build -t vocechat-server:${{ github.ref_name}} .
+          docker tag vocechat-server:${{ github.ref_name}} privoce/vocechat-server:${{ github.ref_name}}
+          docker push privoce/vocechat-server:${{ github.ref_name}}
+          
+          aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 384878476649.dkr.ecr.us-east-1.amazonaws.com
+          docker build --platform linux/amd64 -t 384878476649.dkr.ecr.us-east-1.amazonaws.com/vocechat-server:latest .
+          docker push 384878476649.dkr.ecr.us-east-1.amazonaws.com/vocechat-server:latest
+          
+          docker build --platform linux/amd64 -t 384878476649.dkr.ecr.us-east-1.amazonaws.com/vocechat-server:${{ github.ref_name}} .
+          docker push 384878476649.dkr.ecr.us-east-1.amazonaws.com/vocechat-server:${{ github.ref_name}}
+      - if: matrix.target == 'aarch64-unknown-linux-musl'
+        run: |
+          docker -v
+          cp -rf target/${{ matrix.target }}/release/vocechat-server build/docker/
+          cd build/docker
+          cp -rf ../../config ./
+          docker login -u privoce -p ${{ secrets.DOCKER_PASSWORD }}
+          
+          # build latest
+          sudo apt install -y qemu-user-static binfmt-support
+          sed -i "s/alpine/arm64v8\/alpine/ig" Dockerfile
+          sed -i "s/busybox/arm64v8\/busybox/ig" Dockerfile
+          docker buildx build -t vocechat-server:latest-arm64 --platform linux/arm64 .
+          docker tag vocechat-server:latest-arm64 privoce/vocechat-server:latest-arm64
+          docker push privoce/vocechat-server:latest-arm64
+          
+          # build version
+          docker buildx build -t vocechat-server:${{ github.ref_name}}-arm64 --platform linux/arm64 .
+          docker tag vocechat-server:${{ github.ref_name}}-arm64 privoce/vocechat-server:${{ github.ref_name}}-arm64
+          docker push privoce/vocechat-server:${{ github.ref_name}}-arm64
+      - name: rsync to sh.voce.chat
+        run: |
+          rsync -av vocechat-server-${{ github.ref_name}}-${{ matrix.target }}.zip root@${{ secrets.VOCECHAT_COM_HOST }}:/home/wwwroot/sh.voce.chat/vocechat-server-${{ github.ref_name}}-${{ matrix.target }}.zip
+      - name: Upload Artifact
+        uses: actions/upload-artifact@v2
+        with:
+          name: vocechat-server-${{ github.ref_name}}-${{ matrix.target }}
+          path: vocechat-server-${{ github.ref_name}}-${{ matrix.target }}.zip
+  release:
+    runs-on: ubuntu-latest
+    needs: build
+    outputs:
+      upload_url: ${{ steps.create_release.outputs.upload_url }}
+    steps:
+      #      - uses: dev-drprasad/delete-tag-and-release@v0.2.0
+      #        with:
+      #          delete_release: true
+      #          tag_name: ${{ github.ref_name }}
+      #        env:
+      #          GITHUB_TOKEN: ${{ secrets.THE_GITHUB_TOKEN }}
+      - uses: actions/checkout@v3
+      - name: Create Release
+        id: create_release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.THE_GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ github.ref_name }}
+          release_name: Release ${{ github.ref_name }}
+          draft: false
+          prerelease: false
+  add:
+    runs-on: ubuntu-latest
+    needs: [build, release]
+    strategy:
+      matrix:
+        include:
+          - build: linux
+            os: ubuntu-latest
+            rust: stable
+            target: x86_64-unknown-linux-musl
+          - build: macos
+            os: macos-latest
+            rust: stable
+            target: x86_64-apple-darwin
+          #          - build: macos-arm
+          #            os: macos-latest
+          #            rust: stable
+          #            target: aarch64-apple-darwin
+          #            cross: true
+          #            pre_install: brew install rsync
+          - build: arm-v7
+            os: ubuntu-latest
+            rust: stable
+            target: armv7-unknown-linux-musleabihf
+            cross: true
+          - build: aarch64
+            os: ubuntu-latest
+            rust: stable
+            target: aarch64-unknown-linux-musl
+            cross: true
+    steps:
+      - uses: actions/checkout@v2
+      - name: Download Artifact
+        uses: actions/download-artifact@v2
+        with:
+          name: vocechat-server-${{ github.ref_name}}-${{ matrix.target }}
+      - name: Upload Artifact to Release
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.THE_GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ needs.release.outputs.upload_url }}
+          asset_path: ./vocechat-server-${{ github.ref_name}}-${{ matrix.target }}.zip
+          asset_name: vocechat-server-${{ github.ref_name}}-${{ matrix.target }}.zip
+          asset_content_type: application/zip
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..d5dbe65
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,8 @@
+target
+/data
+.idea
+build/docker/config
+build/docker/wwwroot
+build/docker/*.zip
+build/docker/vocechat-server
+wwwroot
\ No newline at end of file
diff --git a/.rustfmt.toml b/.rustfmt.toml
new file mode 100644
index 0000000..ce8ff6c
--- /dev/null
+++ b/.rustfmt.toml
@@ -0,0 +1,12 @@
+edition = "2021"
+newline_style = "unix"
+# comments
+normalize_comments = true
+wrap_comments = true
+format_code_in_doc_comments = true
+# imports
+imports_granularity = "Crate"
+group_imports = "StdExternalCrate"
+# report
+#report_fixme = "Unnumbered"
+#report_todo = "Unnumbered"
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000..d76e1eb
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,5133 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "aead"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c192eb8f11fc081b0fe4259ba5af04217d4e0faddd02417310a927911abd7c8"
+dependencies = [
+ "crypto-common",
+ "generic-array 0.14.6",
+]
+
+[[package]]
+name = "aes"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "433cfd6710c9986c576a25ca913c39d66a6474107b406f34f91d4a8923395241"
+dependencies = [
+ "cfg-if",
+ "cipher",
+ "cpufeatures",
+]
+
+[[package]]
+name = "aes-gcm"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82e1366e0c69c9f927b1fa5ce2c7bf9eafc8f9268c0b9800729e8b267612447c"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
+[[package]]
+name = "agora-token"
+version = "0.1.0"
+dependencies = [
+ "base64 0.13.1",
+ "checksum",
+ "fastrand",
+ "hmac 0.11.0",
+ "sha2 0.9.9",
+ "thiserror",
+]
+
+[[package]]
+name = "ahash"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcb51a0695d8f838b1ee009b3fbf66bda078cd64590202a864a8f3e8c4315c47"
+dependencies = [
+ "getrandom 0.2.8",
+ "once_cell",
+ "version_check",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc936419f96fa211c1b9166887b38e5e40b19958e5b895be7c1f93adec7071ac"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.66"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "216261ddc8289130e551ddcd5ce8a064710c0d064a4d2895c67151c92b5443f6"
+
+[[package]]
+name = "anymap2"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d301b3b94cb4b2f23d7917810addbbaff90738e0ca2be692bd027e70d7e0330c"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8da52d66c7071e2e3fa2a1e5c6d088fec47b593032b254f5e980de8ea54454d6"
+
+[[package]]
+name = "asn1-rs"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf6690c370453db30743b373a60ba498fc0d6d83b11f4abfd87a84a075db5dd4"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror",
+ "time 0.3.17",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "726535892e8eae7e70657b4c8ea93d26b8553afb1ce617caee529ef96d7dee6c"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2777730b2039ac0f95f093556e61b6d26cebed5393ca6f152717777cec3a42ed"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cda8f4bcc10624c4e85bc66b3f452cca98cfa5ca002dc83a16aad2367641bea"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dad5c83079eae9969be7fadefe640a1c566901f05ff91ab221de4b6f68d9507e"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10f203db73a71dfa2fb6dd22763990fa26f3d2625a6da2da900d23b87d26be27"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.59"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31e6e93155431f3931513b243d371981bb2770112b370c82745a1d19d2f99364"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "atoi"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "616896e05fc0e2649463a93a15183c6a16bf03413a7af88ef1285ddedfa9cda5"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dde43e75fd43e8a1bf86103336bc699aa8d17ad1be60c76c0bdfd4828e19b78"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "base64"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3441f0f7b02788e948e47f457ca01f1d7e6d92c693bc132c22b087d3141c03ff"
+
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
+[[package]]
+name = "base64ct"
+version = "1.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b645a089122eccb6111b4f81cbc1a49f5900ac4666bb93ac027feaecf15607bf"
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bit_field"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcb6dd1c2376d2e096796e234a70e17e94cc2d5d54ff8ce42b28cef1d0d359a4"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitvec"
+version = "0.20.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7774144344a4faa177370406a7ff5f1da24303817368584c6206c8303eb07848"
+dependencies = [
+ "funty",
+ "radium",
+ "tap",
+ "wyz",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "block-padding",
+ "generic-array 0.14.6",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cce20737498f97b993470a6e536b8523f0af7892a4f928cceb1ac5e52ebe7e"
+dependencies = [
+ "generic-array 0.14.6",
+]
+
+[[package]]
+name = "block-padding"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d696c370c750c948ada61c69a0ee2cbbb9c50b1019ddb86d9317157a99c2cae"
+
+[[package]]
+name = "boxfnonce"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5988cb1d626264ac94100be357308f29ff7cbdd3b36bda27f450a4ee3f713426"
+
+[[package]]
+name = "bs58"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "771fe0050b883fcc3ea2359b1a96bcfbc090b7116eae7c3c512c7a083fdf23d3"
+
+[[package]]
+name = "bstr"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3569f383e8f1598449f1a423e72e99569137b47740b1da11ef19af3d5c3223"
+dependencies = [
+ "lazy_static",
+ "memchr",
+ "regex-automata",
+ "serde",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "572f695136211188308f16ad2ca5c851a712c464060ae6974944458eb83880ba"
+
+[[package]]
+name = "byte-slice-cast"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3ac9f8b63eca6fd385229b3675f6cc0dc5c8a5c8a54a59d4f52ffd670d87b0c"
+
+[[package]]
+name = "bytemuck"
+version = "1.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaa3a8d9a1ca92e282c96a32d6511b695d7d994d1d102ba85d279f9b2756947f"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "bytes"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e4cec68f03f32e44924783795810fa50a7035d8c8ebe78580ad7e6c703fba38"
+
+[[package]]
+name = "bytes"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfb24e866b15a1af2a1b663f10c6b6b8f397a84aadb828f12e5b289ec23a3a3c"
+
+[[package]]
+name = "cast"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
+
+[[package]]
+name = "cc"
+version = "1.0.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e9f73505338f7d905b19d18738976aae232eb46b8efc15554ffc56deb5d9ebe4"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "checksum"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5c24f6a463e9973db3df3c2cc276f689f5baf289c87a693dc859e004d3eb45f"
+
+[[package]]
+name = "chrono"
+version = "0.4.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16b0a3d9ed01224b22057780a37bb8c5dbfe1be8ba48678e7bf57ec4b385411f"
+dependencies = [
+ "iana-time-zone",
+ "js-sys",
+ "num-integer",
+ "num-traits",
+ "serde",
+ "time 0.1.45",
+ "wasm-bindgen",
+ "winapi",
+]
+
+[[package]]
+name = "cipher"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1873270f8f7942c191139cb8a40fd228da6c3fd2fc376d7e92d47aa14aeb59e"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "clap"
+version = "2.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
+dependencies = [
+ "bitflags",
+ "textwrap 0.11.0",
+ "unicode-width",
+]
+
+[[package]]
+name = "clap"
+version = "3.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71655c45cb9845d3270c9d6df84ebe72b4dad3c2ba3f7023ad47c144e4e473a5"
+dependencies = [
+ "atty",
+ "bitflags",
+ "clap_derive",
+ "clap_lex",
+ "indexmap",
+ "once_cell",
+ "strsim",
+ "termcolor",
+ "textwrap 0.16.0",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea0c8bce528c4be4da13ea6fead8965e95b6073585a2f05204bd8f4119f82a65"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "cloudabi"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "codespan-reporting"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3538270d33cc669650c4b093848450d380def10c331d38c768e34cac80576e6e"
+dependencies = [
+ "termcolor",
+ "unicode-width",
+]
+
+[[package]]
+name = "color_quant"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d7b894f5411737b7867f4827955924d7c254fc9f4d91a6aad6b097804b1018b"
+
+[[package]]
+name = "const-oid"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4c78c047431fee22c1a7bb92e00ad095a02a983affe4d8a72e2a2c62c1b94f3"
+
+[[package]]
+name = "convert_case"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6245d59a3e82a7fc217c5828a6692dbc6dfb63a0c8c90495621f7b9d79704a0e"
+
+[[package]]
+name = "cookie"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "344adc371239ef32293cb1c4fe519592fcf21206c79c02854320afcdf3ab4917"
+dependencies = [
+ "aes-gcm",
+ "base64 0.13.1",
+ "hkdf",
+ "hmac 0.12.1",
+ "percent-encoding 2.2.0",
+ "rand 0.8.5",
+ "sha2 0.10.6",
+ "subtle",
+ "time 0.3.17",
+ "version_check",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49fc9a695bca7f35f5f4c15cddc84415f66a74ea78eef08e90c5024f2b540e23"
+dependencies = [
+ "crc-catalog",
+]
+
+[[package]]
+name = "crc-catalog"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccaeedb56da03b09f598226e25e80088cb4cd25f316e6e4df7d695f0feeb1403"
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "criterion"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b01d6de93b2b6c65e17c634a26653a29d107b3c98c607c765bf38d041531cd8f"
+dependencies = [
+ "atty",
+ "cast",
+ "clap 2.34.0",
+ "criterion-plot",
+ "csv",
+ "itertools",
+ "lazy_static",
+ "num-traits",
+ "oorandom",
+ "plotters",
+ "rayon",
+ "regex",
+ "serde",
+ "serde_cbor",
+ "serde_derive",
+ "serde_json",
+ "tinytemplate",
+ "walkdir",
+]
+
+[[package]]
+name = "criterion-plot"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2673cc8207403546f45f5fd319a974b1e6983ad1a3ee7e6041650013be041876"
+dependencies = [
+ "cast",
+ "itertools",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2dd04ddaf88237dc3b8d8f9a3c1004b506b54b3313403944054d23c0870c521"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "715e8152b692bba2d374b53d4875445368fdf21a94751410af607a5ac677d1fc"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a9af1f4c2ef74bb8aa1f7e19706bc72d03598c8a570bb5de72243c7a9d9d5a"
+dependencies = [
+ "autocfg 1.1.0",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1cfb3ea8a53f37c40dea2c7bedcbd88bdfae54f5e2175d6ecaff1c988353add"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb766fa798726286dbbb842f174001dab8abc7b627a1dd86e0b7222a95d929f"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crunchy"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a81dae078cea95a014a339291cec439d2f232ebe854a9d672b796c6afafa9b7"
+
+[[package]]
+name = "crypto-bigint"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03c6a1d5fa1de37e071642dfa44ec552ca5b299adb128fab16138e24b548fd21"
+dependencies = [
+ "generic-array 0.14.6",
+ "subtle",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array 0.14.6",
+ "rand_core 0.6.4",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-mac"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1d1a86f49236c215f271d40892d5fc950490551400b02ef360692c29815c714"
+dependencies = [
+ "generic-array 0.14.6",
+ "subtle",
+]
+
+[[package]]
+name = "csv"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22813a6dc45b335f9bade10bf7271dc477e81113e89eb251a0bc2a8a81c536e1"
+dependencies = [
+ "bstr",
+ "csv-core",
+ "itoa 0.4.8",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b2466559f260f48ad25fe6317b3c8dac77b5bdb5763ac7d9d6103530663bc90"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
+[[package]]
+name = "cxx"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4a41a86530d0fe7f5d9ea779916b7cadd2d4f9add748b99c2c029cbbdfaf453"
+dependencies = [
+ "cc",
+ "cxxbridge-flags",
+ "cxxbridge-macro",
+ "link-cplusplus",
+]
+
+[[package]]
+name = "cxx-build"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06416d667ff3e3ad2df1cd8cd8afae5da26cf9cec4d0825040f88b5ca659a2f0"
+dependencies = [
+ "cc",
+ "codespan-reporting",
+ "once_cell",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "scratch",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "cxxbridge-flags"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "820a9a2af1669deeef27cb271f476ffd196a2c4b6731336011e0ba63e2c7cf71"
+
+[[package]]
+name = "cxxbridge-macro"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a08a6e2fcc370a089ad3b4aaf54db3b1b4cee38ddabce5896b33eb693275f470"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "daemonize"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70c24513e34f53b640819f0ac9f705b673fcf4006d7aab8778bee72ebfc89815"
+dependencies = [
+ "boxfnonce",
+ "libc",
+]
+
+[[package]]
+name = "darling"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0dd3cd20dc6b5a876612a6e5accfe7f3dd883db6d07acfbf14c128f61550dfa"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a784d2ccaf7c98501746bf0be29b2022ba41fd62a2e622af997a03e9f972859f"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "strsim",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7618812407e9402654622dd402b0a89dff9ba93badd6540781526117b92aab7e"
+dependencies = [
+ "darling_core",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ee2393c4a91429dffb4bedf19f4d6abf27d8a732c8ce4980305d782e5426d57"
+
+[[package]]
+name = "der"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6919815d73839e7ad218de758883aae3a257ba6759ce7a9992501efbb53d705c"
+dependencies = [
+ "const-oid",
+ "crypto-bigint",
+ "pem-rfc7468",
+]
+
+[[package]]
+name = "der-oid-macro"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c73af209b6a5dc8ca7cbaba720732304792cddc933cfea3d74509c2b1ef2f436"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "der-parser"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cddf120f700b411b2b02ebeb7f04dc0b7c8835909a6c2f52bf72ed0dd3433b2"
+dependencies = [
+ "der-oid-macro",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "der-parser"
+version = "8.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42d4bc9b0db0a0df9ae64634ac5bdefb7afcb534e182275ca0beadbe486701c1"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "derive_more"
+version = "0.99.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb810d30a7c1953f91334de7244731fc3f3c10d7fe163338a35b9f640960321"
+dependencies = [
+ "convert_case",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "rustc_version",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "digest"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3d0c8c8752312f9713efd397ff63acb9f85585afbf179282e720e7704954dd5"
+dependencies = [
+ "generic-array 0.12.4",
+]
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array 0.14.6",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
+dependencies = [
+ "block-buffer 0.10.3",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bf95dc3f046b9da4f2d51833c0d3547d8564ef6910f5c1ed130306a75b92886"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "dotenv"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
+
+[[package]]
+name = "either"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90e5c1c8368803113bf0c9584fc495a58b86dc8a29edbf8fe877d21d9507e797"
+
+[[package]]
+name = "email-encoding"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34dd14c63662e0206599796cd5e1ad0268ab2b9d19b868d6050d688eba2bbf98"
+dependencies = [
+ "base64 0.13.1",
+ "memchr",
+]
+
+[[package]]
+name = "email_address"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2153bd83ebc09db15bcbdc3e2194d901804952e3dc96967e1cd3b0c5c32d112"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9852635589dc9f9ea1b6fe9f05b50ef208c85c834a562f0c6abb1c475736ec2b"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "envy"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f47e0157f2cb54f5ae1bd371b30a2ae4311e1c028f575cd4e81de7353215965"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "ethabi"
+version = "16.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4c98847055d934070b90e806e12d3936b787d0a115068981c1d8dfd5dfef5a5"
+dependencies = [
+ "ethereum-types",
+ "hex",
+ "serde",
+ "serde_json",
+ "sha3",
+ "thiserror",
+ "uint",
+]
+
+[[package]]
+name = "ethbloom"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfb684ac8fa8f6c5759f788862bb22ec6fe3cb392f6bfd08e3c64b603661e3f8"
+dependencies = [
+ "crunchy",
+ "fixed-hash",
+ "impl-rlp",
+ "impl-serde",
+ "tiny-keccak",
+]
+
+[[package]]
+name = "ethereum-types"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05136f7057fe789f06e6d41d07b34e6f70d8c86e5693b60f97aaa6553553bdaf"
+dependencies = [
+ "ethbloom",
+ "fixed-hash",
+ "impl-rlp",
+ "impl-serde",
+ "primitive-types",
+ "uint",
+]
+
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
+[[package]]
+name = "exr"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eb5f255b5980bb0c8cf676b675d1a99be40f316881444f44e0462eaf5df5ded"
+dependencies = [
+ "bit_field",
+ "flume",
+ "half 2.1.0",
+ "lebe",
+ "miniz_oxide",
+ "smallvec",
+ "threadpool",
+]
+
+[[package]]
+name = "fastrand"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a407cfaa3385c4ae6b23e84623d48c2798d06e3e6a1878f7f59f17b3f86499"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "fixed-hash"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcf0ed7fe52a17a03854ec54a9f76d6d84508d1c0e66bc1793301c73fc8493c"
+dependencies = [
+ "byteorder",
+ "rand 0.8.5",
+ "rustc-hex",
+ "static_assertions",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8a2db397cb1c8772f31494cb8917e48cd1e64f0fa7efac59fbd741a0a8ce841"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "fluent"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61f69378194459db76abd2ce3952b790db103ceb003008d3d50d97c41ff847a7"
+dependencies = [
+ "fluent-bundle",
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-bundle"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e242c601dec9711505f6d5bbff5bedd4b61b2469f2e8bb8e57ee7c9747a87ffd"
+dependencies = [
+ "fluent-langneg",
+ "fluent-syntax",
+ "intl-memoizer",
+ "intl_pluralrules",
+ "rustc-hash",
+ "self_cell",
+ "smallvec",
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-langneg"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c4ad0989667548f06ccd0e306ed56b61bd4d35458d54df5ec7587c0e8ed5e94"
+dependencies = [
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-syntax"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0abed97648395c902868fee9026de96483933faa54ea3b40d652f7dfe61ca78"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "flume"
+version = "0.10.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1657b4441c3403d9f7b3409e47575237dac27b1b5726df654a6ecbf92f0f7577"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "nanorand",
+ "pin-project 1.0.12",
+ "spin 0.9.4",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+dependencies = [
+ "percent-encoding 2.2.0",
+]
+
+[[package]]
+name = "fs2"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "funty"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fed34cd105917e91daa4da6b3728c47b068749d6a62c59811f06ed2ac71d9da7"
+
+[[package]]
+name = "futf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
+dependencies = [
+ "mac",
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38390104763dc37a5145a53c29c63c1290b5d316d6086ec32c293f6736051bb0"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ba265a92256105f45b719605a571ffe2d1f0fea3807304b522c1d778f79eed"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04909a7a7e4633ae6c4a9ab280aeb86da1236243a77b694a49eacd659a4bd3ac"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7acc85df6714c176ab5edf386123fafe217be88c0840ec11f199441134a074e2"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-intrusive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a604f7a68fbf8103337523b1fadc8ade7361ee3f112f7c680ad179651616aed5"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot 0.11.2",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00f5fb52a06bdcadeb54e8d3671f8888a39697dcb0b81b23b55174030427f4eb"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bdfb8ce053d86b91919aad980c220b1fb8401a9394410e1c289ed7e66b61835d"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39c15cf1a4aa79df40f1bb462fb39676d0ad9e366c2a33b590d7c66f4f81fcf9"
+
+[[package]]
+name = "futures-task"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ffb393ac5d9a6eaa9d3fdf37ae2776656b706e200c8e16b1bdb227f5198e6ea"
+
+[[package]]
+name = "futures-timer"
+version = "3.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e64b03909df88034c26dc1547e8970b91f98bdb65165d6a4e9110d94263dbb2c"
+
+[[package]]
+name = "futures-util"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "197676987abd2f9cadff84926f410af1c183608d36641465df73ae8211dc65d6"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "futures_codec"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce54d63f8b0c75023ed920d46fd71d0cbbb830b0ee012726b5b4f506fb6dea5b"
+dependencies = [
+ "bytes 0.5.6",
+ "futures",
+ "memchr",
+ "pin-project 0.4.30",
+]
+
+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffdf9f34f1447443d37393cc6c2b8313aebddcd96906caf34e54c68d8e57d7bd"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "ghash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d930750de5717d2dd0b8c0d42c076c0e884c81a73e6cab859bbd2339c71e3e40"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
+[[package]]
+name = "gif"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3edd93c6756b4dfaf2709eafcc345ba2636565295c198a9cfbf75fa5e3e00b06"
+dependencies = [
+ "color_quant",
+ "weezl",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f9f29bc9dda355256b2916cf526ab02ce0aeaaaf2bad60d65ef3f12f11dd0f4"
+dependencies = [
+ "bytes 1.3.0",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "half"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eabb4a44450da02c90444cf74558da904edde8fb4e9035a9a6a4e15445af0bd7"
+
+[[package]]
+name = "half"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad6a9459c9c30b177b925162351f97e7d967c7ea8bab3b8352805327daf45554"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab5ef0d4909ef3724cc8cce6ccc8572c5c817592e9285f5464f8e86f8bd3726e"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashlink"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7249a3129cbc1ffccd74857f81464a323a152173cdb134e0fd81bc803b29facf"
+dependencies = [
+ "hashbrown 0.11.2",
+]
+
+[[package]]
+name = "headers"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3e372db8e5c0d213e0cd0b9be18be2aca3d44cf2fe30a9d46a65581cd454584"
+dependencies = [
+ "base64 0.13.1",
+ "bitflags",
+ "bytes 1.3.0",
+ "headers-core",
+ "http",
+ "httpdate",
+ "mime",
+ "sha1",
+]
+
+[[package]]
+name = "headers-core"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429"
+dependencies = [
+ "http",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hkdf"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791a029f6b9fc27657f6f188ec6e5e43f6911f6f878e0dc5501396e09809d437"
+dependencies = [
+ "hmac 0.12.1",
+]
+
+[[package]]
+name = "hmac"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a2a2320eb7ec0ebe8da8f744d7812d9fc4cb4d09344ac01898dbcb6a20ae69b"
+dependencies = [
+ "crypto-mac",
+ "digest 0.9.0",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "hostname"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867"
+dependencies = [
+ "libc",
+ "match_cfg",
+ "winapi",
+]
+
+[[package]]
+name = "html5ever"
+version = "0.22.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c213fa6a618dc1da552f54f85cba74b05d8e883c92ec4e89067736938084c26e"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+ "proc-macro2 0.4.30",
+ "quote 0.6.13",
+ "syn 0.15.44",
+]
+
+[[package]]
+name = "http"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75f43d41e26995c17e71ee126451dd3941010b0514a81a9d11f3b341debc2399"
+dependencies = [
+ "bytes 1.3.0",
+ "fnv",
+ "itoa 1.0.4",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+dependencies = [
+ "bytes 1.3.0",
+ "http",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+
+[[package]]
+name = "httpdate"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+
+[[package]]
+name = "hyper"
+version = "0.14.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "034711faac9d2166cb1baf1a2fb0b60b1f277f8492fd72176c17f3515e1abd3c"
+dependencies = [
+ "bytes 1.3.0",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa 1.0.4",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59df7c4e19c950e6e0e868dcc0a300b09a9b88e9ec55bd879ca819087a77355d"
+dependencies = [
+ "http",
+ "hyper",
+ "log",
+ "rustls 0.20.7",
+ "rustls-native-certs",
+ "tokio",
+ "tokio-rustls 0.23.4",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.53"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64c122667b287044802d6ce17ee2ddf13207ed924c712de9a66a5814d5b64765"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "winapi",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0703ae284fc167426161c2e3f1da3ea71d94b21bedbcc9494e92b28e334e3dca"
+dependencies = [
+ "cxx",
+ "cxx-build",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38f09e0f0b1fb55fdee1f17470ad800da77af5186a1a76c026b679358b7e844e"
+dependencies = [
+ "matches",
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "idna"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "418a0a6fab821475f634efe3ccc45c013f742efe03d853e8d3355d5cb850ecf8"
+dependencies = [
+ "matches",
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "image"
+version = "0.24.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69b7ea949b537b0fd0af141fff8c77690f2ce96f4f41f042ccb6c69c6c965945"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+ "color_quant",
+ "exr",
+ "gif",
+ "jpeg-decoder",
+ "num-rational",
+ "num-traits",
+ "png",
+ "scoped_threadpool",
+ "tiff",
+]
+
+[[package]]
+name = "impl-codec"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "161ebdfec3c8e3b52bf61c4f3550a1eea4f9579d10dc1b936f3171ebdcd6c443"
+dependencies = [
+ "parity-scale-codec",
+]
+
+[[package]]
+name = "impl-rlp"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f28220f89297a075ddc7245cd538076ee98b01f2a9c23a53a4f1105d5a322808"
+dependencies = [
+ "rlp",
+]
+
+[[package]]
+name = "impl-serde"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4551f042f3438e64dbd6226b20527fc84a6e1fe65688b58746a2f53623f25f5c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "impl-trait-for-tuples"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11d7a9f6330b71fea57921c9b61c47ee6e84f72d394754eff6163ae67e7395eb"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885e79c1fc4b10f0e172c475f458b7f7b93061064d98c3293e98c5ba0c8b399"
+dependencies = [
+ "autocfg 1.1.0",
+ "hashbrown 0.12.3",
+]
+
+[[package]]
+name = "inout"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0c10553d664a4d0bcff9f4215d0aac67a639cc68ef660840afe309b807bc9f5"
+dependencies = [
+ "generic-array 0.14.6",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "intl-memoizer"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c310433e4a310918d6ed9243542a6b83ec1183df95dff8f23f87bb88a264a66f"
+dependencies = [
+ "type-map",
+ "unic-langid",
+]
+
+[[package]]
+name = "intl_pluralrules"
+version = "7.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "078ea7b7c29a2b4df841a7f6ac8775ff6074020c6776d48491ce2268e068f972"
+dependencies = [
+ "unic-langid",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f88c5561171189e69df9d98bcf18fd5f9558300f7ea7b801eb8a0fd748bd8745"
+
+[[package]]
+name = "itertools"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71991ff56294aa922b450139ee08b3bfc70982c6b2c7562771375cf73542dd4"
+
+[[package]]
+name = "itoa"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4217ad341ebadf8d8e724e264f13e593e0648f5b3e94b3896a5df283be015ecc"
+
+[[package]]
+name = "jpeg-decoder"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc0000e42512c92e31c2252315bda326620a4e034105e900c98ec492fa077b3e"
+dependencies = [
+ "rayon",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jsonrpc-core"
+version = "18.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14f7f76aef2d054868398427f6c54943cf3d1caa9a7ec7d0c38d69df97a965eb"
+dependencies = [
+ "futures",
+ "futures-executor",
+ "futures-util",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+]
+
+[[package]]
+name = "jsonwebtoken"
+version = "8.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aa4b4af834c6cfd35d8763d359661b90f2e45d8f750a0849156c7f4671af09c"
+dependencies = [
+ "base64 0.13.1",
+ "pem",
+ "ring",
+ "serde",
+ "serde_json",
+ "simple_asn1",
+]
+
+[[package]]
+name = "jwt"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98328bb4f360e6b2ceb1f95645602c7014000ef0c3809963df8ad3a3a09f8d99"
+dependencies = [
+ "base64 0.13.1",
+ "crypto-mac",
+ "digest 0.9.0",
+ "hmac 0.11.0",
+ "serde",
+ "serde_json",
+ "sha2 0.9.9",
+]
+
+[[package]]
+name = "keccak"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3afef3b6eff9ce9d8ff9b3601125eec7f0c8cbac7abd14f355d053fa56c98768"
+dependencies = [
+ "cpufeatures",
+]
+
+[[package]]
+name = "kstring"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b310ccceade8121d7d77fee406160e457c2f4e7c7982d589da3499bc7ea4526"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+dependencies = [
+ "spin 0.5.2",
+]
+
+[[package]]
+name = "lebe"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03087c2bad5e1034e8cace5926dec053fb3790248370865f5117a7d0213354c8"
+
+[[package]]
+name = "lettre"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eabca5e0b4d0e98e7f2243fb5b7520b6af2b65d8f87bcc86f2c75185a6ff243"
+dependencies = [
+ "async-trait",
+ "base64 0.13.1",
+ "email-encoding",
+ "email_address",
+ "fastrand",
+ "futures-io",
+ "futures-util",
+ "hostname",
+ "httpdate",
+ "idna 0.2.3",
+ "mime",
+ "nom",
+ "once_cell",
+ "quoted_printable",
+ "rustls 0.20.7",
+ "rustls-pemfile 1.0.1",
+ "socket2",
+ "tokio",
+ "tokio-rustls 0.23.4",
+ "webpki-roots 0.22.5",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.137"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc7fcc620a3bff7cdd7a365be3376c97191aeaccc2a603e600951e452615bf89"
+
+[[package]]
+name = "libm"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "348108ab3fba42ec82ff6e9564fc4ca0247bdccdc68dd8af9764bbc79c3c8ffb"
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "898745e570c7d0453cc1fbc4a701eb6c662ed54e8fec8b7d14be137ebeeb9d14"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "link-cplusplus"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9272ab7b96c9046fbc5bc56c06c117cb639fe2d509df0c421cad82d2915cf369"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "liquid"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26e930310cf4334c4936ae18737500a57739c69442b5c42bae114d619af54b82"
+dependencies = [
+ "doc-comment",
+ "kstring",
+ "liquid-core",
+ "liquid-derive",
+ "liquid-lib",
+ "serde",
+]
+
+[[package]]
+name = "liquid-core"
+version = "0.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eae470f061bfc53607283906de925ab67ed57a341e827146e3b241699a1dcde"
+dependencies = [
+ "anymap2",
+ "chrono",
+ "itertools",
+ "kstring",
+ "liquid-derive",
+ "num-traits",
+ "pest",
+ "pest_derive",
+ "serde",
+]
+
+[[package]]
+name = "liquid-derive"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6510e456700da1afe07603913b0da5a2595f2482656ade07abf719aae7501f0a"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "proc-quote",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "liquid-lib"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6341259f779ff663bdf1fc478bddb2ca51fda25414006dc69395eddfac07e0a4"
+dependencies = [
+ "chrono",
+ "itertools",
+ "kstring",
+ "liquid-core",
+ "once_cell",
+ "percent-encoding 2.2.0",
+ "regex",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+dependencies = [
+ "autocfg 1.1.0",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "mac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
+
+[[package]]
+name = "markup5ever"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897636f9850c3eef4905a5540683ed53dc9393860f0846cab2c2ddf9939862ff"
+dependencies = [
+ "phf",
+ "phf_codegen",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "string_cache",
+ "string_cache_codegen",
+ "tendril",
+]
+
+[[package]]
+name = "match_cfg"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4"
+
+[[package]]
+name = "matchers"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matches"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3e378b66a060d48947b590737b30a1be76706c8dd7b8ba0f2fe3989c68a853f"
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a60c7ce501c71e03a9c9c0d35b861413ae925bd979cc7a4e30d060069aaac8d"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4192263c238a5f0d0c6bfd21f336a313a4ce1c450542449ca191bb657b4642ef"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "mio"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d732bc30207a6423068df043e3d02e0735b155ad7ce1a6f76fe2baa5b158de"
+dependencies = [
+ "libc",
+ "log",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "windows-sys 0.42.0",
+]
+
+[[package]]
+name = "multer"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed4198ce7a4cbd2a57af78d28c6fbb57d81ac5f1d6ad79ac6c5587419cbdf22"
+dependencies = [
+ "bytes 1.3.0",
+ "encoding_rs",
+ "futures-util",
+ "http",
+ "httparse",
+ "log",
+ "memchr",
+ "mime",
+ "spin 0.9.4",
+ "tokio",
+ "version_check",
+]
+
+[[package]]
+name = "nanorand"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a51313c5820b0b02bd422f4b44776fbf47961755c74ce64afc73bfad10226c3"
+dependencies = [
+ "getrandom 0.2.8",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4a24736216ec316047a1fc4252e27dabb04218aa4a3f37c6e7ddbf1f9782b54"
+
+[[package]]
+name = "nom"
+version = "7.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8903e5a29a317527874d0402f867152a3d21c908bb0b933e416c65e301d4c36"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f93ab6289c7b344a8a9f60f88d80aa20032336fe78da341afc91c8a2341fc75f"
+dependencies = [
+ "autocfg 1.1.0",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2399c9463abc5f909349d8aa9ba080e0b88b3ce2885389b60b993f39b1a56905"
+dependencies = [
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg 1.1.0",
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d03e6c028c5dc5cac6e2dec0efda81fc887605bb3d884578bb6d6bf7514e252"
+dependencies = [
+ "autocfg 1.1.0",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-rational"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0638a1c9d0a3c0914158145bc76cff373a75a627e6ecbfb71cbe6f453a5a19b0"
+dependencies = [
+ "autocfg 1.1.0",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578ede34cf02f8924ab9447f50c28075b4d3e5b269972345e7e0372b38c6cdcd"
+dependencies = [
+ "autocfg 1.1.0",
+ "libm",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6058e64324c71e02bc2b150e4f3bc8286db6c83092132ffa3f6b1eab0f9def5"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "num_enum"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf5395665662ef45796a4ff5486c5d41d29e0c09640af4c5f17fd94ee2c119c9"
+dependencies = [
+ "num_enum_derive",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0498641e53dd6ac1a4f22547548caa6864cc4933784319cd1775271c5a46ce"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "oauth2"
+version = "4.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eeaf26a72311c087f8c5ba617c96fac67a5c04f430e716ac8d8ab2de62e23368"
+dependencies = [
+ "base64 0.13.1",
+ "chrono",
+ "getrandom 0.2.8",
+ "http",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "sha2 0.10.6",
+ "thiserror",
+ "url 2.3.1",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe554cb2393bc784fd678c82c84cc0599c31ceadc7f03a594911f822cb8d1815"
+dependencies = [
+ "der-parser 6.0.1",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d4bda43fd1b844cbc6e6e54b5444e2b1bc7838bce59ad205902cccbb26d6761"
+dependencies = [
+ "asn1-rs",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86f0b0d4bf799edbc74508c1e8bf170ff5f41238e5f8225603ca7caaae2b7860"
+
+[[package]]
+name = "oorandom"
+version = "11.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+
+[[package]]
+name = "open-graph"
+version = "0.1.0"
+dependencies = [
+ "async-recursion",
+ "flate2",
+ "html5ever",
+ "http",
+ "poem-openapi",
+ "regex",
+ "reqwest",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "tokio",
+ "url 2.3.1",
+]
+
+[[package]]
+name = "openidconnect"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87af7097640fedbe64718ac1c9b0549d72da747a3f527cd089215f96c6f691d5"
+dependencies = [
+ "base64 0.13.1",
+ "chrono",
+ "http",
+ "itertools",
+ "log",
+ "num-bigint",
+ "oauth2",
+ "rand 0.8.5",
+ "ring",
+ "serde",
+ "serde-value",
+ "serde_derive",
+ "serde_json",
+ "serde_path_to_error",
+ "thiserror",
+ "url 2.3.1",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+
+[[package]]
+name = "ordered-float"
+version = "2.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7940cf2ca942593318d07fcf2596cdca60a85c9e7fab408a5e21a4f9dcd40d87"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "os_str_bytes"
+version = "6.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
+
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
+[[package]]
+name = "parity-scale-codec"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "373b1a4c1338d9cd3d1fa53b3a11bdab5ab6bd80a20f7f7becd76953ae2be909"
+dependencies = [
+ "arrayvec",
+ "bitvec",
+ "byte-slice-cast",
+ "impl-trait-for-tuples",
+ "parity-scale-codec-derive",
+ "serde",
+]
+
+[[package]]
+name = "parity-scale-codec-derive"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1557010476e0595c9b568d16dcfb81b93cdeb157612726f5170d31aa707bed27"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core 0.8.5",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core 0.9.4",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dc9e0dc2adc1c69d09143aff38d3d30c5c3f0df0dad82e6d25547af174ebec0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-sys 0.42.0",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1de2e551fb905ac83f73f7aedf2f0cb4a0da7e35efa24a202a936269f1f18e1"
+
+[[package]]
+name = "pem"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03c64931a1a212348ec4f3b4362585eca7159d0d09cbdf4a7f74f02173596fd4"
+dependencies = [
+ "base64 0.13.1",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01de5d978f34aa4b2296576379fcc416034702fd94117c56ffd8a1a767cefb30"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31010dd2e1ac33d5b46a5b413495239882813e0369f8ed8a5e266f173602f831"
+
+[[package]]
+name = "percent-encoding"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
+
+[[package]]
+name = "pest"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f400b0f7905bf702f9f3dc3df5a121b16c54e9e8012c082905fdf09a931861a"
+dependencies = [
+ "thiserror",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "423c2ba011d6e27b02b482a3707c773d19aec65cc024637aec44e19652e66f63"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e64e6c2c85031c02fdbd9e5c72845445ca0a724d419aa0bc068ac620c9935c1"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57959b91f0a133f89a68be874a5c88ed689c19cd729ecdb5d762ebf16c64d662"
+dependencies = [
+ "once_cell",
+ "pest",
+ "sha1",
+]
+
+[[package]]
+name = "phf"
+version = "0.7.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3da44b85f8e8dfaec21adae67f95d93244b2ecf6ad2a692320598dcc8e6dd18"
+dependencies = [
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.7.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b03e85129e324ad4166b06b2c7491ae27fe3ec353af72e72cd1654c7225d517e"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.7.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09364cc93c159b8b06b1f4dd8a4398984503483891b0c26b867cf431fb132662"
+dependencies = [
+ "phf_shared",
+ "rand 0.6.5",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.7.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "234f71a15de2288bcb7e3b6515828d22af7ec8598ee6d24c3b526fa0a80b67a0"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project"
+version = "0.4.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ef0f924a5ee7ea9cbcea77529dba45f8a9ba9f622419fe3386ca581a3ae9d5a"
+dependencies = [
+ "pin-project-internal 0.4.30",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad29a609b6bcd67fee905812e544992d216af9d755757c05ed2d0e15a74c6ecc"
+dependencies = [
+ "pin-project-internal 1.0.12",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "0.4.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "851c8d0ce9bebe43790dedfc86614c23494ac9f423dd618d3a61fc693eafe61e"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "069bdb1e05adc7a8990dce9cc75370895fbe4e3d58b9b73bf1aee56359344a55"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkcs1"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a78f66c04ccc83dd4486fd46c33896f4e17b24a7a3a6400dedc48ed0ddd72320"
+dependencies = [
+ "der",
+ "pkcs8",
+ "zeroize",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cabda3fb821068a9a4fab19a683eac3af12edf0f34b94a8be53c4972b8149d0"
+dependencies = [
+ "der",
+ "spki",
+ "zeroize",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
+
+[[package]]
+name = "plotters"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2538b639e642295546c50fcd545198c9d64ee2a38620a628724a3b266d5fbf97"
+dependencies = [
+ "num-traits",
+ "plotters-backend",
+ "plotters-svg",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "plotters-backend"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "193228616381fecdc1224c62e96946dfbc73ff4384fba576e052ff8c1bea8142"
+
+[[package]]
+name = "plotters-svg"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9a81d2759aae1dae668f783c308bc5c8ebd191ff4184aaa1b37f65a6ae5a56f"
+dependencies = [
+ "plotters-backend",
+]
+
+[[package]]
+name = "png"
+version = "0.17.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d708eaf860a19b19ce538740d2b4bdeeb8337fa53f7738455e706623ad5c638"
+dependencies = [
+ "bitflags",
+ "crc32fast",
+ "flate2",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "poem"
+version = "1.3.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b43fad06b128ce16d2eab9ff430b7d16c4a68c714eee59fd1c720fefdd71b42b"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "base64 0.13.1",
+ "bytes 1.3.0",
+ "chrono",
+ "cookie",
+ "fluent",
+ "fluent-langneg",
+ "fluent-syntax",
+ "futures-util",
+ "headers",
+ "http",
+ "httpdate",
+ "hyper",
+ "hyper-rustls",
+ "intl-memoizer",
+ "mime",
+ "mime_guess",
+ "multer",
+ "parking_lot 0.12.1",
+ "percent-encoding 2.2.0",
+ "pin-project-lite",
+ "poem-derive",
+ "quick-xml",
+ "rcgen 0.10.0",
+ "regex",
+ "rfc7239",
+ "ring",
+ "rustls-pemfile 1.0.1",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "serde_yaml",
+ "smallvec",
+ "sse-codec",
+ "tempfile",
+ "thiserror",
+ "time 0.3.17",
+ "tokio",
+ "tokio-metrics",
+ "tokio-rustls 0.23.4",
+ "tokio-stream",
+ "tokio-util",
+ "tracing",
+ "unic-langid",
+ "x509-parser 0.14.0",
+]
+
+[[package]]
+name = "poem-derive"
+version = "1.3.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb409283c448f2e27563e897bf416d89d646d10215b0132312395a32c9bf1c16"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "poem-openapi"
+version = "2.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a23985d68235c36580d0a5bfa8a00d244fd39cfaa9d0cf09c67c46080aa40e6e"
+dependencies = [
+ "base64 0.13.1",
+ "bytes 1.3.0",
+ "chrono",
+ "derive_more",
+ "email_address",
+ "futures-util",
+ "mime",
+ "num-traits",
+ "poem",
+ "poem-openapi-derive",
+ "quick-xml",
+ "regex",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "serde_yaml",
+ "thiserror",
+ "tokio",
+]
+
+[[package]]
+name = "poem-openapi-derive"
+version = "2.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e6b126bef41ddde5e6217fd7f8f5af95480fb5faf0625322321706aa5b53949"
+dependencies = [
+ "darling",
+ "http",
+ "indexmap",
+ "mime",
+ "proc-macro-crate",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "regex",
+ "syn 1.0.104",
+ "thiserror",
+]
+
+[[package]]
+name = "polyval"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef234e08c11dfcb2e56f79fd70f6f2eb7f025c0ce2333e82f4f0518ecad30c6"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "opaque-debug",
+ "universal-hash",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "primitive-types"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05e4722c697a58a99d5d06a08c30821d7c082a4632198de1eaa5a6c22ef42373"
+dependencies = [
+ "fixed-hash",
+ "impl-codec",
+ "impl-rlp",
+ "impl-serde",
+ "uint",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eda0fc3b0fb7c975631757e14d9049da17374063edb6ebbcbc54d880d4fe94e9"
+dependencies = [
+ "once_cell",
+ "thiserror",
+ "toml",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbf0c48bc1d91375ae5c3cd81e3722dff1abcf81a30960240640d223f59fe0e5"
+
+[[package]]
+name = "proc-macro2"
+version = "0.4.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf3d2011ab5c909338f7887f4fc896d35932e29146c12c8d01da6b22a80ba759"
+dependencies = [
+ "unicode-xid 0.1.0",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ea3d908b0e36316caf9e9e2c4625cdde190a7e6f440d794667ed17a1855e725"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "proc-quote"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e84ab161de78c915302ca325a19bee6df272800e2ae1a43fe3ef430bab2a100"
+dependencies = [
+ "proc-macro-hack",
+ "proc-macro2 1.0.47",
+ "proc-quote-impl",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "proc-quote-impl"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fb3ec628b063cdbcf316e06a8b8c1a541d28fa6c0a8eacd2bfb2b7f49e88aa0"
+dependencies = [
+ "proc-macro-hack",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f50b1c63b38611e7d4d7f68b82d3ad0cc71a2ad2e7f61fc10f1328d917c93cd"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "quote"
+version = "0.6.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce23b6b870e8f94f81fb0a363d65d86675884b34a09043c81e5562f11c1f8e1"
+dependencies = [
+ "proc-macro2 0.4.30",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbe448f377a7d6961e30f5955f9b8d106c3f5e449d493ee1b125c1d43c2b5179"
+dependencies = [
+ "proc-macro2 1.0.47",
+]
+
+[[package]]
+name = "quoted_printable"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fee2dce59f7a43418e3382c766554c614e06a552d53a8f07ef499ea4b332c0f"
+
+[[package]]
+name = "radium"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "643f8f41a8ebc4c5dc4515c82bb8abd397b527fc20fd681b7c011c2aee5d44fb"
+
+[[package]]
+name = "rand"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d71dacdc3c88c1fde3885a3be3fbab9f35724e6ce99467f7d9c5026132184ca"
+dependencies = [
+ "autocfg 0.1.8",
+ "libc",
+ "rand_chacha 0.1.1",
+ "rand_core 0.4.2",
+ "rand_hc 0.1.0",
+ "rand_isaac",
+ "rand_jitter",
+ "rand_os",
+ "rand_pcg",
+ "rand_xorshift",
+ "winapi",
+]
+
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom 0.1.16",
+ "libc",
+ "rand_chacha 0.2.2",
+ "rand_core 0.5.1",
+ "rand_hc 0.2.0",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556d3a1ca6600bfcbab7c7c91ccb085ac7fbbcd70e008a98742e7847f4f7bcef"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom 0.1.16",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.8",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b40677c7be09ae76218dc623efbf7b18e34bced3f38883af07bb75630a21bc4"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_isaac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded997c9d5f13925be2a6fd7e66bf1872597f759fd9dd93513dd7e92e5a5ee08"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_jitter"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1166d5c91dc97b88d1decc3285bb0a99ed84b05cfd0bc2341bdf2d43fc41e39b"
+dependencies = [
+ "libc",
+ "rand_core 0.4.2",
+ "winapi",
+]
+
+[[package]]
+name = "rand_os"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b75f676a1e053fc562eafbb47838d67c84801e38fc1ba459e8f180deabd5071"
+dependencies = [
+ "cloudabi",
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.4.2",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand_pcg"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abf9b09b01790cfe0364f52bf32995ea3c39f4d2dd011eac241d2914146d0b44"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbf7e9e623549b0e21f6e97cf8ecf247c1a8fd2e8a992ae265314300b2455d5c"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rayon"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e060280438193c554f654141c9ea9417886713b7acd75974c85b18a69a88e0b"
+dependencies = [
+ "crossbeam-deque",
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cac410af5d00ab6884528b4ab69d1e8e146e8d471201800fa1b4524126de6ad3"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
+
+[[package]]
+name = "rc-fcm"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64 0.13.1",
+ "chrono",
+ "reqwest",
+ "rustls 0.20.7",
+ "rustls-pemfile 0.3.0",
+ "serde",
+ "serde_json",
+ "thiserror",
+ "tokio",
+]
+
+[[package]]
+name = "rc-magic-link"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "chrono",
+ "fastrand",
+ "hex",
+ "hmac 0.11.0",
+ "serde",
+ "sha2 0.9.9",
+]
+
+[[package]]
+name = "rc-msgdb"
+version = "0.1.0"
+dependencies = [
+ "criterion",
+ "parking_lot 0.12.1",
+ "sled",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "rc-token"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "hmac 0.11.0",
+ "jwt",
+ "serde",
+ "sha2 0.9.9",
+ "textnonce",
+ "thiserror",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5911d1403f4143c9d56a702069d593e8d0f3fab880a85e103604d0893ea31ba7"
+dependencies = [
+ "chrono",
+ "pem",
+ "ring",
+ "x509-parser 0.12.0",
+ "yasna 0.4.0",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffbe84efe2f38dea12e9bfc1f65377fdf03e53a18cb3b995faedf7934c7e785b"
+dependencies = [
+ "pem",
+ "ring",
+ "time 0.3.17",
+ "yasna 0.5.0",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e076559ef8e241f2ae3479e36f97bd5741c0330689e217ad51ce2c76808b868a"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+dependencies = [
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "456c603be3e8d448b072f410900c09faf164fbce2d480456f50eea6e25f9c848"
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.11.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68cc60575865c7831548863cc02356512e3f1dc2f3f82cb837d7fc4cc8f3c97c"
+dependencies = [
+ "base64 0.13.1",
+ "bytes 1.3.0",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-rustls",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "once_cell",
+ "percent-encoding 2.2.0",
+ "pin-project-lite",
+ "rustls 0.20.7",
+ "rustls-pemfile 1.0.1",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "tokio",
+ "tokio-rustls 0.23.4",
+ "tower-service",
+ "url 2.3.1",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "webpki-roots 0.22.5",
+ "winreg",
+]
+
+[[package]]
+name = "rfc7239"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "087317b3cf7eb481f13bd9025d729324b7cd068d6f470e2d76d049e191f5ba47"
+dependencies = [
+ "uncased",
+]
+
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin 0.5.2",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "rlp"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb919243f34364b6bd2fc10ef797edbfa75f33c252e7998527479c6d6b47e1ec"
+dependencies = [
+ "bytes 1.3.0",
+ "rustc-hex",
+]
+
+[[package]]
+name = "rsa"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cf22754c49613d2b3b119f0e5d46e34a2c628a937e3024b8762de4e7d8c710b"
+dependencies = [
+ "byteorder",
+ "digest 0.10.6",
+ "num-bigint-dig",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "smallvec",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc-hex"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e75f6a532d0fd9f7f13144f392b6ad56a32696bfcd9c78f797f16bbb6f072d6"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustls"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35edb675feee39aec9c99fa5ff985081995a06d594114ae14cbe797ad7b7a6d7"
+dependencies = [
+ "base64 0.13.1",
+ "log",
+ "ring",
+ "sct 0.6.1",
+ "webpki 0.21.4",
+]
+
+[[package]]
+name = "rustls"
+version = "0.20.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "539a2bfe908f471bfa933876bd1eb6a19cf2176d375f82ef7f99530a40e48c2c"
+dependencies = [
+ "log",
+ "ring",
+ "sct 0.7.0",
+ "webpki 0.22.0",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0167bac7a9f490495f3c33013e7722b53cb087ecbe082fb0c6387c96f634ea50"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile 1.0.1",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ee86d63972a7c661d1536fefe8c3c8407321c3df668891286de28abcd087360"
+dependencies = [
+ "base64 0.13.1",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0864aeff53f8c05aa08d86e5ef839d3dfcf07aeba2db32f12db0ef716e87bd55"
+dependencies = [
+ "base64 0.13.1",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4501abdff3ae82a1c1b477a17252eb69cee9e66eb915c1abaa4f44d873df9f09"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88d6731146462ea25d9244b2ed5fd1d716d25c52e4d54aa4fb0f3c4e9854dbe2"
+dependencies = [
+ "lazy_static",
+ "windows-sys 0.36.1",
+]
+
+[[package]]
+name = "scoped_threadpool"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d51f5df5af43ab3f1360b429fa5e0152ac5ce8c0bd6485cae490332e96846a8"
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "scratch"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8132065adcfd6e02db789d9285a0deb2f3fcb04002865ab67d5fb103533898"
+
+[[package]]
+name = "sct"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b362b83898e0e69f38515b82ee15aa80636befe47c3b6d3d89a911e78fc228ce"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "sct"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "secp256k1"
+version = "0.21.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c42e6f1735c5f00f51e43e28d6634141f2bcad10931b2609ddd74a86d751260"
+dependencies = [
+ "secp256k1-sys",
+]
+
+[[package]]
+name = "secp256k1-sys"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "957da2573cde917463ece3570eab4a0b3f19de6f1646cde62e6fd3868f566036"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bc1bb97804af6631813c55739f771071e0f2ed33ee20b68c86ec505d906356c"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0160a13a177a45bfb43ce71c01580998474f556ad854dcbca936dd2841a5c556"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "self_cell"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ef965a420fe14fdac7dd018862966a4c14094f900e1650bbc71ddd7d580c8af"
+
+[[package]]
+name = "semver"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e25dfac463d778e353db5be2449d1cce89bd6fd23c9f1ea21310ce6e5a1b29c4"
+
+[[package]]
+name = "serde"
+version = "1.0.148"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e53f64bb4ba0191d6d0676e1b141ca55047d83b74f5607e6d8eb88126c52c2dc"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde-value"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a1a3341211875ef120e117ea7fd5228530ae7e7036a779fdc9117be6b3282c"
+dependencies = [
+ "ordered-float",
+ "serde",
+]
+
+[[package]]
+name = "serde_cbor"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bef2ebfde456fb76bbcf9f59315333decc4fda0b2b44b420243c11e0f5ec1f5"
+dependencies = [
+ "half 1.8.2",
+ "serde",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.148"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a55492425aa53521babf6137309e7d34c20bbfbbfcfe2c7f3a047fd1f6b92c0c"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "020ff22c755c2ed3f8cf162dbb41a7268d934702f3ed3631656ea597e08fc3db"
+dependencies = [
+ "itoa 1.0.4",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "184c643044780f7ceb59104cef98a5a6f12cb2288a7bc701ab93a362b49fd47d"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa 1.0.4",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.9.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d232d893b10de3eb7258ff01974d6ee20663d8e833263c99409d4b13a0209da"
+dependencies = [
+ "indexmap",
+ "itoa 1.0.4",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "sha3"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f81199417d4e5de3f04b1e871023acea7389672c4135918f05aa9cbf2f2fa809"
+dependencies = [
+ "block-buffer 0.9.0",
+ "digest 0.9.0",
+ "keccak",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "900fba806f70c630b0a382d0d825e17a0f19fcd059a2ade1ff237bcddf446b31"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51e73328dc4ac0c7ccbda3a494dfa03df1de2f46018127f60c693f2648455b0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "simple_asn1"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adc4e5204eb1910f40f9cfa375f6f05b68c3abac4b6fd879c8ff5e7ae8a0a085"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "thiserror",
+ "time 0.3.17",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b8de496cf83d4ed58b6be86c3a275b8602f6ffe98d3024a869e124147a9a3ac"
+
+[[package]]
+name = "slab"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4614a76b2a8be0058caa9dbbaf66d988527d86d003c11a94fbd335d7661edcef"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "sled"
+version = "0.34.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f96b4737c2ce5987354855aed3797279def4ebf734436c6aa4552cf8e169935"
+dependencies = [
+ "crc32fast",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "fs2",
+ "fxhash",
+ "libc",
+ "log",
+ "parking_lot 0.11.2",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+
+[[package]]
+name = "socket2"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02e2d2db9033d13a1567121ddd7a095ee144db4e1ca1b1bda3419bc0da294ebd"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "spin"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f6002a767bff9e83f8eeecf883ecb8011875a21ae8da43bffb817a57e78cc09"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d01ac02a6ccf3e07db148d2be087da624fea0221a16152ed01f0496a6b0a27"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "sqlformat"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4b7922be017ee70900be125523f38bdd644f4f06a1b16e8fa5a8ee8c34bffd4"
+dependencies = [
+ "itertools",
+ "nom",
+ "unicode_categories",
+]
+
+[[package]]
+name = "sqlx"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "551873805652ba0d912fec5bbb0f8b4cdd96baf8e2ebf5970e5671092966019b"
+dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e48c61941ccf5ddcada342cd59e3e5173b007c509e1e8e990dafc830294d9dc5"
+dependencies = [
+ "ahash",
+ "atoi",
+ "bitflags",
+ "byteorder",
+ "bytes 1.3.0",
+ "chrono",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "hashlink",
+ "hex",
+ "indexmap",
+ "itoa 1.0.4",
+ "libc",
+ "libsqlite3-sys",
+ "log",
+ "memchr",
+ "once_cell",
+ "paste",
+ "percent-encoding 2.2.0",
+ "rustls 0.19.1",
+ "serde",
+ "serde_json",
+ "sha2 0.10.6",
+ "smallvec",
+ "sqlformat",
+ "sqlx-rt",
+ "stringprep",
+ "thiserror",
+ "tokio-stream",
+ "url 2.3.1",
+ "webpki 0.21.4",
+ "webpki-roots 0.21.1",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc0fba2b0cae21fc00fe6046f8baa4c7fcb49e379f0f592b04696607f69ed2e1"
+dependencies = [
+ "dotenv",
+ "either",
+ "heck",
+ "once_cell",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "serde_json",
+ "sha2 0.10.6",
+ "sqlx-core",
+ "sqlx-rt",
+ "syn 1.0.104",
+ "url 2.3.1",
+]
+
+[[package]]
+name = "sqlx-rt"
+version = "0.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4db708cd3e459078f85f39f96a00960bd841f66ee2a669e90bf36907f5a79aae"
+dependencies = [
+ "once_cell",
+ "tokio",
+ "tokio-rustls 0.22.0",
+]
+
+[[package]]
+name = "sse-codec"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84a59f811350c44b4a037aabeb72dc6a9591fc22aa95a036db9a96297c58085a"
+dependencies = [
+ "bytes 0.5.6",
+ "futures-io",
+ "futures_codec",
+ "memchr",
+]
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "string_cache"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89c058a82f9fd69b1becf8c274f412281038877c553182f1d02eb027045a2d67"
+dependencies = [
+ "lazy_static",
+ "new_debug_unreachable",
+ "phf_shared",
+ "precomputed-hash",
+ "serde",
+ "string_cache_codegen",
+ "string_cache_shared",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0f45ed1b65bf9a4bf2f7b7dc59212d1926e9eaf00fa998988e420fd124467c6"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "string_cache_shared",
+]
+
+[[package]]
+name = "string_cache_shared"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1884d1bc09741d466d9b14e6d37ac89d6909cbcac41dd9ae982d4d063bbedfc"
+
+[[package]]
+name = "stringprep"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee348cb74b87454fff4b551cbf727025810a004f88aeacae7f85b87f4e9a1c1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "substring"
+version = "1.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ee6433ecef213b2e72f587ef64a2f5943e7cd16fbd82dbe8bc07486c534c86"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "subtle"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
+
+[[package]]
+name = "syn"
+version = "0.15.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ca4b3b69a77cbe1ffc9e198781b7acb0c7365a883670e8f1c1bc66fba79a5c5"
+dependencies = [
+ "proc-macro2 0.4.30",
+ "quote 0.6.13",
+ "unicode-xid 0.1.0",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ae548ec36cf198c0ef7710d3c230987c2d6d7bd98ad6edc0274462724c585ce"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+ "unicode-xid 0.2.4",
+]
+
+[[package]]
+name = "tap"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
+]
+
+[[package]]
+name = "tendril"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
+dependencies = [
+ "futf",
+ "mac",
+ "utf-8",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bab24d30b911b2376f3a13cc2cd443142f0c81dda04c118693e35b3835757755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textnonce"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7743f8d70cd784ed1dc33106a18998d77758d281dc40dc3e6d050cf0f5286683"
+dependencies = [
+ "base64 0.12.3",
+ "rand 0.7.3",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+
+[[package]]
+name = "thiserror"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10deb33631e3c9018b9baf9dcbbc4f737320d2b576bac10f6aefa048fa407e3e"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "982d17546b47146b28f7c22e3d08465f6b8903d0ea13c1660d9d84a6e7adcdbb"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5516c27b78311c50bf42c071425c560ac799b11c30b31f87e3081965fe5e0180"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "threadpool"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
+dependencies = [
+ "num_cpus",
+]
+
+[[package]]
+name = "tiff"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f17def29300a156c19ae30814710d9c63cd50288a49c6fd3a10ccfbe4cf886fd"
+dependencies = [
+ "flate2",
+ "jpeg-decoder",
+ "weezl",
+]
+
+[[package]]
+name = "time"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b797afad3f312d1c66a56d11d0316f916356d11bd158fbc6ca6389ff6bf805a"
+dependencies = [
+ "libc",
+ "wasi 0.10.0+wasi-snapshot-preview1",
+ "winapi",
+]
+
+[[package]]
+name = "time"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a561bf4617eebd33bca6434b988f39ed798e527f51a1e797d0ee4f61c0a38376"
+dependencies = [
+ "itoa 1.0.4",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+
+[[package]]
+name = "time-macros"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d967f99f534ca7e495c575c62638eebc2898a8c84c119b89e250477bc4ba16b2"
+dependencies = [
+ "time-core",
+]
+
+[[package]]
+name = "tiny-keccak"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c9d3793400a45f954c52e73d068316d76b6f4e36977e3fcebb13a2721e80237"
+dependencies = [
+ "crunchy",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8aeafdfd935e4a7fe16a91ab711fa52d54df84f9c8f7ca5837a9d1d902ef4c2"
+dependencies = [
+ "displaydoc",
+]
+
+[[package]]
+name = "tinytemplate"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+
+[[package]]
+name = "tokio"
+version = "1.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76ce4a75fb488c605c54bf610f221cea8b0dafb53333c1a67e8ee199dcd2ae3"
+dependencies = [
+ "autocfg 1.1.0",
+ "bytes 1.3.0",
+ "libc",
+ "memchr",
+ "mio",
+ "num_cpus",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "winapi",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9724f9a975fb987ef7a3cd9be0350edcbe130698af5b8f7a631e23d42d052484"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "tokio-metrics"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcb585a0069b53171684e22d5255984ec30d1c7304fd0a4a9a603ffd8c765cdd"
+dependencies = [
+ "futures-util",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc6844de72e57df1980054b38be3a9f4702aba4858be64dd700181a8a6d0e1b6"
+dependencies = [
+ "rustls 0.19.1",
+ "tokio",
+ "webpki 0.21.4",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.23.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c43ee83903113e03984cb9e5cebe6c04a5116269e900e3ddba8f068a62adda59"
+dependencies = [
+ "rustls 0.20.7",
+ "tokio",
+ "webpki 0.22.0",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d660770404473ccd7bc9f8b28494a811bc18542b915c0855c51e8f419d5223ce"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bb2e075f03b3d66d8d8785356224ba688d2906a371015e225beeb65ca92c740"
+dependencies = [
+ "bytes 1.3.0",
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82e1a7758622a465f8cee077614c73484dac5b836c02ff6a40d5d1010324d7"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "tower-service"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+
+[[package]]
+name = "tracing"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+dependencies = [
+ "cfg-if",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4017f8f45139870ca7e672686113917c71c7a6e02d4924eda67186083c03081a"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24eb03ba0eab1fd845050058ce5e616558e8f8d8fca633e6b163fe25c797213a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ddad33d2d10b1ed7eb9d1f518a5674713876e97e5bb9b7345a7984fbb4f922"
+dependencies = [
+ "lazy_static",
+ "log",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6176eae26dd70d0c919749377897b54a9276bd7061339665dd68777926b5a70"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59547bce71d9c38b83d9c0e92b6066c4253371f15005def0c30d9657f50c7642"
+
+[[package]]
+name = "type-map"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d3364c5e96cb2ad1603037ab253ddd34d7fb72a58bdddf4b7350760fc69a46"
+dependencies = [
+ "rustc-hash",
+]
+
+[[package]]
+name = "typenum"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcf81ac59edc17cc8697ff311e8f5ef2d99fcbd9817b34cec66f90b6c3dfd987"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e79c4d996edb816c91e4308506774452e55e95c3c9de07b6729e17e15a5ef81"
+
+[[package]]
+name = "uint"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a45526d29728d135c2900b0d30573fe3ee79fceb12ef534c7bb30e810a91b601"
+dependencies = [
+ "byteorder",
+ "crunchy",
+ "hex",
+ "static_assertions",
+]
+
+[[package]]
+name = "uncased"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09b01702b0fd0b3fadcf98e098780badda8742d4f4a7676615cad90e8ac73622"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "unic-langid"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "398f9ad7239db44fd0f80fe068d12ff22d78354080332a5077dc6f52f14dcf2f"
+dependencies = [
+ "unic-langid-impl",
+ "unic-langid-macros",
+]
+
+[[package]]
+name = "unic-langid-impl"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35bfd2f2b8796545b55d7d3fd3e89a0613f68a0d1c8bc28cb7ff96b411a35ff"
+dependencies = [
+ "tinystr",
+]
+
+[[package]]
+name = "unic-langid-macros"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "055e618bf694161ffff0466d95cef3e1a5edc59f6ba1888e97801f2b4ebdc4fe"
+dependencies = [
+ "proc-macro-hack",
+ "tinystr",
+ "unic-langid-impl",
+ "unic-langid-macros-impl",
+]
+
+[[package]]
+name = "unic-langid-macros-impl"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f5cdec05b907f4e2f6843f4354f4ce6a5bebe1a56df320a49134944477ce4d8"
+dependencies = [
+ "proc-macro-hack",
+ "quote 1.0.21",
+ "syn 1.0.104",
+ "unic-langid-impl",
+]
+
+[[package]]
+name = "unicase"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50f37be617794602aabbeee0be4f259dc1778fabe05e2d67ee8f79326d5cb4f6"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "099b7128301d285f79ddd55b9a83d5e6b9e97c92e0ea0daebee7263e932de992"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ceab39d59e4c9499d4e5a8ee0e2735b891bb7308ac83dfb4e80cad195c9f6f3"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fdbf052a0783de01e944a6ce7a8cb939e295b1e7be835a1112c3b9a7f047a5a"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0edd1e5b14653f783770bce4a4dabb4a5108a5370a5f5d8cfe8710c361f6c8b"
+
+[[package]]
+name = "unicode-xid"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
+
+[[package]]
+name = "unicode_categories"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39ec24b3121d976906ece63c9daad25b85969647682eee313cb5779fdd69e14e"
+
+[[package]]
+name = "universal-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d3160b73c9a19f7e2939a2fdad446c57c1bbbbf4d919d3213ff1267a580d8b5"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1e5fa573d8ac5f1a856f8d7be41d390ee973daf97c806b2c1a465e4e1406e68"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "url"
+version = "1.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd4e7c0d531266369519a4aa4f399d748bd37043b00bde1e4ff1f60a120b355a"
+dependencies = [
+ "idna 0.1.5",
+ "matches",
+ "percent-encoding 1.0.1",
+]
+
+[[package]]
+name = "url"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+dependencies = [
+ "form_urlencoded",
+ "idna 0.3.0",
+ "percent-encoding 2.2.0",
+ "serde",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+dependencies = [
+ "getrandom 0.2.8",
+]
+
+[[package]]
+name = "uuid"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "422ee0de9031b5b948b97a8fc04e3aa35230001a722ddd27943e0be31564ce4c"
+dependencies = [
+ "getrandom 0.2.8",
+]
+
+[[package]]
+name = "valuable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+
+[[package]]
+name = "vc-license"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "bs58",
+ "chrono",
+ "digest 0.8.1",
+ "hex",
+ "pkcs1",
+ "rand 0.8.5",
+ "rsa",
+ "sha2 0.9.9",
+ "uuid 1.2.2",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "vocechat-server"
+version = "0.3.3"
+dependencies = [
+ "agora-token",
+ "anyhow",
+ "async-stream",
+ "base64 0.13.1",
+ "bytes 1.3.0",
+ "chrono",
+ "clap 3.2.23",
+ "daemonize",
+ "envy",
+ "fastrand",
+ "fnv",
+ "fs2",
+ "futures-util",
+ "hex",
+ "hmac 0.11.0",
+ "image",
+ "itertools",
+ "jsonwebtoken",
+ "lettre",
+ "liquid",
+ "mime_guess",
+ "num_enum",
+ "once_cell",
+ "open-graph",
+ "openidconnect",
+ "parking_lot 0.11.2",
+ "poem",
+ "poem-openapi",
+ "rc-fcm",
+ "rc-magic-link",
+ "rc-msgdb",
+ "rc-token",
+ "rcgen 0.8.14",
+ "regex",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sha2 0.9.9",
+ "sqlx",
+ "substring",
+ "tempfile",
+ "textnonce",
+ "tokio",
+ "tokio-stream",
+ "toml",
+ "tracing",
+ "tracing-subscriber",
+ "unic-langid",
+ "url 1.7.2",
+ "uuid 0.8.2",
+ "vc-license",
+ "walkdir",
+ "web3",
+ "zip",
+]
+
+[[package]]
+name = "walkdir"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "808cf2735cd4b6866113f648b791c6adc5714537bc222d9347bb203386ffda56"
+dependencies = [
+ "same-file",
+ "winapi",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ce8a968cb1cd110d136ff8b819a556d6fb6d919363c61534f6860c7eb172ba0"
+dependencies = [
+ "log",
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
+[[package]]
+name = "wasi"
+version = "0.10.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23639446165ca5a5de86ae1d8896b737ae80319560fbaa4c2887b7da6e7ebd7d"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+dependencies = [
+ "quote 1.0.21",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+dependencies = [
+ "proc-macro2 1.0.47",
+ "quote 1.0.21",
+ "syn 1.0.104",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+
+[[package]]
+name = "web-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web3"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44f258e254752d210b84fe117b31f1e3cc9cbf04c0d747eb7f8cf7cf5e370f6d"
+dependencies = [
+ "arrayvec",
+ "derive_more",
+ "ethabi",
+ "ethereum-types",
+ "futures",
+ "futures-timer",
+ "hex",
+ "idna 0.2.3",
+ "jsonrpc-core",
+ "log",
+ "once_cell",
+ "parking_lot 0.12.1",
+ "pin-project 1.0.12",
+ "rlp",
+ "secp256k1",
+ "serde",
+ "serde_json",
+ "tiny-keccak",
+]
+
+[[package]]
+name = "webpki"
+version = "0.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e38c0608262c46d4a56202ebabdeb094cef7e560ca7a226c6bf055188aa4ea"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "webpki"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aabe153544e473b775453675851ecc86863d2a81d786d741f6b76778f2a48940"
+dependencies = [
+ "webpki 0.21.4",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.22.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "368bfe657969fb01238bb756d351dcade285e0f6fcbd36dcb23359a5169975be"
+dependencies = [
+ "webpki 0.22.0",
+]
+
+[[package]]
+name = "weezl"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9193164d4de03a926d909d3bc7c30543cecb35400c02114792c2cae20d5e2dbb"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-sys"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea04155a16a59f9eab786fe12a4a450e75cdb175f9e0d80da1e17db09f55b8d2"
+dependencies = [
+ "windows_aarch64_msvc 0.36.1",
+ "windows_i686_gnu 0.36.1",
+ "windows_i686_msvc 0.36.1",
+ "windows_x86_64_gnu 0.36.1",
+ "windows_x86_64_msvc 0.36.1",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc 0.42.0",
+ "windows_i686_gnu 0.42.0",
+ "windows_i686_msvc 0.42.0",
+ "windows_x86_64_gnu 0.42.0",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc 0.42.0",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d2aa71f6f0cbe00ae5167d90ef3cfe66527d6f613ca78ac8024c3ccab9a19e"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bb8c3fd39ade2d67e9874ac4f3db21f0d710bee00fe7cab16949ec184eeaa47"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd0f252f5a35cac83d6311b2e795981f5ee6e67eb1f9a7f64eb4500fbc4dcdb4"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180e6ccf01daf4c426b846dfc66db1fc518f074baa793aa7d9b9aaeffad6a3b6"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbeae19f6716841636c28d695375df17562ca208b2b7d0dc47635a50ae6c5de7"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2e7917148b2812d1eeafaeb22a97e4813dfa60a3f8f78ebe204bcc88f12f024"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84c12f65daa39dd2babe6e442988fc329d6243fdce47d7d2d155b8d874862246"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dcd171b8776c41b97521e5da127a2d86ad280114807d0b2ab1e462bc764d9e1"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf7b1b21b5362cbc318f686150e5bcea75ecedc74dd157d874d754a2ca44b0ed"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09d525d2ba30eeb3297665bd434a54297e4170c7f1a44cad4ef58095b4cd2028"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.36.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c811ca4a8c853ef420abd8592ba53ddbbac90410fab6903b3e79972a631f7680"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40009d85759725a34da6d89a94e63d7bdc50a862acf0dbc7c8e488f1edcb6f5"
+
+[[package]]
+name = "winreg"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "wyz"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85e60b0d1b5f99db2556934e21937020776a5d31520bf169e851ac44e6420214"
+
+[[package]]
+name = "x509-parser"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffc90836a84cb72e6934137b1504d0cae304ef5d83904beb0c8d773bbfe256ed"
+dependencies = [
+ "base64 0.13.1",
+ "chrono",
+ "data-encoding",
+ "der-parser 6.0.1",
+ "lazy_static",
+ "nom",
+ "oid-registry 0.2.0",
+ "ring",
+ "rusticata-macros",
+ "thiserror",
+]
+
+[[package]]
+name = "x509-parser"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0ecbeb7b67ce215e40e3cc7f2ff902f94a223acf44995934763467e7b1febc8"
+dependencies = [
+ "asn1-rs",
+ "base64 0.13.1",
+ "data-encoding",
+ "der-parser 8.1.0",
+ "lazy_static",
+ "nom",
+ "oid-registry 0.6.0",
+ "rusticata-macros",
+ "thiserror",
+ "time 0.3.17",
+]
+
+[[package]]
+name = "yasna"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e262a29d0e61ccf2b6190d7050d4b237535fc76ce4c1210d9caa316f71dffa75"
+dependencies = [
+ "chrono",
+]
+
+[[package]]
+name = "yasna"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346d34a236c9d3e5f3b9b74563f238f955bbd05fa0b8b4efa53c130c43982f4c"
+dependencies = [
+ "time 0.3.17",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c394b5bd0c6f669e7275d9c20aa90ae064cb22e75a1cad54e1b34088034b149f"
+
+[[package]]
+name = "zip"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "537ce7411d25e54e8ae21a7ce0b15840e7bfcff15b51d697ec3266cc76bdf080"
+dependencies = [
+ "byteorder",
+ "crc32fast",
+ "crossbeam-utils",
+ "flate2",
+]
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000..33f5c13
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,116 @@
+[package]
+name = "vocechat-server"
+version = "0.3.3"
+edition = "2021"
+license = "MIT"
+
+[dependencies]
+rc-msgdb = { path = "./crates/msgdb" }
+rc-token = { path = "./crates/token" }
+rc-fcm = { path = "./crates/fcm" }
+rc-magic-link = { path = "./crates/magic-link" }
+vc-license = { path = "./crates/vc-license" }
+agora-token = { path = "./crates/agora-token" }
+open-graph = { path = "./crates/open-graph", features = ["poem_openapi"] }
+
+poem = { version = "1.3.51", features = [
+    "rustls",
+    "sse",
+    "static-files",
+    "test",
+    "i18n",
+    "anyhow",
+    "acme",
+    'tokio-metrics',
+] }
+poem-openapi = { version = "2.0.23", features = [
+    "rapidoc",
+    "swagger-ui",
+    "redoc",
+    "chrono",
+    "email",
+    "static-files",
+] }
+serde = { version = "1.0.132", features = ["derive"] }
+tokio = { version = "1.17.0", features = [
+    "macros",
+    "rt-multi-thread",
+    "sync",
+    "fs",
+    "time",
+] }
+toml = "0.5.8"
+tracing = "0.1.29"
+tracing-subscriber = { version = "0.3.3", features = ["env-filter"] }
+serde_json = "1.0.73"
+parking_lot = "0.11.2"
+sqlx = { version = "0.5.9", features = [
+    "sqlite",
+    "runtime-tokio-rustls",
+    "chrono",
+    "json",
+] }
+itertools = "0.10.3"
+futures-util = "0.3.19"
+async-stream = "0.3.2"
+image = "0.24.2"
+uuid = { version = "0.8.2", features = ["v4"] }
+rcgen = { version = "0.8.14", features = ["x509-parser"] }
+tokio-stream = "0.1.8"
+num_enum = "0.5.5"
+unic-langid = "0.9.0"
+reqwest = { version = "0.11.8", default-features = false, features = [
+    "rustls-tls",
+    "json",
+] }
+lettre = { version = "0.10.0-rc.4", default-features = false, features = [
+    "smtp-transport",
+    "hostname",
+    "builder",
+    "tokio1",
+    "tokio1-rustls-tls",
+] }
+serde_urlencoded = "0.7.1"
+liquid = "0.23.1"
+fastrand = "1.7.0"
+fs2 = "0.4.3"
+hmac = "0.11.0"
+sha2 = "0.9.0"
+substring = "1.4.5"
+regex = "1.5.4"
+jsonwebtoken = "8.0.1"
+openidconnect = "2.4.0"
+#openidconnect = { git = "https://github.com/sunli829/openidconnect-rs", rev = "efd006c" }
+bytes = "1.1.0"
+textnonce = "1.0.0"
+web3 = { version = "0.18.0", default-features = false, features = ["signing"] }
+clap = { version = "3.1.6", features = ["derive"] }
+walkdir = "2.3.2"
+base64 = "0.13.0"
+zip = { version = "0.6.0", default-features = false, features = ["deflate"] }
+mime_guess = "2.0.4"
+url = "1.7.2"
+once_cell = "1.13.0"
+chrono = { version = "0.4.19", features = ["serde"] }
+anyhow = "1.0.51"
+hex = "0.4.3"
+envy = "0.4.2"
+
+[target.'cfg(not(windows))'.dependencies]
+daemonize = "0.4.1"
+
+[workspace]
+members = [
+    "crates/msgdb",
+    "crates/token",
+    "crates/fcm",
+    "crates/open-graph",
+    "crates/vc-license",
+]
+
+[dev-dependencies]
+reqwest = { version = "0.11.8", default-features = false, features = [
+    "rustls-tls",
+] }
+tempfile = "3.2.0"
+fnv = "1.0.7"
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..64a9983
--- /dev/null
+++ b/README.md
@@ -0,0 +1,81 @@
+
+# Re-decentralized the Internet through personal cloud computing.
+## VoceChat is the `lightest` chat server prioritizes private hosting! Easy integratation to your app with our open API!
+### Quick run
+
+```bash
+docker run -d --restart=always \
+  -p 3009:3000 \
+  --name vocechat-server \
+  Privoce/vocechat-server:latest
+```
+
+On browser visit: http://localhost:3009/
+
+
+### Contact us
+
+Doc: [https://doc.voce.chat](https://doc.voce.chat)  
+Chat with us: [https://voce.chat](https://voce.chat)  
+Email: [han@privoce.com](han@privoce.com)
+### Welcome your help of any form--code, issues, blog articles, social media shares.
+
+# Goal
+
+The goal of Voce is to provide a space owned by "you" on the Internet, just as the name "voce" means in portguese. As cloud computing getting matured, there will be a time in the foreseeable future that netizens like you and me can enjoy the benefit of having a personal cloud space on the Internet--like iCloud, while not only will you have storage, but also a personalized computing layer.
+
+Why do we need a private cloud space? The short answer is that information will become our private property and means of communication will be under the control of every netizen.
+
+Digital technologies including Internet and the Web make information duplicable and transferable, yet platforms are controlling the ownership and means of production and transmission of most information (content) on the Internet. We are building Voce as an open-sourced tool (not a platform) to empower smaller groups and individuals to become a platform themselves. When various servers get connected to each other, all the information shared among the servers will be duplicated and become the server owner's private data under private storages.
+
+# Personal cloud
+
+We need a "home" as our private property on the Internet, and this home should have features more than just storage. No matter you choose NAS, AWS, Raspberry Pi or your local PC to run VoceChat, it is your own private property--yes, public cloud services like AWS purchased by you is commercially your own property and the data in your cloud is protected from accessing by the public cloud service providers. Features including but not limited to instant messaging, activity posts, private video calls, notes, whiteboard are all desiring and useful on your personal cloud server. Personal cloud is the new PC, and there will be a new software layer with some shared traits--distributed by URL(web app), good API, interoperable profiles. Privoce is currently working on this software layer of personal cloud.
+
+# Why Rust
+
+Personal cloud needs efficent solutions. This Rust written server is less than 20MB and runs with great efficiency. Hosting a 20MB private social media server is much more accessible than a 300MB one. Just like cars v. bus, or single family home v. hotels, if Facebook is a grand hotel, VoceChat is like a house. If Matrix and Mastodon are buses, VoceChat is like a car. The next paradigm of the internet is serverless functions + personal storage. Making VoceChat serverless is also a next step.
+
+# Webhook, bot, and ways to get interconnected (work in progress)
+
+Social media cannot always stay private if people want new information to be transferred among different servers. The word "social" in social media means multiple nodes communicate with multiple nodes in a synced space (mass to mass). A channel (private or public) should serve the end of this mass to mass data sharing and syncing space. Channel should function as a shared good where members who joined should have the right to store the same chat data (use their server)--this may one day functions like Bitcoin, yet currently, efficiency should be more prioritiezed and admin of the channel could have the right to assign different "power" to members. We have implemented both inbound and outbound webhooks so that it's possible to sync messages from a VoceChat channel to another channel (slack, discord, or VoceChat) though you will need to write your own server side code to personalize this process (this could be troublesome, and again, serverless could be a good solution). 
+
+We also found bot super interesting and personal bot services may replace platforms--e.g., we are training some bots based on GPT api that can be added to VoceChat.
+
+If you have a proposal on how multiple servers could get interconnected, e.g., should we support Matrix protocal, or other protocal, feel free to share your thougts in the discussions, or directly discuss it with at our chat at  https://voce.chat.
+
+# Free for personal use, require license for non-personal use.
+
+`VoceChat` is an open-source commercial software. The VoceChat server is the smallest, stablest and most efficient independent chat server on today's market, which is good for integration to your own app. VoceChat official image is free for personal use, which we define as equal or less than 20 registered users, if you want to integrate VoceChat to your own app/site for a larger user base, you have to purchase a license. The license is 49$/version.
+
+Our team also provide customization service. We also provide resale license for NAS and cloud providers who want to collaborate with us.
+
+### Project composition:
+
+| Name       | Tech                                | Project                                                   | License | Comment                                             |
+| ---------- | ----------------------------------- | --------------------------------------------------------- | ------- | --------------------------------------------------- |
+| Server     | Rust                                | [vocechat-server](https://github.com/privoce/vocechat-server-rust) | Big Time Public License   | Server supports Linux, Windows, ARM32/64 |
+| Server image | Docker, Shell                             | [vocechat-docker](https://hub.docker.com/r/privoce/vocechat-server/tags) | Creative Commons Attribution-NonCommercial 4.0 International     | Official image supports Linux, ARM64           |
+| APP Client | Flutter                             | [vocechat-client](https://github.com/privoce/vocechat-client) | GPLv3     | Client supports Android and IOS platforms           |
+| Web Client | React                               | [vocechat-web](https://github.com/privoce/vocechat-web)   | GPLv3     | Web App, integrated management                      |
+| Documentation   | [docusaurus](https://docusaurus.io) | [vocechat-doc](https://github.com/privoce/vocechat-doc)   | GPLv3     | Vocechat document website                           |
+
+### Feature list & roadmap
+
+- [x] DM & Group Chating / 2021-Q4
+- [x] Reply, @ to mention a person / 2021-Q4
+- [x] Images and large files transmission / 2021-Q4
+- [x] Pin / 2022-Q1
+- [x] Forward / 2022-Q1
+- [x] Favorate / 2022-Q1
+- [x] Auto-delete my messages / 2022-Q2
+- [x] Voice (now support agora) / 2022-Q4
+- [x] Video (now support agora)/ 2022-Q4
+- [x] Bot and Webhook (inbound and outbound)/ 2022-Q4
+- [ ] Role based permission control/ Undecided
+- [ ] Post, based on ActivityPub/ Undecided
+- [ ] Matrix Bridge/ Undecided
+
+
+Chat with us: https://voce.chat
+Email: han@privoce.com
diff --git a/build/docker/Dockerfile b/build/docker/Dockerfile
new file mode 100644
index 0000000..2783ffe
--- /dev/null
+++ b/build/docker/Dockerfile
@@ -0,0 +1,16 @@
+FROM alpine as certs
+RUN apk update && apk add ca-certificates
+
+FROM busybox
+COPY --from=certs /etc/ssl/certs /etc/ssl/certs
+COPY vocechat-server /home/vocechat-server/vocechat-server
+COPY config /home/vocechat-server/config
+COPY docker-entrypoint.sh /
+RUN chmod +x /docker-entrypoint.sh
+ENV VOCECHAT_FCM_PROJECT_ID=""\
+    VOCECHAT_FCM_PRIVATE_KEY=""\
+    VOCECHAT_FCM_CLIENT_EMAIL=""\
+    VOCECHAT_FCM_TOKEN_URI="https://oauth2.googleapis.com/token"
+EXPOSE 3000
+WORKDIR /home/vocechat-server
+ENTRYPOINT ["/docker-entrypoint.sh"]
\ No newline at end of file
diff --git a/build/docker/build.sh b/build/docker/build.sh
new file mode 100755
index 0000000..948b1eb
--- /dev/null
+++ b/build/docker/build.sh
@@ -0,0 +1,29 @@
+#!/bin/bash
+
+cd ../../
+
+#alias rust-musl-builder='docker run --rm -it -v "$(pwd)":/home/rust/src ekidd/rust-musl-builder'
+#rust-musl-builder cargo build --release
+docker run --rm -it -v "$(pwd)":/home/rust/src ekidd/rust-musl-builder cargo build --release
+
+if [ -f ./target/x86_64-unknown-linux-musl/release/vocechat-server ]; then
+
+  cp -rf ./target/x86_64-unknown-linux-musl/release/vocechat-server build/docker/vocechat-server
+  cp -rf config build/docker/
+
+  cd build/docker
+
+  # sudo docker login -u vocechat -p xxxxxx
+  # build arm64
+  sudo docker build --platform=linux/amd64 -t vocechat-server:latest .
+  docker tag vocechat-server:latest Privoce/vocechat-server:latest
+  docker push Privoce/vocechat-server:latest
+
+  # build arrch64
+  cp -rf ./target/aarch64-unknown-linux-musl/release/vocechat-server build/docker/vocechat-server
+  sudo docker build --platform=linux/arm64 -t vocechat-server:latest-arm64 .
+  docker tag vocechat-server:latest-arm64 Privoce/vocechat-server:latest-arm64
+  docker push Privoce/vocechat-server:latest-arm64
+  #rm -rf  ./config
+
+fi
\ No newline at end of file
diff --git a/build/docker/deploy.sh b/build/docker/deploy.sh
new file mode 100644
index 0000000..0cc6cc3
--- /dev/null
+++ b/build/docker/deploy.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+mkdir -p ~/.vocechat-server/data/cert
+docker stop vocechat-server
+docker rm vocechat-server
+docker pull Privoce/vocechat-server:latest
+docker run -d --restart=always \
+  -p 443:443 \
+  --name vocechat-server \
+  -v ~/.vocechat-server/data:/home/vocechat-server/data \
+  Privoce/vocechat-server:latest \
+  --network.bind "0.0.0.0:443" \
+  --network.domain "chat.domain.com" \
+  --network.tls.type "acme_tls_alpn_01" \
+  --network.tls.acme.directory_url "https://acme-v02.api.letsencrypt.org/directory" \
+  --network.tls.acme.cache_path "/home/vocechat-server/data/cert"
+docker logs -f vocechat-server
\ No newline at end of file
diff --git a/build/docker/docker-compose.yaml b/build/docker/docker-compose.yaml
new file mode 100644
index 0000000..bf5fb9e
--- /dev/null
+++ b/build/docker/docker-compose.yaml
@@ -0,0 +1,27 @@
+version: '3'
+services:
+  vocechat:
+    image: vocechat-server:latest
+    container_name: vocechat-server
+    build:
+      context: .
+      dockerfile: Dockerfile
+    command:
+        "/docker-entrypoint.sh"
+        - "--network.bind"
+        - "0.0.0.0:3000"
+        - "--network.domain"
+        - "localhost"
+#    environment:
+#      - UID=1000
+#      - GID=1000
+#      - ADMIN_USER=admin
+#      - ADMIN_PASSWORD=123456
+#      - DOMAIN=localhost
+    volumes:
+      - /share/data/docker/vocechat-server/data:/home/vocechat-server/data
+    expose:
+      - 3000
+    ports:
+      - 3000:3000/tcp
+    restart: always
\ No newline at end of file
diff --git a/build/docker/docker-entrypoint.sh b/build/docker/docker-entrypoint.sh
new file mode 100644
index 0000000..8258aa9
--- /dev/null
+++ b/build/docker/docker-entrypoint.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+#uid=${UID:=$(id -u)}
+#gid=${GID:=$(id -g)}
+#admin_user=${ADMIN_USER:="admin"}
+#admin_password=${ADMIN_PASSWORD:="123456"}
+#domain=${DOMAIN:=""}
+#
+#if test ! -z $domain; then
+#  sed -i "s/# domain = .*\$/domain = \"$domain\"/ig" /home/vocechat-server/config/config.toml
+#fi
+#
+#if grep -q "name = \"$admin_user\"" /home/vocechat-server/config/config.toml; then
+#cat <<EOT >> /home/vocechat-server/config/config.toml
+#[[user]]
+#name = "$admin_user"
+#password = "$admin_password"
+#email = "$admin_user@$domain"
+#is_admin = true
+#EOT
+#fi
+
+cd /home/vocechat-server/
+cmd="./vocechat-server"
+if test $# -gt 0; then
+  case "$1" in
+      *.toml)
+        cmd="./vocechat-server $@"
+        break
+        ;;
+      --*)
+        cmd="./vocechat-server $@"
+        break
+        ;;
+      *) cmd="$@";;
+  esac
+fi
+echo $cmd
+$cmd
+# exec "$cmd"
diff --git a/build/shell/install.sh b/build/shell/install.sh
new file mode 100755
index 0000000..526678c
--- /dev/null
+++ b/build/shell/install.sh
@@ -0,0 +1,238 @@
+#!/bin/sh
+# auto-check version requires repo to be public
+# VOCECHAT_SERVER_VERION=`curl -s https://github.com/Privoce/vocechat-server/releases/latest | sed "s/.*tag\/\(.*\)\".*/\1/ig"`
+VOCECHAT_SERVER_VERION="v0.3.1"
+ARCH=`uname -m`
+OS=`uname`
+PLATFORM="x86_64-unknown-linux-musl"
+WORK_DIR=""
+BIND_PORT=3000
+DOMAIN=""
+HTTPS_ON=""
+#PWD=`pwd`
+
+echo "  ┌────────────────────────────────────────────────────────────────� "
+echo "  │              vocechat-server $VOCECHAT_SERVER_VERION installation guide         │ "
+echo "  └────────────────────────────────────────────────────────────────┘ "
+
+x_read() {
+  read -r $1 < /dev/tty
+}
+
+
+
+have_command() {
+  if command -v $1 >/dev/null 2>&1; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+check_env() {
+  if test "$OS" != "Darwin"; then
+    if have_command apt; then
+      apt install -y unzip
+    fi
+  fi
+  echo ""
+}
+
+error_exit() {
+  echo -e "\033[31m$1\033[0m"
+  exit
+}
+
+sed_replace() {
+  if test "$OS" = "Darwin" ; then
+    sed -i "" $*
+  else
+    sed -i $*
+  fi
+}
+random_64() {
+  for i in {1..64}
+  do
+     echo $(( RANDOM % 10 )) | xargs echo -n
+  done
+}
+is_writable()
+{
+  if test ! -d $1; then
+    mkdir -p $1;
+  fi
+  if test -w $1; then
+    return 0
+  fi
+  return 1
+}
+port_in_use()
+{
+  n=`netstat -nlpt|grep ":$1 "|wc -l`
+  if test $n -gt 0; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+input_writable_dir()
+{
+  WORK_DIR=""
+  for workdir in /share/Download ~ `pwd`; do
+    if test -d $workdir; then
+      workdir2="$workdir/.vocechat-server"
+      if is_writable $workdir2; then
+        WORK_DIR=$workdir2;
+        break;
+      fi
+    fi
+  done
+  echo -e "Installation path (Default: \033[31m$WORK_DIR\033[0m):"
+  while true; do
+    x_read workdir
+    if test "$workdir" != ""; then
+      WORK_DIR=$workdir
+    fi
+    if test ! -w $WORK_DIR; then
+      echo "$WORK_DIR is unwritable! "
+    else
+      break
+    fi
+ done
+}
+
+input_domain()
+{
+  echo "Please input domain (Default empty):"
+  x_read DOMAIN
+  if test "$DOMAIN" != ""; then
+    input_https_on
+  fi
+}
+
+input_https_on()
+{
+  echo "Enable HTTPS: [y,n] (Default n)"
+  x_read HTTPS_ON
+  HTTPS_ON=$(echo $HTTPS_ON|tr [A-Z] [a-z])
+  if test "$HTTPS_ON" = "y"; then
+    if port_in_use 443; then
+      error_exit "Port 443 is in use! Enable SSL requires opening port 443."
+    fi
+  fi
+}
+
+install_as_service()
+{
+  echo "Start with system launched: [y,n] (Default: n)"
+  x_read AS_SERVICE
+  if test "$AS_SERVICE" = "y"; then
+    if test "$OS" = "Darwin"; then
+      cat >> ~/Library/LaunchAgents/com.vocechat.server.plist << EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+        <key>Label</key>
+        <string>com.vocechat.server.plist</string>
+        <key>ProgramArguments</key>
+        <array>
+                <string>bin/vocechat-server</string>
+                <string>config/config.toml</string>
+        </array>
+        <key>RunAtLoad</key>
+        <true/>
+</dict>
+</plist>
+EOF
+    fi
+  fi
+}
+
+check_env
+
+input_writable_dir
+
+cd $WORK_DIR
+if test -d $WORK_DIR/data/db; then
+  rm -rf $WORK_DIR/data
+fi
+
+input_domain
+
+
+case $ARCH in
+  arm64)
+    if test `uname` = "Darwin"; then
+      PLATFORM="aarch64-apple-darwin"
+    else
+      PLATFORM="aarch64-unknown-linux-musl"
+    fi
+    ;;
+  aarch64)
+    PLATFORM="aarch64-unknown-linux-musl"
+    ;;
+  armv7l | arm)
+    PLATFORM="armv7-unknown-linux-musleabihf"
+    ;;
+  x86_64)
+    if test `uname` = "Darwin"; then
+      PLATFORM="x86_64-apple-darwin"
+    else
+      PLATFORM="x86_64-unknown-linux-musl"
+    fi
+    ;;
+  *)
+    echo -n "error: not supportted arch $(ARCH)!"
+    exit
+    ;;
+esac
+
+echo -e "Detected platform: \033[31m$PLATFORM\033[0m."
+
+BIN_NAME="vocechat-server-$VOCECHAT_SERVER_VERION-$PLATFORM.zip"
+BIN_URL="https://s.voce.chat/$BIN_NAME"
+echo "Downloading URL: $BIN_URL"
+
+# clear old data:
+kill `pidof vocechat-server` 2>/dev/null
+if test ! -f vocechat-server.zip; then
+  curl --progress-bar -f $BIN_URL -o vocechat-server.zip || exit
+fi
+unzip -oq vocechat-server.zip || exit
+chmod a+x vocechat-server
+
+
+curl -f "https://s.voce.chat/vocechat-server.sh" -o vocechat-server.sh || exit
+if test "$DOMAIN" != ""; then
+  sed -i "s/# domain = .*\$/domain = \"$DOMAIN\"/ig" config/config.toml
+  echo $HTTPS_ON
+  if test "$HTTPS_ON" = "y"; then
+    BIND_PORT=443
+    sed -i "s/bind = .*\$/bind = \"0.0.0.0:$BIND_PORT\"/ig" config/config.toml
+    sed -i ':a;N;$!ba;s/# \[network\.tls\]/[network.tls]/4' config/config.toml
+    sed -i ':a;N;$!ba;s/# type = \"acme_tls_alpn_01\"/type = "acme_tls_alpn_01"/1' config/config.toml
+    sed -i ':a;N;$!ba;s/# cache_path/cache_path/2' config/config.toml
+    mkdir -p $WORK_DIR/data/cert
+    # tr '\n' '^' < config/config.toml | sed 's/# \[network\.tls\]/[network.tls]/4' | tr '^' '\n' > config/config2.toml
+  fi
+fi
+
+sed_replace "s#WORKDIR=.*\$#WORKDIR=\"$WORK_DIR\"#ig" vocechat-server.sh
+
+chmod a+x vocechat-server.sh
+
+if test -d /etc/init.d/; then
+  cp -rf vocechat-server.sh /etc/init.d/
+  echo "install done! "
+  echo "run: /etc/init.d/vocechat-server.sh start|stop|restart"
+else
+  echo "/etc/init.d/ does not exists, refused! please try Ubuntu or CentOS, you can contact han@privoce.com."
+  exit
+  # echo "run: /etc/init.d/vocechat-server.sh start|stop|restart"
+fi
+
+export PATH=$PATH:$WORK_DIR
+echo "export PATH=\$PATH:$WORK_DIR" >> /etc/profile
+#cd $PWD
diff --git a/build/shell/vocechat-server.sh b/build/shell/vocechat-server.sh
new file mode 100644
index 0000000..e29c5fd
--- /dev/null
+++ b/build/shell/vocechat-server.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+START=90
+STOP=10
+RETVAL=0
+
+PWD=`pwd`
+WORKDIR=""
+
+cd $WORKDIR
+mkdir data/wwwroot
+case "$1" in
+  start)
+    echo -n "Starting vocechat-server:"
+    ./vocechat-server config/config.toml --daemon --stdout=data/vocechat-server.log 2>&1
+    echo -e "\033[32m [OK] \033[0m"
+    ;;
+  stop)
+    echo -n "Shutting down vocechat-server:"
+    kill `pidof vocechat-server` 2>&1
+    echo -e "\033[32m [OK] \033[0m"
+    RETVAL=$?
+    ;;
+  restart)
+    $0 stop
+    $0 start
+    RETVAL=$?
+    ;;
+  log)
+    tail -f $WORKDIR/data/vocechat-server.log
+    ;;
+  *)
+    echo "Usage $0 {start|stop|restart}"
+    cd $PWD
+    exit 1
+esac
+
+cd $PWD
\ No newline at end of file
diff --git a/cert/ca.crt b/cert/ca.crt
new file mode 100644
index 0000000..224d792
--- /dev/null
+++ b/cert/ca.crt
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFhjCCA24CCQCCJqbypeaQ3zANBgkqhkiG9w0BAQsFADCBhDELMAkGA1UEBhMC
+Q04xEDAOBgNVBAgMB0JlaWppbmcxEDAOBgNVBAcMB0JlaWppbmcxETAPBgNVBAoM
+CFJ1c3RjaGF0MRswGQYDVQQDDBJSdXN0Y2hhdCBTZXJ2ZXIgQ0ExITAfBgkqhkiG
+9w0BCQEWEmFkbWluQHJ1c3RjaGF0LmNvbTAeFw0yMTEyMjkwNTE2NDhaFw0zMTEy
+MjcwNTE2NDhaMIGEMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHQmVpamluZzEQMA4G
+A1UEBwwHQmVpamluZzERMA8GA1UECgwIUnVzdGNoYXQxGzAZBgNVBAMMElJ1c3Rj
+aGF0IFNlcnZlciBDQTEhMB8GCSqGSIb3DQEJARYSYWRtaW5AcnVzdGNoYXQuY29t
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA4mGgT49d1jwhZIp/ezop
+1o+kJChww+roIYVBL1J71cqWd6E+w9KeSE9UT3HYsXvM9q2XwcFjyZCT0eko3evW
+E8Tt/C8jlO/gjhAiNQu20RtPMELwLnexq3+3zpg8lAVywtAwTJk29/uP3/13jraR
+PsbRqlydFyikQwlswV6nCTwUXTN3IjJdf/Ej58G+D4+CDzBpsA1hlzt5q0dGOVRK
+1zUvwJ0Urz48unDGVHSl6rgsww6v7H2GCiCspRSdXBvrqJKM+bJoU0R+ITRD90Po
+z725NBcdxYtOP1NBbNnihqjvjagvn1ODy1bGtkGBUjRuBEjSn2A8UxHO5999lZQ4
+vLWPa5YI9Kt6GQ23lx9NE11DsAnzvfVtJ3Sr5J1F7LgX8+XNYUH5LrM27/eFgOSX
+HMbv3FNJ8kbaHuAlXxhEQFTub7qIwF++U+kyKwZUMWHa392Dq1ejI33cOkfx5HdS
+fPGcvmskE0R+dE+fI/g/t05i5ayp3csaLJlcgu0IFdO4coKhPte1+Zq1OEd/Kh+w
+/DqETlyR0Ga+kmzE+Y02yQTXvIlzJZ/CYdbz8dC27KAXMCI9A1ra6oHs+VhvMmrn
+MIk96uWEbir0RdJcDrZgnAJmh1/wkPPbS+R2Qwbj70qOpFCDg0B9r7ydhybbP0op
+REvvOBKaDdDMtw5bEN1/wZUCAwEAATANBgkqhkiG9w0BAQsFAAOCAgEAkSdY7ttI
+4Fj6tUKV8447fX2XRBO5GZo2ZtuB+udE3ioRkO/KOrvaSm0GwqceFKnmebk5OR2P
+yZNC3caZ9/Z+M0ebkA1XlK6tsdVCY8jhpct2gg9yRlMdOMIkvhkLaXCBejy8+FDO
+ito5Aq67WB8jUfpWl2vw51oDVGdJjjt08AIxXzcYzngGPGxvonh9aD5oMoaqz5ak
+2WR7FwUkYCMT9KMAd4orSYykBdJMfu/AfTooTOMrztdUkznC46L3Wlr6+sJgWW+Q
+nnxn8drqeHDLRk/aFvRjJa3nOquqBwLSGgNJfiUfiMKfzswPvujhGSeQushe7Gbu
+9c8Jho5ELgAqqfx0EAKqsgx3/Pq4o1vgmaHHE/eOpMdrpRaCHg403Z0kAr1cAsgQ
+4puOEdt2mWVA0Lle5NRwkL/j5zceBQr7PLtEN9RuxpaQQI7xo3Lf+lD61PdL385F
+zQlDygoXtnrlBCSHEat49erGov15uqf1S8yF4rR375jwW59JJGHdaL8SLoI/msIg
+aD0nWUzS2TPD/FrniI58uHo+zuxC2spAigFeI6vkqRQCKVrWF7002Q6e+eukIySN
+eVY8Ilq8+4+wF1lTf2qSkbRkHZDt6SMyP8w7bOUgZ0pIJEfYcQWtC6WreCQ4GyjI
+CxSyHWv+MGOb/MlIx7XDW/GtErMHLpGgPvE=
+-----END CERTIFICATE-----
diff --git a/cert/ca.key b/cert/ca.key
new file mode 100644
index 0000000..4cfc3af
--- /dev/null
+++ b/cert/ca.key
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDiYaBPj13WPCFk
+in97OinWj6QkKHDD6ughhUEvUnvVypZ3oT7D0p5IT1RPcdixe8z2rZfBwWPJkJPR
+6Sjd69YTxO38LyOU7+COECI1C7bRG08wQvAud7Grf7fOmDyUBXLC0DBMmTb3+4/f
+/XeOtpE+xtGqXJ0XKKRDCWzBXqcJPBRdM3ciMl1/8SPnwb4Pj4IPMGmwDWGXO3mr
+R0Y5VErXNS/AnRSvPjy6cMZUdKXquCzDDq/sfYYKIKylFJ1cG+uokoz5smhTRH4h
+NEP3Q+jPvbk0Fx3Fi04/U0Fs2eKGqO+NqC+fU4PLVsa2QYFSNG4ESNKfYDxTEc7n
+332VlDi8tY9rlgj0q3oZDbeXH00TXUOwCfO99W0ndKvknUXsuBfz5c1hQfkuszbv
+94WA5Jccxu/cU0nyRtoe4CVfGERAVO5vuojAX75T6TIrBlQxYdrf3YOrV6Mjfdw6
+R/Hkd1J88Zy+ayQTRH50T58j+D+3TmLlrKndyxosmVyC7QgV07hygqE+17X5mrU4
+R38qH7D8OoROXJHQZr6SbMT5jTbJBNe8iXMln8Jh1vPx0LbsoBcwIj0DWtrqgez5
+WG8yaucwiT3q5YRuKvRF0lwOtmCcAmaHX/CQ89tL5HZDBuPvSo6kUIODQH2vvJ2H
+Jts/SilES+84EpoN0My3DlsQ3X/BlQIDAQABAoICAQCzg5j9HgHaPap5ML5weCnv
+I86UgaESKvfShPmwzea3HMP+r1W3MRAk5QtFSFD+RN6+id96XKGFl+kwHoUyna4P
+1SymurarhyB5Zt/JUrWw0cgUzC/rmSzBgzC9WclH054yT6bNRv3o3Yo0o6kn+Svq
+LPzb7D8Bu0+ufQ3JtQYd849ubL4+1tN//jdrsx3E9xa6driIS8QkiZwsrwNHuMj0
+KQ/p3GYnpOHBMmaDWFCtdUjBkKb+kHc3Frvw2A0EmntgHH5ADzJdPUYLjIeMz0QR
+YDA5107bdGEjJCEQcSMJh3MW0NSasj4jg3dl1UH4bu0C5sBmc4jCkq+Q/Y93iqcF
+t57rBz9pcj/i6STaGRjl8ptC03O2dF6VBConCHCPcBMs8LDxJ7qbPWusRKXwbvWI
+kGQba/5PxPjDzVrf+ubXEtRhMDdCgnfLb8N313e9X9mBhTIkUX1hH5SFxZwJSuYt
+3TjobNVSfacjYAyjYHH/VjJB61j21BcEOuqpOqxh6Tf0bAEh014g7qCuIFCQwzxm
+FkpZNQPOTFk+bty4l9/brllvXoarJ2O9/L7mWtLq9d2AjRzU5XVCRZtPtovGyG6J
+qZFfP4kieU7E/gnVfCKuL4jMgkhlUtgAlfDVucEFCSFp3zVi/w8JUSmmCDIPEqmw
+BQ5aNBDtQmH7dVgQGPL6gQKCAQEA+ecsuhMMpdo11DCW+8T5XPFO0XEnDW/9j0Yf
+VAcOmw+GLtlJYTZzhqcD1ohVyQML8K0bn071pgt9tg1nwHk/oMDqE1nUOYq1+B9n
+ZNIUyKCSN+qc5Jg3O5J14CtPdGrkQH5CYw3Kp/lFBSIzvyaswblRgqO4X/Yc7sSF
+qwdleFgt8AyCcAqYi1g68gZ4P6VaN9ETvaG7rSbA6XaMMgiJ1yMWJ29OjXbCOWqi
+I+XK3jHWHKjmDYXW1hxo8mOTNNRBk4G4VzAWHVOZ71DoI2gL2aQP05bZMIwaWPq6
+aafVtHdLjXVX6ZO4bcerjN2pegbyaeWq++1OpjFxoU8tCuNb9QKCAQEA5+eKp6x3
+Rak9xkjQOAJUnQgzpEnkOrxk/+iUeKkT+Kf97yjuMhcfry+L5Iapsmm/rSPXynB+
+PXJi2YpEi2YWq6iUKECjQ+iu00f/IzAHw3bHNSN+ndTd4U55iMQjpjlttd5u63kb
+k/Il5CZpLQwElUZsJu+b2Xbx2Xwm06lyQbPLjOxXTQ3usunqCKWZmIig/MqrYCGO
+aVm8p9jFoyM8ApUwWdFjtDWExCWjRVg72L2P61DscIShBNMsW15J5YWvOMDeRbfY
+LnzkbvzO+FPqGix9RtwSakjqadsC48WIJmG8BJ6LeTBgaxJLS3MjZdtDgBEhiCyn
+bSupzT52kEvrIQKCAQEA1SnJzxa8rSQK0mp3/14vToZPMvwP0bh7UqD/zA8Q+Fcv
+n/qcSx3FQVBpR6+XbRT6NFuUujkB9JbMrmOU4msKSTcE82imTEbznSg8a5V/QPsm
+fifTmHH2ewwdHBAVgDpFZHXObuuut8U6iHx6I0z8A2ruCj9Y4BHw8AIV+qMefJ7K
+4H3rLWL8Z6/k59l47OFAqWfgLNsuWS47U2lZgLwjx60YEp8xJB3u4kcA8xnqB8n+
+1weC5HoLnSsyob8qK9/557a45TYRRwauwaIDwV/Y69az4UpFDNIVD10fcUxGT9+K
+RKmZSZZFtO6ieFADZiFS2d2cEbSEZ+K5CF2fEDCLmQKCAQAzW7H3ZFid0tddfG6w
+mMOIa3KUZdDnuSVdD3MiLb/Ah+PS/WuTKE/aClue5rvaSVUr0Q5PRQ6QKS7/IoH/
+pUJMDe+R4o7F0Vg2bnFwp4hwn3OKryuxZJ0m8qwzv8xtWbaUWoiSGaYj47LEjkUo
+tsqlDI2TKemIBbGWCsrGgXZOWrUvpn/HDtjYQrmT5KjZgRi2I2REy+mwJzGCsp1C
+feEiaUvl+FtuY5PdpMA98UZ/v6uJ38gdOyI14VanfYA8FpkxpnUTV53G3d3xPofP
+szXbShMMiFyDsVZIzzoam3qFlYuAMmSNGEuiKtEGCp/CRQbz69dTQyBpKwxV6glz
+93xBAoIBABr04VG9jN+Sk2G9v9ZCKr/t2K6Cku/4mjbkgTcHGauOF/urSWksoadj
+rhyQbik3XgG+8u+CI9hH/FxBK9f6aypn2/vtgzM+r8DuBn9AX7qK2hVvnUaI78/Y
+Hb0Ef7P8nwVbGYLv4Sw96yXJLa4FT0L2H/hRmNq11uMIKrQ+88+RK9JcZstn9oWV
+0AVYYXm83so+BtW6wwLflPEWicdpyMwd4qrJq6MHNhWwtGzTq2gqRpfuZvlYzp9D
+OQDWsStE54+m79Ymwi7HJV3frJeymXjTzWt/dXTfLtxkxVQOieSm/KDpvmiQzxGD
+TgdMxd0hKCEjjYqMbTgv5yjurUi9dD4=
+-----END PRIVATE KEY-----
diff --git a/cert/create.sh b/cert/create.sh
new file mode 100644
index 0000000..ba6fa7e
--- /dev/null
+++ b/cert/create.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# Create private key file
+openssl genpkey -algorithm RSA \
+    -pkeyopt rsa_keygen_bits:4096 \
+    -pkeyopt rsa_keygen_pubexp:65537 | \
+    openssl pkcs8 -topk8 -nocrypt -outform pem > voce.chat.key
+
+# generate CSR file
+openssl req -subj "/C=US/ST=Arizona/L=Scottsdale/O=Vocechat,Inc./CN=voce.chat/emailAddress=api.privoce@gmail.com" \
+    -new -days 3650 -key voce.chat.key -out voce.chat.csr
+
+# generate self-sign file
+openssl x509 -signkey voce.chat.key -in voce.chat.csr -req -days 365 -out voce.chat.crt
+
+# view certificate
+openssl req -text -noout -verify -in voce.chat.csr
\ No newline at end of file
diff --git a/config/config-tls.toml b/config/config-tls.toml
new file mode 100644
index 0000000..1e08546
--- /dev/null
+++ b/config/config-tls.toml
@@ -0,0 +1,7 @@
+[system]
+server_key = "a secret key"
+data_dir = "./data"
+
+[network]
+bind = "0.0.0.0:3000"
+tls = true
diff --git a/config/config.toml b/config/config.toml
new file mode 100644
index 0000000..09b2949
--- /dev/null
+++ b/config/config.toml
@@ -0,0 +1,46 @@
+# webclient_url = "https://github.com/Privoce/vocechat-web/releases/latest/download"
+webclient_url = "https://s.voce.chat/web_client/v0.3.x"
+
+[system]
+data_dir = "./data"
+token_expiry_seconds = 300
+refresh_token_expiry_seconds = 604800
+# magic_token_expiry_seconds = 600
+
+[network]
+bind = "0.0.0.0:3000"
+# domain = "chat.privoce.com"
+frontend_url = "http://1.2.3.4:4000"
+
+# [network.tls]
+# type = "self_signed"
+
+# [network.tls]
+# type = "certificate"
+# cert = "...."
+# key = "...."
+# path = "./cert/"
+
+# [network.tls]
+# type = "acme_http_01"
+# directory_url = "https://acme-v02.api.letsencrypt.org/directory"
+# http_bind = "0.0.0.0:80"
+# cache_path = "./data/cert"
+
+# [network.tls]
+# type = "acme_tls_alpn_01"
+# directory_url = "https://acme-v02.api.letsencrypt.org/directory"
+# cache_path = "./data/cert"
+
+[template.register_by_email]
+subject = "Register code"
+file = "templates/register_by_email.html"
+
+[template.login_by_email]
+subject = "Your sign-in link for Vocechat"
+file = "templates/login_by_email.html"
+
+#[[user]]
+#name = "Guest"
+#password = "123456"
+#email = "guest@voce.chat"
diff --git a/config/templates/login_by_email.html b/config/templates/login_by_email.html
new file mode 100644
index 0000000..64dbf94
--- /dev/null
+++ b/config/templates/login_by_email.html
@@ -0,0 +1,223 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>VoceChat Link</title>
+    <style type="text/css">
+        #outlook a {
+            padding: 0;
+        }
+
+        body {
+            width: 100% !important;
+            -webkit-text-size-adjust: 100%;
+            -ms-text-size-adjust: 100%;
+            margin: 0;
+            padding: 0;
+        }
+
+        .ExternalClass {
+            width: 100%;
+        }
+
+        .ExternalClass,
+        .ExternalClass p,
+        .ExternalClass span,
+        .ExternalClass font,
+        .ExternalClass td,
+        .ExternalClass div {
+            line-height: 100%;
+        }
+
+        #backgroundTable {
+            margin: 0;
+            padding: 0;
+            width: 100% !important;
+            line-height: 100% !important;
+        }
+
+        img {
+            outline: none;
+            text-decoration: none;
+            -ms-interpolation-mode: bicubic;
+        }
+
+        a img {
+            border: none;
+        }
+
+        .image_fix {
+            display: block;
+        }
+
+        p {
+            margin: 1em 0;
+        }
+
+        h1,
+        h2,
+        h3,
+        h4,
+        h5,
+        h6 {
+            color: black !important;
+        }
+
+        h1 a,
+        h2 a,
+        h3 a,
+        h4 a,
+        h5 a,
+        h6 a {
+            color: blue !important;
+        }
+
+        h1 a:active,
+        h2 a:active,
+        h3 a:active,
+        h4 a:active,
+        h5 a:active,
+        h6 a:active {
+            color: red !important;
+        }
+
+        h1 a:visited,
+        h2 a:visited,
+        h3 a:visited,
+        h4 a:visited,
+        h5 a:visited,
+        h6 a:visited {
+            color: purple !important;
+        }
+
+        table td {
+            border-collapse: collapse;
+        }
+
+        table {
+            border-collapse: collapse;
+            mso-table-lspace: 0pt;
+            mso-table-rspace: 0pt;
+        }
+
+        a {
+            color: orange;
+        }
+
+        @media only screen and (max-device-width: 480px) {
+
+            a[href^="tel"],
+            a[href^="sms"] {
+                text-decoration: none;
+                color: black;
+                /* or whatever your want */
+                pointer-events: none;
+                cursor: default;
+            }
+
+            .mobile_link a[href^="tel"],
+            .mobile_link a[href^="sms"] {
+                text-decoration: default;
+                color: orange !important;
+                /* or whatever your want */
+                pointer-events: auto;
+                cursor: default;
+            }
+        }
+
+        @media only screen and (min-device-width: 768px) and (max-device-width: 1024px) {
+
+            a[href^="tel"],
+            a[href^="sms"] {
+                text-decoration: none;
+                color: blue;
+                pointer-events: none;
+                cursor: default;
+            }
+
+            .mobile_link a[href^="tel"],
+            .mobile_link a[href^="sms"] {
+                text-decoration: default;
+                color: orange !important;
+                pointer-events: auto;
+                cursor: default;
+            }
+        }
+
+        #email_body {
+            font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif !important;
+            width: 500px;
+        }
+
+        img {
+            display: block;
+        }
+
+        a {
+            text-decoration: none;
+        }
+
+        #email_body .p {
+            font-style: normal;
+            font-weight: 400;
+            font-size: 12px;
+            line-height: 18px;
+            color: #1D2939;
+        }
+
+        #email_body .logo {
+            width: 64px;
+            height: 64px;
+        }
+
+        #email_body .btn {
+            display: inline-block;
+            width: auto;
+            margin: 32px 0;
+            padding: 12px 20px;
+            text-decoration: none;
+            font-style: normal;
+            font-weight: 500;
+            font-size: 16px;
+            line-height: 24px;
+            color: #FFFFFF;
+            background: #22CCEE;
+            border: 1px solid #22CCEE;
+            box-shadow: 0px 1px 2px rgba(16, 24, 40, 0.05);
+            border-radius: 8px;
+        }
+
+        #email_body .hl {
+            color: #22CCEE;
+        }
+    </style>
+</head>
+
+<body>
+    <div id="email_body">
+        <img src="https://s.voce.chat/logo.png" alt="Vocechat logo" width="64" height="64" class="logo" />
+        <div class="tip">
+            <div class="p">
+                Click the button below to log in to Vocechat.
+            </div>
+            <div class="p">
+                This button will expire in 3 minutes.
+            </div>
+        </div>
+        <a href="{{ url }}/?magic_token={{ magic_token }}&exists={{ exists }}#/login" class="btn">Login to
+            Vocechat</a>
+        <div class="tail">
+            <div class="p">Button not showing? <a
+                    href="{{ url }}/?magic_token={{ magic_token }}&exists={{ exists }}#/login" class="hl link">Click
+                    here</a>
+            </div>
+            <div class="p">Confirming this request will securely log you in using <span class="hl">
+                    {{ email }}
+                </span>.</div>
+        </div>
+    </div>
+</body>
+
+</html>
\ No newline at end of file
diff --git a/config/templates/register_by_email.html b/config/templates/register_by_email.html
new file mode 100644
index 0000000..7cf5e4a
--- /dev/null
+++ b/config/templates/register_by_email.html
@@ -0,0 +1,224 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>VoceChat Link</title>
+    <style type="text/css">
+        #outlook a {
+            padding: 0;
+        }
+
+        body {
+            width: 100% !important;
+            -webkit-text-size-adjust: 100%;
+            -ms-text-size-adjust: 100%;
+            margin: 0;
+            padding: 0;
+        }
+
+        .ExternalClass {
+            width: 100%;
+        }
+
+        .ExternalClass,
+        .ExternalClass p,
+        .ExternalClass span,
+        .ExternalClass font,
+        .ExternalClass td,
+        .ExternalClass div {
+            line-height: 100%;
+        }
+
+        #backgroundTable {
+            margin: 0;
+            padding: 0;
+            width: 100% !important;
+            line-height: 100% !important;
+        }
+
+        img {
+            outline: none;
+            text-decoration: none;
+            -ms-interpolation-mode: bicubic;
+        }
+
+        a img {
+            border: none;
+        }
+
+        .image_fix {
+            display: block;
+        }
+
+        p {
+            margin: 1em 0;
+        }
+
+        h1,
+        h2,
+        h3,
+        h4,
+        h5,
+        h6 {
+            color: black !important;
+        }
+
+        h1 a,
+        h2 a,
+        h3 a,
+        h4 a,
+        h5 a,
+        h6 a {
+            color: blue !important;
+        }
+
+        h1 a:active,
+        h2 a:active,
+        h3 a:active,
+        h4 a:active,
+        h5 a:active,
+        h6 a:active {
+            color: red !important;
+        }
+
+        h1 a:visited,
+        h2 a:visited,
+        h3 a:visited,
+        h4 a:visited,
+        h5 a:visited,
+        h6 a:visited {
+            color: purple !important;
+        }
+
+        table td {
+            border-collapse: collapse;
+        }
+
+        table {
+            border-collapse: collapse;
+            mso-table-lspace: 0pt;
+            mso-table-rspace: 0pt;
+        }
+
+        a {
+            color: orange;
+        }
+
+        @media only screen and (max-device-width: 480px) {
+
+            a[href^="tel"],
+            a[href^="sms"] {
+                text-decoration: none;
+                color: black;
+                /* or whatever your want */
+                pointer-events: none;
+                cursor: default;
+            }
+
+            .mobile_link a[href^="tel"],
+            .mobile_link a[href^="sms"] {
+                text-decoration: default;
+                color: orange !important;
+                /* or whatever your want */
+                pointer-events: auto;
+                cursor: default;
+            }
+        }
+
+        @media only screen and (min-device-width: 768px) and (max-device-width: 1024px) {
+
+            a[href^="tel"],
+            a[href^="sms"] {
+                text-decoration: none;
+                color: blue;
+                pointer-events: none;
+                cursor: default;
+            }
+
+            .mobile_link a[href^="tel"],
+            .mobile_link a[href^="sms"] {
+                text-decoration: default;
+                color: orange !important;
+                pointer-events: auto;
+                cursor: default;
+            }
+        }
+
+        #email_body {
+            font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell, 'Open Sans', 'Helvetica Neue', sans-serif !important;
+            width: 500px;
+        }
+
+        img {
+            display: block;
+        }
+
+        a {
+            text-decoration: none;
+        }
+
+        #email_body .p {
+            font-style: normal;
+            font-weight: 400;
+            font-size: 12px;
+            line-height: 18px;
+            color: #1D2939;
+        }
+
+        #email_body .logo {
+            width: 64px;
+            height: 64px;
+        }
+
+        #email_body .btn {
+            display: inline-block;
+            width: auto;
+            margin: 32px 0;
+            padding: 12px 20px;
+            text-decoration: none;
+            font-style: normal;
+            font-weight: 500;
+            font-size: 16px;
+            line-height: 24px;
+            color: #FFFFFF;
+            background: #22CCEE;
+            border: 1px solid #22CCEE;
+            box-shadow: 0px 1px 2px rgba(16, 24, 40, 0.05);
+            border-radius: 8px;
+        }
+
+        #email_body .hl {
+            color: #22CCEE;
+        }
+    </style>
+</head>
+
+<body>
+    <div id="email_body">
+        <img src="https://s.voce.chat/logo.png" alt="Vocechat logo" width="64" height="64" class="logo" />
+        <div class="tip">
+            <div class="p">
+                Click the button below to log in to Vocechat.
+            </div>
+            <div class="p">
+                This button will expire in 3 minutes.
+            </div>
+        </div>
+        <a href="{{ url }}/?email={{ email }}&gid={{ gid }}&magic_token={{ magic_token }}#/register/set_name"
+            class="btn">Login to
+            Vocechat</a>
+        <div class="tail">
+            <div class="p">Button not showing? <a
+                    href="{{ url }}/?email={{ email }}&gid={{ gid }}&magic_token={{ magic_token }}#/register/set_name"
+                    class="hl link">Click here</a>
+            </div>
+            <div class="p">Confirming this request will securely log you in using <span class="hl">
+                    {{ email }}
+                </span>.</div>
+        </div>
+    </div>
+</body>
+
+</html>
\ No newline at end of file
diff --git a/crates/agora-token/Cargo.toml b/crates/agora-token/Cargo.toml
new file mode 100644
index 0000000..1ec29c4
--- /dev/null
+++ b/crates/agora-token/Cargo.toml
@@ -0,0 +1,12 @@
+[package]
+name = "agora-token"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+base64 = "0.13.0"
+checksum = "0.2.1"
+fastrand = "1.6.0"
+hmac = "0.11.0"
+sha2 = "0.9"
+thiserror = "1.0.30"
diff --git a/crates/agora-token/src/lib.rs b/crates/agora-token/src/lib.rs
new file mode 100644
index 0000000..3284d1e
--- /dev/null
+++ b/crates/agora-token/src/lib.rs
@@ -0,0 +1,98 @@
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use hmac::{Mac, NewMac};
+use sha2::Sha256;
+
+const VERSION: &str = "006";
+
+#[derive(Debug, Copy, Clone, Eq, PartialEq, Ord, PartialOrd)]
+enum Privileges {
+    JoinChannel = 1,
+    PublishAudioStream = 2,
+    PublishVideoStream = 3,
+    PublishDataStream = 4,
+}
+
+fn create_access_token(
+    app_id: &str,
+    app_certificate: &str,
+    channel_name: &str,
+    uid: &str,
+    privileges: &[Privileges],
+) -> String {
+    let ts = (SystemTime::now().duration_since(UNIX_EPOCH))
+        .unwrap()
+        .as_secs() as u32
+        + 24 * 3600;
+    let salt = fastrand::u32(1..99999999);
+    let mut buf_m = Vec::new();
+
+    buf_m.extend_from_slice(&salt.to_le_bytes());
+    buf_m.extend_from_slice(&ts.to_le_bytes());
+
+    buf_m.extend_from_slice(&(privileges.len() as u16).to_le_bytes());
+    let mut privileges = privileges.to_vec();
+    privileges.sort();
+
+    for k in privileges {
+        buf_m.extend_from_slice(&(k as u16).to_le_bytes());
+        buf_m.extend_from_slice(&ts.to_le_bytes());
+    }
+
+    let mut buf_val = Vec::new();
+    buf_val.extend(format!("{}{}{}", app_id, channel_name, uid).as_bytes());
+    buf_val.extend(&buf_m);
+
+    let buf_sig = {
+        let mut mac = hmac::Hmac::<Sha256>::new_from_slice(app_certificate.as_bytes())
+            .expect("valid app certificate");
+        mac.update(&buf_val);
+        mac.finalize().into_bytes()
+    };
+
+    let crc_channel_name = crc32(channel_name.as_bytes());
+    let crc_uid = crc32(uid.as_bytes());
+
+    let mut buf_content = Vec::new();
+    pack_bytes(&mut buf_content, &buf_sig);
+    buf_content.extend_from_slice(&crc_channel_name.to_le_bytes());
+    buf_content.extend_from_slice(&crc_uid.to_le_bytes());
+    pack_bytes(&mut buf_content, &buf_m);
+
+    format!("{}{}{}", VERSION, app_id, base64::encode(buf_content))
+}
+
+fn crc32(data: &[u8]) -> u32 {
+    let mut hasher = checksum::crc32::Crc32::new();
+    hasher.checksum(data)
+}
+
+fn pack_bytes(data: &mut Vec<u8>, s: &[u8]) {
+    data.extend_from_slice(&(s.len() as u16).to_le_bytes());
+    data.extend_from_slice(s);
+}
+
+pub fn create_rtc_token(
+    app_id: &str,
+    app_certificate: &str,
+    channel_name: &str,
+    uid: u32,
+) -> String {
+    let uid = if uid == 0 {
+        String::new()
+    } else {
+        uid.to_string()
+    };
+    create_access_token(
+        app_id,
+        app_certificate,
+        channel_name,
+        &uid,
+        &[
+            Privileges::JoinChannel,
+            Privileges::PublishAudioStream,
+            Privileges::PublishVideoStream,
+            Privileges::PublishDataStream,
+        ],
+    )
+}
diff --git a/crates/fcm/Cargo.toml b/crates/fcm/Cargo.toml
new file mode 100644
index 0000000..50525b0
--- /dev/null
+++ b/crates/fcm/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "rc-fcm"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+anyhow = "1.0.52"
+base64 = "0.13.0"
+chrono = "0.4.19"
+reqwest = { version = "0.11.8", default-features = false, features = ["rustls-tls", "json"] }
+rustls = "0.20.2"
+rustls-pemfile = "0.3.0"
+serde = { version = "1.0.132", features = ["derive"] }
+serde_json = "1.0.73"
+thiserror = "1.0.30"
+tokio = { version = "1.15.0", features = ["sync"] }
+
+[dev-dependencies]
+tokio = { version = "1.15.0", features = ["macros", "rt-multi-thread"] }
diff --git a/crates/fcm/src/client.rs b/crates/fcm/src/client.rs
new file mode 100644
index 0000000..3fb43c3
--- /dev/null
+++ b/crates/fcm/src/client.rs
@@ -0,0 +1,153 @@
+use anyhow::Result;
+use chrono::{DateTime, Duration, Utc};
+use reqwest::Client;
+use serde::{Deserialize, Deserializer, Serialize};
+use tokio::sync::Mutex;
+
+use crate::{
+    jwt::{Claims, JwtSigner},
+    ApplicationCredentials,
+};
+
+const GRANT_TYPE: &str = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+const SCOPES: &[&str] = &["https://www.googleapis.com/auth/firebase.messaging"];
+
+#[derive(Deserialize, Debug)]
+struct Token {
+    access_token: String,
+    #[serde(
+        deserialize_with = "deserialize_expires_in",
+        rename(deserialize = "expires_in")
+    )]
+    expires_at: Option<DateTime<Utc>>,
+}
+
+impl Token {
+    fn has_expired(&self) -> bool {
+        self.expires_at
+            .map(|expiration_time| expiration_time - Duration::seconds(30) <= Utc::now())
+            .unwrap_or(false)
+    }
+
+    fn as_str(&self) -> &str {
+        &self.access_token
+    }
+}
+
+fn deserialize_expires_in<'de, D>(deserializer: D) -> Result<Option<DateTime<Utc>>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let s: Option<i64> = Deserialize::deserialize(deserializer)?;
+    Ok(s.map(|seconds_from_now| Utc::now() + Duration::seconds(seconds_from_now)))
+}
+
+pub struct FcmClient {
+    client: Client,
+    credentials: ApplicationCredentials,
+    token: Mutex<Option<Token>>,
+}
+
+impl FcmClient {
+    pub fn new(credentials: ApplicationCredentials) -> Self {
+        Self {
+            client: Client::new(),
+            credentials,
+            token: Default::default(),
+        }
+    }
+
+    pub fn credentials(&self) -> &ApplicationCredentials {
+        &self.credentials
+    }
+
+    async fn refresh_token(&self) -> Result<Token> {
+        let signer = JwtSigner::new(&self.credentials.private_key)?;
+        let claims = Claims::new(&self.credentials, SCOPES, None);
+        let signed = signer.sign_claims(&claims)?;
+        let token = self
+            .client
+            .post(&self.credentials.token_uri)
+            .form(&[("grant_type", GRANT_TYPE), ("assertion", signed.as_str())])
+            .send()
+            .await?
+            .error_for_status()?
+            .json::<Token>()
+            .await?;
+        Ok(token)
+    }
+
+    pub async fn send(
+        &self,
+        device_token: &str,
+        title: &str,
+        message: &str,
+        data: &impl Serialize,
+    ) -> Result<()> {
+        let token = loop {
+            let mut token = self.token.lock().await;
+            match &*token {
+                Some(token) if !token.has_expired() => break token.as_str().to_string(),
+                _ => *token = Some(self.refresh_token().await?),
+            }
+        };
+
+        let url = format!(
+            "https://fcm.googleapis.com/v1/projects/{}/messages:send",
+            self.credentials.project_id
+        );
+
+        let _ = reqwest::Client::new()
+            .post(url)
+            .bearer_auth(token)
+            .json(&serde_json::json!({
+                "message": {
+                    "notification": {
+                        "title": title,
+                        "body": message,
+                        "sound": "default",
+                    },
+                    "data": data,
+                    "token": device_token,
+                }
+            }))
+            .send()
+            .await?
+            .error_for_status()?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::*;
+
+    #[tokio::test]
+    async fn test_send() {
+        let credentials = ApplicationCredentials {
+            project_id: "Your project".to_string(),
+            private_key: "Your key".to_string(),
+            client_email: "Your client email"
+                .to_string(),
+            token_uri: "https://oauth2.googleapis.com/token".to_string(),
+        };
+
+        let client = FcmClient::new(credentials);
+        let device_token = "Your client token";
+        client
+            .send(
+                device_token,
+                "title",
+                "hello!",
+                &json!({
+                    "vocechat_server_id": "your server id",
+                    "vocechat_from_uid": "123",
+                    "vocechat_to_uid": "123123",
+                }),
+            )
+            .await
+            .unwrap();
+    }
+}
diff --git a/crates/fcm/src/credentials.rs b/crates/fcm/src/credentials.rs
new file mode 100644
index 0000000..e4cfeb0
--- /dev/null
+++ b/crates/fcm/src/credentials.rs
@@ -0,0 +1,9 @@
+use serde::Deserialize;
+
+#[derive(Debug, Clone, Default, Deserialize)]
+pub struct ApplicationCredentials {
+    pub project_id: String,
+    pub private_key: String,
+    pub client_email: String,
+    pub token_uri: String,
+}
diff --git a/crates/fcm/src/jwt.rs b/crates/fcm/src/jwt.rs
new file mode 100644
index 0000000..3f9c78d
--- /dev/null
+++ b/crates/fcm/src/jwt.rs
@@ -0,0 +1,94 @@
+use anyhow::Result;
+use chrono::Utc;
+use rustls::{sign, sign::SigningKey, PrivateKey};
+use serde::Serialize;
+
+use crate::ApplicationCredentials;
+
+const GOOGLE_RS256_HEAD: &str = r#"{"alg":"RS256","typ":"JWT"}"#;
+
+/// Encodes s as Base64
+fn append_base64<T: AsRef<[u8]> + ?Sized>(s: &T, out: &mut String) {
+    base64::encode_config_buf(s, base64::URL_SAFE, out)
+}
+
+/// Decode a PKCS8 formatted RSA key.
+fn decode_rsa_key(pem_pkcs8: &str) -> Result<PrivateKey> {
+    let mut private_keys = rustls_pemfile::pkcs8_private_keys(&mut pem_pkcs8.as_bytes())?;
+    anyhow::ensure!(!private_keys.is_empty(), "Not enough private keys in PEM");
+    Ok(PrivateKey(private_keys.remove(0)))
+}
+
+/// Permissions requested for a JWT.
+/// See https://developers.google.com/identity/protocols/OAuth2ServiceAccount#authorizingrequests.
+#[derive(Serialize, Debug)]
+pub(crate) struct Claims<'a> {
+    iss: &'a str,
+    aud: &'a str,
+    exp: i64,
+    iat: i64,
+    subject: Option<&'a str>,
+    scope: String,
+}
+
+impl<'a> Claims<'a> {
+    pub(crate) fn new<T>(
+        key: &'a ApplicationCredentials,
+        scopes: &[T],
+        subject: Option<&'a str>,
+    ) -> Self
+    where
+        T: std::string::ToString,
+    {
+        let iat = Utc::now().timestamp();
+        let expiry = iat + 3600 - 5; // Max validity is 1h.
+
+        let scope: String = scopes
+            .iter()
+            .map(|x| x.to_string())
+            .collect::<Vec<_>>()
+            .join(" ");
+        Claims {
+            iss: &key.client_email,
+            aud: &key.token_uri,
+            exp: expiry,
+            iat,
+            subject,
+            scope,
+        }
+    }
+}
+
+/// A JSON Web Token ready for signing.
+pub(crate) struct JwtSigner {
+    signer: Box<dyn rustls::sign::Signer>,
+}
+
+impl JwtSigner {
+    pub(crate) fn new(private_key: &str) -> Result<Self> {
+        let key = decode_rsa_key(private_key)?;
+        let signing_key = sign::RsaSigningKey::new(&key)?;
+        let signer = signing_key
+            .choose_scheme(&[rustls::SignatureScheme::RSA_PKCS1_SHA256])
+            .ok_or_else(|| anyhow::anyhow!("Couldn't choose signing scheme"))?;
+        Ok(JwtSigner { signer })
+    }
+
+    pub(crate) fn sign_claims(&self, claims: &Claims) -> Result<String, rustls::Error> {
+        let mut jwt_head = Self::encode_claims(claims);
+        let signature = self.signer.sign(jwt_head.as_bytes())?;
+        jwt_head.push('.');
+        append_base64(&signature, &mut jwt_head);
+        Ok(jwt_head)
+    }
+
+    /// Encodes the first two parts (header and claims) to base64 and assembles
+    /// them into a form ready to be signed.
+    fn encode_claims(claims: &Claims) -> String {
+        let mut head = String::new();
+        append_base64(GOOGLE_RS256_HEAD, &mut head);
+        head.push('.');
+        append_base64(&serde_json::to_string(&claims).unwrap(), &mut head);
+        head
+    }
+}
diff --git a/crates/fcm/src/lib.rs b/crates/fcm/src/lib.rs
new file mode 100644
index 0000000..76e79b3
--- /dev/null
+++ b/crates/fcm/src/lib.rs
@@ -0,0 +1,6 @@
+mod client;
+mod credentials;
+mod jwt;
+
+pub use client::FcmClient;
+pub use credentials::ApplicationCredentials;
diff --git a/crates/github-oauth/Cargo.toml b/crates/github-oauth/Cargo.toml
new file mode 100644
index 0000000..ecc67d7
--- /dev/null
+++ b/crates/github-oauth/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "github-oauth"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
diff --git a/crates/github-oauth/src/main.rs b/crates/github-oauth/src/main.rs
new file mode 100644
index 0000000..e7a11a9
--- /dev/null
+++ b/crates/github-oauth/src/main.rs
@@ -0,0 +1,3 @@
+fn main() {
+    println!("Hello, world!");
+}
diff --git a/crates/magic-link/Cargo.toml b/crates/magic-link/Cargo.toml
new file mode 100644
index 0000000..3b5c8de
--- /dev/null
+++ b/crates/magic-link/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "rc-magic-link"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+serde = { version = "1.0.132", features = ["derive"] }
+chrono = { version = "0.4.19", features = ["serde"] }
+hmac = "0.11.0"
+sha2 = "0.9.0"
+bincode = "1.3.3"
+fastrand = "1.6.0"
+hex = "0.4.3"
diff --git a/crates/magic-link/src/lib.rs b/crates/magic-link/src/lib.rs
new file mode 100644
index 0000000..cad2a0d
--- /dev/null
+++ b/crates/magic-link/src/lib.rs
@@ -0,0 +1,149 @@
+extern crate core;
+
+use chrono::{DateTime, Utc};
+use hmac::{Mac, NewMac};
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+
+#[derive(Serialize, Deserialize, Debug, Clone, Eq, PartialEq)]
+#[non_exhaustive]
+pub enum MagicLinkToken {
+    Register {
+        is_confirmed: bool,
+        // in_confirmed -> is_email_confirmed
+        gid: Option<i64>,
+        code: String,
+        expired_at: i64,
+        extra_email: Option<String>,
+        extra_password: Option<String>,
+    },
+    Login {
+        email: String,
+        uid: Option<i64>,
+        code: String,
+        expired_at: i64,
+    },
+}
+
+impl MagicLinkToken {
+    pub fn gen_reg_magic_token(
+        code: &str,
+        server_key: &str,
+        expired_at: DateTime<Utc>,
+        is_confirmed: bool,
+        gid: Option<i64>,
+        extra_email: Option<String>,
+        extra_password: Option<String>,
+    ) -> String {
+        encode(
+            server_key,
+            &MagicLinkToken::Register {
+                is_confirmed,
+                gid,
+                code: code.to_string(),
+                expired_at: expired_at.timestamp(), /* : (Utc::now() + Duration::seconds(expired_in)).timestamp() */
+                extra_email,
+                extra_password,
+            },
+        )
+    }
+
+    pub fn gen_login_magic_token(
+        code: &str,
+        server_key: &str,
+        expired_at: DateTime<Utc>,
+        email: &str,
+        uid: Option<i64>,
+    ) -> String {
+        encode(
+            server_key,
+            &MagicLinkToken::Login {
+                email: email.to_string(),
+                uid,
+                code: code.to_string(),
+                expired_at: expired_at.timestamp(),
+            },
+        )
+    }
+
+    pub fn parse(server_key: &str, s: impl AsRef<str>) -> Option<MagicLinkToken> {
+        if s.as_ref().is_empty() {
+            return None;
+        }
+        // ya29.a0ARrdaM-5RaNLVVbJQSCYlekpYmPqhUXpG4THaOOYA0kUJ8jUd_rLFEgRappLi9fdmFpvdD7keGos2jzcnl0Vivh4C3HDNbOJpqCtwEQvH8vIYGUayAeMNMKGowkAhH0zCCprUGNBdQaZ65EW8Gf3kKcPc2GH
+        let data = hex::decode(s.as_ref()).ok()?;
+        assert!(data.len() >= 32);
+        let mut mac = hmac::Hmac::<Sha256>::new_from_slice(server_key.as_bytes()).unwrap();
+        mac.update(&data[32..]);
+        mac.verify(&data[..32]).ok()?;
+        let magic_token = bincode::deserialize::<MagicLinkToken>(&data[32..]).ok()?;
+        if magic_token.get_expired_at() < Utc::now().timestamp() {
+            return None;
+        }
+        Some(magic_token)
+    }
+
+    pub fn get_expired_at(&self) -> i64 {
+        match &self {
+            MagicLinkToken::Register { expired_at, .. } => *expired_at,
+            MagicLinkToken::Login { expired_at, .. } => *expired_at,
+        }
+    }
+
+    pub fn get_code(&self) -> &str {
+        match &self {
+            MagicLinkToken::Register { code, .. } => code.as_str(),
+            MagicLinkToken::Login { code, .. } => code.as_str(),
+        }
+    }
+}
+
+pub fn gen_code() -> String {
+    (0..6)
+        .map(|_| fastrand::char('0'..='9'))
+        .collect::<String>()
+}
+
+fn encode(server_key: &str, magictoken: &MagicLinkToken) -> String {
+    let content = bincode::serialize(&magictoken).unwrap();
+    let mut buf_sig = {
+        let mut mac = hmac::Hmac::<Sha256>::new_from_slice(server_key.as_bytes()).unwrap();
+        mac.update(&content);
+        mac.finalize().into_bytes().to_vec()
+    };
+    buf_sig.extend_from_slice(&content);
+    hex::encode(&buf_sig)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_encode_invite_to_server() {
+        let server_key = "123456";
+        let code = gen_code();
+        let expired_at = chrono::Utc::now() + chrono::Duration::seconds(10);
+        let token = MagicLinkToken::gen_reg_magic_token(
+            &code, server_key, expired_at, true, None, None, None,
+        );
+        if let MagicLinkToken::Register {
+            is_confirmed,
+            gid,
+            code,
+            expired_at,
+            extra_email,
+            extra_password,
+        } = MagicLinkToken::parse(server_key, token).unwrap()
+        {
+            assert!(is_confirmed);
+            assert_eq!(gid, None);
+            assert_eq!(code.len(), 6);
+            assert!(expired_at > 0);
+            assert_eq!(extra_email, None);
+            assert_eq!(extra_password, None);
+        } else {
+            panic!("test failed!");
+        }
+    }
+}
diff --git a/crates/msgdb/Cargo.lock b/crates/msgdb/Cargo.lock
new file mode 100644
index 0000000..25cccde
--- /dev/null
+++ b/crates/msgdb/Cargo.lock
@@ -0,0 +1,768 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bstr"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3569f383e8f1598449f1a423e72e99569137b47740b1da11ef19af3d5c3223"
+dependencies = [
+ "lazy_static",
+ "memchr",
+ "regex-automata",
+ "serde",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a45a46ab1f2412e53d3a0ade76ffad2025804294569aae387231a0cd6e0899"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "cast"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c24dab4283a142afa2fdca129b80ad2c6284e073930f964c3a1293c225ee39a"
+dependencies = [
+ "rustc_version",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "2.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
+dependencies = [
+ "bitflags",
+ "textwrap",
+ "unicode-width",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "criterion"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1604dafd25fba2fe2d5895a9da139f8dc9b319a5fe5354ca137cbbce4e178d10"
+dependencies = [
+ "atty",
+ "cast",
+ "clap",
+ "criterion-plot",
+ "csv",
+ "itertools",
+ "lazy_static",
+ "num-traits",
+ "oorandom",
+ "plotters",
+ "rayon",
+ "regex",
+ "serde",
+ "serde_cbor",
+ "serde_derive",
+ "serde_json",
+ "tinytemplate",
+ "walkdir",
+]
+
+[[package]]
+name = "criterion-plot"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d00996de9f2f7559f7f4dc286073197f83e92256a59ed395f9aac01fe717da57"
+dependencies = [
+ "cast",
+ "itertools",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e54ea8bc3fb1ee042f5aace6e3c6e025d3874866da222930f70ce62aceba0bfa"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6455c0ca19f0d2fbf751b908d5c55c1f5cbc65e03c4225427254b46890bdde1e"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c00d6d2ea26e8b151d99093005cb442fb9a37aeaca582a03ec70946f49ab5ed9"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+ "lazy_static",
+ "memoffset",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e5bed1f1c269533fa816a0a5492b3545209a205ca1a54842be180eb63a16a6"
+dependencies = [
+ "cfg-if",
+ "lazy_static",
+]
+
+[[package]]
+name = "csv"
+version = "1.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22813a6dc45b335f9bade10bf7271dc477e81113e89eb251a0bc2a8a81c536e1"
+dependencies = [
+ "bstr",
+ "csv-core",
+ "itoa 0.4.8",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b2466559f260f48ad25fe6317b3c8dac77b5bdb5763ac7d9d6103530663bc90"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "either"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
+
+[[package]]
+name = "fastrand"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3fcf0cee53519c866c09b5de1f6c56ff9d647101f81c1964fa632e148896cdf"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "fs2"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9564fc758e15025b46aa6643b1b77d047d1a56a1aea6e01002ac0c7026876213"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "fxhash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c31b6d751ae2c7f11320402d34e41349dd1016f8d5d45e48c4312bc8625af50c"
+dependencies = [
+ "byteorder",
+]
+
+[[package]]
+name = "half"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eabb4a44450da02c90444cf74558da904edde8fb4e9035a9a6a4e15445af0bd7"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "itertools"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9a9d19fa1e79b6215ff29b9d6880b706147f16e9b1dbb1e4e5947b5b02bc5e3"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71991ff56294aa922b450139ee08b3bfc70982c6b2c7562771375cf73542dd4"
+
+[[package]]
+name = "itoa"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aab8fc367588b89dcee83ab0fd66b72b50b72fa1904d7095045ace2b0c81c35"
+
+[[package]]
+name = "js-sys"
+version = "0.3.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a38fc24e30fd564ce974c02bf1d337caddff65be6cc4735a1f7eab22a7440f04"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bf2e165bb3457c8e098ea76f3e3bc9db55f87aa90d52d0e6be741470916aaa4"
+
+[[package]]
+name = "lock_api"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88943dd7ef4a2e5a4bfa2753aaab3013e34ce2533d1996fb18ef591e315e2b3b"
+dependencies = [
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+
+[[package]]
+name = "memoffset"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a64b1ec5cda2586e284722486d802acf1f7dbdc623e2bfc57e65ca1cd099290"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "oorandom"
+version = "11.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ab1bc2a289d34bd04a330323ac98a1b4bc82c9d9fcb1e66b63caa84da26b575"
+
+[[package]]
+name = "parking_lot"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d17b78036a60663b797adeaee46f5c9dfebb86948d1255007a1d6be0271ff99"
+dependencies = [
+ "instant",
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d76e8e1493bcac0d2766c42737f34458f1c8c50c0d23bcb24ea953affb273216"
+dependencies = [
+ "cfg-if",
+ "instant",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "winapi",
+]
+
+[[package]]
+name = "plotters"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a3fd9ec30b9749ce28cd91f255d569591cdf937fe280c312143e3c4bad6f2a"
+dependencies = [
+ "num-traits",
+ "plotters-backend",
+ "plotters-svg",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "plotters-backend"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d88417318da0eaf0fdcdb51a0ee6c3bed624333bff8f946733049380be67ac1c"
+
+[[package]]
+name = "plotters-svg"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521fa9638fa597e1dc53e9412a4f9cefb01187ee1f7413076f9e6749e2885ba9"
+dependencies = [
+ "plotters-backend",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7342d5883fbccae1cc37a2353b09c87c9b0f3afd73f5fb9bba687a1f733b029"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "864d3e96a899863136fc6e99f3d7cae289dafe43bf2c5ac19b70df7210c0a145"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rayon"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c06aca804d41dbc8ba42dfd964f0d01334eceb64314b9ecf7c5fad5188a06d90"
+dependencies = [
+ "autocfg",
+ "crossbeam-deque",
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78120e2c850279833f1dd3582f730c4ab53ed95aeaaaa862a2a5c71b1656d8e"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "lazy_static",
+ "num_cpus",
+]
+
+[[package]]
+name = "rc-msgdb"
+version = "0.1.0"
+dependencies = [
+ "criterion",
+ "sled",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8380fe0152551244f0747b1bf41737e0f8a74f97a14ccefd1148187271634f3c"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "regex"
+version = "1.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a11647b6b25ff05a515cb92c365cec08801e83423a235b51e231e1808747286"
+dependencies = [
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b4b750c782965c211b42f022f59af1fbceabdd026623714f104152f1ec149f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "semver"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a3381e03edd24287172047536f20cabde766e2cd3e65e6b00fb3af51c4f38d"
+
+[[package]]
+name = "serde"
+version = "1.0.136"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce31e24b01e1e524df96f1c2fdd054405f8d7376249a5110886fb4b658484789"
+
+[[package]]
+name = "serde_cbor"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bef2ebfde456fb76bbcf9f59315333decc4fda0b2b44b420243c11e0f5ec1f5"
+dependencies = [
+ "half",
+ "serde",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.136"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08597e7152fcd306f41838ed3e37be9eaeed2b61c42e2117266a554fab4662f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e8d9fa5c3b304765ce1fd9c4c8a3de2c8db365a5b91be52f186efc675681d95"
+dependencies = [
+ "itoa 1.0.1",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sled"
+version = "0.34.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f96b4737c2ce5987354855aed3797279def4ebf734436c6aa4552cf8e169935"
+dependencies = [
+ "crc32fast",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "fs2",
+ "fxhash",
+ "libc",
+ "log",
+ "parking_lot",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
+
+[[package]]
+name = "syn"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a65b3f4ffa0092e9887669db0eae07941f023991ab58ea44da8fe8e2d511c6b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tinytemplate"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4d6b5f19ff7664e8c98d03e2139cb510db9b0a60b55f8e8709b689d939b6bc"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "unicode-width"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ed742d4ea2bd1176e236172c8429aaf54486e7ac098db29ffe6529e0ce50973"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "walkdir"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "808cf2735cd4b6866113f648b791c6adc5714537bc222d9347bb203386ffda56"
+dependencies = [
+ "same-file",
+ "winapi",
+ "winapi-util",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25f1af7423d8588a3d840681122e72e6a24ddbcb3f0ec385cac0d12d24256c06"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b21c0df030f5a177f3cba22e9bc4322695ec43e7257d865302900290bcdedca"
+dependencies = [
+ "bumpalo",
+ "lazy_static",
+ "log",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4203d69e40a52ee523b2529a773d5ffc1dc0071801c87b3d270b471b80ed01"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa8a30d46208db204854cadbb5d4baf5fcf8071ba5bf48190c3e59937962ebc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d958d035c4438e28c70e4321a2911302f10135ce78a9c7834c0cab4123d06a2"
+
+[[package]]
+name = "web-sys"
+version = "0.3.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c060b319f29dd25724f09a2ba1418f142f539b2be99fbf4d2d5a8f7330afb8eb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
diff --git a/crates/msgdb/Cargo.toml b/crates/msgdb/Cargo.toml
new file mode 100644
index 0000000..d867b95
--- /dev/null
+++ b/crates/msgdb/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "rc-msgdb"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+parking_lot = "0.12.0"
+sled = "0.34.7"
+thiserror = "1.0.30"
+
+[dev-dependencies]
+criterion = { version = "0.3.5", features = ["html_reports"] }
+tempfile = "3.2.0"
+
+[[bench]]
+name = "db"
+harness = false
diff --git a/crates/msgdb/benches/db.rs b/crates/msgdb/benches/db.rs
new file mode 100644
index 0000000..d763160
--- /dev/null
+++ b/crates/msgdb/benches/db.rs
@@ -0,0 +1,43 @@
+use criterion::{criterion_group, criterion_main, Criterion};
+use rc_msgdb::MsgDb;
+use tempfile::tempdir;
+
+fn send_benchmark(c: &mut Criterion) {
+    let dir = tempdir().unwrap();
+    let db = MsgDb::open(dir.path()).unwrap();
+    let to = (0..50000i64).collect::<Vec<_>>();
+    let msg = b"hello!";
+    c.bench_function("send", |b| {
+        b.iter(|| {
+            db.messages()
+                .send_to_group(1, to.iter().copied(), msg)
+                .unwrap();
+        })
+    });
+}
+
+fn fetch_benchmark(c: &mut Criterion) {
+    let dir = tempdir().unwrap();
+    let db = MsgDb::open(dir.path()).unwrap();
+    let to = vec![1];
+    let msg = b"hello!";
+    for _ in 0..1000 {
+        db.messages()
+            .send_to_group(1, to.iter().copied(), msg)
+            .unwrap();
+    }
+    c.bench_function("fetch", |b| {
+        b.iter(|| {
+            assert_eq!(
+                db.messages()
+                    .fetch_user_messages_after(1, None, 10000)
+                    .unwrap()
+                    .len(),
+                1000
+            );
+        })
+    });
+}
+
+criterion_group!(benches, send_benchmark, fetch_benchmark);
+criterion_main!(benches);
diff --git a/crates/msgdb/src/db.rs b/crates/msgdb/src/db.rs
new file mode 100644
index 0000000..486add2
--- /dev/null
+++ b/crates/msgdb/src/db.rs
@@ -0,0 +1,36 @@
+use std::path::Path;
+
+use parking_lot::Mutex;
+use sled::Db;
+
+use crate::{sequence::Sequence, Messages, Result};
+
+const MSG_SEQUENCE: u8 = 1;
+
+pub struct MsgDb {
+    pub(crate) db: Db,
+    msg_sequence: Mutex<Sequence>,
+}
+
+impl Drop for MsgDb {
+    fn drop(&mut self) {
+        self.msg_sequence.lock().release(&self.db);
+    }
+}
+
+impl MsgDb {
+    pub fn open(path: impl AsRef<Path>) -> Result<Self> {
+        let db = sled::open(path)?;
+        let msg_sequence = Mutex::new(Sequence::new(&db, MSG_SEQUENCE)?);
+        Ok(Self { db, msg_sequence })
+    }
+
+    #[inline]
+    pub fn messages(&self) -> Messages {
+        Messages { db: self }
+    }
+
+    pub(crate) fn generate_msg_id(&self) -> Result<i64> {
+        self.msg_sequence.lock().generate_id(&self.db)
+    }
+}
diff --git a/crates/msgdb/src/error.rs b/crates/msgdb/src/error.rs
new file mode 100644
index 0000000..45941ac
--- /dev/null
+++ b/crates/msgdb/src/error.rs
@@ -0,0 +1,10 @@
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error(transparent)]
+    Db(#[from] sled::Error),
+
+    #[error("invalid data")]
+    InvalidData,
+}
+
+pub type Result<T, E = Error> = ::std::result::Result<T, E>;
diff --git a/crates/msgdb/src/lib.rs b/crates/msgdb/src/lib.rs
new file mode 100644
index 0000000..f8b7b53
--- /dev/null
+++ b/crates/msgdb/src/lib.rs
@@ -0,0 +1,8 @@
+mod db;
+mod error;
+mod messages;
+mod sequence;
+
+pub use db::MsgDb;
+pub use error::{Error, Result};
+pub use messages::Messages;
diff --git a/crates/msgdb/src/messages.rs b/crates/msgdb/src/messages.rs
new file mode 100644
index 0000000..52911a9
--- /dev/null
+++ b/crates/msgdb/src/messages.rs
@@ -0,0 +1,238 @@
+use sled::Batch;
+
+use crate::{MsgDb, Result};
+
+pub struct Messages<'a> {
+    pub(crate) db: &'a MsgDb,
+}
+
+impl<'a> Messages<'a> {
+    pub fn get(&self, mid: i64) -> Result<Option<Vec<u8>>> {
+        Ok(self.db.db.get(key_msg(mid))?.map(|data| data.to_vec()))
+    }
+
+    pub fn send_to_group(
+        &self,
+        gid: i64,
+        to: impl IntoIterator<Item = i64>,
+        msg: &[u8],
+    ) -> Result<i64> {
+        let id = self.db.generate_msg_id()?;
+        let mut batch = Batch::default();
+        batch.insert(&key_msg(id), msg);
+        for target_uid in to {
+            batch.insert(&key_user_msg(target_uid, id), msg);
+        }
+        batch.insert(&key_group_msg(gid, id), msg);
+        self.db.db.apply_batch(batch)?;
+        Ok(id)
+    }
+
+    pub fn send_to_dm(&self, from_uid: i64, to_uid: i64, msg: &[u8]) -> Result<i64> {
+        let id = self.db.generate_msg_id()?;
+        let mut batch = Batch::default();
+        batch.insert(&key_msg(id), msg);
+        for target_uid in [from_uid, to_uid] {
+            batch.insert(&key_user_msg(target_uid, id), msg);
+        }
+        batch.insert(&key_dm_msg(from_uid, to_uid, id), msg);
+        self.db.db.apply_batch(batch)?;
+        Ok(id)
+    }
+
+    pub fn fetch_user_messages_after(
+        &self,
+        uid: i64,
+        after: Option<i64>,
+        limit: usize,
+    ) -> Result<Vec<(i64, Vec<u8>)>> {
+        let after_id = after.map(|id| id + 1).unwrap_or_default();
+        let iter = self
+            .db
+            .db
+            .range(key_user_msg(uid, after_id)..key_user_msg(uid, i64::MAX))
+            .rev();
+        let mut msgs = Vec::new();
+
+        for item in iter.take(limit) {
+            let (key, value) = item?;
+            let (current_uid, msg_id) = match decode_key_user_msg(&key) {
+                Some(res) => res,
+                None => break,
+            };
+
+            if current_uid != uid {
+                break;
+            }
+
+            msgs.push((msg_id, value.to_vec()));
+        }
+
+        msgs.reverse();
+        Ok(msgs)
+    }
+
+    pub fn fetch_dm_messages_before(
+        &self,
+        from_uid: i64,
+        to_uid: i64,
+        before: Option<i64>,
+        limit: usize,
+    ) -> Result<Vec<(i64, Vec<u8>)>> {
+        let before_id = before.unwrap_or(i64::MAX);
+        let iter = self
+            .db
+            .db
+            .range(key_dm_msg(from_uid, to_uid, 0)..key_dm_msg(from_uid, to_uid, before_id))
+            .rev()
+            .take(limit);
+        let mut msgs = Vec::new();
+
+        for item in iter {
+            let (key, value) = item?;
+            let (a, b, msg_id) = match decode_key_dm_msg(&key) {
+                Some(res) => res,
+                None => break,
+            };
+
+            if !(from_uid == a && to_uid == b || from_uid == b && to_uid == a) {
+                break;
+            }
+
+            msgs.push((msg_id, value.to_vec()));
+        }
+
+        msgs.reverse();
+        Ok(msgs)
+    }
+
+    pub fn fetch_group_messages_before(
+        &self,
+        gid: i64,
+        before: Option<i64>,
+        limit: usize,
+    ) -> Result<Vec<(i64, Vec<u8>)>> {
+        let before_id = before.unwrap_or(i64::MAX);
+        let iter = self
+            .db
+            .db
+            .range(key_group_msg(gid, 0)..key_group_msg(gid, before_id))
+            .rev()
+            .take(limit);
+        let mut msgs = Vec::new();
+
+        for item in iter {
+            let (key, value) = item?;
+            let (current_gid, msg_id) = match decode_key_group_msg(&key) {
+                Some(res) => res,
+                None => break,
+            };
+
+            if current_gid != gid {
+                break;
+            }
+
+            msgs.push((msg_id, value.to_vec()));
+        }
+
+        msgs.reverse();
+        Ok(msgs)
+    }
+
+    pub fn insert_merged_msg(&self, mid: i64, msg: &[u8]) -> Result<()> {
+        self.db.db.insert(key_merged_msg(mid), msg)?;
+        Ok(())
+    }
+
+    pub fn update_merged_msg(&self, mid: i64, mut f: impl FnMut(&[u8]) -> Vec<u8>) -> Result<()> {
+        self.db
+            .db
+            .update_and_fetch(key_merged_msg(mid), |data| data.map(&mut f))?;
+        Ok(())
+    }
+
+    pub fn remove_merged_msg(&self, mid: i64) -> Result<()> {
+        self.db.db.remove(key_merged_msg(mid))?;
+        Ok(())
+    }
+
+    pub fn get_merged_msg(&self, mid: i64) -> Result<Option<Vec<u8>>> {
+        Ok(self
+            .db
+            .db
+            .get(key_merged_msg(mid))?
+            .map(|data| data.to_vec()))
+    }
+}
+
+fn key_msg(msg_id: i64) -> [u8; 12] {
+    let mut data = [0; 12];
+    data[0..4].copy_from_slice(b"MSG/");
+    data[4..12].copy_from_slice(&msg_id.to_be_bytes());
+    data
+}
+
+fn key_merged_msg(msg_id: i64) -> [u8; 13] {
+    let mut data = [0; 13];
+    data[0..5].copy_from_slice(b"FMSG/");
+    data[5..13].copy_from_slice(&msg_id.to_be_bytes());
+    data
+}
+
+fn key_user_msg(uid: i64, msg_id: i64) -> [u8; 21] {
+    let mut data = [0; 21];
+    data[0..5].copy_from_slice(b"UMSG/");
+    data[5..13].copy_from_slice(&uid.to_be_bytes());
+    data[13..21].copy_from_slice(&msg_id.to_be_bytes());
+    data
+}
+
+fn decode_key_user_msg(data: &[u8]) -> Option<(i64, i64)> {
+    let data = data.strip_prefix(b"UMSG/")?;
+    if data.len() != 16 {
+        return None;
+    }
+    let uid = i64::from_be_bytes(data[0..8].try_into().unwrap());
+    let msg_id = i64::from_be_bytes(data[8..16].try_into().unwrap());
+    Some((uid, msg_id))
+}
+
+fn key_group_msg(gid: i64, msg_id: i64) -> [u8; 21] {
+    let mut data = [0; 21];
+    data[0..5].copy_from_slice(b"GMSG/");
+    data[5..13].copy_from_slice(&gid.to_be_bytes());
+    data[13..21].copy_from_slice(&msg_id.to_be_bytes());
+    data
+}
+
+fn decode_key_group_msg(data: &[u8]) -> Option<(i64, i64)> {
+    let data = data.strip_prefix(b"GMSG/")?;
+    if data.len() != 16 {
+        return None;
+    }
+    let gid = i64::from_be_bytes(data[0..8].try_into().unwrap());
+    let msg_id = i64::from_be_bytes(data[8..16].try_into().unwrap());
+    Some((gid, msg_id))
+}
+
+fn key_dm_msg(from_uid: i64, to_uid: i64, msg_id: i64) -> [u8; 27] {
+    let mut data = [0; 27];
+    let a = from_uid.min(to_uid);
+    let b = from_uid.max(to_uid);
+    data[0..3].copy_from_slice(b"DM/");
+    data[3..11].copy_from_slice(&a.to_be_bytes());
+    data[11..19].copy_from_slice(&b.to_be_bytes());
+    data[19..27].copy_from_slice(&msg_id.to_be_bytes());
+    data
+}
+
+fn decode_key_dm_msg(data: &[u8]) -> Option<(i64, i64, i64)> {
+    let data = data.strip_prefix(b"DM/")?;
+    if data.len() != 24 {
+        return None;
+    }
+    let from_uid = i64::from_be_bytes(data[0..8].try_into().unwrap());
+    let to_uid = i64::from_be_bytes(data[8..16].try_into().unwrap());
+    let msg_id = i64::from_be_bytes(data[16..24].try_into().unwrap());
+    Some((from_uid, to_uid, msg_id))
+}
diff --git a/crates/msgdb/src/sequence.rs b/crates/msgdb/src/sequence.rs
new file mode 100644
index 0000000..cd96332
--- /dev/null
+++ b/crates/msgdb/src/sequence.rs
@@ -0,0 +1,53 @@
+use sled::Db;
+
+use crate::{Error, Result};
+
+const SEQUENCE_BANDWIDTH: i64 = 32;
+
+pub(crate) struct Sequence {
+    ty: u8,
+    next: i64,
+    leased: i64,
+}
+
+impl Sequence {
+    pub(crate) fn new(db: &Db, ty: u8) -> Result<Sequence> {
+        let (next, leased) = Self::update_sequence_lease(ty, db)?;
+        Ok(Sequence { ty, next, leased })
+    }
+
+    pub(crate) fn release(&self, db: &Db) {
+        let _ = db.insert(key_sequence(self.ty), &self.next.to_be_bytes());
+    }
+
+    fn update_sequence_lease(ty: u8, db: &Db) -> Result<(i64, i64)> {
+        let key = key_sequence(ty);
+        let next = match db.get(key)? {
+            Some(value) => {
+                i64::from_be_bytes(value.as_ref().try_into().map_err(|_| Error::InvalidData)?)
+            }
+            None => 1,
+        };
+        let leased = next + SEQUENCE_BANDWIDTH;
+        db.insert(key, &leased.to_be_bytes())?;
+        Ok((next, leased))
+    }
+
+    pub(crate) fn generate_id(&mut self, db: &Db) -> Result<i64> {
+        if self.next >= self.leased {
+            let (next, lease) = Self::update_sequence_lease(self.ty, db)?;
+            self.next = next;
+            self.leased = lease;
+        }
+        let val = self.next;
+        self.next += 1;
+        Ok(val)
+    }
+}
+
+fn key_sequence(ty: u8) -> [u8; 10] {
+    let mut data = [0; 10];
+    data[0..9].copy_from_slice(b"SEQUENCE/");
+    data[9] = ty;
+    data
+}
diff --git a/crates/open-graph/Cargo.toml b/crates/open-graph/Cargo.toml
new file mode 100644
index 0000000..24b40c2
--- /dev/null
+++ b/crates/open-graph/Cargo.toml
@@ -0,0 +1,27 @@
+[package]
+name = "open-graph"
+version = "0.1.0"
+edition = "2021"
+include = ["**/*.rs", "Cargo.toml"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+tokio = { version = "*", features = ["macros"] }
+html5ever = "0.22.5"
+reqwest = { version = "0.11.10", features = [
+    "tokio-rustls",
+], default-features = false }
+serde = "1.0.136"
+serde_derive = "1.0.136"
+serde_json = "1.0.79"
+poem-openapi = { version = "2.0.23", optional = true }
+http = "0.2.6"
+url = "2.2.2"
+flate2 = "1.0"
+regex = "1.5.4"
+async-recursion = "1.0.0"
+
+[features]
+default = []
+poem_openapi = ["poem-openapi"]
diff --git a/crates/open-graph/README.md b/crates/open-graph/README.md
new file mode 100644
index 0000000..4a67938
--- /dev/null
+++ b/crates/open-graph/README.md
@@ -0,0 +1,40 @@
+# Open Graph Protocal Parser
+
+`pvc-opengraph` is based on `opengraph-0.2.4`, added some extra information: `Title`, `Description`, `Favicon`, and solved some problem:
+
+1. Support three-level attribute name.
+```html
+<meta property="og:image:height" content="1000" />
+```
+
+2. Support extracting `favicon`.
+```html
+<link rel="apple-touch-icon" sizes="57x57" href="https://domain.com/img/favicon/icon.png"/>
+```
+
+3. Support extracting `Title`.
+```html
+<title>First Title</title>
+<meta property="og:title" content="High priority Title" />
+```
+
+4. Relative path is automatically converted to absolute path:
+if request `https://domain.com/path1/path2` get the following:
+```html
+<meta property="og:image" content="rock.jpg" />
+```
+The absolute path is obtained after parsing:
+```
+https://domain.com/path1/rock.jpg
+```
+
+5. `reqwest` updated to the latest version. The `edition` adopts 2021, and `rustls` is enabled by default, which supports better cross platform compilation.
+
+
+6. add feature `poem-openapi`.
+
+
+7. `unzip` decoding of non-standard servers is supported. few servers ignore the client `Accept-Encoding` and always return `gz` format data.
+
+
+9. The code passed the `cargo test` and `cargo clip`.
\ No newline at end of file
diff --git a/crates/open-graph/src/audio.rs b/crates/open-graph/src/audio.rs
new file mode 100644
index 0000000..db91ad5
--- /dev/null
+++ b/crates/open-graph/src/audio.rs
@@ -0,0 +1,17 @@
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+#[cfg(feature = "poem_openapi")]
+#[derive(poem_openapi::Object)]
+pub struct Audio {
+    pub r#type: Option<String>,
+    pub url: String,
+    pub secure_url: Option<String>,
+}
+
+impl Audio {
+    pub fn new(url: String) -> Audio {
+        Audio {
+            url,
+            ..Default::default()
+        }
+    }
+}
diff --git a/crates/open-graph/src/error.rs b/crates/open-graph/src/error.rs
new file mode 100644
index 0000000..601625c
--- /dev/null
+++ b/crates/open-graph/src/error.rs
@@ -0,0 +1,52 @@
+use std::{
+    error,
+    fmt::{Display, Formatter, Result as FmtResult},
+};
+
+use reqwest;
+use url;
+
+#[derive(Debug)]
+pub enum Error {
+    NetworkError(reqwest::Error),
+    UrlParseError(url::ParseError),
+    IoError(std::io::Error),
+    Other(String),
+    Unexpected,
+}
+
+impl Display for Error {
+    fn fmt(&self, f: &mut Formatter) -> FmtResult {
+        match self {
+            Error::NetworkError(ref e) => write!(f, "NetworkError:  {}", e),
+            Error::UrlParseError(ref e) => write!(f, "UrlParseError:  {}", e),
+            Error::IoError(ref e) => write!(f, "IoError:  {}", e),
+            Error::Other(s) => write!(f, "Other Error: {}", s.as_str()),
+            Error::Unexpected => write!(f, "UnexpectedError"),
+        }
+    }
+}
+
+impl From<reqwest::Error> for Error {
+    fn from(err: reqwest::Error) -> Error {
+        Error::NetworkError(err)
+    }
+}
+
+impl From<url::ParseError> for Error {
+    fn from(err: url::ParseError) -> Error {
+        Error::UrlParseError(err)
+    }
+}
+
+impl From<std::io::Error> for Error {
+    fn from(err: std::io::Error) -> Error {
+        Error::IoError(err)
+    }
+}
+
+impl error::Error for Error {
+    fn description(&self) -> &str {
+        ""
+    }
+}
diff --git a/crates/open-graph/src/fetcher.rs b/crates/open-graph/src/fetcher.rs
new file mode 100644
index 0000000..27ac7d2
--- /dev/null
+++ b/crates/open-graph/src/fetcher.rs
@@ -0,0 +1,341 @@
+use std::borrow::Borrow;
+
+use html5ever::{
+    parse_document,
+    rcdom::{
+        Handle,
+        NodeData::{Comment, Doctype, Document, Element, ProcessingInstruction, Text},
+        RcDom,
+    },
+    tendril::{fmt::Slice, TendrilSink},
+    Attribute,
+};
+use http::HeaderMap;
+use reqwest;
+
+// use std::io::Read;
+use crate::{error::Error, Audio, Image, Object, Video};
+
+fn gz_decode(data: &[u8]) -> Result<String, Error> {
+    use std::io::prelude::*;
+
+    use flate2::read::GzDecoder;
+    let mut d = GzDecoder::new(data);
+    let mut s = String::new();
+    d.read_to_string(&mut s)?;
+    Ok(s)
+}
+
+use regex::Regex;
+fn fetch_url_from_meta(text: &str) -> Option<String> {
+    let re = Regex::new(r#"<meta .*?content=".*?url=(.*?)""#).unwrap();
+    if let Some(cap) = re.captures(text) {
+        return cap.get(1).map(|v| v.as_str().to_string());
+    }
+    None
+}
+
+#[test]
+fn test_fetch_url_from_meta() {
+    let text = r#"<meta http-equiv="refresh" content="0;url=http://www.baidu.com/">"#;
+    let a = fetch_url_from_meta(text);
+    assert_eq!(Some("http://www.baidu.com/".to_string()), a);
+}
+
+use async_recursion::async_recursion;
+#[async_recursion]
+pub async fn fetch(url: &str, header_map: Option<HeaderMap>, deep: u8) -> Result<Object, Error> {
+    // let body = reqwest::get(url).await?.text().await?;
+    let mut client = reqwest::Client::new().get(url);
+    if let Some(header_map2) = header_map.clone() {
+        client = client.headers(header_map2);
+        client = client.header(http::header::ACCEPT_ENCODING, "none");
+    }
+    let body = client.send().await?.bytes().await?;
+    // gz magic number: 1f 8b
+    if body.len() < 2 {
+        return Err(Error::Unexpected);
+    }
+    let body = if body[0] == 0x1f && body[1] == 0x8b {
+        gz_decode(body.as_bytes())
+            .unwrap_or_default()
+            .to_lowercase()
+    } else {
+        String::from_utf8(body.to_vec()).unwrap_or_default()
+    };
+
+    if body.contains("<meta") {
+        if let Some(url) = fetch_url_from_meta(body.as_str()) {
+            if deep > 10 {
+                return Err(Error::Other("too many redirect!".into()));
+            }
+            return fetch(&url, header_map, deep + 1).await;
+        }
+    }
+    // let body = client.send().await?.text().await?;
+    let dom = parse_document(RcDom::default(), Default::default())
+        .from_utf8()
+        .read_from(&mut body.as_bytes())
+        .unwrap();
+    walk(dom.document, url)
+}
+
+fn attr_value(attr_name: &str, attrs: &[Attribute]) -> Option<String> {
+    for attr in attrs.iter() {
+        if attr.name.local.as_ref() == attr_name {
+            return Some(attr.value.to_string());
+        }
+    }
+    None
+}
+
+fn inner_text(handle: Handle) -> Option<String> {
+    if handle.children.borrow().len() > 0 {
+        let text1 = handle.children.borrow();
+        let inner = text1.get(0);
+        if let Some(handle) = inner {
+            if let Text { contents } = handle.data.borrow() {
+                return Some(contents.borrow().to_string());
+            }
+        }
+    }
+    None
+}
+
+// use std::any::Any;
+fn walk(handle: Handle, url: &str) -> Result<Object, Error> {
+    let mut key_key_values = vec![];
+    do_walk(handle, &mut key_key_values, url)?;
+    let mut obj = Object::default();
+    for (key0, key1, value) in key_key_values {
+        match key0.as_ref() {
+            "title" => {
+                if !value.is_empty() {
+                    obj.title = value;
+                }
+            }
+            "type" => {
+                obj.r#type = value;
+            }
+            "url" => {
+                obj.url = value;
+            }
+            "favicon_url" => {
+                obj.favicon_url = Some(value);
+            }
+            "description" => {
+                if !value.is_empty() {
+                    obj.description = Some(value);
+                }
+            }
+            "locale" => {
+                obj.locale = Some(value);
+            }
+            "locale_alternate" => {
+                // obj.locale_alternate.as_mut().map(|v|v.push(value)); // cargo clippy warning!
+                if let Some(v) = obj.locale_alternate.as_mut() {
+                    v.push(value);
+                }
+            }
+            "site_name" => {
+                obj.site_name = Some(value);
+            }
+            "image" => {
+                if key1.is_empty() {
+                    obj.images.push(Image::new(value));
+                } else {
+                    if obj.images.is_empty() {
+                        obj.images.push(Image::new(value.clone()));
+                    }
+                    let mut v = obj.images.last_mut().unwrap();
+                    match key1.as_ref() {
+                        "width" => v.width = value.parse::<i32>().ok(),
+                        "height" => v.height = value.parse::<i32>().ok(),
+                        "secure_url" => v.secure_url = Some(value),
+                        "alt" => v.alt = Some(value),
+                        "type" => v.r#type = Some(value),
+                        _ => {}
+                    }
+                }
+            }
+            "audio" => {
+                if key1.is_empty() {
+                    obj.audios.push(Audio::new(value));
+                } else {
+                    if obj.audios.is_empty() {
+                        obj.audios.push(Audio::new(value.clone()));
+                    }
+                    let mut v = obj.audios.last_mut().unwrap();
+                    match key1.as_ref() {
+                        "secure_url" => v.secure_url = Some(value),
+                        "type" => v.r#type = Some(value),
+                        _ => {}
+                    }
+                }
+            }
+            "video" => {
+                if key1.is_empty() {
+                    obj.videos.push(Video::new(value));
+                } else {
+                    if obj.videos.is_empty() {
+                        obj.videos.push(Video::new(value.clone()));
+                    }
+                    let mut v = obj.videos.last_mut().unwrap();
+                    match key1.as_ref() {
+                        "height" => v.height = value.parse::<i32>().ok(),
+                        "width" => v.width = value.parse::<i32>().ok(),
+                        "secure_url" => v.secure_url = Some(value),
+                        "type" => v.r#type = Some(value),
+                        _ => {}
+                    }
+                }
+            }
+            _ => {}
+        };
+    }
+    Ok(obj)
+}
+fn do_walk(
+    handle: Handle,
+    key_key_values: &mut Vec<(String, String, String)>,
+    url: &str,
+) -> Result<(), Error> {
+    let abs_path = url::Url::parse(url)?;
+    match handle.data {
+        Document => (),
+        Doctype { .. } => (),
+        Text { .. } => (),
+        Comment { .. } => (),
+        Element {
+            ref name,
+            ref attrs,
+            ..
+        } => {
+            let tag_name = name.local.as_ref();
+            match tag_name {
+                "meta" => {
+                    if let Some(v) = attr_value("name", &attrs.borrow()) {
+                        if v == "description" {
+                            if let Some(vv) = attr_value("content", &attrs.borrow()) {
+                                key_key_values.push((
+                                    "description".to_string(),
+                                    "".to_string(),
+                                    vv,
+                                ));
+                            }
+                        }
+                    }
+                    if let Some(v) = attr_value("property", &attrs.borrow()) {
+                        if v.starts_with("og:") {
+                            let end = v.chars().count();
+                            let key = unsafe { v.get_unchecked(3..end) }.to_string();
+                            let mut keys: Vec<_> = key.split(':').collect();
+                            let key0 = keys.remove(0).to_string();
+                            let key1 = if keys.is_empty() {
+                                String::new()
+                            } else {
+                                keys.remove(0).to_string()
+                            };
+                            if let Some(mut vv) = attr_value("content", &attrs.borrow()) {
+                                if (key0 == "image" || key0 == "video" || key0 == "audio")
+                                    && key1.is_empty()
+                                    && !vv.starts_with("http")
+                                {
+                                    vv = abs_path.join(vv.as_str())?.to_string();
+                                }
+                                key_key_values.push((key0, key1, vv));
+                            }
+                        }
+                    }
+                }
+                "title" => {
+                    let title = inner_text(handle.clone()).unwrap_or_default();
+                    key_key_values.push(("title".to_string(), "".to_string(), title))
+                }
+                // <link rel="apple-touch-icon" sizes="57x57" href="https://www.redditstatic.com/desktop2x/img/favicon/apple-icon-57x57.png"/>
+                // <link rel="apple-touch-icon" sizes="60x60" href="https://www.redditstatic.com/desktop2x/img/favicon/apple-icon-60x60.png"/>
+                // <link rel="icon" type="image/png" href="http://example.com/myicon.png">
+                // <link rel="icon" type="image/x-icon" href="/images/favicon.ico">
+                "link" => {
+                    if let Some(v) = attr_value("rel", &attrs.borrow()) {
+                        if v.ends_with("icon") {
+                            if let Some(vv) = attr_value("href", &attrs.borrow()) {
+                                let vv = url::Url::parse(url)?.join(&vv)?;
+                                key_key_values.push((
+                                    "favicon_url".to_string(),
+                                    "".to_string(),
+                                    vv.to_string(),
+                                ));
+                            }
+                        }
+                    }
+                }
+                _ => (),
+            }
+        }
+        ProcessingInstruction { .. } => unreachable!(),
+    }
+    for child in handle.children.borrow().iter() {
+        do_walk(child.clone(), key_key_values, url)?;
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn extract_open_graph_object() {
+        let x = r#"
+            <html prefix="og: http://ogp.me/ns#">
+                <head>
+                    <title>The Rock 123</title>
+                    <meta name="description" content="Some Description" />
+                    <meta property="og:title" content="The Rock" />
+                    <meta property="og:type" content="video.movie" />
+                    <meta property="og:url" content="http://www.imdb.com/title/tt0117500/" />
+                    <meta property="og:image" content="http://ia.media-imdb.com/images/rock.jpg" />
+                    <meta property="og:image:type" content="image/jpeg" />
+                    <meta property="og:image" content="https://example.com/rock.jpg" />
+                    <meta property="og:image:width" content="400" />
+                    <meta property="og:image:height" content="300" />
+                    <meta property="og:image" content="https://example.com/rock2.jpg" />
+                    <meta property="og:image" content="https://example.com/rock3.jpg" />
+                    <meta property="og:image:height" content="1000" />
+                </head>
+                <body>
+                    <p>hello</p>
+                    <h1>hello</h1>
+                </body>
+            </html>
+            "#;
+        let x = x.to_string();
+        let dom = parse_document(RcDom::default(), Default::default())
+            .from_utf8()
+            .read_from(&mut x.as_bytes())
+            .unwrap();
+        let obj = walk(dom.document, "").unwrap();
+        assert_eq!(obj.title, "The Rock".to_string());
+        assert_eq!(obj.description, Some("Some Description".to_string()));
+        assert_eq!(obj.r#type, "video.movie".to_string());
+        assert_eq!(obj.url, "http://www.imdb.com/title/tt0117500/".to_string());
+        assert_eq!(obj.images.len(), 4);
+        assert_eq!(
+            obj.images[1].url,
+            "https://example.com/rock.jpg".to_string()
+        );
+        assert_eq!(obj.images[1].width, Some(400));
+        assert_eq!(obj.images[1].height, Some(300));
+        assert_eq!(obj.images[3].height, Some(1000));
+    }
+
+    #[tokio::test]
+    async fn test_fetch() {
+        // curl -H "accept-encoding: none" https://www.bilibili.com/video/BV1s3411J7Aj
+        // let obj = fetch("https://www.bilibili.com/video/BV1s3411J7Aj", None).await.unwrap();
+        // let obj = fetch("https://www.youtube.com/watch?v=BlI9PVQA8ZA", None).await.unwrap();
+        // let obj = fetch("https://dapr.io/", None).await.unwrap();
+        // dbg!(obj);
+    }
+}
diff --git a/crates/open-graph/src/image.rs b/crates/open-graph/src/image.rs
new file mode 100644
index 0000000..dabbe3c
--- /dev/null
+++ b/crates/open-graph/src/image.rs
@@ -0,0 +1,21 @@
+/// more media types: https://en.wikipedia.org/wiki/Media_type
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+#[cfg(feature = "poem_openapi")]
+#[derive(poem_openapi::Object)]
+pub struct Image {
+    pub r#type: Option<String>,
+    pub url: String,
+    pub secure_url: Option<String>,
+    pub width: Option<i32>,
+    pub height: Option<i32>,
+    pub alt: Option<String>,
+}
+
+impl Image {
+    pub fn new(url: String) -> Self {
+        Image {
+            url,
+            ..Default::default()
+        }
+    }
+}
diff --git a/crates/open-graph/src/lib.rs b/crates/open-graph/src/lib.rs
new file mode 100644
index 0000000..48b0a55
--- /dev/null
+++ b/crates/open-graph/src/lib.rs
@@ -0,0 +1,22 @@
+// https://ogp.me/
+#[macro_use]
+extern crate serde_derive;
+extern crate html5ever;
+extern crate reqwest;
+extern crate serde;
+extern crate serde_json;
+
+mod audio;
+mod image;
+mod object;
+mod video;
+
+pub mod error;
+pub mod fetcher;
+
+pub use audio::Audio;
+pub use error::Error;
+pub use fetcher::fetch;
+pub use image::Image;
+pub use object::Object;
+pub use video::Video;
diff --git a/crates/open-graph/src/object.rs b/crates/open-graph/src/object.rs
new file mode 100644
index 0000000..4d426e3
--- /dev/null
+++ b/crates/open-graph/src/object.rs
@@ -0,0 +1,20 @@
+use crate::{Audio, Image, Video};
+
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+#[cfg(feature = "poem_openapi")]
+#[derive(poem_openapi::Object)]
+pub struct Object {
+    pub r#type: String,
+    pub title: String,
+    pub url: String,
+
+    pub images: Vec<Image>,
+    pub audios: Vec<Audio>,
+    pub videos: Vec<Video>,
+
+    pub favicon_url: Option<String>,
+    pub description: Option<String>,
+    pub locale: Option<String>,
+    pub locale_alternate: Option<Vec<String>>,
+    pub site_name: Option<String>,
+}
diff --git a/crates/open-graph/src/video.rs b/crates/open-graph/src/video.rs
new file mode 100644
index 0000000..17ecdad
--- /dev/null
+++ b/crates/open-graph/src/video.rs
@@ -0,0 +1,19 @@
+#[derive(Serialize, Deserialize, Debug, Default, Clone)]
+#[cfg(feature = "poem_openapi")]
+#[derive(poem_openapi::Object)]
+pub struct Video {
+    pub r#type: Option<String>,
+    pub url: String,
+    pub secure_url: Option<String>,
+    pub width: Option<i32>,
+    pub height: Option<i32>,
+}
+
+impl Video {
+    pub fn new(url: String) -> Video {
+        Video {
+            url,
+            ..Default::default()
+        }
+    }
+}
diff --git a/crates/token/Cargo.toml b/crates/token/Cargo.toml
new file mode 100644
index 0000000..04c703e
--- /dev/null
+++ b/crates/token/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "rc-token"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+chrono = { version = "0.4.19", features = ["serde"] }
+hmac = "0.11.0"
+jwt = "0.15.0"
+serde = { version = "1.0.132", features = ["derive"] }
+sha2 = "0.9.0"
+textnonce = "1.0.0"
+thiserror = "1.0.30"
diff --git a/crates/token/src/error.rs b/crates/token/src/error.rs
new file mode 100644
index 0000000..ba70e67
--- /dev/null
+++ b/crates/token/src/error.rs
@@ -0,0 +1,8 @@
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error(transparent)]
+    Jwt(#[from] jwt::Error),
+
+    #[error("expired")]
+    Expired,
+}
diff --git a/crates/token/src/lib.rs b/crates/token/src/lib.rs
new file mode 100644
index 0000000..cce0621
--- /dev/null
+++ b/crates/token/src/lib.rs
@@ -0,0 +1,97 @@
+mod error;
+
+use chrono::{DateTime, Duration, Utc};
+pub use error::Error;
+use hmac::{Hmac, NewMac};
+use jwt::{SignWithKey, VerifyWithKey};
+use serde::{de::DeserializeOwned, Deserialize, Serialize};
+use sha2::Sha256;
+
+#[derive(Debug, Serialize, Deserialize, Eq, PartialEq)]
+pub enum TokenType {
+    AccessToken,
+    RefreshToken,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct TokenFields<T> {
+    #[serde(rename = "d")]
+    data: T,
+    #[serde(rename = "e")]
+    expire_at: DateTime<Utc>,
+    #[serde(rename = "n")]
+    nonce: String,
+    #[serde(rename = "t")]
+    token_type: TokenType,
+}
+
+pub fn create_token_pair(
+    server_key: &str,
+    data: impl Serialize,
+    refresh_token_expiry_seconds: i64,
+    token_expiry_seconds: i64,
+) -> Result<(String, String), Error> {
+    let refresh_token = create_token(
+        server_key,
+        &data,
+        TokenType::RefreshToken,
+        refresh_token_expiry_seconds,
+    )?;
+    let token = create_token(
+        server_key,
+        &data,
+        TokenType::AccessToken,
+        token_expiry_seconds,
+    )?;
+    Ok((refresh_token, token))
+}
+
+fn create_token(
+    server_key: &str,
+    data: &impl Serialize,
+    token_type: TokenType,
+    expiry_seconds: i64,
+) -> Result<String, Error> {
+    Ok(TokenFields {
+        data,
+        expire_at: Utc::now() + Duration::seconds(expiry_seconds),
+        nonce: textnonce::TextNonce::sized(16).unwrap().to_string(),
+        token_type,
+    }
+    .sign_with_key(&create_hmac_key(server_key))?)
+}
+
+fn create_hmac_key(server_key: &str) -> Hmac<Sha256> {
+    Hmac::<Sha256>::new_from_slice(server_key.as_bytes()).expect("invalid server key")
+}
+
+pub fn parse_token<T: DeserializeOwned>(
+    server_key: &str,
+    token: &str,
+    check_expired: bool,
+) -> Result<(TokenType, T), Error> {
+    let fields =
+        VerifyWithKey::<TokenFields<T>>::verify_with_key(token, &create_hmac_key(server_key))?;
+    if check_expired && fields.expire_at < Utc::now() {
+        return Err(Error::Expired);
+    }
+    Ok((fields.token_type, fields.data))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_token() {
+        let (refresh_token, token) = create_token_pair("123456", 100i32, 60 * 5, 60).unwrap();
+
+        let (token_type, value) = parse_token::<i32>("123456", &token, true).unwrap();
+        assert_eq!(token_type, TokenType::AccessToken);
+        assert_eq!(value, 100);
+
+        let (token_type, value) = parse_token::<i32>("123456", &refresh_token, true).unwrap();
+        assert_eq!(token_type, TokenType::RefreshToken);
+        assert_eq!(value, 100);
+    }
+}
diff --git a/crates/vc-license/Cargo.toml b/crates/vc-license/Cargo.toml
new file mode 100644
index 0000000..69df9e2
--- /dev/null
+++ b/crates/vc-license/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "vc-license"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+chrono={version="0.4.19"}
+uuid = {version="1.1.2", features=["v4"]}
+rsa = {version="0.6.1", features=["pem"]}
+pkcs1="0.3.3"
+rand="0.8.5"
+sha2="0.9.9"
+digest="0.8.1"
+bs58="0.4.0"
+hex="0.4.3"
+anyhow = "1.0.52"
\ No newline at end of file
diff --git a/crates/vc-license/src/lib.rs b/crates/vc-license/src/lib.rs
new file mode 100644
index 0000000..8d13378
--- /dev/null
+++ b/crates/vc-license/src/lib.rs
@@ -0,0 +1,265 @@
+use anyhow::{anyhow, Result};
+use chrono::{DateTime, Utc};
+use pkcs1::EncodeRsaPrivateKey;
+use rsa::{
+    pkcs1::{EncodeRsaPublicKey, LineEnding},
+    PaddingScheme, PublicKey, RsaPrivateKey, RsaPublicKey,
+};
+
+#[derive(Debug)]
+pub struct License {
+    pub domains: Vec<String>,
+    pub user_limit: u32,
+    pub created_at: DateTime<Utc>,
+    pub expired_at: DateTime<Utc>,
+    pub sign: Vec<u8>,
+}
+
+impl Default for License {
+    fn default() -> Self {
+        License {
+            domains: vec![],
+            user_limit: 0,
+            created_at: DateTime::<Utc>::MIN_UTC,
+            expired_at: DateTime::<Utc>::MIN_UTC,
+            sign: vec![],
+        }
+    }
+}
+
+impl License {
+    pub fn encode(&self) -> String {
+        format!(
+            "{},{},{}",
+            self.domains.join("|"),
+            self.created_at,
+            self.expired_at
+        )
+    }
+
+    #[allow(clippy::inherent_to_string)]
+    pub fn to_string(&self) -> String {
+        let data = format!(
+            "{},{},{},{},{}",
+            self.domains.join("|"),
+            self.user_limit,
+            self.created_at.to_rfc3339(),
+            self.expired_at.to_rfc3339(),
+            hex::encode(&self.sign)
+        );
+        bs58::encode(data.as_bytes()).into_string()
+    }
+
+    pub fn from_string(s: String) -> Result<Self> {
+        let a = bs58::decode(&s).into_vec()?;
+        let b = String::from_utf8(a)?;
+        let arr = b.split(',').collect::<Vec<_>>();
+        if arr.len() < 5 {
+            return Err(anyhow!("Bad Data: {}", &s));
+        }
+
+        let user_limit = arr[1].parse::<u32>().unwrap_or_default();
+        let created_at = DateTime::parse_from_rfc3339(arr[2])?;
+        let expired_at = DateTime::parse_from_rfc3339(arr[3])?;
+        let created_at = DateTime::<Utc>::from_utc(created_at.naive_utc(), Utc);
+        let expired_at = DateTime::<Utc>::from_utc(expired_at.naive_utc(), Utc);
+
+        let sign = hex::decode(arr[4])?;
+        Ok(License {
+            domains: arr[0].split('|').map(|v| v.to_string()).collect::<Vec<_>>(),
+            user_limit,
+            created_at,
+            expired_at,
+            sign,
+        })
+    }
+}
+
+#[derive(Debug)]
+pub struct LicenseGenerator {
+    private_key: RsaPrivateKey,
+    public_key: RsaPublicKey,
+}
+
+// generate new
+impl LicenseGenerator {
+    pub fn new(private_key: RsaPrivateKey, public_key: RsaPublicKey) -> Self {
+        LicenseGenerator {
+            private_key,
+            public_key,
+        }
+    }
+
+    pub fn new_from_pem(private_key_pem: &str, public_key_pem: &str) -> Result<Self> {
+        let private_key = pkcs1::DecodeRsaPrivateKey::from_pkcs1_pem(private_key_pem)?;
+        let public_key = pkcs1::DecodeRsaPublicKey::from_pkcs1_pem(public_key_pem)?;
+        Ok(LicenseGenerator {
+            private_key,
+            public_key,
+        })
+    }
+
+    pub fn gen(&self, domains: &str, expired_at: DateTime<Utc>, user_limit: u32) -> License {
+        let created_at = Utc::now();
+        let mut license = License {
+            domains: domains
+                .split('|')
+                .map(|v| v.to_string())
+                .collect::<Vec<_>>(),
+            user_limit,
+            created_at,
+            expired_at,
+            sign: vec![],
+        };
+        let data = license.encode();
+        let sign = rsa_sign(data.as_bytes(), &self.private_key);
+        license.sign = sign;
+        license
+    }
+
+    pub fn check(&self, license_str: &str) -> Result<()> {
+        let license = License::from_string(license_str.to_string())?;
+        if license.expired_at < Utc::now() {
+            return Err(anyhow!("License expired at {}!", license.expired_at));
+        }
+        let data = license.encode();
+        if rsa_check_sign(data.as_bytes(), &license.sign, &self.public_key).is_err() {
+            return Err(anyhow!("Invalid sign!"));
+        }
+        Ok(())
+    }
+}
+
+pub fn gen_rsa_pair() -> (RsaPrivateKey, RsaPublicKey) {
+    let mut rng = rand::thread_rng();
+    let bits = 2048;
+    let private_key = RsaPrivateKey::new(&mut rng, bits).expect("failed to generate a key");
+    let public_key = RsaPublicKey::from(&private_key);
+    (private_key, public_key)
+}
+
+pub fn gen_rsa_pem_pair() -> Result<(String, String)> {
+    let mut rng = rand::thread_rng();
+    let bits = 2048;
+    let private_key = RsaPrivateKey::new(&mut rng, bits).expect("failed to generate a key");
+    let a = private_key.to_pkcs1_pem(LineEnding::CRLF)?.to_string();
+    let public_key = RsaPublicKey::from(&private_key);
+    let b = public_key.to_pkcs1_pem(LineEnding::CRLF)?;
+    Ok((a, b))
+}
+
+fn rsa_sign(digest_in: &[u8], private_key: &RsaPrivateKey) -> Vec<u8> {
+    let padding = PaddingScheme::new_pkcs1v15_sign(None);
+    private_key.sign(padding, digest_in).unwrap()
+}
+
+fn rsa_check_sign(hashed: &[u8], sig: &[u8], public_key: &RsaPublicKey) -> Result<()> {
+    Ok(public_key.verify(PaddingScheme::new_pkcs1v15_sign(None), hashed, sig)?)
+}
+
+pub fn rsa_check_license_bs58(license_bs58: &str, public_key_pem: &str) -> Result<()> {
+    let public_key: RsaPublicKey = pkcs1::DecodeRsaPublicKey::from_pkcs1_pem(public_key_pem)?;
+    let license = License::from_string(license_bs58.to_string())?;
+    let data = license.encode();
+    rsa_check_sign(data.as_bytes(), license.sign.as_slice(), &public_key)
+}
+
+pub fn rsa_check_license(license: &License, public_key_pem: &str) -> Result<()> {
+    let public_key: RsaPublicKey = pkcs1::DecodeRsaPublicKey::from_pkcs1_pem(public_key_pem)?;
+    let data = license.encode();
+    rsa_check_sign(data.as_bytes(), license.sign.as_slice(), &public_key)
+}
+
+#[cfg(test)]
+mod test {
+    use std::ops::Add;
+
+    use super::*;
+
+    #[test]
+    fn test_license() {
+        let (private_key, public_key) = gen_rsa_pair();
+        let licensegen = LicenseGenerator::new(private_key, public_key);
+        let expired_at = Utc::now().add(chrono::Duration::seconds(365 * 86400));
+        let license = licensegen.gen("www.domain.com|www.domain2.com", expired_at, 10);
+        assert_eq!(license.domains[0], "www.domain.com");
+        assert_eq!(license.domains[1], "www.domain2.com");
+        assert_eq!(license.expired_at, expired_at);
+        let b = licensegen.check(&license.to_string());
+        assert!(b.is_ok());
+    }
+
+    #[test]
+    fn test_check_license() {
+        let (private_key, public_key) = gen_rsa_pair();
+        let licensegen = LicenseGenerator::new(private_key, public_key.clone());
+        let expired_at = Utc::now().add(chrono::Duration::seconds(365 * 86400));
+        let license = licensegen.gen("www.domain.com|www.domain2.com", expired_at, 20);
+
+        let license_bs58 = license.to_string();
+
+        let public_key_pem = public_key.to_pkcs1_pem(LineEnding::CRLF).unwrap();
+        let a = rsa_check_license_bs58(&license_bs58, &public_key_pem);
+        assert!(a.is_ok());
+    }
+
+    #[test]
+    fn test_gen_license() {
+        let private_key_pem = r#"-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEApqGLPAiVzx42qRkjDGqCT4+BrS3BReJA7UAXQt3YNfw2HIB+
+CJSDF22KnpqmnsaLWmxrUP1Q+ttb+fZhMZ569s5ZLs9h6pq2oTBK8kBUKz127rpw
+HSpGVnuGbkPB4NUcTOYiDTLT7iD9NSN38Cr1ITTD3+4EiSiCuf9aUpggfo06fqF6
+9ebDC0pPSTRvIDgKrJiku93c3d1uDq1DWfYKu3GP23ie5+3WwQcsd/XG/0xyMk1h
+fVQJqTf5Z2rVdmhVGt0XjV6cmaVshJOxGeoAubPLJX4G4DLTvXKGy/WlQlQTqIBz
+8xUBdnwtOymXGQpaS/Vfo0q1kGzZoXsCx3v7BQIDAQABAoIBAQClK0fakB//F9HS
+uCn3qrPUrUk7IjmMTgNRqM/l5gTlLkVs5ykG1D9FP73CDUXP6LpFPWb69r4IituW
+4FPjXVZBwrTAI6zJYeZZzIbdrkpAOkLjzEZJgpgKLZNJRTyu4k+VIiDquFE+n9Cd
+lbTTiaFF8wmdtE8mrdM3Dxi2+jhrd3Snp3kVvFniV7EQTwC6SEOQkyMP01aQgc1B
+ydxxZFqEO2oQ/uBdjovLEy6rAo18d1EZ5p2j/75oIPfVvtTELlnqLen/FKBmfaxz
+vHmaALJahAa1LYnqpr4Mn+SOmkf3lgtfz0H0yneN+9GfTNYcBePReOkcXFmkpE4p
+DG0J8QxBAoGBANX5Z8+wxrhHBcEPXS9/y/EWrLyM37HYoxUPfROgPrxACwxMdlIN
+QPtnGPdwW6qstIL8D63RCwHKADhUGd4BHnUyTiWjW0fQP3lJDj5HStU6/Iptec7t
+ZHggSSqPfhy5xQvRKVIxEDOYMEc4p7O/Lgocst8fK2g1USkT0mD3pPgNAoGBAMdb
+un9jhsV8O3ZufTrANF7IPAQqxk9i7A+zQM7DDXG1zYg/HDWWEh8OHTy8sOz7bbDt
+XpfhWqLxCldJZ5OkeIx27lejGbV7Fkmr7IyoEXVlM6pz4zbaKG7g/YC3xSoGyg03
+ijJ9fLhltCIeKW+df/lNFqeehwv3gGeSq0epVpjZAoGACzSMYyv2vB+8BWgwkRQ4
+Md/mG9mkvUODBs9Q1X5GysTvzy0R5SochQ3ZGNwhcMaqjVF14LxZvzY83LZKxH16
+gtinjwEG/rPBHzDcNha1rITyRK2G+3cjE8ddDYWGLSrtTrkdWNiI6KrHnHMzFQ6l
+8pGeLGENfN+N6IDJO5q8YOECgYAGkICtnStc6WBT4AODobyXumQvhvEMwCchxTdH
+F6kjq2bfK6TUJuLl3uMbkuMIiqbsAoTw31zKrME4apRcijfl+CyU+ivoi+sJ9f1O
+DGK2yORQooxCzCA0tnfieyqk3aBdmwyT6QnoUIED9pZKtJb4MI+kaVXtEPNLdcrq
+Cyts0QKBgQCJY+aRSa7x/WYjotQmwZDfMmABqUTjxWInv2VC6TID4qTR//5ZLWGD
+PGaAcyhCpEW7oh2++dvgy2L5ERToqfbKt0G7gFVdg5fMNExG5xKB1Z8BAe2JrVO7
+3HPF/Sk36ickz/3zXaBWSnoZUqzrMlJeXoSyLYFC+opQKatRRP5vQw==
+-----END RSA PRIVATE KEY-----"#;
+
+        let public_key_pem = r#"-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEApqGLPAiVzx42qRkjDGqCT4+BrS3BReJA7UAXQt3YNfw2HIB+CJSD
+F22KnpqmnsaLWmxrUP1Q+ttb+fZhMZ569s5ZLs9h6pq2oTBK8kBUKz127rpwHSpG
+VnuGbkPB4NUcTOYiDTLT7iD9NSN38Cr1ITTD3+4EiSiCuf9aUpggfo06fqF69ebD
+C0pPSTRvIDgKrJiku93c3d1uDq1DWfYKu3GP23ie5+3WwQcsd/XG/0xyMk1hfVQJ
+qTf5Z2rVdmhVGt0XjV6cmaVshJOxGeoAubPLJX4G4DLTvXKGy/WlQlQTqIBz8xUB
+dnwtOymXGQpaS/Vfo0q1kGzZoXsCx3v7BQIDAQAB
+-----END RSA PUBLIC KEY-----"#;
+
+        let licensegen = LicenseGenerator::new_from_pem(private_key_pem, public_key_pem).unwrap();
+
+        let expired_at = chrono::NaiveDate::parse_from_str("2025-01-01", "%Y-%m-%d")
+            .expect("Date format error: %Y-%m-%d, just like: 2024-02-01");
+        let expired_at = chrono::NaiveDateTime::new(
+            expired_at,
+            chrono::NaiveTime::from_hms_opt(0, 0, 0).unwrap(),
+        );
+        let expired_at = chrono::DateTime::<Utc>::from_utc(expired_at, Utc);
+        let license = licensegen.gen("www.domain.com|www.domain2.com", expired_at, 20);
+
+        let license_bs58 = license.to_string();
+        // dbg!(license_bs58);
+        // assert_eq!(&license_bs58,
+        // "2RvN4krfyQbvuLcXzz4PwoJfckRFptqLKKXSP7f4Np7AGqgixrfdUzZ5qk2iT2gFwCntivyYnSaumyao7QF2SfQ3TKyLAgGDYeYeJcbBri9re5esG2PMrxZBjq68eR94yYqdTg6LAP9oc5WtLAaBX25RkVu2zt59kdgRzk5CbnnmZnMAHgZEDnsVJfCQa6HKnb3p1cpZa6LTANrKh1VuvCAerdCHCoc1YHNwUipg5JJXmxJQadFShv1sYREUHHzLuPMb8xHb7GkPJ6MJpQBzHfDnTySRG7BGxNz5GKCutFp1o7YjkQqZvKBTvWQ8ic4HmbHErLHw4aJ5CAMyugX4v2GAgxS8Z4zi9tjdzRtbbqzncnXSNBTumBxobBskNAbEaQC9HgBavgcAw4wHrHSyG3v2rTdsDUJZgTtanEfxnxZhSpKtXZRFzVNdjmo66GeLhvWwMZSXKzH89uTvMcEokmbUyLz9mKXzRP9dhTJ4bC6YWNrbDueYX9pqrsmXm3Z4aYP7DjknXwPCMKZbsCXZi2YQVUjggCyRarR4eThY6gZ8iWGkvi1ybAADooh8KXSAFNGSRRTGC5La6Atug7y6e6QnFmaRndLHdCyxqyq9LM1Ly2icYAFa2ZspXyL3MyBTLFvgQeqTmL1KQVHzhjwtkTvcFsUxScYNXhVgCkyD5vkSZpcwixGJYyYtkrF27XpMcq8mR6dAyi3Zqt2w68X3xA748a8ofky1KYwHmA1U4BaDpXbbVKSu6wtonMhzvQ6xMssyWJVhrzeymPnMwM8Xiut3pZcpC77Ri"
+        // );
+
+        let license = License::from_string(license_bs58).unwrap();
+        // dbg!(license.domain);
+    }
+}
diff --git a/debug.log b/debug.log
new file mode 100644
index 0000000..700c995
--- /dev/null
+++ b/debug.log
@@ -0,0 +1,2 @@
+[1212/222951.272:ERROR:registration_protocol_win.cc(107)] CreateFile: ϵͳÕÒ²»µ½Ö¸¶¨µÄÎļþ¡£ (0x2)
+[1212/222951.453:ERROR:registration_protocol_win.cc(107)] CreateFile: ϵͳÕÒ²»µ½Ö¸¶¨µÄÎļþ¡£ (0x2)
diff --git a/license b/license
new file mode 100644
index 0000000..192726a
--- /dev/null
+++ b/license
@@ -0,0 +1,199 @@
+The server code is under Big Time Public License license, and the official image is under Creative Commons Attribution-NonCommercial 4.0 International license.
+
+Big Time Public License
+Version 2.0.0
+
+https://bigtimelicense.com/versions/2.0.0
+
+Purpose
+These terms let you use and share this software for noncommercial purposes and in small business for free, while also guaranteeing that paid licenses for big businesses will be available on fair, reasonable, and nondiscriminatory terms.
+
+Note that this section now includes the full phrase “fair, reasonable, and nondiscriminatory�. It’s a FRAND commitment, and it says so.
+
+Acceptance
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+Noncommercial Purposes
+You may use the software for any noncommercial purpose.
+
+Personal Uses
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, count as use for noncommercial purposes.
+
+Noncommercial Organizations
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution counts as use for noncommercial purposes, regardless of the source of funding or obligations resulting from the funding.
+
+Small Business
+You may use the software for the benefit of your company if it meets all these criteria:
+
+had fewer than 20 total individuals working as employees and independent contractors at all times during the last tax year
+We’ve reduced this threshold from 100 to 20 individuals.
+
+earned less than 1,000,000 USD (2019) total revenue in the last tax year
+
+received less than 1,000,000 USD (2019) total debt, equity, and other investment in the last five tax years, counting investment in predecessor companies that reorganized into, merged with, or spun out your company
+
+Adjust these dollar figures for inflation according to the United States Bureau of Labor Statistics’ consumer price index for all urban consumers, United States city average, for all items, not seasonally adjusted, with 1982–1984=100 reference base.
+
+Big Business
+You may use the software for the benefit of your company:
+
+for 128 days after your company stops qualifying under Small Business
+
+indefinitely, if the licensor or their legal successor does not offer fair, reasonable, and nondiscriminatory terms for a commercial license for the software within 32 days of written request and negotiate in good faith to conclude a deal
+
+Note the addition of an obligation to negotiate in good faith. No sending a proposal and then failing to follow through.
+
+How to Request
+If this software includes an address for the licensor or an agent of the licensor in a standard place, such as in documentation, software package metadata, or an “about� page or screen, try to request a fair commercial license at that address. If this package includes both online and offline addresses, try online before offline. If you can’t deliver a request that way, or this software doesn’t include any addressees, spend one hour online researching an address, recording all your searches and inquiries as you go, and try any addresses that you find. If you can’t find any addresses, or if those addresses also fail, that counts as failure to offer a fair commercial license by the licensor under Big Business.
+
+Fair, Reasonable, and Nondiscriminatory Terms
+Fair, reasonable, and nondiscriminatory terms may license the software perpetually or for a term, and may or may not cover new versions of the software. If the licensor advertises license terms and a pricing structure for generally available commercial licenses, the licensor proposes license terms and a price as advertised, and a customer not affiliated with the licensor has bought a commercial commercial license for the software on substantially equivalent terms in the past year, the proposal is fair, reasonable, and nondiscriminatory.
+
+The clarifications around FRAND now live in this section, instead of definitions squirreled away at the bottom of the license.
+
+The “as-advertised� safe harbor now extends to license terms as well as pricing. We’ve almost made more clear that the proposal needs to be in line with what’s advertised to qualify.
+
+The clarifications around perpetual or not and with-updates or not remain.
+
+Copyright License
+The licensor grants you a copyright license to do everything with the software that would otherwise infringe the licensor’s copyright in it for any purpose allowed by these terms.
+
+Notices
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with Required Notice: that the licensor provided with the software. For example:
+
+Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+Patent License
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+Fair Use
+You may have “fair use� rights for the software under the law. These terms do not limit them.
+
+No Other Rights
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else. These terms do not imply any other licenses.
+
+Patent Defense
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+Violations
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice. Otherwise, all your licenses end immediately.
+
+No Liability
+As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.
+
+Definitions
+The licensor is the individual or entity offering these terms, and the software is the software the licensor makes available under these terms.
+
+You refers to the individual or entity agreeing to these terms.
+
+Your company is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization. Control means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise. Control can be direct or indirect.
+
+Your licenses are all the licenses granted to you for the software under these terms.
+
+Use means anything you do with the software requiring one of your licenses.
+
+Attribution-NonCommercial 4.0 International (Offical Images)
+
+Official translations of this license are available in other languages.
+Creative Commons Corporation (“Creative Commons�) is not a law firm and does not provide legal services or legal advice. Distribution of Creative Commons public licenses does not create a lawyer-client or other relationship. Creative Commons makes its licenses and related information available on an “as-is� basis. Creative Commons gives no warranties regarding its licenses, any material licensed under their terms and conditions, or any related information. Creative Commons disclaims all liability for damages resulting from their use to the fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and conditions that creators and other rights holders may use to share original works of authorship and other material subject to copyright and certain other rights specified in the public license below. The following considerations are for informational purposes only, are not exhaustive, and do not form part of our licenses.
+
+Considerations for licensors: Our public licenses are intended for use by those authorized to give the public permission to use material in ways otherwise restricted by copyright and certain other rights. Our licenses are irrevocable. Licensors should read and understand the terms and conditions of the license they choose before applying it. Licensors should also secure all rights necessary before applying our licenses so that the public can reuse the material as expected. Licensors should clearly mark any material not subject to the license. This includes other CC-licensed material, or material used under an exception or limitation to copyright. More considerations for licensors.
+
+Considerations for the public: By using one of our public licenses, a licensor grants the public permission to use the licensed material under specified terms and conditions. If the licensor’s permission is not necessary for any reason–for example, because of any applicable exception or limitation to copyright–then that use is not regulated by the license. Our licenses grant only permissions under copyright and certain other rights that a licensor has authority to grant. Use of the licensed material may still be restricted for other reasons, including because others have copyright or other rights in the material. A licensor may make special requests, such as asking that all changes be marked or described. Although not required by our licenses, you are encouraged to respect those requests where reasonable. More considerations for the public.
+
+Creative Commons Attribution-NonCommercial 4.0 International Public License
+By exercising the Licensed Rights (defined below), You accept and agree to be bound by the terms and conditions of this Creative Commons Attribution-NonCommercial 4.0 International Public License ("Public License"). To the extent this Public License may be interpreted as a contract, You are granted the Licensed Rights in consideration of Your acceptance of these terms and conditions, and the Licensor grants You such rights in consideration of benefits the Licensor receives from making the Licensed Material available under these terms and conditions.
+
+Section 1 – Definitions.
+
+Adapted Material means material subject to Copyright and Similar Rights that is derived from or based upon the Licensed Material and in which the Licensed Material is translated, altered, arranged, transformed, or otherwise modified in a manner requiring permission under the Copyright and Similar Rights held by the Licensor. For purposes of this Public License, where the Licensed Material is a musical work, performance, or sound recording, Adapted Material is always produced where the Licensed Material is synched in timed relation with a moving image.
+Adapter's License means the license You apply to Your Copyright and Similar Rights in Your contributions to Adapted Material in accordance with the terms and conditions of this Public License.
+Copyright and Similar Rights means copyright and/or similar rights closely related to copyright including, without limitation, performance, broadcast, sound recording, and Sui Generis Database Rights, without regard to how the rights are labeled or categorized. For purposes of this Public License, the rights specified in Section 2(b)(1)-(2) are not Copyright and Similar Rights.
+Effective Technological Measures means those measures that, in the absence of proper authority, may not be circumvented under laws fulfilling obligations under Article 11 of the WIPO Copyright Treaty adopted on December 20, 1996, and/or similar international agreements.
+Exceptions and Limitations means fair use, fair dealing, and/or any other exception or limitation to Copyright and Similar Rights that applies to Your use of the Licensed Material.
+Licensed Material means the artistic or literary work, database, or other material to which the Licensor applied this Public License.
+Licensed Rights means the rights granted to You subject to the terms and conditions of this Public License, which are limited to all Copyright and Similar Rights that apply to Your use of the Licensed Material and that the Licensor has authority to license.
+Licensor means the individual(s) or entity(ies) granting rights under this Public License.
+NonCommercial means not primarily intended for or directed towards commercial advantage or monetary compensation. For purposes of this Public License, the exchange of the Licensed Material for other material subject to Copyright and Similar Rights by digital file-sharing or similar means is NonCommercial provided there is no payment of monetary compensation in connection with the exchange.
+Share means to provide material to the public by any means or process that requires permission under the Licensed Rights, such as reproduction, public display, public performance, distribution, dissemination, communication, or importation, and to make material available to the public including in ways that members of the public may access the material from a place and at a time individually chosen by them.
+Sui Generis Database Rights means rights other than copyright resulting from Directive 96/9/EC of the European Parliament and of the Council of 11 March 1996 on the legal protection of databases, as amended and/or succeeded, as well as other essentially equivalent rights anywhere in the world.
+You means the individual or entity exercising the Licensed Rights under this Public License. Your has a corresponding meaning.
+Section 2 – Scope.
+
+License grant.
+Subject to the terms and conditions of this Public License, the Licensor hereby grants You a worldwide, royalty-free, non-sublicensable, non-exclusive, irrevocable license to exercise the Licensed Rights in the Licensed Material to:
+reproduce and Share the Licensed Material, in whole or in part, for NonCommercial purposes only; and
+produce, reproduce, and Share Adapted Material for NonCommercial purposes only.
+Exceptions and Limitations. For the avoidance of doubt, where Exceptions and Limitations apply to Your use, this Public License does not apply, and You do not need to comply with its terms and conditions.
+Term. The term of this Public License is specified in Section 6(a).
+Media and formats; technical modifications allowed. The Licensor authorizes You to exercise the Licensed Rights in all media and formats whether now known or hereafter created, and to make technical modifications necessary to do so. The Licensor waives and/or agrees not to assert any right or authority to forbid You from making technical modifications necessary to exercise the Licensed Rights, including technical modifications necessary to circumvent Effective Technological Measures. For purposes of this Public License, simply making modifications authorized by this Section 2(a)(4) never produces Adapted Material.
+Downstream recipients.
+Offer from the Licensor – Licensed Material. Every recipient of the Licensed Material automatically receives an offer from the Licensor to exercise the Licensed Rights under the terms and conditions of this Public License.
+No downstream restrictions. You may not offer or impose any additional or different terms or conditions on, or apply any Effective Technological Measures to, the Licensed Material if doing so restricts exercise of the Licensed Rights by any recipient of the Licensed Material.
+No endorsement. Nothing in this Public License constitutes or may be construed as permission to assert or imply that You are, or that Your use of the Licensed Material is, connected with, or sponsored, endorsed, or granted official status by, the Licensor or others designated to receive attribution as provided in Section 3(a)(1)(A)(i).
+Other rights.
+
+Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise.
+Patent and trademark rights are not licensed under this Public License.
+To the extent possible, the Licensor waives any right to collect royalties from You for the exercise of the Licensed Rights, whether directly or through a collecting society under any voluntary or waivable statutory or compulsory licensing scheme. In all other cases the Licensor expressly reserves any right to collect such royalties, including when the Licensed Material is used other than for NonCommercial purposes.
+Section 3 – License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the following conditions.
+
+Attribution.
+
+If You Share the Licensed Material (including in modified form), You must:
+
+retain the following if it is supplied by the Licensor with the Licensed Material:
+identification of the creator(s) of the Licensed Material and any others designated to receive attribution, in any reasonable manner requested by the Licensor (including by pseudonym if designated);
+a copyright notice;
+a notice that refers to this Public License;
+a notice that refers to the disclaimer of warranties;
+a URI or hyperlink to the Licensed Material to the extent reasonably practicable;
+indicate if You modified the Licensed Material and retain an indication of any previous modifications; and
+indicate the Licensed Material is licensed under this Public License, and include the text of, or the URI or hyperlink to, this Public License.
+You may satisfy the conditions in Section 3(a)(1) in any reasonable manner based on the medium, means, and context in which You Share the Licensed Material. For example, it may be reasonable to satisfy the conditions by providing a URI or hyperlink to a resource that includes the required information.
+If requested by the Licensor, You must remove any of the information required by Section 3(a)(1)(A) to the extent reasonably practicable.
+If You Share Adapted Material You produce, the Adapter's License You apply must not prevent recipients of the Adapted Material from complying with this Public License.
+Section 4 – Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that apply to Your use of the Licensed Material:
+
+for the avoidance of doubt, Section 2(a)(1) grants You the right to extract, reuse, reproduce, and Share all or a substantial portion of the contents of the database for NonCommercial purposes only;
+if You include all or a substantial portion of the database contents in a database in which You have Sui Generis Database Rights, then the database in which You have Sui Generis Database Rights (but not its individual contents) is Adapted Material; and
+You must comply with the conditions in Section 3(a) if You Share all or a substantial portion of the contents of the database.
+For the avoidance of doubt, this Section 4 supplements and does not replace Your obligations under this Public License where the Licensed Rights include other Copyright and Similar Rights.
+Section 5 – Disclaimer of Warranties and Limitation of Liability.
+
+Unless otherwise separately undertaken by the Licensor, to the extent possible, the Licensor offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Material, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to You.
+To the extent possible, in no event will the Licensor be liable to You on any legal theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this Public License or use of the Licensed Material, even if the Licensor has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to You.
+The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability.
+Section 6 – Term and Termination.
+
+This Public License applies for the term of the Copyright and Similar Rights licensed here. However, if You fail to comply with this Public License, then Your rights under this Public License terminate automatically.
+Where Your right to use the Licensed Material has terminated under Section 6(a), it reinstates:
+
+automatically as of the date the violation is cured, provided it is cured within 30 days of Your discovery of the violation; or
+upon express reinstatement by the Licensor.
+For the avoidance of doubt, this Section 6(b) does not affect any right the Licensor may have to seek remedies for Your violations of this Public License.
+For the avoidance of doubt, the Licensor may also offer the Licensed Material under separate terms or conditions or stop distributing the Licensed Material at any time; however, doing so will not terminate this Public License.
+Sections 1, 5, 6, 7, and 8 survive termination of this Public License.
+Section 7 – Other Terms and Conditions.
+
+The Licensor shall not be bound by any additional or different terms or conditions communicated by You unless expressly agreed.
+Any arrangements, understandings, or agreements regarding the Licensed Material not stated herein are separate from and independent of the terms and conditions of this Public License.
+Section 8 – Interpretation.
+
+For the avoidance of doubt, this Public License does not, and shall not be interpreted to, reduce, limit, restrict, or impose conditions on any use of the Licensed Material that could lawfully be made without permission under this Public License.
+To the extent possible, if any provision of this Public License is deemed unenforceable, it shall be automatically reformed to the minimum extent necessary to make it enforceable. If the provision cannot be reformed, it shall be severed from this Public License without affecting the enforceability of the remaining terms and conditions.
+No term or condition of this Public License will be waived and no failure to comply consented to unless expressly agreed to by the Licensor.
+Nothing in this Public License constitutes or may be interpreted as a limitation upon, or waiver of, any privileges and immunities that apply to the Licensor or You, including from the legal processes of any jurisdiction or authority.
+Creative Commons is not a party to its public licenses. Notwithstanding, Creative Commons may elect to apply one of its public licenses to material it publishes and in those instances will be considered the “Licensor.� The text of the Creative Commons public licenses is dedicated to the public domain under the CC0 Public Domain Dedication. Except for the limited purpose of indicating that material is shared under a Creative Commons public license or as otherwise permitted by the Creative Commons policies published at creativecommons.org/policies, Creative Commons does not authorize the use of the trademark “Creative Commons� or any other trademark or logo of Creative Commons without its prior written consent including, without limitation, in connection with any unauthorized modifications to any of its public licenses or any other arrangements, understandings, or agreements concerning use of licensed material. For the avoidance of doubt, this paragraph does not form part of the public licenses.
+
+Creative Commons may be contacted at creativecommons.org.
+
+Additional languages available: العربية, �eština, Deutsch, Ελληνικά, Español, euskara, suomeksi, français, hrvatski, Bahasa Indonesia, italiano, 日本語, 한국어, Lietuvių, latviski, te reo M�ori, Nederlands, norsk, polski, português, română, ру��кий, Slovenš�ina, svenska, Türkçe, україн�ька, 中文, �語. Please visit https://creativecommons.org/licenses/by-nc/4.0/legalcode for more information about official translations.
diff --git a/migrations/20211225030728_create.sql b/migrations/20211225030728_create.sql
new file mode 100644
index 0000000..666199f
--- /dev/null
+++ b/migrations/20211225030728_create.sql
@@ -0,0 +1,82 @@
+create table user
+(
+    uid               integer primary key autoincrement not null,
+    name              text collate nocase not null,
+    password          text,
+    email             text collate nocase,
+    gender            integer             not null,
+    language          text                not null,
+    is_admin          boolean             not null default false,
+    create_by         text                not null,
+    avatar_updated_at timestamp           not null default '1970-01-01 00:00:00',
+    created_at        timestamp           not null default current_timestamp,
+    updated_at        timestamp           not null default current_timestamp
+);
+
+create unique index user_name on user (name);
+create unique index user_email on user (email);
+
+create table google_auth
+(
+    email text primary key not null,
+    uid   integer          not null,
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create unique index google_auth_uid on google_auth (uid);
+
+create table openid_connect
+(
+    issuer  text    not null,
+    subject text    not null,
+    uid     integer not null,
+    primary key (issuer, subject),
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create unique index openid_connect_uid on openid_connect (uid);
+
+create table refresh_token
+(
+    uid        integer   not null,
+    device     text      not null,
+    token      text      not null,
+    created_at timestamp not null default current_timestamp,
+    updated_at timestamp not null default current_timestamp,
+    primary key (uid, device),
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create table device
+(
+    uid          integer   not null,
+    device       text      not null,
+    device_token text,
+    created_at   timestamp not null default current_timestamp,
+    updated_at   timestamp not null default current_timestamp,
+    primary key (uid, device),
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create table `group`
+(
+    gid         integer primary key autoincrement not null,
+    name        text      not null,
+    owner       integer,
+    is_public   bool      not null default false,
+    description text      not null default '',
+    created_at  timestamp not null default current_timestamp,
+    updated_at  timestamp not null default current_timestamp
+);
+
+create table group_user
+(
+    id  integer primary key autoincrement not null,
+    gid integer not null,
+    uid integer not null,
+    foreign key (gid) references `group` (gid) on delete cascade,
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create unique index group_user_gid_uid on group_user (gid, uid);
+create index group_user_gid on group_user (gid);
diff --git a/migrations/20211231103316_user_log.sql b/migrations/20211231103316_user_log.sql
new file mode 100644
index 0000000..a4a1f4c
--- /dev/null
+++ b/migrations/20211231103316_user_log.sql
@@ -0,0 +1,13 @@
+create table user_log
+(
+    id                integer primary key autoincrement not null,
+    uid               integer   not null,
+    action            integer   not null,
+    email             text,
+    name              text,
+    gender            integer,
+    language          text,
+    is_admin          bool,
+    avatar_updated_at timestamp,
+    created_at        timestamp not null default current_timestamp
+);
diff --git a/migrations/20220110103458_operation_log.sql b/migrations/20220110103458_operation_log.sql
new file mode 100644
index 0000000..fbe25b2
--- /dev/null
+++ b/migrations/20220110103458_operation_log.sql
@@ -0,0 +1,6 @@
+create table operation_log
+(
+    id integer primary key autoincrement not null,
+    log text not null,
+    created_at timestamp not null default current_timestamp
+);
diff --git a/migrations/20220120030840_mute.sql b/migrations/20220120030840_mute.sql
new file mode 100644
index 0000000..0f84b1b
--- /dev/null
+++ b/migrations/20220120030840_mute.sql
@@ -0,0 +1,16 @@
+create table mute
+(
+    id         integer primary key autoincrement not null,
+    uid        integer not null,
+    mute_uid   integer,
+    mute_gid   integer,
+    expired_at timestamp,
+    foreign key (uid) references user (uid) on delete cascade,
+    foreign key (mute_uid) references `user` (uid) on delete cascade,
+    foreign key (mute_gid) references `group` (gid) on delete cascade
+);
+
+create unique index mute_uid_uid on mute (uid, mute_uid);
+create unique index mute_uid_gid on mute (uid, mute_gid);
+create index mute_uid on mute (uid);
+create index mute_expired_at on mute (expired_at);
diff --git a/migrations/20220216110023_metamask_auth.sql b/migrations/20220216110023_metamask_auth.sql
new file mode 100644
index 0000000..06ac68b
--- /dev/null
+++ b/migrations/20220216110023_metamask_auth.sql
@@ -0,0 +1,14 @@
+create table metamask_auth
+(
+    public_address text primary key not null,
+    uid            integer          not null,
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create unique index metamask_auth_uid on metamask_auth (uid);
+
+create table metamask_nonce
+(
+    public_address text primary key not null,
+    nonce          text             not null
+);
diff --git a/migrations/20220222011624_read_index.sql b/migrations/20220222011624_read_index.sql
new file mode 100644
index 0000000..05308ee
--- /dev/null
+++ b/migrations/20220222011624_read_index.sql
@@ -0,0 +1,15 @@
+create table read_index
+(
+    id         integer primary key autoincrement not null,
+    uid        integer not null,
+    target_uid integer,
+    target_gid integer,
+    mid        integer not null,
+    foreign key (uid) references user (uid) on delete cascade,
+    foreign key (target_uid) references `user` (uid) on delete cascade,
+    foreign key (target_gid) references `group` (gid) on delete cascade
+);
+
+create unique index read_index_uid_uid on read_index (uid, target_uid);
+create unique index read_index_uid_gid on read_index (uid, target_gid);
+create index read_index_uid on read_index (uid);
diff --git a/migrations/20220224101141_burn_after_reading.sql b/migrations/20220224101141_burn_after_reading.sql
new file mode 100644
index 0000000..2efec26
--- /dev/null
+++ b/migrations/20220224101141_burn_after_reading.sql
@@ -0,0 +1,15 @@
+create table burn_after_reading
+(
+    id         integer primary key autoincrement not null,
+    uid        integer not null,
+    target_uid integer,
+    target_gid integer,
+    expires_in integer not null,
+    foreign key (uid) references user (uid) on delete cascade,
+    foreign key (target_uid) references `user` (uid) on delete cascade,
+    foreign key (target_gid) references `group` (gid) on delete cascade
+);
+
+create unique index burn_after_reading_uid_uid on burn_after_reading (uid, target_uid);
+create unique index burn_after_reading_uid_gid on burn_after_reading (uid, target_gid);
+create index burn_after_reading_uid on burn_after_reading (uid);
diff --git a/migrations/20220302015013_config.sql b/migrations/20220302015013_config.sql
new file mode 100644
index 0000000..e733f7f
--- /dev/null
+++ b/migrations/20220302015013_config.sql
@@ -0,0 +1,6 @@
+create table config
+(
+    name    text primary key,
+    enabled bool not null default false,
+    value   text not null
+);
diff --git a/migrations/20220322022325_user_status.sql b/migrations/20220322022325_user_status.sql
new file mode 100644
index 0000000..01351f5
--- /dev/null
+++ b/migrations/20220322022325_user_status.sql
@@ -0,0 +1 @@
+alter table user add column status integer not null default 0;
diff --git a/migrations/20220409084106_group_avatar.sql b/migrations/20220409084106_group_avatar.sql
new file mode 100644
index 0000000..e7f4412
--- /dev/null
+++ b/migrations/20220409084106_group_avatar.sql
@@ -0,0 +1 @@
+alter table `group` add column avatar_updated_at timestamp not null default '1970-01-01 00:00:00';
diff --git a/migrations/20220412042859_third_party_users.sql b/migrations/20220412042859_third_party_users.sql
new file mode 100644
index 0000000..c952fb3
--- /dev/null
+++ b/migrations/20220412042859_third_party_users.sql
@@ -0,0 +1,6 @@
+create table third_party_users
+(
+    userid text primary key not null,
+    uid    integer          not null,
+    foreign key (uid) references user (uid) on delete cascade
+);
diff --git a/migrations/20220419112824_favorite.sql b/migrations/20220419112824_favorite.sql
new file mode 100644
index 0000000..aa384ad
--- /dev/null
+++ b/migrations/20220419112824_favorite.sql
@@ -0,0 +1,10 @@
+create table favorite_archive
+(
+    id         integer primary key autoincrement not null,
+    uid        integer not null,
+    archive_id text not null,
+    created_at timestamp not null,
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create unique index favorite_archive_uid_archive_id on favorite_archive (uid, archive_id);
diff --git a/migrations/20220424023928_pin_message.sql b/migrations/20220424023928_pin_message.sql
new file mode 100644
index 0000000..cfbb765
--- /dev/null
+++ b/migrations/20220424023928_pin_message.sql
@@ -0,0 +1,13 @@
+create table pinned_message
+(
+    id         integer primary key autoincrement not null,
+    gid        integer not null,
+    mid        integer not null,
+    created_by integer not null,
+    created_at timestamp not null,
+    foreign key (created_by) references `user` (uid) on delete cascade,
+    foreign key (gid) references `group` (gid) on delete cascade
+);
+
+create index pinned_message_gid on pinned_message (gid);
+create unique index pinned_message_gid_mid on pinned_message (gid, mid);
diff --git a/migrations/20220524222000_github_auth.sql b/migrations/20220524222000_github_auth.sql
new file mode 100644
index 0000000..0f5864c
--- /dev/null
+++ b/migrations/20220524222000_github_auth.sql
@@ -0,0 +1,9 @@
+
+create table github_auth
+(
+    username text primary key not null,
+    uid   integer          not null,
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create unique index github_auth_uid on github_auth (uid);
\ No newline at end of file
diff --git a/migrations/20220614000000_magic_link.sql b/migrations/20220614000000_magic_link.sql
new file mode 100644
index 0000000..e8061e3
--- /dev/null
+++ b/migrations/20220614000000_magic_link.sql
@@ -0,0 +1,16 @@
+create table user_tmp
+(
+    uid               integer primary key autoincrement not null,
+    name              text collate nocase not null,
+    password          text,
+    email             text collate nocase,
+    gender            integer             not null,
+    language          text                not null,
+    is_admin          boolean             not null default false,
+    create_by         text                not null,
+    avatar_updated_at timestamp           not null default '1970-01-01 00:00:00',
+    created_at        timestamp           not null default current_timestamp,
+    updated_at        timestamp           not null default current_timestamp
+);
+
+create unique index user_tmp_email on user (email);
\ No newline at end of file
diff --git a/migrations/20220825014833_guest_user.sql b/migrations/20220825014833_guest_user.sql
new file mode 100644
index 0000000..4f211fb
--- /dev/null
+++ b/migrations/20220825014833_guest_user.sql
@@ -0,0 +1 @@
+alter table user add column is_guest boolean not null default false;
diff --git a/migrations/20221204062009_pinned_message_idx.sql b/migrations/20221204062009_pinned_message_idx.sql
new file mode 100644
index 0000000..be62001
--- /dev/null
+++ b/migrations/20221204062009_pinned_message_idx.sql
@@ -0,0 +1,2 @@
+drop index pinned_message_gid_mid;
+create index pinned_message_gid_mid on pinned_message (gid, mid);
diff --git a/migrations/20221211080856_webhook.sql b/migrations/20221211080856_webhook.sql
new file mode 100644
index 0000000..c1d5bfc
--- /dev/null
+++ b/migrations/20221211080856_webhook.sql
@@ -0,0 +1,4 @@
+alter table
+    user
+add
+    column webhook_url string;
\ No newline at end of file
diff --git a/migrations/20221214110231_is_bot.sql b/migrations/20221214110231_is_bot.sql
new file mode 100644
index 0000000..347a5c8
--- /dev/null
+++ b/migrations/20221214110231_is_bot.sql
@@ -0,0 +1,9 @@
+alter table
+    user
+add
+    column is_bot boolean not null default false;
+
+alter table
+    user_log
+add
+    column is_bot boolean;
\ No newline at end of file
diff --git a/migrations/20221217142927_bot_keys.sql b/migrations/20221217142927_bot_keys.sql
new file mode 100644
index 0000000..8fe9cb6
--- /dev/null
+++ b/migrations/20221217142927_bot_keys.sql
@@ -0,0 +1,13 @@
+create table bot_key (
+    id integer primary key autoincrement not null,
+    uid integer not null,
+    name string not null,
+    key string not null,
+    created_at timestamp not null default current_timestamp,
+    last_used timestamp,
+    foreign key (uid) references user (uid) on delete cascade
+);
+
+create index bot_key_uid on bot_key (uid);
+
+create unique index bot_key_uid_name on bot_key (uid, name);
\ No newline at end of file
diff --git a/src/api/admin_agora.rs b/src/api/admin_agora.rs
new file mode 100644
index 0000000..b3816e6
--- /dev/null
+++ b/src/api/admin_agora.rs
@@ -0,0 +1,155 @@
+use poem::{
+    error::{InternalServerError, ServiceUnavailable},
+    http::StatusCode,
+    web::Data,
+    Error, Result,
+};
+use poem_openapi::{param::Query, payload::Json, Object, OpenApi};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    api::{tags::ApiTags, token::Token, DateTime},
+    config::Config,
+    state::{DynamicConfig, DynamicConfigEntry},
+    State,
+};
+
+pub struct ApiAdminAgora;
+
+#[derive(Debug, Object, Serialize, Deserialize, Default)]
+pub struct AgoraConfig {
+    #[oai(default = "default_agora_url")]
+    pub url: String,
+    pub project_id: String,
+    pub app_id: String,
+    pub app_certificate: String,
+    pub rtm_key: String,
+    pub rtm_secret: String,
+}
+
+fn default_agora_url() -> String {
+    "https://api.agora.io".to_string()
+}
+
+impl DynamicConfig for AgoraConfig {
+    type Instance = Self;
+
+    fn name() -> &'static str {
+        "agora"
+    }
+
+    fn create_instance(self, _config: &Config) -> Self::Instance {
+        self
+    }
+}
+
+/// Agora config
+#[derive(Debug, Object)]
+pub struct AgoraConfigObject {
+    enabled: bool,
+    #[oai(flatten)]
+    config: AgoraConfig,
+}
+
+/// Agora usage response
+#[derive(Deserialize, Object)]
+struct AgoraUsagesResponse {
+    usages: Vec<AgoraUsageItem>,
+}
+
+/// Agora usage item
+#[derive(Deserialize, Object)]
+struct AgoraUsageItem {
+    date: DateTime,
+    usage: AgoraUsage,
+}
+
+/// Agora usage
+#[derive(Deserialize, Object)]
+#[serde(rename_all = "camelCase")]
+struct AgoraUsage {
+    duration_audio_all: i64,
+    duration_video_hd: i64,
+    duration_video_hdp: i64,
+}
+
+#[OpenApi(prefix_path = "/admin/agora", tag = "ApiTags::AdminAgora")]
+impl ApiAdminAgora {
+    /// Set Agora config
+    #[oai(path = "/config", method = "post")]
+    async fn set_config(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        config: Json<AgoraConfigObject>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: config.0.enabled,
+                config: config.0.config,
+            })
+            .await?;
+
+        Ok(())
+    }
+
+    /// Get Agora config
+    #[oai(path = "/config", method = "get")]
+    async fn get_config(
+        &self,
+        state: Data<&State>,
+        _token: Token,
+    ) -> Result<Json<AgoraConfigObject>> {
+        // if !token.is_admin {
+        //     return Err(Error::from_status(StatusCode::FORBIDDEN));
+        // }
+        let entry = state.load_dynamic_config::<AgoraConfig>().await?;
+        Ok(Json(AgoraConfigObject {
+            enabled: entry.enabled,
+            config: entry.config,
+        }))
+    }
+
+    /// Get Agora usage
+    #[oai(path = "/usages", method = "get")]
+    async fn usage(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        /// Start date(YYYY-MM-DD)
+        from_date: Query<String>,
+        /// End date(YYYY-MM-DD)
+        to_date: Query<String>,
+    ) -> Result<Json<AgoraUsagesResponse>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let agora = state
+            .get_dynamic_config_instance::<AgoraConfig>()
+            .await
+            .ok_or_else(|| Error::from_status(StatusCode::SERVICE_UNAVAILABLE))?;
+        let resp = reqwest::Client::new()
+            .get(format!("{}/dev/v3/usage", agora.url))
+            .query(&[
+                ("project_id", agora.project_id.as_str()),
+                ("from_date", from_date.as_str()),
+                ("to_date", to_date.as_str()),
+                ("business", "default"),
+            ])
+            .header("accept", "application/json")
+            .basic_auth(&agora.rtm_key, Some(&agora.rtm_secret))
+            .send()
+            .await
+            .map_err(ServiceUnavailable)?
+            .error_for_status()
+            .map_err(ServiceUnavailable)?
+            .json::<AgoraUsagesResponse>()
+            .await
+            .map_err(InternalServerError)?;
+        Ok(Json(resp))
+    }
+}
diff --git a/src/api/admin_fcm.rs b/src/api/admin_fcm.rs
new file mode 100644
index 0000000..90d738e
--- /dev/null
+++ b/src/api/admin_fcm.rs
@@ -0,0 +1,103 @@
+use poem::{http::StatusCode, web::Data, Error, Result};
+use poem_openapi::{payload::Json, Object, OpenApi};
+use rc_fcm::{ApplicationCredentials, FcmClient};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    api::{tags::ApiTags, token::Token},
+    config::Config,
+    state::{DynamicConfig, DynamicConfigEntry},
+    State,
+};
+
+pub struct ApiAdminFirebase;
+
+/// Firebase config
+#[derive(Debug, Object, Serialize, Deserialize, Default)]
+pub struct FcmConfig {
+    #[serde(default = "default_use_official")]
+    pub use_official: bool,
+    #[oai(default = "default_token_url")]
+    pub token_url: String,
+    pub project_id: String,
+    pub private_key: String,
+    pub client_email: String,
+}
+
+fn default_use_official() -> bool {
+    true
+}
+
+fn default_token_url() -> String {
+    "https://oauth2.googleapis.com/token".to_string()
+}
+
+impl DynamicConfig for FcmConfig {
+    type Instance = FcmClient;
+
+    fn name() -> &'static str {
+        "fcm"
+    }
+
+    fn create_instance(self, config: &Config) -> Self::Instance {
+        if self.use_official {
+            FcmClient::new(ApplicationCredentials {
+                project_id: config.offical_fcm_config.project_id.clone(),
+                private_key: config.offical_fcm_config.private_key.clone(),
+                client_email: config.offical_fcm_config.client_email.clone(),
+                token_uri: config.offical_fcm_config.token_uri.clone(),
+            })
+        } else {
+            FcmClient::new(ApplicationCredentials {
+                project_id: self.project_id,
+                private_key: self.private_key,
+                client_email: self.client_email,
+                token_uri: self.token_url,
+            })
+        }
+    }
+}
+
+/// Firebase config
+#[derive(Debug, Object)]
+pub struct FcmConfigObject {
+    enabled: bool,
+    #[oai(flatten)]
+    config: FcmConfig,
+}
+
+#[OpenApi(prefix_path = "/admin/fcm", tag = "ApiTags::AdminFirebase")]
+impl ApiAdminFirebase {
+    /// Set Firebase config
+    #[oai(path = "/config", method = "post")]
+    async fn set_config(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        config: Json<FcmConfigObject>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: config.0.enabled,
+                config: config.0.config,
+            })
+            .await?;
+        Ok(())
+    }
+
+    /// Get Firebase config
+    #[oai(path = "/config", method = "get")]
+    async fn get_config(&self, state: Data<&State>, token: Token) -> Result<Json<FcmConfigObject>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        let entry = state.load_dynamic_config::<FcmConfig>().await?;
+        Ok(Json(FcmConfigObject {
+            enabled: entry.enabled,
+            config: entry.config,
+        }))
+    }
+}
diff --git a/src/api/admin_github_auth.rs b/src/api/admin_github_auth.rs
new file mode 100644
index 0000000..255ae3b
--- /dev/null
+++ b/src/api/admin_github_auth.rs
@@ -0,0 +1,101 @@
+use poem::{http::StatusCode, web::Data, Error, Result};
+use poem_openapi::{payload::Json, Object, OpenApi};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    api::{tags::ApiTags, token::Token},
+    config::Config,
+    state::{DynamicConfig, DynamicConfigEntry},
+    State,
+};
+
+pub struct ApiAdminGithubAuth;
+
+/// Github authentication config
+#[derive(Debug, Object, Serialize, Deserialize, Default)]
+pub struct GithubAuthConfig {
+    pub client_id: String,
+    pub client_secret: String,
+}
+
+impl DynamicConfig for GithubAuthConfig {
+    type Instance = GithubAuthConfig;
+
+    fn name() -> &'static str {
+        "github-auth"
+    }
+
+    fn create_instance(self, _config: &Config) -> Self::Instance {
+        GithubAuthConfig {
+            client_id: String::new(),
+            client_secret: String::new(),
+        }
+    }
+}
+
+#[OpenApi(prefix_path = "/admin/github_auth", tag = "ApiTags::AdminGithubAuth")]
+impl ApiAdminGithubAuth {
+    /// Set Github auth config
+    #[oai(path = "/config", method = "post")]
+    async fn set_config(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        config: Json<GithubAuthConfig>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: config.0,
+            })
+            .await?;
+        Ok(())
+    }
+
+    /// Get Github auth config
+    #[oai(path = "/config", method = "get")]
+    async fn get_config(&self, state: Data<&State>) -> Result<Json<GithubAuthConfig>> {
+        let entry = state.load_dynamic_config::<GithubAuthConfig>().await?;
+        Ok(Json(entry.config))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use crate::test_harness::TestServer;
+
+    #[tokio::test]
+    async fn set_get_github_oauth() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let resp = server
+            .post("/api/admin/github_auth/config")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "client_id": "test",
+                "client_secret": "test",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let resp = server
+            .get("/api/admin/github_auth/config")
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        // let body = resp.0.take_body().into_string().await.unwrap();
+        // dbg!(body);
+
+        let json = resp.json().await;
+        json.value().object().get("client_id").assert_string("test");
+    }
+}
diff --git a/src/api/admin_google_auth.rs b/src/api/admin_google_auth.rs
new file mode 100644
index 0000000..8bbb317
--- /dev/null
+++ b/src/api/admin_google_auth.rs
@@ -0,0 +1,62 @@
+use poem::{http::StatusCode, web::Data, Error, Result};
+use poem_openapi::{payload::Json, Object, OpenApi};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    api::{tags::ApiTags, token::Token},
+    config::Config,
+    state::{DynamicConfig, DynamicConfigEntry},
+    State,
+};
+
+pub struct ApiAdminGoogleAuth;
+
+/// Google authentication config
+#[derive(Debug, Object, Serialize, Deserialize, Default)]
+pub struct GoogleAuthConfig {
+    pub client_id: String,
+}
+
+impl DynamicConfig for GoogleAuthConfig {
+    type Instance = GoogleAuthConfig;
+
+    fn name() -> &'static str {
+        "google-auth"
+    }
+
+    fn create_instance(self, _config: &Config) -> Self::Instance {
+        GoogleAuthConfig {
+            client_id: String::new(),
+        }
+    }
+}
+
+#[OpenApi(prefix_path = "/admin/google_auth", tag = "ApiTags::AdminGoogleAuth")]
+impl ApiAdminGoogleAuth {
+    /// Set Google auth config
+    #[oai(path = "/config", method = "post")]
+    async fn set_config(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        config: Json<GoogleAuthConfig>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: config.0,
+            })
+            .await?;
+        Ok(())
+    }
+
+    /// Get Google auth config
+    #[oai(path = "/config", method = "get")]
+    async fn get_config(&self, state: Data<&State>) -> Result<Json<GoogleAuthConfig>> {
+        let entry = state.load_dynamic_config::<GoogleAuthConfig>().await?;
+        Ok(Json(entry.config))
+    }
+}
diff --git a/src/api/admin_login.rs b/src/api/admin_login.rs
new file mode 100644
index 0000000..cd25639
--- /dev/null
+++ b/src/api/admin_login.rs
@@ -0,0 +1,119 @@
+use poem::{http::StatusCode, web::Data, Error, Result};
+use poem_openapi::{payload::Json, Enum, Object, OpenApi};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    api::{tags::ApiTags, token::Token},
+    config::Config,
+    state::{DynamicConfig, DynamicConfigEntry},
+    State,
+};
+
+pub struct ApiAdminLogin;
+
+#[derive(Debug, Object, Serialize, Deserialize)]
+pub struct OIDCConfig {
+    pub enable: bool,
+    pub favicon: String,
+    pub domain: String,
+}
+
+#[derive(Debug, Enum, Serialize, Deserialize, Eq, PartialEq, Copy, Clone)]
+pub enum WhoCanSignUp {
+    EveryOne,
+    InvitationOnly,
+}
+
+/// Login config
+#[derive(Debug, Object, Serialize, Deserialize)]
+pub struct LoginConfig {
+    /// Who can sign up
+    #[serde(default = "default_who_can_sign_up")]
+    pub who_can_sign_up: WhoCanSignUp,
+    /// Login as guest
+    #[serde(default)]
+    pub guest: bool,
+    /// Login with password
+    #[serde(default)]
+    pub password: bool,
+    /// Login with magic link
+    #[serde(default)]
+    pub magic_link: bool,
+    /// Login with Google
+    #[serde(default)]
+    pub google: bool,
+    /// Login with Github
+    #[serde(default)]
+    pub github: bool,
+    /// Login with OpenID Connect
+    #[serde(default)]
+    pub oidc: Vec<OIDCConfig>,
+    /// Login with Metamask
+    #[serde(default)]
+    pub metamask: bool,
+    /// Login with third party
+    #[serde(default)]
+    pub third_party: bool,
+}
+
+const fn default_who_can_sign_up() -> WhoCanSignUp {
+    WhoCanSignUp::EveryOne
+}
+
+impl Default for LoginConfig {
+    fn default() -> Self {
+        Self {
+            who_can_sign_up: WhoCanSignUp::EveryOne,
+            guest: false,
+            password: true,
+            magic_link: true,
+            google: false,
+            github: false,
+            oidc: vec![],
+            metamask: false,
+            third_party: false,
+        }
+    }
+}
+
+impl DynamicConfig for LoginConfig {
+    type Instance = Self;
+
+    fn name() -> &'static str {
+        "login"
+    }
+
+    fn create_instance(self, _config: &Config) -> Self::Instance {
+        self
+    }
+}
+
+#[OpenApi(prefix_path = "/admin/login", tag = "ApiTags::AdminLogin")]
+impl ApiAdminLogin {
+    /// Set login config
+    #[oai(path = "/config", method = "post")]
+    async fn set_config(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        config: Json<LoginConfig>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: config.0,
+            })
+            .await?;
+        Ok(())
+    }
+
+    /// Get login config
+    #[oai(path = "/config", method = "get")]
+    async fn get_config(&self, state: Data<&State>) -> Result<Json<LoginConfig>> {
+        let entry = state.load_dynamic_config::<LoginConfig>().await?;
+        Ok(Json(entry.config))
+    }
+}
diff --git a/src/api/admin_smtp.rs b/src/api/admin_smtp.rs
new file mode 100644
index 0000000..fcb0900
--- /dev/null
+++ b/src/api/admin_smtp.rs
@@ -0,0 +1,88 @@
+use poem::{http::StatusCode, web::Data, Error, Result};
+use poem_openapi::{payload::Json, Object, OpenApi};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    api::{tags::ApiTags, token::Token},
+    config::Config,
+    state::{DynamicConfig, DynamicConfigEntry},
+    State,
+};
+
+pub struct ApiAdminSmtp;
+
+#[derive(Debug, Object, Serialize, Deserialize, Default)]
+pub struct SmtpConfig {
+    pub host: String,
+    pub port: Option<u16>,
+    pub from: String,
+    pub username: String,
+    pub password: String,
+}
+
+impl DynamicConfig for SmtpConfig {
+    type Instance = Self;
+
+    fn name() -> &'static str {
+        "smtp"
+    }
+
+    fn create_instance(self, _config: &Config) -> Self::Instance {
+        self
+    }
+}
+
+/// SMTP config
+#[derive(Debug, Object)]
+pub struct SmtpConfigObject {
+    enabled: bool,
+    #[oai(flatten)]
+    config: SmtpConfig,
+}
+
+#[OpenApi(prefix_path = "/admin/smtp", tag = "ApiTags::AdminSmtp")]
+impl ApiAdminSmtp {
+    /// Set SMTP config
+    #[oai(path = "/config", method = "post")]
+    async fn set_config(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        config: Json<SmtpConfigObject>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: config.0.enabled,
+                config: config.0.config,
+            })
+            .await?;
+        Ok(())
+    }
+
+    /// Get SMTP config
+    #[oai(path = "/config", method = "get")]
+    async fn get_config(
+        &self,
+        state: Data<&State>,
+        token: Token,
+    ) -> Result<Json<SmtpConfigObject>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        let entry = state.load_dynamic_config::<SmtpConfig>().await?;
+        Ok(Json(SmtpConfigObject {
+            enabled: entry.enabled,
+            config: entry.config,
+        }))
+    }
+
+    /// Get SMTP config is enabled
+    #[oai(path = "/enabled", method = "get")]
+    async fn is_enabled(&self, state: Data<&State>) -> Result<Json<bool>> {
+        let entry = state.load_dynamic_config::<SmtpConfig>().await?;
+        Ok(Json(entry.enabled))
+    }
+}
diff --git a/src/api/admin_system.rs b/src/api/admin_system.rs
new file mode 100644
index 0000000..150a37c
--- /dev/null
+++ b/src/api/admin_system.rs
@@ -0,0 +1,399 @@
+use image::ImageFormat;
+use poem::{error::InternalServerError, http::StatusCode, web::Data, Error, Result};
+use poem_openapi::{
+    payload::{Binary, Json, PlainText},
+    types::Email,
+    ApiRequest, Object, OpenApi,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    api::{tags::ApiTags, token::Token, SmtpConfig, UserInfo},
+    config::Config,
+    create_user::{CreateUser, CreateUserBy},
+    server::create_random_str,
+    state::{send_mail, DynamicConfig, DynamicConfigEntry},
+    State,
+};
+
+/// Server metrics
+#[derive(Debug, Object)]
+pub struct Metrics {
+    user_count: usize,
+    group_count: usize,
+    online_user_count: usize,
+    version: String,
+}
+
+/// Frontend url
+#[derive(Debug, Object, Serialize, Deserialize, Default)]
+pub struct FrontendUrlConfig {
+    pub url: Option<String>,
+}
+
+impl DynamicConfig for FrontendUrlConfig {
+    type Instance = Self;
+
+    fn name() -> &'static str {
+        "frontend-url"
+    }
+
+    fn create_instance(self, _config: &Config) -> Self::Instance {
+        self
+    }
+}
+
+/// Organization info
+#[derive(Debug, Object, Serialize, Deserialize)]
+pub struct OrganizationConfig {
+    name: String,
+    description: Option<String>,
+}
+
+impl DynamicConfig for OrganizationConfig {
+    type Instance = Self;
+
+    fn name() -> &'static str {
+        "organization"
+    }
+
+    fn create_instance(self, _config: &Config) -> Self::Instance {
+        self
+    }
+}
+
+impl Default for OrganizationConfig {
+    fn default() -> Self {
+        Self {
+            name: "unknown".to_string(),
+            description: None,
+        }
+    }
+}
+
+#[derive(ApiRequest)]
+enum UploadLogoRequest {
+    #[oai(content_type = "image/png")]
+    Image(Binary<Vec<u8>>),
+}
+
+#[derive(Object)]
+struct SendMailRequest {
+    to: String,
+    subject: String,
+    content: String,
+}
+
+#[derive(Object)]
+struct CreateAdminRequest {
+    email: Email,
+    name: String,
+    password: String,
+    gender: i32,
+}
+
+pub struct ApiAdminSystem;
+
+#[OpenApi(prefix_path = "/admin/system", tag = "ApiTags::AdminSystem")]
+impl ApiAdminSystem {
+    /// Get the server version
+    #[oai(path = "/version", method = "get")]
+    async fn version(&self) -> PlainText<&'static str> {
+        PlainText(env!("CARGO_PKG_VERSION"))
+    }
+
+    /// Create administrator user
+    #[oai(path = "/create_admin", method = "post")]
+    async fn create_admin_user(
+        &self,
+        state: Data<&State>,
+        mut req: Json<CreateAdminRequest>,
+    ) -> Result<Json<UserInfo>> {
+        if !state.cache.read().await.users.is_empty() {
+            return Err(poem::Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        req.email.0 = req.email.0.to_lowercase();
+        let (uid, user) = match state
+            .create_user(
+                CreateUser::new(
+                    &req.name,
+                    CreateUserBy::Password {
+                        email: &req.email,
+                        password: &req.password,
+                    },
+                    true,
+                )
+                .gender(req.gender),
+            )
+            .await
+        {
+            Ok(res) => res,
+            Err(_) => return Err(poem::Error::from_status(StatusCode::FORBIDDEN)),
+        };
+
+        // update user.is_admin
+        Ok(Json(user.api_user_info(uid)))
+    }
+
+    /// Returns `true` means that the server has been initialized
+    #[oai(path = "/initialized", method = "get")]
+    async fn initialized(&self, state: Data<&State>) -> Json<bool> {
+        let cache = state.cache.read().await;
+        Json(!cache.users.is_empty())
+    }
+
+    /// Get the system metrics
+    #[oai(path = "/metrics", method = "get")]
+    async fn get_metrics(&self, state: Data<&State>, token: Token) -> Result<Json<Metrics>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let cache = state.cache.read().await;
+        Ok(Json(Metrics {
+            user_count: cache.users.iter().filter(|user| !user.1.is_guest).count(),
+            group_count: cache.groups.len(),
+            online_user_count: cache
+                .users
+                .values()
+                .filter(|user| !user.is_guest && user.is_online())
+                .count(),
+            version: env!("CARGO_PKG_VERSION").to_string(),
+        }))
+    }
+
+    /// Get the organization info
+    #[oai(path = "/organization", method = "get")]
+    async fn get_organization(&self, state: Data<&State>) -> Result<Json<OrganizationConfig>> {
+        let entry = state.load_dynamic_config::<OrganizationConfig>().await?;
+        Ok(Json(entry.config))
+    }
+
+    /// Set the organization info
+    #[oai(path = "/organization", method = "post")]
+    async fn set_organization(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<OrganizationConfig>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: req.0,
+            })
+            .await?;
+        Ok(())
+    }
+
+    /// Upload the organization logo
+    #[oai(path = "/organization/logo", method = "post")]
+    async fn upload_organization_logo(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        logo: UploadLogoRequest,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let UploadLogoRequest::Image(data) = logo;
+        let logo = image::load_from_memory(&data).map_err(InternalServerError)?;
+        let logo = logo.thumbnail(240, 240);
+        let path = state.config.system.data_dir.join("organization.png");
+        logo.save_with_format(path, ImageFormat::Png)
+            .map_err(InternalServerError)?;
+        Ok(())
+    }
+
+    /// Send email(only for test)
+    #[oai(path = "/send_mail", method = "post")]
+    async fn send_mail(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<SendMailRequest>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let smtp_config = state
+            .get_dynamic_config_instance::<SmtpConfig>()
+            .await
+            .ok_or_else(|| Error::from_status(StatusCode::SERVICE_UNAVAILABLE))?;
+        Ok(send_mail(&smtp_config, &req.to, &req.subject, &req.content).await?)
+    }
+
+    /// Get the secret for third-party authentication
+    #[oai(path = "/third_party_secret", method = "get")]
+    async fn third_party_secret(
+        &self,
+        state: Data<&State>,
+        token: Token,
+    ) -> Result<PlainText<String>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        let key_config = state.key_config.read().await;
+        Ok(PlainText(key_config.third_party_secret.clone()))
+    }
+
+    /// Update third-party secret
+    #[oai(path = "/third_party_secret", method = "post")]
+    async fn update_third_party_secret(
+        &self,
+        state: Data<&State>,
+        token: Token,
+    ) -> Result<PlainText<String>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let mut key_config = state.key_config.write().await;
+        let new_third_party_secret = create_random_str(32);
+        key_config.third_party_secret = new_third_party_secret.clone();
+
+        let key_config_path = state.config.system.data_dir.join("key.json");
+        std::fs::write(
+            key_config_path,
+            serde_json::to_vec(&*key_config).map_err(InternalServerError)?,
+        )
+        .map_err(InternalServerError)?;
+
+        Ok(PlainText(new_third_party_secret))
+    }
+
+    /// Get the frontend url
+    #[oai(path = "/frontend_url", method = "get")]
+    async fn get_frontend_url(
+        &self,
+        state: Data<&State>,
+        token: Token,
+    ) -> Result<PlainText<String>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        Ok(PlainText(
+            state
+                .get_dynamic_config_instance::<FrontendUrlConfig>()
+                .await
+                .and_then(|config| config.url.clone())
+                .unwrap_or_default(),
+        ))
+    }
+
+    /// Update the frontend url
+    #[oai(path = "/update_frontend_url", method = "post")]
+    async fn update_frontend_url(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        frontend_url: PlainText<String>,
+    ) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let frontend_url = frontend_url.0.trim_end_matches('/');
+        let re = regex::Regex::new(r#"^https?://[\w\-\.]+(:\d+)?$"#).unwrap();
+        if !re.is_match(frontend_url) {
+            return Err(Error::from_string(
+                "Bad url format!",
+                StatusCode::BAD_REQUEST,
+            ));
+        }
+
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: FrontendUrlConfig {
+                    url: Some(frontend_url.to_string()),
+                },
+            })
+            .await?;
+        Ok(())
+    }
+}
+
+#[test]
+fn test_frontend_url() {
+    let re = regex::Regex::new(r#"^https?://[\w\-\.]+(:\d+)?$"#).unwrap();
+    assert!(re.is_match("http://1.2.3.4:4000"));
+    assert!(re.is_match("http://domain.com"));
+    assert!(re.is_match("http://domain.com:3000"));
+    assert!(re.is_match("https://domain.com:3000"));
+    assert!(re.is_match("http://127.0.0.1"));
+    assert!(re.is_match("http://127.0.0.1:3000"));
+    assert!(re.is_match("https://127.0.0.1:3000"));
+    assert!(!re.is_match("ftp://127.0.0.1:3000"));
+}
+
+#[test]
+fn test_replace_config() {
+    let a = r#"frontend_url = "http://a.com/""#;
+    let re = regex::Regex::new(r#"frontend_url\s*=\s*".*?""#).unwrap();
+    let b = re.replace(a, format!(r#"frontend_url = "{}""#, "http://b.com/"));
+    assert_eq!(b, r#"frontend_url = "http://b.com/""#);
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use crate::test_harness::TestServer;
+
+    #[tokio::test]
+    async fn set_organization() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let resp = server.get("/api/admin/system/organization").send().await;
+        resp.assert_status_is_ok();
+        resp.assert_json(&json!({
+            "name": "unknown",
+            "description": null,
+        }))
+        .await;
+
+        server
+            .post("/api/admin/system/organization")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "abc",
+                "description": "def"
+            }))
+            .send()
+            .await
+            .assert_status_is_ok();
+
+        let resp = server.get("/api/admin/system/organization").send().await;
+        resp.assert_status_is_ok();
+        resp.assert_json(&json!({
+            "name": "abc",
+            "description": "def",
+        }))
+        .await;
+    }
+
+    #[tokio::test]
+    async fn test_update_frontend_url() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let resp = server
+            .post("/api/admin/system/update_frontend_url")
+            .header("X-API-Key", &admin_token)
+            .content_type("text/plain")
+            .body("http://1.2.3.4:4000")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+}
diff --git a/src/api/admin_user.rs b/src/api/admin_user.rs
new file mode 100644
index 0000000..5744a8b
--- /dev/null
+++ b/src/api/admin_user.rs
@@ -0,0 +1,837 @@
+use std::sync::Arc;
+
+use itertools::Itertools;
+use poem::{
+    error::{InternalServerError, ReadBodyError},
+    http::StatusCode,
+    web::Data,
+    Error, Result,
+};
+use poem_openapi::{param::Path, payload::Json, types::Email, ApiResponse, Object, OpenApi};
+
+use crate::{
+    api::{
+        tags::ApiTags,
+        token::Token,
+        user::{UploadAvatarApiResponse, UploadAvatarRequest},
+        CreateUserConflictReason, CreateUserResponse, DateTime, KickReason, LangId, UpdateAction,
+        UpdateUserResponse, UserConflict, UserUpdateLog,
+    },
+    api_key::create_api_key,
+    create_user::{CreateUser, CreateUserBy, CreateUserError},
+    state::{BotKey, BroadcastEvent, UserEvent, UserStatus},
+    State,
+};
+
+pub struct ApiAdminUser;
+
+/// User device
+#[derive(Debug, Object)]
+pub struct UserDevice {
+    pub device: String,
+    pub device_token: Option<String>,
+    pub is_online: bool,
+}
+
+/// Create user request
+#[derive(Debug, Object)]
+pub struct CreateUserRequest {
+    pub email: Email,
+    pub password: String,
+    #[oai(validator(max_length = 32))]
+    pub name: String,
+    pub gender: i32,
+    pub is_admin: bool,
+    #[oai(default)]
+    pub language: LangId,
+    pub webhook_url: Option<String>,
+    #[oai(default)]
+    pub is_bot: bool,
+}
+
+/// User info for admin
+#[derive(Debug, Object)]
+pub struct User {
+    /// User id
+    pub uid: i64,
+    pub email: Option<String>,
+    pub password: String,
+    pub name: String,
+    pub gender: i32,
+    pub is_admin: bool,
+    pub language: LangId,
+    pub create_by: String,
+    pub in_online: bool,
+    pub online_devices: Vec<UserDevice>,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+    pub avatar_updated_at: DateTime,
+    pub status: UserStatus,
+    pub webhook_url: Option<String>,
+    pub is_bot: bool,
+}
+
+/// Update user request
+#[derive(Debug, Object)]
+pub struct UpdateUserRequest {
+    email: Option<String>,
+    password: Option<String>,
+    #[oai(validator(max_length = 32))]
+    name: Option<String>,
+    gender: Option<i32>,
+    is_admin: Option<bool>,
+    language: Option<LangId>,
+    status: Option<UserStatus>,
+    webhook_url: Option<String>,
+}
+
+impl UpdateUserRequest {
+    fn is_empty(&self) -> bool {
+        self.email.is_none()
+            && self.password.is_none()
+            && self.name.is_none()
+            && self.gender.is_none()
+            && self.is_admin.is_none()
+            && self.language.is_none()
+            && self.status.is_none()
+            && self.webhook_url.is_none()
+    }
+}
+
+/// Create bot api key request
+#[derive(Debug, Object)]
+pub struct CreateBotApiKeyRequest {
+    name: String,
+}
+
+/// Create bot api key response
+#[derive(Debug, ApiResponse)]
+pub enum CreateBotApiKeyResponse {
+    #[oai(status = 200)]
+    Ok(Json<String>),
+    /// Key name conflict
+    #[oai(status = 409)]
+    ConflictName,
+}
+
+/// Delete bot api key request
+#[derive(Debug, Object)]
+pub struct DeleteBotApiKeyRequest {
+    uid: i64,
+}
+
+/// Delete bot api key response
+#[derive(Debug, ApiResponse)]
+pub enum DeleteBotApiKeyResponse {
+    #[oai(status = 200)]
+    Ok,
+    /// Key not found
+    #[oai(status = 404)]
+    KeyNotFound,
+}
+
+#[derive(Debug, Object)]
+#[oai(rename = "BotKey")]
+pub struct BotKeyInfo {
+    pub id: i64,
+    pub name: String,
+    pub key: String,
+    pub created_at: DateTime,
+    pub last_used: Option<DateTime>,
+}
+
+#[OpenApi(prefix_path = "/admin/user", tag = "ApiTags::AdminUser")]
+impl ApiAdminUser {
+    /// Create a user
+    #[oai(path = "/", method = "post")]
+    async fn create(
+        &self,
+        state: Data<&State>,
+        mut req: Json<CreateUserRequest>,
+        token: Token,
+    ) -> Result<CreateUserResponse> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        req.email.0 = req.email.0.to_lowercase();
+        let mut create_user = CreateUser::new(
+            &req.name,
+            CreateUserBy::Password {
+                email: &req.email,
+                password: &req.password,
+            },
+            false,
+        )
+        .gender(req.gender)
+        .set_admin(req.is_admin)
+        .language(&req.language)
+        .set_bot(req.is_bot);
+
+        if let Some(webhook_url) = &req.0.webhook_url {
+            // check the webhook url
+            if !matches!(
+                reqwest::get(webhook_url).await.map(|resp| resp.status()),
+                Ok(StatusCode::OK)
+            ) {
+                return Ok(CreateUserResponse::InvalidWebhookUrl);
+            }
+
+            create_user = create_user.webhook_url(webhook_url);
+        }
+        let res = state.create_user(create_user).await;
+
+        match res {
+            Ok((uid, user)) => Ok(CreateUserResponse::Ok(Json(user.api_user(uid)))),
+            Err(CreateUserError::NameConflict) => {
+                Ok(CreateUserResponse::Conflict(Json(UserConflict {
+                    reason: CreateUserConflictReason::NameConflict,
+                })))
+            }
+            Err(CreateUserError::EmailConflict) => {
+                Ok(CreateUserResponse::Conflict(Json(UserConflict {
+                    reason: CreateUserConflictReason::EmailConflict,
+                })))
+            }
+            Err(CreateUserError::PoemError(err)) => Err(err),
+        }
+    }
+
+    /// Get the user by id
+    #[oai(path = "/:uid", method = "get")]
+    async fn get(&self, state: Data<&State>, token: Token, uid: Path<i64>) -> Result<Json<User>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let cache = state.cache.read().await;
+        let user = cache
+            .users
+            .get(&uid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+        Ok(Json(user.api_user(uid.0)))
+    }
+
+    /// Get all users
+    #[oai(path = "/", method = "get")]
+    async fn get_all(&self, state: Data<&State>, token: Token) -> Result<Json<Vec<User>>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let cache = state.cache.read().await;
+        let users = cache
+            .users
+            .iter()
+            .filter(|(_, user)| !user.is_guest)
+            .map(|(uid, user)| user.api_user(*uid))
+            .collect();
+        Ok(Json(users))
+    }
+
+    /// Delete the user by id
+    #[oai(path = "/:uid", method = "delete")]
+    async fn delete(&self, state: Data<&State>, token: Token, uid: Path<i64>) -> Result<()> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        if uid.0 == token.uid || uid.0 == 1 {
+            // cannot delete self and founder
+            return Err(poem::Error::from(StatusCode::FORBIDDEN));
+        }
+
+        state.delete_user(uid.0).await?;
+        Ok(())
+    }
+
+    /// Update user by id
+    #[oai(path = "/:uid", method = "put")]
+    async fn update(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        uid: Path<i64>,
+        req: Json<UpdateUserRequest>,
+    ) -> Result<UpdateUserResponse<User>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        if req.is_empty() {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        let mut cache = state.cache.write().await;
+
+        if let Some(email) = &req.email {
+            if !cache.check_email_conflict(email) {
+                return Ok(UpdateUserResponse::Conflict(Json(UserConflict {
+                    reason: CreateUserConflictReason::EmailConflict,
+                })));
+            }
+        }
+
+        if let Some(name) = &req.name {
+            if !cache.check_name_conflict(name) {
+                return Ok(UpdateUserResponse::Conflict(Json(UserConflict {
+                    reason: CreateUserConflictReason::NameConflict,
+                })));
+            }
+        }
+
+        // check webhook url
+        if let Some(webhook_url) = &req.webhook_url {
+            // check the webhook url
+            if !matches!(
+                reqwest::get(webhook_url).await.map(|resp| resp.status()),
+                Ok(StatusCode::OK)
+            ) {
+                return Ok(UpdateUserResponse::InvalidWebhookUrl);
+            }
+        }
+
+        let now = DateTime::now();
+        let cached_user = cache
+            .users
+            .get_mut(&uid.0)
+            .ok_or_else(|| Error::from(StatusCode::NOT_FOUND))?;
+
+        // begin transaction
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        // update user table
+        let sql = format!(
+            "update user set {} where uid = ?",
+            req.password
+                .iter()
+                .map(|_| "password = ?")
+                .chain(req.email.iter().map(|_| "email = ?"))
+                .chain(req.name.iter().map(|_| "name = ?"))
+                .chain(req.gender.iter().map(|_| "gender = ?"))
+                .chain(req.language.iter().map(|_| "language = ?"))
+                .chain(req.is_admin.iter().map(|_| "is_admin = ?"))
+                .chain(req.status.iter().map(|_| "status = ?"))
+                .chain(req.webhook_url.iter().map(|_| "webhook_url = ?"))
+                .chain(Some("updated_at = ?"))
+                .join(", ")
+        );
+
+        let mut query = sqlx::query(&sql);
+        if let Some(password) = &req.password {
+            query = query.bind(password);
+        }
+        if let Some(email) = &req.email {
+            query = query.bind(email);
+        }
+        if let Some(name) = &req.name {
+            query = query.bind(name);
+        }
+        if let Some(gender) = &req.gender {
+            query = query.bind(gender);
+        }
+        if let Some(language) = &req.language {
+            query = query.bind(language);
+        }
+        if let Some(is_admin) = &req.is_admin {
+            query = query.bind(is_admin);
+        }
+        if let Some(status) = &req.status {
+            query = query.bind(i8::from(*status));
+        }
+        if let Some(webhook_url) = &req.webhook_url {
+            query = query.bind(webhook_url);
+        }
+
+        query
+            .bind(now)
+            .bind(uid.0)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?;
+
+        // insert into user_log table
+        let sql = "insert into user_log (uid, action, email, name, gender, is_admin, language) values (?, ?, ?, ?, ?, ?, ?)";
+        let log_id = sqlx::query(sql)
+            .bind(uid.0)
+            .bind(UpdateAction::Update)
+            .bind(&req.email)
+            .bind(&req.name)
+            .bind(req.gender)
+            .bind(req.is_admin)
+            .bind(&req.language)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?
+            .last_insert_rowid();
+
+        // commit transaction
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        if let Some(email) = &req.0.email {
+            cached_user.email = Some(email.clone());
+        }
+        if let Some(name) = &req.0.name {
+            cached_user.name = name.clone();
+        }
+        if let Some(password) = &req.0.password {
+            cached_user.password = Some(password.clone());
+        }
+        if let Some(gender) = req.0.gender {
+            cached_user.gender = gender;
+        }
+        if let Some(language) = &req.0.language {
+            cached_user.language = language.clone();
+        }
+        if let Some(is_admin) = req.0.is_admin {
+            cached_user.is_admin = is_admin;
+        }
+        if let Some(status) = &req.0.status {
+            cached_user.status = *status;
+        }
+        if let Some(webhook_url) = req.0.webhook_url {
+            cached_user.webhook_url = Some(webhook_url);
+        }
+
+        if let Some(UserStatus::Frozen) = req.0.status {
+            // close all subscriptions
+            for device in cached_user.devices.values_mut() {
+                if let Some(sender) = device.sender.take() {
+                    let _ = sender.send(UserEvent::Kick {
+                        reason: KickReason::Frozen,
+                    });
+                }
+            }
+        }
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserLog(UserUpdateLog {
+                log_id,
+                action: UpdateAction::Update,
+                uid: uid.0,
+                email: req.0.email,
+                name: req.0.name,
+                gender: req.0.gender,
+                language: req.0.language,
+                is_admin: req.0.is_admin,
+                is_bot: None,
+                avatar_updated_at: None,
+            })));
+
+        Ok(UpdateUserResponse::Ok(Json(cached_user.api_user(uid.0))))
+    }
+
+    /// Upload avatar
+    #[oai(path = "/:uid/avatar", method = "post")]
+    async fn upload_avatar(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        uid: Path<i64>,
+        req: UploadAvatarRequest,
+    ) -> Result<UploadAvatarApiResponse> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let mut cache = state.cache.write().await;
+        let now = DateTime::now();
+        let cached_user = cache
+            .users
+            .get_mut(&uid)
+            .ok_or_else(|| Error::from(StatusCode::UNAUTHORIZED))?;
+
+        let UploadAvatarRequest::Image(data) = req;
+        let data = match data
+            .0
+            .into_bytes_limit(state.config.system.upload_avatar_limit)
+            .await
+        {
+            Ok(data) => data,
+            Err(ReadBodyError::PayloadTooLarge) => {
+                return Ok(UploadAvatarApiResponse::PayloadTooLarge);
+            }
+            Err(err) => return Err(err.into()),
+        };
+
+        // write to file
+        state.save_avatar(uid.0, &data)?;
+
+        // update sqlite
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        sqlx::query("update user set avatar_updated_at = ? where uid = ?")
+            .bind(now)
+            .bind(uid.0)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?;
+
+        let log_id =
+            sqlx::query("insert into user_log (uid, action, avatar_updated_at) values (?, ?, ?)")
+                .bind(uid.0)
+                .bind(UpdateAction::Update)
+                .bind(now)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?
+                .last_insert_rowid();
+
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        cached_user.avatar_updated_at = now;
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserLog(UserUpdateLog {
+                log_id,
+                action: UpdateAction::Update,
+                uid: uid.0,
+                email: None,
+                name: None,
+                gender: None,
+                language: None,
+                is_admin: None,
+                is_bot: None,
+                avatar_updated_at: Some(now),
+            })));
+
+        Ok(UploadAvatarApiResponse::Ok)
+    }
+
+    /// Create a bot api-key
+    #[oai(path = "/bot-api-key/:uid", method = "post")]
+    async fn create_bot_api_key(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        uid: Path<i64>,
+        req: Json<CreateBotApiKeyRequest>,
+    ) -> Result<CreateBotApiKeyResponse> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let mut cache = state.cache.write().await;
+        let user = cache
+            .users
+            .get_mut(&uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+
+        if user
+            .bot_keys
+            .values()
+            .any(|bot_key| bot_key.name == req.name)
+        {
+            return Ok(CreateBotApiKeyResponse::ConflictName);
+        }
+
+        let api_key = create_api_key(uid.0, &state.0.key_config.read().await.server_key);
+
+        // update sqlite
+        let now = DateTime::now();
+        let key_id =
+            sqlx::query("insert into `bot_key` (uid, name, key, created_at) values (?, ?, ?, ?)")
+                .bind(uid.0)
+                .bind(&req.name)
+                .bind(&api_key)
+                .bind(now)
+                .execute(&state.db_pool)
+                .await
+                .map_err(InternalServerError)?
+                .last_insert_rowid();
+
+        // update cache
+        user.bot_keys.insert(
+            key_id,
+            BotKey {
+                name: req.0.name,
+                key: api_key.clone(),
+                created_at: now,
+                last_used: None,
+            },
+        );
+
+        Ok(CreateBotApiKeyResponse::Ok(Json(api_key)))
+    }
+
+    /// Delete a bot api-key
+    #[oai(path = "/bot-api-key/:uid/:kid", method = "delete")]
+    async fn delete_bot_api_key(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        uid: Path<i64>,
+        kid: Path<i64>,
+    ) -> Result<DeleteBotApiKeyResponse> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let mut cache = state.cache.write().await;
+        let user = cache
+            .users
+            .get_mut(&uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+
+        if !user.bot_keys.contains_key(&kid) {
+            return Ok(DeleteBotApiKeyResponse::KeyNotFound);
+        }
+
+        // update sqlite
+        sqlx::query("delete from `bot_key` where id = ?")
+            .bind(kid.0)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        // update cache
+        user.bot_keys.remove(&kid);
+        Ok(DeleteBotApiKeyResponse::Ok)
+    }
+
+    /// List bot api-key
+    #[oai(path = "/bot-api-key/:uid", method = "get")]
+    async fn list_bot_api_key(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        uid: Path<i64>,
+    ) -> Result<Json<Vec<BotKeyInfo>>> {
+        if !token.is_admin {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let cache = state.cache.read().await;
+        let user = cache
+            .users
+            .get(&uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+
+        Ok(Json(
+            user.bot_keys
+                .iter()
+                .map(|(kid, bot_key)| BotKeyInfo {
+                    id: *kid,
+                    name: bot_key.name.clone(),
+                    key: bot_key.key.clone(),
+                    created_at: bot_key.created_at,
+                    last_used: bot_key.last_used,
+                })
+                .collect(),
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use poem::http::StatusCode;
+    use serde_json::{json, Value};
+
+    use crate::test_harness::TestServer;
+
+    #[tokio::test]
+    async fn test_create_user() {
+        let server = TestServer::new().await;
+
+        let admin_token = server.login_admin().await;
+        let uid = server.create_user(&admin_token, "test1@voce.chat").await;
+        let token = server.login("test1@voce.chat").await;
+        let current_user = server.parse_token(token).await;
+        assert_eq!(uid, current_user.uid);
+    }
+
+    #[tokio::test]
+    async fn test_create_name_conflict() {
+        let server = TestServer::new().await;
+
+        let admin_token = server.login_admin().await;
+        let resp = server
+            .post("/api/admin/user")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "email": "user1@voce.chat",
+                "password": "123456",
+                "name": "admin",
+                "gender": 1,
+                "language": "en-US",
+                "is_admin": false,
+            }))
+            .send()
+            .await;
+        resp.assert_status(StatusCode::CONFLICT);
+        resp.assert_json(json!({
+            "reason": "name_conflict"
+        }))
+        .await;
+    }
+
+    #[tokio::test]
+    async fn test_create_email_conflict() {
+        let server = TestServer::new().await;
+
+        let admin_token = server.login_admin().await;
+        let resp = server
+            .post("/api/admin/user")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "email": "admin@voce.chat",
+                "password": "123456",
+                "name": "test1",
+                "gender": 1,
+                "language": "en-US",
+                "is_admin": false,
+            }))
+            .send()
+            .await;
+        resp.assert_status(StatusCode::CONFLICT);
+        resp.assert_json(json!({
+            "reason": "email_conflict"
+        }))
+        .await;
+    }
+
+    #[tokio::test]
+    async fn test_delete_user() {
+        let server = TestServer::new().await;
+
+        let admin_token = server.login_admin().await;
+        let uid = server.create_user(&admin_token, "test1@voce.chat").await;
+
+        let resp = server
+            .delete(format!("/api/admin/user/{}", uid))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        server
+            .get(format!("/api/admin/user/{}", uid))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await
+            .assert_status(StatusCode::NOT_FOUND);
+    }
+
+    #[tokio::test]
+    async fn test_update_user_info() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "test1@voce.chat").await;
+
+        let resp = server
+            .put(format!("/api/admin/user/{}", uid1))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({ "email": "test2@voce.chat", "name": "test1", "gender": 2 }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let resp = server
+            .get(format!("/api/admin/user/{}", uid1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        json.value()
+            .object()
+            .get("email")
+            .assert_string("test2@voce.chat");
+        json.value().object().get("name").assert_string("test1");
+        json.value().object().get("gender").assert_i64(2);
+    }
+
+    #[tokio::test]
+    async fn test_update_user_password() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "test1@voce.chat").await;
+
+        fn make_login_body(password: &str) -> Value {
+            json!({
+                "credential": {
+                    "type": "password",
+                    "email": "test1@voce.chat",
+                    "password": password,
+                },
+                "device": "iphone",
+                "device_token": "test",
+            })
+        }
+
+        server
+            .post("/api/token/login")
+            .body_json(&make_login_body("123456"))
+            .send()
+            .await
+            .assert_status_is_ok();
+
+        let resp = server
+            .put(format!("/api/admin/user/{}", uid1))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({ "password": "654321" }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        server
+            .post("/api/token/login")
+            .body_json(&make_login_body("123456"))
+            .send()
+            .await
+            .assert_status(StatusCode::UNAUTHORIZED);
+
+        server
+            .post("/api/token/login")
+            .body_json(&make_login_body("654321"))
+            .send()
+            .await
+            .assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn test_delete_user_then_delete_owned_private_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "test1@voce.chat").await;
+        let token1 = server.login("test1@voce.chat").await;
+        let mut gid_list = Vec::new();
+
+        for _ in 0..10 {
+            // create group
+            let resp = server
+                .post("/api/group")
+                .header("X-API-Key", &token1)
+                .body_json(&json!({
+                    "name": "test",
+                }))
+                .send()
+                .await;
+            resp.assert_status_is_ok();
+            gid_list.push(resp.json().await.value().object().get("gid").i64());
+        }
+
+        server
+            .delete(format!("/api/admin/user/{}", uid1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await
+            .assert_status_is_ok();
+
+        for gid in gid_list {
+            // check group
+            let resp = server
+                .get(format!("/api/group/{}", gid))
+                .header("X-API-Key", &token1)
+                .send()
+                .await;
+            resp.assert_status(StatusCode::NOT_FOUND)
+        }
+    }
+}
diff --git a/src/api/archive.rs b/src/api/archive.rs
new file mode 100644
index 0000000..fec9fcc
--- /dev/null
+++ b/src/api/archive.rs
@@ -0,0 +1,343 @@
+use std::{
+    collections::HashMap,
+    fs::File,
+    io::{Read, Write},
+    path::PathBuf,
+};
+
+use poem::error::{InternalServerError, NotFound};
+use poem_openapi::Object;
+use reqwest::StatusCode;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use crate::{
+    api::{
+        get_merged_message, message::MergedMessagePayload, DateTime, FileMeta, MessageTarget,
+        MessageTargetGroup, MessageTargetUser,
+    },
+    state::State,
+};
+
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct Archive {
+    pub users: Vec<ArchiveUser>,
+    pub messages: Vec<ArchiveMessage>,
+    pub num_attachments: usize,
+}
+
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct ArchiveUser {
+    pub name: String,
+    pub avatar: Option<usize>,
+}
+
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct ArchiveMessage {
+    pub from_user: usize,
+    pub created_at: DateTime,
+    pub mid: i64,
+    pub source: MessageTarget,
+    #[oai(flatten)]
+    pub content: ArchiveMessageContent,
+}
+
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct ArchiveMessageContent {
+    pub properties: Option<HashMap<String, Value>>,
+    pub content_type: String,
+    pub content: Option<String>,
+    pub file_id: Option<usize>,
+    pub thumbnail_id: Option<usize>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ArchiveFile {
+    pub content_type: String,
+    pub filename: Option<String>,
+    #[serde(skip)]
+    pub content: Vec<u8>,
+}
+
+async fn internal_create_message_archive(
+    state: &State,
+    mut mid_list: Vec<i64>,
+    create_by_uid: i64,
+) -> poem::Result<(Archive, Vec<ArchiveFile>)> {
+    let cache = state.cache.read().await;
+    let is_admin = cache
+        .users
+        .get(&create_by_uid)
+        .ok_or_else(|| poem::Error::from_status(StatusCode::BAD_REQUEST))?
+        .is_admin;
+
+    let mut archive = Archive {
+        users: Vec::new(),
+        messages: Vec::new(),
+        num_attachments: 0,
+    };
+    let mut files = Vec::new();
+    let mut users_map: HashMap<i64, usize> = Default::default();
+
+    mid_list.sort_unstable();
+
+    for mid in mid_list {
+        let merged_payload = get_merged_message(&state.msg_db, mid)?
+            .ok_or_else(|| poem::Error::from_status(StatusCode::NOT_FOUND))?;
+
+        if !is_admin {
+            let allow = match merged_payload.target {
+                MessageTarget::User(MessageTargetUser { uid })
+                    if uid == create_by_uid || merged_payload.from_uid == create_by_uid =>
+                {
+                    true
+                }
+                MessageTarget::Group(MessageTargetGroup { gid }) => cache
+                    .groups
+                    .get(&gid)
+                    .map(|group| group.contains_user(create_by_uid))
+                    .unwrap_or_default(),
+                _ => false,
+            };
+
+            if !allow {
+                return Err(poem::Error::from_status(StatusCode::FORBIDDEN));
+            }
+        }
+
+        let from_user = cache
+            .users
+            .get(&merged_payload.from_uid)
+            .ok_or_else(|| poem::Error::from_status(StatusCode::BAD_REQUEST))?;
+
+        let user_idx = match users_map.get(&merged_payload.from_uid) {
+            Some(idx) => *idx,
+            None => {
+                let avatar_path = state
+                    .config
+                    .system
+                    .avatar_dir()
+                    .join(format!("{}.png", merged_payload.from_uid));
+                let avatar_data = tokio::fs::read(avatar_path).await.ok();
+                let avatar = avatar_data.map(|avatar_data| {
+                    files.push(ArchiveFile {
+                        content_type: "image/png".to_string(),
+                        filename: None,
+                        content: avatar_data,
+                    });
+                    files.len() - 1
+                });
+
+                archive.users.push(ArchiveUser {
+                    name: from_user.name.clone(),
+                    avatar,
+                });
+                users_map.insert(merged_payload.from_uid, archive.users.len() - 1);
+                archive.users.len() - 1
+            }
+        };
+
+        match merged_payload.content.content_type.as_str() {
+            "text/plain" | "text/markdown" => {
+                archive.messages.push(ArchiveMessage {
+                    from_user: user_idx,
+                    created_at: merged_payload.created_at,
+                    mid,
+                    source: get_source(create_by_uid, &merged_payload),
+                    content: ArchiveMessageContent {
+                        properties: merged_payload.content.properties.clone(),
+                        content_type: merged_payload.content.content_type.clone(),
+                        content: Some(merged_payload.content.content.clone()),
+                        file_id: None,
+                        thumbnail_id: None,
+                    },
+                });
+            }
+            "vocechat/file" => {
+                let file_path = state
+                    .config
+                    .system
+                    .file_dir()
+                    .join(&merged_payload.content.content);
+                let file_data = tokio::fs::read(&file_path).await.unwrap_or_default();
+
+                let thumbnail_path = state
+                    .config
+                    .system
+                    .thumbnail_dir()
+                    .join(&merged_payload.content.content);
+                let thumbnail_data = tokio::fs::read(&thumbnail_path).await.ok();
+
+                let meta = tokio::fs::read(file_path.with_extension("meta"))
+                    .await
+                    .ok()
+                    .and_then(|data| serde_json::from_slice::<FileMeta>(&data).ok())
+                    .unwrap_or_else(|| FileMeta {
+                        content_type: "application/octet-stream".to_string(),
+                        filename: None,
+                    });
+
+                files.push(ArchiveFile {
+                    content_type: meta.content_type.clone(),
+                    filename: meta.filename.clone(),
+                    content: file_data,
+                });
+                let file_idx = files.len() - 1;
+
+                let thumbnail_id = if let Some(thumbnail_data) = thumbnail_data {
+                    files.push(ArchiveFile {
+                        content_type: meta.content_type,
+                        filename: meta.filename,
+                        content: thumbnail_data,
+                    });
+                    Some(files.len() - 1)
+                } else {
+                    None
+                };
+
+                archive.messages.push(ArchiveMessage {
+                    from_user: user_idx,
+                    created_at: merged_payload.created_at,
+                    mid,
+                    source: get_source(create_by_uid, &merged_payload),
+                    content: ArchiveMessageContent {
+                        properties: merged_payload.content.properties.clone(),
+                        content_type: merged_payload.content.content_type.clone(),
+                        content: None,
+                        file_id: Some(file_idx),
+                        thumbnail_id,
+                    },
+                });
+            }
+            _ => return Err(poem::Error::from_status(StatusCode::BAD_REQUEST)),
+        }
+    }
+
+    archive.num_attachments = files.len();
+    Ok((archive, files))
+}
+
+fn get_source(create_by_uid: i64, merged_payload: &MergedMessagePayload) -> MessageTarget {
+    match merged_payload.target {
+        MessageTarget::User(MessageTargetUser { uid }) => {
+            if uid == create_by_uid {
+                MessageTarget::User(MessageTargetUser {
+                    uid: merged_payload.from_uid,
+                })
+            } else {
+                MessageTarget::User(MessageTargetUser { uid })
+            }
+        }
+        group @ MessageTarget::Group(MessageTargetGroup { .. }) => group,
+    }
+}
+
+pub async fn create_message_archive(
+    state: &State,
+    mid_list: Vec<i64>,
+    create_by_uid: i64,
+) -> poem::Result<Vec<u8>> {
+    let (archive, files) = internal_create_message_archive(state, mid_list, create_by_uid).await?;
+
+    tokio::task::spawn_blocking(move || {
+        let mut buf = Vec::new();
+
+        let mut zip_writer = zip::ZipWriter::new(std::io::Cursor::new(&mut buf));
+
+        let options =
+            zip::write::FileOptions::default().compression_method(zip::CompressionMethod::Stored);
+
+        zip_writer
+            .start_file("index.json", options)
+            .map_err(InternalServerError)?;
+        let index_data = serde_json::to_vec(&archive).map_err(InternalServerError)?;
+        zip_writer.write(&index_data).map_err(InternalServerError)?;
+
+        for (idx, file) in files.into_iter().enumerate() {
+            zip_writer
+                .start_file(format!("attachment/{}.data", idx), options)
+                .map_err(InternalServerError)?;
+            zip_writer
+                .write_all(&file.content)
+                .map_err(InternalServerError)?;
+
+            let meta_data = serde_json::to_vec(&file).map_err(InternalServerError)?;
+            zip_writer
+                .start_file(format!("attachment/{}.meta", idx), options)
+                .map_err(InternalServerError)?;
+            zip_writer
+                .write_all(&meta_data)
+                .map_err(InternalServerError)?;
+        }
+
+        zip_writer.finish().map_err(InternalServerError)?;
+        drop(zip_writer);
+
+        Ok(buf)
+    })
+    .await
+    .map_err(InternalServerError)?
+}
+
+pub async fn extract_archive(path: impl Into<PathBuf>) -> poem::Result<Archive> {
+    let path = path.into();
+
+    tokio::task::spawn_blocking(move || {
+        let file = File::open(path).map_err(NotFound)?;
+        let mut zip_archive = zip::ZipArchive::new(file).map_err(InternalServerError)?;
+        let mut index_file = zip_archive
+            .by_name("index.json")
+            .map_err(InternalServerError)?;
+        let mut data = Vec::new();
+        index_file
+            .read_to_end(&mut data)
+            .map_err(InternalServerError)?;
+
+        serde_json::from_slice(&data).map_err(InternalServerError)
+    })
+    .await
+    .map_err(InternalServerError)?
+}
+
+pub async fn extract_archive_attachment(
+    path: impl Into<PathBuf>,
+    file_idx: usize,
+) -> poem::Result<ArchiveFile> {
+    let path = path.into();
+
+    tokio::task::spawn_blocking(move || {
+        if !path.exists() {
+            return Err(StatusCode::NOT_FOUND.into());
+        }
+
+        let file = File::open(path).map_err(NotFound)?;
+        let mut zip_archive = zip::ZipArchive::new(file).map_err(InternalServerError)?;
+
+        let mut archive_file = {
+            let mut index_file = zip_archive
+                .by_name(&format!("attachment/{}.meta", file_idx))
+                .map_err(InternalServerError)?;
+            let mut data = Vec::new();
+            index_file
+                .read_to_end(&mut data)
+                .map_err(InternalServerError)?;
+
+            serde_json::from_slice::<ArchiveFile>(&data).map_err(InternalServerError)?
+        };
+
+        archive_file.content = {
+            let mut index_file = zip_archive
+                .by_name(&format!("attachment/{}.data", file_idx))
+                .map_err(InternalServerError)?;
+            let mut data = Vec::new();
+            index_file
+                .read_to_end(&mut data)
+                .map_err(InternalServerError)?;
+            data
+        };
+
+        Ok(archive_file)
+    })
+    .await
+    .map_err(InternalServerError)?
+}
diff --git a/src/api/assets/organization-logo.png b/src/api/assets/organization-logo.png
new file mode 100644
index 0000000..4d68bbd
Binary files /dev/null and b/src/api/assets/organization-logo.png differ
diff --git a/src/api/assets/poem.png b/src/api/assets/poem.png
new file mode 100644
index 0000000..bd59131
Binary files /dev/null and b/src/api/assets/poem.png differ
diff --git a/src/api/bot.rs b/src/api/bot.rs
new file mode 100644
index 0000000..cceb0f1
--- /dev/null
+++ b/src/api/bot.rs
@@ -0,0 +1,351 @@
+use std::str::FromStr;
+
+use chrono::Datelike;
+use futures_util::TryFutureExt;
+use mime_guess::{mime, Mime};
+use poem::{
+    error::{BadRequest, InternalServerError},
+    http::StatusCode,
+    web::Data,
+    Error, Result,
+};
+use poem_openapi::{
+    param::{Header, Path, Query},
+    payload::Json,
+    OpenApi,
+};
+use tokio::io::AsyncWriteExt;
+
+use crate::{
+    api::{
+        group::get_related_groups,
+        message::{parse_properties_from_base64, send_message, SendMessageRequest},
+        resource::{
+            sha256_file, ImageProperties, PrepareUploadFileRequest, UploadFileRequest,
+            UploadFileResponse,
+        },
+        tags::ApiTags,
+        DateTime, FileMeta, Group, MessageTarget, UserInfo,
+    },
+    api_key::parse_api_key,
+    state::State,
+};
+
+async fn check_api_key(state: &State, uid: i64, key: &str) -> Result<()> {
+    let mut cache = state.cache.write().await;
+    let bot_key = cache
+        .users
+        .get_mut(&uid)
+        .and_then(|user| {
+            user.bot_keys
+                .values_mut()
+                .find(|bot_key| bot_key.key == key)
+        })
+        .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+    bot_key.last_used = Some(DateTime::now());
+    Ok(())
+}
+
+pub struct ApiBot;
+
+#[OpenApi(prefix_path = "/bot", tag = "ApiTags::Bot")]
+impl ApiBot {
+    /// Get all groups related to the current user.
+    #[oai(path = "/", method = "get")]
+    async fn get_related_groups(
+        &self,
+        state: Data<&State>,
+        #[oai(name = "x-api-key")] api_key: Header<String>,
+        public_only: Query<Option<bool>>,
+    ) -> Result<Json<Vec<Group>>> {
+        let current_uid = parse_api_key(&api_key, &state.0.key_config.read().await.server_key)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        check_api_key(&state, current_uid, &api_key).await?;
+        let cache = state.cache.read().await;
+        Ok(Json(get_related_groups(
+            &cache.groups,
+            current_uid,
+            public_only.0.unwrap_or_default(),
+        )))
+    }
+
+    /// Send message to the specified user
+    #[oai(path = "/send_to_user/:uid", method = "post")]
+    async fn send_to_user(
+        &self,
+        state: Data<&State>,
+        #[oai(name = "x-api-key")] api_key: Header<String>,
+        uid: Path<i64>,
+        #[oai(name = "X-Properties")] properties: Header<Option<String>>,
+        req: SendMessageRequest,
+    ) -> Result<Json<i64>> {
+        let current_uid = parse_api_key(&api_key, &state.0.key_config.read().await.server_key)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        check_api_key(&state, current_uid, &api_key).await?;
+        let properties = parse_properties_from_base64(properties.0);
+        let payload = req
+            .into_chat_message_payload(&state, current_uid, MessageTarget::user(uid.0), properties)
+            .await?;
+        let mid = send_message(&state, payload).await?;
+        Ok(Json(mid))
+    }
+
+    /// Send message to the specified group
+    #[oai(path = "/send_to_group/:gid", method = "post")]
+    async fn send_to_group(
+        &self,
+        state: Data<&State>,
+        #[oai(name = "x-api-key")] api_key: Header<String>,
+        gid: Path<i64>,
+        #[oai(name = "X-Properties")] properties: Header<Option<String>>,
+        req: SendMessageRequest,
+    ) -> Result<Json<i64>> {
+        let current_uid = parse_api_key(&api_key, &state.0.key_config.read().await.server_key)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        check_api_key(&state, current_uid, &api_key).await?;
+        let properties = parse_properties_from_base64(properties.0);
+        let payload = req
+            .into_chat_message_payload(&state, current_uid, MessageTarget::group(gid.0), properties)
+            .await?;
+        let mid = send_message(&state, payload).await?;
+        Ok(Json(mid))
+    }
+
+    /// Get user info by id
+    #[oai(path = "/user/:uid", method = "get")]
+    async fn user_info(
+        &self,
+        state: Data<&State>,
+        #[oai(name = "x-api-key")] api_key: Header<String>,
+        uid: Query<i64>,
+    ) -> Result<Json<UserInfo>> {
+        let current_uid = parse_api_key(&api_key, &state.0.key_config.read().await.server_key)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        check_api_key(&state, current_uid, &api_key).await?;
+        let cache = state.cache.read().await;
+        let user = cache
+            .users
+            .get(&uid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+        Ok(Json(user.api_user_info(uid.0)))
+    }
+
+    /// Get group info by id
+    #[oai(path = "/group/:gid", method = "get")]
+    async fn group_info(
+        &self,
+        state: Data<&State>,
+        #[oai(name = "x-api-key")] api_key: Header<String>,
+        gid: Query<i64>,
+    ) -> Result<Json<Group>> {
+        let current_uid = parse_api_key(&api_key, &state.0.key_config.read().await.server_key)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        check_api_key(&state, current_uid, &api_key).await?;
+        let cache = state.cache.read().await;
+        let group = cache
+            .groups
+            .get(&gid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+        Ok(Json(group.api_group(gid.0)))
+    }
+
+    /// Prepare for uploading file
+    #[oai(path = "/file/prepare", method = "post")]
+    async fn upload_file_prepare(
+        &self,
+        state: Data<&State>,
+        req: Json<PrepareUploadFileRequest>,
+        #[oai(name = "x-api-key")] api_key: Header<String>,
+    ) -> Result<Json<String>> {
+        let current_uid = parse_api_key(&api_key, &state.0.key_config.read().await.server_key)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        check_api_key(&state, current_uid, &api_key).await?;
+
+        let uuid = uuid::Uuid::new_v4().to_string();
+
+        let tmp_file_path = state
+            .config
+            .system
+            .tmp_dir()
+            .join(&uuid)
+            .with_extension("data");
+        let tmp_file_path_meta = tmp_file_path.with_extension("meta");
+
+        tokio::fs::write(&tmp_file_path, &[])
+            .await
+            .map_err(InternalServerError)?;
+
+        let meta = FileMeta {
+            content_type: match req.0.content_type {
+                Some(content_type) => content_type,
+                None => match &req.filename {
+                    Some(filename) => mime_guess::from_path(filename)
+                        .first()
+                        .map(|mime| mime.to_string())
+                        .unwrap_or_else(|| "application/octet-stream".to_string()),
+                    None => "application/octet-stream".to_string(),
+                },
+            },
+            filename: req.0.filename,
+        };
+        tokio::fs::write(
+            &tmp_file_path_meta,
+            serde_json::to_vec(&meta).map_err(InternalServerError)?,
+        )
+        .await
+        .map_err(InternalServerError)?;
+
+        Ok(Json(uuid))
+    }
+
+    /// Upload file
+    #[oai(path = "/file/upload", method = "post")]
+    async fn upload_file(
+        &self,
+        state: Data<&State>,
+        #[oai(name = "x-api-key")] api_key: Header<String>,
+        req: UploadFileRequest,
+    ) -> Result<Json<Option<UploadFileResponse>>> {
+        let current_uid = parse_api_key(&api_key, &state.0.key_config.read().await.server_key)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        check_api_key(&state, current_uid, &api_key).await?;
+
+        if req.file_id.is_empty() {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        // open the file, append data.
+        let tmp_file_path = state
+            .config
+            .system
+            .tmp_dir()
+            .join(&req.file_id)
+            .with_extension("data");
+        let tmp_file_path_meta = tmp_file_path.with_extension("meta");
+
+        if tmp_file_path.exists() {
+            let mut f = tokio::fs::OpenOptions::new()
+                .create(true)
+                .append(true)
+                .open(&tmp_file_path)
+                .await
+                .map_err(InternalServerError)?;
+            f.write_all(req.chunk_data.as_slice())
+                .await
+                .map_err(InternalServerError)?;
+            f.flush().await.map_err(InternalServerError)?;
+        } else {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        if req.chunk_is_last {
+            let file_meta = serde_json::from_slice::<FileMeta>(
+                &std::fs::read(&tmp_file_path_meta).map_err(InternalServerError)?,
+            )
+            .map_err(InternalServerError)?;
+            let is_image = Mime::from_str(&file_meta.content_type)
+                .map(|mime| mime.type_() == mime::IMAGE)
+                .unwrap_or_default();
+
+            let file_size = tokio::fs::metadata(&tmp_file_path)
+                .await
+                .map_err(InternalServerError)?
+                .len() as i64;
+            let file_hash = sha256_file(&tmp_file_path)
+                .await
+                .map_err(|_| Error::from_status(StatusCode::INTERNAL_SERVER_ERROR))?;
+
+            //  move tmp to dir
+            let now = DateTime::now();
+            let year = now.year();
+            let month = now.month();
+            let day = now.day();
+            // ./data/file/{year}/{month}/{day}/{file_uuid}
+            // ./data/file/2021/01/30/123-456-789
+            let save_path = state
+                .config
+                .system
+                .file_dir()
+                .join(year.to_string())
+                .join(month.to_string())
+                .join(day.to_string());
+            if !save_path.exists() {
+                tokio::fs::create_dir_all(&save_path)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+
+            tokio::fs::rename(&tmp_file_path, save_path.join(&req.file_id))
+                .and_then(|_| {
+                    tokio::fs::rename(
+                        &tmp_file_path_meta,
+                        save_path.join(&req.file_id).with_extension("meta"),
+                    )
+                })
+                .await
+                .map_err(InternalServerError)?;
+
+            // create the thumbnail
+            let mut image_properties = None;
+            if is_image {
+                let src_path = save_path.join(&req.file_id);
+                let src_meta_path = src_path.with_extension("meta");
+                let thumbnail_dir_path = state
+                    .config
+                    .system
+                    .thumbnail_dir()
+                    .join(year.to_string())
+                    .join(month.to_string())
+                    .join(day.to_string());
+                let thumbnail_file_path = thumbnail_dir_path.join(&req.file_id);
+                let thumbnail_meta_path = thumbnail_file_path.with_extension("meta");
+
+                tracing::info!(
+                    src_path = %src_path.display(),
+                    thumbnail_path = %thumbnail_file_path.display(),
+                    "create thumbnail",
+                );
+
+                image_properties = Some(
+                    tokio::task::spawn_blocking(move || {
+                        let image_data = std::fs::read(src_path).map_err(InternalServerError)?;
+                        let image = image::load_from_memory(&image_data).map_err(BadRequest)?;
+                        let thumbnail = image.thumbnail(480, 480);
+                        let _ = std::fs::create_dir_all(&thumbnail_dir_path);
+
+                        if thumbnail.color().has_alpha() {
+                            thumbnail
+                                .save_with_format(thumbnail_file_path, image::ImageFormat::Png)
+                                .map_err(InternalServerError)?;
+                        } else {
+                            thumbnail
+                                .save_with_format(thumbnail_file_path, image::ImageFormat::Jpeg)
+                                .map_err(InternalServerError)?;
+                        }
+
+                        std::fs::copy(&src_meta_path, &thumbnail_meta_path)
+                            .map_err(InternalServerError)?;
+                        Ok::<_, poem::Error>(ImageProperties {
+                            width: image.width(),
+                            height: image.height(),
+                        })
+                    })
+                    .await
+                    .map_err(InternalServerError)??,
+                );
+            }
+
+            // return the file url path, the client assembles the payload and sends it.
+            // {year}/{month}/{day}/{file_uuid}
+            // 2021/01/30/123-456-789
+            let file_url_path = format!("{}/{}/{}/{}", year, month, day, &req.file_id);
+            return Ok(Json(Some(UploadFileResponse {
+                path: file_url_path,
+                size: file_size,
+                hash: file_hash.to_string(),
+                image_properties,
+            })));
+        }
+        Ok(Json(None))
+    }
+}
diff --git a/src/api/datetime.rs b/src/api/datetime.rs
new file mode 100644
index 0000000..d4c1b7c
--- /dev/null
+++ b/src/api/datetime.rs
@@ -0,0 +1,112 @@
+use std::{borrow::Cow, ops::Deref};
+
+use chrono::{TimeZone, Utc};
+use poem_openapi::registry::{MetaSchema, MetaSchemaRef};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+#[derive(Debug, Copy, Clone, Eq, PartialEq, Ord, PartialOrd, Serialize, Deserialize)]
+pub struct DateTime(pub chrono::DateTime<Utc>);
+
+impl DateTime {
+    #[inline]
+    pub fn now() -> Self {
+        Self(Utc::now())
+    }
+
+    pub fn zero() -> Self {
+        Self(Utc.timestamp_millis_opt(0).unwrap())
+    }
+}
+
+impl From<chrono::DateTime<Utc>> for DateTime {
+    fn from(datetime: chrono::DateTime<Utc>) -> Self {
+        Self(datetime)
+    }
+}
+
+impl From<DateTime> for chrono::DateTime<Utc> {
+    fn from(datetime: DateTime) -> Self {
+        datetime.0
+    }
+}
+
+impl Deref for DateTime {
+    type Target = chrono::DateTime<Utc>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl Default for DateTime {
+    fn default() -> Self {
+        Self(Utc::now())
+    }
+}
+
+impl sqlx::Type<sqlx::Sqlite> for DateTime {
+    fn type_info() -> sqlx::sqlite::SqliteTypeInfo {
+        <chrono::DateTime<Utc>>::type_info()
+    }
+
+    fn compatible(ty: &sqlx::sqlite::SqliteTypeInfo) -> bool {
+        <chrono::DateTime<Utc>>::compatible(ty)
+    }
+}
+
+impl<'a> sqlx::Decode<'a, sqlx::Sqlite> for DateTime {
+    fn decode(value: sqlx::sqlite::SqliteValueRef<'a>) -> Result<Self, sqlx::error::BoxDynError> {
+        <chrono::DateTime<Utc>>::decode(value).map(Self)
+    }
+}
+
+impl<'a> sqlx::Encode<'a, sqlx::Sqlite> for DateTime {
+    fn encode_by_ref(
+        &self,
+        buf: &mut Vec<sqlx::sqlite::SqliteArgumentValue<'a>>,
+    ) -> sqlx::encode::IsNull {
+        self.0.encode(buf)
+    }
+}
+
+impl poem_openapi::types::Type for DateTime {
+    const IS_REQUIRED: bool = true;
+    type RawValueType = Self;
+    type RawElementValueType = Self;
+
+    fn name() -> Cow<'static, str> {
+        "integer(timestamp)".into()
+    }
+
+    fn schema_ref() -> poem_openapi::registry::MetaSchemaRef {
+        MetaSchemaRef::Inline(Box::new(MetaSchema::new_with_format(
+            "integer",
+            "timestamp",
+        )))
+    }
+
+    fn as_raw_value(&self) -> Option<&Self::RawValueType> {
+        Some(self)
+    }
+
+    fn raw_element_iter<'a>(
+        &'a self,
+    ) -> Box<dyn Iterator<Item = &'a Self::RawElementValueType> + 'a> {
+        Box::new(self.as_raw_value().into_iter())
+    }
+}
+
+impl poem_openapi::types::ParseFromJSON for DateTime {
+    fn parse_from_json(value: Option<Value>) -> poem_openapi::types::ParseResult<Self> {
+        i64::parse_from_json(value)
+            .map(|timestamp| Self(Utc.timestamp_millis_opt(timestamp).unwrap()))
+            .map_err(poem_openapi::types::ParseError::propagate)
+    }
+}
+
+impl poem_openapi::types::ToJSON for DateTime {
+    fn to_json(&self) -> Option<Value> {
+        Some(self.0.timestamp_millis().into())
+    }
+}
diff --git a/src/api/favorite.rs b/src/api/favorite.rs
new file mode 100644
index 0000000..f378078
--- /dev/null
+++ b/src/api/favorite.rs
@@ -0,0 +1,279 @@
+use poem::{
+    error::InternalServerError,
+    http::{header, StatusCode},
+    web::Data,
+    Error, Result,
+};
+use poem_openapi::{
+    param::{Path, Query},
+    payload::{Binary, Json, Response},
+    ApiResponse, Object, OpenApi,
+};
+
+use crate::{
+    api::{
+        archive::{create_message_archive, extract_archive, extract_archive_attachment},
+        tags::ApiTags,
+        token::Token,
+        Archive, DateTime,
+    },
+    middleware::guest_forbidden,
+    state::State,
+};
+
+#[derive(Debug, Object)]
+struct FavoriteArchive {
+    id: String,
+    created_at: DateTime,
+}
+
+#[derive(Debug, Object)]
+struct CreateFavoriteRequest {
+    mid_list: Vec<i64>,
+}
+
+#[derive(Debug, ApiResponse)]
+enum CreateFavoriteResponse {
+    #[oai(status = 200)]
+    Ok(Json<FavoriteArchive>),
+    /// Too many favorite archives
+    #[oai(status = 429)]
+    TooManyFavorites,
+}
+
+pub struct ApiFavorite;
+
+#[OpenApi(prefix_path = "/favorite", tag = "ApiTags::Favorite")]
+impl ApiFavorite {
+    /// Create favorite archive
+    #[oai(path = "/", method = "post", transform = "guest_forbidden")]
+    async fn create(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<CreateFavoriteRequest>,
+    ) -> Result<CreateFavoriteResponse> {
+        let sql = "select count(*) from favorite_archive where uid = ?";
+        let count = sqlx::query_as::<_, (i64,)>(sql)
+            .fetch_one(&state.db_pool)
+            .await
+            .map(|(count,)| count)
+            .map_err(InternalServerError)?;
+        if count >= state.config.system.max_favorite_archives as i64 {
+            return Ok(CreateFavoriteResponse::TooManyFavorites);
+        }
+
+        let data = create_message_archive(&state, req.0.mid_list, token.uid).await?;
+        let path = state.config.system.favorite_dir(token.uid);
+        let uuid = uuid::Uuid::new_v4().to_string();
+
+        let _ = std::fs::create_dir_all(&path);
+        tokio::fs::write(path.join(&uuid), data)
+            .await
+            .map_err(InternalServerError)?;
+
+        let now = DateTime::now();
+        let sql = "insert into favorite_archive (uid, archive_id, created_at) values (?, ?, ?)";
+        sqlx::query(sql)
+            .bind(token.uid)
+            .bind(&uuid)
+            .bind(now)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        Ok(CreateFavoriteResponse::Ok(Json(FavoriteArchive {
+            id: uuid,
+            created_at: now,
+        })))
+    }
+
+    /// List all favorite archives
+    #[oai(path = "/", method = "get")]
+    async fn list(&self, state: Data<&State>, token: Token) -> Result<Json<Vec<FavoriteArchive>>> {
+        let sql = "select archive_id, created_at from favorite_archive where uid = ?";
+        let mut archives = sqlx::query_as::<_, (String, DateTime)>(sql)
+            .bind(token.uid)
+            .fetch_all(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?
+            .into_iter()
+            .map(|(archive_id, created_at)| FavoriteArchive {
+                id: archive_id,
+                created_at,
+            })
+            .collect::<Vec<_>>();
+        archives.sort_by(|a, b| a.created_at.cmp(&b.created_at));
+        Ok(Json(archives))
+    }
+
+    /// Delete a favorite archive
+    #[oai(path = "/:id", method = "delete", transform = "guest_forbidden")]
+    async fn delete(&self, state: Data<&State>, token: Token, id: Path<String>) -> Result<()> {
+        let path = state.config.system.favorite_dir(token.uid).join(&id.0);
+        if !path.exists() {
+            return Err(Error::from_status(StatusCode::NOT_FOUND));
+        }
+
+        sqlx::query("delete from favorite_archive where uid = ? and archive_id = ?")
+            .bind(token.uid)
+            .bind(&id.0)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        tokio::fs::remove_file(&path)
+            .await
+            .map_err(InternalServerError)?;
+
+        Ok(())
+    }
+
+    /// Get favorite archive info
+    #[oai(path = "/:id", method = "get")]
+    async fn get_index(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        id: Path<String>,
+    ) -> Result<Response<Json<Archive>>> {
+        if id.contains('.') {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+        let path = state.config.system.favorite_dir(token.uid).join(&id.0);
+        let archive = extract_archive(path).await?;
+        Ok(Response::new(Json(archive)).header(header::CACHE_CONTROL, "public, max-age=31536000"))
+    }
+
+    /// Get attachment in the archive
+    #[oai(path = "/attachment/:uid/:id/:attachment_id", method = "get")]
+    async fn get_archive_attachment(
+        &self,
+        state: Data<&State>,
+        uid: Path<i64>,
+        id: Path<String>,
+        attachment_id: Path<usize>,
+        #[oai(default)] download: Query<bool>,
+    ) -> Result<Response<Binary<Vec<u8>>>> {
+        if id.contains('.') {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+        let path = state.config.system.favorite_dir(uid.0).join(&id.0);
+        let archive_file = extract_archive_attachment(path, attachment_id.0).await?;
+
+        let mut resp = Response::new(Binary(archive_file.content));
+        let ty = if download.0 { "attachment" } else { "inline" };
+        resp = resp
+            .header(header::CONTENT_TYPE, archive_file.content_type)
+            .header(header::CACHE_CONTROL, "public, max-age=31536000");
+        if let Some(filename) = archive_file.filename {
+            resp = resp.header(
+                header::CONTENT_DISPOSITION,
+                format!(r#"{}; filename="{}""#, ty, filename),
+            );
+        }
+
+        Ok(resp)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use crate::test_harness::TestServer;
+
+    #[tokio::test]
+    async fn test_crud() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let user1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        server.login("user1@voce.chat").await;
+
+        let mid1 = server.send_text_to_user(&admin_token, user1, "a").await;
+        let mid2 = server.send_text_to_user(&admin_token, user1, "b").await;
+        let mid3 = server.send_text_to_user(&admin_token, user1, "c").await;
+
+        let resp = server
+            .post("/api/favorite")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "mid_list": [mid1, mid2],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let archive1 = json.value().object().get("id").string().to_string();
+
+        let resp = server
+            .post("/api/favorite")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "mid_list": [mid2, mid3],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let archive2 = json.value().object().get("id").string().to_string();
+
+        let resp = server
+            .get("/api/favorite")
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let archives = json.value().array();
+
+        archives.assert_len(2);
+        archives.get(0).object().get("id").assert_string(&archive1);
+        archives.get(1).object().get("id").assert_string(&archive2);
+
+        let resp = server
+            .get(format!("/api/favorite/{}", archive1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let json = json.value().object();
+
+        let users = json.get("users").array();
+        users.assert_len(1);
+        users.get(0).object().get("name").assert_string("admin");
+
+        let messages = json.get("messages").array();
+        messages.assert_len(2);
+
+        let message = messages.get(0).object();
+        message.get("from_user").assert_i64(0);
+        message.get("content_type").assert_string("text/plain");
+        message.get("content").assert_string("a");
+
+        let message = messages.get(1).object();
+        message.get("from_user").assert_i64(0);
+        message.get("content_type").assert_string("text/plain");
+        message.get("content").assert_string("b");
+
+        json.get("num_attachments").assert_i64(0);
+
+        let resp = server
+            .delete(format!("/api/favorite/{}", archive1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let resp = server
+            .get("/api/favorite")
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        json.value().array().assert_len(1);
+    }
+}
diff --git a/src/api/group.rs b/src/api/group.rs
new file mode 100644
index 0000000..ca605f8
--- /dev/null
+++ b/src/api/group.rs
@@ -0,0 +1,2251 @@
+use std::{
+    collections::{BTreeMap, BTreeSet},
+    sync::Arc,
+};
+
+use chrono::Utc;
+use itertools::Itertools;
+use poem::{
+    error::{InternalServerError, ReadBodyError},
+    http::StatusCode,
+    web::Data,
+    Error, Result,
+};
+use poem_openapi::{
+    param::{Header, Path, Query},
+    payload::{Json, PlainText},
+    Object, OpenApi,
+};
+
+use crate::{
+    api::{
+        get_merged_message,
+        message::{
+            decode_messages, parse_properties_from_base64, send_message, ChatMessageContent,
+            SendMessageRequest,
+        },
+        tags::ApiTags,
+        token::Token,
+        user::{UploadAvatarApiResponse, UploadAvatarRequest},
+        AgoraConfig, ChatMessage, DateTime, GroupChangedMessage, KickFromGroupReason,
+        MessageTarget,
+    },
+    middleware::guest_forbidden,
+    state::{BroadcastEvent, Cache, CacheGroup, GroupType},
+    State,
+};
+
+/// Update group request
+#[derive(Debug, Object)]
+struct UpdateGroupRequest {
+    name: Option<String>,
+    description: Option<String>,
+    owner: Option<i64>,
+}
+
+/// Change group type request
+#[derive(Debug, Object)]
+struct ChangeGroupTypeRequest {
+    is_public: bool,
+    #[oai(default)]
+    members: Vec<i64>,
+}
+
+impl UpdateGroupRequest {
+    fn is_empty(&self) -> bool {
+        self.name.is_none() && self.owner.is_none() && self.description.is_none()
+    }
+}
+
+/// Group info
+#[derive(Debug, Clone, Object)]
+pub struct Group {
+    /// Group id
+    #[oai(read_only)]
+    pub gid: i64,
+    /// Group owner id
+    #[oai(read_only)]
+    pub owner: Option<i64>,
+    /// Group name
+    pub name: String,
+    /// Group description
+    pub description: Option<String>,
+    /// Members id
+    #[oai(default)]
+    pub members: Vec<i64>,
+    /// Is public group
+    #[oai(default)]
+    pub is_public: bool,
+    #[oai(read_only)]
+    pub avatar_updated_at: DateTime,
+    /// Pinned messages
+    #[oai(read_only)]
+    pub pinned_messages: Vec<PinnedMessage>,
+}
+
+/// Pinned message
+#[derive(Debug, Clone, Object)]
+pub struct PinnedMessage {
+    pub mid: i64,
+    pub created_by: i64,
+    pub created_at: DateTime,
+    #[oai(flatten)]
+    pub content: ChatMessageContent,
+}
+
+/// Agora token response
+#[derive(Debug, Object)]
+struct AgoraTokenResponse {
+    agora_token: String,
+    app_id: String,
+    uid: u32,
+    channel_name: String,
+    /// The agora token expired in seconds
+    expired_in: i64,
+}
+
+/// Pin message request
+#[derive(Debug, Object)]
+struct PinMessageRequest {
+    mid: i64,
+}
+
+/// Unpin message request
+#[derive(Debug, Object)]
+struct UnpinMessageRequest {
+    mid: i64,
+}
+
+/// Create group response
+#[derive(Debug, Object)]
+struct CreateGroupResponse {
+    gid: i64,
+    created_at: DateTime,
+}
+
+pub struct ApiGroup;
+
+#[OpenApi(prefix_path = "/group", tag = "ApiTags::Group")]
+impl ApiGroup {
+    /// Create a new group
+    #[oai(path = "/", method = "post", transform = "guest_forbidden")]
+    async fn create(
+        &self,
+        state: Data<&State>,
+        req: Json<Group>,
+        token: Token,
+    ) -> Result<Json<CreateGroupResponse>> {
+        let mut cache = state.cache.write().await;
+
+        if req.is_public && !token.is_admin {
+            // only admin can create public groups
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        if req.is_public && !req.members.is_empty() {
+            // public groups are not allowed to specify any members.
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        let members = if !req.is_public {
+            req.members
+                .iter()
+                .copied()
+                .chain(std::iter::once(token.uid))
+                .collect::<BTreeSet<i64>>()
+        } else {
+            Default::default()
+        };
+
+        for uid in &members {
+            if !cache.users.contains_key(uid) {
+                // invalid uid
+                return Err(Error::from_status(StatusCode::BAD_REQUEST));
+            }
+        }
+
+        // insert to sqlite
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+        let now = DateTime::now();
+        let owner = if req.is_public { None } else { Some(token.uid) };
+        let sql = "insert into `group` (name, description, owner, is_public, created_at, updated_at) values (?, ?, ?, ?, ?, ?)";
+        let gid = sqlx::query(sql)
+            .bind(&req.0.name)
+            .bind(req.0.description.as_deref().unwrap_or_default())
+            .bind(owner)
+            .bind(req.is_public)
+            .bind(now)
+            .bind(now)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?
+            .last_insert_rowid();
+
+        for id in &members {
+            sqlx::query("insert into group_user (gid, uid) values (?, ?)")
+                .bind(gid)
+                .bind(*id)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        cache.groups.insert(
+            gid,
+            CacheGroup {
+                ty: if req.is_public {
+                    GroupType::Public
+                } else {
+                    GroupType::Private { owner: token.uid }
+                },
+                name: req.0.name.clone(),
+                description: req.0.description.clone().unwrap_or_default(),
+                members: members.clone(),
+                created_at: now,
+                updated_at: now,
+                avatar_updated_at: DateTime::zero(),
+                pinned_messages: Vec::new(),
+            },
+        );
+
+        let group = Group {
+            gid,
+            owner: if req.is_public { None } else { Some(token.uid) },
+            name: req.0.name,
+            description: req.0.description,
+            members: members.clone().into_iter().collect(),
+            is_public: req.0.is_public,
+            avatar_updated_at: req.0.avatar_updated_at,
+            pinned_messages: Vec::new(),
+        };
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::JoinedGroup {
+                targets: {
+                    if !req.0.is_public {
+                        members
+                    } else {
+                        cache.users.keys().copied().collect()
+                    }
+                },
+                group,
+            }));
+
+        Ok(Json(CreateGroupResponse {
+            gid,
+            created_at: now,
+        }))
+    }
+
+    /// Upload group avatar
+    #[oai(path = "/:gid/avatar", method = "post")]
+    async fn upload_avatar(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        gid: Path<i64>,
+        req: UploadAvatarRequest,
+    ) -> Result<UploadAvatarApiResponse> {
+        let mut cache = state.cache.write().await;
+        let now = DateTime::now();
+        let cached_group = cache
+            .groups
+            .get_mut(&gid.0)
+            .ok_or_else(|| Error::from(StatusCode::UNAUTHORIZED))?;
+
+        match cached_group.ty {
+            GroupType::Public if !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            GroupType::Private { owner } if owner != token.uid && !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            _ => {}
+        }
+
+        let UploadAvatarRequest::Image(data) = req;
+        let data = match data
+            .0
+            .into_bytes_limit(state.config.system.upload_avatar_limit)
+            .await
+        {
+            Ok(data) => data,
+            Err(ReadBodyError::PayloadTooLarge) => {
+                return Ok(UploadAvatarApiResponse::PayloadTooLarge);
+            }
+            Err(err) => return Err(err.into()),
+        };
+
+        // write to file
+        state.save_group_avatar(gid.0, &data)?;
+
+        // update sqlite
+        sqlx::query("update `group` set avatar_updated_at = ? where gid = ?")
+            .bind(now)
+            .bind(gid.0)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        // update cache
+        cached_group.avatar_updated_at = now;
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::GroupChanged {
+                targets: if !cached_group.ty.is_public() {
+                    cached_group.members.iter().copied().collect()
+                } else {
+                    cache.users.keys().copied().collect()
+                },
+                msg: GroupChangedMessage {
+                    gid: gid.0,
+                    name: None,
+                    description: None,
+                    owner: None,
+                    avatar_updated_at: Some(now),
+                    is_public: None,
+                },
+            }));
+
+        Ok(UploadAvatarApiResponse::Ok)
+    }
+
+    /// Delete a exists group
+    #[oai(path = "/:gid", method = "delete")]
+    async fn delete(&self, state: Data<&State>, token: Token, gid: Path<i64>) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let group = match cache.groups.get(&gid.0) {
+            Some(group) => group,
+            None => return Err(Error::from_status(StatusCode::NOT_FOUND)),
+        };
+
+        match group.ty {
+            GroupType::Public if !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            GroupType::Private { owner } if owner != token.uid && !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            _ => {}
+        }
+
+        // update sqlite
+        sqlx::query("delete from `group` where gid = ?")
+            .bind(gid.0)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        // update cache
+        let cached_group = cache.groups.remove(&gid.0).unwrap();
+        for user in cache.users.values_mut() {
+            user.read_index_group.remove(&gid.0);
+        }
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::KickFromGroup {
+                targets: {
+                    if !cached_group.ty.is_public() {
+                        cached_group.members
+                    } else {
+                        cache.users.keys().copied().collect()
+                    }
+                },
+                reason: KickFromGroupReason::GroupDeleted,
+                gid: gid.0,
+            }));
+
+        Ok(())
+    }
+
+    /// Update a exists group
+    #[oai(path = "/:gid", method = "put")]
+    async fn update(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        gid: Path<i64>,
+        req: Json<UpdateGroupRequest>,
+    ) -> Result<()> {
+        if req.is_empty() {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        let mut cache = state.cache.write().await;
+        let group = match cache.groups.get_mut(&gid.0) {
+            Some(group) => group,
+            None => return Err(Error::from_status(StatusCode::NOT_FOUND)),
+        };
+
+        match group.ty {
+            GroupType::Public if !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            GroupType::Private { owner } if owner != token.uid && !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            _ => {}
+        }
+
+        if let Some(new_owner) = req.owner {
+            if group.ty.is_public() {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            if !group.contains_user(new_owner) {
+                return Err(Error::from_status(StatusCode::BAD_REQUEST));
+            }
+        }
+
+        let now = Utc::now();
+
+        // update sqlite
+        let sql = format!(
+            "update `group` set {} where gid = ?",
+            req.name
+                .iter()
+                .map(|_| "name = ?")
+                .chain(req.owner.iter().map(|_| "owner = ?"))
+                .chain(req.description.iter().map(|_| "description = ?"))
+                .chain(Some("updated_at = ?"))
+                .join(", ")
+        );
+
+        let mut query = sqlx::query(&sql);
+        if let Some(name) = &req.name {
+            query = query.bind(name);
+        }
+        if let Some(owner) = &req.owner {
+            query = query.bind(owner);
+        }
+        if let Some(description) = &req.description {
+            query = query.bind(description);
+        }
+
+        query
+            .bind(now)
+            .bind(gid.0)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        let mut broadcast_event = GroupChangedMessage {
+            gid: gid.0,
+            name: None,
+            description: None,
+            owner: None,
+            avatar_updated_at: None,
+            is_public: None,
+        };
+
+        // update cache
+        if let Some(name) = req.0.name {
+            broadcast_event.name = Some(name.clone());
+            group.name = name;
+        }
+        if let Some(description) = req.0.description {
+            broadcast_event.description = Some(description.clone());
+            group.description = description;
+        }
+        if let Some(new_owner) = req.0.owner {
+            if let GroupType::Private { owner } = &mut group.ty {
+                broadcast_event.owner = Some(new_owner);
+                *owner = new_owner;
+            }
+        }
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::GroupChanged {
+                targets: if !group.ty.is_public() {
+                    group.members.iter().copied().collect()
+                } else {
+                    cache.users.keys().copied().collect()
+                },
+                msg: broadcast_event,
+            }));
+
+        Ok(())
+    }
+
+    #[oai(path = "/:gid/change_type", method = "post")]
+    async fn change_type(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        gid: Path<i64>,
+        req: Json<ChangeGroupTypeRequest>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let Cache { groups, users, .. } = &mut *cache;
+        let group = match groups.get_mut(&gid.0) {
+            Some(group) => group,
+            None => return Err(Error::from_status(StatusCode::NOT_FOUND)),
+        };
+
+        match group.ty {
+            GroupType::Public if !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            GroupType::Private { owner } if owner != token.uid && !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            _ => {}
+        }
+
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        match (group.ty.is_public(), req.is_public) {
+            (true, false) => {
+                // public to private
+                sqlx::query("update `group` set is_public = ?, owner = ? where gid = ?")
+                    .bind(false)
+                    .bind(token.uid)
+                    .bind(gid.0)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+                let members = if !req.members.is_empty() {
+                    req.members.clone()
+                } else {
+                    users
+                        .iter()
+                        .filter(|(_, user)| !user.is_guest)
+                        .map(|(id, _)| *id)
+                        .collect()
+                };
+
+                for uid in members {
+                    sqlx::query("insert into group_user (gid, uid) values (?, ?)")
+                        .bind(gid.0)
+                        .bind(uid)
+                        .execute(&mut tx)
+                        .await
+                        .map_err(InternalServerError)?;
+                }
+            }
+            (false, true) => {
+                // private to public
+                sqlx::query("update `group` set is_public = ?, owner = ? where gid = ?")
+                    .bind(true)
+                    .bind(None::<i32>)
+                    .bind(gid.0)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+
+                sqlx::query("delete from group_user where gid = ?")
+                    .bind(gid.0)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+            _ => {}
+        }
+
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        match (group.ty.is_public(), req.is_public) {
+            (true, false) => {
+                group.ty = GroupType::Private { owner: token.uid };
+                group.members = if !req.members.is_empty() {
+                    req.members.iter().copied().collect()
+                } else {
+                    users
+                        .iter()
+                        .filter(|(_, user)| !user.is_guest)
+                        .map(|(id, _)| *id)
+                        .collect()
+                };
+
+                let _ = state
+                    .event_sender
+                    .send(Arc::new(BroadcastEvent::GroupChanged {
+                        targets: users.keys().copied().collect(),
+                        msg: GroupChangedMessage {
+                            gid: gid.0,
+                            name: None,
+                            description: None,
+                            owner: Some(gid.0),
+                            avatar_updated_at: None,
+                            is_public: Some(false),
+                        },
+                    }));
+            }
+            (false, true) => {
+                let origin_members = std::mem::take(&mut group.members);
+                let all_users: BTreeSet<_> = users
+                    .iter()
+                    .filter(|(_, user)| !user.is_guest)
+                    .map(|(id, _)| *id)
+                    .collect();
+                let new_members = all_users
+                    .difference(&origin_members)
+                    .copied()
+                    .collect::<BTreeSet<_>>();
+
+                group.ty = GroupType::Public;
+
+                let _ = state
+                    .event_sender
+                    .send(Arc::new(BroadcastEvent::GroupChanged {
+                        targets: users.keys().copied().collect(),
+                        msg: GroupChangedMessage {
+                            gid: gid.0,
+                            name: None,
+                            description: None,
+                            owner: None,
+                            avatar_updated_at: None,
+                            is_public: Some(true),
+                        },
+                    }));
+
+                let _ = state
+                    .event_sender
+                    .send(Arc::new(BroadcastEvent::UserJoinedGroup {
+                        targets: origin_members,
+                        gid: gid.0,
+                        uid: new_members.iter().copied().collect(),
+                    }));
+
+                let _ = state
+                    .event_sender
+                    .send(Arc::new(BroadcastEvent::JoinedGroup {
+                        targets: new_members,
+                        group: group.api_group(gid.0),
+                    }));
+            }
+            _ => {}
+        }
+
+        Ok(())
+    }
+
+    /// Let the current user leave the specified group.
+    #[oai(path = "/:gid/leave", method = "get")]
+    async fn leave(&self, state: Data<&State>, token: Token, gid: Path<i64>) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let group = match cache.groups.get_mut(&gid.0) {
+            Some(group) => group,
+            None => return Err(Error::from_status(StatusCode::NOT_FOUND)),
+        };
+
+        match group.ty {
+            GroupType::Public => return Err(Error::from_status(StatusCode::FORBIDDEN)),
+            GroupType::Private { owner } => {
+                // the current user is not in this group
+                if !group.contains_user(token.uid) {
+                    return Err(Error::from_status(StatusCode::FORBIDDEN));
+                }
+                if owner == token.uid {
+                    // the current user is owner
+                    return Err(Error::from_status(StatusCode::FORBIDDEN));
+                }
+            }
+        }
+
+        // update sqlite
+        sqlx::query("delete from group_user where gid = ? and uid = ?")
+            .bind(gid.0)
+            .bind(token.uid)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        // update cache
+        let members = group.members.clone();
+        group.members.remove(&token.uid);
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserLeavedGroup {
+                targets: members,
+                gid: gid.0,
+                uid: vec![token.uid],
+            }));
+
+        Ok(())
+    }
+
+    /// Get a group by id
+    #[oai(path = "/:gid", method = "get")]
+    async fn get(&self, state: Data<&State>, gid: Path<i64>) -> Result<Json<Group>> {
+        let cache = state.cache.read().await;
+        Ok(Json(
+            cache
+                .groups
+                .get(&gid.0)
+                .map(|group| group.api_group(gid.0))
+                .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?,
+        ))
+    }
+
+    /// Get all groups related to the current user.
+    #[oai(path = "/", method = "get")]
+    async fn get_related_groups(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        public_only: Query<Option<bool>>,
+    ) -> Result<Json<Vec<Group>>> {
+        let cache = state.cache.read().await;
+        Ok(Json(get_related_groups(
+            &cache.groups,
+            token.uid,
+            public_only.0.unwrap_or_default(),
+        )))
+    }
+
+    /// Add some new members to the specified group
+    #[oai(path = "/:gid/members/add", method = "post")]
+    async fn add_members(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        gid: Path<i64>,
+        members: Json<Vec<i64>>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+
+        if !members.iter().all(|uid| cache.users.contains_key(uid)) {
+            // invalid uid
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        let group = cache
+            .groups
+            .get_mut(&gid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+
+        match group.ty {
+            GroupType::Public => return Err(Error::from_status(StatusCode::FORBIDDEN)),
+            GroupType::Private { .. } if !group.members.contains(&token.uid) && !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            _ => {}
+        }
+
+        for uid in members.iter() {
+            if group.contains_user(*uid) {
+                // already in the group
+                return Err(Error::from_status(StatusCode::BAD_REQUEST));
+            }
+        }
+
+        // update sqlite
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+        for uid in members.iter() {
+            sqlx::query("insert into group_user (gid, uid) values (?, ?)")
+                .bind(gid.0)
+                .bind(uid)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        let original_members = group.members.clone();
+        group.members.extend(members.0.clone());
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::JoinedGroup {
+                targets: members.0.clone().into_iter().collect(),
+                group: group.api_group(gid.0),
+            }));
+
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserJoinedGroup {
+                targets: original_members,
+                gid: gid.0,
+                uid: members.0.clone(),
+            }));
+
+        Ok(())
+    }
+
+    /// Remove some members from the specified group
+    #[oai(path = "/:gid/members/remove", method = "post")]
+    async fn remove_members(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        gid: Path<i64>,
+        members: Json<Vec<i64>>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let group = cache
+            .groups
+            .get_mut(&gid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+
+        let owner = match group.ty {
+            GroupType::Public => return Err(Error::from_status(StatusCode::FORBIDDEN)),
+            GroupType::Private { owner } if owner != token.uid && !token.is_admin => {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            GroupType::Private { owner } => owner,
+        };
+
+        for uid in members.iter() {
+            if owner == *uid {
+                // can't remove the owner of group
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+
+            if !group.contains_user(*uid) {
+                // this user is not in the group
+                return Err(Error::from_status(StatusCode::NOT_FOUND));
+            }
+        }
+
+        // update sqlite
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+        for uid in members.iter() {
+            sqlx::query("delete from group_user where gid = ? and uid = ?")
+                .bind(gid.0)
+                .bind(uid)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        for uid in &members.0 {
+            group.members.remove(uid);
+        }
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::KickFromGroup {
+                targets: members.0.clone().into_iter().collect(),
+                gid: gid.0,
+                reason: KickFromGroupReason::Kick,
+            }));
+
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserLeavedGroup {
+                targets: group.members.clone(),
+                gid: gid.0,
+                uid: members.0.clone(),
+            }));
+
+        Ok(())
+    }
+
+    /// Send message to the specified group
+    #[oai(path = "/:gid/send", method = "post", transform = "guest_forbidden")]
+    async fn send(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        gid: Path<i64>,
+        #[oai(name = "X-Properties")] properties: Header<Option<String>>,
+        req: SendMessageRequest,
+    ) -> Result<Json<i64>> {
+        let properties = parse_properties_from_base64(properties.0);
+        let payload = req
+            .into_chat_message_payload(&state, token.uid, MessageTarget::group(gid.0), properties)
+            .await?;
+        let mid = send_message(&state, payload).await?;
+        Ok(Json(mid))
+    }
+
+    /// Create a register magic link to invit user to join group
+    /// format: https://domain.com/?magic_token=xxx#/register
+    #[oai(path = "/create_reg_magic_link", method = "get")]
+    async fn create_reg_magic_link(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        gid: Query<Option<i64>>,
+        expired_in: Query<Option<i64>>,
+        max_times: Query<Option<i32>>,
+        req: &poem::Request,
+    ) -> Result<PlainText<String>> {
+        if gid.0.is_some() {
+            let mut cache = state.cache.write().await;
+            let group = cache
+                .groups
+                .get_mut(&gid.0.unwrap())
+                .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+            if !group.ty.is_public() && !group.members.contains(&token.uid) && !token.is_admin {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+        }
+        let url = crate::state::get_frontend_url(&state, req).await;
+        let code = rc_magic_link::gen_code();
+        let expired_at = chrono::Utc::now()
+            + chrono::Duration::seconds(
+                expired_in
+                    .0
+                    .unwrap_or(state.config.system.magic_token_expiry_seconds),
+            );
+        let magic_link = {
+            let key_config = state.key_config.read().await;
+            let magic_token = rc_magic_link::MagicLinkToken::gen_reg_magic_token(
+                &code,
+                &key_config.server_key,
+                expired_at,
+                false,
+                gid.0,
+                None,
+                None,
+            );
+            format!("{}/?magic_token={}#/register", url, magic_token)
+        };
+        state
+            .reg_magic_code_add(&code, expired_at, max_times.0.unwrap_or(10000))
+            .await;
+        Ok(PlainText(magic_link))
+    }
+
+    /// Get history messages
+    #[oai(path = "/:gid/history", method = "get")]
+    async fn get_history_messages(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        gid: Path<i64>,
+        before: Query<Option<i64>>,
+        #[oai(default = "default_get_history_messages_limit")] limit: Query<usize>,
+    ) -> Result<Json<Vec<ChatMessage>>> {
+        let cache = state.cache.read().await;
+        let group = cache
+            .groups
+            .get(&gid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+        if !group.contains_user(token.uid) {
+            // this user is not in the group
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let msgs = state
+            .msg_db
+            .messages()
+            .fetch_group_messages_before(gid.0, before.0, limit.0)
+            .map_err(InternalServerError)?;
+        Ok(Json(decode_messages(msgs)))
+    }
+
+    /// Generates a Agora token
+    #[oai(path = "/:gid/agora_token", method = "get")]
+    async fn generate_agora_token(
+        &self,
+        state: Data<&State>,
+        gid: Path<i64>,
+        token: Token,
+    ) -> Result<Json<AgoraTokenResponse>> {
+        let agora = state
+            .get_dynamic_config_instance::<AgoraConfig>()
+            .await
+            .ok_or_else(|| Error::from_status(StatusCode::SERVICE_UNAVAILABLE))?;
+        let cache = state.cache.read().await;
+        let group = cache
+            .groups
+            .get(&gid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+
+        if !group.contains_user(token.uid) {
+            // this user is not in the group
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let channel_name = format!("vocechat:group:{}", gid.0);
+        let agora_token = agora_token::create_rtc_token(
+            &agora.app_id,
+            &agora.app_certificate,
+            &channel_name,
+            token.uid as u32,
+        );
+        Ok(Json(AgoraTokenResponse {
+            agora_token,
+            app_id: agora.app_id.clone(),
+            uid: token.uid as u32,
+            channel_name,
+            expired_in: 24 * 3600,
+        }))
+    }
+
+    /// Pin a message
+    #[oai(path = "/:gid/pin", method = "post")]
+    async fn pin_message(
+        &self,
+        state: Data<&State>,
+        gid: Path<i64>,
+        token: Token,
+        req: Json<PinMessageRequest>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let group = cache
+            .groups
+            .get_mut(&gid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+
+        let check_permission = match group.ty {
+            GroupType::Public if token.is_admin => true,
+            GroupType::Private { owner } if owner == token.uid || token.is_admin => true,
+            _ => false,
+        };
+
+        if !check_permission {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        if group.pinned_messages.iter().any(|msg| msg.mid == req.mid) {
+            return Err(Error::from_status(StatusCode::CONFLICT));
+        }
+
+        let merged_msg = get_merged_message(&state.msg_db, req.mid)?
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+
+        // update database
+        let now = DateTime::now();
+        let sql =
+            "insert into pinned_message (gid, mid, created_by, created_at) values (?, ?, ?, ?)";
+        sqlx::query(sql)
+            .bind(gid.0)
+            .bind(req.mid)
+            .bind(token.uid)
+            .bind(now)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        // update cache
+        let pinned_msg = PinnedMessage {
+            mid: req.mid,
+            created_by: token.uid,
+            created_at: now,
+            content: merged_msg.content,
+        };
+        group.pinned_messages.push(pinned_msg.clone());
+        group
+            .pinned_messages
+            .sort_by(|a, b| a.created_at.cmp(&b.created_at));
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::PinnedMessageUpdated {
+                targets: if group.ty.is_public() {
+                    cache.users.keys().copied().collect()
+                } else {
+                    group.members.clone()
+                },
+                gid: gid.0,
+                mid: req.mid,
+                msg: Some(pinned_msg),
+            }));
+
+        Ok(())
+    }
+
+    /// Unpin a message
+    #[oai(path = "/:gid/unpin", method = "post")]
+    async fn unpin_message(
+        &self,
+        state: Data<&State>,
+        gid: Path<i64>,
+        token: Token,
+        req: Json<UnpinMessageRequest>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let group = cache
+            .groups
+            .get_mut(&gid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+
+        let check_permission = match group.ty {
+            GroupType::Public if token.is_admin => true,
+            GroupType::Private { owner } if owner == token.uid || token.is_admin => true,
+            _ => false,
+        };
+
+        if !check_permission {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let idx = match group
+            .pinned_messages
+            .iter()
+            .enumerate()
+            .find(|(_, msg)| msg.mid == req.mid)
+        {
+            Some((idx, _)) => idx,
+            None => return Err(Error::from_status(StatusCode::NOT_FOUND)),
+        };
+
+        // update database
+        let sql = "delete from pinned_message where gid = ? and mid = ?";
+        sqlx::query(sql)
+            .bind(gid.0)
+            .bind(req.mid)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        // update cache
+        group.pinned_messages.remove(idx);
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::PinnedMessageUpdated {
+                targets: if group.ty.is_public() {
+                    cache.users.keys().copied().collect()
+                } else {
+                    group.members.clone()
+                },
+                gid: gid.0,
+                mid: req.mid,
+                msg: None,
+            }));
+
+        Ok(())
+    }
+}
+
+const fn default_get_history_messages_limit() -> usize {
+    300
+}
+
+pub fn get_related_groups(
+    groups_cache: &BTreeMap<i64, CacheGroup>,
+    uid: i64,
+    public_only: bool,
+) -> Vec<Group> {
+    groups_cache
+        .iter()
+        .filter(|(_, group)| group.ty.is_public() || (!public_only && group.contains_user(uid)))
+        .map(|(id, group)| group.api_group(*id))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+    use tokio_stream::StreamExt;
+
+    use super::*;
+    use crate::test_harness::TestServer;
+
+    #[tokio::test]
+    async fn test_crud() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "test1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "test2@voce.chat").await;
+        let uid3 = server.create_user(&admin_token, "test3@voce.chat").await;
+        let token1 = server.login("test1@voce.chat").await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "description": "abc",
+                "members": [uid1, uid2]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+        let json = server.get_group(gid).await;
+        let group = json.value().object();
+        group.get("gid").assert_i64(gid);
+        group.get("owner").assert_i64(1);
+        group.get("name").assert_string("test");
+        group.get("description").assert_string("abc");
+        group.get("members").assert_i64_array(&[1, uid1, uid2]);
+        group.get("is_public").assert_bool(false);
+
+        // update group name
+        let resp = server
+            .put(format!("/api/group/{}", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test2",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        assert_eq!(
+            server
+                .get_group(gid)
+                .await
+                .value()
+                .object()
+                .get("name")
+                .string(),
+            "test2"
+        );
+
+        // update group description
+        let resp = server
+            .put(format!("/api/group/{}", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "description": "iop",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        assert_eq!(
+            server
+                .get_group(gid)
+                .await
+                .value()
+                .object()
+                .get("description")
+                .string(),
+            "iop"
+        );
+
+        // update group owner
+        let resp = server
+            .put(format!("/api/group/{}", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "owner": uid1,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        assert_eq!(
+            server
+                .get_group(gid)
+                .await
+                .value()
+                .object()
+                .get("owner")
+                .i64(),
+            uid1
+        );
+
+        // add members
+        let resp = server
+            .post(format!("/api/group/{}/members/add", gid))
+            .header("X-API-Key", &token1)
+            .body_json(&json!([uid3]))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        assert_eq!(
+            server
+                .get_group(gid)
+                .await
+                .value()
+                .object()
+                .get("members")
+                .i64_array(),
+            &[1, uid1, uid2, uid3]
+        );
+
+        // remove members
+        let resp = server
+            .post(format!("/api/group/{}/members/remove", gid))
+            .header("X-API-Key", &token1)
+            .body_json(&json!([uid2]))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        assert_eq!(
+            server
+                .get_group(gid)
+                .await
+                .value()
+                .object()
+                .get("members")
+                .i64_array(),
+            &[1, uid1, uid3]
+        );
+
+        // delete group
+        let resp = server
+            .delete(format!("/api/group/{}", gid))
+            .header("X-API-Key", &token1)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let resp = server.get(format!("/api/group/{}", gid)).send().await;
+        resp.assert_status(StatusCode::NOT_FOUND);
+    }
+
+    #[tokio::test]
+    async fn only_admin_can_create_public_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+
+        // create group with normal user
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status(StatusCode::FORBIDDEN);
+
+        // create group with admin user
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn only_admin_can_update_public_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // update group with normal user
+        let resp = server
+            .put(format!("/api/group/{}", gid))
+            .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "name": "test1",
+            }))
+            .send()
+            .await;
+        resp.assert_status(StatusCode::FORBIDDEN);
+
+        // update group with admin user
+        let resp = server
+            .put(format!("/api/group/{}", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test1",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn cannot_change_the_public_group_owner() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // change the owner
+        let resp = server
+            .put(format!("/api/group/{}", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!(  {
+                "owner": uid1,
+            }))
+            .send()
+            .await;
+        resp.assert_status(StatusCode::FORBIDDEN);
+    }
+
+    #[tokio::test]
+    async fn only_admin_can_delete_public_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // delete group with normal user
+        let resp = server
+            .delete(format!("/api/group/{}", gid))
+            .header("X-API-Key", &token1)
+            .send()
+            .await;
+        resp.assert_status(StatusCode::FORBIDDEN);
+
+        // delete group with admin user
+        let resp = server
+            .delete(format!("/api/group/{}", gid))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn test_send_to_private_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let mut ids = Vec::new();
+        let mut tokens = Vec::new();
+
+        for i in 1..10 {
+            ids.push(
+                server
+                    .create_user(&admin_token, format!("test{}@voce.chat", i))
+                    .await,
+            );
+            tokens.push(server.login(format!("test{}@voce.chat", i)).await);
+        }
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &tokens[0])
+            .body_json(&json!({
+                "name": "test",
+                "members": ids[1..].iter().copied().collect_vec(),
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let gid = resp.json().await.value().object().get("gid").i64();
+
+        // send text
+        for i in 0..10 {
+            server
+                .send_text_to_group(&tokens[0], gid, format!("hello {}", i))
+                .await;
+        }
+
+        // subscribe
+        let mut streams = Vec::new();
+        for token in &tokens {
+            let stream = server.subscribe_events(token, Some(&["chat"])).await;
+            streams.push(stream);
+        }
+
+        for stream in &mut streams {
+            for j in 0..10 {
+                let event = stream.next().await.unwrap();
+                let event = event.value().object();
+                event.get("target").object().get("gid").assert_i64(gid);
+                let detail = event.get("detail").object();
+                detail.get("content").assert_string(&format!("hello {}", j));
+            }
+        }
+
+        // send text
+        for i in 10..20 {
+            server
+                .send_text_to_group(&tokens[0], gid, format!("hello {}", i))
+                .await;
+        }
+
+        for stream in &mut streams {
+            for j in 10..20 {
+                let event = stream.next().await.unwrap();
+                let event = event.value().object();
+                event.get("target").object().get("gid").assert_i64(gid);
+                let detail = event.get("detail").object();
+                detail.get("content").assert_string(&format!("hello {}", j));
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn test_send_to_public_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        server.create_user(&admin_token, "user2@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // subscribe events
+        let mut events1 = server.subscribe_events(&token1, Some(&["chat"])).await;
+        let mut events2 = server.subscribe_events(&token2, Some(&["chat"])).await;
+
+        // send message
+        let id1 = server.send_text_to_group(&token1, gid, "a").await;
+        let id2 = server.send_text_to_group(&token2, gid, "b").await;
+        let id3 = server.send_text_to_group(&token1, gid, "c").await;
+
+        // check messages
+        for events in [&mut events1, &mut events2] {
+            let msg = events.next().await.unwrap();
+            assert_eq!(msg.value().object().get("mid").i64(), id1);
+            let msg = events.next().await.unwrap();
+            assert_eq!(msg.value().object().get("mid").i64(), id2);
+            let msg = events.next().await.unwrap();
+            assert_eq!(msg.value().object().get("mid").i64(), id3);
+        }
+    }
+
+    #[tokio::test]
+    async fn test_related_groups() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let uid3 = server.create_user(&admin_token, "user3@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+        let token3 = server.login("user3@voce.chat").await;
+
+        // create public group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "public",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let public_gid = json.value().object().get("gid").i64();
+
+        // create group1
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1, uid2]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid1 = json.value().object().get("gid").i64();
+
+        // create group2
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid2, uid3]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid2 = json.value().object().get("gid").i64();
+
+        // get related groups
+        async fn check_groups(server: &TestServer, token: &str, mut groups: Vec<i64>) {
+            let resp = server
+                .get("/api/group")
+                .header("X-API-Key", token)
+                .send()
+                .await;
+            resp.assert_status_is_ok();
+            let json = resp.json().await;
+
+            let mut res = json
+                .value()
+                .array()
+                .iter()
+                .map(|group| group.object().get("gid").i64())
+                .collect_vec();
+            res.sort_unstable();
+            groups.sort_unstable();
+            assert_eq!(res, groups);
+        }
+
+        check_groups(&server, &admin_token, vec![public_gid, gid1, gid2]).await;
+        check_groups(&server, &token1, vec![public_gid, gid1]).await;
+        check_groups(&server, &token2, vec![public_gid, gid1, gid2]).await;
+        check_groups(&server, &token3, vec![public_gid, gid2]).await;
+    }
+
+    #[tokio::test]
+    async fn test_history_messages() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        let id1 = server.send_text_to_group(&admin_token, gid, "a").await;
+        let id2 = server.send_text_to_group(&admin_token, gid, "b").await;
+        let id3 = server.send_text_to_group(&admin_token, gid, "c").await;
+
+        async fn check(
+            server: &TestServer,
+            token: &str,
+            gid: i64,
+            before_mid: Option<i64>,
+            expect: Vec<(i64, &str)>,
+        ) {
+            let mut builder = server
+                .get(format!("/api/group/{}/history", gid))
+                .header("X-API-Key", token);
+            if let Some(before_mid) = before_mid {
+                builder = builder.query("before", &before_mid);
+            }
+            let resp = builder.send().await;
+            resp.assert_status_is_ok();
+            let json = resp.json().await;
+            let array = json.value().array();
+            array.assert_len(expect.len());
+            for (row, (id, content)) in array.iter().zip(expect) {
+                let row = row.object();
+                row.get("mid").assert_i64(id);
+                let detail = row.get("detail").object();
+                detail.get("type").assert_string("normal");
+                detail.get("content").assert_string(content);
+            }
+        }
+
+        check(
+            &server,
+            &admin_token,
+            gid,
+            None,
+            vec![(id1, "a"), (id2, "b"), (id3, "c")],
+        )
+        .await;
+
+        check(
+            &server,
+            &admin_token,
+            gid,
+            Some(id3),
+            vec![(id1, "a"), (id2, "b")],
+        )
+        .await;
+
+        check(&server, &admin_token, gid, Some(id1), vec![]).await;
+    }
+
+    #[tokio::test]
+    async fn test_leave_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        assert_eq!(
+            server
+                .get_group(gid)
+                .await
+                .value()
+                .object()
+                .get("members")
+                .i64_array(),
+            vec![1, uid1]
+        );
+
+        // uid1 leave the group
+        let resp = server
+            .get(format!("/api/group/{}/leave", gid))
+            .header("X-API-Key", &token1)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        assert_eq!(
+            server
+                .get_group(gid)
+                .await
+                .value()
+                .object()
+                .get("members")
+                .i64_array(),
+            vec![1]
+        );
+
+        // owner leave the group
+        let resp = server
+            .get(format!("/api/group/{}/leave", gid))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status(StatusCode::FORBIDDEN)
+    }
+
+    #[tokio::test]
+    async fn received_update_group_msg() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut admin_events = server
+            .subscribe_events(&admin_token, Some(&["group_changed"]))
+            .await;
+        let mut user1_events = server
+            .subscribe_events(&token1, Some(&["group_changed"]))
+            .await;
+        let mut user2_events = server
+            .subscribe_events(&token2, Some(&["group_changed"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test1",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let public_gid = json.value().object().get("gid").i64();
+
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "name": "test2",
+                "members": [uid2],
+                "is_public": false,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let private_gid = json.value().object().get("gid").i64();
+
+        // update public group
+        let resp = server
+            .put(format!("/api/group/{}", public_gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test3",
+                "description": "abc",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut user1_events, &mut user2_events, &mut admin_events] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("type").assert_string("group_changed");
+            obj.get("gid").assert_i64(public_gid);
+            obj.get("name").assert_string("test3");
+            obj.get("description").assert_string("abc");
+            obj.get("owner").assert_null();
+            obj.get("avatar_updated_at").assert_null();
+        }
+
+        // update private group
+        let resp = server
+            .put(format!("/api/group/{}", private_gid))
+            .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "name": "test4",
+                "description": "def",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut user2_events, &mut user1_events] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("type").assert_string("group_changed");
+            obj.get("gid").assert_i64(private_gid);
+            obj.get("name").assert_string("test4");
+            obj.get("description").assert_string("def");
+            obj.get("owner").assert_null();
+            obj.get("avatar_updated_at").assert_null();
+        }
+
+        // update public group avatar
+        let resp = server
+            .post(format!("/api/group/{}/avatar", public_gid))
+            .header("X-API-Key", &admin_token)
+            .content_type("image/png")
+            .body(include_bytes!("assets/poem.png").to_vec())
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut user1_events, &mut user2_events, &mut admin_events] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("type").assert_string("group_changed");
+            obj.get("gid").assert_i64(public_gid);
+            obj.get("avatar_updated_at").assert_not_null();
+        }
+    }
+
+    // #[tokio::test]
+    // async fn invite_to_group() {
+    //     let server = TestServer::new_with_config(|cfg| {
+    //         let url = "http://localhost:3000/web/invite?code={{ code|url_encode }}&token={{ token|url_encode }}";
+    //         cfg.link.reg_magic_url_tpl =
+    //             Some(url.to_string());
+    //     })
+    //     .await;
+    //     let admin_token = server.login_admin().await;
+    //
+    //     // create group
+    //     let resp = server
+    //         .post("/api/group")
+    //         .header("X-API-Key", &admin_token)
+    //         .body_json(&json!({
+    //             "name": "test",
+    //             "description": "abc",
+    //             "is_public": false,
+    //             "members": [],
+    //         }))
+    //         .send()
+    //         .await;
+    //     resp.assert_status_is_ok();
+    //     let json = resp.json().await;
+    //     let gid = json.value().object().get("gid").i64();
+    //
+    //     // create invite link
+    //     let resp = server
+    //         .get(format!("/api/group/create_reg_magic_link/gid={}", gid))
+    //         .header("X-API-Key", &admin_token)
+    //         .send()
+    //         .await;
+    //     resp.assert_status_is_ok();
+    //     let url = resp.0.into_body().into_string().await.unwrap();
+    //     let uri = Uri::from_str(&url).unwrap();
+    //
+    //     #[derive(Deserialize)]
+    //     struct Params {
+    //         code: bool,
+    //         token: String,
+    //     }
+    //     let params =
+    // serde_urlencoded::from_str::<Params>(uri.query().unwrap()).unwrap();
+    //     assert!(!params.code);
+    //
+    //     // register user
+    //     let resp = server
+    //         .post("/api/user/register")
+    //         .header("X-API-Key", &admin_token)
+    //         .body_json(&json!({
+    //             "magic_token": params.token,
+    //             "email": "user1@voce.chat",
+    //             "password": "123456",
+    //             "name": "user1",
+    //             "gender": 1,
+    //         }))
+    //         .send()
+    //         .await;
+    //     resp.assert_status_is_ok();
+    //     let uid = resp.json().await.value().object().get("uid").i64();
+    //
+    //     let resp = server
+    //         .get(format!("/api/group/{}", gid))
+    //         .header("X-API-Key", &admin_token)
+    //         .send()
+    //         .await;
+    //     let json = resp.json().await;
+    //     json.value()
+    //         .object()
+    //         .get("members")
+    //         .array()
+    //         .assert_contains(|value| value.i64() == uid);
+    //
+    //     // create invite link by group member
+    //     let user1_token = server.login("user1@voce.chat").await;
+    //
+    //     let resp = server
+    //         .get(format!("/api/group/create_reg_magic_link?gid=", gid))
+    //         .header("X-API-Key", &user1_token)
+    //         .send()
+    //         .await;
+    //     resp.assert_status_is_ok();
+    //
+    //     // create invite link by a user not in the group
+    //     server.create_user(&admin_token, "user2@voce.chat").await;
+    //     let user2_token = server.login("user2@voce.chat").await;
+    //
+    //     let resp = server
+    //         .get(format!("/api/group/create_reg_magic_link?gid=", gid))
+    //         .header("X-API-Key", &user2_token)
+    //         .send()
+    //         .await;
+    //     resp.assert_status(StatusCode::FORBIDDEN);
+    // }
+
+    #[tokio::test]
+    async fn pin_messsage() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "description": "abc",
+                "is_public": false,
+                "members": [],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        let mid1 = server.send_text_to_group(&admin_token, gid, "a").await;
+        let mid2 = server.send_text_to_group(&admin_token, gid, "b").await;
+        let mid3 = server.send_text_to_group(&admin_token, gid, "c").await;
+
+        // pin
+        for mid in [mid1, mid2] {
+            let resp = server
+                .post(format!("/api/group/{}/pin", gid))
+                .header("X-API-Key", &admin_token)
+                .body_json(&json!({
+                    "mid": mid,
+                }))
+                .send()
+                .await;
+            resp.assert_status_is_ok();
+        }
+
+        let resp = server.get(format!("/api/group/{}", gid)).send().await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let json = json.value().object();
+
+        let pinned_msgs = json.get("pinned_messages").array();
+        pinned_msgs.assert_len(2);
+
+        let m1 = pinned_msgs.get(0).object();
+        m1.get("mid").assert_i64(mid1);
+        m1.get("content").assert_string("a");
+
+        let m2 = pinned_msgs.get(1).object();
+        m2.get("mid").assert_i64(mid2);
+        m2.get("content").assert_string("b");
+
+        // unpin
+        let resp = server
+            .post(format!("/api/group/{}/unpin", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "mid": mid3,
+            }))
+            .send()
+            .await;
+        resp.assert_status(StatusCode::NOT_FOUND);
+
+        let resp = server
+            .post(format!("/api/group/{}/unpin", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "mid": mid1,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let resp = server.get(format!("/api/group/{}", gid)).send().await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let json = json.value().object();
+
+        let pinned_msgs = json.get("pinned_messages").array();
+        pinned_msgs.assert_len(1);
+
+        let m1 = pinned_msgs.get(0).object();
+        m1.get("mid").assert_i64(mid2);
+        m1.get("content").assert_string("b");
+    }
+
+    #[tokio::test]
+    async fn received_pinned_message_updated_private_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["pinned_message_updated"]))
+            .await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+        let mut events_user1 = server
+            .subscribe_events(&user1_token, Some(&["pinned_message_updated"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "description": "abc",
+                "is_public": false,
+                "members": [uid1],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        let mid1 = server.send_text_to_group(&admin_token, gid, "a").await;
+        let mid2 = server.send_text_to_group(&admin_token, gid, "b").await;
+
+        for mid in [mid1, mid2] {
+            let resp = server
+                .post(format!("/api/group/{}/pin", gid))
+                .header("X-API-Key", &admin_token)
+                .body_json(&json!({
+                    "mid": mid,
+                }))
+                .send()
+                .await;
+            resp.assert_status_is_ok();
+        }
+
+        for events in [&mut events_admin, &mut events_user1] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("gid").assert_i64(gid);
+            obj.get("mid").assert_i64(mid1);
+            let msg = obj.get("msg").object();
+            msg.get("content").assert_string("a");
+
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("gid").assert_i64(gid);
+            obj.get("mid").assert_i64(mid2);
+            let msg = obj.get("msg").object();
+            msg.get("content").assert_string("b");
+        }
+
+        let resp = server
+            .put(format!("/api/message/{}/edit", mid1))
+            .header("X-API-Key", &admin_token)
+            .content_type("text/plain")
+            .body("c")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events_admin, &mut events_user1] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("gid").assert_i64(gid);
+            obj.get("mid").assert_i64(mid1);
+            let msg = obj.get("msg").object();
+            msg.get("content").assert_string("c");
+        }
+
+        let resp = server
+            .delete(format!("/api/message/{}", mid1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events_admin, &mut events_user1] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("gid").assert_i64(gid);
+            obj.get("mid").assert_i64(mid1);
+            obj.get("msg").assert_null();
+        }
+    }
+
+    #[tokio::test]
+    async fn received_pinned_message_updated_public_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["pinned_message_updated"]))
+            .await;
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+        let mut events_user1 = server
+            .subscribe_events(&user1_token, Some(&["pinned_message_updated"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "description": "abc",
+                "is_public": true,
+                "members": [],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        let mid1 = server.send_text_to_group(&admin_token, gid, "a").await;
+        let mid2 = server.send_text_to_group(&admin_token, gid, "b").await;
+
+        for mid in [mid1, mid2] {
+            let resp = server
+                .post(format!("/api/group/{}/pin", gid))
+                .header("X-API-Key", &admin_token)
+                .body_json(&json!({
+                    "mid": mid,
+                }))
+                .send()
+                .await;
+            resp.assert_status_is_ok();
+        }
+
+        for events in [&mut events_admin, &mut events_user1] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("gid").assert_i64(gid);
+            obj.get("mid").assert_i64(mid1);
+            let msg = obj.get("msg").object();
+            msg.get("content").assert_string("a");
+
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("gid").assert_i64(gid);
+            obj.get("mid").assert_i64(mid2);
+            let msg = obj.get("msg").object();
+            msg.get("content").assert_string("b");
+        }
+
+        let resp = server
+            .put(format!("/api/message/{}/edit", mid1))
+            .header("X-API-Key", &admin_token)
+            .content_type("text/plain")
+            .body("c")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events_admin, &mut events_user1] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("gid").assert_i64(gid);
+            obj.get("mid").assert_i64(mid1);
+            let msg = obj.get("msg").object();
+            msg.get("content").assert_string("c");
+        }
+
+        let resp = server
+            .delete(format!("/api/message/{}", mid1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events_admin, &mut events_user1] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("gid").assert_i64(gid);
+            obj.get("mid").assert_i64(mid1);
+            obj.get("msg").assert_null();
+        }
+    }
+}
diff --git a/src/api/langid.rs b/src/api/langid.rs
new file mode 100644
index 0000000..803e875
--- /dev/null
+++ b/src/api/langid.rs
@@ -0,0 +1,134 @@
+use std::{
+    borrow::Cow,
+    fmt::{Display, Formatter},
+    ops::Deref,
+    str::FromStr,
+};
+
+use poem_openapi::registry::{MetaSchema, MetaSchemaRef};
+use serde::{de::Error as _, Deserialize, Deserializer, Serialize, Serializer};
+use serde_json::Value;
+use sqlx::sqlite::SqliteArgumentValue;
+
+/// Language id
+///
+/// Reference: <http://tools.ietf.org/html/bcp47>
+#[derive(Debug, Clone)]
+pub struct LangId(unic_langid::LanguageIdentifier);
+
+impl Default for LangId {
+    fn default() -> Self {
+        Self("en-US".parse().unwrap())
+    }
+}
+
+impl Display for LangId {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
+impl FromStr for LangId {
+    type Err = unic_langid::LanguageIdentifierError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        unic_langid::LanguageIdentifier::from_str(s).map(Self)
+    }
+}
+
+impl Deref for LangId {
+    type Target = unic_langid::LanguageIdentifier;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+impl sqlx::Type<sqlx::Sqlite> for LangId {
+    fn type_info() -> sqlx::sqlite::SqliteTypeInfo {
+        String::type_info()
+    }
+
+    fn compatible(ty: &sqlx::sqlite::SqliteTypeInfo) -> bool {
+        String::compatible(ty)
+    }
+}
+
+impl<'a> sqlx::Decode<'a, sqlx::Sqlite> for LangId {
+    fn decode(value: sqlx::sqlite::SqliteValueRef<'a>) -> Result<Self, sqlx::error::BoxDynError> {
+        let s = String::decode(value)?;
+        let language_tag: unic_langid::LanguageIdentifier = s.parse().map_err(Box::new)?;
+        Ok(Self(language_tag))
+    }
+}
+
+impl<'a> sqlx::Encode<'a, sqlx::Sqlite> for LangId {
+    fn encode_by_ref(
+        &self,
+        buf: &mut Vec<sqlx::sqlite::SqliteArgumentValue<'a>>,
+    ) -> sqlx::encode::IsNull {
+        buf.push(SqliteArgumentValue::Text(Cow::Owned(self.0.to_string())));
+        sqlx::encode::IsNull::No
+    }
+}
+
+impl poem_openapi::types::Type for LangId {
+    const IS_REQUIRED: bool = true;
+    type RawValueType = Self;
+    type RawElementValueType = Self;
+
+    fn name() -> Cow<'static, str> {
+        Cow::Borrowed("string(language)")
+    }
+
+    fn schema_ref() -> MetaSchemaRef {
+        MetaSchemaRef::Inline(Box::new(MetaSchema::new_with_format("string", "language")))
+    }
+
+    fn as_raw_value(&self) -> Option<&Self::RawValueType> {
+        Some(self)
+    }
+
+    fn raw_element_iter<'a>(
+        &'a self,
+    ) -> Box<dyn Iterator<Item = &'a Self::RawElementValueType> + 'a> {
+        Box::new(self.as_raw_value().into_iter())
+    }
+}
+
+impl poem_openapi::types::ParseFromJSON for LangId {
+    fn parse_from_json(value: Option<Value>) -> poem_openapi::types::ParseResult<Self> {
+        let value = value.unwrap_or_default();
+        match &value {
+            Value::String(s) => unic_langid::LanguageIdentifier::from_str(s)
+                .map(Self)
+                .map_err(poem_openapi::types::ParseError::custom),
+            _ => Err(poem_openapi::types::ParseError::expected_type(value)),
+        }
+    }
+}
+
+impl poem_openapi::types::ToJSON for LangId {
+    fn to_json(&self) -> Option<Value> {
+        Some(Value::String(self.0.to_string()))
+    }
+}
+
+impl Serialize for LangId {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        serializer.collect_str(self)
+    }
+}
+
+impl<'de> Deserialize<'de> for LangId {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let s = String::deserialize(deserializer)?;
+        LangId::from_str(&s).map_err(|err| <D::Error>::custom(err.to_string()))
+    }
+}
diff --git a/src/api/license.rs b/src/api/license.rs
new file mode 100644
index 0000000..c218ccd
--- /dev/null
+++ b/src/api/license.rs
@@ -0,0 +1,233 @@
+use chrono::Utc;
+use poem::{web::Data, Error, Result};
+use poem_openapi::{payload::Json, Object, OpenApi};
+use reqwest::StatusCode;
+
+use crate::{
+    api::{tags::ApiTags, token::Token},
+    State,
+};
+
+#[derive(Debug, Object)]
+struct CheckLicenseRequest {
+    license: String,
+}
+
+#[derive(Debug, Object)]
+struct SaveLicenseRequest {
+    license: String,
+}
+
+#[derive(Debug, Object, Clone)]
+pub struct LicenseReply {
+    pub domains: Vec<String>,
+    pub user_limit: u32,
+    pub created_at: chrono::DateTime<Utc>,
+    pub expired_at: chrono::DateTime<Utc>,
+    pub sign: bool,
+    pub base58: String,
+}
+
+pub struct ApiLicense;
+
+pub const VOCE_LICENSE_PUBLIC_KEY_PEM: &str = r#"-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEApqGLPAiVzx42qRkjDGqCT4+BrS3BReJA7UAXQt3YNfw2HIB+CJSD
+F22KnpqmnsaLWmxrUP1Q+ttb+fZhMZ569s5ZLs9h6pq2oTBK8kBUKz127rpwHSpG
+VnuGbkPB4NUcTOYiDTLT7iD9NSN38Cr1ITTD3+4EiSiCuf9aUpggfo06fqF69ebD
+C0pPSTRvIDgKrJiku93c3d1uDq1DWfYKu3GP23ie5+3WwQcsd/XG/0xyMk1hfVQJ
+qTf5Z2rVdmhVGt0XjV6cmaVshJOxGeoAubPLJX4G4DLTvXKGy/WlQlQTqIBz8xUB
+dnwtOymXGQpaS/Vfo0q1kGzZoXsCx3v7BQIDAQAB
+-----END RSA PUBLIC KEY-----"#;
+
+#[OpenApi(prefix_path = "/license", tag = "ApiTags::License")]
+impl ApiLicense {
+    /// Check the license is valid
+    #[oai(path = "/check", method = "post")]
+    async fn check(
+        &self,
+        _state: Data<&State>,
+        req: Json<CheckLicenseRequest>,
+    ) -> Result<Json<LicenseReply>> {
+        let license_bs58 = req.license.clone();
+        let license = vc_license::License::from_string(license_bs58.clone())
+            .map_err(|_err| Error::from_status(StatusCode::BAD_REQUEST))?;
+        let sign_is_ok =
+            vc_license::rsa_check_license_bs58(&license_bs58, VOCE_LICENSE_PUBLIC_KEY_PEM).is_ok();
+
+        Ok(Json(LicenseReply {
+            domains: license.domains.clone(),
+            user_limit: license.user_limit,
+            created_at: license.created_at,
+            expired_at: license.expired_at,
+            sign: sign_is_ok,
+            base58: license_bs58,
+        }))
+    }
+
+    /// Save the license
+    #[oai(path = "/", method = "put")]
+    async fn put(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<SaveLicenseRequest>,
+    ) -> Result<Json<bool>> {
+        let mut license_path = state.config.system.data_dir.clone();
+        license_path.push("license");
+        // if !license_path.exists() || (token.is_some() && token.unwrap().is_admin) {
+        if !license_path.exists() || token.is_admin {
+            crate::license::update_license(&state, &req.license)
+                .await
+                .map_err(|_err| Error::from_status(StatusCode::BAD_REQUEST))?;
+        }
+        Ok(Json(true))
+    }
+
+    /// Get the license
+    #[oai(path = "/", method = "get")]
+    async fn get(&self, state: Data<&State>) -> Result<Json<LicenseReply>> {
+        let mut license_path = state.config.system.data_dir.clone();
+        license_path.push("license");
+        let license_bs58 = tokio::fs::read_to_string(license_path)
+            .await
+            .map_err(|_err| Error::from_status(StatusCode::BAD_REQUEST))?;
+        let license = vc_license::License::from_string(license_bs58.clone())
+            .map_err(|_err| Error::from_status(StatusCode::BAD_REQUEST))?;
+        let sign_is_ok =
+            vc_license::rsa_check_license_bs58(&license_bs58, VOCE_LICENSE_PUBLIC_KEY_PEM).is_ok();
+
+        Ok(Json(LicenseReply {
+            domains: license.domains.clone(),
+            user_limit: license.user_limit,
+            created_at: license.created_at,
+            expired_at: license.expired_at,
+            sign: sign_is_ok,
+            base58: license_bs58,
+        }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use reqwest::StatusCode;
+    use serde_json::json;
+
+    use crate::test_harness::TestServer;
+
+    #[tokio::test]
+    async fn test_check_license() {
+        let server = TestServer::new().await;
+        let resp = server
+            .post("/api/license/check")
+            .body_json(&json!({
+                    "license": "37w6gXBCKnuPHT6Np1QjhUDRacerHsz9eY1UKWVQyBiiHjLPJ96fBTMwKRAZW5USxkDcT73CPAejwrnoomcj2ZzC5m9hb7H2Q6rTxwzenWoJ5Va2dP3AY84NkZt15maJJcDxRnGZSURrEixFHtYfvk5neEUnxY5tDz2fjD42fWo5UnE4n8bjTgCgAFdS4AxMCmuFaVbidgnTEeNdLjwpdP3v4nQwYX9d211Zmiy81UYq2pJfrksAcP4Ew34jAgB1etAvqYnT2fGvUWtA7DfG6yMgx2Hbo52Upo8TMQNnNkAv4ZDHF1AZ8NqXScAXCK7v5MpdkfggrRepwViovnVKku5XSa794aoXtx9q8fQuKUvAShTYNA2qVm5EYZTNpMTgHAtyAuABJN3DFpT8jJiSjQ3pb31Nh5v2yDKGDhYzBgdwpQmKMp82GakMxCKFmhM7E74VEi4avFed4UdqtQzf2iFnobNs3hJyqT5zys9Yws1ff9iY2bUqP9HRNWtzamPFvWSEt7AgSqRfe1cEuJLhU1SDL2zVgydD69FEKfmrTyR43YfRz8mVjuNLcbKmwgNQk4145SpsZ59nrRdfjTo3wqhbSmoip53mhDaVpMkiWzbESy1QrD6ow75C3SNzUgxmoBWceFPgzcZbQixLWVoh2ofUf4yJqw3JqoaJFrrFUAjVafQLN4hKhrSSoNbkrFjM5rGmZ87ZVFkkLrLez6vCGbxFfK8KeiXDBeq4H1VKRmuy2G9VVDYLNvGFfNpy2YLYnsiXCY8rEyGctteU9i94jbHn1zN9vinyBcgkY",
+                }))
+            .header("Referer", "http://localhost/")
+            .send()
+            .await;
+
+        let json = resp.json().await;
+        assert_eq!(
+            json.value().object().get("domains").string_array()[0],
+            "www.domain.com"
+        );
+        assert!(json.value().object().get("sign").bool());
+
+        let server = TestServer::new().await;
+        let resp = server
+            .post("/api/license/check")
+            // .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "license": "bad",
+            }))
+            .header("Referer", "http://localhost/")
+            .send()
+            .await;
+        resp.assert_status(StatusCode::BAD_REQUEST);
+    }
+
+    #[tokio::test]
+    async fn test_save_license() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let resp = server
+            .put("/api/license")
+            .header("Referer", "http://localhost/")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                        "license": "2mLNGnEXac5XNmKftu2P8p9hiaqReiUTscKftwNJuKQyLLBYh7JZ6JzC4Vsehw375PfgAksxtLCFy9dLvetiN7nKDtsQGBj5VBhJ9XPtKsbbfrQSyG2bPdaEyM2KuH6YhvnhfSMbnA5deVH5C4uJ8zkwckFPqchmeDiwXobJeNKKRYzpkef5ggS7WeRnWNRrtXjEXkqsYW1aBb3bmAGR9XQzJcyvGYPAmDwRTLfiyNKCmma1ADeQAyhsooiBB4Q56XQ7cBs55VrUPHmvEisaeNnwU4Y9cihvWRz8HfdFhNs2dsCR2hSnDG6mEbtcoTVVaFonhQGKb9nMrDcFiNoidiSazpUWqVHG1SbcCNiwQweZ8VYRxMDVYXFLTXX2rg17jsY4mMvVHp5sqMjHvQRH4ueZtjVHVRYq4Ra21VUZBMcbLmD56RB1nMveWbAWuppENKtvg5MdByVC9Ah5oca34irHGoJMN2DrXCBxLrf21ushhY1gbXw5f4KETaod2EogivongR3g1UoU3FtiKzXbLMspGzJnBzZeij9UdqBNP8jnSiu667bpGYJSAMjJzPXtZ4oL5U5fFY14wQ5ssLssvQx5XyeGBRMKUphZT5EXL9VyTHYX2EU3Z9nQRNpumXkn4PPUQwZcbJbAeEkRbZDEsiG6g3fwFovfZffXkm5w8qCZ37DuaZkp4FgeLjNHgg3jyLM4VyirWgLkxQ2y7qL7hYSBQPzqpQVfkfYiZY9Tw4WG6cZrvUSmmnaLpDJBwwXxCxg1GaqoypusBMT5Mhw22PcLkmN8e8zS1NaXm3KVijukGQAaHTAc4EYDEASbjiSCavMipqd8Mbsj6j",
+                    }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    // #[tokio::test]
+    // async fn test_license_user_limit() {
+    //     let server = TestServer::new().await;
+    //     let state = server.state();
+    //     crate::license::load_license(&state).await.unwrap();
+    //
+    //     // test user limit
+    //     let admin_token = server.login_admin().await;
+    //     for i in 0..30 {
+    //         // user default limit: 20
+    //         server.create_user(&admin_token, format!("user{}@voce.chat",
+    // i)).await;     }
+    //
+    //     let resp = server
+    //         .post("/api/user/send_login_magic_link")
+    //         .query("email", &"xx@xx.com")
+    //         .header("Referer", "http://localhost/")
+    //         .send()
+    //         .await;
+    //     // resp.assert_text("").await;
+    //     resp.assert_text("License error: Users reached limit.").await;
+    // }
+
+    #[tokio::test]
+    async fn test_license_invalid_sign() {
+        // test sign invalid
+        let server = TestServer::new().await;
+        let state = server.state();
+        crate::license::load_license(state).await.unwrap();
+        let invalid_sign_license = "Jym9MkwzuPBfKKPkYVKJfGeGVbpx8pHeWrLM5zPNoSf3GrrwNCowRGgowUX2LULLzMpdLUcSvrHTHLpYRhKDc5JFyPVNqoKxiWfcCwGzn";
+        crate::license::update_license(state, invalid_sign_license)
+            .await
+            .unwrap();
+        let resp = server
+            .post("/api/user/send_login_magic_link")
+            .query("email", &"xx@xx.com")
+            .header("Referer", "http://www.domain.com/")
+            .send()
+            .await;
+        resp.assert_text("License error: Sign invalid.").await;
+    }
+
+    #[tokio::test]
+    async fn test_license_invalid_sign2() {
+        // test sign invalid
+        let server = TestServer::new().await;
+        let state = server.state();
+        crate::license::load_license(state).await.unwrap();
+        let invalid_sign_license = "Jym9MkwzuPBfKKPkYVKJfGeGVbpx8pHeWrLM5zPNoSf3GrrwNCowRGgowUX2LULLzMpdLUcSvrHTHLpYRhKDc5JFyPVNqoKxiWfcCwGzn";
+        crate::license::update_license(state, invalid_sign_license)
+            .await
+            .unwrap();
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "magiclink",
+                    "magic_token": "test",
+                    "extra_name": "jack"
+                },
+                "device": "web",
+                "device_token": "device token",
+            }))
+            .header("Referer", "http://www.domain.com/")
+            .send()
+            .await;
+        resp.assert_text("License error: Sign invalid.").await;
+    }
+}
diff --git a/src/api/message.rs b/src/api/message.rs
new file mode 100644
index 0000000..0b7812c
--- /dev/null
+++ b/src/api/message.rs
@@ -0,0 +1,1019 @@
+use std::{
+    collections::{HashMap, HashSet},
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use itertools::Itertools;
+use poem::{
+    error::{BadRequest, InternalServerError},
+    http::StatusCode,
+    Error, Result,
+};
+use poem_openapi::{
+    payload::{Json, PlainText},
+    ApiRequest, Enum, Object, Union,
+};
+use rc_msgdb::MsgDb;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use crate::{
+    api::{
+        group::Group, resource::FileMeta, user::UserInfo, DateTime, FcmConfig, LangId,
+        PinnedMessage, UpdateAction,
+    },
+    state::{BroadcastEvent, Cache, UserStatus},
+    State,
+};
+
+/// Message target user
+#[derive(Debug, Object, Copy, Clone, Serialize, Deserialize)]
+pub struct MessageTargetUser {
+    pub uid: i64,
+}
+
+/// Message target group
+#[derive(Debug, Object, Copy, Clone, Serialize, Deserialize)]
+pub struct MessageTargetGroup {
+    pub gid: i64,
+}
+
+/// Message target
+#[derive(Debug, Union, Copy, Clone, Serialize, Deserialize)]
+pub enum MessageTarget {
+    User(MessageTargetUser),
+    Group(MessageTargetGroup),
+}
+
+impl MessageTarget {
+    #[inline]
+    pub fn user(uid: i64) -> Self {
+        MessageTarget::User(MessageTargetUser { uid })
+    }
+
+    #[inline]
+    pub fn group(gid: i64) -> Self {
+        MessageTarget::Group(MessageTargetGroup { gid })
+    }
+}
+
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct ChatMessageContent {
+    /// Extended attributes
+    pub properties: Option<HashMap<String, Value>>,
+
+    /// Content type
+    pub content_type: String,
+
+    /// Content
+    pub content: String,
+}
+
+impl ChatMessageContent {
+    fn notify_message(&self, cache: &Cache, mentions: &HashSet<i64>) -> Option<String> {
+        match self.content_type.as_str() {
+            "text/plain" => {
+                if mentions.is_empty() {
+                    Some(self.content.clone())
+                } else {
+                    let mut msg = self.content.clone();
+                    for uid in mentions {
+                        if let Some(user) = cache.users.get(uid) {
+                            msg = msg.replace(&format!(" @{} ", uid), &format!(" @{} ", user.name));
+                        }
+                    }
+                    Some(msg)
+                }
+            }
+            "text/markdown" => Some("You have a new message".to_string()),
+            "vocechat/file" => Some("You have a new file".to_string()),
+            _ => None,
+        }
+    }
+}
+
+/// Normal message
+///
+/// content_type match properties as following:
+/// ##### application/octet-stream
+///    - id: String(UUID)
+///    - name: String
+///    - size: i64
+///    - hash: String(SHA-256)
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct MessageNormal {
+    #[oai(flatten)]
+    pub content: ChatMessageContent,
+
+    /// Expires in seconds
+    pub expires_in: Option<i64>,
+}
+
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct MessageReply {
+    pub mid: i64,
+    #[oai(flatten)]
+    pub content: ChatMessageContent,
+}
+
+/// Message reaction edit
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct MessageReactionEdit {
+    #[oai(flatten)]
+    pub content: ChatMessageContent,
+}
+
+/// Message reaction like
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct MessageReactionLike {
+    pub action: String,
+}
+
+const ALLOWED_EMOJI: &[&str] = &["��", "😄", "👀", "�", "👎", "🎉", "�", "🚀"];
+
+impl MessageReactionLike {
+    pub fn check(&self) -> bool {
+        ALLOWED_EMOJI.contains(&self.action.as_str())
+    }
+}
+
+/// Message reaction delete
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct MessageReactionDelete {}
+
+#[derive(Debug, Union, Clone, Serialize, Deserialize)]
+#[oai(discriminator_name = "type")]
+pub enum MessageReactionDetail {
+    #[oai(mapping = "edit")]
+    Edit(MessageReactionEdit),
+    #[oai(mapping = "like")]
+    Like(MessageReactionLike),
+    #[oai(mapping = "delete")]
+    Delete(MessageReactionDelete),
+}
+
+impl MessageReactionDetail {
+    pub fn can_reaction(
+        &self,
+        current_uid: i64,
+        is_admin: bool,
+        payload: &ChatMessagePayload,
+    ) -> bool {
+        if !matches!(
+            &payload.detail,
+            MessageDetail::Normal(_) | MessageDetail::Reply(_)
+        ) {
+            return false;
+        }
+
+        match self {
+            MessageReactionDetail::Edit(_) => current_uid == payload.from_uid,
+            MessageReactionDetail::Like(_) => true,
+            MessageReactionDetail::Delete(_) => current_uid == payload.from_uid || is_admin,
+        }
+    }
+}
+
+/// Normal reaction
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct MessageReaction {
+    pub mid: i64,
+    pub detail: MessageReactionDetail,
+}
+
+#[derive(Debug, Union, Clone, Serialize, Deserialize)]
+#[oai(discriminator_name = "type")]
+pub enum MessageDetail {
+    #[oai(mapping = "normal")]
+    Normal(MessageNormal),
+    #[oai(mapping = "reaction")]
+    Reaction(MessageReaction),
+    #[oai(mapping = "reply")]
+    Reply(MessageReply),
+}
+
+impl MessageDetail {
+    pub fn as_normal_mut(&mut self) -> Option<&mut MessageNormal> {
+        match self {
+            MessageDetail::Normal(normal) => Some(normal),
+            _ => None,
+        }
+    }
+}
+
+/// Chat message payload
+#[derive(Debug, Object, Clone, Serialize, Deserialize)]
+pub struct ChatMessagePayload {
+    /// Sender id
+    pub from_uid: i64,
+
+    /// The create time of the message.
+    pub created_at: DateTime,
+
+    /// Message target
+    pub target: MessageTarget,
+
+    /// Message detail
+    pub detail: MessageDetail,
+}
+
+impl ChatMessagePayload {
+    pub fn notify_message(&self, cache: &Cache, mentions: &HashSet<i64>) -> Option<String> {
+        match &self.detail {
+            MessageDetail::Normal(MessageNormal { content, .. }) => {
+                content.notify_message(cache, mentions)
+            }
+            MessageDetail::Reply(MessageReply { content, .. }) => {
+                content.notify_message(cache, mentions)
+            }
+            _ => None,
+        }
+    }
+}
+
+/// Merged chat message payload
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct MergedMessagePayload {
+    pub from_uid: i64,
+    /// Message target
+    pub target: MessageTarget,
+    pub content: ChatMessageContent,
+    pub created_at: DateTime,
+}
+
+/// Chat message
+#[derive(Debug, Object, Clone)]
+pub struct ChatMessage {
+    /// Message id
+    pub mid: i64,
+    #[oai(flatten)]
+    pub payload: ChatMessagePayload,
+}
+
+/// Kick reason
+#[derive(Debug, Enum, Copy, Clone, Eq, PartialEq)]
+#[oai(rename_all = "snake_case")]
+pub enum KickReason {
+    /// Login from other device
+    LoginFromOtherDevice,
+
+    /// User has been deleted
+    DeleteUser,
+
+    /// Device has been deleted
+    DeleteDevice,
+
+    /// Logout
+    Logout,
+
+    /// Frozen
+    Frozen,
+}
+
+/// Kick message
+#[derive(Debug, Object, Clone)]
+pub struct KickMessage {
+    pub reason: KickReason,
+}
+
+/// Session ready message
+#[derive(Debug, Object, Clone)]
+pub struct SessionReadyMessage {}
+
+/// Heartbeat message
+#[derive(Debug, Object, Clone)]
+pub struct HeartbeatMessage {
+    pub time: DateTime,
+}
+
+/// User snapshot message
+#[derive(Debug, Object, Clone)]
+pub struct UsersSnapshotMessage {
+    /// A snapshot of all user information.
+    pub users: Vec<UserInfo>,
+
+    /// User information version.
+    pub version: i64,
+}
+
+/// User state
+#[derive(Debug, Object, Clone)]
+pub struct UserState {
+    pub uid: i64,
+    pub online: bool,
+}
+
+/// User state message
+#[derive(Debug, Object, Clone)]
+pub struct UsersStateMessage {
+    pub users: Vec<UserState>,
+}
+
+#[derive(Debug, Object, Clone)]
+pub struct UserStateChangedMessage {
+    pub uid: i64,
+    pub online: Option<bool>,
+}
+
+/// User update log
+#[derive(Debug, Object, Clone)]
+pub struct UserUpdateLog {
+    /// Log id(version)
+    pub log_id: i64,
+    pub action: UpdateAction,
+    pub uid: i64,
+    pub email: Option<String>,
+    pub name: Option<String>,
+    pub gender: Option<i32>,
+    pub language: Option<LangId>,
+    pub is_admin: Option<bool>,
+    pub is_bot: Option<bool>,
+    pub avatar_updated_at: Option<DateTime>,
+}
+
+/// User update log message
+#[derive(Debug, Object, Clone)]
+pub struct UsersUpdateLogMessage {
+    /// Logs
+    pub logs: Vec<UserUpdateLog>,
+}
+
+/// Related groups message
+#[derive(Debug, Object, Clone)]
+pub struct RelatedGroupsMessage {
+    pub groups: Vec<Group>,
+}
+
+/// Other users joined group message
+#[derive(Debug, Object, Clone)]
+pub struct UserJoinedGroupMessage {
+    /// Group id
+    pub gid: i64,
+
+    /// Users id
+    pub uid: Vec<i64>,
+}
+
+/// Other users leaved group message
+#[derive(Debug, Object, Clone)]
+pub struct UserLeavedGroupMessage {
+    /// Group id
+    pub gid: i64,
+
+    /// Users id
+    pub uid: Vec<i64>,
+}
+
+/// Joined group message
+#[derive(Debug, Object, Clone)]
+pub struct JoinedGroupMessage {
+    /// Group
+    pub group: Group,
+}
+
+/// User leaved group reason
+#[derive(Debug, Enum, Copy, Clone)]
+#[oai(rename_all = "snake_case")]
+pub enum KickFromGroupReason {
+    /// Kick by owner or admin
+    Kick,
+    /// Group deleted
+    GroupDeleted,
+}
+
+/// Kick from group message
+#[derive(Debug, Object, Clone)]
+pub struct KickFromGroupMessage {
+    /// Group id
+    pub gid: i64,
+
+    /// Reason
+    pub reason: KickFromGroupReason,
+}
+
+/// Group info changed message
+#[derive(Debug, Object, Clone)]
+pub struct GroupChangedMessage {
+    /// Group id
+    pub gid: i64,
+    pub name: Option<String>,
+    pub description: Option<String>,
+    pub owner: Option<i64>,
+    pub avatar_updated_at: Option<DateTime>,
+    pub is_public: Option<bool>,
+}
+
+/// Pinned message updated
+#[derive(Debug, Object, Clone)]
+pub struct PinnedMessageUpdated {
+    pub gid: i64,
+    pub mid: i64,
+    pub msg: Option<PinnedMessage>,
+}
+
+/// Mute user
+#[derive(Debug, Object, Clone)]
+pub struct MuteUser {
+    /// User id
+    pub uid: i64,
+    /// Expired at
+    pub expired_at: Option<DateTime>,
+}
+
+/// Mute group
+#[derive(Debug, Object, Clone)]
+pub struct MuteGroup {
+    /// Group id
+    pub gid: i64,
+    /// Expired at
+    pub expired_at: Option<DateTime>,
+}
+
+/// Read index to user
+#[derive(Debug, Object, Clone)]
+pub struct ReadIndexUser {
+    /// User id
+    pub uid: i64,
+    /// Message id
+    pub mid: i64,
+}
+
+/// Read index to group
+#[derive(Debug, Object, Clone)]
+pub struct ReadIndexGroup {
+    /// Group id
+    pub gid: i64,
+    /// Message id
+    pub mid: i64,
+}
+
+/// Burn after reading to user
+#[derive(Debug, Object, Clone)]
+pub struct BurnAfterReadingUser {
+    /// User id
+    pub uid: i64,
+    /// Expires in seconds
+    pub expires_in: i64,
+}
+
+/// Burn after reading to group
+#[derive(Debug, Object, Clone)]
+pub struct BurnAfterReadingGroup {
+    /// Group id
+    pub gid: i64,
+    /// Expires in seconds
+    pub expires_in: i64,
+}
+
+/// User settings message
+#[derive(Debug, Object, Clone)]
+pub struct UserSettingsMessage {
+    pub mute_users: Vec<MuteUser>,
+    pub mute_groups: Vec<MuteGroup>,
+    pub read_index_users: Vec<ReadIndexUser>,
+    pub read_index_groups: Vec<ReadIndexGroup>,
+    pub burn_after_reading_users: Vec<BurnAfterReadingUser>,
+    pub burn_after_reading_groups: Vec<BurnAfterReadingGroup>,
+}
+
+/// User setting changed message
+#[derive(Debug, Object, Clone, Default)]
+pub struct UserSettingsChangedMessage {
+    pub from_device: String,
+    pub add_mute_users: Vec<MuteUser>,
+    pub remove_mute_users: Vec<i64>,
+    pub add_mute_groups: Vec<MuteGroup>,
+    pub remove_mute_groups: Vec<i64>,
+    pub read_index_users: Vec<ReadIndexUser>,
+    pub read_index_groups: Vec<ReadIndexGroup>,
+    pub burn_after_reading_users: Vec<BurnAfterReadingUser>,
+    pub burn_after_reading_groups: Vec<BurnAfterReadingGroup>,
+}
+
+/// Message
+#[derive(Debug, Union, Clone)]
+#[oai(discriminator_name = "type")]
+pub enum Message {
+    #[oai(mapping = "ready")]
+    Ready(SessionReadyMessage),
+    #[oai(mapping = "users_snapshot")]
+    UsersSnapshot(UsersSnapshotMessage),
+    #[oai(mapping = "users_log")]
+    UsersUpdateLog(UsersUpdateLogMessage),
+    #[oai(mapping = "users_state")]
+    UsersState(UsersStateMessage),
+    #[oai(mapping = "users_state_changed")]
+    UserStateChanged(UserStateChangedMessage),
+    #[oai(mapping = "user_settings")]
+    UserSettings(UserSettingsMessage),
+    #[oai(mapping = "user_settings_changed")]
+    UserSettingsChanged(UserSettingsChangedMessage),
+    #[oai(mapping = "related_groups")]
+    RelatedGroups(RelatedGroupsMessage),
+    #[oai(mapping = "chat")]
+    Chat(ChatMessage),
+    #[oai(mapping = "kick")]
+    Kick(KickMessage),
+    #[oai(mapping = "user_joined_group")]
+    UserJoinedGroup(UserJoinedGroupMessage),
+    #[oai(mapping = "user_leaved_group")]
+    UserLeavedGroup(UserLeavedGroupMessage),
+    #[oai(mapping = "joined_group")]
+    JoinedGroup(JoinedGroupMessage),
+    #[oai(mapping = "kick_from_group")]
+    KickFromGroup(KickFromGroupMessage),
+    #[oai(mapping = "group_changed")]
+    GroupChanged(GroupChangedMessage),
+    #[oai(mapping = "pinned_message_updated")]
+    PinnedMessageUpdated(PinnedMessageUpdated),
+    #[oai(mapping = "heartbeat")]
+    Heartbeat(HeartbeatMessage),
+}
+
+#[derive(Debug, Object)]
+pub struct FileInfo {
+    pub path: String,
+}
+
+#[derive(Debug, ApiRequest)]
+pub enum SendMessageRequest {
+    Text(PlainText<String>),
+    #[oai(content_type = "text/markdown")]
+    Markdown(PlainText<String>),
+    #[oai(content_type = "vocechat/file")]
+    File(Json<FileInfo>),
+    #[oai(content_type = "vocechat/archive")]
+    Archive(PlainText<String>),
+}
+
+impl SendMessageRequest {
+    pub async fn into_chat_message_content(
+        self,
+        state: &State,
+        properties: Option<HashMap<String, Value>>,
+    ) -> Result<ChatMessageContent> {
+        match self {
+            SendMessageRequest::Text(text) => Ok(ChatMessageContent {
+                properties,
+                content_type: "text/plain".to_string(),
+                content: text.0,
+            }),
+            SendMessageRequest::Markdown(text) => Ok(ChatMessageContent {
+                properties,
+                content_type: "text/markdown".to_string(),
+                content: text.0,
+            }),
+            SendMessageRequest::File(Json(file_info)) => Ok(ChatMessageContent {
+                properties: Some({
+                    let mut properties = properties.unwrap_or_default();
+                    let base_dir = state.config.system.file_dir();
+                    let path = base_dir.join(&file_info.path);
+                    let path_meta = base_dir.join(&file_info.path).with_extension("meta");
+
+                    let filesize = {
+                        let metadata = tokio::fs::metadata(&path).await.map_err(BadRequest)?;
+                        metadata.len()
+                    };
+                    let meta = tokio::fs::read(&path_meta)
+                        .await
+                        .ok()
+                        .and_then(|data| serde_json::from_slice::<FileMeta>(&data).ok())
+                        .unwrap_or_else(|| FileMeta {
+                            content_type: "application/octet-stream".to_string(),
+                            filename: None,
+                        });
+
+                    if let Some(filename) = meta.filename {
+                        properties.insert("name".to_string(), filename.into());
+                    }
+                    properties.insert("content_type".to_string(), meta.content_type.into());
+                    properties.insert("size".to_string(), filesize.into());
+                    properties
+                }),
+                content_type: "vocechat/file".to_string(),
+                content: file_info.path,
+            }),
+            SendMessageRequest::Archive(path) => Ok(ChatMessageContent {
+                properties,
+                content_type: "vocechat/archive".to_string(),
+                content: path.0,
+            }),
+        }
+    }
+
+    pub async fn into_chat_message_payload(
+        self,
+        state: &State,
+        from_uid: i64,
+        target: MessageTarget,
+        properties: Option<HashMap<String, Value>>,
+    ) -> Result<ChatMessagePayload> {
+        Ok(ChatMessagePayload {
+            from_uid,
+            created_at: DateTime::now(),
+            target,
+            detail: MessageDetail::Normal(MessageNormal {
+                content: self.into_chat_message_content(state, properties).await?,
+                expires_in: None,
+            }),
+        })
+    }
+}
+
+pub fn decode_messages(rows: Vec<(i64, Vec<u8>)>) -> Vec<ChatMessage> {
+    rows.into_iter()
+        .filter_map(|(mid, data)| {
+            serde_json::from_slice::<ChatMessagePayload>(&data)
+                .ok()
+                .map(|payload| ChatMessage { mid, payload })
+        })
+        .collect()
+}
+
+enum InternalSendMessageTarget {
+    Group { gid: i64, targets: Vec<i64> },
+    Dm { from_uid: i64, to_uid: i64 },
+}
+
+fn internal_send_message(
+    state: &State,
+    target: InternalSendMessageTarget,
+    payload: ChatMessagePayload,
+) -> poem::Result<i64> {
+    let (msg_id, targets) = match target {
+        InternalSendMessageTarget::Group { gid, targets } => {
+            // send message to group
+            let mid = state
+                .msg_db
+                .messages()
+                .send_to_group(
+                    gid,
+                    targets.iter().copied(),
+                    &serde_json::to_vec(&payload).map_err(InternalServerError)?,
+                )
+                .map_err(InternalServerError)?;
+            (mid, targets)
+        }
+        InternalSendMessageTarget::Dm { from_uid, to_uid } => {
+            // send message to dm
+            let mid = state
+                .msg_db
+                .messages()
+                .send_to_dm(
+                    from_uid,
+                    to_uid,
+                    &serde_json::to_vec(&payload).map_err(InternalServerError)?,
+                )
+                .map_err(InternalServerError)?;
+            (mid, vec![from_uid, to_uid])
+        }
+    };
+
+    // update merged message
+    let merged_id = match &payload.detail {
+        MessageDetail::Normal(normal) => {
+            let merged_payload = MergedMessagePayload {
+                from_uid: payload.from_uid,
+                target: payload.target,
+                content: normal.content.clone(),
+                created_at: payload.created_at,
+            };
+
+            state
+                .msg_db
+                .messages()
+                .insert_merged_msg(
+                    msg_id,
+                    &serde_json::to_vec(&merged_payload).map_err(InternalServerError)?,
+                )
+                .map_err(InternalServerError)?;
+
+            Some(msg_id)
+        }
+        MessageDetail::Reaction(reaction) => match &reaction.detail {
+            MessageReactionDetail::Edit(edit) => {
+                state
+                    .msg_db
+                    .messages()
+                    .update_merged_msg(reaction.mid, |data| {
+                        match serde_json::from_slice::<MergedMessagePayload>(data) {
+                            Ok(mut merged_payload) => {
+                                merged_payload.content = edit.content.clone();
+                                serde_json::to_vec(&merged_payload)
+                                    .unwrap_or_else(|_| data.to_vec())
+                            }
+                            Err(_) => data.to_vec(),
+                        }
+                    })
+                    .map_err(InternalServerError)?;
+
+                Some(reaction.mid)
+            }
+            MessageReactionDetail::Like(_) => None,
+            MessageReactionDetail::Delete(_) => None,
+        },
+        MessageDetail::Reply(reply) => {
+            let merged_payload = MergedMessagePayload {
+                from_uid: payload.from_uid,
+                target: payload.target,
+                content: reply.content.clone(),
+                created_at: payload.created_at,
+            };
+
+            state
+                .msg_db
+                .messages()
+                .insert_merged_msg(
+                    msg_id,
+                    &serde_json::to_vec(&merged_payload).map_err(InternalServerError)?,
+                )
+                .map_err(InternalServerError)?;
+
+            Some(msg_id)
+        }
+    };
+
+    // broadcast message
+    let _ = state.event_sender.send(Arc::new(BroadcastEvent::Chat {
+        targets: targets.into_iter().collect(),
+        message: ChatMessage {
+            mid: msg_id,
+            payload,
+        },
+    }));
+
+    if let Some(merged_id) = merged_id {
+        let _ = state.msg_updated_channel.send(merged_id);
+    }
+    Ok(msg_id)
+}
+
+pub async fn send_message(state: &State, mut payload: ChatMessagePayload) -> poem::Result<i64> {
+    let cache = state.cache.read().await;
+
+    // set expires_in
+    if let Some(normal) = payload.detail.as_normal_mut() {
+        let current_user = cache
+            .users
+            .get(&payload.from_uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        normal.expires_in = match payload.target {
+            MessageTarget::User(MessageTargetUser { uid }) => {
+                current_user.burn_after_reading_to_user_expires_in(uid)
+            }
+            MessageTarget::Group(MessageTargetGroup { gid }) => {
+                current_user.burn_after_reading_to_group_expires_in(gid)
+            }
+        };
+    }
+
+    let mentions = match &payload.detail {
+        MessageDetail::Normal(normal) => normal
+            .content
+            .properties
+            .as_ref()
+            .and_then(|properties| properties.get("mentions")),
+        MessageDetail::Reaction(_) => None,
+        MessageDetail::Reply(reply) => reply
+            .content
+            .properties
+            .as_ref()
+            .and_then(|properties| properties.get("mentions")),
+    };
+    let mentions = mentions.and_then(|value| value.as_array());
+    let mentions = match mentions {
+        Some(mentions) => mentions
+            .iter()
+            .filter_map(|value| value.as_i64())
+            .collect::<HashSet<_>>(),
+        None => Default::default(),
+    };
+
+    // do send
+    let from_uid = payload.from_uid;
+    let mid = match payload.target {
+        MessageTarget::User(MessageTargetUser { uid }) => {
+            // send notify
+            if let Some(user) = cache.users.get(&payload.from_uid) {
+                if user.status == UserStatus::Normal {
+                    if let Some(notify_message) = payload.notify_message(&cache, &mentions) {
+                        let target_user = match cache.users.get(&uid) {
+                            Some(user) => user,
+                            None => return Err(Error::from_status(StatusCode::NOT_FOUND)),
+                        };
+
+                        let notify_tokens = if !target_user.is_user_muted(payload.from_uid) {
+                            target_user
+                                .devices
+                                .values()
+                                .filter_map(|device| device.device_token.clone())
+                                .collect_vec()
+                        } else {
+                            vec![]
+                        };
+
+                        let key_config = state.key_config.read().await;
+                        let data = serde_json::json!({
+                            "vocechat_server_id": &key_config.server_id,
+                            "vocechat_from_uid": from_uid.to_string(),
+                            "vocechat_to_uid": uid.to_string(),
+                        });
+
+                        send_notify(
+                            state.clone(),
+                            notify_tokens,
+                            user.name.clone(),
+                            notify_message,
+                            data,
+                        )
+                        .await;
+                    }
+                }
+            };
+
+            // send message
+            tokio::task::spawn_blocking({
+                let state = state.clone();
+                move || {
+                    internal_send_message(
+                        &state,
+                        InternalSendMessageTarget::Dm {
+                            from_uid,
+                            to_uid: uid,
+                        },
+                        payload,
+                    )
+                }
+            })
+            .await
+            .map_err(InternalServerError)??
+        }
+        MessageTarget::Group(MessageTargetGroup { gid }) => {
+            let notify_message = payload.notify_message(&cache, &mentions);
+
+            let group = match cache.groups.get(&gid) {
+                Some(group) => group,
+                None => return Err(Error::from_status(StatusCode::NOT_FOUND)),
+            };
+
+            if !group.ty.is_public() && !group.members.contains(&from_uid) {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+
+            let target_users = if !group.ty.is_public() {
+                group.members.iter().copied().collect::<Vec<_>>()
+            } else {
+                cache.users.keys().copied().collect::<Vec<_>>()
+            };
+
+            // send notify
+            if let Some(user) = cache.users.get(&payload.from_uid) {
+                if let Some(notify_message) = notify_message {
+                    let key_config = state.key_config.read().await;
+                    let data = serde_json::json!({
+                        "vocechat_server_id": &key_config.server_id,
+                        "vocechat_from_uid": from_uid.to_string(),
+                        "vocechat_to_gid": gid.to_string(),
+                    });
+
+                    let notify_tokens = target_users
+                        .iter()
+                        .filter_map(|uid| match cache.users.get(uid) {
+                            Some(user) if *uid != payload.from_uid => {
+                                if user.status != UserStatus::Normal {
+                                    return None;
+                                }
+
+                                if mentions.contains(uid) || !user.is_group_muted(gid) {
+                                    Some(
+                                        user.devices
+                                            .values()
+                                            .filter_map(|device| device.device_token.clone()),
+                                    )
+                                } else {
+                                    None
+                                }
+                            }
+                            _ => None,
+                        })
+                        .flatten()
+                        .collect::<Vec<_>>();
+
+                    send_notify(
+                        state.clone(),
+                        notify_tokens,
+                        group.name.clone(),
+                        format!("{}: {}", user.name, notify_message),
+                        data,
+                    )
+                    .await;
+                }
+            }
+
+            // send message
+            tokio::task::spawn_blocking({
+                let state = state.clone();
+                move || {
+                    internal_send_message(
+                        &state,
+                        InternalSendMessageTarget::Group {
+                            gid,
+                            targets: target_users,
+                        },
+                        payload,
+                    )
+                }
+            })
+            .await
+            .map_err(InternalServerError)??
+        }
+    };
+
+    Ok(mid)
+}
+
+async fn send_notify(
+    state: State,
+    notify_tokens: Vec<String>,
+    title: String,
+    message: String,
+    data: impl Serialize + Send + Sync + 'static,
+) {
+    let notify_start_time = Instant::now();
+    if !notify_tokens.is_empty() {
+        let fut = async move {
+            if let Some(fcm_client) = state.get_dynamic_config_instance::<FcmConfig>().await {
+                for token in notify_tokens {
+                    if state.invalid_device_tokens.lock().contains(&token) {
+                        continue;
+                    }
+
+                    if Instant::now() - notify_start_time > Duration::from_secs(60) {
+                        break;
+                    }
+
+                    tracing::info!(
+                        device_token = token.as_str(),
+                        message = message.as_str(),
+                        "send notify"
+                    );
+                    if let Err(err) = fcm_client.send(&token, &title, &message, &data).await {
+                        if let Some(req_err) = err.downcast_ref::<reqwest::Error>() {
+                            if let Some(StatusCode::BAD_REQUEST) = req_err.status() {
+                                state.invalid_device_tokens.lock().insert(token);
+                                continue;
+                            }
+                        }
+
+                        tracing::error!(
+                            device_token = token.as_str(),
+                            error = %err, "failed to send notify with firebase",
+                        );
+                    }
+                }
+            }
+        };
+        tokio::spawn(fut);
+    }
+}
+
+pub fn parse_properties_from_base64(s: Option<impl AsRef<str>>) -> Option<HashMap<String, Value>> {
+    s.and_then(|s| {
+        base64::decode(s.as_ref())
+            .ok()
+            .and_then(|data| serde_json::from_slice(&data).ok())
+    })
+}
+
+pub fn get_merged_message(db: &MsgDb, mid: i64) -> poem::Result<Option<MergedMessagePayload>> {
+    Ok(db
+        .messages()
+        .get_merged_msg(mid)
+        .map_err(InternalServerError)?
+        .and_then(|data| serde_json::from_slice(&data).ok()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn check_like_emoji(s: &str, r: bool) {
+        assert_eq!(
+            MessageReactionLike {
+                action: s.to_string()
+            }
+            .check(),
+            r
+        );
+    }
+
+    #[test]
+    fn like_emoji() {
+        check_like_emoji("a", false);
+        check_like_emoji("ab", false);
+        check_like_emoji("��", true);
+        check_like_emoji("😄", true);
+        check_like_emoji("😄��", false);
+    }
+}
diff --git a/src/api/message_api.rs b/src/api/message_api.rs
new file mode 100644
index 0000000..7475584
--- /dev/null
+++ b/src/api/message_api.rs
@@ -0,0 +1,404 @@
+use poem::{error::InternalServerError, http::StatusCode, web::Data, Error, Result};
+use poem_openapi::{
+    param::{Header, Path},
+    payload::Json,
+    ApiResponse, Object, OpenApi,
+};
+
+use crate::{
+    api::{
+        message::{
+            parse_properties_from_base64, send_message, MessageDetail, MessageReaction,
+            MessageReactionDelete, MessageReactionDetail, MessageReactionEdit, MessageReactionLike,
+            MessageReply, SendMessageRequest,
+        },
+        tags::ApiTags,
+        token::Token,
+        ChatMessagePayload, DateTime, MessageTarget, MessageTargetGroup, MessageTargetUser,
+    },
+    middleware::guest_forbidden,
+    State,
+};
+
+pub struct ApiMessage;
+
+#[derive(Debug, Object)]
+struct LikeMessageRequest {
+    action: String,
+}
+
+#[derive(ApiResponse)]
+enum ReactionApiResponse {
+    /// Success
+    #[oai(status = 200)]
+    Ok(Json<i64>),
+    /// Target user does not exist
+    #[oai(status = 404)]
+    MessageDoesNotExist,
+    #[oai(status = 403)]
+    Forbidden,
+}
+
+#[OpenApi(prefix_path = "/message", tag = "ApiTags::Message")]
+impl ApiMessage {
+    /// Edit message
+    #[oai(path = "/:mid/edit", method = "put", transform = "guest_forbidden")]
+    async fn edit(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        mid: Path<i64>,
+        #[oai(name = "X-Properties")] properties: Header<Option<String>>,
+        req: SendMessageRequest,
+    ) -> Result<ReactionApiResponse> {
+        let properties = parse_properties_from_base64(properties.0);
+        let content = req.into_chat_message_content(&state, properties).await?;
+        do_reaction(
+            &state,
+            token,
+            mid.0,
+            MessageReactionDetail::Edit(MessageReactionEdit { content }),
+        )
+        .await
+    }
+
+    /// Edit message
+    #[oai(path = "/:mid/like", method = "put", transform = "guest_forbidden")]
+    async fn like(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        mid: Path<i64>,
+        req: Json<LikeMessageRequest>,
+    ) -> Result<ReactionApiResponse> {
+        let like = MessageReactionLike {
+            action: req.0.action,
+        };
+        if !like.check() {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        do_reaction(&state, token, mid.0, MessageReactionDetail::Like(like)).await
+    }
+
+    /// Delete message
+    #[oai(path = "/:mid", method = "delete", transform = "guest_forbidden")]
+    async fn delete(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        mid: Path<i64>,
+    ) -> Result<ReactionApiResponse> {
+        do_reaction(
+            &state,
+            token,
+            mid.0,
+            MessageReactionDetail::Delete(MessageReactionDelete {}),
+        )
+        .await
+    }
+
+    /// Reply message
+    #[oai(path = "/:mid/reply", method = "post", transform = "guest_forbidden")]
+    async fn reply(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        mid: Path<i64>,
+        #[oai(name = "X-Properties")] properties: Header<Option<String>>,
+        req: SendMessageRequest,
+    ) -> Result<ReactionApiResponse> {
+        let properties = parse_properties_from_base64(properties.0);
+        let content = req.into_chat_message_content(&state, properties).await?;
+
+        let msg_data = match state
+            .msg_db
+            .messages()
+            .get(mid.0)
+            .map_err(InternalServerError)?
+        {
+            Some(data) => data,
+            None => return Ok(ReactionApiResponse::MessageDoesNotExist),
+        };
+        let payload =
+            serde_json::from_slice::<ChatMessagePayload>(&msg_data).map_err(InternalServerError)?;
+
+        if !matches!(
+            &payload.detail,
+            MessageDetail::Normal(_) | MessageDetail::Reply(_)
+        ) {
+            return Ok(ReactionApiResponse::Forbidden);
+        }
+
+        match payload.target {
+            MessageTarget::User(MessageTargetUser { uid }) => {
+                if uid != token.uid && payload.from_uid != token.uid {
+                    return Ok(ReactionApiResponse::Forbidden);
+                }
+            }
+            MessageTarget::Group(MessageTargetGroup { gid }) => {
+                let cache = state.cache.read().await;
+                let group = match cache.groups.get(&gid) {
+                    Some(group) => group,
+                    None => return Ok(ReactionApiResponse::Forbidden),
+                };
+                if !group.contains_user(token.uid) {
+                    return Ok(ReactionApiResponse::Forbidden);
+                }
+            }
+        }
+
+        let new_payload = ChatMessagePayload {
+            from_uid: token.uid,
+            created_at: DateTime::now(),
+            target: get_target(token.uid, &payload),
+            detail: MessageDetail::Reply(MessageReply {
+                mid: mid.0,
+                content,
+            }),
+        };
+        let new_mid = send_message(&state, new_payload).await?;
+        Ok(ReactionApiResponse::Ok(Json(new_mid)))
+    }
+}
+
+fn get_target(current_uid: i64, payload: &ChatMessagePayload) -> MessageTarget {
+    match payload.target {
+        MessageTarget::User(MessageTargetUser { uid }) => {
+            MessageTarget::user(if uid == current_uid {
+                payload.from_uid
+            } else {
+                uid
+            })
+        }
+        MessageTarget::Group(MessageTargetGroup { gid }) => MessageTarget::group(gid),
+    }
+}
+
+async fn do_reaction(
+    state: &State,
+    token: Token,
+    mid: i64,
+    detail: MessageReactionDetail,
+) -> Result<ReactionApiResponse> {
+    let msg_data = match state
+        .msg_db
+        .messages()
+        .get(mid)
+        .map_err(InternalServerError)?
+    {
+        Some(data) => data,
+        None => return Ok(ReactionApiResponse::MessageDoesNotExist),
+    };
+    let payload =
+        serde_json::from_slice::<ChatMessagePayload>(&msg_data).map_err(InternalServerError)?;
+    if !detail.can_reaction(token.uid, token.is_admin, &payload) {
+        return Ok(ReactionApiResponse::Forbidden);
+    }
+
+    let new_payload = ChatMessagePayload {
+        from_uid: token.uid,
+        created_at: DateTime::now(),
+        target: get_target(token.uid, &payload),
+        detail: MessageDetail::Reaction(MessageReaction { mid, detail }),
+    };
+    let new_mid = send_message(state, new_payload).await?;
+    Ok(ReactionApiResponse::Ok(Json(new_mid)))
+}
+
+#[cfg(test)]
+mod tests {
+    use futures_util::StreamExt;
+    use serde_json::json;
+
+    use crate::test_harness::TestServer;
+
+    #[tokio::test]
+    async fn test_reaction_edit() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let user1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+        let mut user1_events = server.subscribe_events(&user1_token, Some(&["chat"])).await;
+
+        let mid1 = server.send_text_to_user(&admin_token, user1, "a").await;
+
+        let resp = server
+            .put(format!("/api/message/{}/edit", mid1))
+            .header("X-API-Key", &admin_token)
+            .content_type("text/plain")
+            .body("b")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let mid2 = resp.json().await.value().i64();
+
+        let msg = user1_events.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("mid").assert_i64(mid1);
+        msg.get("from_uid").assert_i64(1);
+        msg.get("target").object().get("uid").assert_i64(user1);
+        let detail = msg.get("detail").object();
+        detail.get("type").assert_string("normal");
+        detail.get("content_type").assert_string("text/plain");
+        detail.get("content").assert_string("a");
+
+        let msg = user1_events.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("mid").assert_i64(mid2);
+        msg.get("from_uid").assert_i64(1);
+        msg.get("target").object().get("uid").assert_i64(user1);
+        let detail = msg.get("detail").object();
+        detail.get("type").assert_string("reaction");
+        detail.get("mid").assert_i64(mid1);
+        let reaction_detail = detail.get("detail").object();
+        reaction_detail.get("type").assert_string("edit");
+        reaction_detail.get("content").assert_string("b");
+    }
+
+    #[tokio::test]
+    async fn test_reaction_like() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let user1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+        let mut admin_events = server.subscribe_events(&admin_token, Some(&["chat"])).await;
+        let mut user1_events = server.subscribe_events(&user1_token, Some(&["chat"])).await;
+
+        let mid1 = server.send_text_to_user(&admin_token, user1, "a").await;
+
+        for events in [&mut admin_events, &mut user1_events] {
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("mid").assert_i64(mid1);
+            msg.get("from_uid").assert_i64(1);
+            msg.get("target").object().get("uid").assert_i64(user1);
+        }
+
+        let resp = server
+            .put(format!("/api/message/{}/like", mid1))
+            .header("X-API-Key", &admin_token)
+            .content_type("application/json")
+            .body_json(&json!({
+                "action": "��"
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let mid2 = resp.json().await.value().i64();
+
+        let resp = server
+            .put(format!("/api/message/{}/like", mid1))
+            .header("X-API-Key", &user1_token)
+            .content_type("application/json")
+            .body_json(&json!({
+                "action": "🚀"
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let mid3 = resp.json().await.value().i64();
+
+        for events in [&mut admin_events, &mut user1_events] {
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("mid").assert_i64(mid2);
+            msg.get("from_uid").assert_i64(1);
+            msg.get("target").object().get("uid").assert_i64(user1);
+            let detail = msg.get("detail").object();
+            detail.get("type").assert_string("reaction");
+            detail.get("mid").assert_i64(mid1);
+            let reaction_detail = detail.get("detail").object();
+            reaction_detail.get("type").assert_string("like");
+            reaction_detail.get("action").assert_string("��");
+
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("mid").assert_i64(mid3);
+            msg.get("from_uid").assert_i64(user1);
+            msg.get("target").object().get("uid").assert_i64(1);
+            let detail = msg.get("detail").object();
+            detail.get("type").assert_string("reaction");
+            detail.get("mid").assert_i64(mid1);
+            let reaction_detail = detail.get("detail").object();
+            reaction_detail.get("type").assert_string("like");
+            reaction_detail.get("action").assert_string("🚀");
+        }
+    }
+
+    #[tokio::test]
+    async fn test_reply() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let user1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+        let mut user1_events = server.subscribe_events(&user1_token, Some(&["chat"])).await;
+
+        let mid1 = server.send_text_to_user(&admin_token, user1, "a").await;
+
+        let msg = user1_events.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("mid").assert_i64(mid1);
+        let detail = msg.get("detail").object();
+        detail.get("type").assert_string("normal");
+        detail.get("content_type").assert_string("text/plain");
+        detail.get("content").assert_string("a");
+
+        let resp = server
+            .post(format!("/api/message/{}/reply", mid1))
+            .content_type("text/plain")
+            .header("X-API-Key", &admin_token)
+            .body("b")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let mid2 = resp.json().await.value().i64();
+
+        let msg = user1_events.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("mid").assert_i64(mid2);
+        let detail = msg.get("detail").object();
+        detail.get("type").assert_string("reply");
+        detail.get("mid").assert_i64(mid1);
+        detail.get("content_type").assert_string("text/plain");
+        detail.get("content").assert_string("b");
+
+        let resp = server
+            .post(format!("/api/message/{}/reply", mid1))
+            .content_type("text/plain")
+            .header("X-API-Key", &user1_token)
+            .body("c")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let mid3 = resp.json().await.value().i64();
+
+        let msg = user1_events.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("mid").assert_i64(mid3);
+        let detail = msg.get("detail").object();
+        detail.get("type").assert_string("reply");
+        detail.get("mid").assert_i64(mid1);
+        detail.get("content_type").assert_string("text/plain");
+        detail.get("content").assert_string("c");
+
+        let resp = server
+            .post(format!("/api/message/{}/reply", mid3))
+            .content_type("text/plain")
+            .header("X-API-Key", &user1_token)
+            .body("d")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let mid4 = resp.json().await.value().i64();
+
+        let msg = user1_events.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("mid").assert_i64(mid4);
+        let detail = msg.get("detail").object();
+        detail.get("type").assert_string("reply");
+        detail.get("mid").assert_i64(mid3);
+        detail.get("content_type").assert_string("text/plain");
+        detail.get("content").assert_string("d");
+    }
+}
diff --git a/src/api/mod.rs b/src/api/mod.rs
new file mode 100644
index 0000000..67fcf9f
--- /dev/null
+++ b/src/api/mod.rs
@@ -0,0 +1,75 @@
+use poem_openapi::{OpenApi, OpenApiService};
+
+mod admin_agora;
+mod admin_fcm;
+mod admin_github_auth;
+mod admin_google_auth;
+mod admin_login;
+mod admin_smtp;
+mod admin_system;
+mod admin_user;
+mod archive;
+mod bot;
+mod datetime;
+mod favorite;
+mod group;
+mod langid;
+mod license;
+mod message;
+mod message_api;
+mod resource;
+mod tags;
+mod token;
+mod user;
+mod user_log_action;
+
+pub use admin_agora::AgoraConfig;
+pub use admin_fcm::FcmConfig;
+pub use admin_login::{LoginConfig, WhoCanSignUp};
+pub use admin_smtp::SmtpConfig;
+pub use admin_system::{FrontendUrlConfig, Metrics, OrganizationConfig};
+pub use admin_user::{User, UserDevice};
+pub use archive::Archive;
+pub use datetime::DateTime;
+pub use group::{Group, PinnedMessage};
+pub use langid::LangId;
+pub use message::{
+    get_merged_message, BurnAfterReadingGroup, BurnAfterReadingUser, ChatMessage,
+    ChatMessagePayload, GroupChangedMessage, HeartbeatMessage, JoinedGroupMessage,
+    KickFromGroupMessage, KickFromGroupReason, KickMessage, KickReason, Message, MessageDetail,
+    MessageTarget, MessageTargetGroup, MessageTargetUser, MuteGroup, MuteUser, ReadIndexGroup,
+    ReadIndexUser, RelatedGroupsMessage, UserJoinedGroupMessage, UserLeavedGroupMessage,
+    UserSettingsChangedMessage, UserSettingsMessage, UserState, UserStateChangedMessage,
+    UserUpdateLog, UsersStateMessage, UsersUpdateLogMessage,
+};
+pub use resource::FileMeta;
+pub use token::{CurrentUser, Token};
+pub use user::{
+    CreateUserConflictReason, CreateUserResponse, UpdateUserResponse, UserConflict, UserInfo,
+};
+pub use user_log_action::UpdateAction;
+
+pub fn create_api_service() -> OpenApiService<impl OpenApi, ()> {
+    OpenApiService::new(
+        (
+            token::ApiToken,
+            user::ApiUser,
+            group::ApiGroup,
+            admin_user::ApiAdminUser,
+            resource::ApiResource,
+            message_api::ApiMessage,
+            favorite::ApiFavorite,
+            license::ApiLicense,
+            admin_system::ApiAdminSystem,
+            admin_agora::ApiAdminAgora,
+            admin_fcm::ApiAdminFirebase,
+            admin_smtp::ApiAdminSmtp,
+            admin_login::ApiAdminLogin,
+            admin_google_auth::ApiAdminGoogleAuth,
+            admin_github_auth::ApiAdminGithubAuth,
+            bot::ApiBot,
+        ),
+        "Voce Chat",
+        env!("CARGO_PKG_VERSION"),
+    )
+}
diff --git a/src/api/resource.rs b/src/api/resource.rs
new file mode 100644
index 0000000..a83baab
--- /dev/null
+++ b/src/api/resource.rs
@@ -0,0 +1,1105 @@
+use std::str::FromStr;
+
+use chrono::Datelike;
+use futures_util::TryFutureExt;
+use mime_guess::{mime, Mime};
+// use open_graph::Object;
+use poem::{
+    error::{BadRequest, InternalServerError},
+    http::{header, HeaderMap, StatusCode},
+    web::{Data, StaticFileRequest, StaticFileResponse},
+    Body, Error, Result,
+};
+use poem_openapi::{
+    param::Query,
+    payload::{Binary, Json, Response},
+    ApiRequest, Multipart, Object, OpenApi,
+};
+use serde::{Deserialize, Serialize};
+use sha2::Digest;
+use tokio::io::AsyncWriteExt;
+
+use crate::{
+    api::{
+        archive::{create_message_archive, extract_archive, extract_archive_attachment},
+        tags::ApiTags,
+        token::Token,
+        Archive, DateTime,
+    },
+    State,
+};
+
+/// Upload image request
+#[derive(Debug, ApiRequest)]
+pub enum UploadImageRequest {
+    #[oai(content_type = "image/png")]
+    Image(Binary<Body>),
+}
+
+/// Prepare upload file request
+#[derive(Debug, Object)]
+pub struct PrepareUploadFileRequest {
+    pub content_type: Option<String>,
+    pub filename: Option<String>,
+}
+
+/// Upload file request
+#[derive(Debug, Multipart)]
+pub struct UploadFileRequest {
+    #[oai(default)]
+    /// file_id: uuid that return by prepare uploading file API
+    pub file_id: String,
+    pub chunk_data: poem_openapi::types::Binary<Vec<u8>>,
+    #[oai(default)]
+    pub chunk_is_last: bool,
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct FileMeta {
+    pub content_type: String,
+    pub filename: Option<String>,
+}
+
+/// Download file request
+#[derive(Debug, Object)]
+struct DownloadFileRequest {
+    #[oai(default)]
+    file_id: String,
+    #[oai(default)]
+    chunk_start: i64,
+    #[oai(default)]
+    chunk_len: i64,
+}
+
+/// Image properties
+#[derive(Debug, Object)]
+pub struct ImageProperties {
+    pub width: u32,
+    pub height: u32,
+}
+
+/// Download file request
+#[derive(Debug, Object)]
+pub struct UploadFileResponse {
+    pub path: String,
+    pub size: i64,
+    pub hash: String,
+    pub image_properties: Option<ImageProperties>,
+}
+
+#[derive(Debug, Object)]
+struct CreateArchiveMsgRequest {
+    mid_list: Vec<i64>,
+}
+
+pub struct ApiResource;
+
+#[OpenApi(prefix_path = "/resource", tag = "ApiTags::Resource")]
+impl ApiResource {
+    /// Get the organization logo
+    #[oai(path = "/organization/logo", method = "get")]
+    async fn get_organization_logo(
+        &self,
+        state: Data<&State>,
+        req: StaticFileRequest,
+    ) -> Result<StaticFileResponse> {
+        let path = state.config.system.data_dir.join("organization.png");
+        if path.exists() {
+            Ok(req.create_response(path, false)?)
+        } else {
+            Ok(req
+                .create_response_from_data(include_bytes!("assets/organization-logo.png"))?
+                .with_content_type("image/png"))
+        }
+    }
+
+    /// Get user avatar by id
+    #[oai(path = "/avatar", method = "get")]
+    async fn get_avatar(
+        &self,
+        state: Data<&State>,
+        uid: Query<i64>,
+        req: StaticFileRequest,
+    ) -> Result<StaticFileResponse> {
+        let path = state
+            .config
+            .system
+            .avatar_dir()
+            .join(format!("{}.png", uid.0));
+        Ok(req.create_response(path, false)?)
+    }
+
+    /// Get group avatar by id
+    #[oai(path = "/group_avatar", method = "get")]
+    async fn get_group_avatar(
+        &self,
+        state: Data<&State>,
+        gid: Query<i64>,
+        req: StaticFileRequest,
+    ) -> Result<StaticFileResponse> {
+        let path = state
+            .config
+            .system
+            .group_avatar_dir()
+            .join(format!("{}.png", gid.0));
+        Ok(req.create_response(path, false)?)
+    }
+
+    /// Prepare for uploading file
+    #[oai(path = "/file/prepare", method = "post")]
+    async fn upload_file_prepare(
+        &self,
+        state: Data<&State>,
+        req: Json<PrepareUploadFileRequest>,
+        _token: Token,
+    ) -> Result<Json<String>> {
+        let uuid = uuid::Uuid::new_v4().to_string();
+
+        let tmp_file_path = state
+            .config
+            .system
+            .tmp_dir()
+            .join(&uuid)
+            .with_extension("data");
+        let tmp_file_path_meta = tmp_file_path.with_extension("meta");
+
+        tokio::fs::write(&tmp_file_path, &[])
+            .await
+            .map_err(InternalServerError)?;
+
+        let meta = FileMeta {
+            content_type: match req.0.content_type {
+                Some(content_type) => content_type,
+                None => match &req.filename {
+                    Some(filename) => mime_guess::from_path(filename)
+                        .first()
+                        .map(|mime| mime.to_string())
+                        .unwrap_or_else(|| "application/octet-stream".to_string()),
+                    None => "application/octet-stream".to_string(),
+                },
+            },
+            filename: req.0.filename,
+        };
+        tokio::fs::write(
+            &tmp_file_path_meta,
+            serde_json::to_vec(&meta).map_err(InternalServerError)?,
+        )
+        .await
+        .map_err(InternalServerError)?;
+
+        Ok(Json(uuid))
+    }
+
+    /// Upload file
+    #[oai(path = "/file/upload", method = "post")]
+    async fn upload_file(
+        &self,
+        state: Data<&State>,
+        _token: Token,
+        req: UploadFileRequest,
+    ) -> Result<Json<Option<UploadFileResponse>>> {
+        if req.file_id.is_empty() {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        // open the file, append data.
+        let tmp_file_path = state
+            .config
+            .system
+            .tmp_dir()
+            .join(&req.file_id)
+            .with_extension("data");
+        let tmp_file_path_meta = tmp_file_path.with_extension("meta");
+
+        if tmp_file_path.exists() {
+            let mut f = tokio::fs::OpenOptions::new()
+                .create(true)
+                .append(true)
+                .open(&tmp_file_path)
+                .await
+                .map_err(InternalServerError)?;
+            f.write_all(req.chunk_data.as_slice())
+                .await
+                .map_err(InternalServerError)?;
+            f.flush().await.map_err(InternalServerError)?;
+        } else {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        if req.chunk_is_last {
+            let file_meta = serde_json::from_slice::<FileMeta>(
+                &std::fs::read(&tmp_file_path_meta).map_err(InternalServerError)?,
+            )
+            .map_err(InternalServerError)?;
+            let is_image = Mime::from_str(&file_meta.content_type)
+                .map(|mime| mime.type_() == mime::IMAGE)
+                .unwrap_or_default();
+
+            let file_size = tokio::fs::metadata(&tmp_file_path)
+                .await
+                .map_err(InternalServerError)?
+                .len() as i64;
+            let file_hash = sha256_file(&tmp_file_path)
+                .await
+                .map_err(|_| Error::from_status(StatusCode::INTERNAL_SERVER_ERROR))?;
+
+            //  move tmp to dir
+            let now = DateTime::now();
+            let year = now.year();
+            let month = now.month();
+            let day = now.day();
+            // ./data/file/{year}/{month}/{day}/{file_uuid}
+            // ./data/file/2021/01/30/123-456-789
+            let save_path = state
+                .config
+                .system
+                .file_dir()
+                .join(year.to_string())
+                .join(month.to_string())
+                .join(day.to_string());
+            if !save_path.exists() {
+                tokio::fs::create_dir_all(&save_path)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+
+            tokio::fs::rename(&tmp_file_path, save_path.join(&req.file_id))
+                .and_then(|_| {
+                    tokio::fs::rename(
+                        &tmp_file_path_meta,
+                        save_path.join(&req.file_id).with_extension("meta"),
+                    )
+                })
+                .await
+                .map_err(InternalServerError)?;
+
+            // create the thumbnail
+            let mut image_properties = None;
+            if is_image {
+                let src_path = save_path.join(&req.file_id);
+                let src_meta_path = src_path.with_extension("meta");
+                let thumbnail_dir_path = state
+                    .config
+                    .system
+                    .thumbnail_dir()
+                    .join(year.to_string())
+                    .join(month.to_string())
+                    .join(day.to_string());
+                let thumbnail_file_path = thumbnail_dir_path.join(&req.file_id);
+                let thumbnail_meta_path = thumbnail_file_path.with_extension("meta");
+
+                tracing::info!(
+                    src_path = %src_path.display(),
+                    thumbnail_path = %thumbnail_file_path.display(),
+                    "create thumbnail",
+                );
+
+                image_properties = Some(
+                    tokio::task::spawn_blocking(move || {
+                        let image_data = std::fs::read(src_path).map_err(InternalServerError)?;
+                        let image = image::load_from_memory(&image_data).map_err(BadRequest)?;
+                        let thumbnail = image.thumbnail(480, 480);
+                        let _ = std::fs::create_dir_all(&thumbnail_dir_path);
+
+                        if thumbnail.color().has_alpha() {
+                            thumbnail
+                                .save_with_format(thumbnail_file_path, image::ImageFormat::Png)
+                                .map_err(InternalServerError)?;
+                        } else {
+                            thumbnail
+                                .save_with_format(thumbnail_file_path, image::ImageFormat::Jpeg)
+                                .map_err(InternalServerError)?;
+                        }
+
+                        std::fs::copy(&src_meta_path, &thumbnail_meta_path)
+                            .map_err(InternalServerError)?;
+                        Ok::<_, poem::Error>(ImageProperties {
+                            width: image.width(),
+                            height: image.height(),
+                        })
+                    })
+                    .await
+                    .map_err(InternalServerError)??,
+                );
+            }
+
+            // return the file url path, the client assembles the payload and sends it.
+            // {year}/{month}/{day}/{file_uuid}
+            // 2021/01/30/123-456-789
+            let file_url_path = format!("{}/{}/{}/{}", year, month, day, &req.file_id);
+            return Ok(Json(Some(UploadFileResponse {
+                path: file_url_path,
+                size: file_size,
+                hash: file_hash.to_string(),
+                image_properties,
+            })));
+        }
+        Ok(Json(None))
+    }
+
+    /// Download file
+    #[oai(path = "/file", method = "get")]
+    async fn download_file(
+        &self,
+        state: Data<&State>,
+        file_path: Query<String>,
+        #[oai(default)] thumbnail: Query<bool>,
+        #[oai(default)] download: Query<bool>,
+        req: StaticFileRequest,
+    ) -> Result<Response<StaticFileResponse>> {
+        if file_path.is_empty() || file_path.contains('.') {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+        let base_dir = if !thumbnail.0 {
+            state.config.system.file_dir()
+        } else {
+            state.config.system.thumbnail_dir()
+        };
+        let path = base_dir.join(file_path.as_str());
+        let path_meta = base_dir.join(file_path.as_str()).with_extension("meta");
+
+        let meta = tokio::fs::read(&path_meta)
+            .await
+            .ok()
+            .and_then(|data| serde_json::from_slice::<FileMeta>(&data).ok())
+            .unwrap_or_else(|| FileMeta {
+                content_type: "application/octet-stream".to_string(),
+                filename: None,
+            });
+
+        let mut resp = Response::new(req.create_response(path, false)?);
+        let ty = if download.0 { "attachment" } else { "inline" };
+        resp = resp.header(header::CONTENT_TYPE, meta.content_type);
+        if let Some(filename) = meta.filename {
+            resp = resp.header(
+                header::CONTENT_DISPOSITION,
+                format!(r#"{}; filename="{}""#, ty, filename),
+            );
+        }
+
+        Ok(resp)
+    }
+
+    /// Create messages archive
+    #[oai(path = "/archive", method = "post")]
+    async fn create_archive(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<CreateArchiveMsgRequest>,
+    ) -> Result<Json<String>> {
+        let data = create_message_archive(&state, req.0.mid_list, token.uid).await?;
+
+        let now = DateTime::now();
+        let year = now.year();
+        let month = now.month();
+        let day = now.day();
+        let save_path = state
+            .config
+            .system
+            .archive_msg_dir()
+            .join(year.to_string())
+            .join(month.to_string())
+            .join(day.to_string());
+        let _ = std::fs::create_dir_all(&save_path);
+        let uuid = uuid::Uuid::new_v4().to_string();
+
+        let file_path = save_path.join(&uuid);
+        std::fs::write(file_path, data).map_err(InternalServerError)?;
+
+        Ok(Json(format!("{}/{}/{}/{}", year, month, day, &uuid)))
+    }
+
+    /// Get archive info
+    #[oai(path = "/archive", method = "get")]
+    async fn get_archive_index(
+        &self,
+        state: Data<&State>,
+        file_path: Query<String>,
+    ) -> Result<Response<Json<Archive>>> {
+        if file_path.is_empty() || file_path.contains('.') {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+        let path = state
+            .config
+            .system
+            .archive_msg_dir()
+            .join(file_path.as_str());
+        let archive = extract_archive(path).await?;
+        Ok(Response::new(Json(archive)).header(header::CACHE_CONTROL, "public, max-age=31536000"))
+    }
+
+    /// Get archive attachment
+    #[oai(path = "/archive/attachment", method = "get")]
+    async fn get_archive_attachment(
+        &self,
+        state: Data<&State>,
+        file_path: Query<String>,
+        attachment_id: Query<usize>,
+        #[oai(default)] download: Query<bool>,
+    ) -> Result<Response<Binary<Vec<u8>>>> {
+        if file_path.is_empty() || file_path.contains('.') {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+        let path = state
+            .config
+            .system
+            .archive_msg_dir()
+            .join(file_path.as_str());
+        let archive_file = extract_archive_attachment(path, attachment_id.0).await?;
+
+        let mut resp = Response::new(Binary(archive_file.content));
+        let ty = if download.0 { "attachment" } else { "inline" };
+        resp = resp
+            .header(header::CONTENT_TYPE, archive_file.content_type)
+            .header(header::CACHE_CONTROL, "public, max-age=31536000");
+        if let Some(filename) = archive_file.filename {
+            resp = resp.header(
+                header::CONTENT_DISPOSITION,
+                format!(r#"{}; filename="{}""#, ty, filename),
+            );
+        }
+
+        Ok(resp)
+    }
+
+    /// Parse URL with Open Graphic Protocol
+    #[oai(path = "/open_graphic_parse", method = "get")]
+    async fn open_graphic_parse(
+        &self,
+        url: Query<String>,
+        header_map: &HeaderMap,
+    ) -> Result<Response<Json<open_graph::Object>>> {
+        if url.is_empty() {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+        let url = url.0;
+        let extra_header_map = header_map
+            .get(poem::http::header::ACCEPT_LANGUAGE)
+            .cloned()
+            .map(|value| (poem::http::header::ACCEPT_LANGUAGE, value))
+            .into_iter()
+            .collect::<HeaderMap>();
+        let obj = open_graph::fetch(&url, Some(extra_header_map), 0)
+            .await
+            .unwrap_or_default();
+        Ok(Response::new(Json(obj)).header(header::CACHE_CONTROL, "public, max-age=86400"))
+    }
+}
+
+pub async fn sha256_file<P: AsRef<std::path::Path>>(path: P) -> anyhow::Result<String> {
+    let path = path.as_ref().to_path_buf();
+    Ok(tokio::task::spawn_blocking(move || {
+        let mut file = std::fs::File::open(path)?;
+        let mut sha256 = sha2::Sha256::new();
+        std::io::copy(&mut file, &mut sha256)?;
+        let hash = hex::encode(sha256.finalize().as_slice());
+        Ok::<_, std::io::Error>(hash)
+    })
+    .await??)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Write;
+
+    use futures_util::StreamExt;
+    use poem::test::TestForm;
+    use reqwest::StatusCode;
+    use serde_json::json;
+
+    use super::*;
+    use crate::test_harness::TestServer;
+
+    #[tokio::test]
+    async fn test_sha256_file() {
+        // use std::io::Write;
+        let mut tmp_file = tempfile::NamedTempFile::new().unwrap();
+        tmp_file.write_all(b"1").unwrap();
+        let s = sha256_file(tmp_file.path()).await.unwrap();
+        assert_eq!(
+            "6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b",
+            s
+        );
+        std::fs::remove_file(tmp_file.path()).unwrap();
+    }
+
+    fn sha256_bytes(v: impl AsRef<[u8]>) -> String {
+        let mut sha256 = sha2::Sha256::new();
+        sha2::digest::Update::update(&mut sha256, v);
+        hex::encode(sha256.finalize().as_slice())
+    }
+
+    #[test]
+    fn test_sha256_bytes() {
+        let s = sha256_bytes(b"1");
+        assert_eq!(
+            "6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b",
+            s
+        );
+    }
+
+    #[tokio::test]
+    async fn test_organization_logo() {
+        let server = TestServer::new().await;
+        let token = server.login_admin().await;
+
+        let resp = server.get("/api/resource/organization/logo").send().await;
+        resp.assert_status_is_ok();
+        resp.assert_bytes(include_bytes!("assets/organization-logo.png"))
+            .await;
+
+        // upload the logo
+        let resp = server
+            .post("/api/admin/system/organization/logo")
+            .header("X-API-Key", &token)
+            .content_type("image/png")
+            .body(include_bytes!("assets/poem.png").to_vec())
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        // get the logo
+        let resp = server.get("/api/resource/organization/logo").send().await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn test_avatar() {
+        let server = TestServer::new().await;
+        let token = server.login_admin().await;
+
+        // upload avatar
+        let resp = server
+            .post("/api/user/avatar")
+            .header("X-API-Key", &token)
+            .content_type("image/png")
+            .body(include_bytes!("assets/poem.png").to_vec())
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        // get avatar
+        let resp = server
+            .get("/api/resource/avatar")
+            .query("uid", &2i64)
+            .send()
+            .await;
+        resp.assert_status(StatusCode::NOT_FOUND);
+
+        // get avatar
+        let resp = server
+            .get("/api/resource/avatar")
+            .query("uid", &1i64)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn test_upload_file_prepare() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let resp = server
+            .post("/api/resource/file/prepare")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "content_type": "audio/mp4",
+                "filename": "test.mp4",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let id = json.value().string();
+        assert_eq!(id.len(), 36);
+    }
+
+    #[tokio::test]
+    async fn test_upload_file() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let file1_name = "1.txt";
+        let file1_content = b"abc";
+        let file1_sh256 = sha256_bytes(file1_content);
+
+        // upload_file_prepare
+        let resp = server
+            .post("/api/resource/file/prepare")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "content_type": "text/plain",
+                "filename": file1_name,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let file_id = json.value().string();
+
+        // upload file
+        let resp = server
+            .post("/api/resource/file/upload")
+            .header("X-API-Key", &admin_token)
+            .multipart(
+                TestForm::new()
+                    .text("file_id", file_id.to_string())
+                    .text("chunk_is_last", "true")
+                    .bytes("chunk_data", file1_content.to_vec()),
+            )
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let j = resp.json().await;
+
+        let file_path = j.value().object().get("path").string();
+        let file_size = j.value().object().get("size").i64();
+        assert_eq!(file_size, file1_content.len() as i64);
+        let file_hash = j.value().object().get("hash").string();
+        assert_eq!(file_hash, &file1_sh256);
+
+        // download file as inline
+        let resp = server
+            .get("/api/resource/file")
+            .query("file_path", &file_path)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.assert_header("content-type", "text/plain");
+        resp.assert_header("content-disposition", r#"inline; filename="1.txt""#);
+        resp.assert_bytes(file1_content).await;
+
+        // download file as attachment
+        let resp = server
+            .get("/api/resource/file")
+            .query("file_path", &file_path)
+            .query("download", &true)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.assert_header("content-type", "text/plain");
+        resp.assert_header("content-disposition", r#"attachment; filename="1.txt""#);
+        resp.assert_bytes(file1_content).await;
+    }
+
+    #[tokio::test]
+    async fn test_upload_image() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        // upload_file_prepare
+        let resp = server
+            .post("/api/resource/file/prepare")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "content_type": "image/png",
+                "filename": "poem.png",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let file_id = json.value().string();
+
+        // upload file
+        let resp = server
+            .post("/api/resource/file/upload")
+            .header("X-API-Key", &admin_token)
+            .multipart(
+                TestForm::new()
+                    .text("file_id", file_id.to_string())
+                    .text("chunk_is_last", "true")
+                    .bytes("chunk_data", include_bytes!("assets/poem.png").to_vec()),
+            )
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let obj = json.value().object();
+        let image_properties = obj.get("image_properties").object();
+        image_properties.get("width").assert_i64(400);
+        image_properties.get("height").assert_i64(400);
+
+        let file_path = obj.get("path").string();
+
+        // download image
+        let resp = server
+            .get("/api/resource/file")
+            .query("file_path", &file_path)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.assert_header("content-type", "image/png");
+        resp.assert_header("content-disposition", r#"inline; filename="poem.png""#);
+        resp.assert_bytes(include_bytes!("assets/poem.png")).await;
+
+        // download thumbnail
+        let resp = server
+            .get("/api/resource/file")
+            .query("file_path", &file_path)
+            .query("thumbnail", &true)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.assert_header("content-type", "image/png");
+        resp.assert_header("content-disposition", r#"inline; filename="poem.png""#);
+    }
+
+    #[tokio::test]
+    async fn test_upload_file_with_chunk() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let file1_content = b"12345678";
+        let file1_sh256 = sha256_bytes(file1_content);
+        let mut file1 = tempfile::NamedTempFile::new().unwrap();
+        let file1_name = "1.txt";
+        let file_path1 = file1
+            .path()
+            .to_str()
+            .map(|v| v.to_string())
+            .unwrap_or_default();
+        file1.write_all(file1_content).unwrap();
+        file1.flush().unwrap();
+
+        // upload file prepare
+        let resp = server
+            .post("/api/resource/file/prepare")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": file1_name,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let file_id = json.value().string();
+        assert_eq!(file_id.len(), 36);
+
+        // upload file
+        let mut file_path = String::new();
+        for (i, c) in file1_content.iter().enumerate() {
+            let is_last = i + 1 == file1_content.len();
+            let resp = server
+                .post("/api/resource/file/upload")
+                .header("X-API-Key", &admin_token)
+                .multipart(
+                    TestForm::new()
+                        .text("file_id", file_id.to_string())
+                        .text("chunk_is_last", if is_last { "true" } else { "false" })
+                        .bytes("chunk_data", vec![*c]),
+                )
+                .send()
+                .await;
+            resp.assert_status_is_ok();
+            if is_last {
+                let j = resp.json().await;
+                file_path = j.value().object().get("path").string().to_string();
+                assert!(file_path.len() > 36);
+            }
+        }
+        tokio::fs::remove_file(&file_path1).await.unwrap();
+
+        // download file
+        let mut downloaded_data = vec![];
+        // for i in 0..file1_content.len() + 1 {
+        let mut i = 0;
+        loop {
+            let resp = server
+                .get("/api/resource/file")
+                .query("file_path", &file_path)
+                .header("X-API-Key", &admin_token)
+                .header("Range", format!("bytes={}-{}", i, i))
+                //.typed_header(Range::bytes(i..i+1))
+                .send()
+                .await;
+            if resp.0.status() != StatusCode::RANGE_NOT_SATISFIABLE {
+                assert_eq!(resp.0.status(), StatusCode::PARTIAL_CONTENT);
+            } else {
+                break;
+            }
+            let body = resp.0.into_body().into_bytes().await.unwrap();
+            downloaded_data.append(&mut body.to_vec());
+            i += 1;
+        }
+        assert_eq!(sha256_bytes(&downloaded_data), file1_sh256);
+    }
+
+    #[tokio::test]
+    async fn test_upload_file_and_send_subscribe_msg() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let _uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let file1_content = b"1";
+        let file1_sha256 = sha256_bytes(file1_content);
+        let file1_name = "1.txt";
+
+        // upload file prepare
+        let resp = server
+            .post("/api/resource/file/prepare")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "filename": file1_name,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let file_id = json.value().string();
+        assert_eq!(file_id.len(), 36);
+
+        // upload file
+        let resp = server
+            .post("/api/resource/file/upload")
+            .header("X-API-Key", &admin_token)
+            .multipart(
+                TestForm::new()
+                    .text("file_id", file_id.to_string())
+                    .text("chunk_is_last", "true")
+                    .bytes("chunk_data", file1_content.to_vec()),
+            )
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let j = resp.json().await;
+        let file_path = j.value().object().get("path").string().to_string();
+        assert!(file_path.len() > 36);
+        j.value().object().get("hash").assert_string(&file1_sha256);
+        j.value()
+            .object()
+            .get("size")
+            .assert_i64(file1_content.len() as i64);
+
+        // send msg
+        let resp = server
+            .post(format!("/api/user/{}/send", uid2))
+            .header("X-API-Key", &token1)
+            .content_type("vocechat/file")
+            .body_json(&json!({
+                "path": file_path,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let mut msg_stream = server.subscribe_events(&token2, Some(&["chat"])).await;
+        let msg = msg_stream.next().await.unwrap();
+        let msg = msg.value().object();
+
+        let detail = msg.get("detail").object();
+        detail.get("content_type").assert_string("vocechat/file");
+
+        let properties = detail.get("properties").object();
+        properties.get("name").assert_string(file1_name);
+        properties.get("content_type").assert_string("text/plain");
+        properties
+            .get("size")
+            .assert_i64(file1_content.len() as i64);
+    }
+
+    #[tokio::test]
+    async fn test_open_graphic_parse() {
+        // let server = TestServer::new().await;
+        // let admin_token = server.login_admin().await;
+
+        // let resp = server
+        //     .get("/api/resource/open_graphic_parse")
+        //     .header("X-API-Key", &admin_token)
+        //     .query("url", &"https://www.youtube.com/watch?v=5C_HPTJg5ek")
+        //     .send()
+        //     .await;
+        // resp.assert_status_is_ok();
+        // let json = resp.json().await;
+        // json.value()
+        //     .object()
+        //     .get("type")
+        //     .assert_string("video.other");
+        // // json.value().object().get("url").assert_string("https://www.youtube.com/embed/5C_HPTJg5ek");
+
+        // let resp = server
+        //     .get("/api/resource/open_graphic_parse")
+        //     .header("X-API-Key", &admin_token)
+        //     .query("url", &"http://baidu.com/")
+        //     .send()
+        //     .await;
+        // resp.assert_status_is_ok();
+        // let json = resp.json().await;
+        // json.value()
+        //     .object()
+        //     .get("title")
+        //     .assert_string("百度一下，你就知�");
+    }
+
+    // #[tokio::test]
+    // async fn test_open_graphic_parse_directly() {
+    //     let a = open_graph::fetch("https://www.youtube.com/watch?v=5C_HPTJg5ek", None).await.unwrap();
+    //     dbg!(a);
+    // }
+
+    #[tokio::test]
+    async fn test_archive() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+
+        // upload avatar
+        let resp = server
+            .post("/api/user/avatar")
+            .header("X-API-Key", &user1_token)
+            .content_type("image/png")
+            .body(include_bytes!("assets/organization-logo.png").to_vec())
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "description": "abc",
+                "is_public": true,
+                "members": [],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let gid = resp.json().await.value().object().get("gid").i64();
+
+        let mid1 = server.send_text_to_group(&admin_token, gid, "abc").await;
+        let mid2 = server.send_text_to_group(&admin_token, gid, "def").await;
+
+        // upload_file_prepare
+        let resp = server
+            .post("/api/resource/file/prepare")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "content_type": "application/octet-stream",
+                "filename": "poem.png",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let file_id = json.value().string();
+
+        // upload file
+        let resp = server
+            .post("/api/resource/file/upload")
+            .header("X-API-Key", &admin_token)
+            .multipart(
+                TestForm::new()
+                    .text("file_id", file_id.to_string())
+                    .text("chunk_is_last", "true")
+                    .bytes("chunk_data", include_bytes!("assets/poem.png").to_vec()),
+            )
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let obj = json.value().object();
+        let file_path = obj.get("path").string().to_string();
+
+        let resp = server
+            .post(format!("/api/group/{}/send", gid))
+            .header("X-API-Key", &admin_token)
+            .content_type("vocechat/file")
+            .body_json(&json!({
+                "path": file_path,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let mid3 = resp.json().await.value().i64();
+
+        let mid4 = server.send_text_to_group(&user1_token, gid, "ghi").await;
+
+        // create archive
+        let resp = server
+            .post("/api/resource/archive")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "mid_list": [mid1, mid2, mid3, mid4],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let archive_path = resp.json().await.value().string().to_string();
+
+        // get archive index
+        let resp = server
+            .get("/api/resource/archive")
+            .query("file_path", &archive_path)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let json = json.value().object();
+
+        // check users
+        let users = json.get("users").array();
+
+        let user = users.get(0).object();
+        user.get("name").assert_string("admin");
+        user.get("avatar").assert_null();
+
+        let user = users.get(1).object();
+        user.get("name").assert_string("user1@voce.chat");
+        user.get("avatar").assert_i64(1);
+
+        // check messages
+        let messages = json.get("messages").array();
+        messages.assert_len(4);
+
+        let msg = messages.get(0).object();
+        msg.get("from_user").assert_i64(0);
+        msg.get("content_type").assert_string("text/plain");
+        msg.get("content").assert_string("abc");
+
+        let msg = messages.get(1).object();
+        msg.get("from_user").assert_i64(0);
+        msg.get("content_type").assert_string("text/plain");
+        msg.get("content").assert_string("def");
+
+        let msg = messages.get(2).object();
+        msg.get("from_user").assert_i64(0);
+        msg.get("content_type").assert_string("vocechat/file");
+        msg.get("file_id").assert_i64(0);
+
+        let msg = messages.get(3).object();
+        msg.get("from_user").assert_i64(1);
+        msg.get("content_type").assert_string("text/plain");
+        msg.get("content").assert_string("ghi");
+
+        // check attachment
+        let resp = server
+            .get("/api/resource/archive/attachment")
+            .query("file_path", &archive_path)
+            .query("attachment_id", &0)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.assert_header(
+            header::CONTENT_DISPOSITION,
+            r#"inline; filename="poem.png""#,
+        );
+        resp.assert_header(header::CONTENT_TYPE, "application/octet-stream");
+
+        let resp = server
+            .get("/api/resource/archive/attachment")
+            .query("file_path", &archive_path)
+            .query("attachment_id", &1)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+}
diff --git a/src/api/tags.rs b/src/api/tags.rs
new file mode 100644
index 0000000..5b666ab
--- /dev/null
+++ b/src/api/tags.rs
@@ -0,0 +1,52 @@
+use poem_openapi::Tags;
+
+#[derive(Tags)]
+pub enum ApiTags {
+    /// Token operations
+    Token,
+
+    /// User operations
+    User,
+
+    /// Group operations
+    Group,
+
+    /// Message operations
+    Message,
+
+    /// Resource operations
+    Resource,
+
+    /// Favorite archive operations
+    Favorite,
+
+    /// License operations
+    License,
+
+    /// User management operations
+    AdminUser,
+
+    /// System management operations
+    AdminSystem,
+
+    /// Agora management operations
+    AdminAgora,
+
+    /// Firebase management operations
+    AdminFirebase,
+
+    /// Smtp management operations
+    AdminSmtp,
+
+    /// Login management operations
+    AdminLogin,
+
+    /// Google auth management operations
+    AdminGoogleAuth,
+
+    /// Google auth management operations
+    AdminGithubAuth,
+
+    /// Bot operations
+    Bot,
+}
diff --git a/src/api/token.rs b/src/api/token.rs
new file mode 100644
index 0000000..c56e16c
--- /dev/null
+++ b/src/api/token.rs
@@ -0,0 +1,2123 @@
+use std::{collections::HashMap, ops::Deref, time::Duration};
+
+use bytes::Bytes;
+use chrono::Utc;
+use futures_util::TryFutureExt;
+use hmac::{Mac, NewMac};
+use openidconnect::{
+    core::{
+        CoreAuthenticationFlow, CoreClient, CoreClientRegistrationRequest, CoreIdTokenClaims,
+        CoreIdTokenVerifier, CoreJwsSigningAlgorithm, CoreProviderMetadata,
+    },
+    registration::EmptyAdditionalClientMetadata,
+    AuthorizationCode, CsrfToken, IssuerUrl, Nonce, PkceCodeChallenge, RedirectUrl, Scope,
+};
+use poem::{
+    error::{BadRequest, InternalServerError, ServiceUnavailable},
+    http::StatusCode,
+    web::Data,
+    Error, Request, Result,
+};
+use poem_openapi::{
+    auth::ApiKey,
+    param::{Header, Query},
+    payload::Json,
+    types::Example,
+    ApiResponse, Object, OpenApi, SecurityScheme, Union,
+};
+use rc_magic_link::MagicLinkToken;
+use rc_token::{parse_token, TokenType};
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+
+use crate::{
+    api::{
+        admin_login::{LoginConfig, WhoCanSignUp},
+        tags::ApiTags,
+        user::UserInfo,
+        DateTime, KickReason,
+    },
+    create_user::{CreateUser, CreateUserBy, CreateUserError},
+    middleware::guest_forbidden,
+    state::{CacheDevice, OAuth2State, UserEvent, UserStatus},
+    State,
+};
+
+#[derive(Debug, Serialize, Deserialize, Clone, Eq, PartialEq)]
+pub struct CurrentUser {
+    pub uid: i64,
+    pub device: String,
+    pub is_admin: bool,
+    pub is_guest: bool,
+}
+
+/// ApiKey authorization
+#[derive(SecurityScheme)]
+#[oai(
+    type = "api_key",
+    key_name = "X-API-Key",
+    in = "header",
+    checker = "api_checker"
+)]
+pub struct Token(pub CurrentUser);
+
+impl Deref for Token {
+    type Target = CurrentUser;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+/// ApiKey authorization
+#[derive(SecurityScheme)]
+#[oai(
+    type = "api_key",
+    key_name = "api-key",
+    in = "query",
+    checker = "api_checker"
+)]
+pub struct TokenInQuery(pub CurrentUser);
+
+impl Deref for TokenInQuery {
+    type Target = CurrentUser;
+
+    fn deref(&self) -> &Self::Target {
+        &self.0
+    }
+}
+
+async fn api_checker(req: &Request, api_key: ApiKey) -> Option<CurrentUser> {
+    let state = req.extensions().get::<State>().unwrap();
+    let key_config = state.key_config.read().await;
+    let (token_type, current_user): (_, CurrentUser) =
+        parse_token(&key_config.server_key, &api_key.key, true).ok()?;
+    if token_type != TokenType::AccessToken {
+        return None;
+    }
+    Some(current_user)
+}
+
+#[derive(Debug, Object)]
+struct LoginCredentialPassword {
+    /// Email
+    email: String,
+
+    /// Password
+    password: String,
+}
+
+#[derive(Debug, Object)]
+struct LoginCredentialMagicLink {
+    /// Login magic token
+    magic_token: String,
+
+    /// Register directly through login magic link
+    #[oai(default)]
+    extra_name: String,
+}
+
+#[derive(Debug, Object)]
+struct LoginCredentialGoogleIdToken {
+    /// Google id token
+    id_token: String,
+    #[oai(default)]
+    magic_token: String,
+}
+
+#[derive(Debug, Object)]
+struct LoginCredentialGithubCode {
+    /// Github code
+    code: String,
+    #[oai(default)]
+    magic_token: String,
+}
+
+#[derive(Debug, Object)]
+struct LoginCredentialOpenIdConnect {
+    code: String,
+    #[oai(rename = "state")]
+    oidc_state: String,
+    #[oai(default)]
+    magic_token: String,
+}
+
+#[derive(Debug, Object)]
+struct LoginCredentialMetaMask {
+    public_address: String,
+    nonce: String,
+    signature: String,
+    #[oai(default)]
+    magic_token: String,
+}
+
+#[derive(Debug, Object)]
+struct LoginCredentialThirdParty {
+    key: String,
+}
+
+/// Login credential
+#[derive(Debug, Union)]
+#[oai(discriminator_name = "type")]
+enum LoginCredential {
+    #[oai(mapping = "password")]
+    Password(LoginCredentialPassword),
+    #[oai(mapping = "magiclink")]
+    MagicLink(LoginCredentialMagicLink),
+    #[oai(mapping = "google")]
+    GoogleIdToken(LoginCredentialGoogleIdToken),
+    #[oai(mapping = "github")]
+    GithubCode(LoginCredentialGithubCode),
+    #[oai(mapping = "oidc")]
+    OpenIdConnect(LoginCredentialOpenIdConnect),
+    #[oai(mapping = "metamask")]
+    MetaMask(LoginCredentialMetaMask),
+    #[oai(mapping = "thirdparty")]
+    ThirdParty(LoginCredentialThirdParty),
+}
+
+impl LoginCredential {
+    fn magic_token(&self) -> Option<&str> {
+        match self {
+            LoginCredential::Password(_) => None,
+            LoginCredential::MagicLink(LoginCredentialMagicLink { magic_token, .. }) => {
+                Some(magic_token.as_str())
+            }
+            LoginCredential::GoogleIdToken(LoginCredentialGoogleIdToken {
+                magic_token, ..
+            }) => Some(magic_token.as_str()),
+            LoginCredential::GithubCode(LoginCredentialGithubCode { magic_token, .. }) => {
+                Some(magic_token.as_str())
+            }
+            LoginCredential::OpenIdConnect(LoginCredentialOpenIdConnect {
+                magic_token, ..
+            }) => Some(magic_token.as_str()),
+            LoginCredential::MetaMask(LoginCredentialMetaMask { magic_token, .. }) => {
+                Some(magic_token.as_str())
+            }
+            LoginCredential::ThirdParty(_) => None,
+        }
+    }
+}
+
+/// Login request
+#[derive(Debug, Object)]
+#[oai(example)]
+struct LoginRequest {
+    /// Credential
+    credential: LoginCredential,
+
+    /// Device id
+    #[oai(default = "default_device")]
+    device: String,
+
+    /// FCM device token
+    device_token: Option<String>,
+}
+
+impl Example for LoginRequest {
+    fn example() -> Self {
+        LoginRequest {
+            credential: LoginCredential::Password(LoginCredentialPassword {
+                email: "admin@voce.chat".to_string(),
+                password: "123456".to_string(),
+            }),
+            device: "web".to_string(),
+            device_token: None,
+        }
+    }
+}
+
+#[derive(Debug, Deserialize, Serialize, PartialEq)]
+struct GoogleIdTokenPayload {
+    email: String,
+    name: Option<String>,
+    picture: Option<String>,
+}
+
+#[derive(Debug, Deserialize, Serialize, PartialEq)]
+struct GithubTokenPayload {
+    username: String,
+    name: Option<String>,
+    picture: Option<String>,
+}
+
+fn default_device() -> String {
+    "unknown".to_string()
+}
+
+/// Token response
+#[derive(Debug, Object)]
+pub struct LoginResponse {
+    /// Server id
+    server_id: String,
+    /// Access token
+    token: String,
+    /// Refresh token
+    refresh_token: String,
+    /// The access token expired in seconds
+    expired_in: i64,
+    /// User info
+    user: UserInfo,
+}
+
+#[derive(ApiResponse)]
+pub enum LoginApiResponse {
+    /// Login success
+    #[oai(status = 200)]
+    Ok(Json<LoginResponse>),
+    /// Login method does not supported
+    #[oai(status = 403)]
+    LoginMethodNotSupported,
+    /// Invalid account or password
+    #[oai(status = 401)]
+    InvalidAccount,
+    /// User does not exists
+    #[oai(status = 404)]
+    UserDoesNotExist,
+    /// User has been frozen
+    #[oai(status = 423)]
+    Frozen,
+    /// Email collision
+    #[oai(status = 409)]
+    EmailConflict,
+    /// Account not associated
+    #[oai(status = 410)]
+    AccountNotAssociated,
+}
+
+/// Bind credential
+#[derive(Debug, Union)]
+#[oai(discriminator_name = "type")]
+enum BindCredential {
+    #[oai(mapping = "google")]
+    GoogleIdToken(LoginCredentialGoogleIdToken),
+    #[oai(mapping = "github")]
+    GithubCode(LoginCredentialGithubCode),
+    #[oai(mapping = "oidc")]
+    OpenIdConnect(LoginCredentialOpenIdConnect),
+    #[oai(mapping = "metamask")]
+    MetaMask(LoginCredentialMetaMask),
+}
+
+/// Bind request
+#[derive(Debug, Object)]
+struct BindRequest {
+    /// Credential
+    credential: BindCredential,
+}
+
+#[derive(ApiResponse)]
+enum BindApiResponse {
+    /// Login success
+    #[oai(status = 200)]
+    Ok,
+    /// Login method does not supported
+    #[oai(status = 403)]
+    LoginMethodNotSupported,
+    /// Invalid credential
+    #[oai(status = 401)]
+    InvalidCredential,
+    #[oai(status = 409)]
+    Exists,
+}
+
+/// Credentials response
+#[derive(Debug, Object)]
+struct CredentialsResponse {
+    password: bool,
+    google: Option<String>,
+    metamask: Option<String>,
+    oidc: Vec<String>,
+}
+
+/// Renew token request
+#[derive(Debug, Object)]
+struct RenewTokenRequest {
+    token: String,
+    refresh_token: String,
+}
+
+/// Renew token response
+#[derive(Debug, Object)]
+struct RenewTokenResponse {
+    /// Access token
+    token: String,
+    /// Refresh token
+    refresh_token: String,
+    /// The access token expired in seconds
+    expired_in: i64,
+}
+
+#[derive(ApiResponse)]
+enum RenewTokenApiResponse {
+    /// Renew success
+    #[oai(status = 200)]
+    Ok(Json<RenewTokenResponse>),
+    /// Illegal token
+    #[oai(status = 401)]
+    IllegalToken,
+}
+
+#[derive(ApiResponse)]
+enum LogoutApiResponse {
+    /// Logout success
+    #[oai(status = 200)]
+    Ok,
+    /// Illegal token
+    #[oai(status = 401)]
+    IllegalToken,
+}
+
+#[derive(Debug, Object)]
+struct OpenIdAuthorizeRequest {
+    issuer: String,
+    redirect_uri: String,
+}
+
+#[derive(Debug, Object)]
+struct OpenIdAuthorizeResponse {
+    url: String,
+}
+
+#[derive(Debug, Object)]
+struct CreateThirdPartyKeyRequest {
+    userid: String,
+    username: String,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+struct ThirdPartyLoginInfo {
+    userid: String,
+    username: String,
+    expired_at: chrono::DateTime<Utc>,
+}
+
+/// Update device token request
+#[derive(Debug, Object)]
+struct UpdateDeviceTokenRequest {
+    device_token: Option<String>,
+}
+
+pub struct ApiToken;
+
+#[OpenApi(prefix_path = "/token", tag = "ApiTags::Token")]
+impl ApiToken {
+    /// OpenId authorize
+    #[oai(path = "/openid/authorize", method = "post")]
+    async fn openid_authorize(
+        &self,
+        state: Data<&State>,
+        req: Json<OpenIdAuthorizeRequest>,
+    ) -> Result<Json<OpenIdAuthorizeResponse>> {
+        let mut provider_metadata = None;
+        let login_cfg = state
+            .get_dynamic_config_instance::<LoginConfig>()
+            .await
+            .unwrap_or_default();
+        if !login_cfg
+            .oidc
+            .iter()
+            .any(|oidc| oidc.domain == req.issuer && oidc.enable)
+        {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        for url in [
+            format!("https://{}", req.0.issuer),
+            format!("https://{}/", req.0.issuer),
+        ] {
+            let issuer_url = IssuerUrl::new(url).map_err(BadRequest)?;
+            if let Ok(metadata) = CoreProviderMetadata::discover_async(
+                issuer_url.clone(),
+                openidconnect::reqwest::async_http_client,
+            )
+            .await
+            {
+                provider_metadata = Some((issuer_url, metadata));
+                break;
+            }
+        }
+
+        let (issuer_url, provider_metadata) =
+            provider_metadata.ok_or_else(|| Error::from_status(StatusCode::SERVICE_UNAVAILABLE))?;
+        let redirect_uri = RedirectUrl::new(req.0.redirect_uri).map_err(BadRequest)?;
+
+        let registration_endpoint = provider_metadata
+            .registration_endpoint()
+            .ok_or_else(|| Error::from_status(StatusCode::SERVICE_UNAVAILABLE))?;
+        tracing::debug!(
+            issuer_url = issuer_url.as_str(),
+            redirect_uri = redirect_uri.as_str(),
+            registration_endpoint = registration_endpoint.as_str(),
+            "registration endpoint",
+        );
+
+        let registration_response = CoreClientRegistrationRequest::new(
+            vec![redirect_uri.clone()],
+            EmptyAdditionalClientMetadata::default(),
+        )
+        .register_async(
+            registration_endpoint,
+            openidconnect::reqwest::async_http_client,
+        )
+        .await
+        .map_err(ServiceUnavailable)?;
+
+        tracing::debug!(
+            issuer_url = issuer_url.as_str(),
+            redirect_uri = redirect_uri.as_str(),
+            "openid authorize",
+        );
+
+        let client = CoreClient::new(
+            registration_response.client_id().clone(),
+            registration_response.client_secret().cloned(),
+            provider_metadata.issuer().clone(),
+            provider_metadata.authorization_endpoint().clone(),
+            provider_metadata.token_endpoint().cloned(),
+            provider_metadata.userinfo_endpoint().cloned(),
+            provider_metadata.jwks().clone(),
+        )
+        .set_redirect_uri(redirect_uri);
+
+        let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();
+        let (auth_url, csrf_token, nonce) = client
+            .authorize_url(
+                CoreAuthenticationFlow::AuthorizationCode,
+                CsrfToken::new_random,
+                Nonce::new_random,
+            )
+            .add_scope(Scope::new("openid".to_string()))
+            .set_pkce_challenge(pkce_challenge)
+            .url();
+
+        tracing::debug!(
+            authorize_url = auth_url.as_str(),
+            "authorization url generated"
+        );
+
+        state.pending_oidc.lock().await.insert(
+            csrf_token.secret().to_string(),
+            OAuth2State {
+                client,
+                issuer: req.0.issuer,
+                pkce_verifier,
+                csrf_token: csrf_token.clone(),
+                nonce,
+            },
+        );
+
+        tokio::spawn({
+            let state = state.clone();
+            async move {
+                // timeout
+                tokio::time::sleep(Duration::from_secs(150)).await;
+                state.pending_oidc.lock().await.remove(csrf_token.secret());
+            }
+        });
+
+        Ok(Json(OpenIdAuthorizeResponse {
+            url: auth_url.to_string(),
+        }))
+    }
+
+    /// Get the nonce for MetaMask login
+    #[oai(path = "/metamask/nonce", method = "get")]
+    async fn metamask_nonce(
+        &self,
+        state: Data<&State>,
+        public_address: Query<String>,
+    ) -> Result<Json<String>> {
+        let public_address = public_address.0.to_lowercase();
+        let nonce = textnonce::TextNonce::new();
+        let sql = r#"
+        insert into metamask_nonce (public_address, nonce) values (?, ?)
+            on conflict (public_address) do update set nonce = excluded.nonce
+            "#;
+        sqlx::query(sql)
+            .bind(&public_address)
+            .bind(&nonce.0)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+        Ok(Json(nonce.0))
+    }
+
+    /// Create a key for third-party user login.
+    #[oai(method = "post", path = "/create_third_party_key")]
+    async fn create_third_party_key(
+        &self,
+        state: Data<&State>,
+        req: Json<CreateThirdPartyKeyRequest>,
+        #[oai(name = "X-SECRET")] secret: Header<String>,
+    ) -> Result<Json<String>> {
+        let key_config = state.key_config.read().await;
+        if secret.0 != key_config.third_party_secret {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let info = ThirdPartyLoginInfo {
+            userid: req.0.userid,
+            username: req.0.username,
+            expired_at: chrono::Utc::now() + chrono::Duration::seconds(60 * 2),
+        };
+        let key_content = serde_json::to_vec(&info).unwrap();
+        let mut buf_sig = {
+            let mut mac =
+                hmac::Hmac::<Sha256>::new_from_slice(key_config.server_key.as_bytes()).unwrap();
+            mac.update(&key_content);
+            mac.finalize().into_bytes().to_vec()
+        };
+        buf_sig.extend_from_slice(&key_content);
+        Ok(Json(hex::encode(&buf_sig)))
+    }
+
+    /// Login as guest
+    #[oai(path = "/login_guest", method = "get")]
+    async fn login_guest(&self, state: Data<&State>) -> Result<LoginApiResponse> {
+        let login_cfg = state
+            .get_dynamic_config_instance::<LoginConfig>()
+            .await
+            .unwrap_or_default();
+        if !login_cfg.guest {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let name = state.cache.read().await.assign_username(None, None);
+        let (uid, _) = state
+            .create_user(CreateUser::new(&name, CreateUserBy::Guest, false))
+            .await
+            .map_err(|err| {
+                Error::from_string(format!("{:?}", err), StatusCode::INTERNAL_SERVER_ERROR)
+            })?;
+        do_login(&state, uid, "guest_device", None).await
+    }
+
+    /// Login
+    #[oai(path = "/login", method = "post")]
+    async fn login(
+        &self,
+        state: Data<&State>,
+        req: Json<LoginRequest>,
+        request: &Request,
+    ) -> Result<LoginApiResponse> {
+        // let smtp_on = state
+        //     .load_dynamic_config::<crate::api::SmtpConfig>()
+        //     .await?
+        //     .enabled;
+
+        crate::license::check_license_wrap!(&state, request);
+
+        let login_cfg = state
+            .get_dynamic_config_instance::<LoginConfig>()
+            .await
+            .unwrap_or_default();
+        let key_config = state.key_config.read().await;
+        let magic_token = match req.credential.magic_token() {
+            Some(s) if !s.is_empty() => match MagicLinkToken::parse(&key_config.server_key, s) {
+                Some(mt) => Some(mt),
+                None => {
+                    return Err(Error::from_status(StatusCode::BAD_REQUEST));
+                }
+            },
+            _ => None,
+        };
+        if magic_token.is_some() {
+            let code = magic_token.as_ref().unwrap().get_code();
+            if !state.magic_code_check_code(code).await {
+                return Err(poem::Error::from_status(StatusCode::BAD_REQUEST));
+            }
+        }
+
+        let can_register = match login_cfg.who_can_sign_up {
+            WhoCanSignUp::InvitationOnly => magic_token.is_some(),
+            _ => true,
+        };
+
+        let uid = match req.0.credential {
+            // login with password
+            LoginCredential::Password(LoginCredentialPassword { email, password })
+                if login_cfg.password =>
+            {
+                let email = email.to_lowercase();
+                let cache = state.cache.read().await;
+                let uid = match cache
+                    .users
+                    .iter()
+                    .find(|(_, user)| user.email.as_ref() == Some(&email))
+                {
+                    Some((uid, cached_user)) => {
+                        if cached_user.password.as_ref() != Some(&password) {
+                            return Ok(LoginApiResponse::InvalidAccount);
+                        }
+                        *uid
+                    }
+                    None => return Ok(LoginApiResponse::UserDoesNotExist),
+                };
+                uid
+            }
+
+            // login with magic link
+            LoginCredential::MagicLink(LoginCredentialMagicLink {
+                magic_token,
+                extra_name,
+            }) => {
+                let (email, uid, code, _expired_at) = match MagicLinkToken::parse(
+                    &state.key_config.read().await.server_key,
+                    &magic_token,
+                ) {
+                    Some(MagicLinkToken::Login {
+                        email,
+                        uid,
+                        code,
+                        expired_at,
+                    }) => (email, uid, code, expired_at),
+                    _ => return Ok(LoginApiResponse::InvalidAccount),
+                };
+
+                {
+                    // let smtp_on = true;
+                    // let cache = state.cache.read().await;
+                    // let r = cache.codes.codes.get(&code);
+                    if !state.magic_code_check_code(&code).await {
+                        state.login_magic_code_remove(&code).await;
+                        return Err(Error::from_string("Bad code.", StatusCode::BAD_REQUEST));
+                    }
+                }
+
+                let username = if extra_name.is_empty() {
+                    None
+                } else {
+                    Some(extra_name)
+                };
+                let uid = match (uid, username.as_ref()) {
+                    (Some(uid), None) => uid,
+                    (None, Some(username)) => {
+                        // create a new user
+                        if !can_register {
+                            return Ok(LoginApiResponse::AccountNotAssociated);
+                        }
+
+                        let name = state
+                            .cache
+                            .write()
+                            .await
+                            .assign_username(Some(username), Some(username))
+                            .into_owned();
+                        let create_user = CreateUser::new(
+                            &name,
+                            CreateUserBy::MagicLink { email: &email },
+                            false,
+                        );
+                        match state.create_user(create_user).await {
+                            Ok((uid, _)) => uid,
+                            Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                        }
+                    }
+                    _ => return Ok(LoginApiResponse::InvalidAccount),
+                };
+                // state.magic_code_check_update_by_email(email);
+                uid
+            }
+            // login with google id token
+            LoginCredential::GoogleIdToken(LoginCredentialGoogleIdToken { id_token, .. })
+                if login_cfg.google =>
+            {
+                let payload = parse_google_id_token(&id_token)
+                    .await
+                    .map_err(|err| poem::Error::from((StatusCode::BAD_REQUEST, err)))?;
+                let sql = "select uid from google_auth where email = ?";
+                match sqlx::query_as::<_, (i64,)>(sql)
+                    .bind(&payload.email)
+                    .fetch_optional(&state.db_pool)
+                    .await
+                    .map_err(InternalServerError)?
+                {
+                    Some((uid,)) => uid,
+                    // create a new user
+                    None => {
+                        if !can_register {
+                            return Ok(LoginApiResponse::AccountNotAssociated);
+                        }
+
+                        // bind same email.
+                        let uid = state
+                            .cache
+                            .read()
+                            .await
+                            .users
+                            .iter()
+                            .find(|(_, user)| user.email.as_ref() == Some(&payload.email))
+                            .map(|(uid, _)| *uid);
+
+                        if let Some(uid) = uid {
+                            let sql = "insert into google_auth (email, uid) values (?, ?)";
+                            sqlx::query(sql)
+                                .bind(&payload.email)
+                                .bind(uid)
+                                .execute(&state.db_pool)
+                                .await
+                                .map_err(InternalServerError)?;
+                            uid
+                        } else {
+                            // download avatar
+                            let avatar = match &payload.picture {
+                                Some(url) => download_avatar(url).await.ok(),
+                                None => None,
+                            };
+
+                            let name = state
+                                .cache
+                                .write()
+                                .await
+                                .assign_username(payload.name.as_deref(), Some(&payload.email))
+                                .into_owned();
+
+                            let mut create_user = CreateUser::new(
+                                &name,
+                                CreateUserBy::Google {
+                                    email: &payload.email,
+                                },
+                                false,
+                            );
+                            if let Some(avatar) = &avatar {
+                                create_user = create_user.avatar(avatar);
+                            }
+
+                            match state.create_user(create_user).await {
+                                Ok((uid, _)) => uid,
+                                Err(CreateUserError::EmailConflict) => {
+                                    return Ok(LoginApiResponse::EmailConflict)
+                                }
+                                Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                            }
+                        }
+                    }
+                }
+            }
+            // login with github code
+            LoginCredential::GithubCode(LoginCredentialGithubCode { code, .. })
+                if login_cfg.github =>
+            {
+                // fetch id_token by code
+                let token = github_fetch_token(&code, &state)
+                    .await
+                    .map_err(|err| poem::Error::from((StatusCode::BAD_REQUEST, err)))?;
+                let github_userinfo = github_fetch_user_info(&token)
+                    .await
+                    .map_err(|err| poem::Error::from((StatusCode::BAD_REQUEST, err)))?;
+                let sql = "select uid from github_auth where username = ?";
+                match sqlx::query_as::<_, (i64,)>(sql)
+                    .bind(&github_userinfo.username)
+                    .fetch_optional(&state.db_pool)
+                    .await
+                    .map_err(InternalServerError)?
+                {
+                    Some((uid,)) => uid,
+                    // create a new user
+                    None => {
+                        if !can_register {
+                            return Ok(LoginApiResponse::AccountNotAssociated);
+                        }
+
+                        let uid = state
+                            .cache
+                            .read()
+                            .await
+                            .users
+                            .iter()
+                            .find(|(_, user)| user.email.as_ref() == github_userinfo.email.as_ref())
+                            .map(|(uid, _)| *uid);
+                        if let Some(uid) = uid {
+                            let sql = "insert into github_auth (username, uid) values (?, ?)";
+                            sqlx::query(sql)
+                                .bind(&github_userinfo.username)
+                                .bind(uid)
+                                .execute(&state.db_pool)
+                                .await
+                                .map_err(InternalServerError)?;
+                            uid
+                        } else {
+                            // download avatar
+                            let avatar = match &github_userinfo.avatar_url {
+                                Some(avatar_url) => download_avatar(avatar_url).await.ok(),
+                                None => None,
+                            };
+
+                            let name = state
+                                .cache
+                                .write()
+                                .await
+                                .assign_username(Some(&github_userinfo.username), None);
+
+                            let mut create_user = CreateUser::new(
+                                &name,
+                                CreateUserBy::Github {
+                                    username: github_userinfo.username.as_str(),
+                                },
+                                false,
+                            );
+                            if let Some(avatar) = &avatar {
+                                create_user = create_user.avatar(avatar);
+                            }
+
+                            match state.create_user(create_user).await {
+                                Ok((uid, _)) => uid,
+                                Err(CreateUserError::EmailConflict) => {
+                                    return Ok(LoginApiResponse::EmailConflict)
+                                }
+                                Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                            }
+                        }
+                    }
+                }
+            }
+            // login with open id connect
+            LoginCredential::OpenIdConnect(LoginCredentialOpenIdConnect {
+                code,
+                oidc_state,
+                ..
+            }) => {
+                let item = {
+                    let mut pending_oidc = state.pending_oidc.lock().await;
+                    match pending_oidc.remove(&oidc_state) {
+                        Some(item) => item,
+                        None => {
+                            tracing::debug!("oidc id does not exist");
+                            return Ok(LoginApiResponse::InvalidAccount);
+                        }
+                    }
+                };
+
+                tracing::debug!("wait for oauth2 response");
+
+                let issuer = item.issuer.clone();
+                let id_token = match oidc_get_id_token(item, code, oidc_state).await {
+                    Ok(id_token) => id_token,
+                    Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                };
+
+                let subject = id_token.subject().to_string();
+                let email = if id_token.email_verified().unwrap_or_default() {
+                    id_token.email().map(|email| email.to_string())
+                } else {
+                    None
+                };
+                let name = id_token
+                    .name()
+                    .and_then(|name| name.iter().next().map(|(_, name)| name.to_string()));
+                let picture = id_token.picture().and_then(|picture| {
+                    picture
+                        .iter()
+                        .next()
+                        .map(|(_, picture)| picture.to_string())
+                });
+
+                let sql = "select uid from openid_connect where issuer = ? and subject = ?";
+                match sqlx::query_as::<_, (i64,)>(sql)
+                    .bind(&issuer)
+                    .bind(&subject)
+                    .fetch_optional(&state.db_pool)
+                    .await
+                    .map_err(InternalServerError)?
+                {
+                    Some((uid,)) => uid,
+                    // create a new user
+                    None => {
+                        if !can_register {
+                            return Ok(LoginApiResponse::AccountNotAssociated);
+                        }
+
+                        // download avatar
+                        let avatar = match &picture {
+                            Some(url) => download_avatar(url).await.ok(),
+                            None => None,
+                        };
+
+                        let name = state
+                            .cache
+                            .write()
+                            .await
+                            .assign_username(name.as_deref(), email.as_deref());
+
+                        let mut create_user = CreateUser::new(
+                            &name,
+                            CreateUserBy::OpenIdConnect {
+                                issuer: &issuer,
+                                subject: &subject,
+                                email: email.as_deref(),
+                            },
+                            false,
+                        );
+                        if let Some(avatar) = &avatar {
+                            create_user = create_user.avatar(avatar);
+                        }
+
+                        match state.create_user(create_user).await {
+                            Ok((uid, _)) => uid,
+                            Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                        }
+                    }
+                }
+            }
+            LoginCredential::MetaMask(LoginCredentialMetaMask {
+                public_address,
+                nonce,
+                signature,
+                ..
+            }) if login_cfg.metamask => {
+                // Reference: https://github.com/MetaMask/test-dapp
+                // https://metamask.github.io/test-dapp/
+
+                let public_address = public_address.to_lowercase();
+                if !check_metamask_public_address(&state, &public_address, &nonce, &signature)
+                    .await?
+                {
+                    return Ok(LoginApiResponse::InvalidAccount);
+                }
+
+                let sql = "select uid from metamask_auth where public_address = ?";
+                match sqlx::query_as::<_, (i64,)>(sql)
+                    .bind(&public_address)
+                    .fetch_optional(&state.db_pool)
+                    .await
+                    .map_err(InternalServerError)?
+                {
+                    Some((uid,)) => uid,
+                    // create a new user
+                    None => {
+                        if !can_register {
+                            return Ok(LoginApiResponse::AccountNotAssociated);
+                        }
+
+                        let name = state.cache.write().await.assign_username(None, None);
+                        let create_user = CreateUser::new(
+                            &name,
+                            CreateUserBy::MetaMask {
+                                public_address: &public_address,
+                            },
+                            false,
+                        );
+                        match state.create_user(create_user).await {
+                            Ok((uid, _)) => uid,
+                            Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                        }
+                    }
+                }
+            }
+            LoginCredential::ThirdParty(LoginCredentialThirdParty { key })
+                if login_cfg.third_party =>
+            {
+                let data = match hex::decode(&key) {
+                    Ok(data) => data,
+                    Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                };
+                let key_config = state.key_config.read().await;
+                let mut mac =
+                    hmac::Hmac::<Sha256>::new_from_slice(key_config.server_key.as_bytes()).unwrap();
+                mac.update(&data[32..]);
+                if mac.verify(&data[..32]).is_err() {
+                    return Ok(LoginApiResponse::InvalidAccount);
+                }
+                let info: ThirdPartyLoginInfo = match serde_json::from_slice(&data[32..]) {
+                    Ok(info) => info,
+                    Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                };
+                if info.expired_at < Utc::now() {
+                    return Ok(LoginApiResponse::InvalidAccount);
+                }
+
+                let sql = "select uid from third_party_users where userid = ?";
+                match sqlx::query_as::<_, (i64,)>(sql)
+                    .bind(&info.userid)
+                    .fetch_optional(&state.db_pool)
+                    .await
+                    .map_err(InternalServerError)?
+                {
+                    Some((uid,)) => uid,
+                    // create a new user
+                    None => {
+                        let name = state
+                            .cache
+                            .write()
+                            .await
+                            .assign_username(Some(&info.username), None);
+                        let create_user = CreateUser::new(
+                            &name,
+                            CreateUserBy::ThirdParty {
+                                thirdparty_uid: &info.userid,
+                                username: &info.username,
+                            },
+                            false,
+                        );
+                        match state.create_user(create_user).await {
+                            Ok((uid, _)) => uid,
+                            Err(_) => return Ok(LoginApiResponse::InvalidAccount),
+                        }
+                    }
+                }
+            }
+            _ => return Ok(LoginApiResponse::LoginMethodNotSupported),
+        };
+
+        do_login(&state, uid, &req.0.device, req.0.device_token.as_deref()).await
+    }
+
+    /// Bind credential
+    #[oai(path = "/bind", method = "post", transform = "guest_forbidden")]
+    async fn bind(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<BindRequest>,
+    ) -> Result<BindApiResponse> {
+        let login_cfg = state
+            .get_dynamic_config_instance::<LoginConfig>()
+            .await
+            .unwrap_or_default();
+
+        match req.0.credential {
+            BindCredential::GoogleIdToken(id_token) if login_cfg.google => {
+                if get_credential_google(&state, token.uid).await?.is_some() {
+                    return Ok(BindApiResponse::Exists);
+                }
+                match parse_google_id_token(&id_token.id_token).await {
+                    Ok(GoogleIdTokenPayload { email, .. }) => {
+                        let email = email.to_lowercase();
+                        let sql = "insert into google_auth (email, uid) values (?, ?)";
+                        sqlx::query(sql)
+                            .bind(email)
+                            .bind(token.uid)
+                            .execute(&state.db_pool)
+                            .await
+                            .map_err(InternalServerError)?;
+                    }
+                    Err(_) => return Ok(BindApiResponse::InvalidCredential),
+                }
+            }
+            BindCredential::GithubCode(code) if login_cfg.github => {
+                if get_credential_github(&state, token.uid).await?.is_some() {
+                    return Ok(BindApiResponse::Exists);
+                }
+                let github_token = github_fetch_token(&code.code, &state).await?;
+                match github_fetch_user_info(&github_token).await {
+                    Ok(GithubUserInfo { username, .. }) => {
+                        let sql = "insert into github_auth (username, uid) values (?, ?)";
+                        sqlx::query(sql)
+                            .bind(username)
+                            .bind(token.uid)
+                            .execute(&state.db_pool)
+                            .await
+                            .map_err(InternalServerError)?;
+                    }
+                    Err(_) => return Ok(BindApiResponse::InvalidCredential),
+                };
+            }
+            BindCredential::OpenIdConnect(LoginCredentialOpenIdConnect {
+                code,
+                oidc_state,
+                ..
+            }) => {
+                let item = {
+                    let mut pending_oidc = state.pending_oidc.lock().await;
+                    match pending_oidc.remove(&oidc_state) {
+                        Some(item) => item,
+                        None => {
+                            tracing::debug!("oidc id does not exist");
+                            return Ok(BindApiResponse::InvalidCredential);
+                        }
+                    }
+                };
+
+                if get_credentials_openid(&state, token.uid)
+                    .await?
+                    .iter()
+                    .any(|issuer| &item.issuer == issuer)
+                {
+                    return Ok(BindApiResponse::Exists);
+                }
+
+                tracing::debug!("wait for oauth2 response");
+
+                let issuer = item.issuer.clone();
+                let id_token = match oidc_get_id_token(item, code, oidc_state).await {
+                    Ok(id_token) => id_token,
+                    Err(_) => return Ok(BindApiResponse::InvalidCredential),
+                };
+
+                let sql = "insert into openid_connect (issuer, subject, uid) values (?, ?, ?)";
+                sqlx::query(sql)
+                    .bind(&issuer)
+                    .bind(id_token.subject().as_str())
+                    .bind(token.uid)
+                    .execute(&state.db_pool)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+            BindCredential::MetaMask(LoginCredentialMetaMask {
+                public_address,
+                nonce,
+                signature,
+                ..
+            }) if login_cfg.metamask => {
+                if get_credential_metamask(&state, token.uid).await?.is_some() {
+                    return Ok(BindApiResponse::Exists);
+                }
+
+                let public_address = public_address.to_lowercase();
+                if !check_metamask_public_address(&state, &public_address, &nonce, &signature)
+                    .await?
+                {
+                    return Ok(BindApiResponse::InvalidCredential);
+                }
+
+                let sql = "insert into metamask_auth (public_address, uid) values (?, ?)";
+                sqlx::query(sql)
+                    .bind(public_address)
+                    .bind(token.uid)
+                    .execute(&state.db_pool)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+            _ => return Ok(BindApiResponse::LoginMethodNotSupported),
+        }
+
+        Ok(BindApiResponse::Ok)
+    }
+
+    /// Get the credentials of current user
+    #[oai(path = "/credentials", method = "get")]
+    async fn credentials(
+        &self,
+        state: Data<&State>,
+        token: Token,
+    ) -> Result<Json<CredentialsResponse>> {
+        let cache = state.cache.read().await;
+        let cached_user = cache
+            .users
+            .get(&token.uid)
+            .ok_or_else(|| Error::from(StatusCode::UNAUTHORIZED))?;
+
+        Ok(Json(CredentialsResponse {
+            password: cached_user.password.is_some(),
+            google: get_credential_google(&state, token.uid).await?,
+            metamask: get_credential_metamask(&state, token.uid).await?,
+            oidc: get_credentials_openid(&state, token.uid).await?,
+        }))
+    }
+
+    /// Renew the refresh token
+    #[oai(path = "/renew", method = "post")]
+    async fn renew(
+        &self,
+        state: Data<&State>,
+        req: Json<RenewTokenRequest>,
+    ) -> Result<RenewTokenApiResponse> {
+        let key_config = state.key_config.read().await;
+        let (token_type1, current_user1): (TokenType, CurrentUser) =
+            match rc_token::parse_token(&key_config.server_key, &req.token, false) {
+                Ok(res) => res,
+                Err(_) => return Ok(RenewTokenApiResponse::IllegalToken),
+            };
+        if token_type1 != TokenType::AccessToken {
+            return Ok(RenewTokenApiResponse::IllegalToken);
+        }
+
+        let (token_type2, current_user2): (TokenType, CurrentUser) =
+            match rc_token::parse_token(&key_config.server_key, &req.refresh_token, true) {
+                Ok(res) => res,
+                Err(_) => return Ok(RenewTokenApiResponse::IllegalToken),
+            };
+        if token_type2 != TokenType::RefreshToken {
+            return Ok(RenewTokenApiResponse::IllegalToken);
+        }
+
+        if current_user1 != current_user2 {
+            return Ok(RenewTokenApiResponse::IllegalToken);
+        }
+
+        let (prev_refresh_token,) = match sqlx::query_as::<_, (String,)>(
+            "select token from refresh_token where uid = ? and device = ?",
+        )
+        .bind(current_user1.uid)
+        .bind(&current_user1.device)
+        .fetch_optional(&state.db_pool)
+        .await
+        .map_err(InternalServerError)?
+        {
+            Some(res) => res,
+            None => return Ok(RenewTokenApiResponse::IllegalToken),
+        };
+
+        if prev_refresh_token != req.refresh_token {
+            return Ok(RenewTokenApiResponse::IllegalToken);
+        }
+
+        let (refresh_token, token) = rc_token::create_token_pair(
+            &key_config.server_key,
+            current_user1.clone(),
+            state.config.system.refresh_token_expiry_seconds,
+            state.config.system.token_expiry_seconds,
+        )
+        .map_err(InternalServerError)?;
+
+        sqlx::query("update refresh_token set token = ? where uid = ? and device = ?")
+            .bind(&refresh_token)
+            .bind(current_user1.uid)
+            .bind(current_user1.device)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        Ok(RenewTokenApiResponse::Ok(Json(RenewTokenResponse {
+            token,
+            refresh_token,
+            expired_in: state.config.system.token_expiry_seconds,
+        })))
+    }
+
+    /// Logout
+    #[oai(path = "/logout", method = "get")]
+    async fn logout(&self, state: Data<&State>, token: Token) -> Result<LogoutApiResponse> {
+        let mut cache = state.cache.write().await;
+        let cached_user = match cache.users.get_mut(&token.uid) {
+            Some(cached_user) => cached_user,
+            None => return Ok(LogoutApiResponse::IllegalToken),
+        };
+
+        // begin transaction
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        sqlx::query("delete from refresh_token where uid = ? and device = ?")
+            .bind(token.uid)
+            .bind(&token.device)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?;
+
+        sqlx::query("delete from device where uid = ? and device = ?")
+            .bind(token.uid)
+            .bind(&token.device)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?;
+
+        // commit transaction
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // close events connection
+        if let Some(sender) = cached_user
+            .devices
+            .get_mut(&token.device)
+            .and_then(|device| device.sender.take())
+        {
+            let _ = sender.send(UserEvent::Kick {
+                reason: KickReason::Logout,
+            });
+        }
+
+        cached_user.devices.remove(&token.device);
+        Ok(LogoutApiResponse::Ok)
+    }
+
+    /// Update FCM device token
+    #[oai(path = "/device_token", method = "put", transform = "guest_forbidden")]
+    async fn update_device_token(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<UpdateDeviceTokenRequest>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let cached_user = match cache.users.get_mut(&token.uid) {
+            Some(cached_user) => cached_user,
+            None => return Err(Error::from_status(StatusCode::NOT_FOUND)),
+        };
+
+        // update sqlite
+        let sql = "update device set device_token = ?, updated_at = ? where uid = ? and device = ?";
+        sqlx::query(sql)
+            .bind(&req.device_token)
+            .bind(DateTime::now())
+            .bind(token.uid)
+            .bind(&token.device)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        // update cache
+        if let Some(cache_device) = cached_user.devices.get_mut(&token.device) {
+            cache_device.device_token = req.0.device_token;
+        }
+
+        Ok(())
+    }
+}
+
+pub async fn do_login(
+    state: &State,
+    uid: i64,
+    device: &str,
+    device_token: Option<&str>,
+) -> Result<LoginApiResponse> {
+    let mut cache = state.cache.write().await;
+    let cached_user = match cache.users.get_mut(&uid) {
+        Some(cached_user) => cached_user,
+        None => return Ok(LoginApiResponse::UserDoesNotExist),
+    };
+
+    if cached_user.status == UserStatus::Frozen {
+        return Ok(LoginApiResponse::Frozen);
+    }
+
+    // update refresh token
+    let key_config = state.key_config.read().await;
+    let (refresh_token, token) = rc_token::create_token_pair(
+        &key_config.server_key,
+        CurrentUser {
+            uid,
+            device: device.to_string(),
+            is_admin: cached_user.is_admin,
+            is_guest: cached_user.is_guest,
+        },
+        state.config.system.refresh_token_expiry_seconds,
+        state.config.system.token_expiry_seconds,
+    )
+    .map_err(InternalServerError)?;
+
+    let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+    sqlx::query(
+        r#"
+        insert into refresh_token (uid, device, token) values (?, ?, ?)
+            on conflict (uid, device) do update set token = excluded.token
+        "#,
+    )
+    .bind(uid)
+    .bind(device)
+    .bind(&refresh_token)
+    .execute(&mut tx)
+    .await
+    .map_err(InternalServerError)?;
+
+    // update device token
+    sqlx::query(
+        r#"
+        insert into device (uid, device, device_token) values (?, ?, ?)
+            on conflict (uid, device) do update set device_token = excluded.device_token
+        "#,
+    )
+    .bind(uid)
+    .bind(device)
+    .bind(device_token)
+    .execute(&mut tx)
+    .await
+    .map_err(InternalServerError)?;
+
+    tx.commit().await.map_err(InternalServerError)?;
+
+    cached_user
+        .devices
+        .entry(device.to_string())
+        .and_modify(|device| {
+            device.device_token = device_token.map(ToString::to_string);
+        })
+        .or_insert_with(|| CacheDevice {
+            device_token: device_token.map(ToString::to_string),
+            sender: None,
+        });
+
+    Ok(LoginApiResponse::Ok(Json(LoginResponse {
+        server_id: key_config.server_id.clone(),
+        token,
+        refresh_token,
+        expired_in: state.config.system.token_expiry_seconds,
+        user: cached_user.api_user_info(uid),
+    })))
+}
+
+async fn download_avatar(url: &str) -> anyhow::Result<Bytes> {
+    Ok(reqwest::get(url)
+        .and_then(|resp| async move { resp.error_for_status() })
+        .and_then(|resp| resp.bytes())
+        .await?)
+}
+
+#[cfg(not(test))]
+async fn parse_google_id_token(token: &str) -> anyhow::Result<GoogleIdTokenPayload> {
+    use jsonwebtoken::{
+        decode_header,
+        jwk::{AlgorithmParameters, JwkSet},
+        DecodingKey, Validation,
+    };
+
+    let jwks = reqwest::get("https://www.googleapis.com/oauth2/v3/certs")
+        .await?
+        .error_for_status()?
+        .json::<JwkSet>()
+        .await?;
+    let header = decode_header(token)?;
+    let kid = header
+        .kid
+        .ok_or_else(|| anyhow::anyhow!("Token doesn't have a `kid` header field"))?;
+    let jwk = jwks
+        .find(&kid)
+        .ok_or_else(|| anyhow::anyhow!("No matching JWK found for the given kid"))?;
+    match &jwk.algorithm {
+        AlgorithmParameters::RSA(rsa) => {
+            let decoding_key = DecodingKey::from_rsa_components(&rsa.n, &rsa.e)?;
+            let mut validation = Validation::new(jwk.common.algorithm.unwrap());
+            validation.iss = Some(
+                vec![
+                    "accounts.google.com".to_string(),
+                    "https://accounts.google.com".to_string(),
+                ]
+                .into_iter()
+                .collect(),
+            );
+            let token =
+                jsonwebtoken::decode::<GoogleIdTokenPayload>(token, &decoding_key, &validation)?;
+            Ok(token.claims)
+        }
+        _ => anyhow::bail!("Not supported"),
+    }
+}
+
+// curl -d "client_id=xxxxx&client_secret=xxxxx&code=xxxx&redirect_uri=http://localhost:3000/" https://github.com/login/oauth/access_token
+async fn github_fetch_token(code: &str, state: &State) -> anyhow::Result<String> {
+    use crate::api::admin_github_auth::GithubAuthConfig;
+    let entry = state.load_dynamic_config::<GithubAuthConfig>().await?;
+
+    let params = [
+        ("client_id", entry.config.client_id),
+        ("client_secret", entry.config.client_secret),
+        ("code", code.to_string()),
+    ]; // , ("redirect_uri", "")
+    let client = reqwest::Client::new();
+    let res = client
+        .post("https://github.com/login/oauth/access_token")
+        .header("User-Agent", "Vocechat")
+        .form(&params)
+        .send()
+        .await?;
+    // access_token=xxxxx&scope=user&token_type=bearer
+    // error=bad_verification_code&
+    // error_description=The+code+passed+is+incorrect+or+expired.&error_uri=https%
+    // 3A%2F%2Fdocs.github.com%2Fapps%2Fmanaging-oauth
+    let body = res.text().await?;
+    tracing::debug!(body = body.as_str());
+    let pairs = serde_urlencoded::from_str::<HashMap<String, String>>(&body)?;
+    let access_token = pairs.get("access_token").cloned().unwrap_or_default();
+    Ok(access_token)
+}
+
+// curl -H "Authorization: token xxxxxxxx" https://api.github.com/user
+// {
+// "login": "User123",
+// "id": 123456,
+// "node_id": "ADQ6GXNlcjg3NDU7NzQw",
+// "avatar_url": "https://avatars.githubusercontent.com/u/87459740?v=4",
+// "gravatar_id": "",
+// "url": "https://api.github.com/users/User123",
+// "html_url": "https://github.com/User123",
+// "followers_url": "https://api.github.com/users/User123/followers",
+// "following_url": "https://api.github.com/users/User123/following{/other_user}",
+// "gists_url": "https://api.github.com/users/User123/gists{/gist_id}",
+// "starred_url": "https://api.github.com/users/User123/starred{/owner}{/repo}",
+// "subscriptions_url": "https://api.github.com/users/User123/subscriptions",
+// "organizations_url": "https://api.github.com/users/User123/orgs",
+// "repos_url": "https://api.github.com/users/User123/repos",
+// "events_url": "https://api.github.com/users/User123/events{/privacy}",
+// "received_events_url": "https://api.github.com/users/User123/received_events",
+// "type": "User",
+// "site_admin": false,
+// "name": null,
+// "company": null,
+// "blog": "",
+// "location": null,
+// "email": null,
+// "hireable": null,
+// "bio": null,
+// "twitter_username": null,
+// "public_repos": 15,
+// "public_gists": 0,
+// "followers": 0,
+// "following": 0,
+// "created_at": "2021-07-15T03:44:12Z",
+// "updated_at": "2022-05-21T07:18:06Z",
+// "private_gists": 0,
+// "total_private_repos": 4,
+// "owned_private_repos": 4,
+// "disk_usage": 3812,
+// "collaborators": 0,
+// "two_factor_authentication": false,
+// "plan": {
+// "name": "free",
+// "space": 976562499,
+// "collaborators": 0,
+// "private_repos": 10000
+// }
+// }
+
+struct GithubUserInfo {
+    username: String,
+    email: Option<String>,
+    avatar_url: Option<String>,
+}
+
+async fn github_fetch_user_info(token: &str) -> anyhow::Result<GithubUserInfo> {
+    let client = reqwest::Client::new();
+    let res = client
+        .get("https://api.github.com/user")
+        .header("User-Agent", "Vocechat")
+        .header("Authorization", format!("token {}", token))
+        .send()
+        .await?;
+    // access_token=xxxxx&scope=user&token_type=bearer
+    let body = res.text().await?;
+    tracing::debug!(body = body.as_str());
+    let pairs: serde_json::Value = serde_json::from_str(&body)?;
+    let username = pairs
+        .get("login")
+        .and_then(|v| v.as_str())
+        .unwrap()
+        .to_string();
+    let email = pairs
+        .get("email")
+        .and_then(|v| v.as_str())
+        .map(ToString::to_string);
+    let avatar_url = pairs
+        .get("avatar_url")
+        .and_then(|v| v.as_str())
+        .map(ToString::to_string);
+    Ok(GithubUserInfo {
+        username,
+        email,
+        avatar_url,
+    })
+}
+
+async fn oidc_get_id_token(
+    item: OAuth2State,
+    code: String,
+    state: String,
+) -> anyhow::Result<CoreIdTokenClaims> {
+    let code = AuthorizationCode::new(code);
+
+    anyhow::ensure!(&state == item.csrf_token.secret(), "invalid csrf token");
+
+    // Exchange the code with a token.
+    let token_response = match item
+        .client
+        .exchange_code(code)
+        .set_pkce_verifier(item.pkce_verifier)
+        .request_async(openidconnect::reqwest::async_http_client)
+        .await
+    {
+        Ok(token_response) => token_response,
+        Err(err) => {
+            tracing::debug!(error = %err, "failed to exchange the code with a token");
+            return Err(err.into());
+        }
+    };
+
+    let id_token_verifier: CoreIdTokenVerifier = item
+        .client
+        .id_token_verifier()
+        .set_other_audience_verifier_fn(|aud| aud.as_str() == "solid")
+        .set_allowed_algs(vec![
+            CoreJwsSigningAlgorithm::RsaSsaPkcs1V15Sha256,
+            CoreJwsSigningAlgorithm::EcdsaP256Sha256,
+        ]);
+    let id_token = match token_response.extra_fields().id_token() {
+        Some(id_token) => id_token,
+        None => {
+            tracing::debug!("id token does not exist");
+            anyhow::bail!("expect id token");
+        }
+    };
+    let id_token_claims: &CoreIdTokenClaims = match id_token.claims(&id_token_verifier, &item.nonce)
+    {
+        Ok(id_token_claims) => id_token_claims,
+        Err(err) => {
+            tracing::debug!(error = %err, "failed to verify claims");
+            return Err(err.into());
+        }
+    };
+
+    tracing::debug!("success get id token");
+    Ok(id_token_claims.clone())
+}
+
+#[cfg(test)]
+async fn parse_google_id_token(_token: &str) -> anyhow::Result<GoogleIdTokenPayload> {
+    Ok(GoogleIdTokenPayload {
+        email: "test@gmail.com".to_string(),
+        name: Some("test".to_string()),
+        picture: None,
+    })
+}
+
+async fn check_metamask_public_address(
+    state: &State,
+    public_address: &str,
+    nonce: &str,
+    signature: &str,
+) -> anyhow::Result<bool> {
+    if !signature.starts_with("0x") {
+        return Ok(false);
+    }
+    let signature = hex::decode(&signature[2..])?;
+    if signature.len() < 64 {
+        return Ok(false);
+    }
+    let sql = "select nonce from metamask_nonce where public_address = ?";
+    let db_nonce = sqlx::query_as::<_, (String,)>(sql)
+        .bind(public_address)
+        .fetch_optional(&state.db_pool)
+        .await?
+        .map(|(nonce,)| nonce);
+    if db_nonce.as_deref() != Some(nonce) {
+        return Ok(false);
+    }
+    let message = web3::signing::hash_message(nonce);
+    let recovery = web3::types::Recovery::from_raw_signature(message.as_bytes(), &signature)?;
+    let address = web3::signing::recover(
+        message.as_bytes(),
+        &signature[..64],
+        recovery.recovery_id().unwrap_or_default(),
+    )?;
+    Ok(format!("0x{}", hex::encode(address)) == public_address)
+}
+
+async fn get_credential_google(state: &State, uid: i64) -> anyhow::Result<Option<String>> {
+    let sql = "select email from google_auth where uid = ?";
+    Ok(sqlx::query_as::<_, (String,)>(sql)
+        .bind(uid)
+        .fetch_optional(&state.db_pool)
+        .await?
+        .map(|(email,)| email))
+}
+
+async fn get_credential_github(state: &State, uid: i64) -> anyhow::Result<Option<String>> {
+    let sql = "select username from github_auth where uid = ?";
+    Ok(sqlx::query_as::<_, (String,)>(sql)
+        .bind(uid)
+        .fetch_optional(&state.db_pool)
+        .await?
+        .map(|(username,)| username))
+}
+
+async fn get_credential_metamask(state: &State, uid: i64) -> anyhow::Result<Option<String>> {
+    let sql = "select public_address from metamask_auth where uid = ?";
+    Ok(sqlx::query_as::<_, (String,)>(sql)
+        .bind(uid)
+        .fetch_optional(&state.db_pool)
+        .await?
+        .map(|(public_address,)| public_address))
+}
+
+async fn get_credentials_openid(state: &State, uid: i64) -> anyhow::Result<Vec<String>> {
+    let sql = "select issuer from openid_connect where uid = ?";
+    Ok(sqlx::query_as::<_, (String,)>(sql)
+        .bind(uid)
+        .fetch_all(&state.db_pool)
+        .await?
+        .into_iter()
+        .map(|(issuer,)| issuer)
+        .collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use poem::http::StatusCode;
+    use serde_json::json;
+
+    use crate::test_harness::TestServer;
+
+    async fn login(server: &TestServer) -> String {
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "password",
+                    "email": "admin@voce.chat",
+                    "password": "123456",
+                },
+                "device": "iphone",
+                "device_token": "test",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json()
+            .await
+            .value()
+            .object()
+            .get("token")
+            .string()
+            .to_string()
+    }
+
+    #[tokio::test]
+    async fn test_login() {
+        let server = TestServer::new().await;
+
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "password",
+                    "email": "admin@voce.chat",
+                    "password": "123456",
+                },
+                "device": "iphone",
+                "device_token": "test",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let obj = json.value().object();
+        assert_eq!(server.parse_token(obj.get("token").string()).await.uid, 1);
+        assert_eq!(
+            server
+                .parse_token(obj.get("refresh_token").string())
+                .await
+                .uid,
+            1
+        );
+    }
+
+    #[tokio::test]
+    async fn test_login_with_google_id_token() {
+        let server = TestServer::new().await;
+
+        server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "google",
+                    "id_token": "abc",
+                    "magic_token": "",
+                },
+                "device": "iphone",
+                "device_token": "test",
+            }))
+            .send()
+            .await
+            .assert_status_is_ok();
+    }
+
+    // #[tokio::test]
+    // async fn test_login_with_google_id_token_conflict_email() {
+    //     let server = TestServer::new().await;
+    //     let admin_token = server.login_admin().await;
+    //     server.create_user(&admin_token, "test@gmail.com").await;
+    //
+    //     server
+    //         .post("/api/token/login")
+    //         .body_json(&json!({
+    //             "credential": {
+    //                 "type": "google",
+    //                 "id_token": "abc",
+    //             },
+    //             "device": "iphone",
+    //             "device_token": "test",
+    //         }))
+    //         .send()
+    //         .await
+    //         .assert_status(StatusCode::CONFLICT);
+    // }
+
+    #[tokio::test]
+    async fn test_renew() {
+        let server = TestServer::new().await;
+
+        // login
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "password",
+                    "email": "admin@voce.chat",
+                    "password": "123456",
+                },
+                "device": "iphone",
+                "device_token": "test",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let obj = json.value().object();
+        let token = obj.get("token").string();
+        let refresh_token = obj.get("refresh_token").string();
+
+        // renew
+        let resp = server
+            .post("/api/token/renew")
+            .body_json(&json!({
+                "token": token,
+                "refresh_token": refresh_token,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn test_logout() {
+        let server = TestServer::new().await;
+
+        // login
+        let token = login(&server).await;
+
+        // logout
+        let resp = server
+            .get("/api/token/logout")
+            .header("X-API-Key", &token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn test_renew_with_expired_token() {
+        let server = TestServer::new_with_config(|cfg| {
+            cfg.system.token_expiry_seconds = 3;
+        })
+        .await;
+
+        // login
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "password",
+                    "email": "admin@voce.chat",
+                    "password": "123456",
+                },
+                "device": "iphone",
+                "device_token": "test",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let obj = json.value().object();
+        let token = obj.get("token").string();
+        let refresh_token = obj.get("refresh_token").string();
+
+        tokio::time::sleep(Duration::from_secs(5)).await;
+
+        // use the old token
+        let resp = server
+            .get("/api/user/me")
+            .header("X-API-Key", token)
+            .send()
+            .await;
+        resp.assert_status(StatusCode::UNAUTHORIZED);
+
+        // renew
+        let resp = server
+            .post("/api/token/renew")
+            .body_json(&json!({
+                "token": token,
+                "refresh_token": refresh_token,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let obj = json.value().object();
+        let new_token = obj.get("token").string();
+
+        // use the new token
+        let resp = server
+            .get("/api/user/me")
+            .header("X-API-Key", new_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn test_login_with_metamask() {
+        let server = TestServer::new().await;
+        let public_address = "0x203911a828e486e9c6464e70084ae9a53f855d26";
+        let nonce = "Example `personal_sign` message";
+        let signature = "0x73043b9af49b11c504962664991020c6a2a7d88a022fc9917e1ec05fa3ea35b75b193cd6e54dfbb8840508908feee688f7bc9fd408fc6c479d0706568acd5df11c";
+
+        sqlx::query("insert into metamask_nonce (public_address, nonce) values (?, ?)")
+            .bind(public_address)
+            .bind(nonce)
+            .execute(&server.state().db_pool)
+            .await
+            .unwrap();
+
+        // login
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "metamask",
+                    "public_address": public_address,
+                    "nonce": nonce,
+                    "signature": signature,
+                }
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+    }
+
+    #[tokio::test]
+    async fn test_update_device_token() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin_with_device("web").await;
+
+        let resp = server
+            .put("/api/token/device_token")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "device_token": "abc"
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        assert_eq!(
+            server
+                .state()
+                .cache
+                .read()
+                .await
+                .users
+                .get(&1)
+                .unwrap()
+                .devices
+                .get("web")
+                .unwrap()
+                .device_token
+                .as_deref(),
+            Some("abc")
+        );
+
+        let device_token2 = sqlx::query_as::<_, (Option<String>,)>(
+            "select device_token from device where uid = ? and device = ?",
+        )
+        .bind(1)
+        .bind("web")
+        .fetch_one(&server.state().db_pool)
+        .await
+        .map(|(t,)| t)
+        .unwrap();
+        assert_eq!(device_token2.as_deref(), Some("abc"));
+
+        let resp = server
+            .put("/api/token/device_token")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({ "device_token": null }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        assert!(server
+            .state()
+            .cache
+            .read()
+            .await
+            .users
+            .get(&1)
+            .unwrap()
+            .devices
+            .get("web")
+            .unwrap()
+            .device_token
+            .is_none());
+
+        let device_token2 = sqlx::query_as::<_, (Option<String>,)>(
+            "select device_token from device where uid = ? and device = ?",
+        )
+        .bind(1)
+        .bind("web")
+        .fetch_one(&server.state().db_pool)
+        .await
+        .map(|(t,)| t)
+        .unwrap();
+        assert_eq!(device_token2, None);
+    }
+
+    #[tokio::test]
+    async fn test_login_with_third_party() {
+        let server = TestServer::new().await;
+
+        let resp = server
+            .post("/api/token/create_third_party_key")
+            .body_json(&json!({
+                "userid": "u1",
+                "username": "usertest"
+            }))
+            .header(
+                "X-SECRET",
+                &server.state().key_config.read().await.third_party_secret,
+            )
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let key = resp.json().await.value().string().to_string();
+
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "thirdparty",
+                    "key": key,
+                }
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let obj = json.value().object();
+        let user = obj.get("user").object();
+        user.get("name").assert_string("usertest");
+        let uid1 = user.get("uid").i64();
+
+        let resp = server
+            .post("/api/token/create_third_party_key")
+            .body_json(&json!({
+                "userid": "u1",
+                "username": "usertest"
+            }))
+            .header(
+                "X-SECRET",
+                &server.state().key_config.read().await.third_party_secret,
+            )
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let key = resp.json().await.value().string().to_string();
+
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "thirdparty",
+                    "key": key,
+                }
+            }))
+            .send()
+            .await;
+        let json = resp.json().await;
+        let obj = json.value().object();
+        let user = obj.get("user").object();
+        let uid2 = user.get("uid").i64();
+
+        assert_eq!(uid1, uid2);
+    }
+}
diff --git a/src/api/user.rs b/src/api/user.rs
new file mode 100644
index 0000000..17a26c4
--- /dev/null
+++ b/src/api/user.rs
@@ -0,0 +1,4186 @@
+use std::sync::Arc;
+
+use futures_util::{stream::BoxStream, StreamExt};
+use itertools::Itertools;
+use poem::{
+    error::{InternalServerError, ReadBodyError},
+    http::StatusCode,
+    web::Data,
+    Body, Error, Request, Result,
+};
+use poem_openapi::{
+    param::{Header, Path, Query},
+    payload::{Binary, EventStream, Json, PlainText},
+    types::{Email, ToJSON},
+    ApiRequest, ApiResponse, Enum, Object, OpenApi,
+};
+use rc_magic_link::MagicLinkToken;
+use rc_msgdb::MsgDb;
+use tokio::{
+    sync::{
+        broadcast::Receiver,
+        mpsc::{self, UnboundedReceiver, UnboundedSender},
+    },
+    time::{Duration, Instant},
+};
+
+use crate::{
+    api::{
+        admin_login::WhoCanSignUp,
+        group::get_related_groups,
+        message::{
+            decode_messages, parse_properties_from_base64, send_message, JoinedGroupMessage,
+            KickFromGroupMessage, KickReason, MessageTargetGroup, MessageTargetUser,
+            PinnedMessageUpdated, RelatedGroupsMessage, SendMessageRequest, SessionReadyMessage,
+            UserJoinedGroupMessage, UserLeavedGroupMessage, UserState, UsersSnapshotMessage,
+            UsersStateMessage,
+        },
+        tags::ApiTags,
+        token::{Token, TokenInQuery},
+        BurnAfterReadingGroup, BurnAfterReadingUser, ChatMessage, ChatMessagePayload, CurrentUser,
+        DateTime, HeartbeatMessage, KickMessage, LangId, LoginConfig, Message, MessageTarget,
+        MuteGroup, MuteUser, ReadIndexGroup, ReadIndexUser, UpdateAction, User,
+        UserSettingsChangedMessage, UserSettingsMessage, UserStateChangedMessage, UserUpdateLog,
+        UsersUpdateLogMessage,
+    },
+    create_user::{CreateUser, CreateUserBy, CreateUserError},
+    middleware::guest_forbidden,
+    state::{BroadcastEvent, Cache, CacheDevice, CacheUser, UserEvent},
+    SqlitePool, State,
+};
+
+const MAX_NEWEST_MESSAGES: usize = 5000;
+
+/// User info
+#[derive(Debug, Object, Clone)]
+pub struct UserInfo {
+    #[oai(read_only)]
+    pub uid: i64,
+    pub email: Option<String>,
+    pub name: String,
+    pub gender: i32,
+    pub language: LangId,
+    #[oai(read_only)]
+    pub is_admin: bool,
+    #[oai(read_only)]
+    pub is_bot: bool,
+    #[oai(read_only)]
+    pub avatar_updated_at: DateTime,
+    #[oai(read_only)]
+    pub create_by: String,
+}
+
+/// Change password request
+#[derive(Debug, Object)]
+struct ChangePasswordRequest {
+    old_password: String,
+    new_password: String,
+}
+
+/// Update user info request
+#[derive(Debug, Object)]
+struct UpdateUserInfoRequest {
+    name: Option<String>,
+    gender: Option<i32>,
+    language: Option<LangId>,
+}
+
+impl UpdateUserInfoRequest {
+    fn is_empty(&self) -> bool {
+        self.name.is_none() && self.gender.is_none() && self.language.is_none()
+    }
+}
+
+#[derive(Debug, ApiResponse)]
+pub enum UpdateUserResponse<T: ToJSON> {
+    #[oai(status = 200)]
+    Ok(Json<T>),
+    /// Invalid webhook url
+    #[oai(status = 406)]
+    InvalidWebhookUrl,
+    /// User conflict
+    #[oai(status = 409)]
+    Conflict(Json<UserConflict>),
+}
+
+#[derive(ApiRequest)]
+pub enum UploadAvatarRequest {
+    #[oai(content_type = "image/png")]
+    Image(Binary<Body>),
+}
+
+/// Mute request user
+#[derive(Debug, Object)]
+struct MuteRequestUser {
+    /// User id
+    uid: i64,
+    /// Seconds
+    expired_in: Option<u32>,
+}
+
+/// Mute request group
+#[derive(Debug, Object)]
+struct MuteRequestGroup {
+    /// Group id
+    gid: i64,
+    /// Seconds
+    expired_in: Option<u32>,
+}
+
+/// Mute request
+#[derive(Debug, Object)]
+struct MuteRequest {
+    #[oai(default)]
+    add_users: Vec<MuteRequestUser>,
+    #[oai(default)]
+    add_groups: Vec<MuteRequestGroup>,
+    #[oai(default)]
+    remove_users: Vec<i64>,
+    #[oai(default)]
+    remove_groups: Vec<i64>,
+}
+
+/// Update read index request user
+#[derive(Debug, Object)]
+struct UpdateReadIndexRequestUser {
+    /// User id
+    uid: i64,
+    /// Message id
+    mid: i64,
+}
+
+/// Update read index request group
+#[derive(Debug, Object)]
+struct UpdateReadIndexRequestGroup {
+    /// Group id
+    gid: i64,
+    /// Message id
+    mid: i64,
+}
+
+/// Update read index request
+#[derive(Debug, Object)]
+struct UpdateReadIndexRequest {
+    #[oai(default)]
+    users: Vec<UpdateReadIndexRequestUser>,
+    #[oai(default)]
+    groups: Vec<UpdateReadIndexRequestGroup>,
+}
+
+/// Update read index request user
+#[derive(Debug, Object)]
+struct UpdateBurnAfterReadingRequestUser {
+    /// User id
+    uid: i64,
+    /// Expires in seconds
+    expires_in: i64,
+}
+
+/// Update read index request group
+#[derive(Debug, Object)]
+struct UpdateBurnAfterReadingRequestGroup {
+    /// Group id
+    gid: i64,
+    /// Expires in seconds
+    expires_in: i64,
+}
+
+/// Update read after reading request
+#[derive(Debug, Object)]
+struct UpdateBurnAfterReadingRequest {
+    #[oai(default)]
+    users: Vec<UpdateBurnAfterReadingRequestUser>,
+    #[oai(default)]
+    groups: Vec<UpdateBurnAfterReadingRequestGroup>,
+}
+
+#[derive(ApiResponse)]
+pub enum UploadAvatarApiResponse {
+    /// Success
+    #[oai(status = 200)]
+    Ok,
+    /// Payload too large
+    #[oai(status = 413)]
+    PayloadTooLarge,
+}
+
+#[derive(Debug, Object)]
+struct CheckMagicTokenRequest {
+    magic_token: String,
+}
+
+#[derive(Debug, Object)]
+struct RegisterRequest {
+    magic_token: Option<String>,
+    email: Option<Email>,
+    password: Option<String>,
+    #[oai(validator(max_length = 32))]
+    name: Option<String>,
+    #[oai(default)]
+    gender: i32,
+    #[oai(default)]
+    language: LangId,
+    /// Device id
+    #[oai(default = "default_device")]
+    device: String,
+    /// FCM device token
+    device_token: Option<String>,
+}
+
+fn default_device() -> String {
+    "unknown".to_string()
+}
+
+// #[derive(Debug, Enum)]
+// #[oai(rename_all = "snake_case")]
+// enum CodeUseFor {
+//     Register,
+// }
+
+#[derive(Debug, Enum)]
+#[oai(rename_all = "snake_case")]
+pub enum CreateUserConflictReason {
+    NameConflict,
+    EmailConflict,
+}
+
+#[derive(Debug, Object)]
+pub struct UserConflict {
+    pub reason: CreateUserConflictReason,
+}
+
+#[derive(Debug, ApiResponse)]
+pub enum CreateUserResponse {
+    #[oai(status = 200)]
+    Ok(Json<User>),
+    /// Invalid webhook url
+    #[oai(status = 406)]
+    InvalidWebhookUrl,
+    /// User conflict
+    #[oai(status = 409)]
+    Conflict(Json<UserConflict>),
+}
+
+#[derive(Debug, ApiResponse)]
+pub enum RegisterUserResponse {
+    #[oai(status = 200)]
+    Ok(Json<super::token::LoginResponse>),
+    #[oai(status = 409)]
+    Conflict(Json<UserConflict>),
+    /// Magic token has been expired.
+    #[oai(status = 412)]
+    MagicTokenExpired,
+    #[oai(status = 413)]
+    OkButLoginFailed,
+}
+
+/// Change password request
+#[derive(Debug, Object)]
+struct SendRegMagicTokenRequest {
+    magic_token: String,
+    email: Email,
+    password: String,
+}
+
+// #[derive(Debug, ApiResponse)]
+// pub enum SendRegMagicTokenResponse {
+//     #[oai(status = 200)]
+//     Ok(Json<SendRegMagicTokenResponseInner>),
+//     #[oai(status = 409)]
+//     Conflict(Json<UserConflict>),
+//     /// Magic token has been expired.
+//     #[oai(status = 412)]
+//     MagicTokenExpired,
+// }
+
+#[derive(Debug, Object)]
+pub struct SendRegMagicTokenResponse {
+    new_magic_token: String,
+    mail_is_sent: bool,
+}
+
+pub struct ApiUser;
+
+#[OpenApi(prefix_path = "/user", tag = "ApiTags::User")]
+impl ApiUser {
+    /// Check the invite magic token is valid
+    #[oai(path = "/check_magic_token", method = "post")]
+    async fn check_magic_token(
+        &self,
+        state: Data<&State>,
+        req: Json<CheckMagicTokenRequest>,
+    ) -> Result<Json<bool>> {
+        let key_config = state.key_config.read().await;
+        Ok(Json(
+            MagicLinkToken::parse(&key_config.server_key, &req.magic_token).is_some(),
+        ))
+    }
+
+    /// Register a new user with the magic token
+    #[oai(path = "/register", method = "post")]
+    async fn register(
+        &self,
+        state: Data<&State>,
+        req: Json<RegisterRequest>,
+    ) -> Result<RegisterUserResponse> {
+        let key_config = state.key_config.read().await;
+        let login_config = state
+            .get_dynamic_config_instance::<LoginConfig>()
+            .await
+            .unwrap_or_default();
+
+        let can_register = match login_config.who_can_sign_up {
+            WhoCanSignUp::EveryOne => true,
+            WhoCanSignUp::InvitationOnly if req.magic_token.is_some() => true,
+            _ => false,
+        };
+        if !can_register {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+
+        let (mt_gid, extra_email, extra_password) = if let Some(magic_token) = &req.magic_token {
+            let mt = match MagicLinkToken::parse(&key_config.server_key, magic_token) {
+                Some(magic_token) => magic_token,
+                None => return Ok(RegisterUserResponse::MagicTokenExpired),
+            };
+            let (is_confirmed, mt_gid, extra_email, extra_password) = match mt {
+                MagicLinkToken::Register {
+                    is_confirmed,
+                    gid,
+                    extra_email,
+                    extra_password,
+                    ..
+                } => (is_confirmed, gid, extra_email, extra_password),
+                _ => return Ok(RegisterUserResponse::MagicTokenExpired),
+            };
+
+            // check magic token is validated by email.
+            let smtp_on = state
+                .load_dynamic_config::<crate::api::SmtpConfig>()
+                .await?
+                .enabled;
+            if smtp_on && !is_confirmed {
+                return Err(Error::from_status(StatusCode::FORBIDDEN));
+            }
+            (mt_gid, extra_email, extra_password)
+        } else {
+            (None, None, None)
+        };
+        let email = if req.email.is_some() {
+            req.email.as_ref().unwrap().0.clone()
+        } else {
+            extra_email.unwrap_or_default()
+        };
+        let password = if req.password.is_some() {
+            req.password.as_ref().cloned().unwrap_or_default()
+        } else {
+            extra_password.unwrap_or_default()
+        };
+        let name = state
+            .cache
+            .read()
+            .await
+            .assign_username(req.name.as_deref(), Some(email.as_str()));
+
+        let create_user = CreateUser::new(
+            &name,
+            CreateUserBy::Password {
+                email: &email,
+                password: &password,
+            },
+            false,
+        )
+        .gender(req.gender)
+        .language(&req.language);
+
+        let (uid, res) = match state.create_user(create_user).await {
+            Ok((uid, user)) => (
+                uid,
+                // Ok::<_, poem::Error>(RegisterUserResponse::Ok(Json(user.api_user_info(uid)))),
+                Ok::<_, poem::Error>({
+                    drop(user);
+                    if let Ok(super::token::LoginApiResponse::Ok(Json(login_resp))) =
+                        super::token::do_login(
+                            &state,
+                            uid,
+                            &req.0.device,
+                            req.0.device_token.as_deref(),
+                        )
+                        .await
+                    {
+                        RegisterUserResponse::Ok(Json(login_resp))
+                    } else {
+                        RegisterUserResponse::OkButLoginFailed
+                    }
+                }),
+            ),
+            Err(CreateUserError::NameConflict) => {
+                return Ok(RegisterUserResponse::Conflict(Json(UserConflict {
+                    reason: CreateUserConflictReason::NameConflict,
+                })));
+            }
+            Err(CreateUserError::EmailConflict) => {
+                return Ok(RegisterUserResponse::Conflict(Json(UserConflict {
+                    reason: CreateUserConflictReason::EmailConflict,
+                })));
+            }
+            Err(CreateUserError::PoemError(err)) => return Err(err),
+        };
+        let res = res?;
+        if let Some(gid) = mt_gid {
+            let mut cache = state.cache.write().await;
+            if let Some(group) = cache.groups.get_mut(&gid) {
+                if !group.ty.is_public() {
+                    // update sqlite
+                    sqlx::query("insert into group_user (gid, uid) values (?, ?)")
+                        .bind(gid)
+                        .bind(uid)
+                        .execute(&state.db_pool)
+                        .await
+                        .map_err(InternalServerError)?;
+
+                    // update cache
+                    group.members.insert(uid);
+                }
+                // broadcast event
+                let _ = state
+                    .event_sender
+                    .send(Arc::new(BroadcastEvent::UserJoinedGroup {
+                        targets: group
+                            .members
+                            .iter()
+                            .copied()
+                            .filter(|x| *x != uid)
+                            .collect(),
+                        gid,
+                        uid: vec![uid],
+                    }));
+            }
+        }
+        Ok(res)
+    }
+
+    /// Check the specified email address is available.
+    #[oai(path = "/check_email", method = "get")]
+    async fn check_email(&self, state: Data<&State>, email: Query<Email>) -> Result<Json<bool>> {
+        let cache = state.cache.read().await;
+        Ok(Json(cache.check_email_conflict(&email)))
+    }
+
+    /// Send register magic link to email
+    /// return the new magic token
+    #[oai(path = "/send_reg_magic_link", method = "post")]
+    async fn send_reg_magic_link(
+        &self,
+        state: Data<&State>,
+        post: Json<SendRegMagicTokenRequest>,
+        req: &Request,
+    ) -> Result<Json<SendRegMagicTokenResponse>> {
+        use poem::http::StatusCode;
+        let url = crate::state::get_frontend_url(&state, req).await;
+        let key_config = state.key_config.read().await;
+
+        let smtp_on = state
+            .load_dynamic_config::<crate::api::SmtpConfig>()
+            .await?
+            .enabled;
+
+        let (new_magic_token, gid) = if smtp_on {
+            let mt = MagicLinkToken::parse(&key_config.server_key, &post.magic_token).ok_or_else(
+                || Error::from_status(StatusCode::from_u16(1000).unwrap_or_default()),
+            )?;
+
+            let (gid, code, expired_at) = match mt {
+                MagicLinkToken::Register {
+                    gid,
+                    code,
+                    expired_at,
+                    ..
+                } => Ok((gid, code, expired_at)),
+                _ => Err(Error::from_status(
+                    StatusCode::from_u16(1001).unwrap_or_default(),
+                )),
+            }?;
+
+            if !state.magic_code_check_code(&code).await {
+                return Err(poem::Error::from_status(StatusCode::BAD_REQUEST));
+            }
+
+            let expired_at = {
+                let naive = chrono::NaiveDateTime::from_timestamp_opt(expired_at, 0).unwrap();
+                chrono::DateTime::from_utc(naive, chrono::Utc)
+            };
+
+            (
+                MagicLinkToken::gen_reg_magic_token(
+                    &code,
+                    &state.key_config.read().await.server_key,
+                    expired_at,
+                    true,
+                    gid,
+                    Some(post.email.0.clone()),
+                    Some(post.password.clone()),
+                ),
+                gid,
+            )
+        } else {
+            let code = rc_magic_link::gen_code();
+            let expired_at = chrono::Utc::now() + chrono::Duration::seconds(86400);
+            let gid = None;
+            (
+                MagicLinkToken::gen_reg_magic_token(
+                    &code,
+                    &state.key_config.read().await.server_key,
+                    expired_at,
+                    true,
+                    gid,
+                    Some(post.email.0.clone()),
+                    Some(post.password.clone()),
+                ),
+                gid,
+            )
+        };
+
+        if smtp_on {
+            let email = post.email.clone();
+            let template = state
+                .templates
+                .register_by_email
+                .as_ref()
+                .ok_or_else(|| poem::Error::from_status(StatusCode::FORBIDDEN))?;
+
+            let uid = {
+                let cache = state.cache.read().await;
+                cache
+                    .users
+                    .iter()
+                    .find(|(_, user)| user.email.as_deref() == Some(&email))
+                    .map(|(uid, _)| *uid)
+            };
+            if uid.is_some() {
+                return Err(poem::Error::from_status(StatusCode::CONFLICT));
+            }
+
+            let content = template
+                .template
+                .render(&liquid::object!({
+                    "magic_token": &new_magic_token,
+                    "email": email.0,
+                    "gid": gid,
+                    "url": url,
+                }))
+                .map_err(InternalServerError)?;
+
+            tokio::spawn({
+                let state = state.clone();
+                let subject = template.subject.clone();
+                let email = email.to_string();
+                async move {
+                    let smtp_config = state
+                        .get_dynamic_config_instance::<crate::api::SmtpConfig>()
+                        .await;
+                    if let Some(smtp_config) = smtp_config {
+                        if let Err(err) =
+                            crate::state::send_mail(&smtp_config, email, subject, content).await
+                        {
+                            tracing::error!(error = %err, "failed to send mail");
+                        }
+                    }
+                }
+            });
+
+            Ok(Json(SendRegMagicTokenResponse {
+                new_magic_token: if cfg!(test) {
+                    new_magic_token
+                } else {
+                    "".to_string()
+                },
+                mail_is_sent: true,
+            }))
+        } else {
+            Ok(Json(SendRegMagicTokenResponse {
+                new_magic_token,
+                mail_is_sent: false,
+            }))
+        }
+    }
+
+    /// Send login magic link
+    /// login magic link only can be used once.
+    #[oai(path = "/send_login_magic_link", method = "post")]
+    async fn send_login_magic_link(
+        &self,
+        state: Data<&State>,
+        email: Query<Email>,
+        req: &Request,
+    ) -> Result<PlainText<String>> {
+        crate::license::check_license_wrap!(&state, req);
+
+        let login_config = state
+            .get_dynamic_config_instance::<LoginConfig>()
+            .await
+            .unwrap_or_default();
+        if !login_config.magic_link {
+            return Err(Error::from_status(StatusCode::NOT_ACCEPTABLE));
+        }
+
+        let url = crate::state::get_frontend_url(&state, req).await;
+        let code = rc_magic_link::gen_code();
+        let expired_at = chrono::Utc::now()
+            + chrono::Duration::seconds(state.config.system.magic_token_expiry_seconds);
+        let magic_token = state
+            .send_login_magic_link(&code, &url, expired_at, &email)
+            .await?;
+
+        if cfg!(test) {
+            Ok(PlainText(magic_token))
+        } else {
+            Ok(PlainText(
+                "Magic token has been sent to the email。".to_string(),
+            ))
+        }
+    }
+
+    /// Get the current user information
+    #[oai(path = "/me", method = "get")]
+    async fn me(&self, state: Data<&State>, token: Token) -> Result<Json<UserInfo>> {
+        let cache = state.cache.read().await;
+        let user = cache
+            .users
+            .get(&token.uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        Ok(Json(user.api_user_info(token.uid)))
+    }
+
+    /// Get the specified user information
+    #[oai(path = "/:uid", method = "get")]
+    async fn get_user(&self, state: Data<&State>, uid: Path<i64>) -> Result<Json<UserInfo>> {
+        let cache = state.cache.read().await;
+        let user = cache
+            .users
+            .get(&uid.0)
+            .ok_or_else(|| Error::from_status(StatusCode::NOT_FOUND))?;
+        Ok(Json(user.api_user_info(uid.0)))
+    }
+
+    #[oai(
+        path = "/change_password",
+        method = "post",
+        transform = "guest_forbidden"
+    )]
+    async fn change_password(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<ChangePasswordRequest>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let cached_user = cache
+            .users
+            .get_mut(&token.uid)
+            .ok_or_else(|| Error::from(StatusCode::UNAUTHORIZED))?;
+
+        if cached_user.password.as_deref().unwrap_or_default() != &*req.old_password {
+            return Err(Error::from(StatusCode::FORBIDDEN));
+        }
+
+        // update database
+        let sql = "update user set password = ? where uid = ?";
+        sqlx::query(sql)
+            .bind(&req.new_password)
+            .bind(token.uid)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?;
+
+        // update cache
+        cached_user.password = Some(req.0.new_password);
+        Ok(())
+    }
+
+    /// Update the current user information
+    #[oai(path = "/", method = "put", transform = "guest_forbidden")]
+    async fn update_user(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<UpdateUserInfoRequest>,
+    ) -> Result<UpdateUserResponse<UserInfo>> {
+        if req.is_empty() {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        let mut cache = state.cache.write().await;
+        if let Some(name) = &req.name {
+            if !cache.check_name_conflict(name) {
+                return Ok(UpdateUserResponse::Conflict(Json(UserConflict {
+                    reason: CreateUserConflictReason::NameConflict,
+                })));
+            }
+        }
+
+        let now = DateTime::now();
+        let cached_user = cache
+            .users
+            .get_mut(&token.uid)
+            .ok_or_else(|| Error::from(StatusCode::UNAUTHORIZED))?;
+
+        // begin transaction
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        // update user table
+        let sql = format!(
+            "update user set {} where uid = ?",
+            req.name
+                .iter()
+                .map(|_| "name = ?")
+                .chain(req.gender.iter().map(|_| "gender = ?"))
+                .chain(req.language.iter().map(|_| "language = ?"))
+                .chain(Some("updated_at = ?"))
+                .join(", ")
+        );
+
+        let mut query = sqlx::query(&sql);
+        if let Some(name) = &req.name {
+            query = query.bind(name);
+        }
+        if let Some(gender) = &req.gender {
+            query = query.bind(gender);
+        }
+        if let Some(language) = &req.language {
+            query = query.bind(language);
+        }
+
+        query
+            .bind(now)
+            .bind(token.uid)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?;
+
+        // insert into user_log table
+        let log_id = if req.name.is_some() || req.gender.is_some() && req.language.is_some() {
+            Some(sqlx::query(
+                "insert into user_log (uid, action, name, gender, language) values (?, ?, ?, ?, ?)",
+            )
+                .bind(token.uid)
+                .bind(UpdateAction::Update)
+                .bind(&req.name)
+                .bind(req.gender)
+                .bind(&req.language)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?.last_insert_rowid())
+        } else {
+            None
+        };
+
+        // commit transaction
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        if let Some(name) = &req.0.name {
+            cached_user.name = name.clone();
+        }
+        if let Some(gender) = req.0.gender {
+            cached_user.gender = gender;
+        }
+        if let Some(language) = &req.0.language {
+            cached_user.language = language.clone();
+        }
+
+        // broadcast event
+        if let Some(log_id) = log_id {
+            let _ = state
+                .event_sender
+                .send(Arc::new(BroadcastEvent::UserLog(UserUpdateLog {
+                    log_id,
+                    action: UpdateAction::Update,
+                    uid: token.uid,
+                    email: None,
+                    name: req.0.name,
+                    gender: req.0.gender,
+                    language: req.0.language,
+                    is_admin: None,
+                    is_bot: None,
+                    avatar_updated_at: None,
+                })));
+        }
+
+        Ok(UpdateUserResponse::Ok(Json(
+            cached_user.api_user_info(token.uid),
+        )))
+    }
+
+    /// Upload avatar
+    #[oai(path = "/avatar", method = "post", transform = "guest_forbidden")]
+    async fn upload_avatar(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: UploadAvatarRequest,
+    ) -> Result<UploadAvatarApiResponse> {
+        let mut cache = state.cache.write().await;
+        let now = DateTime::now();
+        let cached_user = cache
+            .users
+            .get_mut(&token.uid)
+            .ok_or_else(|| Error::from(StatusCode::UNAUTHORIZED))?;
+
+        let UploadAvatarRequest::Image(data) = req;
+        let data = match data
+            .0
+            .into_bytes_limit(state.config.system.upload_avatar_limit)
+            .await
+        {
+            Ok(data) => data,
+            Err(ReadBodyError::PayloadTooLarge) => {
+                return Ok(UploadAvatarApiResponse::PayloadTooLarge);
+            }
+            Err(err) => return Err(err.into()),
+        };
+
+        // write to file
+        state.save_avatar(token.uid, &data)?;
+
+        // update sqlite
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        sqlx::query("update user set avatar_updated_at = ? where uid = ?")
+            .bind(now)
+            .bind(token.uid)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?;
+
+        let log_id =
+            sqlx::query("insert into user_log (uid, action, avatar_updated_at) values (?, ?, ?)")
+                .bind(token.uid)
+                .bind(UpdateAction::Update)
+                .bind(now)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?
+                .last_insert_rowid();
+
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        cached_user.avatar_updated_at = now;
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserLog(UserUpdateLog {
+                log_id,
+                action: UpdateAction::Update,
+                uid: token.uid,
+                email: None,
+                name: None,
+                gender: None,
+                language: None,
+                is_admin: None,
+                is_bot: None,
+                avatar_updated_at: Some(now),
+            })));
+
+        Ok(UploadAvatarApiResponse::Ok)
+    }
+
+    /// Get all users
+    #[oai(path = "/", method = "get")]
+    async fn get_all_users(&self, state: Data<&State>) -> Json<Vec<UserInfo>> {
+        Json(
+            state
+                .cache
+                .read()
+                .await
+                .users
+                .iter()
+                .filter(|(_, user)| !user.is_guest)
+                .map(|(id, user)| user.api_user_info(*id))
+                .collect(),
+        )
+    }
+
+    /// Send message to the specified user
+    #[oai(path = "/:uid/send", method = "post", transform = "guest_forbidden")]
+    async fn send(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        uid: Path<i64>,
+        #[oai(name = "X-Properties")] properties: Header<Option<String>>,
+        req: SendMessageRequest,
+    ) -> Result<Json<i64>> {
+        let properties = parse_properties_from_base64(properties.0);
+        let payload = req
+            .into_chat_message_payload(&state, token.uid, MessageTarget::user(uid.0), properties)
+            .await?;
+        let mid = send_message(&state, payload).await?;
+        Ok(Json(mid))
+    }
+
+    /// Get history messages
+    #[oai(path = "/:uid/history", method = "get")]
+    async fn get_history_messages(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        uid: Path<i64>,
+        before: Query<Option<i64>>,
+        #[oai(default = "default_get_history_messages_limit")] limit: Query<usize>,
+    ) -> Result<Json<Vec<ChatMessage>>> {
+        let msgs = state
+            .msg_db
+            .messages()
+            .fetch_dm_messages_before(token.uid, uid.0, before.0, limit.0)
+            .map_err(InternalServerError)?;
+        Ok(Json(decode_messages(msgs)))
+    }
+
+    /// Subscribe events
+    #[oai(path = "/events", method = "get")]
+    async fn events(
+        &self,
+        state: Data<&State>,
+        token: TokenInQuery,
+        after_mid: Query<Option<i64>>,
+        users_version: Query<Option<i64>>,
+    ) -> Result<EventStream<BoxStream<'static, Message>>> {
+        let uid = token.uid;
+        let mut cache = state.cache.write().await;
+        let related_groups = get_related_groups(&cache.groups, uid, false);
+        let user = cache
+            .users
+            .get_mut(&token.uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        let user_settings_msg = get_user_settings_msg(user);
+        let rx_user_event = create_user_event_receiver(&state, &token.0, user)?;
+        let receiver = state.event_sender.subscribe();
+        let users_log_msg = fetch_user_log(&cache, &state.db_pool, users_version.0).await?;
+        let users_state_msg = get_users_state(&cache, uid);
+        let newest_messages = fetch_newest_messages(&cache, &state.msg_db, uid, after_mid.0)?;
+        let push_start_id = newest_messages.last().map(|msg| msg.mid);
+        let messages = users_log_msg
+            .into_iter()
+            .chain(Some(Message::UsersState(users_state_msg)))
+            .chain(Some(Message::RelatedGroups(RelatedGroupsMessage {
+                groups: related_groups,
+            })))
+            .chain(Some(Message::UserSettings(user_settings_msg)))
+            .chain(newest_messages.into_iter().map(Message::Chat))
+            .chain(Some(Message::Ready(SessionReadyMessage {})));
+
+        tracing::info!(
+            uid = uid,
+            device = token.device.as_str(),
+            "subscribe events"
+        );
+
+        let (tx_msg, rx_msg) = mpsc::unbounded_channel();
+        for message in messages {
+            let _ = tx_msg.send(message);
+        }
+        tokio::spawn(events_loop(
+            state.0.clone(),
+            rx_user_event,
+            receiver,
+            push_start_id,
+            token.uid,
+            token.0.device,
+            tx_msg,
+        ));
+
+        Ok(
+            EventStream::new(tokio_stream::wrappers::UnboundedReceiverStream::new(rx_msg).boxed())
+                .keep_alive(Duration::from_secs(5)),
+        )
+    }
+
+    /// Get all devices of the current user
+    #[oai(path = "/devices", method = "get")]
+    async fn get_devices(&self, state: Data<&State>, token: Token) -> Result<Json<Vec<String>>> {
+        let cache = state.cache.read().await;
+        let user = cache
+            .users
+            .get(&token.uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        Ok(Json(user.devices.keys().cloned().collect()))
+    }
+
+    /// Delete current user's specified device
+    #[oai(
+        path = "/devices/:device",
+        method = "delete",
+        transform = "guest_forbidden"
+    )]
+    async fn delete_device(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        device: Path<String>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+
+        let rows_affected = sqlx::query("delete from device where uid = ? and device = ?")
+            .bind(token.uid)
+            .bind(&device.0)
+            .execute(&state.db_pool)
+            .await
+            .map_err(InternalServerError)?
+            .rows_affected();
+        if rows_affected == 0 {
+            return Err(Error::from_status(StatusCode::UNAUTHORIZED));
+        }
+
+        let user = cache
+            .users
+            .get_mut(&token.uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        let cached_device = user
+            .devices
+            .remove(&device.0)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        if let Some(sender) = cached_device.sender {
+            let _ = sender.send(UserEvent::Kick {
+                reason: KickReason::DeleteDevice,
+            });
+        }
+
+        Ok(())
+    }
+
+    /// Change the mute settings
+    #[oai(path = "/mute", method = "post")]
+    async fn mute(&self, state: Data<&State>, token: Token, req: Json<MuteRequest>) -> Result<()> {
+        let mut cache = state.cache.write().await;
+
+        if req
+            .add_users
+            .iter()
+            .any(|item| item.uid == token.uid || !cache.users.contains_key(&item.uid))
+        {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        if req
+            .add_groups
+            .iter()
+            .any(|item| !cache.groups.contains_key(&item.gid))
+        {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        if req
+            .remove_users
+            .iter()
+            .any(|uid| !cache.users.contains_key(uid))
+        {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        if req
+            .remove_groups
+            .iter()
+            .any(|gid| !cache.groups.contains_key(gid))
+        {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        let user = cache
+            .users
+            .get_mut(&token.uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+
+        let now = DateTime::now();
+        let add_user_list = req
+            .0
+            .add_users
+            .into_iter()
+            .map(|item| MuteUser {
+                uid: item.uid,
+                expired_at: item.expired_in.map(|seconds| {
+                    DateTime::from(now.0 + chrono::Duration::seconds(seconds as i64))
+                }),
+            })
+            .collect_vec();
+        let add_group_list = req
+            .0
+            .add_groups
+            .into_iter()
+            .map(|item| MuteGroup {
+                gid: item.gid,
+                expired_at: item.expired_in.map(|seconds| {
+                    DateTime::from(now.0 + chrono::Duration::seconds(seconds as i64))
+                }),
+            })
+            .collect_vec();
+        let remove_user_list = req.0.remove_users;
+        let remove_group_list = req.0.remove_groups;
+
+        // update sqlite
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        for item in &add_user_list {
+            let sql = r#"
+                    insert into mute (uid, mute_uid, expired_at) values (?, ?, ?)
+                        on conflict (uid, mute_uid) do update set expired_at = excluded.expired_at
+                    "#;
+            sqlx::query(sql)
+                .bind(token.uid)
+                .bind(item.uid)
+                .bind(item.expired_at)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+
+        for item in &add_group_list {
+            let sql = r#"
+                    insert into mute (uid, mute_gid, expired_at) values (?, ?, ?)
+                        on conflict (uid, mute_gid) do update set expired_at = excluded.expired_at
+                    "#;
+            sqlx::query(sql)
+                .bind(token.uid)
+                .bind(item.gid)
+                .bind(item.expired_at)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+
+        for uid in &remove_user_list {
+            let sql = "delete from mute where uid = ? and mute_uid = ?";
+            sqlx::query(sql)
+                .bind(token.uid)
+                .bind(uid)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+
+        for gid in &remove_group_list {
+            let sql = "delete from mute where uid = ? and mute_gid = ?";
+            sqlx::query(sql)
+                .bind(token.uid)
+                .bind(gid)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        for item in &add_user_list {
+            user.mute_user.insert(item.uid, item.expired_at);
+        }
+        for item in &add_group_list {
+            user.mute_group.insert(item.gid, item.expired_at);
+        }
+        for uid in &remove_user_list {
+            user.mute_user.remove(uid);
+        }
+        for gid in &remove_group_list {
+            user.mute_group.remove(gid);
+        }
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserSettingsChanged {
+                uid: token.0.uid,
+                message: UserSettingsChangedMessage {
+                    from_device: token.0.device,
+                    add_mute_users: add_user_list,
+                    add_mute_groups: add_group_list,
+                    remove_mute_users: remove_user_list,
+                    remove_mute_groups: remove_group_list,
+                    ..Default::default()
+                },
+            }));
+
+        Ok(())
+    }
+
+    /// Change the burn after reading settings
+    #[oai(path = "/burn-after-reading", method = "post")]
+    async fn update_burn_after_reading(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<UpdateBurnAfterReadingRequest>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+
+        if req.users.iter().any(|item| {
+            item.uid == token.uid || !cache.users.contains_key(&item.uid) || item.expires_in < 0
+        }) {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        if req
+            .groups
+            .iter()
+            .any(|item| !cache.groups.contains_key(&item.gid) || item.expires_in < 0)
+        {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        let user = cache
+            .users
+            .get_mut(&token.uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+
+        let burn_after_reading_users = req
+            .0
+            .users
+            .into_iter()
+            .map(|item| BurnAfterReadingUser {
+                uid: item.uid,
+                expires_in: item.expires_in,
+            })
+            .collect_vec();
+        let burn_after_reading_groups = req
+            .0
+            .groups
+            .into_iter()
+            .map(|item| BurnAfterReadingGroup {
+                gid: item.gid,
+                expires_in: item.expires_in,
+            })
+            .collect_vec();
+
+        // update sqlite
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        for item in &burn_after_reading_users {
+            if item.expires_in > 0 {
+                let sql = r#"
+                    insert into burn_after_reading (uid, target_uid, expires_in) values (?, ?, ?)
+                        on conflict (uid, target_uid) do update set expires_in = excluded.expires_in
+                    "#;
+                sqlx::query(sql)
+                    .bind(token.uid)
+                    .bind(item.uid)
+                    .bind(item.expires_in)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            } else {
+                let sql = "delete from burn_after_reading where uid = ? and target_uid = ?";
+                sqlx::query(sql)
+                    .bind(token.uid)
+                    .bind(item.uid)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+        }
+
+        for item in &burn_after_reading_groups {
+            if item.expires_in > 0 {
+                let sql = r#"
+                    insert into burn_after_reading (uid, target_gid, expires_in) values (?, ?, ?)
+                        on conflict (uid, target_gid) do update set expires_in = excluded.expires_in
+                    "#;
+                sqlx::query(sql)
+                    .bind(token.uid)
+                    .bind(item.gid)
+                    .bind(item.expires_in)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            } else {
+                let sql = "delete from burn_after_reading where uid = ? and target_gid = ?";
+                sqlx::query(sql)
+                    .bind(token.uid)
+                    .bind(item.gid)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+        }
+
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        for item in &burn_after_reading_users {
+            if item.expires_in > 0 {
+                user.burn_after_reading_user
+                    .insert(item.uid, item.expires_in);
+            } else {
+                user.burn_after_reading_user.remove(&item.uid);
+            }
+        }
+
+        for item in &burn_after_reading_groups {
+            if item.expires_in > 0 {
+                user.burn_after_reading_group
+                    .insert(item.gid, item.expires_in);
+            } else {
+                user.burn_after_reading_group.remove(&item.gid);
+            }
+        }
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserSettingsChanged {
+                uid: token.0.uid,
+                message: UserSettingsChangedMessage {
+                    from_device: token.0.device,
+                    burn_after_reading_users,
+                    burn_after_reading_groups,
+                    ..Default::default()
+                },
+            }));
+
+        Ok(())
+    }
+
+    /// Update read index
+    #[oai(path = "/read-index", method = "post")]
+    async fn update_read_index(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        req: Json<UpdateReadIndexRequest>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+
+        if req
+            .users
+            .iter()
+            .any(|item| item.uid == token.uid || !cache.users.contains_key(&item.uid))
+        {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        if req
+            .groups
+            .iter()
+            .any(|item| !cache.groups.contains_key(&item.gid))
+        {
+            return Err(Error::from_status(StatusCode::BAD_REQUEST));
+        }
+
+        let user = cache
+            .users
+            .get_mut(&token.uid)
+            .ok_or_else(|| Error::from_status(StatusCode::UNAUTHORIZED))?;
+        let read_index_users = req
+            .0
+            .users
+            .into_iter()
+            .filter_map(|item| match user.read_index_user.get(&item.uid) {
+                Some(prev_mid) if item.mid > *prev_mid => Some(ReadIndexUser {
+                    uid: item.uid,
+                    mid: item.mid,
+                }),
+                None => Some(ReadIndexUser {
+                    uid: item.uid,
+                    mid: item.mid,
+                }),
+                _ => None,
+            })
+            .collect_vec();
+        let read_index_groups = req
+            .0
+            .groups
+            .into_iter()
+            .filter_map(|item| match user.read_index_group.get(&item.gid) {
+                Some(prev_mid) if item.mid > *prev_mid => Some(ReadIndexGroup {
+                    gid: item.gid,
+                    mid: item.mid,
+                }),
+                None => Some(ReadIndexGroup {
+                    gid: item.gid,
+                    mid: item.mid,
+                }),
+                _ => None,
+            })
+            .collect_vec();
+
+        if read_index_users.is_empty() && read_index_groups.is_empty() {
+            return Ok(());
+        }
+
+        // update sqlite
+        let mut tx = state.db_pool.begin().await.map_err(InternalServerError)?;
+
+        for item in &read_index_users {
+            let sql = r#"
+                    insert into read_index (uid, target_uid, mid) values (?, ?, ?)
+                        on conflict (uid, target_uid) do update set mid = excluded.mid
+                    "#;
+            sqlx::query(sql)
+                .bind(token.uid)
+                .bind(item.uid)
+                .bind(item.mid)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+
+        for item in &read_index_groups {
+            let sql = r#"
+                    insert into read_index (uid, target_gid, mid) values (?, ?, ?)
+                        on conflict (uid, target_gid) do update set mid = excluded.mid
+                    "#;
+            sqlx::query(sql)
+                .bind(token.uid)
+                .bind(item.gid)
+                .bind(item.mid)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?;
+        }
+
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        for item in &read_index_users {
+            user.read_index_user.insert(item.uid, item.mid);
+        }
+        for item in &read_index_groups {
+            user.read_index_group.insert(item.gid, item.mid);
+        }
+
+        // broadcast event
+        let _ = state
+            .event_sender
+            .send(Arc::new(BroadcastEvent::UserSettingsChanged {
+                uid: token.0.uid,
+                message: UserSettingsChangedMessage {
+                    from_device: token.0.device,
+                    read_index_users,
+                    read_index_groups,
+                    ..Default::default()
+                },
+            }));
+
+        Ok(())
+    }
+
+    /// Delete current user
+    #[oai(path = "/delete", method = "delete")]
+    async fn delete_current_user(&self, state: Data<&State>, token: Token) -> Result<()> {
+        state.delete_user(token.uid).await?;
+        Ok(())
+    }
+
+    /// Register a new user with the magic token
+    #[oai(path = "/update_fcm_token", method = "put")]
+    async fn update_fcm_token(
+        &self,
+        state: Data<&State>,
+        token: Token,
+        device: Query<String>,
+        fcm_token: PlainText<String>,
+    ) -> Result<()> {
+        let mut cache = state.cache.write().await;
+        let uid = token.uid;
+        let cached_user = match cache.users.get_mut(&uid) {
+            Some(cached_user) => cached_user,
+            None => return Err(Error::from_status(StatusCode::UNAUTHORIZED)),
+        };
+
+        // update device token
+        sqlx::query(
+            r#"
+        insert into device (uid, device, device_token) values (?, ?, ?)
+            on conflict (uid, device) do update set device_token = excluded.device_token
+        "#,
+        )
+        .bind(uid)
+        .bind(&device.0)
+        .bind(&fcm_token.0)
+        .execute(&state.db_pool)
+        .await
+        .map_err(InternalServerError)?;
+
+        cached_user
+            .devices
+            .entry(device.to_string())
+            .and_modify(|device| {
+                device.device_token = Some(fcm_token.0.clone());
+            })
+            .or_insert_with(|| CacheDevice {
+                device_token: Some(fcm_token.0),
+                sender: None,
+            });
+
+        Ok(())
+    }
+}
+
+const fn default_get_history_messages_limit() -> usize {
+    300
+}
+
+async fn fetch_user_log(
+    cache: &Cache,
+    db_pool: &SqlitePool,
+    users_version: Option<i64>,
+) -> Result<Option<Message>> {
+    match users_version {
+        Some(users_version) => {
+            let sql = "select id, uid, action, email, name, gender, language, is_admin, is_bot, avatar_updated_at from user_log where id > ?";
+            let mut stream = sqlx::query_as::<
+                _,
+                (
+                    i64,
+                    i64,
+                    UpdateAction,
+                    Option<String>,
+                    Option<String>,
+                    Option<i32>,
+                    Option<LangId>,
+                    Option<bool>,
+                    Option<bool>,
+                    Option<DateTime>,
+                ),
+            >(sql)
+            .bind(users_version)
+            .fetch(db_pool);
+
+            let mut logs = Vec::new();
+            while let Some(res) = stream.next().await {
+                let (
+                    id,
+                    uid,
+                    action,
+                    email,
+                    name,
+                    gender,
+                    language,
+                    is_admin,
+                    is_bot,
+                    avatar_updated_at,
+                ) = res.map_err(InternalServerError)?;
+                let log = UserUpdateLog {
+                    log_id: id,
+                    action,
+                    uid,
+                    email,
+                    name,
+                    gender,
+                    language,
+                    is_admin,
+                    is_bot,
+                    avatar_updated_at,
+                };
+                logs.push(log);
+            }
+
+            if !logs.is_empty() {
+                Ok(Some(Message::UsersUpdateLog(UsersUpdateLogMessage {
+                    logs,
+                })))
+            } else {
+                Ok(None)
+            }
+        }
+        None => {
+            let version = sqlx::query_as::<_, (i64,)>("select max(id) from user_log")
+                .fetch_optional(db_pool)
+                .await
+                .map_err(InternalServerError)?
+                .map(|(version,)| version);
+            let users = cache
+                .users
+                .iter()
+                .filter(|user| !user.1.is_guest)
+                .map(|(uid, user)| user.api_user_info(*uid))
+                .collect_vec();
+            if !users.is_empty() {
+                Ok(Some(Message::UsersSnapshot(UsersSnapshotMessage {
+                    users,
+                    version: version.expect("user log version"),
+                })))
+            } else {
+                Ok(None)
+            }
+        }
+    }
+}
+
+fn get_users_state(cache: &Cache, current_uid: i64) -> UsersStateMessage {
+    UsersStateMessage {
+        users: cache
+            .users
+            .iter()
+            .filter_map(|(uid, user)| {
+                if *uid != current_uid && !user.is_guest {
+                    Some(UserState {
+                        uid: *uid,
+                        online: user.is_online(),
+                    })
+                } else {
+                    None
+                }
+            })
+            .collect(),
+    }
+}
+
+fn get_user_settings_msg(user: &CacheUser) -> UserSettingsMessage {
+    let now = DateTime::now();
+
+    UserSettingsMessage {
+        mute_users: user
+            .mute_user
+            .iter()
+            .filter_map(|(uid, expired_in)| {
+                if matches!(expired_in, Some(expired_in) if now.0 > expired_in.0) {
+                    return None;
+                }
+                Some(MuteUser {
+                    uid: *uid,
+                    expired_at: *expired_in,
+                })
+            })
+            .collect(),
+        mute_groups: user
+            .mute_group
+            .iter()
+            .filter_map(|(gid, expired_in)| {
+                if matches!(expired_in, Some(expired_in) if now.0 > expired_in.0) {
+                    return None;
+                }
+                Some(MuteGroup {
+                    gid: *gid,
+                    expired_at: *expired_in,
+                })
+            })
+            .collect(),
+        read_index_users: user
+            .read_index_user
+            .iter()
+            .map(|(uid, mid)| ReadIndexUser {
+                uid: *uid,
+                mid: *mid,
+            })
+            .collect(),
+        read_index_groups: user
+            .read_index_group
+            .iter()
+            .map(|(gid, mid)| ReadIndexGroup {
+                gid: *gid,
+                mid: *mid,
+            })
+            .collect(),
+        burn_after_reading_users: user
+            .burn_after_reading_user
+            .iter()
+            .map(|(uid, expires_in)| BurnAfterReadingUser {
+                uid: *uid,
+                expires_in: *expires_in,
+            })
+            .collect(),
+        burn_after_reading_groups: user
+            .burn_after_reading_group
+            .iter()
+            .map(|(gid, expires_in)| BurnAfterReadingGroup {
+                gid: *gid,
+                expires_in: *expires_in,
+            })
+            .collect(),
+    }
+}
+
+fn create_user_event_receiver(
+    state: &State,
+    current_user: &CurrentUser,
+    user: &mut CacheUser,
+) -> Result<UnboundedReceiver<UserEvent>> {
+    let is_online = user.is_online();
+
+    if let Some(device) = user.devices.get_mut(&current_user.device) {
+        if let Some(sender) = device.sender.take() {
+            let _ = sender.send(UserEvent::Kick {
+                reason: KickReason::LoginFromOtherDevice,
+            });
+        }
+
+        let (tx_user_event, rx_user_event) = mpsc::unbounded_channel();
+        device.sender = Some(tx_user_event);
+
+        if !is_online && user.is_online() && !user.is_guest {
+            let _ = state
+                .event_sender
+                .send(Arc::new(BroadcastEvent::UserStateChanged(
+                    UserStateChangedMessage {
+                        uid: current_user.uid,
+                        online: Some(true),
+                    },
+                )));
+        }
+
+        Ok(rx_user_event)
+    } else {
+        Err(Error::from_status(StatusCode::FORBIDDEN))
+    }
+}
+
+fn fetch_newest_messages(
+    cache: &Cache,
+    msg_db: &MsgDb,
+    uid: i64,
+    after_mid: Option<i64>,
+) -> Result<Vec<ChatMessage>> {
+    Ok(msg_db
+        .messages()
+        .fetch_user_messages_after(uid, after_mid, MAX_NEWEST_MESSAGES)
+        .map_err(InternalServerError)?
+        .into_iter()
+        .filter_map(|(id, data)| {
+            Some(id).zip(serde_json::from_slice::<ChatMessagePayload>(&data).ok())
+        })
+        .map(|(id, payload)| ChatMessage { mid: id, payload })
+        .filter(|msg| match &msg.payload.target {
+            MessageTarget::User(MessageTargetUser { .. }) => true,
+            MessageTarget::Group(MessageTargetGroup { gid }) => cache.groups.contains_key(gid),
+        })
+        .collect::<Vec<_>>())
+}
+
+#[allow(clippy::too_many_arguments)]
+async fn events_loop(
+    state: State,
+    mut rx_user_event: UnboundedReceiver<UserEvent>,
+    mut receiver: Receiver<Arc<BroadcastEvent>>,
+    mut push_start_id: Option<i64>,
+    current_uid: i64,
+    current_device: String,
+    tx_msg: UnboundedSender<Message>,
+) {
+    let mut heartbeat = tokio::time::interval_at(
+        Instant::now() + Duration::from_secs(15),
+        Duration::from_secs(15),
+    );
+
+    loop {
+        tokio::select! {
+            res = receiver.recv() => {
+                match res {
+                    Ok(event) => {
+                        match &*event {
+                            BroadcastEvent::Chat { targets, message } => {
+                                if !targets.contains(&current_uid) {
+                                    continue;
+                                }
+
+                                if let Some(id) = push_start_id {
+                                    if message.mid <= id {
+                                        continue;
+                                    }
+                                    push_start_id = None;
+                                }
+
+                                if tx_msg.send(Message::Chat(message.clone())).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::UserLog(update_log) => {
+                                if tx_msg.send(Message::UsersUpdateLog(UsersUpdateLogMessage {
+                                    logs: vec![update_log.clone()],
+                                })).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::UserJoinedGroup { targets, gid, uid } => {
+                                if !targets.contains(&current_uid) {
+                                    continue;
+                                }
+                                if tx_msg.send(Message::UserJoinedGroup(UserJoinedGroupMessage { gid: *gid, uid: uid.clone() })).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::UserLeavedGroup { targets, gid, uid } => {
+                                if !targets.contains(&current_uid) {
+                                    continue;
+                                }
+                                if tx_msg.send(Message::UserLeavedGroup(UserLeavedGroupMessage { gid: *gid, uid: uid.clone() })).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::JoinedGroup { targets, group } => {
+                                if !targets.contains(&current_uid) {
+                                    continue;
+                                }
+                                if tx_msg.send(Message::JoinedGroup(JoinedGroupMessage { group: group.clone() })).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::KickFromGroup { targets, gid, reason } => {
+                                if !targets.contains(&current_uid) {
+                                    continue;
+                                }
+                                if tx_msg.send(Message::KickFromGroup(KickFromGroupMessage { gid: *gid, reason: *reason })).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::UserStateChanged(msg) => {
+                                if current_uid == msg.uid {
+                                    continue;
+                                }
+                                if tx_msg.send(Message::UserStateChanged(msg.clone())).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::UserSettingsChanged { uid, message } => {
+                                if current_uid != *uid {
+                                    continue;
+                                }
+                                if message.from_device == current_device {
+                                    continue;
+                                }
+                                if tx_msg.send(Message::UserSettingsChanged(message.clone())).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::GroupChanged { targets, msg } => {
+                                if targets.contains(&current_uid) && tx_msg.send(Message::GroupChanged(msg.clone())).is_err() {
+                                    break;
+                                }
+                            }
+                            BroadcastEvent::PinnedMessageUpdated { targets, gid, mid, msg } => {
+                                if targets.contains(&current_uid) {
+                                    let msg = Message::PinnedMessageUpdated(PinnedMessageUpdated {
+                                        gid: *gid,
+                                        mid: *mid,
+                                        msg: msg.clone(),
+                                    });
+                                    if tx_msg.send(msg).is_err() {
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                    }
+                    Err(_) => break,
+                }
+            }
+            res = rx_user_event.recv() => {
+                match res {
+                    Some(UserEvent::Kick { reason }) => {
+                        if tx_msg.send(Message::Kick(KickMessage { reason })).is_err() {
+                            break;
+                        }
+                    }
+                    None => break,
+                }
+            }
+            _ = heartbeat.tick() => {
+                if tx_msg.send(Message::Heartbeat(HeartbeatMessage {
+                    time: DateTime::now(),
+                })).is_err() {
+                    break;
+                }
+            }
+        }
+    }
+
+    let mut cache = state.cache.write().await;
+    if let Some(user) = cache.users.get_mut(&current_uid) {
+        if let Some(device) = user.devices.get_mut(&current_device) {
+            device.sender = None;
+        }
+        if !user.is_online() && !user.is_guest {
+            let _ = state
+                .event_sender
+                .send(Arc::new(BroadcastEvent::UserStateChanged(
+                    UserStateChangedMessage {
+                        uid: current_uid,
+                        online: Some(false),
+                    },
+                )));
+        }
+    }
+
+    tracing::info!(
+        uid = current_uid,
+        device = current_device.as_str(),
+        "unsubscribe events"
+    );
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{str::FromStr, time::Duration};
+
+    use futures_util::StreamExt;
+    use itertools::Itertools;
+    use poem::http::Uri;
+    use serde::Deserialize;
+    use serde_json::json;
+
+    use crate::{
+        api::{LoginConfig, SmtpConfig},
+        config::TemplateConfig,
+        state::DynamicConfigEntry,
+        test_harness::TestServer,
+    };
+
+    #[tokio::test]
+    async fn test_events_after_mid() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+        let mut seq = None;
+
+        for i in 0..10 {
+            server
+                .send_text_to_user(&token1, uid2, format!("hello, {}", i))
+                .await;
+        }
+
+        let mut msg_stream = server
+            .subscribe_events_after_mid(&token2, Some(&["chat"]), seq)
+            .await;
+        for i in 0..10 {
+            let msg = msg_stream.next().await.unwrap();
+            let msg = msg.value().object();
+            assert_eq!(msg.get("from_uid").i64(), uid1);
+            let detail = msg.get("detail").object();
+            detail
+                .get("content")
+                .assert_string(&format!("hello, {}", i));
+            seq = Some(msg.get("mid").i64());
+        }
+
+        server
+            .send_text_to_user(&token1, uid2, format!("hello, {}", 11))
+            .await;
+
+        let mut msg_stream = server
+            .subscribe_events_after_mid(&token2, Some(&["chat"]), seq)
+            .await;
+        let msg = msg_stream.next().await.unwrap();
+        let msg = msg.value().object();
+        assert_eq!(msg.get("from_uid").i64(), uid1);
+        let detail = msg.get("detail").object();
+        detail
+            .get("content")
+            .assert_string(&format!("hello, {}", 11));
+    }
+
+    #[tokio::test]
+    async fn test_send() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        for i in 0..10 {
+            server
+                .send_text_to_user(&token1, uid2, format!("hello, {}", i))
+                .await;
+        }
+
+        let mut events1 = server.subscribe_events(&token1, Some(&["chat"])).await;
+        let mut events2 = server.subscribe_events(&token2, Some(&["chat"])).await;
+
+        for events in [&mut events1, &mut events2] {
+            for i in 0..10 {
+                let msg = events.next().await.unwrap();
+                let msg = msg.value().object();
+                msg.get("from_uid").assert_i64(uid1);
+                msg.get("target").object().get("uid").assert_i64(uid2);
+                let detail = msg.get("detail").object();
+                detail.get("type").assert_string("normal");
+                detail
+                    .get("content")
+                    .assert_string(&format!("hello, {}", i));
+            }
+        }
+
+        for i in 10..20 {
+            server
+                .send_text_to_user(&token1, uid2, format!("hello, {}", i))
+                .await;
+        }
+
+        for events in [&mut events1, &mut events2] {
+            for i in 10..20 {
+                let msg = events.next().await.unwrap();
+                let msg = msg.value().object();
+                msg.get("from_uid").assert_i64(uid1);
+                msg.get("target").object().get("uid").assert_i64(uid2);
+                let detail = msg.get("detail").object();
+                detail.get("type").assert_string("normal");
+                detail
+                    .get("content")
+                    .assert_string(&format!("hello, {}", i));
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn test_send_with_properties() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let mut events1 = server.subscribe_events(&token1, Some(&["chat"])).await;
+
+        let resp = server
+            .post(format!("/api/user/{}/send", uid1))
+            .header("X-API-Key", &admin_token)
+            .header(
+                "X-Properties",
+                base64::encode(
+                    serde_json::to_string(&json!({
+                        "a": 10,
+                        "b": "abc",
+                    }))
+                    .unwrap(),
+                ),
+            )
+            .content_type("text/plain")
+            .body("hello")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let mid = resp.json().await.value().i64();
+
+        let msg = events1.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("mid").assert_i64(mid);
+        msg.get("from_uid").assert_i64(1);
+        msg.get("target").object().get("uid").assert_i64(uid1);
+        let detail = msg.get("detail").object();
+        detail.get("type").assert_string("normal");
+        let content = detail.get("content");
+        content.assert_string("hello");
+        let properties = detail.get("properties").object();
+        properties.get("a").assert_i64(10);
+        properties.get("b").assert_string("abc");
+    }
+
+    #[tokio::test]
+    async fn kick_by_login_from_other_device() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let mut msg_stream1 = server.subscribe_events(&admin_token, Some(&["kick"])).await;
+        let mut _msg_stream2 = server.subscribe_events(&admin_token, None).await;
+
+        let msg = msg_stream1.next().await.unwrap();
+        assert_eq!(
+            msg.value().object().get("reason").string(),
+            "login_from_other_device"
+        );
+    }
+
+    #[tokio::test]
+    async fn kick_by_delete_user() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+
+        let mut events1 = server.subscribe_events(&token1, Some(&["kick"])).await;
+
+        let resp = server
+            .delete(format!("/api/admin/user/{}", uid1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let msg = events1.next().await.unwrap();
+        assert_eq!(msg.value().object().get("reason").string(), "delete_user");
+    }
+
+    #[tokio::test]
+    async fn test_get_devices() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let resp = server
+            .get("/api/user/devices")
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        json.value().assert_string_array(&["iphone"]);
+    }
+
+    #[tokio::test]
+    async fn kick_by_delete_device() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let mut resp_events = server.subscribe_events(&admin_token, Some(&["kick"])).await;
+
+        let resp = server
+            .delete("/api/user/devices/iphone")
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let msg = resp_events.next().await.unwrap();
+        let obj = msg.value().object();
+        assert_eq!(obj.get("reason").string(), "delete_device");
+
+        let resp = server
+            .get("/api/user/devices")
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        json.value().assert_string_array(&[]);
+    }
+
+    #[tokio::test]
+    async fn kick_by_logout() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        let mut resp_events = server.subscribe_events(&admin_token, Some(&["kick"])).await;
+
+        let resp = server
+            .get("/api/token/logout")
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let msg = resp_events.next().await.unwrap();
+        let obj = msg.value().object();
+        assert_eq!(obj.get("reason").string(), "logout");
+    }
+
+    #[tokio::test]
+    async fn test_user_log() {
+        let filters = &["users_snapshot", "users_log"];
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        // create user1
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let mut events1 = server.subscribe_events(&token1, Some(filters)).await;
+
+        let json = events1.next().await.unwrap();
+        json.value()
+            .object()
+            .get("type")
+            .assert_string("users_snapshot");
+        json.value().object().get("version").assert_i64(2);
+        assert_eq!(
+            json.value().object().get("users").array(),
+            vec![
+                json!({
+                    "uid": 1,
+                    "email": "admin@voce.chat",
+                    "name": "admin",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": true,
+                    "is_bot": false,
+                    "avatar_updated_at": 0,
+                    "create_by": "password",
+                }),
+                json!({
+                    "uid": uid1,
+                    "email": "user1@voce.chat",
+                    "name": "user1@voce.chat",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": false,
+                    "is_bot": false,
+                    "create_by": "password",
+                    "avatar_updated_at": 0,
+                }),
+            ]
+        );
+
+        // create user2
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+        let mut events2 = server.subscribe_events(&token2, Some(filters)).await;
+
+        let json = events2.next().await.unwrap();
+        json.value()
+            .object()
+            .get("type")
+            .assert_string("users_snapshot");
+        json.value().object().get("version").assert_i64(3);
+        assert_eq!(
+            json.value().object().get("users").array(),
+            vec![
+                json!({
+                    "uid": 1,
+                    "email": "admin@voce.chat",
+                    "name": "admin",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": true,
+                    "is_bot": false,
+                    "avatar_updated_at": 0,
+                    "create_by": "password",
+                }),
+                json!({
+                    "uid": uid1,
+                    "email": "user1@voce.chat",
+                    "name": "user1@voce.chat",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": false,
+                    "is_bot": false,
+                    "avatar_updated_at": 0,
+                    "create_by": "password",
+                }),
+                json!({
+                    "uid": uid2,
+                    "email": "user2@voce.chat",
+                    "name": "user2@voce.chat",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": false,
+                    "is_bot": false,
+                    "avatar_updated_at": 0,
+                    "create_by": "password",
+                }),
+            ]
+        );
+
+        // create user2 event
+        let json = events1.next().await.unwrap();
+        json.value().object().get("type").assert_string("users_log");
+        assert_eq!(
+            json.value().object().get("logs").array(),
+            vec![json!({
+                "log_id": 3,
+                "action": "create",
+                "uid": uid2,
+                "email": "user2@voce.chat",
+                "name": "user2@voce.chat",
+                "gender": 1,
+                "language": "en-US",
+                "is_admin": false,
+                "is_bot": false,
+                "avatar_updated_at": 0,
+            })]
+        );
+
+        // update user2 name
+        let resp = server
+            .put("/api/user")
+            .header("X-API-Key", &token2)
+            .body_json(&json!({
+                "name": "test22"
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events1, &mut events2] {
+            let json = events.next().await.unwrap();
+            json.value().object().get("type").assert_string("users_log");
+            assert_eq!(
+                json.value().object().get("logs").array(),
+                vec![json!({
+                    "log_id": 4,
+                    "action": "update",
+                    "uid": uid2,
+                    "email": null,
+                    "name": "test22",
+                    "gender": null,
+                    "language": null,
+                    "is_admin": null,
+                    "is_bot": null,
+                    "avatar_updated_at": null,
+                })]
+            );
+        }
+
+        // delete user2
+        let resp = server
+            .delete(format!("/api/admin/user/{}", uid2))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let json = events1.next().await.unwrap();
+        json.value().object().get("type").assert_string("users_log");
+        assert_eq!(
+            json.value().object().get("logs").array(),
+            vec![json!({
+                "log_id": 5,
+                "action": "delete",
+                "uid": uid2,
+                "email": null,
+                "name": null,
+                "gender": null,
+                "language": null,
+                "is_admin": null,
+                "is_bot": null,
+                "avatar_updated_at": null,
+            })]
+        );
+
+        // create user3
+        let uid3 = server.create_user(&admin_token, "user3@voce.chat").await;
+        let token3 = server.login("user3@voce.chat").await;
+        let mut events3 = server.subscribe_events(&token3, Some(filters)).await;
+
+        let json = events3.next().await.unwrap();
+        json.value()
+            .object()
+            .get("type")
+            .assert_string("users_snapshot");
+        json.value().object().get("version").assert_i64(6);
+        assert_eq!(
+            json.value().object().get("users").array(),
+            vec![
+                json!({
+                    "uid": 1,
+                    "email": "admin@voce.chat",
+                    "name": "admin",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": true,
+                    "is_bot": false,
+                    "avatar_updated_at": 0,
+                    "create_by": "password",
+                }),
+                json!({
+                    "uid": uid1,
+                    "email": "user1@voce.chat",
+                    "name": "user1@voce.chat",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": false,
+                    "is_bot": false,
+                    "avatar_updated_at": 0,
+                    "create_by": "password",
+                }),
+                json!({
+                    "uid": uid3,
+                    "email": "user3@voce.chat",
+                    "name": "user3@voce.chat",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": false,
+                    "is_bot": false,
+                    "avatar_updated_at": 0,
+                    "create_by": "password",
+                }),
+            ]
+        );
+
+        let json = events1.next().await.unwrap();
+        json.value().object().get("type").assert_string("users_log");
+        assert_eq!(
+            json.value().object().get("logs").array(),
+            vec![json!({
+                "log_id": 6,
+                "action": "create",
+                "uid": uid3,
+                "email": "user3@voce.chat",
+                "name": "user3@voce.chat",
+                "gender": 1,
+                "language": "en-US",
+                "is_admin": false,
+                "is_bot": false,
+                "avatar_updated_at": 0,
+            })]
+        );
+
+        // update user3 avatar
+        let resp = server
+            .post("/api/user/avatar")
+            .header("X-API-Key", &token3)
+            .content_type("image/png")
+            .body(include_bytes!("assets/poem.png").to_vec())
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let json = events1.next().await.unwrap();
+        json.value().object().get("type").assert_string("users_log");
+        let obj = json.value().object().get("logs").array().get(0).object();
+        let avatar_updated_at = obj.get("avatar_updated_at").i64();
+
+        // skip snapshot
+        let mut events3 = server
+            .subscribe_events_with_users_version(&token3, Some(filters), 3)
+            .await;
+        let json = events3.next().await.unwrap();
+        json.value().object().get("type").assert_string("users_log");
+        assert_eq!(
+            json.value().object().get("logs").array(),
+            vec![
+                json!({
+                    "log_id": 4,
+                    "action": "update",
+                    "uid": uid2,
+                    "email": null,
+                    "name": "test22",
+                    "gender": null,
+                    "language": null,
+                    "is_admin": null,
+                    "is_bot": null,
+                    "avatar_updated_at": null,
+                }),
+                json!({
+                    "log_id": 5,
+                    "action": "delete",
+                    "uid": uid2,
+                    "email": null,
+                    "name": null,
+                    "gender": null,
+                    "language": null,
+                    "is_admin": null,
+                    "is_bot": null,
+                    "avatar_updated_at": null,
+                }),
+                json!({
+                    "log_id": 6,
+                    "action": "create",
+                    "uid": uid3,
+                    "email": "user3@voce.chat",
+                    "name": "user3@voce.chat",
+                    "gender": 1,
+                    "language": "en-US",
+                    "is_admin": false,
+                    "is_bot": false,
+                    "avatar_updated_at": 0,
+                }),
+                json!({
+                    "log_id": 7,
+                    "action": "update",
+                    "uid": uid3,
+                    "email": null,
+                    "name": null,
+                    "gender": null,
+                    "language": null,
+                    "is_admin": null,
+                    "is_bot": null,
+                    "avatar_updated_at": avatar_updated_at,
+                }),
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn test_subscribe_with_different_devices_1() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login_with_device("user1@voce.chat", "a1").await;
+        let token2 = server.login_with_device("user1@voce.chat", "a2").await;
+
+        let mut events1 = server.subscribe_events(&token1, Some(&["chat"])).await;
+        let mut events2 = server.subscribe_events(&token2, Some(&["chat"])).await;
+
+        for i in 0..10 {
+            server
+                .send_text_to_user(&admin_token, uid1, format!("hello {}", i))
+                .await;
+        }
+
+        for events in [&mut events1, &mut events2] {
+            for i in 0..10 {
+                let msg = events.next().await.unwrap();
+                let msg = msg.value().object();
+                assert_eq!(msg.get("from_uid").i64(), 1);
+                let detail = msg.get("detail").object();
+                detail.get("content").assert_string(&format!("hello {}", i));
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn received_chat_messages_from_myself() {
+        let server = TestServer::new().await;
+        let admin_token_ios = server.login_admin_with_device("ios").await;
+        let admin_token_android = server.login_admin_with_device("android").await;
+        let uid1 = server
+            .create_user(&admin_token_ios, "user1@voce.chat")
+            .await;
+        let uid1_token = server.login("user1@voce.chat").await;
+
+        let mut admin_events_ios = server
+            .subscribe_events(&admin_token_ios, Some(&["chat"]))
+            .await;
+        let mut admin_events_android = server
+            .subscribe_events(&admin_token_android, Some(&["chat"]))
+            .await;
+        let mut uid1_events = server.subscribe_events(&uid1_token, Some(&["chat"])).await;
+
+        let mid = server
+            .send_text_to_user(&admin_token_ios, uid1, "hello")
+            .await;
+
+        for events in [
+            &mut admin_events_ios,
+            &mut admin_events_android,
+            &mut uid1_events,
+        ] {
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("mid").assert_i64(mid);
+            msg.get("from_uid").assert_i64(1);
+            let detail = msg.get("detail").object();
+            detail.get("type").assert_string("normal");
+            detail.get("content").assert_string("hello");
+        }
+    }
+
+    #[tokio::test]
+    async fn received_joined_group_when_create_private_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["joined_group"]))
+            .await;
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["joined_group"]))
+            .await;
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["joined_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1, uid2]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        for events in [&mut events_admin, &mut events1, &mut events2] {
+            let msg = events.next().await.unwrap();
+            let group = msg.value().object().get("group").object();
+            group.get("gid").assert_i64(gid);
+            group.get("is_public").assert_bool(false);
+        }
+    }
+
+    #[tokio::test]
+    async fn received_joined_group_when_create_public_group() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let _uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let _uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["joined_group"]))
+            .await;
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["joined_group"]))
+            .await;
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["joined_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        for events in [&mut events_admin, &mut events1, &mut events2] {
+            let msg = events.next().await.unwrap();
+            let group = msg.value().object().get("group").object();
+            group.get("gid").assert_i64(gid);
+            group.get("is_public").assert_bool(true);
+        }
+    }
+
+    #[tokio::test]
+    async fn received_kick_from_group_when_delete_private_group_by_owner() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let _uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["kick_from_group"]))
+            .await;
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["kick_from_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid2]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // delete group by owner
+        let resp = server
+            .delete(format!("/api/group/{}", gid))
+            .header("X-API-Key", &token1)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events1, &mut events2] {
+            let msg = events.next().await.unwrap();
+            msg.value().object().get("gid").assert_i64(gid);
+            msg.value()
+                .object()
+                .get("reason")
+                .assert_string("group_deleted");
+        }
+    }
+
+    #[tokio::test]
+    async fn received_kick_from_group_when_delete_public_group_by_admin() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let _uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let _uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut admin_events = server
+            .subscribe_events(&admin_token, Some(&["kick_from_group"]))
+            .await;
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["kick_from_group"]))
+            .await;
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["kick_from_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // delete group by admin
+        let resp = server
+            .delete(format!("/api/group/{}", gid))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut admin_events, &mut events1, &mut events2] {
+            let msg = events.next().await.unwrap();
+            msg.value().object().get("gid").assert_i64(gid);
+            msg.value()
+                .object()
+                .get("reason")
+                .assert_string("group_deleted");
+        }
+    }
+
+    #[tokio::test]
+    async fn received_joined_group_when_add_member() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["joined_group"]))
+            .await;
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["joined_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // add uid1, uid2
+        let resp = server
+            .post(format!("/api/group/{}/members/add", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!([uid1, uid2]))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events1, &mut events2] {
+            let msg = events.next().await.unwrap();
+            let group = msg.value().object().get("group").object();
+            group.get("gid").assert_i64(gid);
+        }
+    }
+
+    #[tokio::test]
+    async fn received_kick_from_group_when_remove_members() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["kick_from_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1, uid2]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // remove uid2 from group
+        let resp = server
+            .post(format!("/api/group/{}/members/remove", gid))
+            .header("X-API-Key", &token1)
+            .body_json(&json!([uid2]))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let msg = events2.next().await.unwrap();
+        msg.value().object().get("gid").assert_i64(gid);
+        msg.value().object().get("reason").assert_string("kick");
+    }
+
+    #[tokio::test]
+    async fn received_kick_from_group_when_delete_owner_user() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["kick_from_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid2]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // delete user1
+        let resp = server
+            .delete(format!("/api/admin/user/{}", uid1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let msg = events2.next().await.unwrap();
+        msg.value().object().get("gid").assert_i64(gid);
+        msg.value()
+            .object()
+            .get("reason")
+            .assert_string("group_deleted");
+    }
+
+    #[tokio::test]
+    async fn received_user_joined_private_group_when_add_member() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["user_joined_group"]))
+            .await;
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["user_joined_group"]))
+            .await;
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["joined_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // add uid2
+        let resp = server
+            .post(format!("/api/group/{}/members/add", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!([uid2]))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events_admin, &mut events1] {
+            let msg = events.next().await.unwrap();
+            msg.value().object().get("gid").assert_i64(gid);
+            msg.value().object().get("uid").assert_i64_array(&[uid2]);
+        }
+
+        let msg = events2.next().await.unwrap();
+        msg.value()
+            .object()
+            .get("group")
+            .object()
+            .get("gid")
+            .assert_i64(gid);
+    }
+
+    #[tokio::test]
+    async fn received_user_joined_public_group_when_create_user() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let _uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["user_joined_group"]))
+            .await;
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["user_joined_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // create user2
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+
+        for events in [&mut events_admin, &mut events1] {
+            let msg = events.next().await.unwrap();
+            msg.value().object().get("gid").assert_i64(gid);
+            msg.value().object().get("uid").assert_i64_array(&[uid2]);
+        }
+    }
+
+    #[tokio::test]
+    async fn received_user_leaved_private_group_when_remove_member() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["user_leaved_group"]))
+            .await;
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["user_leaved_group"]))
+            .await;
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["kick_from_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1, uid2]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // remove uid2
+        let resp = server
+            .post(format!("/api/group/{}/members/remove", gid))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!([uid2]))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events_admin, &mut events1] {
+            let msg = events.next().await.unwrap();
+            msg.value().object().get("gid").assert_i64(gid);
+            msg.value().object().get("uid").assert_i64_array(&[uid2]);
+        }
+
+        let msg = events2.next().await.unwrap();
+        msg.value().object().get("gid").assert_i64(gid);
+    }
+
+    #[tokio::test]
+    async fn received_user_leaved_public_group_when_delete_user() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let _uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let _token2 = server.login("user2@voce.chat").await;
+
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["user_leaved_group"]))
+            .await;
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["user_leaved_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // delete user2
+        let resp = server
+            .delete(format!("/api/admin/user/{}", uid2))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events_admin, &mut events1] {
+            let msg = events.next().await.unwrap();
+            msg.value().object().get("gid").assert_i64(gid);
+            msg.value().object().get("uid").assert_i64_array(&[uid2]);
+        }
+    }
+
+    #[tokio::test]
+    async fn received_related_groups_on_subscribe() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+
+        // create public group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "a",
+                "is_public": true,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid1 = json.value().object().get("gid").i64();
+
+        // create private group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "a",
+                "members": [uid1],
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid2 = json.value().object().get("gid").i64();
+
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["related_groups"]))
+            .await;
+
+        let resp = events1.next().await.unwrap();
+        let array = resp.value().object().get("groups").object_array();
+        array[0].get("gid").assert_i64(gid1);
+        array[1].get("gid").assert_i64(gid2);
+    }
+
+    #[tokio::test]
+    async fn received_user_leaved_private_group_when_leave() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2 = server.login("user2@voce.chat").await;
+
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["user_leaved_group"]))
+            .await;
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["user_leaved_group"]))
+            .await;
+        let mut events2 = server
+            .subscribe_events(&token2, Some(&["user_leaved_group"]))
+            .await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1, uid2]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // user2 leave the group
+        let resp = server
+            .get(format!("/api/group/{}/leave", gid))
+            .header("X-API-Key", &token2)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        for events in [&mut events_admin, &mut events1, &mut events2] {
+            let msg = events.next().await.unwrap();
+            msg.value().object().get("gid").assert_i64(gid);
+            msg.value().object().get("uid").assert_i64_array(&[uid2]);
+        }
+    }
+
+    #[tokio::test]
+    async fn received_mute_list() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // mute uid1 and gid
+        let resp = server
+            .post("/api/user/mute")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "add_users": [{
+                    "uid": uid1,
+                    "expired_in": 6,
+                }],
+                "add_groups": [{
+                    "gid": gid,
+                    "expired_in": 3,
+                }]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let mut events = server
+            .subscribe_events(&admin_token, Some(&["user_settings"]))
+            .await;
+        let msg = events.next().await.unwrap();
+
+        let mute_users = msg.value().object().get("mute_users").array();
+        mute_users.assert_len(1);
+        mute_users.get(0).object().get("uid").assert_i64(uid1);
+
+        let mute_groups = msg.value().object().get("mute_groups").array();
+        mute_groups.assert_len(1);
+        mute_groups.get(0).object().get("gid").assert_i64(gid);
+    }
+
+    #[tokio::test]
+    async fn received_mute_changed() {
+        let server = TestServer::new().await;
+        let admin_token_ios = server.login_with_device("admin@voce.chat", "ios").await;
+        let admin_token_android = server.login_with_device("admin@voce.chat", "android").await;
+        let mut events_admin_ios = server
+            .subscribe_events(&admin_token_ios, Some(&["user_settings_changed"]))
+            .await;
+        let mut events_admin_android = server
+            .subscribe_events(&admin_token_android, Some(&["user_settings_changed"]))
+            .await;
+        let uid1 = server
+            .create_user(&admin_token_ios, "user1@voce.chat")
+            .await;
+
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // mute uid1
+        let resp = server
+            .post("/api/user/mute")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "add_users": [{
+                    "uid": uid1,
+                    "expired_in": 6,
+                }]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        // mute gid
+        let resp = server
+            .post("/api/user/mute")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "add_groups": [{
+                    "gid": gid,
+                    "expired_in": 3,
+                }]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let msg = events_admin_android.next().await.unwrap();
+        msg.value().object().get("from_device").assert_string("ios");
+        msg.value()
+            .object()
+            .get("add_mute_users")
+            .array()
+            .get(0)
+            .object()
+            .get("uid")
+            .assert_i64(uid1);
+        let msg = events_admin_android.next().await.unwrap();
+        msg.value().object().get("from_device").assert_string("ios");
+        msg.value()
+            .object()
+            .get("add_mute_groups")
+            .array()
+            .get(0)
+            .object()
+            .get("gid")
+            .assert_i64(gid);
+
+        assert!(
+            tokio::time::timeout(Duration::from_secs(1), events_admin_ios.next())
+                .await
+                .is_err(),
+        );
+
+        // unmute uid1
+        let resp = server
+            .post("/api/user/mute")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({ "remove_users": [uid1] }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let msg = events_admin_android.next().await.unwrap();
+        msg.value().object().get("from_device").assert_string("ios");
+        msg.value()
+            .object()
+            .get("remove_mute_users")
+            .array()
+            .get(0)
+            .assert_i64(uid1);
+    }
+
+    #[tokio::test]
+    async fn received_mute_list_exclude_expired_items() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // mute uid1 and gid
+        let resp = server
+            .post("/api/user/mute")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "add_users": [{
+                    "uid": uid1,
+                    "expired_in": 6,
+                }],
+                "add_groups": [{
+                    "gid": gid,
+                    "expired_in": 3,
+                }]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        async fn check_items(
+            server: &TestServer,
+            token: &str,
+            mut expect_uids: Vec<i64>,
+            mut expect_gids: Vec<i64>,
+        ) {
+            let mut events = server
+                .subscribe_events(&token, Some(&["user_settings"]))
+                .await;
+            let msg = events.next().await.unwrap();
+            let mute_users = msg.value().object().get("mute_users").array();
+            let mut mute_users = mute_users
+                .iter()
+                .map(|item| item.object().get("uid").i64())
+                .collect_vec();
+            let mute_groups = msg.value().object().get("mute_groups").array();
+            let mut mute_groups = mute_groups
+                .iter()
+                .map(|item| item.object().get("gid").i64())
+                .collect_vec();
+
+            expect_uids.sort_unstable();
+            expect_gids.sort_unstable();
+            mute_users.sort_unstable();
+            mute_groups.sort_unstable();
+
+            assert_eq!(expect_uids, mute_users);
+            assert_eq!(expect_gids, mute_groups);
+        }
+
+        check_items(&server, &admin_token, vec![uid1], vec![gid]).await;
+
+        tokio::time::sleep(Duration::from_secs(4)).await;
+        check_items(&server, &admin_token, vec![uid1], vec![]).await;
+
+        tokio::time::sleep(Duration::from_secs(3)).await;
+        check_items(&server, &admin_token, vec![], vec![]).await;
+    }
+
+    #[tokio::test]
+    async fn received_users_state() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let uid2 = server.create_user(&admin_token, "user2@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+        let token2_ios = server.login_with_device("user2@voce.chat", "ios").await;
+        let token2_android = server.login_with_device("user2@voce.chat", "android").await;
+
+        let mut events1 = server
+            .subscribe_events(&token1, Some(&["users_state", "users_state_changed"]))
+            .await;
+        let mut events_admin = server
+            .subscribe_events(&admin_token, Some(&["users_state", "users_state_changed"]))
+            .await;
+
+        // user1
+        let msg = events1.next().await.unwrap();
+        msg.value()
+            .object()
+            .get("type")
+            .assert_string("users_state");
+
+        let users = msg.value().object().get("users").array();
+        users.assert_len(2);
+
+        users.get(0).object().get("uid").assert_i64(1);
+        users.get(0).object().get("online").assert_bool(false);
+
+        users.get(1).object().get("uid").assert_i64(uid2);
+        users.get(1).object().get("online").assert_bool(false);
+
+        let msg = events1.next().await.unwrap();
+        let obj = msg.value().object();
+        obj.get("type").assert_string("users_state_changed");
+        obj.get("uid").assert_i64(1);
+        obj.get("online").assert_bool(true);
+
+        // admin
+        let msg = events_admin.next().await.unwrap();
+        msg.value()
+            .object()
+            .get("type")
+            .assert_string("users_state");
+
+        let users = msg.value().object().get("users").array();
+        users.assert_len(2);
+
+        users.get(0).object().get("uid").assert_i64(uid1);
+        users.get(0).object().get("online").assert_bool(true);
+
+        users.get(1).object().get("uid").assert_i64(uid2);
+        users.get(1).object().get("online").assert_bool(false);
+
+        // user2
+        let mut events2_ios = server
+            .subscribe_events(&token2_ios, Some(&["users_state", "users_state_changed"]))
+            .await;
+        let mut events2_android = server
+            .subscribe_events(
+                &token2_android,
+                Some(&["users_state", "users_state_changed"]),
+            )
+            .await;
+        for events in [&mut events2_ios, &mut events2_android] {
+            let msg = events.next().await.unwrap();
+            msg.value()
+                .object()
+                .get("type")
+                .assert_string("users_state");
+
+            let users = msg.value().object().get("users").array();
+            users.assert_len(2);
+
+            users.get(0).object().get("uid").assert_i64(1);
+            users.get(0).object().get("online").assert_bool(true);
+
+            users.get(1).object().get("uid").assert_i64(uid1);
+            users.get(1).object().get("online").assert_bool(true);
+        }
+
+        // user1, admin
+        for events in [&mut events1, &mut events_admin] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("type").assert_string("users_state_changed");
+            obj.get("uid").assert_i64(uid2);
+            obj.get("online").assert_bool(true);
+        }
+
+        // user1
+        drop(events2_ios);
+        assert!(tokio::time::timeout(Duration::from_secs(6), events1.next())
+            .await
+            .is_err());
+
+        drop(events2_android);
+        tokio::time::sleep(Duration::from_secs(6)).await;
+
+        // user1, admin
+        for events in [&mut events1, &mut events_admin] {
+            let msg = events.next().await.unwrap();
+            let obj = msg.value().object();
+            obj.get("type").assert_string("users_state_changed");
+            obj.get("uid").assert_i64(uid2);
+            obj.get("online").assert_bool(false);
+        }
+    }
+
+    #[tokio::test]
+    async fn received_read_index() {
+        let server = TestServer::new().await;
+        let admin_token_ios = server.login_admin_with_device("ios").await;
+        let admin_token_android = server.login_admin_with_device("android").await;
+        let user1 = server
+            .create_user(&admin_token_ios, "user1@voce.chat")
+            .await;
+        let user1_token = server.login("user1@voce.chat").await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "name": "test",
+                "members": [user1]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        let mut events_admin_ios = server
+            .subscribe_events(
+                &admin_token_ios,
+                Some(&["chat", "user_settings", "user_settings_changed"]),
+            )
+            .await;
+        let mut events_admin_android = server
+            .subscribe_events(
+                &admin_token_android,
+                Some(&["chat", "user_settings", "user_settings_changed"]),
+            )
+            .await;
+
+        let mid1 = server.send_text_to_user(&user1_token, 1, "a").await;
+        let mid2 = server.send_text_to_group(&user1_token, gid, "b").await;
+
+        for events in [&mut events_admin_ios, &mut events_admin_android] {
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("type").assert_string("user_settings");
+            msg.get("read_index_users").array().assert_len(0);
+            msg.get("read_index_groups").array().assert_len(0);
+
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("type").assert_string("chat");
+            msg.get("mid").assert_i64(mid1);
+            msg.get("from_uid").assert_i64(user1);
+            let detail = msg.get("detail").object();
+            detail.get("content").assert_string("a");
+
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("type").assert_string("chat");
+            msg.get("mid").assert_i64(mid2);
+            msg.get("from_uid").assert_i64(user1);
+            msg.get("target").object().get("gid").assert_i64(gid);
+            let detail = msg.get("detail").object();
+            detail.get("content").assert_string("b");
+        }
+
+        // update read index
+        server
+            .post("/api/user/read-index")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "users": [{"uid": user1, "mid": mid1}],
+                "groups": [{"gid": gid, "mid": mid2}],
+            }))
+            .send()
+            .await
+            .assert_status_is_ok();
+
+        let msg = events_admin_android.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("type").assert_string("user_settings_changed");
+        let read_index_users = msg.get("read_index_users").array();
+        let read_index_groups = msg.get("read_index_groups").array();
+
+        read_index_users.assert_len(1);
+        let item = read_index_users.get(0).object();
+        item.get("uid").assert_i64(user1);
+        item.get("mid").assert_i64(mid1);
+
+        read_index_groups.assert_len(1);
+        let item = read_index_groups.get(0).object();
+        item.get("gid").assert_i64(gid);
+        item.get("mid").assert_i64(mid2);
+
+        let mid3 = server.send_text_to_user(&user1_token, 1, "c").await;
+
+        for events in [&mut events_admin_ios, &mut events_admin_android] {
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("type").assert_string("chat");
+            msg.get("mid").assert_i64(mid3);
+            msg.get("from_uid").assert_i64(user1);
+            let detail = msg.get("detail").object();
+            detail.get("content").assert_string("c");
+        }
+
+        // update read index
+        server
+            .post("/api/user/read-index")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "users": [{"uid": user1, "mid": 0}],
+                "groups": [{"gid": gid, "mid": 0}],
+            }))
+            .send()
+            .await
+            .assert_status_is_ok();
+
+        // update read index
+        server
+            .post("/api/user/read-index")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "users": [{"uid": user1, "mid": mid3}]
+            }))
+            .send()
+            .await
+            .assert_status_is_ok();
+
+        let msg = events_admin_android.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("type").assert_string("user_settings_changed");
+        let read_index_users = msg.get("read_index_users").array();
+        read_index_users.assert_len(1);
+        let item = read_index_users.get(0).object();
+        item.get("uid").assert_i64(user1);
+        item.get("mid").assert_i64(mid3);
+
+        let admin_token_web = server.login_admin_with_device("web").await;
+        let mut events_admin_web = server
+            .subscribe_events(&admin_token_web, Some(&["user_settings"]))
+            .await;
+
+        let msg = events_admin_web.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("type").assert_string("user_settings");
+        let read_index_users = msg.get("read_index_users").array();
+        let read_index_groups = msg.get("read_index_groups").array();
+
+        read_index_users.assert_len(1);
+        let item = read_index_users.get(0).object();
+        item.get("uid").assert_i64(user1);
+        item.get("mid").assert_i64(mid3);
+
+        read_index_groups.assert_len(1);
+        let item = read_index_groups.get(0).object();
+        item.get("gid").assert_i64(gid);
+        item.get("mid").assert_i64(mid2);
+    }
+
+    #[tokio::test]
+    async fn received_burn_after_reading() {
+        let server = TestServer::new().await;
+        let admin_token_ios = server.login_admin_with_device("ios").await;
+        let admin_token_android = server.login_admin_with_device("android").await;
+        let user1 = server
+            .create_user(&admin_token_ios, "user1@voce.chat")
+            .await;
+        let user1_token = server.login("user1@voce.chat").await;
+
+        // create group
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "name": "test",
+                "members": [user1]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        let mut events_admin_ios = server
+            .subscribe_events(
+                &admin_token_ios,
+                Some(&["chat", "user_settings", "user_settings_changed"]),
+            )
+            .await;
+        let mut events_admin_android = server
+            .subscribe_events(
+                &admin_token_android,
+                Some(&["chat", "user_settings", "user_settings_changed"]),
+            )
+            .await;
+
+        let resp = server
+            .post("/api/user/burn-after-reading")
+            .header("X-API-Key", &admin_token_ios)
+            .body_json(&json!({
+                "users": [{
+                    "uid": user1,
+                    "expires_in": 15,
+                }],
+                "groups": [{
+                    "gid": gid,
+                    "expires_in": 30,
+                }]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let mid1 = server.send_text_to_user(&admin_token_ios, user1, "a").await;
+        let mid2 = server.send_text_to_group(&admin_token_ios, gid, "b").await;
+
+        for events in [&mut events_admin_ios, &mut events_admin_android] {
+            let msg = events.next().await.unwrap();
+            let msg = msg.value().object();
+            msg.get("type").assert_string("user_settings");
+            msg.get("burn_after_reading_users").array().assert_len(0);
+            msg.get("burn_after_reading_groups").array().assert_len(0);
+        }
+
+        let msg = events_admin_android.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("type").assert_string("user_settings_changed");
+        msg.get("burn_after_reading_users").array().assert_len(1);
+        let item = msg.get("burn_after_reading_users").array().get(0).object();
+        item.get("uid").assert_i64(user1);
+        item.get("expires_in").assert_i64(15);
+        msg.get("burn_after_reading_groups").array().assert_len(1);
+        let item = msg.get("burn_after_reading_groups").array().get(0).object();
+        item.get("gid").assert_i64(gid);
+        item.get("expires_in").assert_i64(30);
+
+        let mut events_user1 = server.subscribe_events(&user1_token, Some(&["chat"])).await;
+        let msg = events_user1.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("type").assert_string("chat");
+        msg.get("mid").assert_i64(mid1);
+        msg.get("from_uid").assert_i64(1);
+        msg.get("target").object().get("uid").assert_i64(user1);
+        let detail = msg.get("detail").object();
+        detail.get("content").assert_string("a");
+        detail.get("expires_in").assert_i64(15);
+
+        let msg = events_user1.next().await.unwrap();
+        let msg = msg.value().object();
+        msg.get("type").assert_string("chat");
+        msg.get("mid").assert_i64(mid2);
+        msg.get("from_uid").assert_i64(1);
+        msg.get("target").object().get("gid").assert_i64(gid);
+        let detail = msg.get("detail").object();
+        detail.get("content").assert_string("b");
+        detail.get("expires_in").assert_i64(30);
+    }
+
+    #[tokio::test]
+    async fn check_reg_magic_token() {
+        let server = TestServer::new().await;
+        let code = rc_magic_link::gen_code();
+        let expired_at = chrono::Utc::now() + chrono::Duration::seconds(86400);
+        let reg_magic_token = rc_magic_link::MagicLinkToken::gen_reg_magic_token(
+            &code,
+            &server.state().key_config.read().await.server_key,
+            expired_at,
+            false,
+            None,
+            None,
+            None,
+        );
+
+        // check reg magic token
+        let resp = server
+            .post("/api/user/check_magic_token")
+            .body_json(&json!({
+                "magic_token": &reg_magic_token,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json().await.value().assert_bool(true);
+
+        // invalid magic token
+        let resp = server
+            .post("/api/user/check_magic_token")
+            .body_json(&json!({
+                "magic_token": "abc",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json().await.value().assert_bool(false);
+    }
+
+    #[tokio::test]
+    async fn check_login_magic_token() {
+        let server = TestServer::new().await;
+        let code = rc_magic_link::gen_code();
+        let expired_at = chrono::Utc::now() + chrono::Duration::seconds(86400);
+        let email = "user1@mail.com";
+        let login_magic_token = rc_magic_link::MagicLinkToken::gen_login_magic_token(
+            &code,
+            &server.state().key_config.read().await.server_key,
+            expired_at,
+            email,
+            None,
+        );
+
+        // check login magic token
+        let resp = server
+            .post("/api/user/check_magic_token")
+            .body_json(&json!({
+                "magic_token": &login_magic_token,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json().await.value().assert_bool(true);
+    }
+
+    #[tokio::test]
+    async fn reg_magic_link_without_smtp() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+
+        // create invite link, gid = None, global server
+        let resp = server
+            .get("/api/group/create_reg_magic_link?expired_in=600&max_times=10000")
+            .header("X-API-Key", &user1_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let url = resp.0.into_body().into_string().await.unwrap();
+        let uri = Uri::from_str(&url).unwrap();
+
+        #[derive(Deserialize)]
+        struct Params {
+            magic_token: String,
+        }
+        let params = serde_urlencoded::from_str::<Params>(uri.query().unwrap()).unwrap();
+        assert!(!params.magic_token.is_empty());
+
+        let email1 = "user2@voce.chat";
+        let resp = server
+            .post("/api/user/register")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "magic_token": params.magic_token,
+                "email": email1,
+                "password": "123456",
+                "gender": 1,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        // resp.assert_text("xxx").await;
+        let json = resp.json().await;
+        assert_eq!(
+            email1,
+            json.value()
+                .object()
+                .get("user")
+                .object()
+                .get("email")
+                .string()
+        );
+    }
+
+    #[tokio::test]
+    async fn reg_magic_link_with_smtp() {
+        let server = TestServer::new_with_config(|cfg| {
+            cfg.template.register_by_email = Some(TemplateConfig {
+                subject: "Register".to_string(),
+                file: concat!(
+                    env!("CARGO_MANIFEST_DIR"),
+                    "/config/templates/register_by_email.html"
+                )
+                .to_string(),
+            });
+        })
+        .await;
+        server
+            .state()
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: SmtpConfig {
+                    host: "localhost:1111".to_string(),
+                    port: None,
+                    from: "aaa".to_string(),
+                    username: "aaa".to_string(),
+                    password: "aaa".to_string(),
+                },
+            })
+            .await
+            .unwrap();
+        let admin_token = server.login_admin().await;
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+
+        // create invite link
+        let resp = server
+            .get("/api/group/create_reg_magic_link")
+            .header("X-API-Key", &user1_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let url = resp.0.into_body().into_string().await.unwrap();
+        let uri = Uri::from_str(&url).unwrap();
+
+        #[derive(Deserialize)]
+        struct Params {
+            magic_token: String,
+        }
+        let params = serde_urlencoded::from_str::<Params>(uri.query().unwrap()).unwrap();
+        assert!(!params.magic_token.is_empty());
+
+        // send magic link
+        let resp = server
+            .post("/api/user/send_reg_magic_link")
+            .body_json(&json!({
+                "magic_token": &params.magic_token,
+                "email": "user3@voce.chat",
+                "password": "1",
+            }))
+            .send()
+            .await;
+        // resp.assert_text("").await;
+        resp.assert_status_is_ok();
+
+        // resp.assert_text(params.magic_token).await;
+        let json = resp.json().await;
+        let new_magic_token = json.value().object().get("new_magic_token").string();
+        // let new_magic_token = resp.0.into_body().into_string().await.unwrap();
+        dbg!(&new_magic_token);
+
+        let resp = server
+            .post("/api/user/register")
+            .body_json(&json!({
+                "magic_token": new_magic_token,
+                "gender": 1,
+            }))
+            .send()
+            .await;
+        // resp.assert_text("").await;
+        resp.assert_status_is_ok();
+
+        let json = resp.json().await;
+        json.value()
+            .object()
+            .get("user")
+            .object()
+            .get("email")
+            .assert_string("user3@voce.chat");
+    }
+
+    #[tokio::test]
+    async fn login_magic_link_with_smtp() {
+        let server = TestServer::new_with_config(|cfg| {
+            cfg.template.login_by_email = Some(TemplateConfig {
+                subject: "Login".to_string(),
+                file: concat!(
+                    env!("CARGO_MANIFEST_DIR"),
+                    "/config/templates/login_by_email.html"
+                )
+                .to_string(),
+            });
+        })
+        .await;
+        let state = server.state();
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: SmtpConfig {
+                    host: "localhost:1111".to_string(),
+                    port: None,
+                    from: "aaa".to_string(),
+                    username: "aaa".to_string(),
+                    password: "aaa".to_string(),
+                },
+            })
+            .await
+            .unwrap();
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: LoginConfig {
+                    magic_link: true,
+                    ..Default::default()
+                },
+            })
+            .await
+            .unwrap();
+
+        let email1 = "user@email.com";
+        let resp = server
+            .post("/api/user/send_login_magic_link")
+            .query("email", &email1)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let magic_token = resp.0.into_body().into_string().await.unwrap();
+        assert!(!magic_token.is_empty());
+
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "magiclink",
+                    "magic_token": &magic_token,
+                    "extra_name": "jack"
+                },
+                "device": "web",
+                "device_token": "device token",
+            }))
+            .send()
+            .await;
+        // resp.assert_text("").await;
+        // resp.assert_status_is_ok();
+
+        let json = resp.json().await;
+        assert!(!json
+            .value()
+            .object()
+            .get("refresh_token")
+            .string()
+            .is_empty());
+    }
+
+    #[tokio::test]
+    async fn check_email() {
+        let server = TestServer::new().await;
+
+        let resp = server
+            .get("/api/user/check_email")
+            .query("email", &"admin@voce.chat")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json().await.value().assert_bool(false);
+
+        let resp = server
+            .get("/api/user/check_email")
+            .query("email", &"user1@voce.chat")
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json().await.value().assert_bool(true);
+    }
+
+    #[tokio::test]
+    async fn user_frozen() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let user1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+
+        let resp = server
+            .get(format!("/api/admin/user/{}", user1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        json.value().object().get("status").assert_string("normal");
+
+        let mut events = server.subscribe_events(&user1_token, Some(&["kick"])).await;
+
+        let resp = server
+            .put(format!("/api/admin/user/{}", user1))
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "status": "frozen"
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        let resp = server
+            .get(format!("/api/admin/user/{}", user1))
+            .header("X-API-Key", &admin_token)
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        json.value().object().get("status").assert_string("frozen");
+
+        let msg = events.next().await.unwrap();
+        msg.value().object().get("type").assert_string("kick");
+        msg.value().object().get("reason").assert_string("frozen");
+
+        assert!(events.next().await.is_none());
+    }
+
+    #[tokio::test]
+    async fn test_history_messages() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+        let user1_token = server.login("user1@voce.chat").await;
+
+        let id1 = server.send_text_to_user(&admin_token, uid1, "a").await;
+        let id2 = server.send_text_to_user(&user1_token, 1, "b").await;
+        let id3 = server.send_text_to_user(&admin_token, uid1, "c").await;
+
+        async fn check(
+            server: &TestServer,
+            token: &str,
+            to_uid: i64,
+            before_mid: Option<i64>,
+            expect: Vec<(i64, &str)>,
+        ) {
+            let mut builder = server
+                .get(format!("/api/user/{}/history", to_uid))
+                .header("X-API-Key", token);
+            if let Some(before_mid) = before_mid {
+                builder = builder.query("before", &before_mid);
+            }
+            let resp = builder.send().await;
+            resp.assert_status_is_ok();
+            let json = resp.json().await;
+            let array = json.value().array();
+            array.assert_len(expect.len());
+            for (row, (id, content)) in array.iter().zip(expect) {
+                let row = row.object();
+                row.get("mid").assert_i64(id);
+                let detail = row.get("detail").object();
+                detail.get("type").assert_string("normal");
+                detail.get("content").assert_string(content);
+            }
+        }
+
+        check(
+            &server,
+            &admin_token,
+            uid1,
+            None,
+            vec![(id1, "a"), (id2, "b"), (id3, "c")],
+        )
+        .await;
+
+        check(
+            &server,
+            &admin_token,
+            uid1,
+            Some(id3),
+            vec![(id1, "a"), (id2, "b")],
+        )
+        .await;
+        check(
+            &server,
+            &user1_token,
+            1,
+            Some(id3),
+            vec![(id1, "a"), (id2, "b")],
+        )
+        .await;
+
+        check(&server, &admin_token, uid1, Some(id1), vec![]).await;
+    }
+
+    #[tokio::test]
+    async fn test_change_password() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+
+        server.create_user(&admin_token, "user1@voce.chat").await;
+        let token1 = server.login("user1@voce.chat").await;
+
+        server
+            .post("/api/user/change_password")
+            .header("X-API-Key", &token1)
+            .body_json(&json!({
+                "old_password": "123456",
+                "new_password": "654321",
+            }))
+            .send()
+            .await
+            .assert_status_is_ok();
+
+        let resp = server
+            .post("/api/token/login")
+            .body_json(&json!({
+                "credential": {
+                    "type": "password",
+                    "email": "user1@voce.chat",
+                    "password": "654321"
+                },
+                "device": "web",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json()
+            .await
+            .value()
+            .object()
+            .get("token")
+            .assert_not_null();
+    }
+}
diff --git a/src/api/user_log_action.rs b/src/api/user_log_action.rs
new file mode 100644
index 0000000..7ffd112
--- /dev/null
+++ b/src/api/user_log_action.rs
@@ -0,0 +1,41 @@
+use poem_openapi::Enum;
+use sqlx::sqlite::SqliteArgumentValue;
+
+/// Update action type
+#[derive(
+    Debug, Copy, Clone, Eq, PartialEq, num_enum::IntoPrimitive, num_enum::TryFromPrimitive, Enum,
+)]
+#[repr(i32)]
+#[oai(rename_all = "snake_case")]
+pub enum UpdateAction {
+    Create = 1,
+    Update = 2,
+    Delete = 3,
+}
+
+impl sqlx::Type<sqlx::Sqlite> for UpdateAction {
+    fn type_info() -> sqlx::sqlite::SqliteTypeInfo {
+        i32::type_info()
+    }
+
+    fn compatible(ty: &sqlx::sqlite::SqliteTypeInfo) -> bool {
+        i32::compatible(ty)
+    }
+}
+
+impl<'a> sqlx::Decode<'a, sqlx::Sqlite> for UpdateAction {
+    fn decode(value: sqlx::sqlite::SqliteValueRef<'a>) -> Result<Self, sqlx::error::BoxDynError> {
+        let n = i32::decode(value)?;
+        Ok(Self::try_from(n)?)
+    }
+}
+
+impl<'a> sqlx::Encode<'a, sqlx::Sqlite> for UpdateAction {
+    fn encode_by_ref(
+        &self,
+        buf: &mut Vec<sqlx::sqlite::SqliteArgumentValue<'a>>,
+    ) -> sqlx::encode::IsNull {
+        buf.push(SqliteArgumentValue::Int((*self).into()));
+        sqlx::encode::IsNull::No
+    }
+}
diff --git a/src/api_key.rs b/src/api_key.rs
new file mode 100644
index 0000000..3ad3369
--- /dev/null
+++ b/src/api_key.rs
@@ -0,0 +1,33 @@
+use hmac::{Mac, NewMac};
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
+
+#[derive(Debug, Serialize, Deserialize)]
+struct ApiKey {
+    uid: i64,
+    nonce: String,
+}
+
+pub fn create_api_key(uid: i64, server_key: &str) -> String {
+    let content = serde_json::to_vec(&ApiKey {
+        uid,
+        nonce: textnonce::TextNonce::new().0,
+    })
+    .unwrap();
+    let mut buf_sig = {
+        let mut mac = hmac::Hmac::<Sha256>::new_from_slice(server_key.as_bytes()).unwrap();
+        mac.update(&content);
+        mac.finalize().into_bytes().to_vec()
+    };
+    buf_sig.extend_from_slice(&content);
+    hex::encode(&buf_sig)
+}
+
+pub fn parse_api_key(data: &str, server_key: &str) -> Option<i64> {
+    let data = hex::decode(data).ok()?;
+    let mut mac = hmac::Hmac::<Sha256>::new_from_slice(server_key.as_bytes()).unwrap();
+    mac.update(&data[32..]);
+    mac.verify(&data[..32]).ok()?;
+    let api_key = serde_json::from_slice::<ApiKey>(&data[32..]).ok()?;
+    Some(api_key.uid)
+}
diff --git a/src/config.rs b/src/config.rs
new file mode 100644
index 0000000..928fc01
--- /dev/null
+++ b/src/config.rs
@@ -0,0 +1,312 @@
+use std::path::PathBuf;
+
+use anyhow::Context;
+use futures_util::StreamExt;
+use poem::listener::{
+    acme::{AutoCert, ChallengeType},
+    BoxListener, Listener, RustlsCertificate, RustlsConfig,
+};
+use rc_fcm::ApplicationCredentials;
+use serde::{Deserialize, Deserializer, Serialize};
+
+use crate::api::LangId;
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct KeyConfig {
+    pub server_id: String,
+    pub server_key: String,
+    pub third_party_secret: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct Config {
+    pub system: SystemConfig,
+    pub network: NetworkConfig,
+    #[serde(default)]
+    pub template: TemplatesConfig,
+    #[serde(default, rename = "user")]
+    pub users: Vec<UserConfig>,
+    pub webclient_url: Option<String>,
+    #[serde(default)]
+    pub offical_fcm_config: ApplicationCredentials,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct SystemConfig {
+    pub data_dir: PathBuf,
+    #[serde(default = "default_token_expiry_seconds")]
+    pub token_expiry_seconds: i64,
+    #[serde(default = "default_refresh_token_expiry_seconds")]
+    pub refresh_token_expiry_seconds: i64,
+    #[serde(default = "default_magic_token_expiry_seconds")]
+    pub magic_token_expiry_seconds: i64,
+    #[serde(default = "default_upload_avatar_limit")]
+    pub upload_avatar_limit: usize,
+    #[serde(default = "default_send_image_limit")]
+    pub send_image_limit: usize,
+    #[serde(default = "default_upload_timeout_seconds")]
+    pub upload_timeout_seconds: i64,
+    #[serde(default = "default_file_expiry_days")]
+    pub file_expiry_days: i64,
+    #[serde(default = "default_max_favorite_archives")]
+    pub max_favorite_archives: usize,
+}
+
+const fn default_token_expiry_seconds() -> i64 {
+    60 * 5
+}
+
+const fn default_refresh_token_expiry_seconds() -> i64 {
+    60 * 60 * 24 * 7
+}
+
+const fn default_magic_token_expiry_seconds() -> i64 {
+    60 * 15
+}
+
+const fn default_upload_avatar_limit() -> usize {
+    1024 * 512
+}
+
+const fn default_send_image_limit() -> usize {
+    1024 * 1024 * 2
+}
+
+const fn default_upload_timeout_seconds() -> i64 {
+    300
+}
+
+const fn default_file_expiry_days() -> i64 {
+    30 * 3
+}
+
+const fn default_max_favorite_archives() -> usize {
+    100
+}
+
+impl SystemConfig {
+    pub fn sqlite_filename(&self) -> PathBuf {
+        self.db_dir().join("db.sqlite")
+    }
+
+    pub fn tmp_dir(&self) -> PathBuf {
+        self.data_dir.join("upload").join("tmp")
+    }
+
+    pub fn db_dir(&self) -> PathBuf {
+        self.data_dir.join("db")
+    }
+
+    pub fn msg_dir(&self) -> PathBuf {
+        self.data_dir.join("msg")
+    }
+
+    pub fn avatar_dir(&self) -> PathBuf {
+        self.data_dir.join("avatar")
+    }
+
+    pub fn group_avatar_dir(&self) -> PathBuf {
+        self.data_dir.join("group_avatar")
+    }
+
+    pub fn thumbnail_dir(&self) -> PathBuf {
+        self.data_dir.join("upload").join("thumbnail")
+    }
+
+    pub fn file_dir(&self) -> PathBuf {
+        self.data_dir.join("upload").join("file")
+    }
+
+    pub fn archive_msg_dir(&self) -> PathBuf {
+        self.data_dir.join("archive_msgs")
+    }
+
+    pub fn wwwroot_dir(&self) -> PathBuf {
+        self.data_dir.join("wwwroot")
+    }
+
+    pub fn temp_wwwroot_dir(&self) -> PathBuf {
+        self.data_dir.join("wwwroot.temp")
+    }
+
+    pub fn favorite_dir(&self, uid: i64) -> PathBuf {
+        self.data_dir.join("favorite").join(format!("{}", uid))
+    }
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(tag = "type", rename_all = "snake_case")]
+pub enum TlsConfig {
+    SelfSigned,
+    Certificate {
+        cert: Option<String>,
+        cert_path: Option<String>,
+        key: Option<String>,
+        key_path: Option<String>,
+    },
+    #[serde(rename = "acme_http_01")]
+    AcmeHttp01 {
+        #[serde(default = "acme_http_bind")]
+        http_bind: String,
+        directory_url: Option<String>,
+        cache_path: Option<String>,
+    },
+    #[serde(rename = "acme_tls_alpn_01")]
+    AcmeTlsAlpn01 {
+        directory_url: Option<String>,
+        cache_path: Option<String>,
+    },
+}
+
+fn acme_http_bind() -> String {
+    "0.0.0.0:80".to_string()
+}
+
+impl TlsConfig {
+    pub fn create_auto_cert(&self, domains: &[String]) -> anyhow::Result<Option<AutoCert>> {
+        match self {
+            TlsConfig::SelfSigned | TlsConfig::Certificate { .. } => Ok(None),
+            TlsConfig::AcmeHttp01 {
+                cache_path,
+                directory_url,
+                ..
+            } => {
+                anyhow::ensure!(!domains.is_empty(), "missing `network.domain` config");
+                let mut auto_cert = domains.iter().fold(
+                    AutoCert::builder().challenge_type(ChallengeType::Http01),
+                    |acc, domain| acc.domain(domain),
+                );
+                if let Some(directory_url) = directory_url {
+                    auto_cert = auto_cert.directory_url(directory_url);
+                }
+                if let Some(cache_path) = cache_path {
+                    let _ = std::fs::create_dir_all(cache_path);
+                    auto_cert = auto_cert.cache_path(cache_path);
+                }
+                Ok(Some(auto_cert.build()?))
+            }
+            TlsConfig::AcmeTlsAlpn01 {
+                cache_path,
+                directory_url,
+            } => {
+                anyhow::ensure!(!domains.is_empty(), "missing `network.domain` config");
+                let mut auto_cert = domains.iter().fold(
+                    AutoCert::builder().challenge_type(ChallengeType::TlsAlpn01),
+                    |acc, domain| acc.domain(domain),
+                );
+                if let Some(directory_url) = directory_url {
+                    auto_cert = auto_cert.directory_url(directory_url);
+                }
+                if let Some(cache_path) = cache_path {
+                    let _ = std::fs::create_dir_all(cache_path);
+                    auto_cert = auto_cert.cache_path(cache_path);
+                }
+                Ok(Some(auto_cert.build()?))
+            }
+        }
+    }
+
+    pub fn transform_listener(
+        &self,
+        listener: impl Listener + 'static,
+        auto_cert: Option<AutoCert>,
+    ) -> anyhow::Result<BoxListener> {
+        let listener = match self {
+            TlsConfig::SelfSigned => listener
+                .rustls(crate::self_signed::create_self_signed_config().boxed())
+                .boxed(),
+            TlsConfig::Certificate {
+                cert,
+                cert_path,
+                key,
+                key_path,
+            } => {
+                let cert = match (cert, cert_path) {
+                    (Some(cert), _) => cert.clone(),
+                    (None, Some(cert_path)) => std::fs::read_to_string(cert_path)
+                        .with_context(|| format!("failed to load certificate `{}`", cert_path))?,
+                    (None, None) => anyhow::bail!("missing `network.tls.cert` config"),
+                };
+                let key = match (key, key_path) {
+                    (Some(key), _) => key.clone(),
+                    (None, Some(key_path)) => std::fs::read_to_string(key_path)
+                        .with_context(|| format!("failed to load private key `{}`", key_path))?,
+                    (None, None) => anyhow::bail!("missing `network.tls.key` config"),
+                };
+
+                listener
+                    .rustls(
+                        RustlsConfig::new().fallback(RustlsCertificate::new().cert(cert).key(key)),
+                    )
+                    .boxed()
+            }
+            TlsConfig::AcmeHttp01 { .. } => listener.acme(auto_cert.unwrap()).boxed(),
+            TlsConfig::AcmeTlsAlpn01 { .. } => listener.acme(auto_cert.unwrap()).boxed(),
+        };
+        Ok(listener)
+    }
+}
+
+fn deserialize_domains<'de, D>(deserializer: D) -> Result<Vec<String>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    #[derive(Debug, Deserialize)]
+    #[serde(untagged)]
+    enum Domains {
+        One(String),
+        Array(Vec<String>),
+    }
+
+    Domains::deserialize(deserializer).map(|domains| match domains {
+        Domains::One(domain) => vec![domain],
+        Domains::Array(domains) => domains,
+    })
+}
+
+#[derive(Debug, Deserialize)]
+pub struct NetworkConfig {
+    #[serde(deserialize_with = "deserialize_domains", default)]
+    pub domain: Vec<String>,
+    pub bind: String,
+    pub tls: Option<TlsConfig>,
+    #[serde(default)]
+    pub frontend_url: String,
+}
+
+#[derive(Debug, Deserialize, Default)]
+pub struct TemplateConfig {
+    pub subject: String,
+    pub file: String,
+}
+
+#[derive(Debug, Deserialize, Default)]
+pub struct TemplatesConfig {
+    /// Register code content
+    ///
+    /// params:
+    ///     - code: string
+    #[serde(default)]
+    pub register_by_email: Option<TemplateConfig>,
+
+    /// Login by email content
+    ///
+    /// params:
+    ///     - email: string
+    ///     - token: string
+    #[serde(default)]
+    pub login_by_email: Option<TemplateConfig>,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct UserConfig {
+    pub name: String,
+    pub password: String,
+    pub email: String,
+    #[serde(default)]
+    pub gender: i32,
+    #[serde(default)]
+    pub language: LangId,
+    #[serde(default)]
+    pub is_admin: bool,
+}
diff --git a/src/create_user.rs b/src/create_user.rs
new file mode 100644
index 0000000..c90764e
--- /dev/null
+++ b/src/create_user.rs
@@ -0,0 +1,373 @@
+use std::sync::Arc;
+
+use poem::error::InternalServerError;
+use reqwest::StatusCode;
+use tokio::sync::{RwLockMappedWriteGuard, RwLockWriteGuard};
+
+use crate::{
+    api::{DateTime, LangId, UpdateAction, UserUpdateLog},
+    state::{BroadcastEvent, CacheUser, UserStatus},
+    State,
+};
+
+#[derive(Debug)]
+pub enum CreateUserBy<'a> {
+    Guest,
+    Password {
+        email: &'a str,
+        password: &'a str,
+    },
+    MagicLink {
+        email: &'a str,
+    },
+    Google {
+        email: &'a str,
+    },
+    Github {
+        username: &'a str,
+    },
+    OpenIdConnect {
+        issuer: &'a str,
+        subject: &'a str,
+        email: Option<&'a str>,
+    },
+    MetaMask {
+        public_address: &'a str,
+    },
+    ThirdParty {
+        thirdparty_uid: &'a str,
+        username: &'a str,
+    },
+}
+
+impl<'a> CreateUserBy<'a> {
+    fn type_name(&self) -> &'static str {
+        match self {
+            CreateUserBy::Guest => "guest",
+            CreateUserBy::Password { .. } => "password",
+            CreateUserBy::MagicLink { .. } => "magiclink",
+            CreateUserBy::Google { .. } => "google",
+            CreateUserBy::Github { .. } => "github",
+            CreateUserBy::OpenIdConnect { .. } => "oidc",
+            CreateUserBy::MetaMask { .. } => "metamask",
+            CreateUserBy::ThirdParty { .. } => "thirdparty",
+        }
+    }
+
+    fn email(&self) -> Option<&'a str> {
+        match self {
+            CreateUserBy::Guest => None,
+            CreateUserBy::Password { email, .. } => Some(*email),
+            CreateUserBy::MagicLink { email } => Some(*email),
+            CreateUserBy::Google { email } => Some(*email),
+            CreateUserBy::Github { username } => Some(*username),
+            CreateUserBy::OpenIdConnect { email, .. } => *email,
+            CreateUserBy::MetaMask { .. } => None,
+            CreateUserBy::ThirdParty { .. } => None,
+        }
+    }
+
+    fn password(&self) -> Option<&'a str> {
+        match self {
+            CreateUserBy::Guest => None,
+            CreateUserBy::Password { password, .. } => Some(*password),
+            CreateUserBy::MagicLink { .. } => None,
+            CreateUserBy::Google { .. } => None,
+            CreateUserBy::Github { .. } => None,
+            CreateUserBy::OpenIdConnect { .. } => None,
+            CreateUserBy::MetaMask { .. } => None,
+            CreateUserBy::ThirdParty { .. } => None,
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct CreateUser<'a> {
+    name: &'a str,
+    gender: i32,
+    is_admin: bool,
+    language: Option<&'a LangId>,
+    avatar: Option<&'a [u8]>,
+    create_by: CreateUserBy<'a>,
+    webhook_url: Option<&'a str>,
+    is_bot: bool,
+}
+
+impl<'a> CreateUser<'a> {
+    pub fn new(name: &'a str, create_by: CreateUserBy<'a>, is_admin: bool) -> Self {
+        Self {
+            name,
+            gender: 0,
+            is_admin,
+            language: None,
+            avatar: None,
+            create_by,
+            webhook_url: None,
+            is_bot: false,
+        }
+    }
+
+    pub fn gender(self, gender: i32) -> Self {
+        Self { gender, ..self }
+    }
+
+    pub fn set_admin(self, is_admin: bool) -> Self {
+        Self { is_admin, ..self }
+    }
+
+    pub fn set_bot(self, is_bot: bool) -> Self {
+        Self { is_bot, ..self }
+    }
+
+    pub fn language(self, language: &'a LangId) -> Self {
+        Self {
+            language: Some(language),
+            ..self
+        }
+    }
+
+    pub fn avatar(self, avatar: &'a [u8]) -> Self {
+        Self {
+            avatar: Some(avatar),
+            ..self
+        }
+    }
+
+    pub fn webhook_url(self, webhook_url: &'a str) -> Self {
+        Self {
+            webhook_url: Some(webhook_url),
+            ..self
+        }
+    }
+}
+
+#[derive(Debug)]
+pub enum CreateUserError {
+    NameConflict,
+    EmailConflict,
+    PoemError(poem::Error),
+}
+
+impl From<poem::Error> for CreateUserError {
+    fn from(err: poem::Error) -> Self {
+        CreateUserError::PoemError(err)
+    }
+}
+
+impl State {
+    pub async fn create_user(
+        &self,
+        create_user: CreateUser<'_>,
+    ) -> Result<(i64, RwLockMappedWriteGuard<'_, CacheUser>), CreateUserError> {
+        let email = create_user.create_by.email();
+        let password = create_user.create_by.password();
+        let language = create_user.language.cloned().unwrap_or_default();
+        let mut cache = self.cache.write().await;
+        let is_guest = matches!(&create_user.create_by, CreateUserBy::Guest);
+
+        // check license
+        {
+            if cache
+                .users
+                .iter()
+                .filter(|(_, user)| !user.is_guest)
+                .count()
+                >= crate::license::G_LICENSE.lock().await.user_limit as usize
+            {
+                return Err(CreateUserError::PoemError(poem::Error::from_string(
+                    "License error: Users reached limit.",
+                    StatusCode::UNAVAILABLE_FOR_LEGAL_REASONS,
+                )));
+            }
+        }
+
+        if !cache.check_name_conflict(create_user.name) {
+            return Err(CreateUserError::NameConflict);
+        }
+        if let Some(email) = email {
+            if !cache.check_email_conflict(email) {
+                return Err(CreateUserError::EmailConflict);
+            }
+        }
+
+        let now = DateTime::now();
+
+        // update sqlite
+        let mut tx = self.db_pool.begin().await.map_err(InternalServerError)?;
+
+        // insert into user table
+        let avatar_updated_at = if create_user.avatar.is_some() {
+            now
+        } else {
+            DateTime::zero()
+        };
+        let sql = "insert into user (name, password, email, gender, language, is_admin, create_by, avatar_updated_at, status, created_at, updated_at, is_guest, webhook_url, is_bot) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
+        let uid = sqlx::query(sql)
+            .bind(create_user.name)
+            .bind(password)
+            .bind(email)
+            .bind(create_user.gender)
+            .bind(&language)
+            .bind(create_user.is_admin)
+            .bind(create_user.create_by.type_name())
+            .bind(avatar_updated_at)
+            .bind(i8::from(UserStatus::Normal))
+            .bind(now)
+            .bind(now)
+            .bind(is_guest)
+            .bind(create_user.webhook_url)
+            .bind(create_user.is_bot)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?
+            .last_insert_rowid();
+
+        if let Some(avatar) = create_user.avatar {
+            let _ = self.save_avatar(uid, avatar);
+        }
+
+        match &create_user.create_by {
+            CreateUserBy::Google { email } => {
+                // insert into google_auth
+                let sql = "insert into google_auth (email, uid) values (?, ?)";
+                sqlx::query(sql)
+                    .bind(email)
+                    .bind(uid)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+            CreateUserBy::Github { username } => {
+                // insert into google_auth
+                let sql = "insert into github_auth (username, uid) values (?, ?)";
+                sqlx::query(sql)
+                    .bind(username)
+                    .bind(uid)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+            CreateUserBy::OpenIdConnect {
+                issuer, subject, ..
+            } => {
+                // insert into openid_connect
+                let sql = "insert into openid_connect (issuer, subject, uid) values (?, ?, ?)";
+                sqlx::query(sql)
+                    .bind(issuer)
+                    .bind(subject)
+                    .bind(uid)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+            CreateUserBy::MetaMask { public_address } => {
+                // insert into metamask_auth
+                let sql = "insert into metamask_auth (public_address, uid) values (?, ?)";
+                sqlx::query(sql)
+                    .bind(public_address)
+                    .bind(uid)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+            CreateUserBy::ThirdParty { thirdparty_uid, .. } => {
+                let sql = "insert into third_party_users (userid, uid) values (?, ?)";
+                sqlx::query(sql)
+                    .bind(thirdparty_uid)
+                    .bind(uid)
+                    .execute(&mut tx)
+                    .await
+                    .map_err(InternalServerError)?;
+            }
+            _ => {}
+        }
+
+        let log_id = if !is_guest {
+            // insert into user_log table
+            let sql = "insert into user_log (uid, action, email, name, gender, language, avatar_updated_at, is_admin, is_bot) values (?, ?, ?, ?, ?, ?, ?, ?, ?)";
+            let log_id = sqlx::query(sql)
+                .bind(uid)
+                .bind(UpdateAction::Create)
+                .bind(email)
+                .bind(create_user.name)
+                .bind(create_user.gender)
+                .bind(&language)
+                .bind(avatar_updated_at)
+                .bind(create_user.is_admin)
+                .bind(create_user.is_bot)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?
+                .last_insert_rowid();
+            Some(log_id)
+        } else {
+            None
+        };
+
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        cache.users.insert(
+            uid,
+            CacheUser {
+                email: email.map(ToString::to_string),
+                name: create_user.name.to_string(),
+                password: password.map(ToString::to_string),
+                gender: create_user.gender,
+                is_admin: create_user.is_admin,
+                language: language.clone(),
+                create_by: create_user.create_by.type_name().to_string(),
+                created_at: now,
+                updated_at: now,
+                avatar_updated_at,
+                devices: Default::default(),
+                mute_user: Default::default(),
+                mute_group: Default::default(),
+                burn_after_reading_user: Default::default(),
+                burn_after_reading_group: Default::default(),
+                read_index_user: Default::default(),
+                read_index_group: Default::default(),
+                status: UserStatus::Normal,
+                is_guest,
+                webhook_url: create_user.webhook_url.map(ToString::to_string),
+                is_bot: create_user.is_bot,
+                bot_keys: Default::default(),
+            },
+        );
+
+        if let Some(log_id) = log_id {
+            // broadcast event
+            let _ = self
+                .event_sender
+                .send(Arc::new(BroadcastEvent::UserLog(UserUpdateLog {
+                    log_id,
+                    action: UpdateAction::Create,
+                    uid,
+                    email: email.map(ToString::to_string),
+                    name: Some(create_user.name.to_string()),
+                    gender: create_user.gender.into(),
+                    language: Some(language.clone()),
+                    is_admin: Some(create_user.is_admin),
+                    is_bot: Some(create_user.is_bot),
+                    avatar_updated_at: Some(avatar_updated_at),
+                })));
+
+            for (gid, group) in cache.groups.iter() {
+                if group.ty.is_public() {
+                    let _ = self
+                        .event_sender
+                        .send(Arc::new(BroadcastEvent::UserJoinedGroup {
+                            targets: cache.users.keys().copied().collect(),
+                            gid: *gid,
+                            uid: vec![uid],
+                        }));
+                }
+            }
+        }
+
+        Ok((
+            uid,
+            RwLockWriteGuard::map(cache, |cache| cache.users.get_mut(&uid).unwrap()),
+        ))
+    }
+}
diff --git a/src/license.rs b/src/license.rs
new file mode 100644
index 0000000..0a61b77
--- /dev/null
+++ b/src/license.rs
@@ -0,0 +1,110 @@
+use std::ops::Deref;
+
+use anyhow::Result;
+use chrono::Utc;
+use once_cell::sync::Lazy;
+use poem::Request;
+use tokio::sync::Mutex;
+use vc_license::License;
+
+use crate::state::State;
+
+pub static VOCE_LICENSE_DEFAULT: &str = "333RgyjbHG5BoTXJaHDwAwcqZD1FZo24LKyByKvM4EgRGoyZFfrDhVgNVu9PFSaUoT6funBzzHWxNJRTcXfUEhx16WoSng9hukM51nmsA6EF5bNA76UDdjxyTRqp3EdpcWZhs58oiuwun1CF5HMYGT54pD9xb35u3Aq15iHqCkWBcoU4DHJRtg9HPVqGskbmwSAYbpfgWZE9NQMxt4RZxB8arik1CCUyAxpW8tKPLdt1JzeJi1KcWXn8Vmm8Nzb7hFfpjVb8yeAGc2QXyGLkGq92BgRdA6iPpc4HZQkfDFZ69xP2YFiH5fZbmAFAX2UGYKPkFQU5jQodVTtqZXxexczPCNtZQY2K5cdLcnQEoVjSKQ3cp2m15Twyus9JFbS3dm22aeX3ZBu2unXoV6mDwDndTJ3tBU6FxVyg3zckAHj5Kh2yfAcVdqnaU3JQAZcFsQVHw319qbUywm2PenD1jnSBAtuy6N6oqzXj9n8yQFrqJLFKCg8VaVhke9fUCKGYey4iVgQsHLHK6CMcjYMGWfB3tatPn44wGNpegdm9i4vEo3729HQBu6Ba4MCrNkkX8o244WehVHSaage6UVdMQMd8uh3QBEJJQTd3Vchz9Z4W4389iW5iA2pyzXTGmKEh8NiqUQZJgoE3HZysdaHpahxbCs2ihU7M9da5DtJMxjic7fKNtTinSomQ9E8TS5mBBGJsSYsAb94kpRrT9wxmH5Am81WWaY3UWR68Kxb4DHHtU7MA1ptJuQNCuBMBGeG7tj5f3TmsxB7FR4Mh4Fz";
+
+pub const VOCE_LICENSE_PUBLIC_KEY_PEM: &str = r#"-----BEGIN RSA PUBLIC KEY-----
+MIIBCgKCAQEApqGLPAiVzx42qRkjDGqCT4+BrS3BReJA7UAXQt3YNfw2HIB+CJSD
+F22KnpqmnsaLWmxrUP1Q+ttb+fZhMZ569s5ZLs9h6pq2oTBK8kBUKz127rpwHSpG
+VnuGbkPB4NUcTOYiDTLT7iD9NSN38Cr1ITTD3+4EiSiCuf9aUpggfo06fqF69ebD
+C0pPSTRvIDgKrJiku93c3d1uDq1DWfYKu3GP23ie5+3WwQcsd/XG/0xyMk1hfVQJ
+qTf5Z2rVdmhVGt0XjV6cmaVshJOxGeoAubPLJX4G4DLTvXKGy/WlQlQTqIBz8xUB
+dnwtOymXGQpaS/Vfo0q1kGzZoXsCx3v7BQIDAQAB
+-----END RSA PUBLIC KEY-----"#;
+
+// pub static mut g_license: Lazy<License> = Lazy::new(||License::default());
+pub static G_LICENSE: Lazy<Mutex<License>> = Lazy::new(|| Mutex::new(License::default()));
+
+/// inline always, Increase the difficulty of disassembly
+#[inline(always)]
+pub fn get_referer_domain(req: &Request) -> Option<String> {
+    let referer = req.header("Referer").unwrap_or_default();
+    let u = url::Url::parse(referer).ok()?;
+    u.domain()
+        .map(|v| v.to_string())
+        .or_else(|| u.host().map(|v| v.to_string()))
+}
+
+pub async fn load_license(state: &State) -> Result<()> {
+    let mut license_path = state.config.system.data_dir.clone();
+    license_path.push("license");
+    if !license_path.exists() {
+        tokio::fs::write(&license_path, VOCE_LICENSE_DEFAULT).await?;
+    }
+    let license_bs58 = tokio::fs::read_to_string(&license_path).await?;
+    let license = License::from_string(license_bs58)?;
+
+    G_LICENSE.lock().await.created_at = license.created_at;
+    G_LICENSE.lock().await.expired_at = license.expired_at;
+    G_LICENSE.lock().await.user_limit = license.user_limit;
+    G_LICENSE.lock().await.domains = license.domains;
+    G_LICENSE.lock().await.sign = license.sign;
+
+    Ok(())
+}
+
+pub async fn update_license(state: &State, new_license: &str) -> Result<()> {
+    let license = vc_license::License::from_string(new_license.to_string())?;
+    let mut license_path = state.config.system.data_dir.clone();
+    license_path.push("license");
+    std::fs::write(license_path, new_license.as_bytes())?;
+
+    G_LICENSE.lock().await.created_at = license.created_at;
+    G_LICENSE.lock().await.expired_at = license.expired_at;
+    G_LICENSE.lock().await.user_limit = license.user_limit;
+    G_LICENSE.lock().await.domains = license.domains;
+    G_LICENSE.lock().await.sign = license.sign;
+
+    Ok(())
+}
+
+/// inline always, Increase the difficulty of disassembly
+#[inline(always)]
+pub async fn check_license(state: &State, req: &Request) -> Result<()> {
+    if cfg!(test) && req.header("Referer").is_none() {
+        return Ok(());
+    }
+    let domain = get_referer_domain(req)
+        .ok_or_else(|| anyhow::anyhow!("License error: Referer is empty."))?;
+    let license_guard = G_LICENSE.lock().await;
+    let license = license_guard.deref();
+    if domain == "localhost" {
+        return Ok(());
+    }
+    if !license.domains.contains(&domain) && !license.domains.contains(&"*".to_string()) {
+        return Err(anyhow::anyhow!("License error: Domain incorrect."));
+    }
+    if license.expired_at < Utc::now() {
+        return Err(anyhow::anyhow!("License error: Expired."));
+    }
+    if vc_license::rsa_check_license(license, VOCE_LICENSE_PUBLIC_KEY_PEM).is_err() {
+        return Err(anyhow::anyhow!("License error: Sign invalid."));
+    }
+    let cache = state.cache.read().await;
+    if cache
+        .users
+        .iter()
+        .filter(|(_, user)| !user.is_guest)
+        .count()
+        > license.user_limit as usize
+    {
+        return Err(anyhow::anyhow!("License error: Users reached limit."));
+    }
+    Ok(())
+}
+
+#[macro_export]
+macro_rules! check_license_wrap {
+    ($($tt: expr),*) => {
+        $crate::license::check_license($($tt),*).await.map_err(|err| Error::from_string(err.to_string(), StatusCode::UNAVAILABLE_FOR_LEGAL_REASONS))?;
+    }
+}
+pub(crate) use check_license_wrap;
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 0000000..481fdc8
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,438 @@
+#![allow(clippy::large_enum_variant)]
+#![allow(clippy::uninlined_format_args)]
+
+mod api;
+mod api_key;
+mod config;
+mod create_user;
+mod license;
+mod middleware;
+mod self_signed;
+mod server;
+mod state;
+#[cfg(test)]
+mod test_harness;
+
+use std::{
+    fs::File,
+    io::Cursor,
+    path::{Path, PathBuf},
+    sync::Arc,
+    time::Duration,
+};
+
+use anyhow::Context;
+use clap::Parser;
+use futures_util::TryFutureExt;
+use poem::{
+    listener::{Listener, TcpListener},
+    EndpointExt, RouteScheme, Server,
+};
+use serde::Deserialize;
+use sqlx::SqlitePool;
+use tokio::runtime::Runtime;
+use tracing_subscriber::{fmt::Subscriber, util::SubscriberInitExt, EnvFilter};
+use zip::ZipArchive;
+
+use crate::{
+    config::{Config, TlsConfig},
+    state::State,
+};
+
+#[derive(Debug, Default, Deserialize)]
+struct EnvironmentVars {
+    data_dir: Option<PathBuf>,
+
+    fcm_project_id: String,
+    fcm_private_key: String,
+    fcm_client_email: String,
+    token_uri: String,
+}
+
+impl EnvironmentVars {
+    fn merge_to_config(self, mut config: Config) -> Config {
+        if let Some(data_dir) = self.data_dir {
+            config.system.data_dir = data_dir;
+        }
+
+        config.offical_fcm_config.project_id = self.fcm_project_id;
+        config.offical_fcm_config.private_key = self.fcm_private_key;
+        config.offical_fcm_config.client_email = self.fcm_client_email;
+        config.offical_fcm_config.token_uri = self.token_uri;
+
+        config
+    }
+}
+
+#[derive(Debug, Parser)]
+#[clap(name = "vocechat", author, version, about)]
+struct Options {
+    /// Path of the config file
+    #[clap(default_value = "config/config.toml")]
+    pub config: PathBuf,
+    /// Start a daemon in the background
+    #[cfg(not(windows))]
+    #[clap(long = "daemon")]
+    pub daemon: bool,
+    /// Create pid file, lock it exclusive and write daemon pid.
+    #[cfg(not(windows))]
+    #[clap(long = "pid.file")]
+    pub pid_file: Option<PathBuf>,
+    /// Standard output file of the daemon
+    #[clap(long = "stdout")]
+    pub stdout: Option<PathBuf>,
+    /// Server domain
+    #[clap(long = "network.domain")]
+    network_domain: Vec<String>,
+    /// Listener bind address
+    #[clap(long = "network.bind")]
+    network_bind: Option<String>,
+    /// Tls type (none, self_signed, certificate, acme_http_01,
+    /// acme_tls_alpn_01)
+    #[clap(long = "network.tls.type")]
+    network_tls_type: Option<String>,
+    /// Certificate file path
+    #[clap(long = "network.tls.cert")]
+    network_tls_cert_path: Option<String>,
+    /// Certificate key path
+    #[clap(long = "network.tls.key")]
+    network_tls_key_path: Option<String>,
+    /// Listener bind address for AcmeHTTP_01
+    #[clap(long = "network.tls.acme.http_bind")]
+    network_tls_acme_http_bind: Option<String>,
+    /// Frontend url
+    #[clap(long = "network.frontend_url")]
+    frontend_url: Option<String>,
+    /// Acme directory url
+    #[clap(
+        long = "network.tls.acme.directory_url",
+        default_value = "https://acme-v02.api.letsencrypt.org/directory"
+    )]
+    network_tls_acme_directory_url: String,
+    /// Cache path for certificates
+    #[clap(long = "network.tls.acme.cache_path")]
+    network_tls_acme_cache_path: Option<String>,
+}
+
+impl Options {
+    fn merge_to_config(self, mut config: Config) -> Config {
+        config.network.domain.extend(self.network_domain);
+        if let Some(network_bind) = self.network_bind {
+            config.network.bind = network_bind;
+        }
+
+        if let Some(network_tls_type) = self.network_tls_type {
+            match network_tls_type.as_str() {
+                "none" => config.network.tls = None,
+                "self_signed" => config.network.tls = Some(TlsConfig::SelfSigned),
+                "certificate" => match (self.network_tls_cert_path, self.network_tls_key_path) {
+                    (Some(cert_path), Some(key_path)) => {
+                        config.network.tls = Some(TlsConfig::Certificate {
+                            cert: None,
+                            cert_path: Some(cert_path),
+                            key: None,
+                            key_path: Some(key_path),
+                        });
+                    }
+                    (None, _) => {
+                        tracing::warn!("`network.tls.cert` is required");
+                    }
+                    (_, None) => {
+                        tracing::warn!("`network.tls.key` is required");
+                    }
+                },
+                "acme_http_01" => match self.network_tls_acme_http_bind {
+                    Some(http_bind) => {
+                        config.network.tls = Some(TlsConfig::AcmeHttp01 {
+                            http_bind,
+                            directory_url: Some(self.network_tls_acme_directory_url),
+                            cache_path: self.network_tls_acme_cache_path,
+                        });
+                    }
+                    None => {
+                        tracing::warn!("`network.tls.acme.http_bind` is required");
+                    }
+                },
+                "acme_tls_alpn_01" => {
+                    config.network.tls = Some(TlsConfig::AcmeTlsAlpn01 {
+                        directory_url: Some(self.network_tls_acme_directory_url),
+                        cache_path: self.network_tls_acme_cache_path,
+                    });
+                }
+                _ => {
+                    tracing::warn!(
+                        r#type = network_tls_type.as_str(),
+                        "unknown `network.tls.type`"
+                    );
+                }
+            }
+        }
+
+        if let Some(frontend_url) = self.frontend_url {
+            config.network.frontend_url = frontend_url;
+        }
+
+        config
+    }
+}
+
+fn init_tracing(with_ansi: bool) {
+    if std::env::var_os("RUST_LOG").is_none() {
+        std::env::set_var("RUST_LOG", "vocechat=debug,poem=debug");
+    }
+
+    let subscriber = Subscriber::builder()
+        .with_env_filter(EnvFilter::from_default_env())
+        .with_ansi(with_ansi)
+        .finish();
+    subscriber.try_init().unwrap();
+}
+
+fn load_config(path: &Path) -> anyhow::Result<Config> {
+    let data = std::fs::read(path)?;
+    Ok(toml::from_slice(&data)?)
+}
+
+fn main() {
+    let options: Options = Options::parse();
+
+    #[cfg(not(windows))]
+    if options.daemon {
+        use daemonize::Daemonize;
+
+        let mut daemon = Daemonize::new().working_directory(std::env::current_dir().unwrap());
+
+        if let Some(stdout_file) = &options.stdout {
+            match File::create(stdout_file) {
+                Ok(file) => {
+                    daemon = daemon.stdout(file);
+                }
+                Err(err) => {
+                    tracing::error!(
+                        path = %stdout_file.display(),
+                        error = %err,
+                        "failed to create file"
+                    );
+                }
+            }
+        }
+
+        if let Some(pid_file) = &options.pid_file {
+            daemon = daemon.pid_file(pid_file);
+        }
+
+        if let Err(err) = daemon.start() {
+            tracing::error!(error = %err, "failed to create daemon");
+            return;
+        }
+
+        init_tracing(false);
+    } else {
+        init_tracing(true);
+    }
+
+    #[cfg(windows)]
+    init_tracing(true);
+
+    Runtime::new().unwrap().block_on(async move {
+        // load config
+        tracing::info!(
+            current_dir = %std::env::current_dir().unwrap().display(),
+            path = %options.config.display(),
+            "load configuration file.",
+        );
+        let config_path = options.config.clone();
+        let config = Arc::new(match load_config(&config_path) {
+            Ok(config) => envy::prefixed("VOCECHAT_")
+                .from_env::<EnvironmentVars>()
+                .unwrap_or_default()
+                .merge_to_config(options.merge_to_config(config)),
+            Err(err) => {
+                tracing::error!(
+                    path = %config_path.display(),
+                    error = %err,
+                    "failed to load configuration file."
+                );
+                return;
+            }
+        });
+
+        let state = match server::create_state(config_path.parent().unwrap(), config.clone()).await
+        {
+            Ok(state) => state,
+            Err(err) => {
+                tracing::error!(
+                    error = %err,
+                    "failed to create server."
+                );
+                return;
+            }
+        };
+
+        let auto_cert = match &config.network.tls {
+            Some(tls) => match tls.create_auto_cert(&config.network.domain) {
+                Ok(auto_cert) => auto_cert,
+                Err(err) => {
+                    tracing::error!(
+                        error = %err,
+                        "failed to create auto certificate manager"
+                    );
+                    return;
+                }
+            },
+            None => None,
+        };
+
+        crate::license::load_license(&state).await.unwrap();
+
+        let app = match &config.network.tls {
+            Some(TlsConfig::AcmeHttp01 { .. }) => RouteScheme::new()
+                .https(server::create_endpoint(state.clone()).await)
+                .http(auto_cert.as_ref().unwrap().http_01_endpoint())
+                .boxed(),
+            _ => server::create_endpoint(state.clone()).await
+                .map_to_response()
+                .boxed(),
+        };
+
+        tokio::spawn({
+            let state = state.clone();
+            async move {
+                loop {
+                    tokio::time::sleep(Duration::from_secs(30)).await;
+                    state.magic_code_clean().await;
+                    state.clean_mute().await;
+                    state.sync_bot_key_last_used().await;
+
+                    tokio::task::spawn_blocking({
+                        let state = state.clone();
+                        move || {
+                            state.clean_temp_files();
+                            state.clean_files();
+                        }
+                    });
+                }
+            }
+        });
+
+        tokio::spawn({
+            let state = state.clone();
+            async move {
+                loop {
+                    state.clean_guest().await;
+                    tokio::time::sleep(Duration::from_secs(60 * 60 * 24)).await;
+                }
+            }
+        });
+
+        tokio::spawn({
+            let state = state.clone();
+            async move {
+                loop {
+                    update_webclient(&state).await;
+                    tokio::time::sleep(Duration::from_secs(60 * 5)).await;
+                }
+            }
+        });
+
+        let mut listener = TcpListener::bind(config.network.bind.to_string()).boxed();
+        if let Some(tls_config) = &config.network.tls {
+            listener = match tls_config.transform_listener(listener, auto_cert) {
+                Ok(listener) => listener,
+                Err(err) => {
+                    tracing::error!(error = %err, "failed to create listener");
+                    return;
+                }
+            };
+            if let TlsConfig::AcmeHttp01 { http_bind, .. } = &tls_config {
+                listener = listener
+                    .combine(TcpListener::bind(http_bind.clone()))
+                    .boxed();
+            }
+        }
+
+        Server::new(listener).run(app).await.unwrap();
+    });
+}
+
+async fn update_webclient(state: &State) {
+    let webclient_url = match &state.config.webclient_url {
+        Some(webclient_url) => webclient_url,
+        None => return,
+    };
+
+    let mut current_hash = None;
+
+    let wwwroot_dir = state.config.system.wwwroot_dir();
+    if wwwroot_dir.exists() {
+        current_hash = std::fs::read_to_string(wwwroot_dir.join(".hash")).ok();
+    }
+
+    let hash_url = format!("{}/web.vocechat.md5", webclient_url);
+    tracing::info!(url = hash_url.as_str(), "check web client md5");
+    let least_hash = match reqwest::get(&hash_url)
+        .and_then(|resp| async move { resp.error_for_status() })
+        .and_then(|resp| resp.text())
+        .await
+    {
+        Ok(hash) => hash,
+        Err(err) => {
+            tracing::error!(url = hash_url.as_str(), err = %err, "failed to download hash file");
+            return;
+        }
+    };
+
+    if current_hash.as_deref() == Some(least_hash.as_str()) {
+        tracing::info!("web client is up to date");
+        return;
+    }
+
+    let zip_url = format!("{}/web.vocechat.zip", webclient_url);
+    tracing::info!(url = zip_url.as_str(), "downloading web client");
+    let zip_data = match reqwest::get(&zip_url)
+        .and_then(|resp| async move { resp.error_for_status() })
+        .and_then(|resp| resp.bytes())
+        .await
+    {
+        Ok(zip_data) => zip_data,
+        Err(err) => {
+            tracing::error!(url = zip_url.as_str(), err = %err, "failed to download zip file");
+            return;
+        }
+    };
+
+    let temp_wwwroot_dir = state.config.system.temp_wwwroot_dir();
+    let _ = std::fs::remove_dir_all(&temp_wwwroot_dir);
+    let _ = std::fs::create_dir(&temp_wwwroot_dir);
+
+    tracing::info!("extract web client");
+    if let Err(err) = ZipArchive::new(Cursor::new(zip_data))
+        .context("failed to open zip archive")
+        .and_then(|mut archive| {
+            for i in 0..archive.len() {
+                let mut file = archive.by_index(i)?;
+                if let Some(path) = file.enclosed_name().map(|path| path.to_path_buf()) {
+                    if file.is_file() {
+                        let path = temp_wwwroot_dir.join(path);
+                        if let Some(parent) = path.parent() {
+                            let _ = std::fs::create_dir_all(parent);
+                        }
+                        std::io::copy(&mut file, &mut File::create(path)?)?;
+                    }
+                }
+            }
+            Ok(())
+        })
+        .and_then(|_| {
+            std::fs::write(temp_wwwroot_dir.join(".hash"), least_hash)
+                .context("failed to write hash file")
+        })
+    {
+        tracing::error!(err = %err, "failed to extract zip file");
+        return;
+    }
+
+    let _ = std::fs::remove_dir_all(&wwwroot_dir);
+    let _ = std::fs::rename(temp_wwwroot_dir, wwwroot_dir);
+    tracing::info!("web client updated");
+}
diff --git a/src/middleware.rs b/src/middleware.rs
new file mode 100644
index 0000000..74fa6be
--- /dev/null
+++ b/src/middleware.rs
@@ -0,0 +1,23 @@
+use poem::{http::StatusCode, Endpoint, EndpointExt, Error};
+use poem_openapi::{ApiExtractor, ExtractParamOptions};
+
+use crate::api::Token;
+
+pub fn guest_forbidden(ep: impl Endpoint) -> impl Endpoint {
+    ep.before(|req| async move {
+        let token = Token::from_request(
+            &req,
+            &mut Default::default(),
+            ExtractParamOptions {
+                name: "",
+                default_value: None,
+                explode: false,
+            },
+        )
+        .await?;
+        if token.is_guest {
+            return Err(Error::from_status(StatusCode::FORBIDDEN));
+        }
+        Ok(req)
+    })
+}
diff --git a/src/self_signed.rs b/src/self_signed.rs
new file mode 100644
index 0000000..0e3cbfd
--- /dev/null
+++ b/src/self_signed.rs
@@ -0,0 +1,42 @@
+use std::time::Duration;
+
+use futures_util::Stream;
+use poem::listener::{RustlsCertificate, RustlsConfig};
+use rcgen::{Certificate, CertificateParams, KeyPair, RcgenError, SanType};
+
+const CA_CERT: &str = include_str!("../cert/ca.crt");
+const CA_KEY: &str = include_str!("../cert/ca.key");
+
+fn create_certificate() -> Result<(String, String), RcgenError> {
+    let key = KeyPair::from_pem(CA_KEY)?;
+    let params = CertificateParams::from_ca_cert_pem(CA_CERT, key)?;
+    let ca_cert = Certificate::from_params(params)?;
+
+    let mut params = CertificateParams::default();
+    params
+        .subject_alt_names
+        .push(SanType::IpAddress("127.0.0.1".parse().unwrap()));
+    params
+        .subject_alt_names
+        .push(SanType::IpAddress("0.0.0.0".parse().unwrap()));
+    params
+        .subject_alt_names
+        .push(SanType::DnsName("localhost".to_string()));
+    let gen_cert = Certificate::from_params(params)?;
+
+    let server_crt = gen_cert.serialize_pem_with_signer(&ca_cert)?;
+    let server_key = gen_cert.serialize_private_key_pem();
+
+    Ok((server_crt, server_key))
+}
+
+pub fn create_self_signed_config() -> impl Stream<Item = RustlsConfig> {
+    async_stream::stream! {
+        loop {
+            if let Ok((cert, key)) = create_certificate() {
+                yield RustlsConfig::new().fallback(RustlsCertificate::new().cert(cert).key(key));
+            }
+            tokio::time::sleep(Duration::from_secs(60 * 5)).await;
+        }
+    }
+}
diff --git a/src/server.rs b/src/server.rs
new file mode 100644
index 0000000..ff593e5
--- /dev/null
+++ b/src/server.rs
@@ -0,0 +1,377 @@
+use std::{path::Path, sync::Arc};
+
+use anyhow::Result;
+use itertools::Itertools;
+use poem::{
+    middleware::{Cors, TokioMetrics, Tracing},
+    Endpoint, EndpointExt, Route,
+};
+use rc_msgdb::MsgDb;
+use sqlx::migrate::{MigrateDatabase, Migrator};
+use tokio::sync::{broadcast, mpsc, RwLock};
+
+use crate::{
+    api,
+    api::{
+        get_merged_message, AgoraConfig, FcmConfig, FrontendUrlConfig, LoginConfig,
+        OrganizationConfig, SmtpConfig,
+    },
+    config::{KeyConfig, TemplateConfig},
+    create_user::{CreateUser, CreateUserBy},
+    state::{
+        forward_chat_messages_to_webhook, BroadcastEvent, Cache, DynamicConfigEntry, Template,
+        Templates,
+    },
+    Config, SqlitePool, State,
+};
+
+pub static MIGRATOR: Migrator = sqlx::migrate!();
+
+pub fn create_random_str(len: usize) -> String {
+    String::from_utf8(
+        (0..len)
+            .map(|_| fastrand::alphanumeric() as u8)
+            .collect_vec(),
+    )
+    .unwrap()
+}
+
+pub async fn create_state(config_path: &Path, config: Arc<Config>) -> Result<State> {
+    // load key config
+    let mut key_config = None;
+    let key_config_path = config.system.data_dir.join("key.json");
+    if key_config_path.exists() {
+        if let Ok(data) = std::fs::read(&key_config_path) {
+            if let Ok(cfg) = serde_json::from_slice::<KeyConfig>(&data) {
+                key_config = Some(cfg);
+            }
+        }
+    }
+
+    std::fs::create_dir_all(&config.system.data_dir).expect("create data dir");
+
+    if key_config.is_none() {
+        let cfg = KeyConfig {
+            server_id: create_random_str(32),
+            server_key: create_random_str(32),
+            third_party_secret: create_random_str(32),
+        };
+        std::fs::write(&key_config_path, serde_json::to_vec(&cfg)?)?;
+        key_config = Some(cfg);
+    }
+    let key_config = key_config.unwrap();
+
+    std::fs::create_dir_all(config.system.tmp_dir()).expect("create tmp dir");
+    std::fs::create_dir_all(config.system.db_dir()).expect("create db dir");
+    std::fs::create_dir_all(config.system.msg_dir()).expect("create message dir");
+    std::fs::create_dir_all(config.system.thumbnail_dir()).expect("create thumbnails dir");
+    std::fs::create_dir_all(config.system.file_dir()).expect("create file dir");
+    std::fs::create_dir_all(config.system.avatar_dir()).expect("create avatars dir");
+    std::fs::create_dir_all(config.system.group_avatar_dir()).expect("create group avatars dir");
+
+    // open sqlite db
+    let dsn = format!("sqlite:{}", config.system.sqlite_filename().display());
+    if !config.system.sqlite_filename().exists() {
+        tracing::info!(dsn = dsn.as_str(), "create sqlite db.");
+        sqlx::Sqlite::create_database(&dsn).await?;
+    }
+
+    tracing::info!(dsn = dsn.as_str(), "open sqlite db.");
+    let db_pool = SqlitePool::connect(&dsn).await?;
+    MIGRATOR.run(&db_pool).await?;
+
+    // open message db
+    tracing::info!(
+        path = config.system.msg_dir().display().to_string().as_str(),
+        "open message db."
+    );
+    let msg_db = MsgDb::open(config.system.msg_dir())?;
+
+    let (groups, users) = futures_util::try_join!(
+        State::load_groups_cache(&msg_db, &db_pool),
+        State::load_users_cache(&db_pool),
+    )?;
+
+    // load templates
+    let templates = Templates {
+        register_by_email: load_template(config_path, config.template.register_by_email.as_ref())?,
+        login_by_email: load_template(config_path, config.template.login_by_email.as_ref())?,
+    };
+
+    let (msg_updated_tx, msg_updated_rx) = mpsc::unbounded_channel();
+
+    let state = State {
+        key_config: Arc::new(RwLock::new(key_config)),
+        config: config.clone(),
+        config_path: config_path.to_owned(),
+        db_pool,
+        msg_db: Arc::new(msg_db),
+        cache: Arc::new(RwLock::new(Cache {
+            dynamic_config: Default::default(),
+            groups,
+            users,
+            codes: Default::default(),
+        })),
+        event_sender: Arc::new(broadcast::channel(128).0),
+        templates: Arc::new(templates),
+        pending_oidc: Default::default(),
+        msg_updated_channel: Arc::new(msg_updated_tx),
+        invalid_device_tokens: Default::default(),
+    };
+
+    // load dynamic config
+    state
+        .initialize_dynamic_config::<OrganizationConfig>()
+        .await?;
+    state
+        .initialize_dynamic_config::<FrontendUrlConfig>()
+        .await?;
+    state.initialize_dynamic_config::<SmtpConfig>().await?;
+    state
+        .initialize_dynamic_config_with::<FcmConfig, _>(|| DynamicConfigEntry {
+            enabled: true,
+            config: FcmConfig {
+                use_official: true,
+                ..Default::default()
+            },
+        })
+        .await?;
+    state.initialize_dynamic_config::<AgoraConfig>().await?;
+    state.initialize_dynamic_config::<LoginConfig>().await?;
+
+    // create users
+    for user in &config.users {
+        let create_user = CreateUser::new(
+            &user.name,
+            CreateUserBy::Password {
+                email: &user.email,
+                password: &user.password,
+            },
+            false,
+        )
+        .gender(user.gender)
+        .set_admin(user.is_admin)
+        .language(&user.language);
+        let _ = state.create_user(create_user).await;
+    }
+
+    tokio::spawn(process_msg_updated(state.clone(), msg_updated_rx));
+    tokio::spawn(forward_chat_messages_to_webhook(state.clone()));
+    Ok(state)
+}
+
+async fn process_msg_updated(state: State, mut rx: mpsc::UnboundedReceiver<i64>) {
+    while let Some(mid) = rx.recv().await {
+        // process pinned messages
+        if let Ok(merged_msg) = get_merged_message(&state.msg_db, mid) {
+            let mut cache = state.cache.write().await;
+            let Cache { groups, users, .. } = &mut *cache;
+
+            for (gid, group) in groups {
+                if let Some((idx, pinned_msg)) = group
+                    .pinned_messages
+                    .iter_mut()
+                    .enumerate()
+                    .find(|(_, pinned_msg)| pinned_msg.mid == mid)
+                {
+                    let targets = if group.ty.is_public() {
+                        users.iter().map(|(uid, _)| *uid).collect()
+                    } else {
+                        group.members.clone()
+                    };
+
+                    match merged_msg {
+                        Some(merged_msg) => {
+                            // pinned message updated
+
+                            // update cache
+                            pinned_msg.content = merged_msg.content;
+
+                            // broadcast
+                            let _ = state.event_sender.send(Arc::new(
+                                BroadcastEvent::PinnedMessageUpdated {
+                                    targets,
+                                    gid: *gid,
+                                    mid,
+                                    msg: Some(pinned_msg.clone()),
+                                },
+                            ));
+                        }
+                        None => {
+                            // pinned message deleted
+
+                            // update cache
+                            group.pinned_messages.remove(idx);
+
+                            // update database
+                            if let Err(err) =
+                                sqlx::query("delete from pinned_message where gid = ? and mid = ?")
+                                    .bind(gid)
+                                    .bind(mid)
+                                    .execute(&state.db_pool)
+                                    .await
+                            {
+                                tracing::error!(
+                                    gid = gid,
+                                    mid = mid,
+                                    error = %err,
+                                    "failed to delete pinned message"
+                                );
+                            }
+
+                            // broadcast
+                            let _ = state.event_sender.send(Arc::new(
+                                BroadcastEvent::PinnedMessageUpdated {
+                                    targets,
+                                    gid: *gid,
+                                    mid,
+                                    msg: None,
+                                },
+                            ));
+                        }
+                    }
+                    break;
+                }
+            }
+        }
+    }
+}
+
+pub fn load_template(
+    config_path: &Path,
+    template_cfg: Option<&TemplateConfig>,
+) -> Result<Option<Template>> {
+    match template_cfg {
+        Some(cfg) => {
+            let file = config_path.join(&cfg.file);
+            tracing::info!(path = %file.display(), "load template");
+
+            let template = liquid::ParserBuilder::with_stdlib()
+                .build()
+                .unwrap()
+                .parse_file(file)?;
+            Ok(Some(Template {
+                subject: cfg.subject.clone(),
+                template,
+            }))
+        }
+        None => Ok(None),
+    }
+}
+
+pub async fn create_endpoint(state: State) -> impl Endpoint {
+    let mut api_service = state.config.network.domain.iter().fold(
+        api::create_api_service().server("http://localhost:3000/api"),
+        |acc, domain| acc.server(format!("https://{}/api", domain)),
+    );
+    let frontend_url = state
+        .get_dynamic_config_instance::<FrontendUrlConfig>()
+        .await
+        .and_then(|config| config.url.clone())
+        .or_else(|| {
+            if !state.config.network.frontend_url.is_empty() {
+                Some(state.config.network.frontend_url.clone())
+            } else {
+                None
+            }
+        });
+    if let Some(frontend_url) = frontend_url {
+        api_service = api_service.server(if frontend_url.ends_with('/') {
+            format!("{}api", frontend_url)
+        } else {
+            format!("{}/api", frontend_url)
+        });
+    };
+
+    let metrics = TokioMetrics::new();
+
+    Route::new()
+        .nest(
+            "/",
+            poem::endpoint::StaticFilesEndpoint::new(state.config.system.wwwroot_dir())
+                .index_file("index.html"),
+        )
+        .at("/health", poem::endpoint::make_sync(|_| ()))
+        .at("/metrics", metrics.exporter())
+        .nest("/api/doc", api_service.swagger_ui())
+        .nest("/api/doc2", api_service.rapidoc())
+        .nest("/api/swagger", api_service.swagger_ui())
+        .nest("/api/doc3", api_service.redoc())
+        .nest("/api/spec", api_service.spec_endpoint())
+        .nest("/api", api_service)
+        .with(Tracing)
+        .with(Cors::new().allow_credentials(true))
+        .with(metrics)
+        .inspect_err(|err: &sqlx::Error| {
+            tracing::error!(error = %err, "sqlite error");
+        })
+        .data(state)
+}
+
+#[cfg(test)]
+mod tests {
+    use poem::{
+        listener::{Acceptor, Listener, TcpListener},
+        Server,
+    };
+    use reqwest::{Certificate, StatusCode};
+
+    use super::*;
+    use crate::{
+        config::{NetworkConfig, SystemConfig, TlsConfig},
+        self_signed::create_self_signed_config,
+    };
+
+    #[tokio::test]
+    async fn test_tls_server() {
+        let tempdir = tempfile::TempDir::new().unwrap();
+        let config = Config {
+            system: SystemConfig {
+                data_dir: tempdir.path().to_path_buf(),
+                token_expiry_seconds: 60 * 60,
+                refresh_token_expiry_seconds: 60 * 60,
+                magic_token_expiry_seconds: 60 * 15,
+                upload_avatar_limit: 1024 * 1024,
+                send_image_limit: 1024 * 1024,
+                upload_timeout_seconds: 300,
+                file_expiry_days: 30 * 3,
+                max_favorite_archives: 100,
+            },
+            network: NetworkConfig {
+                domain: Vec::new(),
+                bind: "127.0.0.1:0".to_string(),
+                tls: Some(TlsConfig::SelfSigned),
+                frontend_url: "https://127.0.0.1:3000".to_string(),
+            },
+            template: Default::default(),
+            users: vec![],
+            webclient_url: None,
+            offical_fcm_config: Default::default(),
+        };
+        let state = create_state(tempdir.path(), Arc::new(config))
+            .await
+            .unwrap();
+        let ep = create_endpoint(state).await;
+        let acceptor = TcpListener::bind("127.0.0.1:0")
+            .rustls(create_self_signed_config())
+            .into_acceptor()
+            .await
+            .unwrap();
+        let addr = acceptor.local_addr().remove(0);
+        tokio::spawn(async move {
+            Server::new_with_acceptor(acceptor).run(ep).await.unwrap();
+        });
+        let port = addr.as_socket_addr().unwrap().port();
+
+        let client = reqwest::Client::builder()
+            .use_rustls_tls()
+            .add_root_certificate(Certificate::from_pem(include_bytes!("../cert/ca.crt")).unwrap())
+            .danger_accept_invalid_certs(true)
+            .no_proxy()
+            .build()
+            .unwrap();
+        let url = format!("https://localhost:{}/health", port);
+        let resp = client.get(url).send().await.unwrap();
+        assert_eq!(resp.status(), StatusCode::OK);
+    }
+}
diff --git a/src/state.rs b/src/state.rs
new file mode 100644
index 0000000..0f602f8
--- /dev/null
+++ b/src/state.rs
@@ -0,0 +1,1616 @@
+use std::{
+    any::Any,
+    borrow::Cow,
+    collections::{BTreeMap, BTreeSet, HashMap, HashSet},
+    path::{Path, PathBuf},
+    sync::Arc,
+    time::{Duration, SystemTime},
+};
+
+use chrono::{NaiveDate, Utc};
+use futures_util::{StreamExt, TryStreamExt};
+use itertools::Itertools;
+use num_enum::{FromPrimitive, IntoPrimitive};
+use openidconnect::{core::CoreClient, CsrfToken, Nonce, PkceCodeVerifier};
+use poem::{
+    error::{BadRequest, InternalServerError},
+    http::StatusCode,
+    Request,
+};
+use poem_openapi::{types::ToJSON, Enum};
+use rc_magic_link::MagicLinkToken;
+use rc_msgdb::MsgDb;
+use reqwest::Client;
+use serde::{de::DeserializeOwned, Serialize};
+use sqlx::SqlitePool;
+use tokio::sync::{broadcast, mpsc, Mutex, RwLock};
+use walkdir::WalkDir;
+
+use crate::{
+    api::{
+        get_merged_message, ChatMessage, DateTime, FrontendUrlConfig, Group, GroupChangedMessage,
+        KickFromGroupReason, KickReason, LangId, MessageDetail, PinnedMessage, SmtpConfig,
+        UpdateAction, User, UserDevice, UserInfo, UserSettingsChangedMessage,
+        UserStateChangedMessage, UserUpdateLog,
+    },
+    config::KeyConfig,
+    Config,
+};
+
+#[derive(Debug, Copy, Clone)]
+pub enum GroupType {
+    Public,
+    Private { owner: i64 },
+}
+
+impl GroupType {
+    pub fn is_public(&self) -> bool {
+        matches!(self, GroupType::Public)
+    }
+
+    pub fn owner(&self) -> Option<i64> {
+        match self {
+            GroupType::Public => None,
+            GroupType::Private { owner } => Some(*owner),
+        }
+    }
+}
+
+pub struct CacheGroup {
+    pub ty: GroupType,
+    pub name: String,
+    pub description: String,
+    pub members: BTreeSet<i64>,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+    pub avatar_updated_at: DateTime,
+    pub pinned_messages: Vec<PinnedMessage>,
+}
+
+impl CacheGroup {
+    pub fn contains_user(&self, uid: i64) -> bool {
+        self.ty.is_public() || self.members.contains(&uid)
+    }
+
+    pub fn description_opt(&self) -> Option<String> {
+        if !self.description.is_empty() {
+            Some(self.description.clone())
+        } else {
+            None
+        }
+    }
+
+    pub fn api_group(&self, gid: i64) -> Group {
+        Group {
+            gid,
+            owner: self.ty.owner(),
+            name: self.name.clone(),
+            description: self.description_opt(),
+            members: self.members.iter().copied().collect(),
+            is_public: self.ty.is_public(),
+            avatar_updated_at: self.avatar_updated_at,
+            pinned_messages: self.pinned_messages.clone(),
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct CacheDevice {
+    pub device_token: Option<String>,
+    pub sender: Option<mpsc::UnboundedSender<UserEvent>>,
+}
+
+#[derive(Debug, Copy, Clone, FromPrimitive, IntoPrimitive, Enum, Eq, PartialEq)]
+#[oai(rename_all = "lowercase")]
+#[repr(i8)]
+pub enum UserStatus {
+    Normal = 0,
+    #[num_enum(default)]
+    Frozen = -1,
+}
+
+#[derive(Debug)]
+pub struct BotKey {
+    pub name: String,
+    pub key: String,
+    pub created_at: DateTime,
+    pub last_used: Option<DateTime>,
+}
+
+#[derive(Debug)]
+pub struct CacheUser {
+    pub email: Option<String>,
+    pub name: String,
+    pub password: Option<String>,
+    pub gender: i32,
+    pub is_admin: bool,
+    pub language: LangId,
+    pub create_by: String,
+    pub devices: HashMap<String, CacheDevice>,
+    pub mute_user: HashMap<i64, Option<DateTime>>,
+    pub mute_group: HashMap<i64, Option<DateTime>>,
+    pub burn_after_reading_user: HashMap<i64, i64>,
+    pub burn_after_reading_group: HashMap<i64, i64>,
+    pub read_index_user: HashMap<i64, i64>,
+    pub read_index_group: HashMap<i64, i64>,
+    pub created_at: DateTime,
+    pub updated_at: DateTime,
+    pub avatar_updated_at: DateTime,
+    pub status: UserStatus,
+    pub is_guest: bool,
+    pub webhook_url: Option<String>,
+    pub is_bot: bool,
+    pub bot_keys: HashMap<i64, BotKey>,
+}
+
+impl CacheUser {
+    pub fn is_online(&self) -> bool {
+        self.devices.values().any(|device| device.sender.is_some())
+    }
+
+    pub fn api_user_info(&self, uid: i64) -> UserInfo {
+        UserInfo {
+            uid,
+            email: self.email.clone(),
+            name: self.name.clone(),
+            gender: self.gender,
+            language: self.language.clone(),
+            is_admin: self.is_admin,
+            is_bot: self.is_bot,
+            avatar_updated_at: self.avatar_updated_at,
+            create_by: self.create_by.clone(),
+        }
+    }
+
+    pub fn api_user(&self, uid: i64) -> User {
+        User {
+            uid,
+            email: self.email.clone(),
+            password: Default::default(),
+            name: self.name.clone(),
+            gender: self.gender,
+            is_admin: self.is_admin,
+            language: self.language.clone(),
+            create_by: self.create_by.clone(),
+            in_online: self.is_online(),
+            online_devices: self
+                .devices
+                .iter()
+                .map(|(device, cached_device)| UserDevice {
+                    device: device.clone(),
+                    device_token: cached_device.device_token.clone(),
+                    is_online: cached_device.sender.is_some(),
+                })
+                .collect(),
+            created_at: self.created_at,
+            updated_at: self.updated_at,
+            avatar_updated_at: self.avatar_updated_at,
+            status: self.status,
+            webhook_url: self.webhook_url.clone(),
+            is_bot: self.is_bot,
+        }
+    }
+
+    pub fn is_user_muted(&self, uid: i64) -> bool {
+        let now = DateTime::now();
+        match self.mute_user.get(&uid) {
+            Some(Some(expired_at)) if expired_at.0 < now.0 => true,
+            Some(None) => true,
+            _ => false,
+        }
+    }
+
+    pub fn is_group_muted(&self, gid: i64) -> bool {
+        let now = DateTime::now();
+        match self.mute_group.get(&gid) {
+            Some(Some(expired_at)) if expired_at.0 < now.0 => true,
+            Some(None) => true,
+            _ => false,
+        }
+    }
+
+    pub fn burn_after_reading_to_user_expires_in(&self, uid: i64) -> Option<i64> {
+        self.burn_after_reading_user.get(&uid).copied()
+    }
+
+    pub fn burn_after_reading_to_group_expires_in(&self, gid: i64) -> Option<i64> {
+        self.burn_after_reading_group.get(&gid).copied()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub enum BroadcastEvent {
+    /// Chat message
+    Chat {
+        targets: BTreeSet<i64>,
+        message: ChatMessage,
+    },
+    /// Users update log
+    UserLog(UserUpdateLog),
+    /// Other users joined group
+    UserJoinedGroup {
+        targets: BTreeSet<i64>,
+        gid: i64,
+        uid: Vec<i64>,
+    },
+    /// Other users leaved group
+    UserLeavedGroup {
+        targets: BTreeSet<i64>,
+        gid: i64,
+        uid: Vec<i64>,
+    },
+    /// Join the group
+    JoinedGroup {
+        targets: BTreeSet<i64>,
+        group: Group,
+    },
+    /// Kick from group
+    KickFromGroup {
+        targets: BTreeSet<i64>,
+        gid: i64,
+        reason: KickFromGroupReason,
+    },
+    /// User state changed
+    UserStateChanged(UserStateChangedMessage),
+    /// User settings changed
+    UserSettingsChanged {
+        uid: i64,
+        message: UserSettingsChangedMessage,
+    },
+    /// Group changed
+    GroupChanged {
+        targets: BTreeSet<i64>,
+        msg: GroupChangedMessage,
+    },
+    /// Pinned message updated
+    PinnedMessageUpdated {
+        targets: BTreeSet<i64>,
+        gid: i64,
+        mid: i64,
+        msg: Option<PinnedMessage>,
+    },
+}
+
+#[derive(Debug, Clone)]
+pub enum UserEvent {
+    /// Kick by other device
+    Kick { reason: KickReason },
+}
+
+pub struct CodeValue {
+    remain_times: i32,
+    expired_at: chrono::DateTime<Utc>,
+    email: String,
+}
+
+#[derive(Default)]
+pub struct CodeCache {
+    // All sent codes, gc in tokio::spawn()
+    pub codes: HashMap<String, CodeValue>,
+    // Last code sent to email
+    // HashMap<email, code>
+    pub email_code: HashMap<String, String>,
+}
+
+#[derive(Default)]
+pub struct Cache {
+    pub dynamic_config: HashMap<&'static str, Box<dyn Any + Send + Sync>>,
+    pub groups: BTreeMap<i64, CacheGroup>,
+    pub users: BTreeMap<i64, CacheUser>,
+    pub codes: CodeCache,
+}
+
+impl Cache {
+    fn assign_username_by_name<'a>(&self, name: &'a str) -> Cow<'a, str> {
+        if self.check_name_conflict(name) {
+            return Cow::Borrowed(name);
+        }
+
+        loop {
+            let new_name = format!("{}{}", name, fastrand::u32(1111..9999));
+            if self.check_name_conflict(&new_name) {
+                break Cow::Owned(new_name);
+            }
+        }
+    }
+
+    fn assign_username_by_email<'a>(&self, email: &'a str) -> Cow<'a, str> {
+        match email.find('@') {
+            Some(idx) if idx > 0 => self.assign_username_by_name(&email[..idx]),
+            _ => self.assign_username_by_name(email),
+        }
+    }
+
+    pub fn assign_username<'a>(
+        &self,
+        name: Option<&'a str>,
+        email: Option<&'a str>,
+    ) -> Cow<'a, str> {
+        if let Some(name) = name {
+            self.assign_username_by_name(name)
+        } else if let Some(email) = email {
+            self.assign_username_by_email(email)
+        } else {
+            loop {
+                let new_name = format!("User{}", fastrand::u32(111111..999999));
+                if self.check_name_conflict(&new_name) {
+                    break Cow::Owned(new_name);
+                }
+            }
+        }
+    }
+
+    pub fn check_name_conflict(&self, name: &str) -> bool {
+        !self
+            .users
+            .values()
+            .any(|user| user.name.eq_ignore_ascii_case(name))
+    }
+
+    pub fn check_email_conflict(&self, email: &str) -> bool {
+        !self.users.values().any(|user| {
+            if let Some(user_email) = &user.email {
+                user_email.eq_ignore_ascii_case(email)
+            } else {
+                false
+            }
+        })
+    }
+}
+
+pub struct Template {
+    pub subject: String,
+    pub template: liquid::Template,
+}
+
+#[derive(Default)]
+pub struct Templates {
+    pub register_by_email: Option<Template>,
+    pub login_by_email: Option<Template>,
+}
+
+pub struct OAuth2State {
+    pub client: CoreClient,
+    pub issuer: String,
+    pub pkce_verifier: PkceCodeVerifier,
+    pub csrf_token: CsrfToken,
+    pub nonce: Nonce,
+}
+
+pub trait DynamicConfig: Serialize + DeserializeOwned + Default {
+    type Instance: Send + Sync + 'static;
+
+    fn name() -> &'static str;
+
+    fn create_instance(self, config: &Config) -> Self::Instance;
+}
+
+pub struct DynamicConfigEntry<T: DynamicConfig> {
+    pub enabled: bool,
+    pub config: T,
+}
+
+#[derive(Clone)]
+pub struct State {
+    pub key_config: Arc<RwLock<KeyConfig>>,
+    pub config: Arc<Config>,
+    pub config_path: PathBuf,
+    pub db_pool: SqlitePool,
+    pub msg_db: Arc<MsgDb>,
+    pub cache: Arc<RwLock<Cache>>,
+    pub event_sender: Arc<broadcast::Sender<Arc<BroadcastEvent>>>,
+    pub templates: Arc<Templates>,
+    pub pending_oidc: Arc<Mutex<HashMap<String, OAuth2State>>>,
+    pub msg_updated_channel: Arc<mpsc::UnboundedSender<i64>>,
+    pub invalid_device_tokens: Arc<parking_lot::Mutex<HashSet<String>>>,
+}
+
+impl State {
+    pub async fn load_users_cache(db: &SqlitePool) -> sqlx::Result<BTreeMap<i64, CacheUser>> {
+        let mut users = BTreeMap::new();
+        let sql = "select uid, email, name, password, gender, is_admin, language, create_by, created_at, updated_at, avatar_updated_at, status, is_guest, webhook_url, is_bot from user";
+        let mut stream = sqlx::query_as::<
+            _,
+            (
+                i64,
+                Option<String>,
+                String,
+                Option<String>,
+                i32,
+                bool,
+                LangId,
+                String,
+                DateTime,
+                DateTime,
+                DateTime,
+                i8,
+                bool,
+                Option<String>,
+                bool,
+            ),
+        >(sql)
+        .fetch(db);
+        while let Some(res) = stream.next().await {
+            let (
+                uid,
+                email,
+                name,
+                password,
+                gender,
+                is_admin,
+                language,
+                create_by,
+                created_at,
+                updated_at,
+                avatar_updated_at,
+                status,
+                is_guest,
+                webhook_url,
+                is_bot,
+            ) = res?;
+
+            let devices = sqlx::query_as::<_, (String, Option<String>)>(
+                "select device, device_token from device where uid = ?",
+            )
+            .bind(uid)
+            .fetch_all(db)
+            .await?;
+            let devices = devices
+                .into_iter()
+                .map(|(device, device_token)| {
+                    (
+                        device,
+                        CacheDevice {
+                            device_token,
+                            sender: None,
+                        },
+                    )
+                })
+                .collect();
+
+            let sql = "select mute_uid, mute_gid, expired_at from mute where uid = ?";
+            let mute = sqlx::query_as::<_, (Option<i64>, Option<i64>, Option<DateTime>)>(sql)
+                .bind(uid)
+                .fetch_all(db)
+                .await?;
+            let mut mute_user = HashMap::new();
+            let mut mute_group = HashMap::new();
+            for (uid, gid, expired_at) in mute {
+                match (uid, gid) {
+                    (Some(uid), None) => {
+                        mute_user.insert(uid, expired_at);
+                    }
+                    (None, Some(gid)) => {
+                        mute_group.insert(gid, expired_at);
+                    }
+                    _ => {}
+                }
+            }
+
+            let sql =
+                "select target_uid, target_gid, expires_in from burn_after_reading where uid = ?";
+            let burn_after_reading = sqlx::query_as::<_, (Option<i64>, Option<i64>, i64)>(sql)
+                .bind(uid)
+                .fetch_all(db)
+                .await?;
+            let mut burn_after_reading_user = HashMap::new();
+            let mut burn_after_reading_group = HashMap::new();
+            for (uid, gid, expires_in) in burn_after_reading {
+                match (uid, gid) {
+                    (Some(uid), None) => {
+                        burn_after_reading_user.insert(uid, expires_in);
+                    }
+                    (None, Some(gid)) => {
+                        burn_after_reading_group.insert(gid, expires_in);
+                    }
+                    _ => {}
+                }
+            }
+
+            let sql = "select target_uid, target_gid, mid from read_index where uid = ?";
+            let read_index = sqlx::query_as::<_, (Option<i64>, Option<i64>, i64)>(sql)
+                .bind(uid)
+                .fetch_all(db)
+                .await?;
+            let mut read_index_user = HashMap::new();
+            let mut read_index_group = HashMap::new();
+            for (uid, gid, mid) in read_index {
+                match (uid, gid) {
+                    (Some(uid), None) => {
+                        read_index_user.insert(uid, mid);
+                    }
+                    (None, Some(gid)) => {
+                        read_index_group.insert(gid, mid);
+                    }
+                    _ => {}
+                }
+            }
+
+            let sql = "select id, name, key, created_at, last_used from `bot_key` where uid = ?";
+            let bot_keys =
+                sqlx::query_as::<_, (i64, String, String, DateTime, Option<DateTime>)>(sql)
+                    .bind(uid)
+                    .fetch(db)
+                    .map_ok(|(id, name, key, created_at, last_used)| {
+                        (
+                            id,
+                            BotKey {
+                                name,
+                                key,
+                                created_at,
+                                last_used,
+                            },
+                        )
+                    })
+                    .try_collect()
+                    .await?;
+
+            users.insert(
+                uid,
+                CacheUser {
+                    email,
+                    name,
+                    password,
+                    gender,
+                    is_admin,
+                    language,
+                    create_by,
+                    devices,
+                    mute_user,
+                    mute_group,
+                    burn_after_reading_user,
+                    burn_after_reading_group,
+                    read_index_user,
+                    read_index_group,
+                    created_at,
+                    updated_at,
+                    avatar_updated_at,
+                    status: status.into(),
+                    is_guest,
+                    webhook_url,
+                    is_bot,
+                    bot_keys,
+                },
+            );
+        }
+
+        Ok(users)
+    }
+
+    pub async fn load_groups_cache(
+        msg_db: &MsgDb,
+        db: &SqlitePool,
+    ) -> sqlx::Result<BTreeMap<i64, CacheGroup>> {
+        let mut groups = BTreeMap::new();
+
+        let sql =
+            "select gid, name, description, owner, is_public, created_at, updated_at, avatar_updated_at from `group`";
+        let mut stream = sqlx::query_as::<
+            _,
+            (
+                i64,
+                String,
+                String,
+                Option<i64>,
+                bool,
+                DateTime,
+                DateTime,
+                DateTime,
+            ),
+        >(sql)
+        .fetch(db);
+        while let Some(res) = stream.next().await {
+            // load pinned messages
+            let sql = "select mid, created_by, created_at from pinned_message where gid = ?";
+            let ids = sqlx::query_as::<_, (i64, i64, DateTime)>(sql)
+                .fetch_all(db)
+                .await?;
+            let mut pinned_messages = Vec::new();
+
+            for (mid, created_by, created_at) in ids {
+                if let Some(merged_msg) = get_merged_message(msg_db, mid).ok().flatten() {
+                    pinned_messages.push(PinnedMessage {
+                        mid,
+                        created_by,
+                        created_at,
+                        content: merged_msg.content,
+                    });
+                }
+            }
+
+            pinned_messages.sort_by(|a, b| a.created_at.cmp(&b.created_at));
+
+            let (
+                gid,
+                name,
+                description,
+                owner,
+                is_public,
+                created_at,
+                updated_at,
+                avatar_updated_at,
+            ) = res?;
+            groups.insert(
+                gid,
+                CacheGroup {
+                    ty: if is_public {
+                        GroupType::Public
+                    } else {
+                        GroupType::Private {
+                            owner: owner.unwrap(),
+                        }
+                    },
+                    name,
+                    description,
+                    members: Default::default(),
+                    created_at,
+                    updated_at,
+                    avatar_updated_at,
+                    pinned_messages,
+                },
+            );
+        }
+
+        let mut stream =
+            sqlx::query_as::<_, (i64, i64)>("select gid, uid from group_user").fetch(db);
+        while let Some(res) = stream.next().await {
+            let (gid, uid) = res?;
+            if let Some(conv) = groups.get_mut(&gid) {
+                conv.members.insert(uid);
+            }
+        }
+
+        Ok(groups)
+    }
+
+    pub async fn send_login_magic_link(
+        &self,
+        code: &str,
+        url: &str,
+        expired_at: chrono::DateTime<Utc>,
+        email: &str,
+    ) -> poem::Result<String> {
+        let template = self
+            .templates
+            .login_by_email
+            .as_ref()
+            .ok_or_else(|| poem::Error::from_status(StatusCode::FORBIDDEN))?;
+
+        let uid = {
+            let cache = self.cache.read().await;
+            cache
+                .users
+                .iter()
+                .find(|(_, user)| user.email.as_deref() == Some(email))
+                .map(|(uid, _)| *uid)
+        };
+
+        self.login_magic_code_add(code, email, expired_at, 1).await;
+        // if !self.magic_code_check_code(code, &email).await {
+        //     return Err(poem::Error::from_status(StatusCode::BAD_REQUEST));
+        // }
+
+        let magic_token = MagicLinkToken::gen_login_magic_token(
+            code,
+            &self.key_config.read().await.server_key,
+            expired_at,
+            email,
+            uid,
+        );
+
+        let content = template
+            .template
+            .render(&liquid::object!({
+                "magic_token": &magic_token,
+                "email": email,
+                "url": url,
+                "exists": if uid.is_some() { "true" } else { "false" },
+            }))
+            .map_err(InternalServerError)?;
+
+        tokio::spawn({
+            let state = self.clone();
+            let subject = template.subject.clone();
+            let email = email.to_string();
+            async move {
+                let smtp_config = state.get_dynamic_config_instance::<SmtpConfig>().await;
+                if let Some(smtp_config) = smtp_config {
+                    if let Err(err) = send_mail(&smtp_config, email, subject, content).await {
+                        tracing::error!(error = %err, "failed to send mail");
+                    }
+                }
+            }
+        });
+
+        Ok(magic_token)
+    }
+
+    pub async fn magic_code_check_code(&self, code: &str) -> bool {
+        let mut cache = self.cache.write().await;
+        if let Some(v) = cache.codes.codes.get_mut(code) {
+            if v.expired_at < Utc::now() || v.remain_times <= 0 {
+                cache.codes.codes.remove(code);
+                false
+            } else {
+                v.remain_times -= -1;
+                true
+            }
+        } else {
+            false
+        }
+    }
+
+    // pub async fn magic_code_check_email(&self, email: &str, code: &code) -> bool{
+    //     let mut cache = self.cache.write().await;
+    //     if let Some(code) = cache.codes.email_code.get(email) {
+    //         if let Some((remain_times, expired_at, email2)) =
+    // cache.codes.codes.get_mut(code) {             // if !email2.is_empty() &&
+    // email2.as_str() != email {             //     return false;
+    //             // }
+    //             if *expired_at < Utc::now() || *remain_times <= 0 {
+    //                 cache.codes.codes.remove(code);
+    //                 false
+    //             } else {
+    //                 *remain_times -= -1;
+    //                 *email2 = email.to_string();
+    //                 cache
+    //                     .codes
+    //                     .email_code
+    //                     .insert(email.to_string(), code.to_string());
+    //                 true
+    //             }
+    //         } else {
+    //             false
+    //         }
+    //     }
+    //
+    // }
+
+    pub async fn reg_magic_code_add(
+        &self,
+        code: &str,
+        expired_at: chrono::DateTime<Utc>,
+        max_times: i32,
+    ) {
+        let mut cache = self.cache.write().await;
+        cache.codes.codes.insert(
+            code.to_string(),
+            CodeValue {
+                remain_times: max_times,
+                expired_at,
+                email: "".to_string(),
+            },
+        );
+    }
+
+    pub async fn login_magic_code_add(
+        &self,
+        code: &str,
+        email: &str,
+        expired_at: chrono::DateTime<Utc>,
+        max_times: i32,
+    ) {
+        let mut cache = self.cache.write().await;
+        // delete last code, avoid memory leak.
+        if let Some(last_code) = cache
+            .codes
+            .email_code
+            .insert(email.to_string(), code.to_string())
+        {
+            cache.codes.codes.remove(&last_code);
+        }
+        cache.codes.codes.insert(
+            code.to_string(),
+            CodeValue {
+                remain_times: max_times,
+                expired_at,
+                email: email.to_string(),
+            },
+        );
+    }
+
+    pub async fn login_magic_code_remove(&self, code: &str) {
+        let mut cache = self.cache.write().await;
+        if let Some(v) = cache.codes.codes.remove(code) {
+            cache.codes.email_code.remove(&v.email);
+        }
+    }
+
+    pub async fn magic_code_clean(&self) {
+        let mut cache = self.cache.write().await;
+
+        let expired_emails = cache
+            .codes
+            .codes
+            .iter()
+            .filter(|&(_k, v)| v.expired_at < Utc::now() || v.remain_times <= 0)
+            .map(|(_k, v)| v.email.to_string())
+            .collect::<Vec<_>>();
+        for email in &expired_emails {
+            cache.codes.email_code.remove(email);
+        }
+        cache
+            .codes
+            .codes
+            .retain(|_, v| v.expired_at >= Utc::now() && v.remain_times > 0);
+    }
+
+    pub async fn clean_mute(&self) {
+        let now = DateTime::now();
+
+        // clean in sqlite
+        if let Err(err) =
+            sqlx::query("delete from mute where expired_at notnull and expired_at < ?")
+                .bind(now)
+                .execute(&self.db_pool)
+                .await
+        {
+            tracing::error!(error = %err, "failed to query expired mute items");
+        }
+
+        // clean in cache
+        let mut cache = self.cache.write().await;
+        let mut uid_list = Vec::new();
+        let mut gid_list = Vec::new();
+
+        for user in cache.users.values_mut() {
+            uid_list.clear();
+            gid_list.clear();
+
+            for (uid, expired_at) in user.mute_user.iter() {
+                if matches!(expired_at, Some(expired_at) if expired_at < &now) {
+                    uid_list.push(*uid);
+                }
+            }
+
+            for (gid, expired_at) in user.mute_group.iter() {
+                if matches!(expired_at, Some(expired_at) if expired_at < &now) {
+                    gid_list.push(*gid);
+                }
+            }
+
+            for uid in &uid_list {
+                user.mute_user.remove(uid);
+            }
+            for gid in &gid_list {
+                user.mute_group.remove(gid);
+            }
+        }
+    }
+
+    pub async fn sync_bot_key_last_used(&self) {
+        async fn internal_sync_bot_key_last_used(state: &State) -> anyhow::Result<()> {
+            let cache = state.cache.read().await;
+            let mut tx = state.db_pool.begin().await?;
+
+            for user in cache.users.values() {
+                for (id, bot_key) in &user.bot_keys {
+                    sqlx::query("update `bot_key` set last_used = ? where id = ?")
+                        .bind(bot_key.last_used)
+                        .bind(id)
+                        .execute(&mut tx)
+                        .await?;
+                }
+            }
+
+            tx.commit().await?;
+            Ok(())
+        }
+
+        if let Err(err) = internal_sync_bot_key_last_used(self).await {
+            tracing::error!(error = %err, "failed to write last used of bot key");
+        }
+    }
+
+    pub fn clean_temp_files(&self) {
+        let now = SystemTime::now();
+        let timeout_dur = Duration::from_secs(self.config.system.upload_timeout_seconds as u64);
+
+        if let Ok(file_list) = self.config.system.tmp_dir().read_dir() {
+            for entry in file_list.flatten() {
+                let path = entry.path();
+                if path.extension().and_then(|ext| ext.to_str()) == Some("data") {
+                    let mut remove = false;
+
+                    if let Ok(modified) = path.metadata().and_then(|md| md.modified()) {
+                        remove = now > modified + timeout_dur;
+                    }
+
+                    if remove {
+                        let _ = std::fs::remove_file(&path);
+                        let _ = std::fs::remove_file(path.with_extension("meta"));
+                    }
+                }
+            }
+        }
+    }
+
+    pub fn clean_files(&self) {
+        let now = Utc::now().date_naive();
+        clean_file_dir(
+            now,
+            &self.config.system.thumbnail_dir(),
+            self.config.system.file_expiry_days,
+        );
+        clean_file_dir(
+            now,
+            &self.config.system.file_dir(),
+            self.config.system.file_expiry_days,
+        );
+        clean_file_dir(
+            now,
+            &self.config.system.archive_msg_dir(),
+            self.config.system.file_expiry_days,
+        );
+    }
+
+    pub fn save_avatar(&self, uid: i64, data: &[u8]) -> poem::Result<()> {
+        let image = image::load_from_memory(data).map_err(BadRequest)?;
+        let avatar = image.thumbnail(256, 256);
+        let path = self.config.system.avatar_dir().join(format!("{}.png", uid));
+        avatar
+            .save_with_format(path, image::ImageFormat::Png)
+            .map_err(InternalServerError)?;
+        Ok(())
+    }
+
+    pub fn save_group_avatar(&self, gid: i64, data: &[u8]) -> poem::Result<()> {
+        let image = image::load_from_memory(data).map_err(BadRequest)?;
+        let avatar = image.thumbnail(256, 256);
+        let path = self
+            .config
+            .system
+            .group_avatar_dir()
+            .join(format!("{}.png", gid));
+        avatar
+            .save_with_format(path, image::ImageFormat::Png)
+            .map_err(InternalServerError)?;
+        Ok(())
+    }
+
+    pub async fn load_dynamic_config<T: DynamicConfig>(
+        &self,
+    ) -> anyhow::Result<DynamicConfigEntry<T>> {
+        self.load_dynamic_config_with(|| DynamicConfigEntry {
+            enabled: false,
+            config: T::default(),
+        })
+        .await
+    }
+
+    pub async fn load_dynamic_config_with<T, F>(
+        &self,
+        f: F,
+    ) -> anyhow::Result<DynamicConfigEntry<T>>
+    where
+        T: DynamicConfig,
+        F: FnOnce() -> DynamicConfigEntry<T>,
+    {
+        let sql = "select enabled, value from config where name = ?";
+        match sqlx::query_as::<_, (bool, String)>(sql)
+            .bind(T::name())
+            .fetch_optional(&self.db_pool)
+            .await?
+        {
+            Some((enabled, value)) => Ok(DynamicConfigEntry {
+                enabled,
+                config: serde_json::from_str(&value)?,
+            }),
+            None => Ok(f()),
+        }
+    }
+
+    pub async fn set_dynamic_config<T: DynamicConfig>(
+        &self,
+        entry: DynamicConfigEntry<T>,
+    ) -> anyhow::Result<()> {
+        let sql = r#"
+        insert into config (name, enabled, value) values (?, ?, ?)
+            on conflict (name) do update set enabled = excluded.enabled, value = excluded.value
+        "#;
+        sqlx::query(sql)
+            .bind(T::name())
+            .bind(entry.enabled)
+            .bind(serde_json::to_string(&entry.config)?)
+            .execute(&self.db_pool)
+            .await?;
+
+        if entry.enabled {
+            let instance = entry.config.create_instance(&self.config);
+            self.cache
+                .write()
+                .await
+                .dynamic_config
+                .insert(T::name(), Box::new(Arc::new(instance)));
+        } else {
+            self.cache.write().await.dynamic_config.remove(T::name());
+        }
+
+        Ok(())
+    }
+
+    pub async fn initialize_dynamic_config<T>(&self) -> anyhow::Result<()>
+    where
+        T: DynamicConfig,
+    {
+        self.initialize_dynamic_config_with(|| DynamicConfigEntry {
+            enabled: false,
+            config: T::default(),
+        })
+        .await
+    }
+
+    pub async fn initialize_dynamic_config_with<T, F>(&self, f: F) -> anyhow::Result<()>
+    where
+        T: DynamicConfig,
+        F: FnOnce() -> DynamicConfigEntry<T>,
+    {
+        let entry = self.load_dynamic_config_with::<T, _>(f).await?;
+        if entry.enabled {
+            let instance = entry.config.create_instance(&self.config);
+            self.cache
+                .write()
+                .await
+                .dynamic_config
+                .insert(T::name(), Box::new(Arc::new(instance)));
+        }
+        Ok(())
+    }
+
+    pub async fn get_dynamic_config_instance<T: DynamicConfig>(&self) -> Option<Arc<T::Instance>> {
+        self.cache
+            .read()
+            .await
+            .dynamic_config
+            .get(T::name())
+            .and_then(|instance| {
+                instance
+                    .downcast_ref::<Arc<T::Instance>>()
+                    .map(Clone::clone)
+            })
+    }
+
+    pub async fn clean_guest(&self) {
+        if let Ok(users) = sqlx::query_as::<_, (i64,)>(
+            "select uid from user where is_guest = true and datetime('now', '-7 days') >= created_at",
+        )
+        .fetch_all::<_>(&self.db_pool)
+        .await
+        {
+            for (uid,) in users {
+                let _ = self.delete_user(uid).await;
+            }
+        }
+    }
+
+    pub async fn delete_user(&self, uid: i64) -> poem::Result<()> {
+        let mut cache = self.cache.write().await;
+        let is_guest = match cache.users.get(&uid) {
+            Some(user) => user.is_guest,
+            None => return Err(poem::Error::from(StatusCode::NOT_FOUND)),
+        };
+
+        // begin transaction
+        let mut tx = self.db_pool.begin().await.map_err(InternalServerError)?;
+
+        // delete from user table
+        sqlx::query("delete from user where uid = ?")
+            .bind(uid)
+            .execute(&mut tx)
+            .await
+            .map_err(InternalServerError)?;
+
+        let log_id = if !is_guest {
+            // insert into user_log table
+            let log_id = sqlx::query("insert into user_log (uid, action) values (?, ?)")
+                .bind(uid)
+                .bind(UpdateAction::Delete)
+                .execute(&mut tx)
+                .await
+                .map_err(InternalServerError)?
+                .last_insert_rowid();
+            Some(log_id)
+        } else {
+            None
+        };
+
+        // commit transaction
+        tx.commit().await.map_err(InternalServerError)?;
+
+        // update cache
+        if let Some(cached_user) = cache.users.remove(&uid) {
+            // close all subscriptions
+            for device in cached_user.devices.into_values() {
+                if let Some(sender) = device.sender {
+                    let _ = sender.send(UserEvent::Kick {
+                        reason: KickReason::DeleteUser,
+                    });
+                }
+            }
+        }
+
+        let mut removed_groups_id = Vec::new();
+        let mut removed_groups = Vec::new();
+        let mut exit_from_private_group = Vec::new();
+        let mut exit_from_public_group = Vec::new();
+
+        for (gid, group) in cache.groups.iter_mut() {
+            match group.ty {
+                GroupType::Public => {
+                    exit_from_public_group.push(*gid);
+                }
+                GroupType::Private { owner } if owner == uid => {
+                    removed_groups_id.push(*gid);
+                }
+                GroupType::Private { .. } => {
+                    group.members.remove(&uid);
+                    exit_from_private_group.push((*gid, group.members.clone()));
+                }
+            }
+        }
+
+        for gid in &removed_groups_id {
+            removed_groups.extend(cache.groups.remove(gid).map(|group| (*gid, group)));
+        }
+        for user in cache.users.values_mut() {
+            user.read_index_user.remove(&uid);
+        }
+        for user in cache.users.values_mut() {
+            for gid in &removed_groups_id {
+                user.read_index_group.remove(gid);
+            }
+        }
+
+        // broadcast event
+        if let Some(log_id) = log_id {
+            let _ = self
+                .event_sender
+                .send(Arc::new(BroadcastEvent::UserLog(UserUpdateLog {
+                    log_id,
+                    action: UpdateAction::Delete,
+                    uid,
+                    email: None,
+                    name: None,
+                    gender: None,
+                    language: None,
+                    is_admin: None,
+                    is_bot: None,
+                    avatar_updated_at: None,
+                })));
+
+            for (gid, group) in removed_groups {
+                let _ = self
+                    .event_sender
+                    .send(Arc::new(BroadcastEvent::KickFromGroup {
+                        targets: group.members.iter().copied().collect(),
+                        gid,
+                        reason: KickFromGroupReason::GroupDeleted,
+                    }));
+            }
+
+            for (gid, members) in exit_from_private_group {
+                let _ = self
+                    .event_sender
+                    .send(Arc::new(BroadcastEvent::UserLeavedGroup {
+                        targets: members,
+                        gid,
+                        uid: vec![uid],
+                    }));
+            }
+
+            for gid in exit_from_public_group {
+                let _ = self
+                    .event_sender
+                    .send(Arc::new(BroadcastEvent::UserLeavedGroup {
+                        targets: cache.users.keys().copied().collect(),
+                        gid,
+                        uid: vec![uid],
+                    }));
+            }
+        }
+
+        Ok(())
+    }
+}
+
+pub(crate) async fn send_mail(
+    smtp_config: &SmtpConfig,
+    to: impl AsRef<str>,
+    subject: impl Into<String>,
+    content: impl Into<String>,
+) -> anyhow::Result<()> {
+    use lettre::AsyncTransport;
+
+    let msg = lettre::Message::builder()
+        .from(smtp_config.from.parse()?)
+        .reply_to(smtp_config.from.parse()?)
+        .to(to.as_ref().parse()?)
+        .subject(subject)
+        .multipart(
+            lettre::message::MultiPart::alternative().singlepart(
+                lettre::message::SinglePart::builder()
+                    .header(lettre::message::header::ContentType::TEXT_HTML)
+                    .body(content.into()),
+            ),
+        )?;
+    let creds = lettre::transport::smtp::authentication::Credentials::new(
+        smtp_config.username.clone(),
+        smtp_config.password.clone(),
+    );
+
+    let port = smtp_config.port.unwrap_or(465);
+    tracing::info!(
+        host = smtp_config.host.as_str(),
+        port = port,
+        from = smtp_config.from.as_str(),
+        to = to.as_ref(),
+        "send mail"
+    );
+
+    let mailer = lettre::AsyncSmtpTransport::<lettre::Tokio1Executor>::relay(&smtp_config.host)?
+        .port(port)
+        .credentials(creds)
+        .build();
+
+    if cfg!(not(test)) {
+        mailer.send(msg).await?;
+    }
+    Ok(())
+}
+
+pub async fn get_frontend_url(state: &State, req: &Request) -> String {
+    let frontend_url = state
+        .get_dynamic_config_instance::<FrontendUrlConfig>()
+        .await
+        .and_then(|config| config.url.clone())
+        .or_else(|| {
+            if !state.config.network.frontend_url.is_empty() {
+                Some(state.config.network.frontend_url.clone())
+            } else {
+                None
+            }
+        });
+
+    if let Some(frontend_url) = frontend_url {
+        frontend_url
+    } else {
+        let tls_on = state.config.network.tls.is_some();
+        let host = state
+            .config
+            .network
+            .domain
+            .get(0)
+            .cloned()
+            .unwrap_or_else(|| {
+                let mut host = req
+                    .header("Authority")
+                    .map(|v| v.to_string())
+                    .unwrap_or_else(|| {
+                        req.header("Host")
+                            .map(|v| v.to_string())
+                            .unwrap_or_default()
+                    });
+                if host.is_empty() {
+                    host = if state.config.network.domain.is_empty() {
+                        state
+                            .config
+                            .network
+                            .bind
+                            .clone()
+                            .replace("0.0.0.0", "localhost")
+                    } else {
+                        format!(
+                            "{}:{}",
+                            state
+                                .config
+                                .network
+                                .domain
+                                .get(0)
+                                .map(|v| v.to_string())
+                                .unwrap_or_default(),
+                            &state.config.network.bind
+                                [state.config.network.bind.find(':').unwrap_or_default() + 1..]
+                        )
+                    };
+                }
+                host
+            });
+        format!("{}://{}", if tls_on { "https" } else { "http" }, &host)
+    }
+}
+
+fn clean_file_dir(now: NaiveDate, path: &Path, expiry_days: i64) {
+    let mut remove_dirs = Vec::new();
+    let mut iter = WalkDir::new(path).into_iter();
+
+    while let Some(Ok(entry)) = iter.next() {
+        let entry_path = entry.path();
+        if !entry_path.is_dir() {
+            continue;
+        }
+
+        if let Ok(p) = entry_path.strip_prefix(path) {
+            if let Some(date) = p
+                .to_str()
+                .map(|name| name.split(std::path::MAIN_SEPARATOR).collect_vec())
+                .filter(|s| s.len() == 3)
+                .and_then(|s| {
+                    let year = s[0].parse::<i32>().ok();
+                    let month = s[1].parse::<u32>().ok();
+                    let day = s[2].parse::<u32>().ok();
+                    match (year, month, day) {
+                        (Some(year), Some(month), Some(day)) => Some((year, month, day)),
+                        _ => None,
+                    }
+                })
+                .and_then(|(y, m, d)| NaiveDate::from_ymd_opt(y, m, d))
+            {
+                if (now - date).num_days() > expiry_days {
+                    remove_dirs.push(entry_path.to_path_buf());
+                }
+            }
+        }
+    }
+
+    for p in remove_dirs {
+        let _ = std::fs::remove_dir_all(p);
+    }
+}
+
+pub(crate) async fn forward_chat_messages_to_webhook(state: State) {
+    let client = Client::new();
+    let mut rx = state.event_sender.subscribe();
+
+    while let Ok(event) = rx.recv().await {
+        if let BroadcastEvent::Chat { targets, message } = &*event {
+            if !matches!(
+                &message.payload.detail,
+                MessageDetail::Normal(_) | MessageDetail::Reply(_)
+            ) {
+                continue;
+            }
+
+            let webhook_urls = state
+                .cache
+                .read()
+                .await
+                .users
+                .iter()
+                .filter_map(|(uid, user)| {
+                    if !targets.contains(uid) {
+                        None
+                    } else {
+                        user.webhook_url.as_ref().cloned()
+                    }
+                })
+                .collect::<Vec<_>>();
+            let msg_json = message.to_json_string();
+
+            for webhook_url in webhook_urls {
+                let client = client.clone();
+                let msg_json = msg_json.clone();
+
+                tokio::spawn(async move {
+                    for _ in 0..3 {
+                        if client
+                            .post(&webhook_url)
+                            .header("content-type", "application/json")
+                            .body(msg_json.clone())
+                            .send()
+                            .await
+                            .and_then(|resp| resp.error_for_status())
+                            .is_ok()
+                        {
+                            break;
+                        }
+                        tokio::time::sleep(Duration::from_secs(1)).await;
+                    }
+                });
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{path::Path, time::Duration};
+
+    use chrono::NaiveDate;
+    use itertools::Itertools;
+    use serde_json::json;
+
+    use crate::{state::clean_file_dir, test_harness::TestServer, State};
+
+    #[tokio::test]
+    async fn test_clean_mute() {
+        let server = TestServer::new().await;
+        let admin_token = server.login_admin().await;
+        let uid1 = server.create_user(&admin_token, "user1@voce.chat").await;
+
+        let resp = server
+            .post("/api/group")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "name": "test",
+                "members": [uid1]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        let json = resp.json().await;
+        let gid = json.value().object().get("gid").i64();
+
+        // mute uid1 and token1
+        let resp = server
+            .post("/api/user/mute")
+            .header("X-API-Key", &admin_token)
+            .body_json(&json!({
+                "add_users": [{
+                    "uid": uid1,
+                    "expired_in": 6,
+                }],
+                "add_groups": [{
+                    "gid": gid,
+                    "expired_in": 3,
+                }]
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+
+        async fn check(state: &State, mut items: Vec<(i64, Vec<i64>, Vec<i64>)>) {
+            // check in cache
+            let cache = state.cache.read().await;
+
+            for (uid, users, groups) in &mut items {
+                let mut exists_users = cache
+                    .users
+                    .get(uid)
+                    .unwrap()
+                    .mute_user
+                    .keys()
+                    .copied()
+                    .collect_vec();
+                let mut exists_groups = cache
+                    .users
+                    .get(uid)
+                    .unwrap()
+                    .mute_group
+                    .keys()
+                    .copied()
+                    .collect_vec();
+
+                users.sort_unstable();
+                groups.sort_unstable();
+                exists_users.sort_unstable();
+                exists_groups.sort_unstable();
+
+                assert_eq!(users, &exists_users);
+                assert_eq!(groups, &exists_groups);
+            }
+
+            for (uid, users, groups) in &items {
+                let mute = sqlx::query_as::<_, (Option<i64>, Option<i64>)>(
+                    "select mute_uid, mute_gid from mute where uid = ?",
+                )
+                .bind(uid)
+                .fetch_all(&state.db_pool)
+                .await
+                .unwrap();
+
+                let mut exists_users = Vec::new();
+                let mut exists_groups = Vec::new();
+
+                for (uid, gid) in mute {
+                    match (uid, gid) {
+                        (Some(uid), None) => {
+                            exists_users.push(uid);
+                        }
+                        (None, Some(gid)) => {
+                            exists_groups.push(gid);
+                        }
+                        _ => {}
+                    }
+                }
+
+                exists_users.sort_unstable();
+                exists_groups.sort_unstable();
+                assert_eq!(users, &exists_users);
+                assert_eq!(groups, &exists_groups);
+            }
+        }
+
+        server.state().clean_mute().await;
+        check(server.state(), vec![(1, vec![uid1], vec![gid])]).await;
+
+        tokio::time::sleep(Duration::from_secs(4)).await;
+        server.state().clean_mute().await;
+        check(server.state(), vec![(1, vec![uid1], vec![])]).await;
+
+        tokio::time::sleep(Duration::from_secs(3)).await;
+        server.state().clean_mute().await;
+        check(server.state(), vec![]).await;
+    }
+
+    #[test]
+    fn test_clear_file_dir() {
+        fn create_dirs(path: &Path, dirs: &[i32]) {
+            for d in dirs.iter().copied() {
+                let year = d / 10000;
+                let month = d / 100 % 100;
+                let day = d % 100;
+
+                let dpath = path
+                    .join(format!("{}", year))
+                    .join(format!("{}", month))
+                    .join(format!("{}", day));
+                let _ = std::fs::create_dir_all(dpath);
+            }
+        }
+
+        fn check_dirs(path: &Path, dirs: &[(i32, bool)]) {
+            for (d, exists) in dirs.iter().copied() {
+                let year = d / 10000;
+                let month = d / 100 % 100;
+                let day = d % 100;
+
+                let dpath = path
+                    .join(format!("{}", year))
+                    .join(format!("{}", month))
+                    .join(format!("{}", day));
+                assert_eq!(
+                    dpath.exists(),
+                    exists,
+                    "{}-{}-{} = {}",
+                    year,
+                    month,
+                    day,
+                    exists
+                );
+            }
+        }
+
+        let path = tempfile::tempdir().unwrap();
+        let dirs = vec![
+            20220101, 20220102, 20220103, 20220104, 20220105, 20220106, 20220107, 20220108,
+        ];
+        create_dirs(path.path(), &dirs);
+
+        clean_file_dir(
+            NaiveDate::from_ymd_opt(2022, 1, 10).unwrap(),
+            path.path(),
+            7,
+        );
+        check_dirs(
+            path.path(),
+            &[
+                (20220101, false),
+                (20220102, false),
+                (20220103, true),
+                (20220104, true),
+                (20220105, true),
+                (20220106, true),
+                (20220107, true),
+                (20220108, true),
+            ],
+        );
+
+        clean_file_dir(
+            NaiveDate::from_ymd_opt(2022, 1, 12).unwrap(),
+            path.path(),
+            7,
+        );
+
+        check_dirs(
+            path.path(),
+            &[
+                (20220103, false),
+                (20220104, false),
+                (20220105, true),
+                (20220106, true),
+                (20220107, true),
+                (20220108, true),
+            ],
+        );
+    }
+}
diff --git a/src/test_harness.rs b/src/test_harness.rs
new file mode 100644
index 0000000..c8d0e49
--- /dev/null
+++ b/src/test_harness.rs
@@ -0,0 +1,311 @@
+use std::{ops::Deref, path::Path, sync::Arc};
+
+use futures_util::{stream::BoxStream, StreamExt};
+use poem::{
+    endpoint::BoxEndpoint,
+    test::{TestClient, TestJson},
+    EndpointExt,
+};
+use serde_json::json;
+use sqlx::{migrate::MigrateDatabase, Sqlite, SqlitePool};
+use tempfile::TempDir;
+
+use crate::{
+    api::{CurrentUser, LoginConfig, WhoCanSignUp},
+    config::{NetworkConfig, SystemConfig},
+    create_user::{CreateUser, CreateUserBy},
+    server::MIGRATOR,
+    state::DynamicConfigEntry,
+    Config, State,
+};
+
+pub struct TestServer {
+    _tempdir: TempDir,
+    state: State,
+    client: TestClient<BoxEndpoint<'static>>,
+}
+
+impl Deref for TestServer {
+    type Target = TestClient<BoxEndpoint<'static>>;
+
+    fn deref(&self) -> &Self::Target {
+        &self.client
+    }
+}
+
+impl TestServer {
+    pub async fn new() -> Self {
+        Self::new_with_config(|_| {}).await
+    }
+
+    pub async fn new_with_config<F: FnOnce(&mut Config)>(f: F) -> Self {
+        let tempdir = TempDir::new().unwrap();
+        init_db(tempdir.path()).await;
+
+        // create server
+        let mut cfg = Config {
+            system: SystemConfig {
+                data_dir: tempdir.path().to_path_buf(),
+                token_expiry_seconds: 60,
+                refresh_token_expiry_seconds: 60 * 60,
+                magic_token_expiry_seconds: 60 * 15,
+                upload_avatar_limit: 1024 * 1024,
+                send_image_limit: 1024 * 1024,
+                upload_timeout_seconds: 300,
+                file_expiry_days: 30 * 3,
+                max_favorite_archives: 100,
+            },
+            network: NetworkConfig {
+                domain: Vec::new(),
+                bind: "127.0.0.1:3000".to_string(),
+                tls: None,
+                frontend_url: "http://127.0.0.1:3000".to_string(),
+            },
+            template: Default::default(),
+            users: vec![],
+            webclient_url: None,
+            offical_fcm_config: Default::default(),
+        };
+        f(&mut cfg);
+        let state = crate::server::create_state(tempdir.path(), Arc::new(cfg))
+            .await
+            .unwrap();
+        crate::license::load_license(&state).await.unwrap();
+        state
+            .set_dynamic_config(DynamicConfigEntry {
+                enabled: true,
+                config: LoginConfig {
+                    who_can_sign_up: WhoCanSignUp::EveryOne,
+                    guest: true,
+                    password: true,
+                    magic_link: true,
+                    google: true,
+                    github: true,
+                    oidc: vec![],
+                    metamask: true,
+                    third_party: true,
+                },
+            })
+            .await
+            .unwrap();
+        let app = crate::server::create_endpoint(state.clone()).await;
+
+        state
+            .create_user(
+                CreateUser::new(
+                    "admin",
+                    CreateUserBy::Password {
+                        email: "admin@voce.chat",
+                        password: "123456",
+                    },
+                    false,
+                )
+                .gender(1)
+                .set_admin(true),
+            )
+            .await
+            .unwrap();
+
+        Self {
+            _tempdir: tempdir,
+            state,
+            client: TestClient::new(app.map_to_response().boxed())
+                .default_content_type("application/json"),
+        }
+    }
+
+    pub fn state(&self) -> &State {
+        &self.state
+    }
+
+    pub async fn parse_token(&self, token: impl AsRef<str>) -> CurrentUser {
+        rc_token::parse_token(
+            &self.state.key_config.read().await.server_key,
+            token.as_ref(),
+            true,
+        )
+        .unwrap()
+        .1
+    }
+
+    pub async fn login(&self, email: impl AsRef<str>) -> String {
+        self.login_with_device(email, "iphone").await
+    }
+
+    pub async fn login_with_device(
+        &self,
+        email: impl AsRef<str>,
+        device: impl AsRef<str>,
+    ) -> String {
+        let resp = self
+            .client
+            .post("/api/token/login")
+            .header("Referer", "http://localhost/")
+            .body_json(&json!({
+                "credential": {
+                    "type": "password",
+                    "email": email.as_ref(),
+                    "password": "123456"
+                },
+                "device": device.as_ref(),
+                "device_token": "test",
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json()
+            .await
+            .value()
+            .object()
+            .get("token")
+            .string()
+            .to_string()
+    }
+
+    pub async fn login_admin(&self) -> String {
+        self.login("admin@voce.chat").await
+    }
+
+    pub async fn login_admin_with_device(&self, device: impl AsRef<str>) -> String {
+        self.login_with_device("admin@voce.chat", device).await
+    }
+
+    pub async fn create_user(&self, token: impl AsRef<str>, email: impl AsRef<str>) -> i64 {
+        let resp = self
+            .client
+            .post("/api/admin/user")
+            .header("X-API-Key", token.as_ref())
+            .header("Referer", "http://localhost/")
+            .body_json(&json!({
+                "email": email.as_ref(),
+                "password": "123456",
+                "name": email.as_ref(),
+                "gender": 1,
+                "language": "en-US",
+                "is_admin": false,
+            }))
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json().await.value().object().get("uid").i64()
+    }
+
+    pub async fn send_text_to_user(
+        &self,
+        token: impl AsRef<str>,
+        uid: i64,
+        text: impl Into<String>,
+    ) -> i64 {
+        let resp = self
+            .client
+            .post(format!("/api/user/{}/send", uid))
+            .header("X-API-Key", token.as_ref())
+            .header("Referer", "http://localhost/")
+            .content_type("text/plain")
+            .body(text.into())
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json().await.value().i64()
+    }
+
+    pub async fn send_text_to_group(
+        &self,
+        token: impl AsRef<str>,
+        gid: i64,
+        text: impl Into<String>,
+    ) -> i64 {
+        let resp = self
+            .client
+            .post(format!("/api/group/{}/send", gid))
+            .header("X-API-Key", token.as_ref())
+            .header("Referer", "http://localhost/")
+            .content_type("text/plain")
+            .body(text.into())
+            .send()
+            .await;
+        resp.assert_status_is_ok();
+        resp.json().await.value().i64()
+    }
+
+    pub async fn get_group(&self, gid: i64) -> TestJson {
+        let resp = self.get(format!("/api/group/{}", gid)).send().await;
+        resp.assert_status_is_ok();
+        resp.json().await
+    }
+
+    async fn internal_subscribe_events(
+        &self,
+        token: impl AsRef<str>,
+        filters: Option<&[&str]>,
+        after_mid: Option<i64>,
+        users_version: Option<i64>,
+    ) -> BoxStream<'static, TestJson> {
+        let mut builder = self
+            .client
+            .get("/api/user/events")
+            .query("api-key", &token.as_ref())
+            .header("Referer", "http://localhost/")
+            .header("Connection", "keep-alive")
+            .content_type("text/event-stream");
+        if let Some(after_mid) = after_mid {
+            builder = builder.query("after_mid", &after_mid);
+        }
+        if let Some(users_version) = users_version {
+            builder = builder.query("users_version", &users_version);
+        }
+        let resp = builder.send().await;
+        resp.assert_status_is_ok();
+        let mut stream = resp.json_sse_stream().boxed();
+        if let Some(filters) = filters {
+            let filters = filters.iter().map(ToString::to_string).collect::<Vec<_>>();
+            stream = stream
+                .filter(move |json| {
+                    futures_util::future::ready(
+                        filters
+                            .iter()
+                            .any(|filter| filter == json.value().object().get("type").string()),
+                    )
+                })
+                .boxed();
+        }
+        stream
+    }
+
+    pub async fn subscribe_events_with_users_version(
+        &self,
+        token: impl AsRef<str>,
+        filters: Option<&[&str]>,
+        users_version: i64,
+    ) -> BoxStream<'static, TestJson> {
+        self.internal_subscribe_events(token, filters, None, Some(users_version))
+            .await
+    }
+
+    pub async fn subscribe_events(
+        &self,
+        token: impl AsRef<str>,
+        filters: Option<&[&str]>,
+    ) -> BoxStream<'static, TestJson> {
+        self.internal_subscribe_events(token, filters, None, None)
+            .await
+    }
+
+    pub async fn subscribe_events_after_mid(
+        &self,
+        token: impl AsRef<str>,
+        filters: Option<&[&str]>,
+        after_mid: Option<i64>,
+    ) -> BoxStream<'static, TestJson> {
+        self.internal_subscribe_events(token, filters, after_mid, None)
+            .await
+    }
+}
+
+async fn init_db(path: &Path) {
+    std::fs::create_dir(path.join("db")).unwrap();
+    let dsn = format!("sqlite:{}", path.join("db").join("db.sqlite").display());
+    Sqlite::create_database(&dsn).await.unwrap();
+    let db = SqlitePool::connect(&dsn).await.unwrap();
+    MIGRATOR.run(&db).await.unwrap();
+}